One-Step, Three-Factor Passthought Authentication With Custom-Fit, In-Ear EEG

Abstract

In-ear EEG offers a promising path toward usable, discreet brain-computer interfaces (BCIs) for both healthy individuals and persons with disabilities. To test the promise of this modality, we produced a brain-based authentication system using custom-fit EEG earpieces. In a sample of N = 7 participants, we demonstrated that our system has high accuracy, higher than prior work using non-custom earpieces. We demonstrated that both inherence and knowledge factors contribute to authentication accuracy, and performed a simulated attack to show our system's robustness against impersonation. From an authentication standpoint, our system provides three factors of authentication in a single step. From a usability standpoint, our system does not require a cumbersome, head-worn device.

Neural Dynamics of a Single Human with Long-Term, High Temporal Density Electroencephalography

“…2B shows the interindividual correlations (µ=0.45, σ=0.10) to be significantly below the intra-individual ones throughout the year. This gap is consistent with the within-subjects and betweensubjects similarity scores in [16], and is the basis underlying many brainwave-based authentication systems [21], [22], [23], [24], [25], [26], [27].…”

Open-source concealed EEG data collection for Brain-computer-interfaces - neural observation through OpenBCI amplifiers with around-the-ear cEEGrid electrodes

“…Such research has for example found the suitability of ear-EEG for continuous daily observation [22], the observation of auditory attention processes [29,35,38,53,59], visual stimulation intensities [22,60], or sleep stage classification [51,56,66]. Due to the advanced understandings, recent work has also started to explore more HCI-related application scenarios like the monitoring of affect [4] and stress [45], biosignal based user authentication [48], and the recognition of mental gestures as user input information for active BCIs [49]. While this research represents a fascinating and growing development in the HCI domain, its progress is greatly impeded by a low degree of accessibility to the required components: (1) cost-effective amplifiers with open data access and (2) ready-to-use ear-EEG electrodes, and (3) the integration of both parts into wearable units that can be used in realistic HCI scenarios.…”

Evaluating the Usability of Passthought Authentication

“…In recent years this paradigm has been extended to include three authentication factors by treating the BCI device itself as a physical authentication token. 15 In addition to the potential for single-step MFA, passthoughts provide several other benefits: 14 unlike other biometrics, they are cancelable or changeable, meaning that they can be revoked or changed in the event of a data breach; depending on the implementation, passthoughts can be immune to observation or shoulder-surfing attacks that are problematic for text passwords and many other Despite these factors, there remain unanswered questions regarding the public acceptance and adoption of passthoughts. It is generally understood that usability is a critical component of security systems, and that poor usability is itself a security vulnerability.…”

“…Poulos, Rangoussi, and Alexandris 103 and Paranjape et al 104 published studies in 1999 and 2001 respectively demonstrating classification systems which could identify individuals from a small sample based on features of their EEG with accuracies between 80 and 100%. Since then a number of studies 15,[105][106][107][108][109] have implemented biometric authentication systems based on resting-state EEG with reasonable success, demonstrating that the uniqueness of individual users' EEGs is sufficient for biometric authentication, at least within a restricted population.…”

“…Single-step multi-factor authentication. Merrill et al 15 successfully demonstrated a passthought application which required three distinct authentication factors (a secret, a biometric, and a physical token) that could be authenticated in a single step. This capability of passthoughts can potentially overcome a significant limitation to the usability of multi-factor authentication systems which typically require a separate action from the user for each factor.…”