WO2011039371A1

WO2011039371A1 - Crosswise alignment of typing behaviour for authenticating and/or identifying a person

Info

Publication number: WO2011039371A1
Application number: PCT/EP2010/064696
Authority: WO
Inventors: Markus Wagenhofer; Andreas Beer; Sebastian Erdenreich; Johann Schenkl
Original assignee: Psylock Gmbh
Priority date: 2009-10-02
Filing date: 2010-10-01
Publication date: 2011-04-07
Also published as: DE102009044173A1

Abstract

The present invention relates to a method for authenticating and/or identifying a person using the typing behaviour on a keyboard and also to a corresponding apparatus, wherein the method comprises: - registration of a person, which involves at least one registration typing sample being captured and being stored under an identifier, - creation of a registration profile on the basis of the registration typing sample submitted during registration, and storage of the registration profile under the identifier, - submission of at least one logon typing sample during logon for authentication and/or identification purposes, - creation of a logon profile on the basis of the logon typing sample submitted during logon, and - crosswise alignment of the logon typing sample with the registration profile and of the registration typing sample with the logon profile.

Description

CROSS-REFERENCE COMPARISON OF TIP BEHAVIOR DATA FOR AUTHENTICATION AND / OR IDENTIFICATION OF A PERSON BACKGROUND OF THE INVENTION

FIELD OF THE INVENTION

The present invention relates to a method for authentication and / or identification of a person by means of the typing behavior on a keyboard as well as a device which is thus prepared and / or comprises a program code processable by a data processing system, so that a corresponding method can be performed.

STATE OF THE ART

The prior art discloses methods and devices for identifying and / or authenticating persons who use the typing behavior of the person to be authenticated or identified on a keyboard. Examples are given in WO 98/06020 A2 or US Pat. No. 6,151,593.

Although very good results are already obtained by means of these methods and devices, there is a continuing need to increase the safety and reliability of such systems and devices and to improve the comfort for the user by the possibility of entering short typing sequences. Here, however, is problematic that such goals are actually incompatible, since a high recognition security is usually associated with a long typing sequence, so for example, the input of a very long text. However, this reduces the convenience for the user, since he does not want to enter overlong texts during authentication and / or identification. DISCLOSURE OF THE INVENTION

OBJECT OF THE INVENTION ...

It is therefore an object of the present invention to provide a method and a device for authentication and / or identification of a person on the basis of their typing behavior, which agreed on the contrary objectives of high security and reliability on the one hand and a convenient use on the other hand.

TECHNICAL SOLUTION

This object is achieved by a method having the features of claim 1 and a device having the features of claim 10. Advantageous embodiments are the subject of the dependent claims.

According to the present invention, a method for authenticating and / or identifying a person by means of the typing behavior on a keyboard is specified, in which when registering a person in a corresponding system a registration sample is detected and recorded under the identity of the person, ie, for example corresponding identifier is stored. From the at least one registration sample a registration profile is created and also stored under the identifier or identity. If a user of a system equipped with the invention wishes to log on to the system later, he / she must submit at least one log-in sample for authentication and / or identification during the log-in, from which in turn a log-on profile is created. Identification and / or authentication is accomplished by cross-checking the logon tip sample with the registration profile and the registration tip sample with the logon profile. This cross-matching can increase recognition performance and thus make authentication and / or identification more secure without unnecessarily long tipping samples.

The detection of the typing behavior necessary in the method according to the invention can be carried out on a conventional computer keyboard in which corresponding data about the pressing and releasing of the keys, in particular the times of pressing and / or releasing a key or the holding time of a key, are detected become. In addition to such conventional keyboards, of course, all other input devices are used in which corresponding touches are triggered by a user, such as touch-sensitive screens on which, for example, a keyboard can be represented by software, or other touch-sensitive surfaces. In particular, it is also sufficient to use a single touch-sensitive surface in which, for example, a certain sequence of touches takes place, such as a Morse code.

The authentication means that in a corresponding system, e.g. a personal computer or a network of several personal computers, a specific user is detected and known and the user also logs on to the system under his corresponding identity or identifier. The authentication thus only checks whether the given person actually agrees with the person who has been registered.

In the identification of a person is in the corresponding system, ie the computer system or a corresponding network, also a registration for the user before, but the user does not reveal his identity when logging, but the system can the user on the basis of typed typing data independently recognize, so identify.

When registering a user in the system, ie the first-time registration, at least one registration sample is recorded according to the present invention and a corresponding registration profile is created therefrom. Both the registration profile and the registration sample, ie the corresponding raw tip data, are stored under the identity or identification of the registered person.

When the user logs on for later use of the system, the user must also submit at least one log-in sample from which a log-on profile is created in accordance with the registration profile. In the case of crosswise matching, the logon tip sample is now compared with the registration profile and the registration tip sample with the logon profile, so that at least two adjustment values or match values can be determined. The resulting higher number of match values already gives a higher accuracy of recognition.

This can be further increased by increasing the number of registration tip samples or application tip samples, so that in an advantageous embodiment at least two registration tip samples and at least two application tip samples are detected. These tipping samples may be submitted by separate entry procedures or by a single entry The input process can be divided into two or more taps so that multiple taps are created.

A further increase in the recognition performance can be achieved in that the at least two or more registration tip samples and / or logon tip samples comprise the same text or at least the same text components. For example, the user may be asked to enter a password two or more times, so that at least two or more login taps samples with the same text are recorded by repeatedly entering the same text, at least two or more registration tip samples at registration, and at registration ,

This also shows that, in addition to the cross-matching method according to the invention, other authentication and / or identification means can also be used, such as e.g. the entry of passwords and the like. In particular, the present method offers a possibility of connecting such authentication and / or identification measures with the method according to the invention in a simple manner without incurring additional expenditure.

With two or more registration tip samples and / or logon tip samples, a corresponding number of matches can be made with the registration profile or login profile. Thus, for two registration tip samples and two logon tip samples, a total of four matches can be made, that is, two times a match of the logon tip samples to the registration profile and two times a match of the registration tip samples to the login profile. At each match, a match score may be formed that is used to determine whether the identification and / or authentication was successful or not.

In particular, from the plurality of match values, a match end value may be formed, e.g. by appropriate mathematical methods, such as averaging or the like.

The match end value or individual match values from the various matchings may be compared to a threshold, or it may be checked whether those match values are within a certain predetermined range. When creating the registration and / or registration profile, at least one characteristic feature can be determined from the raw tip data obtained during the key actuation. Such characteristic features of the key operation or the typing behavior can be formed by the holding time of a specific key or different keys or corresponding average values. In addition, it is also possible transition periods from releasing one, in particular a specific key, or all keys as an average value until pressing the next key, and transition periods of releasing a key to release the next key or the transition periods from pressing a key to press next key. These features can all be related to specific keys or key sequences, or determined as averages for all keystrokes. In addition, the error frequency or error frequency can be detected, ie the fact how often and in which intervals the user has to correct his inputs. In addition, the tip rate, ie the ratio of the number of typed characters to the duration or the attack frequency can be determined as a feature. Likewise, simple or multiple overhauls, that is, the actuation of the next key prior to releasing the previous key, the frequency of use of certain function keys, the selection of alternative keys, such as the selection of the left or right font keys, and the like, may be taken as features , Also temporal key-related abnormalities, such as particularly long transition periods after pressing a particular key or special location-related features that take into account the local position of the actuated keys, can also be used. All features can be combined with each other to form new features, or statistical characteristics can be determined from them as features.

Corresponding profiles, that is to say registration and / or login profiles, can be generated from the features, wherein corresponding values of the profile can be determined from the generated features by mathematical functions, for example by forming average values, sums or the like. However, the profiles may also include corresponding feature fields and / or feature vectors that characterize the typing behavior.

When comparing the jog samples with the profiles, ie the registration and / or login profiles, match values can be compared by comparing a jog sample with the corresponding be generated profile. A comparison or comparison can be performed by mathematical functions or algorithms. For example, a field of feature vectors or a corresponding feature matrix of a plurality of tipping samples can be compared with a feature vector of a single tipping sample, or a suitable matching value can be formed. Alternatively, it is also possible to form average values from several characteristics of different tipping samples, which are then compared with the characteristics of a single tip sample. Further comparable matching methods are additionally conceivable. BRIEF DESCRIPTION OF THE FIGURES

Further advantages, characteristics and features of the present invention will become apparent in the following detailed description of embodiments with reference to the accompanying drawings. The drawings show this in a purely schematic way in

Fig. 1 is an illustration of a personal computer to which the present invention is implemented;

FIG. 2 shows a representation of the method steps of the method according to the invention; FIG.

Fig. 3 is an illustration of the structure of a Tippverhaltensprofils and a corresponding

Comparing the typing behavior profile with typing data according to a first example; and in

4 shows a representation of a typographical profile and the comparison with a tip sample according to a second exemplary embodiment of the invention.

EMBODIMENTS

FIG. 1 shows a conventional PC (personal computer) 1 equipped with a screen 2 and a keyboard 3. In order to personalize the access of a user to the PC 1 and any network connected to it or to allow access only to certain persons, an authentication and / or identification routine can be executed when starting the PC 1. Authentication requires the user to prove that he or she is the default user. He logs with an identification information or identifier, which may be given for example by his name, in the system and the system must now determine by an appropriate authentication routine, if the given user matches the registered users. In an identification routine, the PC system 1 can independently identify the user, for example, using a database with registered users, without the user himself having to specify his identity, ie his identification information or identifier.

In the method according to the invention or the corresponding device, such as a PC system 1, in which the method according to the invention is implemented, the authentication and / or identification is based on biometric data which are obtained from the typing behavior of the user. In addition, however, further authentication and / or identification measures can be carried out. Thus, for example, the input of a password can contribute to the identification or authentication on the one hand by checking the password, and on the other hand the method according to the invention can be used on the basis of the biometric data of the typing behavior obtained when the password is entered.

Accordingly, it is shown in FIG. 1 that, for example, in the case of the authentication and / or identification routine, twice an identical text, for example a password, has to be entered into the keyboard 3. In the exemplary embodiment shown in FIG. 1, this is the password "London".

Instead of the keyboard 3 shown in Figure 1, of course, all other input devices in which an actuation of a button, a switch, a touchpad or other touch-sensitive surface is required, also suitable as input devices. For example, the password may also be entered via a touch-sensitive screen, or a single touch-sensitive panel or switches may be used in which actuation occurs at a particular rhythm, e.g. with a Morse code.

According to the inventive method, when registering on the PC system 1, the user first typed twice the text, for example the password "London", whereby both the typing samples have been stored as registration spam samples and a registration profile generated from the typing samples has been stored is. 2, the subsequent log-on to the system requires in turn the input of the password "London." From these tips or log sample samples, a profile, namely the log-on profile, is again created delivered tip samples with the cast at the registration tip samples is computed such that on the one hand the stored discharged during the registration tip samples S _s roi ι and S _s roi 2 (enroll for enrollment (registration)) with the logon tip samples Si _og i _n 1 and Si ₀ gi _{n 2} (login for application) created profile P _log are compared in and at which the registration tip samples S] _0g in 1 and Si _og j _{n 2} with the products manufactured from the registration tip samples Senroi l and S _s roi 2 registration profile P _enr oi be synchronized. Accordingly, a cross-check takes place and there are generated a total of four match scores (match score) MSi to MS _4. The Übere instimmungswert MSj is, for example, determined during the adjustment of the tip sample S _s roi 1 with the login profile P _log i _n, while the match value MS ₂ from the adjustment of the registration sample S _s roi 2 with the login profile Pi _og i _n is generated. The matching values MS ₃ and MS ₄ are then determined correspondingly from the comparison of the _log- in _{tip samples} S _log i _n 1 and Si _og in _FIG . 2, each with the registration _profile P _enr oi. From the thus determined match values MS 1 to MS ₄ , a match end value MS _{ges is} generated, which serves to determine whether the authentication and / or identification was successful or not. For example, the compliant _final score MS _ges must be within certain limits to result in successful authentication and / or identification of the user at the PC system 1. By the crosswise comparison of the typed in the registration tipps, so the registration tip samples, with the registration profile generated from the Anmeldippproben and the matching of the typed in the registration tipps, so Anmierungsippproben, with the registration profile generated during registration, the security and performance of the authentication and / or identification can be significantly improved. In particular, a further increase can be achieved by using a plurality of identical tap samples, such as in the exemplary embodiment in which the identical tap samples are dispensed twice with respect to the password "London." Figures 3 and 4 illustrate the procedure for matching the tap samples with the profiles and the structure of the profiles generated from the tipproh data.

FIG. 3 shows a first exemplary embodiment in which a feature vector Vi is formed from the raw tip data, which are recorded, for example, when the password "London" is tapped. which comprises the three features M1, M2 and M3. The features may include, for example, the determined holding duration of a key in the form of an average value, the average transition duration from releasing a key to press the next key, and the transition duration from pressing a key to pressing the next key or the like.

The profile P comprises the feature vectors Vj and V ₂ which are generated when the password "London" is typed in. For example, the feature vector Vi comprises features M1, M2 and M3 which are determined when the password "London" is typed for the first time as features Mi i, M _2] and M31. The feature vector V ₂ accordingly comprises the features Mj ₂ , M ₂₂ and M ₃₂ , which were determined on the second input of the password "London".

As shown in the diagram of FIG. 3, the corresponding feature vectors Vi and V _{2 represent} a point in the three-dimensional vector space corresponding to the features Mi, M ₂

By means of the feature vectors Vi and V ₂ , a feature space R can be defined, which is defined for example by the relationship of the feature vectors V) and V ₂ to one another. The feature space R can be defined as the set of all points that is defined within a sphere around the feature vector Vj and V ₂ according to the distance of the feature vectors Vi and V ₂ .

During the comparison, it can now be checked whether a feature vector S, which comprises the corresponding features S1, S2 and S3, which are generated from the log-in tip samples in the log-on procedure, lies in the feature space R. The position of the feature vector S in the feature space R can be described by a match value MS. From a plurality of match values MSi to MS _n , a match end value MS _ges can be determined by means of which it can be decided whether the authentication and / or identification could be successfully completed. In the exemplary embodiment of FIG. 3, the profile is defined by a feature vector field or a feature space R generated therefrom.

In the embodiment shown in FIG. 4, a single feature vector from the average values of the detected features is used as profile P. Here- For example, the average values from the two jog samples are formed in the input of the word "London" as shown in Fig. 4. Accordingly, the features Mi i and Mi 2 as well as the features M ₂ i and M ₂₂ and the features M ₃ j and M ₃₂ used for the formation of average values. the comparison with a feature vector S is carried here- in relation to the profile vector P by a simple vector comparison, it being shown as a matching value MS of the difference vector between the feature vector S and the profile P.

Although the present invention has been described in detail with reference to the illustrated embodiments, it will be understood by those skilled in the art that the invention is not limited to this embodiment, but that they are merely illustrative and the invention may include modifications that omit individual features or otherwise combining the features presented without departing from the scope of the appended claims. In particular, the present invention includes all combinations of all features presented.

Claims

, WO 2011/039371 PCT / EP2010 / 064696 Claims

A method of authenticating and / or identifying a person by typing on a keyboard, the method comprising:

Registration of a person in which at least one registration sample is recorded and stored under an identifier,

- create a registration profile based on the registration tip sample submitted at registration and save the registration profile under the identifier,

- submission of at least one log-in sample during registration for authentication and / or identification,

- Create a login profile based on the registration tip sample submitted at registration, and

- cross-check the logon tip sample with the registration profile and the registration tip sample with the logon profile.

2. The method according to claim 1,

characterized in that

at least two registration tip samples and at least two logon tip samples are submitted or generated from an input.

3. The method according to claim 1 or 2,

characterized in that

at least two registration tip samples and / or at least two logon tip samples with the same text or text components.

4. The method according to any one of claims 2 or 3,

characterized in that

match the number of logon tip samples with the registration profile and the number of registration tip samples with the login profile.

5. Method according to one of the preceding claims,

characterized in that

a match value is determined for each match.

6. The method according to claim 5,

characterized in that

a match end value is formed from a plurality of match values.

7. The method according to claim 6,

characterized in that

the match end value is compared to a threshold.

8. The method according to any one of the preceding claims,

characterized in that

in the creation of the registration and / or registration profile from raw key data obtained at the key actuation, at least one characteristic feature is determined from the group indicating the holding duration of a key, the transition period of releasing a key to press the next key, the transition period of releasing a key - to release the next key, the transition period from pressing a key to press the next key, the error frequency or frequency, the tip rate, the attack frequency, single or multiple overhauls, the frequency of use of certain function keys, the selection of alternative keys, the selection of the left or right shift key, temporal or key-related abnormalities, which are distinguished by exceptional values from the determined data, location-related features, in which the local position of the keys is taken into account, and combinations and statistical characteristics thereof.

9. The method according to any one of the preceding claims,

characterized in that

when generating the registration and / or login profile, the generated features are summarized into averages, sums, or the like, or grouped into feature fields or vectors.

10. Device which is so prepared and / or comprises a processable by a data processing program code, so that a method according to one of the preceding claims is feasible.