Emerging Tech

Blog archive
ZEBRA taps keyboard dynamics to identify users

ZEBRA taps keyboard dynamics to identify users

Unattended computers are a recognized security risk. So are users who don’t follow security protocols. In some settings, that combination can be life threatening.

In busy hospitals, for example, doctors, nurses and health care staff use the same computers to update patient information. Studies have found that doctors frequently enter health data into the wrong patient’s record because they thought the open record on the computer at hand belonged to the patient they were treating – when in fact the previous user had not closed the record he was working on and logged out.

Even in situations where workers have their own computers, users get distracted and forget to log out or find workarounds to avoid frequent logins.

IT managers have tried, with varying degrees of success, a variety of deauthentication techniques.  Automatic logouts after a period of inactivity aren’t sensitive to context, and proximity sensors don’t work well in crowded environments.

Researchers have been working on a way to continuously authenticate users while they are using a computer terminal and automatically log them out when they leave. That’s the idea – though not yet the technology – behind ZEBRA, or Zero Effort Bilateral Recurring Authentication.

The Dartmouth College Trustworthy Health and Wellness (THaW) program, funded by the National Science Foundation, developed ZEBRA as a way to protect medical records in clinical settings by preventing accidental (or intentional) misuse of a user’s account on a vacant terminal.  

With the ZEBRA system, developed by Shrirang Mare, a Ph.D. candidate in computer science, a user wears a bracelet with a built-in radio, gyroscope and accelerometer.  When the worker is using a computer equipped with ZEBRA software, the computer records the wrist movements transmitted from the bracelet. 

ZEBRA compares the bracelet movements with keyboard and mouse input and, if they correlate, the user is authorized. “You can authenticate with the base once at the beginning of the day and then when you take off the bracelet, the bracelet can detect that it has been taken off,” Mare said.

If a ZEBRA user steps away and someone else starts using the computer, the two sequences of interactions will not match, and the terminal will deauthenticate the ZEBRA user, forcing the second user to login.

In testing, ZEBRA performed with 85 percent accuracy when given 11 seconds to record activity. The accuracy rate increased to 90 percent when the system was given 50 seconds to record activity.  According to Mare, the errors are primarily due to periods of minimal wrist movement by the user. 

The team is continuing to work on lowering the error rates. “Thirty seconds is a long time for an attacker to do some damage,” Mare noted. 

It’s also possible that the bracelet itself could be better adapted for the purpose.  Currently, ZEBRA uses a commercially available Shimmer bracelet, a wearable sensor platform that has been used in applications from assistive robotics and environmental monitoring to sports performance management.

And Mare said that the most recent version of the Shimmer bracelet, Shimmer3, already promises improvement over the previous version.  “Shimmer3 has a new low-noise accelerometer sensor compared to Shimmer2R, and we are exploring that,” Mare said.  “We are also exploring new ways to improve accuracy through changes in software.” 

Posted by Patrick Marshall on Oct 07, 2014 at 11:41 AM


Featured

  • FCW Perspectives
    human machine interface

    Your agency isn’t ready for AI

    To truly take advantage, government must retool both its data and its infrastructure.

  • Cybersecurity
    secure network (bluebay/Shutterstock.com)

    Federal CISO floats potential for new supply chain regs

    The federal government's top IT security chief and canvassed industry for feedback on how to shape new rules of the road for federal acquisition and procurement.

  • People
    DHS Secretary Kirstjen Nielsen, shown here at her Nov. 8, 2017, confirmation hearing. DHS Photo by Jetta Disco

    DHS chief Nielsen resigns

    Kirstjen Nielsen, the first Homeland Security secretary with a background in cybersecurity, is being replaced on an acting basis by the Customs and Border Protection chief. Her last day is April 10.

Stay Connected

Sign up for our newsletter.

I agree to this site's Privacy Policy.