KinWrite: Handwriting-Based Authentication Using Kinect Proceedings of the 20th Annual Network & Distributed System Security Symposium, NDSS 2013 Jing Tian, Wenyuan Xu and Song Wang Dept. of Computer Science and Engineering, University of South Carolina Chengzhang Qu School of Computer Science, Wuhan University

Outline  Introduction  KinWrite Architecture  Data Processing & Feature Extraction  Template Selection and Verification  Experiment and Evaluation  Conclusion 2

Introduction(1/4)  Authentication plays a key role in securing various resources including corporate facilities or electronic assets.  Authentication mechanisms can be divided into three categories  knowledge-based  token-based  biometrics-based. 3

Introduction(2/4)  There are some requirements of the system  Around-the-Clock Use.  Rapid Enrollment.  Rapid Verification.  No Unauthorized Access.  Low False Negative. 4

Introduction(3/4) There are some possible categories of attack :  Random Attack  Observer Attack  Content-Aware Attack  Educated Attack  Insider Attack 5

Introduction(4/4)  In this paper, we propose a user-friendly authentication system, called KinWrite.  allows users to choose short and easy-to-memorize passwords while providing resilience to password cracking and password theft.  For instance, a Kinect can be installed at the entrance of a building. 6

KinWrite Architecture 7

8

Data Processing  We construct a refined 3D-signature from a raw depth image sequence  Fingertip localization  Signature normalization  Signature smoothing 9

fingertip localization 10

Signature normalization 11

Signature smoothing Apply a Kalman filter to smooth the raw 3D-signatures We choose the time-independent variance as the variance of the fingertip positions. 12

KinWrite Architecture 13

Feature Selection  Position and Position Difference between Frames ◦ The fingertip position in the t-th frame : ◦ the inter-frame position difference :  Velocity :  Magnitude of acceleration :  Slope Angle :  Path Angle :  Log radius of curvature :  curvature : 14

15

Feature Processing  First, we normalize each feature such that it conforms to a normal Gaussian distribution N(0,1) over all the frames.  Second, we weigh each feature differently to achieve a better performance.  selected a small set of training samples for each signature  verified these training samples using the Dynamic Time Warping(DTW) classifier  simply consider the average verification rate over all signatures as the weight for this feature 16

Dynamic Time Warping (DTW) 17

KinWrite Architecture 18

Template Selection 19

Threshold Selection We calculate the DTW distance between the template of a user u and all the M training samples (from all the users), and sort them. 20

KinWrite Architecture 21

22 Experiment and Evaluation

Data Acquisition 23

Evaluation Matrix the number of true positives the number of false positives the number of true negatives the number of false negatives  Precision  reflects how cautious the system is to accept a user  Recall  quantifies the fraction of honest users that have been granted access out of all honest users 24

Evaluation Matrix the number of true positives the number of false positives the number of true negatives the number of false negatives  ROC curve  stands for receiver operating characteristic curve  a plot of true positive rate (TPR) over false positive rate (FPR)  An ideal system has 100% TPR and 0% FPR  means all honest users can pass the verification while none of the attackers can fool the system 25

Evaluate the impact of training size 26

Performance(1/2) 27

Performance(2/2) 28

29

30

Data Acquisition 31

Performance 32

Performance 33

Conclusion We have designed a behavior-based authentication system called KinWrite that can be used for building access control. To evaluate the performance of KinWrite, we collected 1180 samples for 35 different signatures over five months. In addition, we modelled 5 types of attackers and collected D signature samples from 18 ‘attackers’. These results suggest that KinWrite can deny the access requests from all unauthorized users with a high probability, and honest users can acquire access with 1.3 trials on average. 34

35 Thanks for your listening!