WO2016045225A1 - 基于鼠标行为的密码容错方法 - Google Patents

基于鼠标行为的密码容错方法 Download PDF

Info

Publication number
WO2016045225A1
WO2016045225A1 PCT/CN2014/095900 CN2014095900W WO2016045225A1 WO 2016045225 A1 WO2016045225 A1 WO 2016045225A1 CN 2014095900 W CN2014095900 W CN 2014095900W WO 2016045225 A1 WO2016045225 A1 WO 2016045225A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
mouse
data
password
login
Prior art date
Application number
PCT/CN2014/095900
Other languages
English (en)
French (fr)
Inventor
蒋昌俊
陈闳中
闫春钢
丁志军
谭正
Original Assignee
同济大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 同济大学 filed Critical 同济大学
Publication of WO2016045225A1 publication Critical patent/WO2016045225A1/zh
Priority to AU2017100409A priority Critical patent/AU2017100409A4/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/316—User authentication by observing the pattern of computer usage, e.g. typical user behaviour

Definitions

  • the invention relates to the field of Internet identity authentication technology.
  • the main purpose of access control is to assign different permissions to different users, so that each user operates the system with their own appropriate permissions.
  • the first and most important step is user authentication. Only when the system determines the identity of the user can the user be assigned the correct permissions and then proceed with subsequent operations.
  • the main user authentication methods include three types: (1) user memory information, such as username/password; (2) auxiliary devices, such as secret security cards, bank cards, etc.; (3) user biometric information, such as fingerprints, etc. .
  • the three methods have their own advantages, but the shortcomings are also obvious.
  • the user name/password is simpler, but the problems such as password forgetting and password leakage make the security and user experience unsatisfactory.
  • the security of the auxiliary device is more secure. High, but when the related auxiliary equipment is lost or stolen, the user information also has the risk of leakage; thus, the authentication method using biological information has emerged, which has high security and reliability, but requires additional equipment support.
  • the first method that is, the use of the username/password is the most extensive, but its disadvantages are also obvious when it is widely used.
  • the illegal user In terms of security, once the password is leaked, the illegal user It can also be authenticated. This mode will not provide any protection for user data.
  • the security problem requires the user to keep their own passwords and change the passwords frequently. Therefore, in terms of security issues, the user's cooperation is required.
  • the user name/password mode itself is difficult to improve, but the user experience problem can be improved from the mode.
  • the shortcomings start with improving the user experience, so the present invention will mainly focus on the improvement of the user experience.
  • the present invention hopes to find a new identity authentication method, in order to effectively supplement and improve the existing methods, and provide identity authentication protection for access control.
  • the present invention proposes the concept of password fault tolerance, and it is expected that the identity of the user can be confirmed by other data even when the user cannot provide the correct password.
  • the first method is to require the user to provide more identity authentication information, such as questions about user privacy, etc.
  • the second method is to use the user's biometrics such as iris, fingerprint and other features for user identity authentication. These two methods have their own shortcomings in solving the problem.
  • the first method requires the user to perform additional operations and increases the user's operation.
  • the second method requires additional equipment to complete the authentication.
  • the present invention selects a scheme for user identity authentication and password fault tolerance based on user behavior characteristics.
  • the user's behavioral characteristics mainly refer to the operating characteristics of the input device of the mouse, keyboard, etc. when the user uses the computer. According to relevant literature and experiments, these features can confirm the identity of the user to a certain extent.
  • the mouse has become the main input device for human-computer interaction. For this reason, the present invention will design a password fault tolerance method based on the characteristics of the user's behavior, and use the mouse character data of the user to collect the user name/password verification method to analyze whether the user is a legitimate user and implement the password. Fault tolerance.
  • a password fault-tolerant method based on mouse behavior characterized in that, based on the mouse behavior data when the user logs in, by collecting and processing the daily behavior data of the user mouse, an identity authentication mode capable of determining the identity of the user is obtained, and each time the user logs in When comparing the similarity between the login data and the user login mode, the password tolerance of the user login process is finally realized.
  • an identity authentication mode capable of determining the identity of the user is obtained, and each time the user logs in
  • the password tolerance of the user login process is finally realized.
  • UI interfaces, software processes, and database operations need to be designed.
  • the UI interface is used to guide the user input and display the authentication result, and mainly includes a login interface, a registration interface, and a virtual keyboard, and various prompt windows.
  • the login interface and registration interface provide the basic functions of the lander.
  • the virtual keyboard is used to collect more user mouse information.
  • the design of the front-end interface is completed by using the graphical design capabilities provided by C++Builder.
  • the software main process is mainly composed of four steps of feature selection, data collection, mode establishment, and password fault tolerance.
  • the feature selection is to select the characteristics of the mouse that can judge the user's identity. After selecting the appropriate feature, the required data is collected and processed to obtain the user's identity authentication mode, and finally the mode is used for identity authentication to implement password fault tolerance.
  • the database is mainly operated in accordance with four steps in the software flow, and records the user name, password, mouse identity authentication mode data, and login data, and performs data processing and updating according to software requirements.
  • the system After a period of user information data collection and data processing, the system will successfully establish a unique identity authentication mode for the user, and use this mode for password fault tolerance when the user cannot provide the password correctly.
  • the main solution at this stage is to use the auxiliary information to verify the user's identity, including providing the user with private information, or verifying the user's biometrics.
  • These methods increase the user's operation and require additional equipment. stand by.
  • the method adopted by the present invention does not require additional operations and equipment, and directly utilizes the mouse characteristics of the user at login to verify the identity of the user.
  • Figure 1 shows the flow chart of software operation, feature selection, data acquisition, mode creation, and password tolerance. The process will be described in detail below.
  • Mouse feature information mainly includes two types, one is called user physiological layer feature, which refers to the unique characteristics of the user when using the mouse, and has nothing to do with the application environment, including mouse click frequency, double click frequency, moving direction frequency, average The feature quantity such as speed; the second type is the user dialogue layer feature, which refers to the mouse characteristics of the user in a specific application environment, including the instantaneous movement speed of the mouse, the instantaneous movement direction of the mouse movement, and the like. There are two points to note here.
  • the double-click operation is basically not used, so the double-click frequency does not need to be acquired, and secondly, the instantaneous moving speed of the mouse and the instantaneous moving direction. Together, they form the instantaneous motion vector of the mouse.
  • the mouse movement vector in continuous time can describe the running track of the mouse over a period of time, so the two data will operate as a whole.
  • the system tested their identity authentication performance separately.
  • the test invited 4 users to calculate the misrecognition rate and the false rejection rate of each user's identity authentication after training each user's 5 types of data.
  • the false positive rate is the probability that the system will pass the verification after the password is fault-tolerant for the illegal user to log in.
  • the misunderstanding rate is shown in Figure 2 below.
  • the false rejection rate refers to the probability that the system will pass the verification after the password is fault-tolerant for the legitimate user to log in.
  • the error rejection rate is shown in Figure 3 below.
  • the mouse track, the average moving speed of the mouse and the frequency of the mouse moving direction have higher recognition rate of the user identity, so the three data will be selected as the user identity authentication and password fault tolerance in the software module of the system. in accordance with.
  • This speed is the instantaneous moving speed of the mouse at a certain moment, taking the speed between (x1, y1) (x2, y2) as an example;
  • the instantaneous vector ( ⁇ , v, t) of the user's mouse can be established to describe the user's mouse trajectory.
  • step 2 the instantaneous movement speed of the mouse v1, v2, ..., vn
  • the percentage of the four regions where the angle falls in (-180, -90) (-90, 0) (0, 90) and (90, 180) is calculated.
  • the five kinds of data required can be calculated from the coordinates of the mouse track, so we need to collect and record the coordinates of the user's mouse movement track.
  • the mouse coordinates are collected every 100ms by calling the API function, and stored in the array of the database together with the timestamp, so that when the user login behavior is completed, the record is recorded in our database. User mouse track.
  • the authentication mode is a mode unique to each user, mainly including the three data we selected and the user name and password, as shown in Table 1.
  • the system compares the identity authentication mode with the data of the current login to determine the result of the password tolerance.
  • the user's physiological layer data includes the average moving speed of the mouse and the frequency of the mouse moving direction. For one training, an average speed and a percentage of the movement of the mouse in four directions will be obtained.
  • the number of movements in the angular range is A n , [90,180]
  • the number of movements in the angular range is B n
  • the number of movements in the range of (-180, -90) is C n , [-90, 0) angular range
  • the number of internal movements is D n , where n represents the nth training.
  • the user's dialogue layer data refers to the mouse track feature, which is composed of the user's mouse instantaneous speed, mouse instantaneous angle and time stamp.
  • each time the mouse track data collected includes 100 sets of data, we define symbols for each of the three data.
  • the instantaneous speed and the instantaneous angle corresponding to the same time stamp are averaged in the data collected multiple times, and finally the user's dialogue layer feature data is obtained.
  • Combining the physiological layer feature data with the dialogue layer feature data constitutes a user identity authentication mode.
  • the software module of the system uses the login data of the user to establish a login mode corresponding to the identity authentication mode for the user.
  • the similarity between the three data selected in the present invention in the login mode and the identity authentication mode is compared in turn.
  • the comparison of the similarity of the mouse trajectory is mainly the comparison of the mouse vector, and the similarity between the average speed and the direction frequency is mainly calculated by relative error. Methods.
  • the input data r, q, p is the similarity of the three data calculated in the previous step, w1, w2, and w3 are weights, and the similarity Uk of the login mode and the user identity authentication mode can be obtained by weighted summation.
  • Sum is the summation function
  • x is the final user identity authentication result. If x is 1, the authentication is successful. The user logs in successfully through the password fault tolerance function. If x is 0, the authentication fails and the user is denied login.
  • the weight indicates the degree of influence of each variable on the final verification result. Because each person's habit is different, the value of the weight is different for each user. For example, when a user logs in, the mouse track changes greatly. However, the average speed of the mouse is relatively stable. In this case, the weight w1 of r should be relatively small, and the weight w2 of q should be larger; the feature similarity indicates the stability of the user feature, if the user is daily If the behavior fluctuates greatly, the feature similarity is relatively small, and vice versa. In order to obtain appropriate values, an appropriate method is required when training 20 sets of training data. Here we use the idea of supervised learning in the neural network model. The specific algorithm is as follows.
  • the initial three weights w 1 , w 2 , and w 3 are all set to 1/3, that is, the initial state three similarities have the same degree of influence on the final result.
  • the first set of data is stored in the database as the initial identity authentication mode, and each subsequent data will be compared with the existing identity authentication mode in the database to obtain three Similarity, select the weight corresponding to the lowest similarity minus 1/500, and increase the highest corresponding weight by 1/500.
  • After the completion save the data in the database and get a new identity authentication mode.
  • the weight corresponding to the high similarity variable will have a greater impact on the final result, and achieve the purpose of weight adjustment in supervised learning.
  • the login interface and registration interface including the input of user name and password, feedback on registration and login status, etc., will describe the process of user interaction in detail.
  • the registration process is shown in Figure 7, which mainly includes the judgment of the user name and password length and the judgment of whether the two passwords are the same.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Social Psychology (AREA)
  • User Interface Of Digital Computer (AREA)

Abstract

本发明涉及互联网身份认证技术领域，一种基于鼠标行为的密码容错方法，其特征在于，基于用户登陆时的鼠标行为数据，通过采集并处理用户鼠标的日常行为数据，得到可以判断用户身份的身份认证模式，并在每次用户登陆时，比较本次登陆数据与用户登陆模式的相似度，最终实现用户登陆过程的密码容错。分别对系统UI界面、系统软件模块流程以及系统数据库操作进行相应设计。本发明改善用户体验，同时为用户提供有效的身份认证保障。

Description

基于鼠标行为的密码容错方法 技术领域
本发明涉及互联网身份认证技术领域。
背景技术
随着计算机与网络技术的飞速发展，人类在问题处理、信息传递等方面都获得了巨大的便利，但与此同时，我们在计算机与网络的安全性方面也面临着巨大的挑战，针对网络账户的恶意攻击，利用系统漏洞的非法入侵等种种危害，都给我们的个人隐私和财产带来危险，因此，针对不同的威胁类型，我们拥有了加密性保护、完整性保护、存取控制保护等种种安全防卫措施。其中，对于计算机及网络系统来说，存取控制保护是最必要的保护之一。
存取控制的主要目的是为不同的用户分配不同的权限，使得每个用户都在自己适当的权限下对系统进行操作。为了实现存取控制，第一步也是最为重要的一步便是用户身份认证，只有系统确定了用户的身份，才能为用户分配正确的权限，继而进行后续操作。目前主要的用户身份认证依据包括三种：(1)用户记忆信息，如用户名/密码；(2)辅助设备，如密保卡、银行卡等；(3)用户生物特征信息，如指纹等。三种方法各有优点，但缺点也很明显，用户名/密码的方式较为简便，但密码遗忘、密码泄露等问题使得其安全性和用户体验都不能令人满意；辅助设备的方式安全性较高，但相关辅助设备丢失或被盗时，用户信息同样存在泄露的风险；由此出现了利用生物信息的认证方法，这种方法安全性和可靠性都较高，但需要额外的设备支持。
在现有的三种方法中，第一种方法，即用户名/密码的使用是最广泛的，但在广为使用的同时，其缺点也显而易见，在安全性方面，一旦密码泄露，非法用户也可以通过身份验证，该模式将不能为用户数据提供任何防护，在用户体验方面，若用户不能正确地输入密码，即使是合法用户也不能通过验证。其安全性问题需要用户妥善保管自己的密码，并经常性的更改密码，因此在安全性问题上，需要用户的配合，用户名/密码模式本身已经很难改进，但用户体验问题却可以从模式的缺点入手，提升用户体验，所以本发明将主要针对用户体验的改善。
发明内容
基于上述论述，本发明希望找到新的身份认证方法，以期对现有的方法做出有效地补充和改进，为存取控制提供身份认证保障。
为了对用户体验做出改进，本发明提出了密码容错的概念，希望即使在用户无法提供正确的密码时，也可以通过其他数据来确认用户的身份。为达到这个目标，目前主要有两种方法。第一种方法是要求用户提供更多的身份认证信息，例如有关用户隐私的问题等，第二种方法是使用用户的生物特征例如虹膜、指纹等特征进行用户身份认证。这两种方法在解决问题的同时也各自有着缺点，第一种方法需要用户进行额外的操作，增加了用户的操作量，而第二种方法需要额外的设备才可以完成身份认证。
为了克服现行的方法中所存在的问题，本发明选择了基于用户行为特征进行用户身份认证和密码容错的方案。用户的行为特征主要是指用户在使用计算机时，对鼠标、键盘等输入设备的操作特征，根据相关文献和实验证实，这些特征可以在一定程度上确认用户的身份。而近些年来，随着图形化界面的发展，鼠标已经成为人机交互的主要输入设备。基于这个原因，本发明将设计一个可以实现基于用户行为特征的密码容错方法，利用采集用户的鼠标特征数据，结合原有的用户名/密码验证方式，分析出用户是否为合法用户，实现密码的容错功能。
为此，本发明给出的技术方案：
一种基于鼠标行为的密码容错方法，其特征在于，基于用户登陆时的鼠标行为数据，通过采集并处理用户鼠标的日常行为数据，得到可以判断用户身份的身份认证模式，并在每次用户登陆时，比较本次登陆数据与用户登陆模式的相似度，最终实现用户登陆过程的密码容错。为实现所预想的系统功能，需要对UI界面、软件流程以及数据库操作进行设计。
所述的UI界面:系统前端界面用以实现引导用户输入、认证结果的展示，主要包括登陆界面、注册界面以及虚拟键盘三个界面，以及各类提示窗口。登陆界面及注册界面提供登陆器的基础功能，虚拟键盘是为了采集到更多的用户鼠标信息。例如利用C++Builder所提供的图形化设计能力完成前端界面的设计。
所述的软件主体流程：主要由特征选择、数据采集、模式建立以及密码容错四个步骤组成。特征选择是为了选取可以判断用户身份的鼠标特征，选择到适当的特征后，对所需要的数据进行采集和处理，得到用户的身份认证模式，并最终使用该模式进行身份认证，实现密码容错。
所述的数据库：其操作主要是配合软件流程中的4个步骤，记录用户的用户名、密码、鼠标身份认证模式数据以及登陆数据等，并根据软件要求进行数据处理和更新。
经过一段时间的用户信息数据采集、数据处理之后，系统将成功地为用户建立起独特的身份认证模式，并在用户无法正确提供密码时，使用该模式进行密码容错。
与现有技术相比，本发明的创新点：
1)面对用户忘记密码的问题，现阶段主要解决方法是使用辅助信息来验证用户身份，包括由用户提供隐私信息，或验证用户的生物特征，这些方法增加了用户操作量，需要额外的设备支持。而本发明所采用的方法不需要额外的操作和设备，直接利用用户在登陆时的鼠标特征验证用户身份。
2)选择了在登录时更有代表性和区分性的鼠标特征数据。本发明改善用户体验，同时为用户提供有效的身份认证保障。
附图说明
图1软件模块流程图
图2用户误识率测试
图3用户误拒率测试
图4数据采集流程
图5密码容错的神经网络模式
图6登陆交互流程
图7注册流程图
具体实施方式
(案例)
一、软件流程
图1所示为软件运行的流程图，特征选择、数据采集、模式建立以及密码容错过 程将在下面进行详细介绍。
1、特征选择
为了实现用户行为特征的数据采集，建立身份认证模式，首先要确定我们需要采集的用户鼠标特征信息。鼠标特征信息主要包括两类，一类称作用户生理层特征，指的是用户在使用鼠标时的独特特征，与应用环境没有关系，包括鼠标的单击频率、双击频率、移动方向频率、平均速度等特征量；第二类为用户对话层特征，指的是用户在某个特定的应用环境下的鼠标特征，包括鼠标瞬时移动速度、鼠标移动瞬时移动方向等。在这里有两点需要注意，首先对于本软件所要实现的用户登陆与密码容错功能来说，双击操作是基本用不到的，因此双击频率无需采集，其次，鼠标的瞬时移动速度与瞬时移动方向共同组成了鼠标的瞬时移动向量，在附加时间戳之后，连续时间内的鼠标移动向量可描述出鼠标在一段时间内的运行轨迹，因此这两个数据将作为一个整体进行操作。面对选取出的5种数据，本系统对它们的身份认证性能分别作了测试。测试邀请了4名用户，在对每位用户的5种数据进行训练之后，计算使用每种数据进行用户身份认证的误识率与误拒率。误识率即对于非法的用户登陆，系统经过密码容错使其通过验证的概率。误识率如下图2所示。
误拒率指对于合法的用户登陆，系统经过密码容错拒绝其通过验证的概率。误拒率如下图3所示。
由测试结果可以看出，鼠标轨迹、鼠标平均移动速度以及鼠标移动方向频率对用户身份的辨识率更高，因此在本系统的软件模块中将选取这三个数据作为用户身份认证与密码容错的依据。
2、数据采集
经过上述分析后，我们得到了所要采集的数据类型，数据采集的流程如图4所示，接下来将详细解释该过程。我们设在用户使用鼠标的过程中，软件每隔100ms记录一次鼠标坐标，得到的坐标记为(x1,y1)，(x2,y2)，(x3,y3)...(xn,yn)。
(1)鼠标瞬时移动角度
对于连续采集的两个鼠标轨迹点o和a，连接两点，其与水平线的夹角θ就是用户鼠标瞬时移动角度，而这个角度便是某一时刻鼠标的瞬时移动角度，设角度为θ，以(x1，y1)(x2，y2)之间的角度为例；
Figure PCTCN2014095900-appb-000001
Figure PCTCN2014095900-appb-000002
根据(1)(2)求得角度的cos与sin值，再依据arcsin()和arcos()计算出角度值。
(2)鼠标瞬时移动速度
这个速度是某一时刻鼠标的瞬时移动速度，以(x1，y1)(x2，y2)之间的速度为例；
Figure PCTCN2014095900-appb-000003
(3)时间戳
以程序开始运行时记为0时
t＝n*0.1   (4)
前三项数据采集完成后，可建立起用户鼠标的瞬时向量(θ，v，t)，用于描述用户鼠标轨迹。
(4)鼠标平均移动速度
根据步骤2计算出的鼠标瞬时移动速度v1,v2,...,vn
Figure PCTCN2014095900-appb-000004
(5)鼠标移动方向频率
根据步骤1计算得到的角度值，计算角度落在(-180，-90)(-90,0)(0,90)及(90,180)四个区域的百分比。
通过分析可以发现，所需要的五种数据均可由鼠标轨迹坐标计算得到，因此我们需要采集并记录用户鼠标移动轨迹的坐标。在系统的软件模块启动后，通过调用API函数，每隔100ms采集一次鼠标坐标，并连同时间戳存入数据库的数组中，这样当一次用户登录行为完成，我们的数据库中便记录下了本次的用户鼠标轨迹。
3、模式建立
表1 用户身份认证模式
Figure PCTCN2014095900-appb-000005
Figure PCTCN2014095900-appb-000006
身份认证模式是每位用户所特有的模式，主要包括我们所选择的三项数据以及用户名、密码等信息，如表1所示。在用户登陆时，系统会将身份认证模式与本次登陆的数据进行比较，以确定密码容错的结果。
(1)生理层数据处理
用户生理层数据包括鼠标平均移动速度以及鼠标移动方向频率，对于一次训练来说，将会得到一个平均速度以及鼠标在4个方向的移动的百分比。
记录平均移动速度为
Figure PCTCN2014095900-appb-000007
[0，90)角度范围内移动次数为An，[90,180]角度范围内移动次数为Bn，(-180,-90)角度范围内移动次数为Cn，[-90，0)角度范围内移动次数为Dn，其中n表示第n次训练。对n组训练数据取平均值，可得到用户的生理层特征数据。
(2)对话层数据处理
用户的对话层数据指的是鼠标轨迹特征，由用户的鼠标瞬时速度、鼠标瞬时角度以及时间戳共同组成。在系统的软件模块中，每次采集到的鼠标轨迹数据包括100组数据，我们为这三个数据分别定义符号。定义鼠标瞬时角度为θm_n，鼠标瞬时速度为Vm_n，时间戳为tm_n，其中m表示第m组训练数据，n表示本组数据的时间顺序。将多次采集到的数据中相同时间戳所对应的瞬时速度与瞬时角度求平均数，最终得到用户的对话层特征数据。
将生理层特征数据与对话层特征数据组合起来，便构成了用户身份认证模式。
4、密码容错
(1)登陆模式建立
在用户登陆时，系统的软件模块会使用用户本次的登录数据为用户建立起与身份认证模式相对应的登陆模式。
(2)数据比较
依次比较本发明所选择的三项数据在登陆模式与身份认证模式中的相似度，鼠标轨迹相似度的比较主要是对鼠标矢量的比较，平均速度与方向频率的相似度主要采用了相对误差计算的方法。
(3)密码容错
如图5所示。输入数据r，q，p为上一步计算得到的三项数据的相似度，w1、w2、w3为权值，加权求和后便可得到登陆模式与用户身份认证模式的相似度Uk。其中求和函数Sum为
uk＝rw1+qw2+pw3   (6)
在获得相似度之后，如何才能确定本次身份认证是否通过呢？在这里我们定义新的变量特征相似度S，若计算得到的相似度大于等于特征相似度，用户认证通过，否则密码容错行为失败，特征相似度对应图5中的阈值。激励函数如下。
v＝Uk-s
Figure PCTCN2014095900-appb-000008
x即最终的用户身份认证结果，x为1表示认证成功，用户通过密码容错功能登陆成功，x为0表示认证失败，用户被拒绝登陆。
因此，权值以及特征相似度的取值将成为影响输出结果的关键。权值表示的是每种变量对最终验证结果的影响程度，由于每个人的习惯不同，权值的取值对每位用户来说都是不同的，例如某位用户登陆时鼠标轨迹变化较大，但鼠标平均速度较为稳定，在这种情况下，r的权值w1应该比较小，而q的权值w2应该取值较大；特征相似度表示的是用户特征的稳定程度，若用户日常行为波动较大，则特征相似度相对较小，反之较大。为了取得适当的值，在对20组训练数据进行训练时，需要采用合适的方法。在这里我们采用神经网络模式中的监督学习的思想获得，具体算法思想如下。
首先将初始的三个权值w1、w2、w3均设置为1/3，即初始状态三个相似度对最终结果的影响程度是相同的。在20组初始数据的训练中，第一组数据即作为最初的身份认证模式，存入数据库中，其后的每组数据，都将与数据库中已存在的身份认证模式进行比较，得到三个相似度，选取其中最低相似度所对应的权值减去1/500，最高的对应权值增加1/500，完成后将本组数据存入数据库，得到新的身份认证模式，这样经过20组数据递归训练，高相似度的变量对应的权值将会对最终的结果起到更大的影响，达到监督学习中对权值调整的目的。在权值调整完成后，20组训练数据也已存入数据库，使用这些数据建立起身份认证模式，并依据新的权值与身份认证模式重新计算20组数据的相似度uk，其中k表示次数，最终的特征相似度u计算如下。
u＝(u1+u2+...+uk+...+u20)/20   (8)
同时需要注意的是，在软件模块实际运行过程中，并没有初始数据用于训练，因此将采集用户在用户名和密码均输入正确时的数据作为训练数据，并存入数据库中。
二、关于用户交互过程设计
在软件模块的运行过程中，系统需要与用户进行交互，其中交互过程主要集中在 登陆界面与注册界面，包括用户名与密码的输入、注册与登陆情况的反馈等，接下来将详细描述用户交互的过程。
1、登陆交互过程
如图6所示。用户登陆时，在指定位置输入用户名或密码，系统首先验证用户名是否合法，若通过验证，进入密码验证环节，否则弹出错误信息。密码验证阶段，若密码完全正确，则直接返回登陆成功，若编辑距离大于2，则弹出错误信息，若两种情况均不满足，则进入密码容错过程，经过登陆模式与身份认证模式的比较，若通过验证，则通知用户登陆成功，否则弹出错误信息。
2、注册过程
注册过程如图7所示，主要包括用户名、密码长度的判断以及两次输入密码是否相同的判断。

Claims (1)

  1. 一种基于鼠标行为的密码容错方法，其特征在于，基于用户登陆时的鼠标行为数据，通过采集并处理用户鼠标的日常行为数据，得到可以判断用户身份的身份认证模式，并在每次用户登陆时，比较本次登陆数据与用户登陆模式的相似度，最终实现用户登陆过程的密码容错。分别对系统UI界面、系统软件模块流程以及系统数据库操作进行如下设计，
    所述的UI界面:为系统前端界面，用以实现引导用户输入、认证结果的展示，主要包括登陆界面、注册界面以及虚拟键盘三个界面，以及各类提示窗口；登陆界面及注册界面提供登陆器的基础功能，虚拟键盘是为了采集到更多的用户鼠标信息；
    所述的软件模块的流程：包括特征选择、数据采集、模式建立以及密码容错四个步骤组成，特征选择是为了选取可以判断用户身份的鼠标特征，选择到适当的特征后，对所需要的数据进行采集和处理，得到用户的身份认证模式，并最终使用该模式进行身份认证，实现密码容错；
    所述的数据库：其操作主要是配合软件模块流程中的4个步骤，记录用户的用户名、密码、鼠标身份认证模式数据以及登陆数据等，并根据软件模块要求进行数据处理和更新。
PCT/CN2014/095900 2014-09-25 2014-12-31 基于鼠标行为的密码容错方法 WO2016045225A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
AU2017100409A AU2017100409A4 (en) 2014-09-25 2017-04-10 Password fault tolerance method based on mouse behaviour

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410499054.7A CN104281795B (zh) 2014-09-25 2014-09-25 基于鼠标行为的密码容错方法
CN201410499054.7 2014-09-25

Related Child Applications (1)

Application Number Title Priority Date Filing Date
AU2017100409A Division AU2017100409A4 (en) 2014-09-25 2017-04-10 Password fault tolerance method based on mouse behaviour

Publications (1)

Publication Number Publication Date
WO2016045225A1 true WO2016045225A1 (zh) 2016-03-31

Family

ID=52256659

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/095900 WO2016045225A1 (zh) 2014-09-25 2014-12-31 基于鼠标行为的密码容错方法

Country Status (2)

Country Link
CN (1) CN104281795B (zh)
WO (1) WO2016045225A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106775353A (zh) * 2016-12-21 2017-05-31 普华基础软件股份有限公司 一种利用鼠标动作解锁桌面操作系统屏幕的方法
CN110287664A (zh) * 2019-07-01 2019-09-27 贵州大学 一种基于多行为特征选择的身份认证方法

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105991281A (zh) * 2015-02-04 2016-10-05 中国移动通信集团公司 一种身份认证方法、设备及系统
CN104933353A (zh) * 2015-07-07 2015-09-23 北京展扬金卡科技有限公司 密码操作方法及装置
CN107871279A (zh) * 2017-09-30 2018-04-03 上海壹账通金融科技有限公司 用户身份验证方法及应用服务器
CN108629174B (zh) * 2018-05-08 2022-06-07 创新先进技术有限公司 字符串校验的方法及装置
CN109407947A (zh) * 2018-09-30 2019-03-01 北京金山云网络技术有限公司 界面交互及其验证方法、登录请求生成及验证方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101674184A (zh) * 2009-10-19 2010-03-17 北京微通新成网络科技有限公司 一种基于用户击键特征的身份识别方法
CN103152324A (zh) * 2013-01-29 2013-06-12 北京凯华信业科贸有限责任公司 基于行为特征的用户认证方法
CN103533546A (zh) * 2013-10-29 2014-01-22 无锡赛思汇智科技有限公司 基于多维度行为特征的隐式用户验证及隐私保护方法
CN103699822A (zh) * 2013-12-31 2014-04-02 同济大学 基于鼠标行为的电子商务中用户异常行为应用系统及检测方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
IL211289A0 (en) * 2011-02-17 2011-04-28 Univ Ben Gurion System for verifying user identity via mouse dynamics

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101674184A (zh) * 2009-10-19 2010-03-17 北京微通新成网络科技有限公司 一种基于用户击键特征的身份识别方法
CN103152324A (zh) * 2013-01-29 2013-06-12 北京凯华信业科贸有限责任公司 基于行为特征的用户认证方法
CN103533546A (zh) * 2013-10-29 2014-01-22 无锡赛思汇智科技有限公司 基于多维度行为特征的隐式用户验证及隐私保护方法
CN103699822A (zh) * 2013-12-31 2014-04-02 同济大学 基于鼠标行为的电子商务中用户异常行为应用系统及检测方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106775353A (zh) * 2016-12-21 2017-05-31 普华基础软件股份有限公司 一种利用鼠标动作解锁桌面操作系统屏幕的方法
CN110287664A (zh) * 2019-07-01 2019-09-27 贵州大学 一种基于多行为特征选择的身份认证方法

Also Published As

Publication number Publication date
CN104281795B (zh) 2017-10-31
CN104281795A (zh) 2015-01-14

Similar Documents

Publication Publication Date Title
WO2016045225A1 (zh) 基于鼠标行为的密码容错方法
Dasgupta et al. Advances in user authentication
JP6565230B2 (ja) ユーザ認証方法、システム、及びプログラム
Messerman et al. Continuous and non-intrusive identity verification in real-time environments based on free-text keystroke dynamics
US10467394B2 (en) Pointing device biometrics for continuous user authentication
Traore et al. Combining mouse and keystroke dynamics biometrics for risk-based authentication in web environments
Serwadda et al. When kids' toys breach mobile phone security
Li et al. Unobservable re-authentication for smartphones.
US20130263240A1 (en) Method for authentication and verification of user identity
Bours et al. A login system using mouse dynamics
US20210264003A1 (en) Keyboard and mouse based behavioral biometrics to enhance password-based login authentication using machine learning model
Polakis et al. Faces in the distorting mirror: Revisiting photo-based social authentication
Meng et al. Enhancing click-draw based graphical passwords using multi-touch on mobile phones
CN111563746A (zh) 用户身份认证的方法、装置、电子设备和介质
Meng et al. The effect of adaptive mechanism on behavioural biometric based mobile phone authentication
Buriro et al. Risk-driven behavioral biometric-based one-shot-cum-continuous user authentication scheme
Lone et al. A novel OTP based tripartite authentication scheme
Mondal et al. A continuous combination of security & forensics for mobile devices
Sharma et al. Behavioral biometrics: past, present and future
Ma et al. A kind of mouse behavior authentication method on dynamic soft keyboard
Sahdev et al. Behavioral biometrics for adaptive authentication in digital banking-guard against flawless privacy
Aumi et al. AirAuth: towards attack-resilient biometric authentication using in-air gestures
Lin et al. Developing cloud-based intelligent touch behavioral authentication on mobile phones
Pilankar et al. Multi-phase mouse dynamics authentication system using behavioural biometrics
Gorad et al. User identity verification using mouse signature

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14902547

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14902547

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 10/10/2017)

122 Ep: pct application non-entry in european phase

Ref document number: 14902547

Country of ref document: EP

Kind code of ref document: A1