StrokePIN: Enhancing PIN Authentication With Keystroke Dynamics for Mobile Devices

Keystroke dynamics-based authentication is a promising approach to enhance the security of personal identification number (PIN)-based authentication systems for mobile devices. While its effectiveness has been extensively studied, due to the limitations on the number of samples users can provide, most research struggles with the trade-off between system performance and user experience. Additionally, little effort has been devoted to quantifying the security of PIN keystroke dynamics. In this paper, we present StrokePIN, a user-friendly and efficient authentication system that utilizes multi-modality data. Specifically, we leverage a few-shot learning technique, called Siamese Network, which enables lightweight deployment of the system without retraining. To evaluate StrokePIN, we design a set of experiments and collect two new multi-modality datasets of keystroke dynamics of 20 PINs from 116 users. These datasets are the only publicly available resources of their kind to date, and we have made them accessible online. Furthermore, we quantify the security of keystroke dynamics of PINs with entropy, revealing its security boundaries. The evaluation results show that compared to the baselines, StrokePIN achieves state-of-the-art performance with False Acceptance Rate (FAR) of 2.2% and False Rejection Rate (FRR) of 1.9% on unseen users. For unseen PINs, StrokePIN achieves an FAR of 2.6% and an FRR of 1.4%. Additionally, by dynamically updating the template library, StrokePIN can mitigate the impact of user behavior drift over time, achieving the performance with FAR of 8.3% and FRR of 0.4%. Our security analysis results indicate that keystroke dynamics can provide 4.03-5.83 bits of security against 3 to 10 online guessing attacks.