Behavioral biometrics: A new authentication factor which needs to develop

Still marginal today, behavioral biometrics is already revolutionizing paradigms and authenticationPrimary or secondary authentication Authentication allows a user to guarantee his or her identity before accessing a resource or service. Primary authentication will give user access to the workstation (Windows... More methods.

By strengthening the security of information systems and making authentication more comfortable for users, this new factor is essential in the dynamic context created by today’s technological evolution and society. Indeed, the traditional password is becoming increasingly obsolete and used alone, it does not guarantee a sufficient level of security. Multi-factor authentication responds to this issue, with a trend towards the use of factors inherent to the user (fingerprint, behavioral print, etc.).

What is behavioral biometrics?

Less obvious and much more subtle than physiological or body biometrics, behavioral biometrics includes all the techniques used to identify a person based on his or her behavior. In computer science, it can be, for example, the way a person uses the mouse or types on the keyboard. Precise measurements on this type of behavior in conjunction with specific algorithms allow to identify particular characteristics that are unique to each person.

Without being invasive to the user’s activity, behavioral biometrics allows to continue the authentication process and guarantee the user’s identity during the entire session. While traditional authentication methods perform the authentication operation only at the beginning of the session, behavioral biometrics allows a continuous authentication of the user.

Certain advantages make behavioral biometrics particularly well suited to authentications: it is almost inviolable. It is much more difficult to steal a user’s behavior than to steal their password; and as soon as an activity is detected, it is possible to validate the user’s identity and thus ensure that even in the event of short absences without locking the session, it is still impossible for a third-party user to take control of the information system.

Why this authentication factor needs to develop?

We can estimate that this authentication factor will develop insofar as behavioral biometrics will meet several challenges. One of them being the obsolescence of passwords that we still use massively today. While other authentication factors are already used to strengthen authentication (physical factors such as smart cards or body biometrics such as fingerprints), behavioral biometrics can provide the benefits of factors inherent to the user, based on who they are and not on what they know or have. For an illegitimate user (e.g. a colleague of the authenticated person) it is difficult or even impossible to steal the behavior of the authenticated user. On the other hand, behavioral biometrics uses simple devices that are already present on all computer systems: keyboard and mouse, which allow to capture this behavioral data.

Another key point is that commonly used authentication methods only allow to authenticate at the beginning of a session, which can finally seem rather archaic compared to situations we may experience in everyday life. If we take the example of a person who goes to the counter of a bank to carry out banking operations, this person will present his or her identity card to the bank employee to identify himself or herself. The bank employee verifies the identity by comparing his face (body biometrics) or other elements (age, sex) with the reference, which in this case for him are the elements written on the identity card. Once the identification has been validated, the person in front of him becomes authenticated and legitimate to carry out banking operations. Implicitly, the bank employee keeps in mind biometric elements (including his face, voice, etc.) and then proceeds to perform the tasks requested on that person’s accounts. During the various operations, the bank employee remembers the face of the person present at the counter. He therefore effortlessly and implicitly performs a continuous authentication of the person for the requested transactions without having to go through the identification stage for each transaction. In the event of a change of person, the modification of the biometric factors is obvious and therefore the execution of the operations or “the session” is stopped.

In the case of a session on a computer system, if this continuous authentication mechanism is not implemented, an illegitimate user can take control of the system. This can happen even during a short absence of the legitimate user from the computer. In terms of security, behavioral biometrics provides some advantages over other more traditional authentication methods: ease of implementation of continuous authentication, agnostic and non-invasive for user activity, inherent user authentication factor and ease of implementation (use of simple devices such as keyboard or mouse). These specificities allow a better reactivity by acting before the threat materializes, while being totally transparent for the user since he does not need to take any steps to authenticate himself (scan a smart card or a fingerprint, type credentials or answer previously defined personal questions). It is well known that the more constraints a person faces, the more they will try to bypass them, which is why user comfort is now considered to be an important security element in the same way as the intrinsic security of a solution. By anticipating these issues and the dynamics of the challenges posed by authentication methods to information systems, Systancia offers Systancia Cleanroom Authograph, a continuous authentication solution based on behavioral biometrics. Now integrated into Systancia Cleanroom, it allows to guarantee the identity of privileged users whose identity theft would be potentially disastrous for the information system.