Authentication by Keystroke Timing: Some Preliminary Results

The growing use of computers to store sensitive, private, and classified information makes it increasingly important to be able to determine with a very high degree of confidence the identity of an individual seeking access to the computer. This report summarizes preliminary efforts to establish whether an individual can be identified by the statistical characteristics of his or her typing. Can people be identified by the way they type To investigate this question, an experiment was carried out at Rand, in which seven professional typists were each given a paragraph of prose to type, and the times between successive keystrokes were recorded. This procedure was repeated 4 months later with the same typists and the same paragraph of prose. By examining the probability distributions of the times each typist required to type certain pairs of successively typed letters digraphs, the authors found that of the large number of digraphs represented in most ordinary paragraphs, there were five which, considered together, could serve as a basis for distinguishing among the subjects. The implications of this finding are that touch typists appear to have a typing signature, and that this method of distinguishing subjects might provide the basis for a computer authentication system.