Emerging Tech

Blog archive
ZEBRA taps keyboard dynamics to identify users

ZEBRA taps keyboard dynamics to identify users

Unattended computers are a recognized security risk. So are users who don’t follow security protocols. In some settings, that combination can be life threatening.

In busy hospitals, for example, doctors, nurses and health care staff use the same computers to update patient information. Studies have found that doctors frequently enter health data into the wrong patient’s record because they thought the open record on the computer at hand belonged to the patient they were treating – when in fact the previous user had not closed the record he was working on and logged out.

Even in situations where workers have their own computers, users get distracted and forget to log out or find workarounds to avoid frequent logins.

IT managers have tried, with varying degrees of success, a variety of deauthentication techniques.  Automatic logouts after a period of inactivity aren’t sensitive to context, and proximity sensors don’t work well in crowded environments.

Researchers have been working on a way to continuously authenticate users while they are using a computer terminal and automatically log them out when they leave. That’s the idea – though not yet the technology – behind ZEBRA, or Zero Effort Bilateral Recurring Authentication.

The Dartmouth College Trustworthy Health and Wellness (THaW) program, funded by the National Science Foundation, developed ZEBRA as a way to protect medical records in clinical settings by preventing accidental (or intentional) misuse of a user’s account on a vacant terminal.  

With the ZEBRA system, developed by Shrirang Mare, a Ph.D. candidate in computer science, a user wears a bracelet with a built-in radio, gyroscope and accelerometer.  When the worker is using a computer equipped with ZEBRA software, the computer records the wrist movements transmitted from the bracelet. 

ZEBRA compares the bracelet movements with keyboard and mouse input and, if they correlate, the user is authorized. “You can authenticate with the base once at the beginning of the day and then when you take off the bracelet, the bracelet can detect that it has been taken off,” Mare said.

If a ZEBRA user steps away and someone else starts using the computer, the two sequences of interactions will not match, and the terminal will deauthenticate the ZEBRA user, forcing the second user to login.

In testing, ZEBRA performed with 85 percent accuracy when given 11 seconds to record activity. The accuracy rate increased to 90 percent when the system was given 50 seconds to record activity.  According to Mare, the errors are primarily due to periods of minimal wrist movement by the user. 

The team is continuing to work on lowering the error rates. “Thirty seconds is a long time for an attacker to do some damage,” Mare noted. 

It’s also possible that the bracelet itself could be better adapted for the purpose.  Currently, ZEBRA uses a commercially available Shimmer bracelet, a wearable sensor platform that has been used in applications from assistive robotics and environmental monitoring to sports performance management.

And Mare said that the most recent version of the Shimmer bracelet, Shimmer3, already promises improvement over the previous version.  “Shimmer3 has a new low-noise accelerometer sensor compared to Shimmer2R, and we are exploring that,” Mare said.  “We are also exploring new ways to improve accuracy through changes in software.” 

Posted by Patrick Marshall on Oct 07, 2014 at 11:41 AM


Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

Sign up for our newsletter.

I agree to this site's Privacy Policy.