SECURITY

Password Analysis Measures Typing Speed and Rhythm

Rebecca Kutzer-Rice | Date: 05-27-11 | Comments

Researchers have created a key-pattern analysis program that measures the speed and rhythm at which a password is typed. These biometrically based passwords are more secure than traditional passwords and could help prevent hacking attacks on both companies and individuals.

With the rise of phishing attacks and keystroke logging, it's clear that even the most complicated and frequently updated password is not totally secure. A new approach from researchers at American University of Beirut analyzes more than just the characters of passwords�it also verifies the speed and rhythm at which they are typed.

Key-pattern analysis (KPA)�the examination of typing beat and speed�can also measure the force with which a user taps keys. This type of analysis creates a biometric profile of the user. Even if the right numbers, letters and symbols are entered, if the biometric profile does not match, the password will fail.

Key-pattern analysis could give rise to a new generation of passwords.

KPA usually requires specially modified keyboards. In their study, the researchers, including Ravel Jabbour, Wes Masri and Ali El-Hajj, avoided modified keyboards, which are inconvenient for users to obtain and install. They also identified other problems with traditional KPA. Typically, for example, analysis focuses on inter-timing, the pause between pressing each key. Researchers found that this measurement was not accurate enough to identify legitimate users.

The new KPA program measures intra-timing, how long each key is pressed. This measurement is more robust than inter-timing, and it more accurately distinguishes legitimate from illegitimate users. Using a standard keyboard, the program gathers information about a user from electrical signals in the keys.

When a user types in the password, the program compares its typing pattern with a pre-stored pattern created by the user during initial setup. The KPA algorithm looks at both inter- and intra-timing to confirm a user's identity.

As with traditional passwords, a longer password is better for KPA security, since it produces a more complex typing pattern than shorter combinations. Typing patterns for longer passwords, however, could be more difficult for a user to reproduce.

For group accounts and company teams, the KPA program can create multiple profiles for the same password to ensure the ability to share securely.

Better KPA programs like this could mean the rise of a new generation of biometrically based passwords�translating to more secure personal and company accounts.