-This paper presents an approach for an authentication method of people by using their eye movements. Our method is based on a simple scan-path comparison. People's eye movements were recorded by using an eye tracker when they were drawing a personal identification number (PIN) on a screen numeric pad. Data was analyzed using the Eyenalysis algorithm to measure the similarity of scan-paths by calculating and normalizing the distance in pixels for each point in the scan-paths. In the results of a first experiment and analysis we got an average acceptance rate of 80% and a low false acceptance rate under 25%. In a second experiment a previous training for each participant was done, and we got best results with trained people. However, we are continuing with this research in order to make a new study where variables like fixation time and distance from the equipment are also considered.
A issue when talking about digital devices. We have a
T present, information security is a very important constant concern that our information is not violated. That is why techniques were developed to authenticate that a person is, in fact, who he claims to be.
These mechanisms fall into three categories: something you know (eg. passwords, PIN, patterns), something you have (eg. magnetic cards, chips, keys) and something you are (eg. body parts, voice, iris pattern.).
Belonging to last category, biometric authentication
systems were born [
The case of the fingerprint [
Due to the fact that privacy is an issue that can not be
ignored, especially when we talk about the information
we store in our mobile devices, it is necessary to develop
and improve the existing authentication methods, or in
addition, create one new, since these are proven to be
vulnerable, as in the case of Android unlock pattern [
Halverson [
In our work, we propose a prototype of an algorithm for
the authentication of users based on eye movements with
comparison of ocular movement patterns, as proposed by
Mathot and Cristino [
In [
Security is a really important factor in contemporary
systems since that some of existing authentication methods
are vulnerable. For example, fingerprint method has been
violated several years ago [
The recognition of iris was also violated in recent times
as explained in [
In this research, an own software program displaying a numeric on-screen pad (Figure 1) was developed. Users are supposed to draw a numerical password with their eyes on the numeric pad while eye movements are captured by an eye tracker and a comparison of the captured scan-paths is also performed.
For comparison purpose, various pattern recognition
and similarity measures where used, but we will talk about
the one that allowed interesting results in our experiments:
The Eyenalysis algorithm proposed by Mathot & Cristino
[
The method followed is described in the next algorithm. It shows the process performed to capture data that will be analyzed after the experimental phase.
Experiment starts Computer starts calibration process if U serStaresAtF ixationCross true then numericP ad true user draws his pin with eyes experiment ends else numericP ad f alse waiting for user end if Ten users where asked to create a 4-to-6 digit PIN (e.g. 2704) and follow it with their eyes. Subsequently, the numeric pad appears as shown in Figure 1 and the participant must draw the numeric PIN with the eyes.
For the purpose of this experiment, a previous calibration was done in order to obtain the best possible results in the data capture. This calibration step was done by the calibration software developed by the eye tracker manufacturer. In the computer screen shown in Figure 2 t can be seen the image of the calibration software.
Error given by the calibration step is an average of the error of all the nine points displayed on the calibration screen. Subsequently, the numeric pad appears as shown in Figure 1 and the participant must draw the numeric PIN with the eyes. 4.2
For the second experiment, 3 users where asked to do the same process as the previous experiment, with the difference that in this time, the first user had no training at all. Second participant had experience with eye tracking because of participations in previous experiments. The third participant had extensive training on eye tracking with previous experiments and a process where he was asked to read and visualize images focusing on specifics parts of them. 5
In both of the experiments, a total of 4 scan-paths were
captured from each participant after a training were 5
scanpaths for participant was captured. The last 4 scan-paths
were used as data to be compared in the data analysis
section. Data was analyzed with the Eyenalysis algorithm [
Eyenalisis
Eyenalysis algorithm was proposed by Mathot & Cristino
[
D(S; T ) =
Pin=1 diS + Pn j
j=1 dT max(nS ; nT ) where S and T are scan-paths to be compared and d is the distance calculated beforehand for each point in the scanpath.
This method gives good results based on a distance calculated in pixels. The minor is the distance, the more similar the scan-path is to the other one, the authors of this algorithm say that around 100 px is considered a good measure of similarity.
For the intruder acceptance rate, we ask a participant to make the same password than the other participant, just telling him to imitate the password in the correct numeric order, but never tell him how much time he should last in each number.
In Figure 3 we can see how we got a better sight on how the acceptance rate for a intruder, was much more low than the person trying to authenticate himself.
This algorithm give a good way to make an approach
for authentication based on eye movement. From the 10
participants of the experiment, 8 were accepted giving us
a 80% of acceptance based in the criteria proposed by the
author of the algorithm where he says 100 px is considered
a good similarity measure, and we add 200 more px to give
the users a threshold to commit errors.
A second experiment was run, where 5 participants were
recruited and asked to follow the method described before
of drawing a numeric PIN with their eyes. The difference in
this experiment is that distance is normalized according to
Eyenalysis algorithm [
The last participant in this experiment, had a lot of experience by working with eye tracker technology than the other ones. This participant, was invited for the last experiment. He also contributed in another experiments involving eye tracking and he read articles about eye tracking before. Results with this participant are shown in Figure 6 with a 83.33% of acceptance.
The second participant, was trained before by being recruited for the first experiment, so he has a little experience on eye tracking and the purposed method. With this participant we obtain the results in Figure 5 obtaining a 16.66% of acceptance.
We can notice that participant with more training perform a better acceptance in both algorithms and with a less error rate, while the participant with not much training performs a good average. Finally, the participant with no training at all, obtained worst results. In the experimentation process, we find that both methods gave good results, but they do not have a direct point of comparison because the Eyenalysis algorithm represents the normalized distance between all the points in a scan-path, while the linear correlation, represent the accuracy rate of a scan-path compared to another comparing point by point in the x axis and then in the y axis leaving no way to make a real comparison. They are different metrics to account similarity.
In the case of the linear correlation, we can say that results are affected by the calibration step and light conditions. Here, the false acceptance rate is measured by comparing the scan-path of the real user with the scan-path of other user.
On other hand, the intruder distance on the Eyenalysis method is measured by testing with a different person, and let know him the password of the real user, and then he tries to follow his scanpth.
Results are shown in Figure 5 where we can see that the distance in pixels for the real user is much less from the intruder, so we can deduce that a user will have a threshold to commit errors.
But if we consider that threshold, the best distance reached by the intruders will be much higher than the worst distance reached by the real user, making this way of authentication have a considerable rate of security.
For the second experiment, a modification to the
Eyenalysis [
This modification consist on dividing the distance given in pixels by 10, normalizing more the obtained results. This simple modification lead to a way to compare the results in both algorithms as is shown in Figure 4, 5 and 6, where we can see how the training plays an important role in our method. 7
In conclusion, Eyenalysis [
In the case of Simple Linear Regression [
In future work, we are planning to taking into account more variables like fixation time and a specific fixations set of each eye trying to find a relation between the time of fixations and the level of security. And to improve the algorithm performance with simple algorithms. It is important to evaluate our algorithm method in different experimental conditions in order to assure that is accurate to every kind of situation.
The first author would like to thank to LabTEC2 to provide the necessary equipment for run the experiments.
Alberto Quintana-Neva´ rez Is a software engineer undergraduate student at UACJ in Me´ xico, Quintana-Neva´ rez has participated in projects at LabTEC2. His research focuses on information security, secure app development, social computing and eye movement.
Francisco Lo´ pez-Orozco PhD. Since 2015, he is an associate professor in the Software and Computer Systems Engineering undergraduate programs at UACJ. He obtained his PhD from the University of Grenoble, France in 2013. He is a co-founder and permanent member of the Laboratory of Emerging Technologies in Computer Science (LabTEC2) at UACJ. His research focuses on cognitive computational and experimental psychology, human-computer interaction, centered user design.