Identity and Privacy: an insight on the ÉGIDA activity’s progress in behavioural biometrics
ÉGIDA is a project born to bring companies closer to security and privacy technologies, based on a national collaboration that contribute to placing Spain at the forefront of the cybersecurity technology market. The national network is formed by Gradiant, Fidesol and the Basque Research and Technology Alliance (BRTA) centres, Ikerlan and Vicomtech. Recent progress includes advances in the FARO projects, a collaboration with industrial companies that will allow testing ÉGIDA’s technologies in a realistic context.
Amongst the different Activities that define ÉGIDA’s objectives, Vicomtech is the leader of Activity 2 that is centred on Identity and Privacy technologies. Within this activity, the partners are focused on biometric solutions that can enhance the performance of security systems being used as secondary means of authentication.
Under these premises, Vicomtech implemented a capturing system that collects accelerometer and gyroscope data for registering a signature that a user performs in the air. The data collected can be used to verify the identity of a person in environments that are unsuitable for more traditional methods of authentication, such as a face or fingerprint verification. An application for this type of system can be, for instance, in an industrial context where the employees need to wear working gear and protectors that would cover their face, hands or muffled their voice. The biometric verification is performed with the use of autoencoders: during the enrolment, a new autoencoder will be trained with 10 signatures obtained from the new user. The verification is performed by comparing the signature before and after being processed with the specific autoencoder trained for the person that claims the identity. A threshold is then applied to the distance between the two signatures to establish if the signature corresponds to the person’s identity. Under the same activity, Vicomtech also worked on developing an algorithm that uses keystroke dynamics as a second means of authentication. When users are required to type in their credentials, like email accounts and passwords, the system not only verifies that the password is correct, but it also runs an authentication algorithm on the background that checks the keystroke dynamics and verifies the user in a non-invasive and continuous way. The data used is extracted from the press and release times of each key: four different latencies are calculated to be used as features, and they’re fed to a Siamese Neural Network that calculates a Euclidean distance between the enrolment and the entries. The next steps will evaluate the Presentation Attack Detention of this system.