DE102009044173A1 - Cross-matching of typing behavior data to authenticate and / or identify a person - Google Patents

Abstract

The present invention relates to a method for authentication and / or identification of a person by means of typing behavior on a keyboard and a corresponding device, the method comprising: - registering a person in which at least one registration sample is recorded and stored under an identifier, - creating a registration profile on the basis of the registration tip sample submitted during the registration and storing the registration profile under the identifier, - submission of at least one logon tip sample when logging in for authentication and / or identification, - creation of a logon profile on the basis of the logon tip sample submitted during registration, and - crosswise comparison the logon tip sample with the registration profile and the registration tip sample with the login profile.

Description

BACKGROUND OF THE INVENTION

FIELD OF THE INVENTION

The present invention relates to a method for authentication and / or identification of a person by means of the typing behavior on a keyboard as well as a device which is thus prepared and / or comprises a program code processable by a data processing system, so that a corresponding method can be performed.

STATE OF THE ART

The prior art discloses methods and devices for identifying and / or authenticating persons who use the typing behavior of the person to be authenticated or identified on a keyboard. Examples are in the WO 98/06020 A2 respectively. US 6,151,593 A given.

Although very good results are already obtained by means of these methods and devices, there is a continuing need to increase the safety and reliability of such systems and devices and to improve the comfort for the user by the possibility of entering short typing sequences. Here, however, is problematic that such goals are actually incompatible, since a high recognition security is usually associated with a long typing sequence, so for example, the input of a very long text. However, this reduces the convenience for the user, since he does not want to enter overlong texts during authentication and / or identification.

DISCLOSURE OF THE INVENTION

OBJECT OF THE INVENTION

It is therefore an object of the present invention to provide a method and a device for authentication and / or identification of a person on the basis of their typing behavior, which agreed on the contrary objectives of high security and reliability on the one hand and a convenient use on the other hand.

TECHNICAL SOLUTION

This object is achieved by a method having the features of claim 1 and a device having the features of claim 10. Advantageous embodiments are the subject of the dependent claims.

According to the present invention, a method for authenticating and / or identifying a person by means of the typing behavior on a keyboard is specified, wherein upon registration of a person in a corresponding system a registration tip sample is detected and under the identity of the person, ie, for example, a corresponding identifier , is stored. From the at least one registration sample a registration profile is created and also stored under the identifier or identity. If a user of a system equipped with the invention wishes to log on to the system later, he / she must submit at least one log-in sample for authentication and / or identification during the log-in, from which in turn a log-on profile is created. Identification and / or authentication is accomplished by cross-checking the logon tip sample with the registration profile and the registration tip sample with the logon profile. Through this cross-matching, the recognition performance can be increased and thus the authentication and / or identification can be carried out more safely without unnecessarily long tipping samples having to be dispensed.

The necessary in the inventive method detecting the typing behavior can be done on a conventional computer keyboard, in which appropriate data on the pressing and releasing the keys, in particular z. B. the times of pressing and / or letting go of a key or the holding time of a key are detected. In addition to such conventional keyboards, of course, all other input devices are used in which appropriate touches are triggered by a user, such as touch-sensitive screens on which z. B. a keyboard can be represented by software, or other touch-sensitive surfaces. In particular, it is also sufficient to use a single touch-sensitive surface in which z. For example, a certain sequence of touches takes place, such as a Morse code.

The authentication means that in a corresponding system, eg. B. a personal computer or a network of multiple personal computer, a specific user is detected and known and the user also logs on under his own identity or identifier to the system. The authentication thus only checks whether the given person actually agrees with the person who has been registered.

In the identification of a person is in the corresponding system, so the computer system or a corresponding network, also a registration for the user before, however the user does not have to disclose his identity when logging in, but the system can recognize the user independently on the basis of the typed data entered, ie identify it.

When registering a user in the system, ie the first-time registration, at least one registration sample is recorded according to the present invention and a corresponding registration profile is created therefrom. Both the registration profile and the registration tip sample, ie the corresponding raw tip data, are stored under the identity or identification of the registered person.

When the user logs on for later use of the system, the user must also submit at least one log-in sample from which a log-on profile is created in accordance with the registration profile. In the case of crosswise matching, the logon tip sample is now compared with the registration profile and the registration tip sample with the logon profile, so that at least two adjustment values or match values can be determined. The resulting higher number of match values already gives a higher accuracy of recognition.

This can be further increased by increasing the number of registration tip samples or log-tip samples, so that in an advantageous embodiment at least two registration tip samples and at least two log-tip samples are detected. These jog samples can be submitted by separate acquisition operations, or a single input operation can be divided into two or more jog samples so that multiple jigsamples are generated.

A further increase in the recognition performance can be achieved by the at least two or more registration tip samples and / or log-in tip samples comprising the same text or at least the same text components. For example, the user may be asked to enter a password two or more times, so that at least two or more log-in samples with the same text are recorded by repeatedly entering the same text, at least two or more registration tip samples during registration, and at log-on.

This also shows that in addition to the method according to the invention with cross-matching and other authentication and / or identification means can be used, such. As the input of passwords and the like. In particular, the present method offers a possibility to connect such authentication and / or identification measures with the method according to the invention in a simple manner without incurring additional expenditure.

With two or more registration tip samples and / or logon tip samples, a corresponding number of matches can be made to the registration profile or login profile. Thus, for two registration tip samples and two logon tip samples, a total of four matches can be made, that is, two times a match of the logon tip samples to the registration profile and two times a match of the registration tip samples to the login profile. At each match, a match score may be formed that is used to determine whether the identification and / or authentication was successful or not.

In particular, from the plurality of match values, a match end value may be formed, such as, for example, " match " B. by appropriate mathematical methods, such as averaging or the like.

The match end value or individual match values from the various matchings may be compared to a threshold, or it may be checked whether those match values are within a certain predetermined range.

When creating the registration and / or registration profile, at least one characteristic feature can be determined from the raw tip data obtained during the key actuation. Such characteristic features of the key operation or the typing behavior can be formed by the holding time of a specific key or different keys or corresponding average values. Moreover, it is also possible transition periods from releasing one, in particular a certain key, or all keys as an average value until pressing the next key, and transition periods of releasing a key to release the next key or the transition periods from pressing a key to press the next key. These features can all be related to specific keys or key sequences, or determined as averages for all keystrokes. In addition, the error frequency or error frequency can be detected, ie the fact how often and in which intervals the user has to correct his inputs. In addition, the tip rate, ie the ratio of the number of typed characters to the duration or the attack frequency can be determined as a feature. In the same way, simple or multiple overhauls, ie pressing the next key before releasing the previous key, the frequency of use of certain function keys, the selection of alternative keys, such as the selection of the left or right font keys and the like are used as features. Also temporal key-related abnormalities, such as particularly long transition periods after pressing a particular key or special location-related features that take into account the local position of the actuated keys, can also be used. All features can be combined with each other to form new features, or statistical characteristics can be determined from them as features.

Corresponding profiles, that is to say registration and / or login profiles, can be generated from the features, wherein corresponding values of the profile can be determined from the generated features by mathematical functions, for example by forming average values, sums or the like. However, the profiles may also include corresponding feature fields and / or feature vectors that characterize the typing behavior.

When comparing the jog samples with the profiles, ie the registration and / or login profiles, match values can be generated by comparing a jog sample with the corresponding profile. A comparison or comparison can be performed by mathematical functions or algorithms. For example, a field of feature vectors or a corresponding feature matrix of a plurality of tippy samples can be compared with a feature vector of a single tipping sample, or a suitable match value can be formed. Alternatively, it is also possible to form average values from several characteristics of different tipping samples, which are then compared with the characteristics of a single tip sample. Further comparable matching methods are additionally conceivable.

BRIEF DESCRIPTION OF THE FIGURES

Further advantages, characteristics and features of the present invention will become apparent in the following detailed description of embodiments with reference to the accompanying drawings. The drawings show this in a purely schematic way in

1 a representation of a personal computer to which the present invention is implemented;

2 a representation of the method steps of the method according to the invention;

3 a representation of the structure of a Tippverhaltensprofils and a corresponding adjustment of the Tippverhaltensprofils with tap data according to a first embodiment; and in

4 a representation of a Tippverhaltensprofils and the comparison with a tip sample according to a second embodiment of the invention.

EMBODIMENTS

The 1 shows a conventional PC (personal computer) 1 that with a screen 2 and a keyboard 3 Is provided. To access a user to the PC 1 and to personalize a network that may be connected to it, or to allow access only to certain persons, can be done when starting the PC 1 an authentication and / or identification routine are executed. Authentication requires the user to prove that he or she is the default user. He logs with an identification information or identifier, which may be given for example by his name, in the system and the system must now determine by an appropriate authentication routine, if the given user matches the registered users.

In an identification routine, the PC system 1 independently the identification of the user z. B. on the basis of a database with registered users, without the user himself must specify his identity, so his identification information or identifier.

In the method according to the invention or the corresponding device, such as a PC system 1 in which the method according to the invention is implemented, the authentication and / or identification is based on biometric data obtained from the typing behavior of the user. In addition, however, further authentication and / or identification measures can be carried out. Thus, for example, the input of a password can contribute to the identification or authentication on the one hand by checking the password, and on the other hand the method according to the invention can be used on the basis of the biometric data of the typing behavior obtained when the password is entered.

Accordingly, in 1 illustrated that, for example, in the authentication and / or identification routine twice an identical text, for example. A password in the keyboard 3 must be entered. In the embodiment shown the 1 this is the password "London".

Instead of in 1 illustrated keyboard 3 are of course all other input devices in which an actuation of a button, a switch, a touchpad or other touch-sensitive surface is required, also suitable as input devices. For example, the input of the password can also be done via a touch-sensitive screen or it can be used a single touch-sensitive field or a single button or switch, in which a certain rhythm is an operation such. B. in a Morse code.

According to the inventive method, the user has when registering on the PC system 1 First of all, the text, for example the password "London", has been typed in twice, whereby both the typing samples have been stored as registration sample samples, and a registration profile generated from the typing samples has also been stored.

As is clear from the 2 results in the later logon to the system again twice the password "London" is required. In turn, a profile, namely the login profile, is created from these typing data or filing tip samples. The comparison of the tipping samples submitted with the registration with the tipping samples submitted during the registration is now carried out in such a way that, on the one hand, the tipped samples S _enrol1 and _Enrol1 (enrollment enrollment (enrollment)) _submitted with the registration with the _{sample login samples} S _login1 and S _login2 (login for application) created profile P _login are compared and the registration tip samples S are compared _login1 and S _login2 with the registration of the tip samples S and S _{enrol1 enrol2} produced registration profile P _enroll. Accordingly, a crosswise comparison takes place and a total of four match values (match score) MS ₁ to MS _{4 are} generated. The match value MS ₁ is determined, for example, during the comparison of the tip sample S _enrol1 with the login _profile P _login , while the match _value MS _{2 is} generated from the comparison of the registration _sample S _enrol2 with the login _profile P _login . The match values MS ₃ and MS ₄ are then determined in accordance with the matching of the _{logon tip samples} S _login1 and S _login2 , each with the registration _profile P _enrol . From the thus determined match values MS ₁ to MS ₄ , a match end value MS _{ges is} generated, which serves to determine whether the authentication and / or identification was successful or not. For example, the match end value MS _ges must be within certain limits in order to successfully authenticate and / or identify the user on the PC system 1 respectively. By the crosswise comparison of the typed in the registration tipps, so the registration tip samples, with the registration profile generated from the Anmeldippproben and the matching of the typed in the registration tipps, so Anmierungsippproben, with the registration profile generated during registration, the security and performance of the authentication and / or identification can be significantly improved. In particular, a further increase can be achieved by using a plurality of identical tip samples, such. Example, in the embodiment in which the identical jigs with respect. The password "London" are submitted twice.

The 3 and 4 illustrate the procedure for matching the jog samples with the profiles and the structure of the profiles generated from the tipproh data.

The 3 shows a first embodiment in which a feature vector V _{1 is} formed from the raw tip data, which are detected, for example, when typing the password "London", comprising the three features M1, M2 and M3. The features can z. Example, the determined holding time of a key in the form of an average, the average transition period from the release of a key to press the next key and the transition period from pressing a key to press the next key or the like.

The profile P comprises the feature vectors V ₁ and V ₂ , which are generated when typing the password "London". Thus, for example, the feature vector V ₁ comprises the features M1, M2 and M3, which are determined upon first tapping of the password "London" as features M ₁₁ , M ₂₁ and M ₃₁ . The feature vector V ₂ accordingly comprises the features M ₁₂ , M ₂₂ and M ₃₂ , which were determined on the second input of the password "London".

As in the diagram of 3 ₄ , the corresponding feature vectors V ₁ and V _{2 represent} a point in the three-dimensional vector space corresponding to the features M ₁ , M ₂ and M ₃ .

By means of the feature vectors V ₁ and V ₂ , a feature space R can be defined, which is defined for example by the relationship of the feature vectors V ₁ and V ₂ to one another. The feature space R may be defined as the set of points, each defined within a sphere around the feature vector V ₁ and V ₂ corresponding to the distance between the feature vectors V ₁ and _V2.

When matching can now be checked whether a feature vector S, which includes the corresponding features S1, S2 and S3, which are generated in the registration procedure from the Anmeldippproben located in the feature space R. The location of the feature vector S in the feature space R can be described by a match value MS. From several match values MS ₁ to MS _n , a match end value MS _ges can be determined by means of which it can be decided whether the authentication and / or identification could be successfully completed.

In the embodiment of the 3 the profile is defined by a feature vector field or a feature space R generated therefrom.

In the embodiment which in the 4 is shown, a single feature vector from the average values of the detected features is used as profile P. For this purpose, for. For example, the average values from the two tap samples are formed when entering the word "London", as in 4 shown. Accordingly, features M ₁₁ and M ₁₂ and features M ₂₁ and M ₂₂ and features M ₃₁ and M _{32 are used} to form averages. The comparison with a feature vector S takes place here with respect to the profile vector P by means of a simple vector comparison, wherein the difference vector between the feature vector S and the profile P can be displayed as the match value MS.

Although the present invention has been described in detail with reference to the illustrated embodiments, it will be understood by those skilled in the art that the invention is not limited to these embodiments, but that these are merely illustrative and the invention may include modifications that omit individual features or otherwise combining the features presented without departing from the scope of the appended claims. In particular, the present invention includes all combinations of all features presented.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• WO 98/06020 A2 [0002]
• US 6151593 A [0002]

Claims (10)

A method of authenticating and / or identifying a person by typing on a keyboard, the method comprising: Registration of a person in which at least one registration sample is recorded and stored under an identifier, - create a registration profile based on the registration tip sample submitted at registration and save the registration profile under the identifier, - submission of at least one log-in sample during registration for authentication and / or identification, - Create a login profile based on the registration tip sample submitted at registration, and - cross-check the logon tip sample with the registration profile and the registration tip sample with the logon profile. A method according to claim 1, characterized in that at least two registration tip samples and at least two Anmierungsippproben are delivered or generated from an input. Method according to claim 1 or 2, characterized in that at least two registration tip samples and / or at least two logon tip samples with the same text or text components are detected. Method according to one of claims 2 or 3, characterized in that each of the number of Anmeldippproben with the registration profile and the number of registration tip samples are matched with the registration profile. Method according to one of the preceding claims, characterized in that a match value is determined during each adjustment. A method according to claim 5, characterized in that a match end value is formed from a plurality of match values. A method according to claim 6, characterized in that the agreement final value is compared with a threshold value. Method according to one of the preceding claims, characterized in that in the preparation of the registration and / or registration profile obtained from the key press raw tip data at least one characteristic feature is determined from the group, the duration of a key, the transition period from the release of a key to Pressing the next key, the transition period from releasing a key to release the next key, the transition period from pressing a key to pressing the next key, the error frequency or frequency, the tip rate, the attack frequency, single or multiple overhauls, the frequency of use certain function keys, the selection of alternative keys, the selection of the left or right shift key, temporal or key-related abnormalities which are distinguished by exceptional values from the determined data, location-related features which take into account the local position of the keys and includes combinations and statistical characteristics thereof. Method according to one of the preceding claims, characterized in that when generating the registration and / or login profile, the generated features are combined into averages, sums or the like or grouped into feature fields or vectors. Device which is so prepared and / or comprises a processable by a data processing system program code, so that a method according to any one of the preceding claims is feasible.

Images