Behavioural Biometrics

Behavioural biometrics is revolutionising paradigms and authentication methods. By strengthening the security of IT systems and making authentication more user-friendly, this new factor is essential in the dynamic context created by today’s technological evolution. The traditional password is becoming increasingly obsolete: used alone, it does not guarantee a sufficient level of security. Multi-factor authentication responds to this issue, with a trend towards the use of factors inherent to the user — a fingerprint, a behavioural print, and the like.

What is behavioural biometrics?

Behavioural biometrics includes all the techniques used to identify a person based on their behaviour. In computing, that can be, for example, the way a person uses the mouse or types on the keyboard. Precise measurements of this type of behaviour, in conjunction with specific algorithms, allow particular characteristics to be identified that are unique to each person.

Without being invasive to the user’s activity, behavioural biometrics allows continuous authentication and verifies the user’s identity throughout the entire session. Traditional authentication methods authenticate the user only at the beginning of the session; behavioural biometrics does not stop there.

Behavioural biometrics offers strong authentication benefits, making it nearly impossible to bypass. It is much more difficult to steal a user’s behaviour than to steal their password. As soon as an activity is detected, it is possible to validate the user’s identity and so ensure that, even in the event of short absences without locking the session, it remains impossible for a third party to take control of the information system.

Behavioural biometrics and the need for improvement

We can expect this authentication factor to grow, as behavioural biometrics addresses several challenges — one of which is the diminishing relevance of passwords, still widely used today. While other authentication factors are already used to strengthen authentication (physical factors such as smart cards, or body biometrics such as fingerprints), behavioural biometrics can provide the benefits of factors inherent to the user, based on who they are rather than on what they know or have. For an illegitimate user — a colleague of the authenticated person, say — it is difficult or even impossible to steal the behaviour of the authenticated user. Behavioural biometrics also uses simple devices already present on every computer system: the keyboard and the mouse, which are what capture this behavioural data.

Another key point is that commonly used authentication methods only authenticate at the beginning of a session, which can seem rather outdated compared with situations we experience in everyday life. Take a person who goes to the counter of a bank to carry out banking operations: they present their identity card to the bank employee to identify themselves. The employee verifies the identity by comparing their face (body biometrics) or other elements such as age and sex against the reference, which here is what is written on the identity card. Once the identification has been validated, the person in front of them becomes authenticated and legitimate to carry out banking operations. Implicitly, the employee keeps biometric elements in mind — the face, the voice — and then proceeds to perform the tasks requested on that person’s accounts. During the various operations, the employee remembers the face of the person present at the counter. They therefore effortlessly and implicitly perform a continuous authentication of that person for the requested transactions, without having to go through the identification stage for each one. In the event of a change of person, the modification of the biometric factors is obvious, and the execution of the operations — the session — is stopped.

In the case of a session on a computer system, if this continuous authentication mechanism is not implemented, an illegitimate user can take control of the system. This can happen even during a short absence of the legitimate user from the computer. In terms of security, behavioural biometrics provides several advantages over more traditional authentication methods: ease of implementing continuous authentication, being agnostic and non-invasive to user activity, being an inherent user authentication factor, and ease of deployment through simple devices such as the keyboard or mouse. These characteristics allow better reactivity by acting before the threat materialises, while being entirely transparent to the user, who does not need to take any step to authenticate — no smart card to scan, no fingerprint, no credentials to type, no personal questions to answer. It is well known that the more constraints a person faces, the more they will try to bypass them, which is why user comfort is now considered an important security element in the same way as the intrinsic security of a solution.