Freely typed keystroke dynamics-based user authentication for mobile devices based on heterogeneous features

Abstract

Keystroke dynamics-based authentication (KDA) is one of the human behavioral biometric-based user authentication methods based on the unique typing pattern of a person. Previous KDA studies on mobile devices primarily focused on fixed-length text-based KDA, such as passwords and personal identification numbers. This can strengthen the login system and prevent abnormal usage of impostors based on certain attack methods, such as shoulder surfing and smudge attacks. However, this method possesses a limitation that continuous monitoring is not possible after login. To solve this problem, KDA based on freely typed text was studied; however, there are only a few studies on this technique. Further, the performance authentication based on these studies is insufficient for a real-world implementation. In this paper, we propose a novel freely typed text-based KDA method for mobile devices named FACT, i.e., user authentication on mobile devices based on free text, accelerator, coordinate, and time. We collected data from three different smartphone sensors while typing in two languages (English and Korean), and 17 variables were extracted for a set of keystroke data. A total of six authentication methods were employed and the proposed FACT yielded an equal error rate lower than 1% with only one reference keystroke set; moreover, it demonstrated a perfect protection capability while using Korean when more than four reference keystroke sets were used. To contribute to the research and industrial community, we have publicized our collected keystroke dataset so that anyone who conducts a KDA study or develops a KDA-related mobile service can use the dataset without any restrictions. (c) 2020 Elsevier Ltd. All rights reserved.