Secure Strokes A Security Mechanism for Authentication in Mobile Devices using User s Behavioral Pattern of Keystrokes Dynamics with Visual Cues

Transcription

1 Secure Strokes A Security Mechanism for Authentication in Mobile Devices using User s Behavioral Pattern of Keystrokes Dynamics with Visual Cues Pallavica Sahoo MCA, VIT University, Vellore pallavica.sahoo123@gmail.com Prithumit Deb B.Tech IT, VIT University, Vellore prithumitls@gmail.com ABSTRACT The aim is to develop a security system for mobile devices that eliminates the vulnerability of PIN (4-digit) security and which reduces the high end configuration and memory space requirements of biometrics security. The issues that we will be handling in the project work is the vulnerability of PIN security in mobile devices and providing an extra layer of security through Key Strokes Dynamics based authentication system. Also the problem of authentication error rates while using natural user keystroke pattern will be worked upon. And a better mechanism which uses an artificial keystroke rhythm with cues will be worked upon. Method- Keystroke Dynamics based Authentication Security system for Mobile Devices using Artificial typing rhythm and cues. Principle- Making use of the behavioral pattern of the user rather than any physical pattern or biometrics. 1. LITERATURE SURVEY / RELATED WORKS Paper Title with Authors, and year Specific problems/issues discussed Problem statement Assumptions Keystroke dynamics-based authentication for mobile devices. (Seong-seob Hwang, Sungzoon Cho, Sunghoon Park) Keystroke dynamics based authentication for mobile devices. Data security through keystrokes dynamics based authentication User acquaintance with typing in Keystroke Dynamics as a Biometric for Authentication (Fabian Monrose, Aviel D. Rubin) Security threats to a computer and using biometrics to increase the level of security Result on the Authentication based on Keystrokes dynamics and comparison of the experiment results with the prior works Users are familiar with computers and mobile keypad Constraints Limited user group for the experiment Process or Keystrokes operation or Dynamics based functional Authentication description Claimed Less advantages configuration and memory Claimed disadvantages Tools used space required Difficult to implement for a larger and diverse set of users with varying typing pattern 3G synchronized IMT-2000 cellular system passwords Limitation of user group for data collection The problem with keystroke recognition is that unlike other non-static biometrics there are no known features or feature transformations which are dedicated solely to carrying discriminating information. MATLAB, C++, GNU plot 6

2 (CDMA2000 1xEV-DO) Tables and Choice of fields Passwords and use of typing hands, Equal Error rates, factors affecting error rates Domain tested Domain of 25 users with average age 25.3 yrs Metrics used with formula Performance graphs Future proposed work Cumulative distribution of enroll, login and imposter distances Applying the same theory to a more diverse user group 2. ANALYSIS & DESIGN Data collected 63 users Euclidean Distance measure, weighted weighted probability The system design is split into two major parts. was from Non and Recognition based on freetext typing pattern during the identification process Enrollment Process for the user Natural Rhythm Keystrokes Artificial Rhythm Keystrokes Login and Authentication time out of 10 sec is used. The 4 discrete points S 1, S 2, S 3, S 4 are taken and a arbitrary quadrilateral is formed whose area is calculated and the average area of the 4 are taken A avg and the deviation in his typing pattern is found out Deviation = Max(A 1, A 2, A 3 A 4 )- Min(A 1, A 2, A 3 A 4 ) Artificial Rhythm Keystrokes with visual cues Here the same is done as Natural Rhythm Keystroke with a major difference that visual color cues (red, orange, yellow) are used so that the user can remember his typing pattern and a more consistency is obtained. Here the x value is according to the color (pattern) that the user is following. 2.2 Login and Authentication Process The Average Quadrilateral Area A avg for the natural rhythm and artificial rhythm with their Deviation is determined and stored in the local RMS database and a threshold T is determined. The user when tries to login first has to pass through the password validation and in next stage the user is asked to type the password either in his natural rhythm or artificial rhythm with visual cues. The A avg is determined again using the same Varignon Parallelogram method. It is checked if it lies within the threshold value T and the user is authenticated if he satisfies the threshold limit Mathematical Models and Formula used Here the Varignon Parallelogram Method for calculating the area of arbitrary quadrilateral using Midpoint Theorem 2.1 Enrollment Process The enrollment process is started by collecting the basic profile data from the user i.e. Name, username, security PIN (4 digits).then follows the process of enrolling his keystroke pattern using the two methods Natural Rhythm Keystrokes without cues The user is asked to type his PIN in his natural typing rhythm (4 times) and his typing pattern is recorded. S(x, y) is taken as some discrete coordinates where x=the key pressed and y= the key press timings of the user. A Fig 1: Arbitrary Quadrilateral Area Calculation (Varignon Method) From elementary geometry, we know that in triangle V 0 V 1 V 2 the midpoint line M 0 M 1 is parallel to the base V 0 V 2. In triangle V 0 V 1 V 2 V 3, the line M 3 M 2 is 7

3 parallel to that same base V 0 V 2. Thus, M 0 M 1 and M 3 M 2 are parallel to each other. Similarly, M 0 M 3 and M 1 M 2 are parallel, which shows that M 0 M 1 M 2 M 3 is a parallelogram. The area relation is also easy to demonstrate, and we can compute the quadrilateral's area as: Area=2*Area (M0 M1 M2 M3) =2* (M3 M0) (M1 - M0) =2* ((V1+V2)/2-(V0+V1)/2)*((V3+V0)/2-(V0+V1)/2) =1/2 (V2-V0) * (V3-V1) Mathematical Comparison and Analysis of Probability But if we are using the key stroke pattern authentication method using artificial visual cues (3- colors) and a 10 sec timeout then the number of combination becomes * 3 4 * 10C 4 = * 81 * 210 = * combinations. So we can see that this method reduces the vulnerability of PIN (4 digits) by increasing the number of combinations by times, thus reducing the probability of an imposter accessing the data illegally. So this method can be considered as a better security technique. If we are using the normal PIN authentication and assume that it is of 4 digits P 1 P 2 P 3 P 4. Then the total combinations that can be formed are (0-9 digits). 3. SYSTEM DESIGN 8

4 4. IMPLEMENTATION MODULES 4.1 The GUI module: In this module the user is presented with an interface where he can enter details so as to create a profile for himself. The user is asked to provide his name, the username he wishes to login with and his password to login into the system. The user is asked to enter his password twice in order to double check it. The info entered here is stored in the database against the name of the user along with other details that include data related to his natural and artificial rhythm. 4.2 The Natural rhythm module: In this module the user enters the password so as data related to his natural rhythm can be calculated. As the user presses the key, the key he enters and the time difference between key presses is calculated and based on this a set of 4 values is generated. Each sets has two elements the key pressed and the time difference which are used to plot a virtual quadrilateral whose area is calculated using Varignon Parallelogram method and this area is what identifies each users keystrokes as unique. This whole process of entering the keystrokes and calculating the data is repeated four times and based on these four set of values other values like mean deviation and all are calculate in order to create the user's profile. 4.3 The Artificial rhythm with cues module: This module provides the user with visual cues that help him improve periodicity of his keystrokes so that the method can become more accurate and reliable. Also providing the user with cues of different color (three colors) increases the combinations that can be generated by the standard 4-digit pins used in mobiles by approximately times. This combined with the improved periodicity of the keystrokes provides the user with a new level of security. 4.4 The XML Connectivity module and Authentication: All the details produced by the above three modules will be stored in a XML file (using JSR 172 Web Services and XML Parsing API) with the threshold values in order to provide some relaxation to the user in terms of typing periodicity so as to avoid false rejects. Below a sample XML file generated after the enrollment process is shown. <?xml version="1.0"?> <prit> <password>1234</password> <area>0.52</area> <min>0.16</min> <max>0.15</max> </prit> The J2ME XML Parsing API is used to parse the XML file with the root tag denoting the username and the other information are retrieved using the XML parser and compared with the information that user has entered while login process. If the value of the area calculated during login lies between the retrieved area threshold value from the XML file then the user is authenticated else the authentication is rejected. 5. HARDWARE AND SOFTWARE REQUIREMENTS 5.1 Hardware Specifications Multimedia GSM Cell phones supporting J2ME with CLDC 1.1 supports and MIDP 2.0 and multimedia support J2ME MMAPI 5.2 Database and Software 1. Database containing the user s enrolment and login information and his keystroke patterns are stored in RMS (Record Management System) which is a local storage database provided by J2ME itself. 2. Software Building and testing Platform- J2ME 3. Software-Emulator used is Sun JAVA Wireless Toolkit CONCLUSION This new method of authentication using keystroke dynamics is acceptably far more efficient than the existing PIN authentication method. Also it is less resource and memory consuming than the biometrics methods (often an extra device is required in biometrics). The artificial rhythm with cues makes this KDA more unique and consistent and far more secure. Here the project is made using only a limited group of users. There could be a problem in fixing an accurate threshold value, there for the FAR (False Acceptance Rate) or FRR (False Rejection Rate) may vary inconsistently. Security is a matter of concern for mobile devices. But a security method that is applicable to the general mobile users, users of diverse groups should be developed keeping in mind the limited configuration, resources and memory that can be used in mobile devices. 9

5 7. SCREENSHOTS Fig 2- initial screen Fig 4- enrolling keystroke pattern Fig 3- profile creation screen Fig 5- area and statistics 10

6 REFERENCES 1. Keystroke dynamics-based authentication for mobile devices. (Seong-seob Hwang, Sungzoon Cho, Sunghoon Park) Keystroke Dynamics as a Biometric for Authentication (Fabian Monrose, Aviel D. Rubin) /parsingxml jsp Fig 6- login screen Fig 7- Natural rhythm enrollment 11