Deterring password sharing: user authentication via fuzzy c-means clustering applied to keystroke biometric data

This work describes a clustering-based system to enhance user authentication by applying fuzzy techniques to biometric data in order to deter password sharing. Fuzzy c-means is used to train personal, per-keyboard profiles based on the keystroke dynamics of users when entering passwords on a keyboard. These profiles use DES encryption taking the actual passwords as key and are read at logon time by the access control mechanism in order to further validate the identity of the user. Fuzzy values obtained from membership functions applied to the input (i.e., keystroke latencies) are compared against profile values, and a match, within a certain precision threshold γ, will grant access to the user. With this technique, even when user A shares password P_A with user B, B will still be denied access unless he is capable of mimicking the keystroke dynamics of A. We describe the motivation, design, and implementation of a prototype whose results indicate the accuracy level and feasibility of the approach.