ZEBRA taps keyboard dynamics to identify users
Connecting state and local government leaders
Dartmouth’s ZEBRA program uses a sensor bracelet that compares subtle wrist movements with keyboard inputs to authenticate -- and deauthenticate -- computers users.
Unattended computers are a recognized security risk. So are users who don’t follow security protocols. In some settings, that combination can be life threatening.
In busy hospitals, for example, doctors, nurses and health care staff use the same computers to update patient information. Studies have found that doctors frequently enter health data into the wrong patient’s record because they thought the open record on the computer at hand belonged to the patient they were treating – when in fact the previous user had not closed the record he was working on and logged out.
Even in situations where workers have their own computers, users get distracted and forget to log out or find workarounds to avoid frequent logins.
IT managers have tried, with varying degrees of success, a variety of deauthentication techniques. Automatic logouts after a period of inactivity aren’t sensitive to context, and proximity sensors don’t work well in crowded environments.
Researchers have been working on a way to continuously authenticate users while they are using a computer terminal and automatically log them out when they leave. That’s the idea – though not yet the technology – behind ZEBRA, or Zero Effort Bilateral Recurring Authentication.
The Dartmouth College Trustworthy Health and Wellness (THaW) program, funded by the National Science Foundation, developed ZEBRA as a way to protect medical records in clinical settings by preventing accidental (or intentional) misuse of a user’s account on a vacant terminal.
With the ZEBRA system, developed by Shrirang Mare, a Ph.D. candidate in computer science, a user wears a bracelet with a built-in radio, gyroscope and accelerometer. When the worker is using a computer equipped with ZEBRA software, the computer records the wrist movements transmitted from the bracelet.
ZEBRA compares the bracelet movements with keyboard and mouse input and, if they correlate, the user is authorized. “You can authenticate with the base once at the beginning of the day and then when you take off the bracelet, the bracelet can detect that it has been taken off,” Mare said.
If a ZEBRA user steps away and someone else starts using the computer, the two sequences of interactions will not match, and the terminal will deauthenticate the ZEBRA user, forcing the second user to login.
In testing, ZEBRA performed with 85 percent accuracy when given 11 seconds to record activity. The accuracy rate increased to 90 percent when the system was given 50 seconds to record activity. According to Mare, the errors are primarily due to periods of minimal wrist movement by the user.
The team is continuing to work on lowering the error rates. “Thirty seconds is a long time for an attacker to do some damage,” Mare noted.
It’s also possible that the bracelet itself could be better adapted for the purpose. Currently, ZEBRA uses a commercially available Shimmer bracelet, a wearable sensor platform that has been used in applications from assistive robotics and environmental monitoring to sports performance management.
And Mare said that the most recent version of the Shimmer bracelet, Shimmer3, already promises improvement over the previous version. “Shimmer3 has a new low-noise accelerometer sensor compared to Shimmer2R, and we are exploring that,” Mare said. “We are also exploring new ways to improve accuracy through changes in software.”