TapDynamics : Strengthening User Authentication on Mobile Phones with Keystroke Dynamics

The convenience and ubiquity of mobile devices make them a rich source of personal data such as email and financial information. Unfortunately, this data is often guaded by only a simple drawing pattern or short PIN code, which recent literature has shown to be woefully insecure [1]; as a particularly scary example, Bonneau’s recent work suggests that an attacker can guess most users’ PIN codes after only eleven attempts [2]. With the the rise of smartphone theft, we see a crucial need for stronger security mechanisms that protect a user’s data on smartphones. Our project aims to address this problem by strengthening user authentication when a person unlocks/logs into a phone. Specifically, we construct and analyze four keystroke dynamic classifiers that use a smartphone’s sensors to learn the key tap behavior of the true owner. After this training, our classifiers can be used to determine whether a login attempt is being made by the true owner or by an attacker who has guessed the owner’s PIN.