An Application of Biometric Technology: Keystroke Recognition application which requires a lower level of security will permit for some
of security will permit for some differences in the
This article examines biometric technology-Keystroke Recognition. As we possess unique
physiological biometrics, we also possess unique behavioral biometrics-such as the way
we sign our name. The way and the manner in which we type on our computer keyboard
varies from individual to individual, and in fact it is unique enough, it is also considered
to be a behavioral biometric.
This article is composed of the following sections: (1) How Keystroke Recognition Works;
and (2) The Strengths and Weaknesses of Keystroke Recognition.
How Keystroke Recognition Works
In comparison to the other biometric technologies examined, Keystroke Recognition is
probably of the easiest to implement and administer. This is so because at the present
time, Keystoke Recognition is completely a software based solution. There is no need to
install any new hardware. All that is needed is the existing computer and keyboard that
the individual is currently using. There is only one primary vendor for this technology,
and that is BioNet Systems, LLC. The product is called BioPassword.
To start the enrollment process, the individual must type a specific word or group of
words. In most cases, the username and password of the individual is used.
It is very important that this same word or phrasing is used in both the enrollment and
verification processes. Otherwise, the behavioral characteristics of typing will be
significantly different, and as a result, there will be a mismatch between the enrollment
and verification templates.
To create the enrollment template, the individual must type their user name and
password about 15 times. It is highly recommended that the enrollment process occur
over a period of time, rather than at a single point in time. This is so because the
behavioral characteristics will be much more consistent. With Keystroke Recognition, the
individual must type without making any corrections (for example, using the backspace
key to delete any errors). If the individual does make any corrections, the Keystroke
Recognition system will prompt the individual to start completely over again.
The distinctive, behavioral characteristics measured by Keystroke Recognition include:
1. The cumulative typing speed;
2. The time that elapses between consecutive keystrokes;
3. The time that each key is held down;
4. The frequency of the individual in using other keys on the keyboard, such as the
number pad or function keys;
5. The sequence utilized by the individual when attempting to type a capital letter-
for example, does the individual release the shift key or the letter key first?
These behavioral characteristics are then created into statistical profiles, which then
essentially become the enrollment and verification templates. These templates also store
the actual username and password. The statistical profiles can either be global
or local . With a global profile, all of the typing behavioral characteristics
can be combined, or with a local profile, the behavioral characteristics are
measured for each keystroke.
The extent of the statistical correlation between the enrollment and verification templates
can then be subsequently modified, depending upon the security level needed. An
typing behavior. However, an application which requires a higher level of security will not
allow for any differences in the typing behavior.
It is important at this point to make a distinction between static and dynamic keystroke
verification. With the former, verification is established only at certain times, for
example, when the individual logins into their computer. However, with the latter, the
individuals keystroke and typing patterns are recorded during the entire session.
The Strengths and Weaknesses of Keystroke Recognition
Keystroke Recognition possesses a number of strengths and weaknesses. In terms of
strengths, probably the biggest one is that it does not require any additional, specialized
hardware to implement. As stated before, Keystroke Recognition is purely a software
based solution, thus you have the system set up in just a little amount of time. Second,
Keystroke Recognition can be easily integrated with other, existing authentication
processes. The adoption of other biometric technologies reviewed require the
implementation of a new process into an existing one. This requires that individuals must
be properly trained in the use of these new, biometric devices. This can greatly increase
the time spent as well as cost. Third, everybody is familiar with typing their username
and password. As a result, there is very minimal training required in order for an
individual to use a Keystroke Recognition system properly. Fourth, the templates that are
generated by a Keystroke Recognition system are specific only to that username and
password that has been used. Should this username and/or password be tampered with,
the individual just needs to select a new username and password to create a new set of
enrollment and verification templates.
In terms of weaknesses, Keystroke Recognition possesses the same flaws a
username/password system has. For example, passwords can be forgotten or
compromised, and individuals will have to continue to remember multiple passwords in
order to gain access to their company network. It should be noted that Keystroke
Recognition does not ease the burden of having to remember multiple passwords, or
decrease the administrative costs of having to reset passwords. It only enhances the
security to an existing username/password based system. Second, Keystroke Recognition
is still not a proven technology, like other biometric systems, and as a result, has not
been tested in wide scale deployments. Finally, Keystroke Recognition does not enhance
convenience to the individual using the system.
All of the articles written thus far have examined biometric technologies which are in use
today, even though they may not have been widely implemented. Our next series of
articles will examine the Performance Standards used to rate biometric technologies; the
use of Multi-Modal (a two tier system) biometric systems; Single Sign On
Solutions for computer and network security; and the Social Implications of biometric
technologies.
About the Author:
Ravi Das is the President of HTG Solutions (www.htgsolutions.com), a software company
based in Chicago, IL. The company offers a total security solutions, utilizing biometric
technology. The author can be reached at htg@htgsolutions.com June 2004