DE102009044455A1 - Method for authenticating and/or identifying user of personal computer, involves accepting deception attempts during deviation of typing behavior of user for sequences, where typing behavior of user is adapted among each other - Google Patents

Abstract

The method involves authenticating and/or identifying a user through an operation of a keyboard (3) of a personal computer (PC) (1), where the keyboard operation comprises two sequences. The sequences are identical with respect to selection and/or alphabetic sequence of keys to be operated. The typing behavior of the user determined with respect to the sequences is adapted among each other. Deception attempts are verified during deviation of the typing behavior of the user for the sequences. A compliance value is formed from compliance values. An independent claim is also included for a device for authentication and/or identification of a user of a data processing system.

Description

BACKGROUND OF THE INVENTION

FIELD OF THE INVENTION

The present invention relates to a method for authentication and / or identification of a user of a data processing system comprising at least one keyboard, wherein the user is authenticated and / or identified by a keyboard operation. Furthermore, the present invention relates to a corresponding device in which this method is used.

STATE OF THE ART

The prior art discloses methods and devices for identifying and / or authenticating persons who use the typing behavior of the person to be authenticated or identified on a keyboard. Examples are in the WO 98/06020 A2 or the US 6,151,593 A given.

Although such authentications and / or identifications are difficult to circumvent or falsify, there are applications in which attempts to deceive are possible. This is, for example, the registration for services that are offered, for example, over the Internet in a limited way for free, for example, for first-time users. For this purpose, it is usually provided that the use is only possible for registered users and the user of the service must register at least at the first use, so that it can be continuously determined how long he uses the service already for free. However, since the real identification of an Internet user is difficult or very expensive, such limited free services are often misused in such a way that multiple registrations are made by one and the same person, so that the simulated new registration further free use is possible. This leads to a very high economic and technical effort for the service provider, since a large number of users must be registered and managed, for which space, technical equipment, etc. must be provided. In addition, there is also a corresponding economic damage, as a free trial offer is made in an illegal manner, a permanent use ratio, without paying the necessary fees. To counter this, biometric methods, such as authentication and / or identification by means of typing behavior, can be used, as already described in the unpublished patent application DE 10 2008 002 544 is described. Accordingly, the DE 10 2008 002 544 fully incorporated by reference into the disclosure. In a corresponding method, the biometric characteristic of the typing behavior is used to detect multiple registrations.

However, a user might be tempted to change his typing behavior during the first registration and / or the later logins to the service in such a way that multiple registrations are possible again.

DISCLOSURE OF THE INVENTION

OBJECT OF THE INVENTION

It is therefore an object of the invention to further develop the authentication and / or identification by means of typing behavior in such a way that abuse can be ruled out, for example, by multiple registration in online services or in general the faking of a specific identity. At the same time, however, the method and corresponding devices should be simple in design and easy to handle.

TECHNICAL SOLUTION

This object is achieved by a method having the features of claim 1 and a device having the features of claim 10. Advantageous embodiments are the subject of the dependent claims. In particular, it is achieved with the present invention that a multiple registration or initial registration is not possible even if a user adjusts his typing behavior, so that an abuse can be excluded by misadapted typing behavior.

The invention is based on the recognition that an improvement in the authentication and / or identification of a user by means of typing behavior can be achieved by the user having to enter at least two sequences during the dispensing of the tip sample, ie the key actuation or keyboard actuation an equal selection and / or sequence of keys, in particular sequences with identical text, requires, so that it can be determined by an adjustment of the typing behavior, which has been determined when entering the two sequences, whether a deviation is present or not. A detected deviation indicates that an attempt of deception exists in such a way that the user has adjusted his typing behavior. This can in particular be used already at a first registration of a new user, ie at the absolute beginning of an authentication and / or identification process, to attempts to deceive to discover and prevent. In the same way, the comparison, in particular continuous comparison or comparison of typing behavior values, which are determined from the same keyboard input sequences, can increase the overall authentication and / or identification reliability, ie the recognition certainty, since the influences on the determined ones result when comparing identical entries Typing behavior values can be eliminated by the different key entries and thus the requirements for the match of the typing behavior values can be increased.

The keypad actuation used for the authentication and / or identification can already be the first login, that is, the registration of the user. If the user enters z. B. twice the same text components, for example in the form of repeated input of the password, it can already be determined during registration (enrollment), whether the inputs differ with respect to the typing behavior, so as to determine whether the user deliberately obstructs his typing behavior. Since this is particularly difficult with identical inputs, an attempt to deceive can already be determined when registering for a service or system.

In addition, the identical keystrokes can be used in subsequent, so repeated applications (authentication) to the data processing system or the data processing system to increase the detection security and detect any deception attempts. Accordingly, it is also possible to use the keyboard operations during normal operation, ie, for example, the operation of the data processing system or a corresponding system, so that a continuous review can be done and in particular can also be determined whether the typing behavior has a certain consistency.

The keystroke sequences with identical inputs may only relate to a portion of the keypad actuation for authentication and / or identification, or may represent the entire keypad actuation for authentication and / or identification. For example, it may therefore be required that twice the complete identical passphrase or the completely identical password is entered, based on these inputs, the method for authentication and / or identification is performed with the mutual adjustment of the identical sequences. Alternatively, only parts of the password or the passphrase can represent repetitions, ie identical sequences, which can be used to check the concurrence of the typing behavior. In addition, repeated entries in "normal operation" can be compared with each other and with the typing profile stored for the registration.

The necessary in the inventive method detecting the typing behavior can be done on a conventional computer keyboard, in which appropriate data on the pressing and releasing the keys, in particular z. B. the times of pressing and / or letting go of a key or the holding time of a key are detected. In addition to such conventional keyboards, of course, all other input devices are used in which appropriate touches are triggered by a user, such as touch-sensitive screens on which z. B. a keyboard can be represented by software, or other touch-sensitive surfaces.

The authentication means in the context of the present description that in a corresponding system, for. B. a personal computer or a network of multiple personal computer, a specific user is detected and known and the user also logs on under his own identity or identifier to the system. The authentication thus only checks whether the given person actually agrees with the person who has been registered.

In the identification of a person is in the corresponding system, ie the computer system or a corresponding network, also a registration for the user before, but the user does not reveal his identity when logging, but the system can the user on the basis of typed typing data independently recognize, so identify.

The present invention can be used for both purposes to improve the detection security and / or the detection of deceptive attempts.

Instead of only two identical sequences of keyboard input, in the present method for authentication and / or identification also several identical sequences and / or several pairs of identical sequences with respectively mutual matching may be used.

At each match, a match score may be formed that is used to determine whether or not the match of the jog behavior in the sequences is sufficiently high.

In particular, one of the plurality of match values may be a match end value are formed, such. B. by appropriate mathematical methods, such as averaging or the like.

The match end value or individual match values from the various matchings may be compared to a threshold, or it may be checked whether those match values are within a certain predetermined range.

When creating a tip behavior profile, at least one characteristic feature can be determined from the raw tip data obtained during keyboard operation. Such characteristic features of the key operation or the typing behavior can be formed by the holding time of a specific key or different keys or corresponding average values. In addition, it is also possible transition periods from releasing one, in particular a specific key, or all keys as an average value until pressing the next key, and transition periods of releasing a key to release the next key or the transition periods from pressing a key to press next key. These features can all be related to specific keys or key sequences, or determined as averages for all keystrokes of a sequence. In addition, the error frequency or error frequency can be detected, ie the fact how often and in which intervals the user has to correct his inputs. In addition, the tip rate, ie the ratio of the number of typed characters to the duration or the attack frequency can be determined as a feature. Likewise, simple or multiple overhauls, that is, the actuation of the next key prior to releasing the previous key, the frequency of use of certain function keys, the selection of alternative keys, such as the selection of the left or right font keys, and the like, may be taken as features , Also, temporal, key-related abnormalities, such as particularly long transition periods after pressing a particular key or special location-related features that take into account the local position of the actuated keys, can also be used. All features can be combined with each other to form new features, or statistical characteristics can be determined from them as features.

Corresponding profiles, ie typing behavior profiles, can be generated from the features, wherein corresponding values of the profile can be determined from the generated features by mathematical functions, for example by forming average values, totals or the like. However, the profiles may also include corresponding feature fields and / or feature vectors that characterize the typing behavior.

A comparison of the tipping samples from the sequences can be performed by mathematical functions or algorithms. For example, a feature vector from a jog sample of a sequence may be compared with a feature vector of a jog sample from another sequence, or a suitable match value may be formed. Further comparable matching methods are additionally conceivable.

If an attempt to deceive is determined from the determined values for the typing behavior, then the corresponding authentication and / or identification can be denied or revoked, or a closer examination can be connected with further checks. In particular, z. For example, an online service may be denied or revoked, or may be subject to further review.

BRIEF DESCRIPTION OF THE FIGURES

Further advantages, characteristics and features of the present invention will become apparent in the following detailed description of embodiments with reference to the accompanying figures. The figures show this in a purely schematic way in

1 an illustration of a conventional computer system with which the present invention can be used;

2 a representation of the input of a text for registration and / or authentication to a computer system as in 1 shown; and in

3 a representation of another embodiment of the present invention, which in the input of a text in the computer system 1 is applied.

Embodiment

The 1 to 3 represent in a purely schematic manner, the application of the following invention in various embodiments.

For example, according to the embodiments, the present invention may be used to access a computer system or even a single personal computer PC 1 to allow, as he schematic in 1 with an associated monitor 2 as an output unit and a keyboard 3 is shown as an input unit.

To the PC 1 or to be able to work with a computer network connected thereto, the user must first be registered in the system, for which purpose the user is assigned an identity, for example a user name.

To ensure that the user is also the same as the registered user, authentication or identification must be performed by the system.

Authentication here means that the system verifies that the default user is actually the registered user whom he claims to be at logon. During identification, the system can automatically determine which of the registered users is trying to log in to the system.

For authentication and / or identification may be the typing behavior of the user on the keyboard 3 Use, which is characteristic for each user and thus is clearly associated with a user. Instead of the commercial keyboard shown 3 of the computer system 1 Also, other input devices, in which in the broadest sense key presses must be made, such as the input via touch-sensitive screens or surfaces and the like, find use. When entering data via the keyboard, raw tip data can be obtained from which the typing behavior can be determined. The raw tip data consist, for example, of the record of which key presses were performed warm. From these raw hint data, corresponding characteristic features such as holding periods of keys, transition periods indicating the release of one key and the operation of the following key can be obtained, and the like. These characteristic features of the typing behavior can be used alone or in combination with other authentication and / or identification means in order to authenticate or identify the user of the data processing system. For example, the authentication and / or identification by means of the typing behavior may be associated with the input of a password or passphrase.

Thus, upon first registration of a user under the specified user name, a password input can be requested, wherein not only the password or the passphrase is registered for the user name, but also the associated typing behavior.

When re-logging to the system then the input of the user name, so the identifier, and the input of the passphrase or the password is required, whereby first the match of the password to the registered password and also the match of the typing behavior are checked. For this purpose, a comparison is made between the typing behavior during registration and the typing behavior, as determined during registration. If the password or the passphrase and the typing behavior match the values stored during registration, then the registration is successfully completed and the user is granted access to the system.

Since such authentication methods are offered for a variety of services in the global computer network of the Internet, without an immediate verification of the identity of the user can take place, it is interesting to capture multiple registrations especially for limited-free offers. This can be determined, for example, by a corresponding adjustment of the typing behavior of a new user to be registered or an already registered user with other users, as for example in the German patent application DE 10 2008 002 544 is described. Accordingly, the description of this patent application is incorporated in full by reference in this application. However, a user who knows that his registration or registration includes the determination of his typing behavior, try to make a further registration by pretending another typing behavior. Furthermore, it is conceivable that attempts are made to imitate the typing behavior of other users in order to gain access to the system under the wrong username.

This is where the present invention is based, as shown in FIG 2 upon initial registration and / or repeated login, it is required that a particular text such as the password or passphrase be entered twice. If the same text is entered twice or more via the keyboard 3 can be found by comparing the typing behavior when typing the identical text or the corresponding key operation in the same text out whether a match of typing behavior is present or not. In 2 Thus, when entering the password, the word Text is entered twice and, as indicated by the arrows, the input of these two words is compared with regard to the typing behavior.

If it is determined by the system that the typing behavior in the identical text samples is different, then it is reasonable to suppose that an attempt to deceive has been made. In this case, either the authentication and / or identification can be rejected or a more accurate verification to determine a possible attempted deception.

Another embodiment is in 3 shown. Here, the input of, for example, a text is used in a word processing program to check the authentication and / or identification based on repeatedly occurring identical sequences of keyboard input. In the embodiment shown the 3 For example, whenever the word TEXT appears, the jogging behavior with respect to that component is determined and mutually aligned with other sequences in which the word TEXT also occurs, so that the authentication and / or identification is continuously checked or the security of a proper authentication and / or identification can be increased and improved.

Although the present invention has been described in detail with reference to the embodiments, it will be understood by those skilled in the art that the invention is not limited to these embodiments, but modifications are possible in a manner that eliminates individual features presented or other combinations of the features presented without departing from the scope of the appended claims. In particular, the present invention claims all combinations of old features presented.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• WO 98/06020 A2 [0002]
• US 6151593 A [0002]
• DE 102008002544 [0003, 0003, 0035]

Claims (10)

A method for authenticating and / or identifying a user of a data processing system comprising at least one keyboard, wherein the user is authenticated and / or identified by a keyboard operation, characterized in that the keyboard operation comprises at least two sequences relating to the selection and / or order the keys to be operated are identical, with respect to the sequences determined typing behavior is compared with each other and in case of a deviation of the typing behavior for the two sequences a deception attempt is adopted. A method according to claim 1, characterized in that the keyboard operation comprises the first or a repeated logon to the data processing system or a system used therewith and / or the operation of the data processing system or the system. A method according to claim 1 or 2, characterized in that the sequences represent a total of a part of the keyboard for authentication and / or identification and / or the entire keyboard operation for authentication and / or identification. Method according to one of the preceding claims, characterized in that the typing behavior is determined by determining at least one characteristic feature from the group, which is the holding time of a key, the transition period from releasing a key to press the next Key, the transition period from releasing a key to release the next key, the transition period from pressing a key to pressing the next key, the error frequency or frequency, the tip rate, the attack frequency, single or multiple overhauls, the frequency of use of certain function keys, the selection of alternative keys, the selection of the left or right shift key, temporal or key-related abnormalities, which are distinguished by exceptional values from the determined data, location-related features in which the local position of the keys is taken into account, and the like d includes combinations and statistical characteristics thereof. Method according to one of the preceding claims, characterized in that the typing behavior is determined by combining the features generated from the raw tip data into mean values, totals or the like or grouping them into feature fields or vectors. Method according to one of the preceding claims, characterized in that a match value is determined for each adjustment of the sequences. A method according to claim 6, characterized in that a match end value is formed from a plurality of match values. A method according to claim 7, characterized in that the match score (s) and / or the match score are compared to a threshold value. Method according to one of the preceding claims, characterized in that the acceptance and / or identification and / or registration is refused or revoked or checked in more detail in the assumption of an attempted deception. An apparatus comprising a keyboard and a data processing program executable on or with the apparatus, wherein the data processing program, when executed, performs a method according to any one of the preceding claims.

Images