On the Design of an Authentication System Based on Keystroke Dynamics Using a Predefined Input Text

1. Introduction

At the end of the 19^th century, analyzing the typing behaviour of telegraphers, the discovery was made that each human being has his own pattern when transmitting dots and lines (Bryan & Harter, 1897). Transfer of this observation to typing behaviour on a computer keyboard for the purpose of identifying persons started with (Spillane, 1975). A patent was first time assigned to Garcia (1986) in 1986. Recently, many publications on the subject of authentication based on keystroke dynamics have appeared (Clarke et al., 2003; Cho et al., 2001; Dowland et al., 2002; Furnell & Dowland, 2000; Monrose et al., 2001; Obaidat & Sadoun, 1997). This demonstrates an increasing interest in this biometrical method. The greatest advantage of this kind of biometrics is that no additional hardware is required for its use on a conventional PC or notebook. A standard keyboard takes over the task of a recording sensor. This saves time and costs otherwise needed for purchasing, installing and maintaining additional hardware.

Nevertheless, a breakthrough of keystroke dynamics based biometrics to a broad usage in practice did not yet occur, in spite of intensive research and development efforts. The reasons for this lay in the nature of the typing behaviour itself. An evident problem is the fact that the manner in which a person types is not constant. Typing severely changes depending on the time of day, the individual mood of the user and on external circumstances (e.g. simultaneous telephoning, a change in keyboards etc.). Because of this, the method for successful user authentication using keystroke dynamics has to be, on the one hand, very tolerant towards typing fluctuations of the authorized user, and on the other hand, to reject impostors with a high probability. This apparent antagonism is very difficult to resolve, the most probable way to handle it being the use of a very long text. This, however, would result in an application impracticable in most use cases.

This problem can be eased by methods that take into account the asymmetry between the data captured at enrolment time and that registered at authentication time. The individual traits of keystroke dynamics, e.g. the duration of a stroke or the transition times from one key to the next, can be captured by a statistical model. On enrolment, a long text is typed in. Out of the data collected during enrolment, the method estimates the different parameters of the statistical model. On login, the user only needs to type a short sentence. Asymmetrical methods based on statistical models have the advantage that an arbitrary text may be used. An example for such a method from early literature on keystroke biometrics is the patent script by Young and Hammon (Young & Hammon, 1989).

A more recent example is the method of Bartmann (2000). This method uses stable statistical characteristics in addition to pure keystroke dynamics (Bartmann & Bartmann, 1997). The former characteristics are hardly subject to the daily condition and mood of a user, and are not influenced by external circumstances. These characteristics include the right- or left-handedness of the user or the way he learned to type. Both characteristics influence the way he uses the shift keys. Usually, a shift key is pressed by the “weak” hand and the capital letter by the “strong” one. This fact can be interpreted as right- or left-handedness. If a person is mostly using one shift key, he has probably learned typing by himself, while the interchanging use of both shift keys shows that the user is typing according to the ten finger typing system. Equally, the (rare) use of the numerical pad carries valuable information.