6: Signature Recognition and Keystroke Dynamics in Software

Generator Code 128 Code Set C in Software 6: Signature Recognition and Keystroke Dynamics

that may be required in certain sensitive environments Such systems should be marked with banners and notices to inform users that their use is monitored The more nefarious use of keystroke monitoring, also sometimes known as spyware, is to eavesdrop on others The software can capture work, e-mail, chat sessions, and of course passwords Spyware is inexpensive, simple to use, and once installed (deliberately or otherwise), is extremely invasive

The canonical analysis and assessment of using keyboard characteristics to establish identity was a 1980 RAND report3 funded by the National Science Foundation The RAND report used a digraph representation for the keystrokes (discussed later in this chapter) and conducted experiments on a small population of users A relevant general patent was issued that same year to Robert Salem of General Electric Company in New York Although not directly applied to keyboards and user identities, the patent describes a tap-actuated lock and a method of actuating the lock based on tap sequences4 In the early 1980s, a feasibility study was conducted by Stanford Research Institute, and the idea and application of keystroke characteristics was later studied and advanced by many others, notably Leggett and Williams (1988) and Joyce and Gupta (1990) The first patent to apply keyboard patterns specifically for the purpose of identification was entitled Method and apparatus for verifying an individual s identity and was issued to James Young and Robert Hammon of International Bioaccess Systems Corporation of New York5 Filed in 1985 and issued in 1989, the abstract from the patent is quoted here: A device and method for verifying the identity of an individual based on keystroke dynamics comprising a keyboard for the inputting of data in the form of alphanumeric characters by keystrokes, a timing encoder coupled to the keyboard for timing periods between keystrokes, a CPU coupled to RAM and to the timing encoder for generating a template for the individual, the template comprising a first plurality of features based upon a first set of time periods between keystrokes from a first set of keystrokes of the individual and the CPU determining a plurality of extracted features based upon a second set of time periods from a second

R Gaines, W Lisowski, S Press, and N Shapiro, 1980 Authentication by Keystroke Timing, RAND Report R-256-NSF RAND Corporation R Salem, United States Patent No 4,197,524 (issued April 8, 1980) Tap-acuated Lock and Method of Actuating the Lock Washington DC: US Government Printing Office J Young, and R Hammon, United States Patent No 4,805,222 (issued February 14, 1989) Method and Apparatus for Verifying an Individual s Identity Washington DC: US Government Printing Office

set of keystrokes, and comparing the template to the plurality of extracted features such that the identity of the individual may be verified

The most natural application for keystroke dynamics is to harden passwords The keystroke dynamics of each user is used to augment existing passwords by requiring that the password be entered in a manner consistent with the intended user For this purpose, the technique is relatively straightforward to apply and is one of the least expensive biometrics No additional devices need to be purchased, installed, or integrated, and the software itself is reasonably priced The principal disadvantage is that it is not always easy to quantify the security benefit and weigh that benefit against the software cost and the newly introduced possibility of rejecting authorized users A certain percentage of authorized users will experience rejects because they bruised their finger, or because they are weary, ill, or stressed, or they otherwise happen to be having a bad typing day Even so, keystroke dynamics is an elegant addition to system security and increasingly will be available as an option, either as determined by user preference or as part of an organization s security policy In the near future, operating system vendors might well choose to incorporate keystroke dynamics biometrics into their systems to augment existing built-in password policy options Conventional password hardening policies used in some of industry and in many secure environments call for passwords to be selected and administered with some (or all) of the following additional properties: