Continuous Multimodal Biometric Authentication for PC and Handheld Devices

Biometric authentication systems offer a secure and convenient method of verifying the identity of individuals based on their unique physiological or behavioral traits. This paper presents a comprehensive survey of biometric authentication systems, focusing on the principles, technologies, applications, challenges, and future directions in the field. The survey covers various biometric modalities, including fingerprint recognition, iris recognition, facial recognition, keystroke dynamics, voice recognition, and gait analysis. Key topics discussed include the use of multi-modal biometric systems, continuous authentication, machine learning, and AI in biometrics, and biometric encryption. The paper also explores the implementation of biometric authentication in access control systems, financial transactions, healthcare systems, and government and law enforcement. Challenges such as security and privacy concerns, spoofing and impersonation, scalability and integration, and ethical and legal issues are addressed. Future research opportunities include improving accuracy and reliability, enhancing security and privacy, addressing societal and ethical concerns, and integrating biometric authentication with the Internet of Things (IoT).

Continuous authentication with feature-level fusion of touch gestures and keystroke dynamics to solve security and usability issues

Behavioral biometrics & continuous user authentication on mobile devices: A survey

Digital financial platforms rely heavily on session-based authentication mechanisms that verify user identity only at discrete checkpoints, leaving systems vulnerable to post-login account takeover attacks. Continuous authentication based on behavioral biometrics has emerged as a promising solution for maintaining persistent identity assurance throughout active sessions. This work proposes a real-time behavioral biometric framework for continuous authentication using keystroke dynamics and sequential monitoring of interaction patterns. The proposed method models user-specific behavioral structure through reconstruction consistency in a low-dimensional subspace learned from enrollment data. Incoming interaction events are evaluated in real time using reconstruction error, and a sliding temporal window aggregates behavioral deviation to support stable decision making. User-specific thresholds derived from enrollment statistics enable adaptive sensitivity control, while takeover detection latency is explicitly quantified to assess operational security effectiveness. Experiments were conducted using the CMU Keystroke Dynamics benchmark under simulated session takeover scenarios. Performance was evaluated using verification metrics including false acceptance rate, false rejection rate, equal error rate, and temporal detection delay. Results demonstrate that the proposed framework achieves reliable identity discrimination while enabling rapid detection of behavioral takeover events with low latency and stable threshold behavior. The findings confirm that continuous behavioral monitoring can significantly reduce the exposure window of compromised sessions, even under unimodal biometric sensing. The proposed framework provides a computationally efficient and deployment-ready approach for strengthening real-time security in financial transaction ecosystems.

Continuous authentication utilizes automatic recognition of certain user\nfeatures for seamless and passive authentication without requiring user\nattention. Such features can be divided into categories of physiological\nbiometrics and behavioral biometrics. Keystroke dynamics is proposed for\nbehavioral biometrics-oriented authentication by recognizing users by means of\ntheir typing patterns. However, it has been pointed out that continuous\nauthentication using physiological biometrics and behavior biometrics incur\nprivacy risks, revealing personal characteristics and activities. In this\npaper, we consider a previously proposed keystroke dynamics-based\nauthentication scheme that has no privacy-preserving properties. In this\nregard, we propose a generic privacy-preserving version of this authentication\nscheme in which all user features are encrypted -- preventing disclosure of\nthose to the authentication server. Our scheme is generic in the sense that it\nassumes homomorphic cryptographic primitives. Authentication is conducted on\nthe basis of encrypted data due to the homomorphic cryptographic properties of\nour protocol.\n

Continuous authentication offers the ability to continuously verify users' identity for accessing to the protected resource. Although current explorations such as face and fingerprint verification have seen varying rates of success, three main problems may limit their applicability in the context of information protection and access control: they can be of low availability in some practical scenarios, they can be intrusive, and they commonly require costly equipment. This paper presents a multimodal biometrics authentication system that can continuously verify the presence of a logged-in user. Three passive biometric modalities are currently used - keystroke (i.e., behavioral biometric), face (i.e., physiological biometric), and skin color (i.e., soft biometric) - but our approach can also be readily extended to include more modalities. By fusing these three passive biometrics, the continuous authentication system combines both temporal and modality information holistically, and can keep verifying who is using the computing system, without troubling users' routine activities. Based on real data resulting from our implementation, we find the results to be very promising with a false-acceptance rate of 0% and a false-rejection rate of 0.72%. Additional experiment on the size of observation window is provided to further examine the applicability of the proposed approach.

Traditional keyboards remain the input device of choice for typing-heavy environments. When attached to sensitive data, security is a major concern. To continuously authenticate users in these environments, use of keystroke dynamics can be a preferred choice. An integral part of user enrollment in a keystroke based continuous authentication system is the writing instruction (prompt) given to the users, to use as a basis for their improvised writing. There are many prompts possible, and they directly impact the performance of authentication systems. Hence, prompts should be designed carefully, and with purpose. In this paper, we bridge the gap between cognitive psychology and computer science and attempt to influence the mental state of the users to acquire a better authentication performance. We compare two kinds of writing prompts, creative and factual, for generating reference samples. In addition, we perform two robustness tests: robustness to dissimilar writing style (e.g., creative reference and factual test) and robustness to surface (e.g., hard surface reference and soft surface test). We collect data from thirty participants in four weekly sessions. We experiment with three features: key interval, key press, and key hold latencies. We use Relative (R) measure to generate the match score between the reference and test samples. Results show that creative writing consistently performs better than the factual one. Both writing prompts perform well with dissimilar style in testing, i.e., continuous authentication is found robust to writing style. Also, we find that the surface (hard or soft) used in testing need not match that used for the reference, thus continuous authentication is also surface robust.

This book is on biometric authentication and proposes to use keystroke dynamics to avoid password-based authentication problems such as shared or stolen. The difficulties concerning password-based are that most users option for simple passwords. They prefer using similar passwords spanning distinct applications (Vance, 2010). Keystroke dynamics is known to overcome these circumstances. Keystroke dynamics measures the rhythms that a person exhibits while typing on a keyboard. In this sense, keystroke dynamics is a behavioural biometric modality, as well as signature dynamics, gait and voice (Klevans and Rodman, 1997; Monrose and Rubin, 2000; Impedovo and Pirlo, 2007; Moustakas et al., 2010). Among the advantages of keystroke dynamics in comparison to other modalities, it can be mentioned here that it is a low-cost modality: indeed, neither extra sensor nor device is required (Giot et al., 2011; Bours, 2012). The counterpart to this low cost and ease of use is the worst performances compared to those obtained with morphological biometric modalities such as fingerprint, face and iris (Wildes, 1997; Maio and Jain, 2009). The rather worse performances of keystroke dynamics (in comparison to other modalities) can be explained by the large intra-class variability of the users’ behaviour. Indeed, the way of typing continuously evolves when time elapses. One way to handle this variability is to consider additional information in the decision process. Future perspectives of these security procedures could be a new paradigm in cybersecurity applications.

Continuous authentication has been proposed as a complementary security mechanism to password-based authentication for computer devices that are handled directly by humans, such as smart phones. Continuous authentication has some privacy issues as certain user features and actions are revealed to the authentication server, which is not assumed to be trusted. Wei et al. proposed in 2021 a privacy-preserving protocol for behavioral authentication that utilizes homomorphic encryption. The encryption prevents the server from obtaining sampled user features. In this paper, we show that the Wei et al. scheme is insecure regarding both an honest-but-curious server and an active eavesdropper. We present two attacks: The first attack enables the authentication server to obtain the secret user key, plaintext behavior template and plaintext authentication behavior data from encrypted data. The second attack enables an active eavesdropper to restore the plaintext authentication behavior data from the transmitted encrypted data.

Current authentication mechanisms have a barely addressed problem: they only authenticate a user at the login procedure. If a user leaves the desk without logging out or locking computer session, an intruder has an occasion to use the system. This paper proposes an authentication methodology that is both inexpensive and non-intrusive and authenticates users continuously while using a computer keyboard. The proposed methodology uses neural networks committee machines to recognize user’s typing pattern, which is a biometric behavioral characteristic. The continuous authentication prevents potential attacks when user leaves the desk without logging out or locking computer session. Some experiments are done to evaluate and calibrate the authentication committee.

The traditional static password-based authentication schemes are insufficient to fully protect user privacy. They suffer from various usability and security issues which are usually utilized by online criminals to obtain users' passwords and control their accounts. In 2014 more than 4.9 million Gmail accounts have been compromise and published online. As a response to such incidents security researchers have started to investigates other alternative authentication methods. Currently there is a growing body of research to improve user authentication based on physiological and behavioral biometrics. In this paper we review the literature and discuss several related studies. Additionally, we propose the use of free-password authentication scheme using vein recognition at the login stage and keystroke dynamics as a continuous authentication during the user session.

Session authentication schemes establish the identity of the user only at the beginning of the session, so they are vulnerable to attacks that tamper with communications after the establishment of the authenticated session. Moreover, smartphones themselves are used as authentication means, especially in two-factor authentication schemes, which are often required by several services. Whether the smartphone is in the hands of the legitimate user constitutes a great concern, and correspondingly whether the legitimate user is the one who uses the services. In response to these concerns, Behavioral Biometrics (BB) Continuous Authentication (CA) technologies have been proposed on a large corpus of literature. This paper presents a research on the development and validation of a BBCA system (named BioPrivacy), that is based on the user’s keystroke dynamics, using a Multi-Layer Perceptron (MLP). Also, we introduce a new behavioral biometrics collection tool, and we propose a methodology for the selection of an appropriate set of behavioral biometrics. Our system achieved 97.18% Accuracy, 0.02% Equal Error Rate (EER), 97.2% True Acceptance Rate (TAR) and 0.02% False Acceptance Rate (FAR).KeywordsMachine learningBehavioral biometricsContinuous authenticationMobile devicesMulti-layer perceptron (MLP)

Copyright © 2018 by SCITEPRESS – Science and Technology Publications, Lda. All rights reserved. Continuous authentication using keystroke dynamics is significant for applications where continuous monitoring of a user’s identity is desirable, for example in the context of the online assessments and examinations frequently encountered in eLearning environments. In this paper, a novel approach to realtime keystroke continuous authentication is proposed that is founded on a sinusoidal signal based approach that takes into consideration the sequencing of keystrokes. Three alternative time series representations are considered and compared: Keystroke Time Series (KTS), Discrete Fourier Transform (DFT) and Discrete Wavelet Transform (DWT). The proposed process is fully described and analysed using three keystroke dynamics datasets. The evaluation also includes a comparison with the established Feature Vector Representation (FVR) approach. The reported evaluation demonstrates that the proposed method, coupled with the DWT representation, outperforms other approaches to keystroke continuous authentication with a best overall accuracy of 98.24%; a clear indicator that the proposed keystroke continuous authentication using time series analysis has significant potential.

Keystroke dynamics has been used as a form of one-time user authentication and continuous verification especially when it comes to securing the cyberspace. In this paper, we present the idea of using keystroke dynamics as a form of second layer authentication in web applications. We showed that this method can authenticate a user with high accuracy and can be used as an alternate to CAPTCHA tests, security questions and image selections that are being used today. We have developed a working web-based platform in a browser environment that enforces the proposed second-layer security. We performed penetration test experiments by launching a total of 598,500 impostor and genuine authentication attempts and found the Equal Error Rate (EER) as 10.5%.

This study introduces AffectiVR, a dataset designed for periocular biometric authentication and emotion evaluation in virtual reality (VR) environments. To maximize immersion in VR environments, interactions must be seamless and natural, with unobtrusive authentication and emotion recognition technologies playing a crucial role. This study proposes a method for user authentication by utilizing periocular images captured by a camera attached to a VR headset. Existing datasets have lacked periocular images acquired in VR environments, limiting their practical application. To address this, periocular images were collected from 100 participants using the HTC Vive Pro and Pupil Labs infrared cameras in a VR environment. Participants also watched seven emotion-inducing videos, and emotional evaluations for each video were conducted. The final dataset comprises 1988 monocular videos and corresponding self-assessment manikin (SAM) evaluations for each experimental video. This study also presents a baseline study to evaluate the performance of biometric authentication using the collected dataset. A deep learning model was used to analyze the performance of biometric authentication based on periocular data collected in a VR environment, confirming the potential for implicit and continuous authentication. The high-resolution periocular images collected in this study provide valuable data not only for user authentication but also for emotion evaluation research. The dataset developed in this study can be used to enhance user immersion in VR environments and as a foundational resource for advancing emotion recognition and authentication technologies in fields such as education, therapy, and entertainment. This dataset offers new research opportunities for non-invasive continuous authentication and emotion recognition in VR environments, and it is expected to significantly contribute to the future development of related technologies.