Abstract: Apparatus and methods are described for detecting sharing of electronic or online accounts based on grouping of data samples that include keyboard input timing factors and optionally secondary factors. The data samples can be received from various computers having various keyboards of a certain type and may be input by more than one user. The data samples are grouped based on distances and ratios of mathematical combinations of distances between input timing of key events such as dwell and flight time, as well as optionally based on at least one secondary factor related to the keyboard input timing factors. Example secondary factors include a time of day of the input; and/or a machine identification, location, and IP address of the computer used to input the sample.

Abstract: Embodiments of the invention relate to collecting keystroke timing data of samples of a phrase input by a user on an input device during different user sessions, and creating a biometric user template based on the timing data collected during the different sessions. Once a sufficient number of samples are collected, the template may be used to authenticate the user.

Abstract: Access to a resource may be denied in response to a score value being below a threshold value. The score value may be based on timing information of key-press and key-release events. After denying access to the resource, the timing information of key-press and key-release events may be incorporated into the keystroke dynamics template.

Abstract: Providing secondary non-biometric authentication to identify a user following a failure of a biometric authentication based on a biometric template. In one embodiment, a knowledge-based authentication scheme may be provided. In another embodiment, a one-time password authentication scheme may be provided. An identity of the user may be confirmed using the non-biometric based authentication scheme.

Abstract: A keystroke dynamics authentication system collects measurements as a user types a phrase on a keyboard. A first set of derived data values are computed based on the collected measurements, and then a second set of derived data values are computed based on the first set of derived values. The first and second sets of derived values are used to construct a template for identifying the user based on his typing.

Abstract: Apparatus and methods are described for detecting sharing of electronic or online accounts based on grouping of data samples that include keyboard input timing factors and optionally secondary factors. The data samples can be received from various computers having various keyboards of a certain type and may be input by more than one user. The data samples are grouped based on distances and ratios of mathematical combinations of distances between input timing of key events such as dwell and flight time, as well as optionally based on at least one secondary factor related to the keyboard input timing factors. Example secondary factors include a time of day of the input; and/or a machine identification, location, and IP address of the computer used to input the sample.

Abstract: A keystroke dynamics authentication system collects measurements as a user types a phrase on a keyboard. A first set of derived data values are computed based on the collected measurements, and then a second set of derived data values are computed based on the first set of derived values. The first and second sets of derived values are used to construct a template for identifying the user based on his typing.