Behavioral Biometric Security: Brainwave Authentication Methods Rachel Schomp The University of North Carolina at Chapel Hill Department of Computer Science Abstract—This paper investigates the possibility At the center of human cognition is the brain, of creating an authentication system based on an electrochemical organ capable of generating as the measurements of the human brain. Dis- much as 10 watts of electrical power [76]. The brain cussed throughout will be an evaluation of the is comprised of approximately 100 billion nerve feasibility of brainwave authentication based on cells known as neurons and is a complex system brain anatomy and behavior characteristics, where mental states emerge from interactions be- conventional vs. dynamic authentication meth- tween many functional and physical levels [17]. It ods, the possibility of continuous authentication, can process immense amounts of information, and and biometric ethical and security concerns. with such a complex structure, no one has yet to de- crypt the whole picture on how precisely the brain I. INTRODUCTION works. Research suggests that at some point, the computational power of a computer will surpass Technology continues to permeate our daily that of the human brain. However, as we do not yet lives, and with this expansion comes increasing know how the entire brain computes, there is no fi- cyber security concerns. Simple PINs and pass- nite answer for exactly how fast the brain works words are no longer enough to limit use to only the [63]. Despite the daunting complexity of this organ, intended user. More complex means of authentica- growing an understanding of the brain is imperative tion are required, and the way this can be accom- to cracking authentication methods using brain- plished is through behavior-based biometric secu- waves. rity. With approximately 100 billion neurons [17], Similar to the gates and wires of a computer, the each brain is identifiably unique in the way it reacts neurons in a brain gather and transmit electrochem- to and processes incoming information. It is this ical signals [19]. This electrical activity emanating characteristic that can turn brainwaves into an au- from the brain manifests in the form of brainwaves. thentication metric. However, neurological infor- Brainwaves fall into four main categories—Beta mation is a growing and critical information class. waves, Alpha waves, Theta waves, and Delta waves The commerciality of neural devices is a contrib- [76]. uting factor to this expansion with neural implants i. Beta waves occur when the brain is actively for clinical patients, at-home neurostimulators, and engaged in mental activities such as a per- Brain-Computer Interfacing smartphone applica- son who is in active conversation. As the tions. A multitude of new access points carrying fastest of these brainwaves, Beta waves can neural information has now been established and be characterized as having a relatively low this continued multiplication in data extraction will amplitude and frequency between 15 to 40 lead to great strides in behavioral-biometrics, but cycles per second. also inevitable security and privacy concerns [28]. ii. A person who has just finished a task and sits down to rest would be in an Alpha state. II. THE BRAIN Alpha waves are slower and higher in am- plitude, and describe a non-arousal state. “If the human brain were so simple iii. Theta waves are most common in a state That we could understand it, where the task being completed has be- We would be so simple come so automatic you disengage from be- That we couldn’t.” ing mentally focused on it. One example of - Emerson M. Pugh [52] this is when you are driving on the highway 1 and discover you can no longer remember [18]. BCIs establish a communication pathway for your actions or thoughts for the last five the user to either send information to or control an miles. Theta waves often occur when indi- external device exclusively through brain activity viduals are running outside or in a state of [23]. This action bypasses the muscle and periph- mental relaxation such as in the shower; eral nervous systems, making it a useful tool for you are more prone to the flow of ideas in people who do not have full function of their bod- this category. ies. In clinical settings, BCI applications include re- iv. Finally, Delta waves are classified as hav- pairing, augmenting or assisting cognitive func- ing the greatest amplitude and slowest fre- tions, and sensory-motor functions in patients with quency between 1.5 and 4 cycles per se- physical impairments. Given the significant poten- cond. They will never go completely down tial of BCI devices, particularly the commerciality to zero because that would indicate brain of immediacy and hands-free controls, Yuan et al. death, but deep dreamless sleep will take [80] predicts BCIs will gradually replace device you down to the lowest frequency of ap- control mechanisms, including the keyboard, touch proximately 2 cycles per second [25]. screen, and voice command. I. TYPES OF BCIS Brain-Computer Interfaces are divided into three types: invasive, partially-invasive, and non- invasive [17]. i. Invasive BCIs require the neural device to be implanted directly into the gray mat- ter—the outer layer of the brain. Invasive BCIs could also include the surgical im- plantation of an electrode array, which con- nects directly to the central nervous system [23]. ii. Partially-invasive BCI devices are placed inside the skull, but do not touch the gray matter. Rather, the device is likely situated in one of the dura matter layers. Figure 1: From Ned Herrmann [76] iii. Non-invasive BCI devices are attached di- rectly to the scalp, requiring no surgical ac- What is unique about brainwaves is that every tion. This option is the most common for man, woman, and child of all ages, backgrounds, practical authentication devices involving and daily lives experience the same brainwave char- brainwaves [23]. acteristics. These categories and interactions are Various types of signals can be used in a BCI. consistent across geographical lines and cultural Particularly, neural activity produces magnetic and differences [76]. metabolic signals in addition to the more common electrical activity captured in an Electroencephalo- III. BRAIN-COMPUTER INTERFACES graph (EEG) [44]. Magnetic fields can be recorded with a Magnetoencephalography (MEG), and the This section will discuss Brain-Computer Inter- metabolic activity of the brain can be observed face devices before moving on to specific types of through a Positron Emission Tomography (PET) Brain-Computer Interfaces (I), and the Electroen- scan. Other possibilities include the Functional cephalograph (II). Magnetic Resonance Imaging (fMRI) and Optical Brain-Computer Interface (BCI) devices are Imaging. Despite the numerous options to gather in- predicted to become heavily used in the future for formation on brain signals, none are as accessible applications in user authentication, neuro-medical for authentication as the EEG, as it requires no so- tools, entertainment and gaming, and smartphones phisticated techniques or an exorbitantly expensive 2 device in specialized facilities such as a hospital These signals that are averaged in a syn- [44]. chronized fashion are called Event-Related Potentials (ERP). II. ELECTROENCEPHALOGRAPH ERPs represent different components of the pro- cesses of human perception and cognition; they are The small electrical charges created by the ap- the brain's time-locked response to stimulus [18]. proximately 100 billion neurons in the brain con- ERPs are useful because they increase the signal- tribute to the generation of an electric field with to-noise ratio, thus reducing the unrelated brain ac- electrical potentials fluctuating around the scalp tivity shown. Due to the noisiness of readings from [17]. This electric output can then be read and dis- the brain, finding a measurement that minimizes sected by an Electroencephalograph machine. An this is crucial for a more transparent reading in au- EEG records and measures the brain’s electrical ac- thentication. Also, EEGs and ERPs are non-voli- tivity through voltage fluctuations resulting from tional, which states the user cannot willingly con- ionic current with the neurons [75] through elec- trol them, making these metrics difficult to be com- trodes placed on the skin [5]. These signals are the promised [18]. output that represents brain activity based on a per- These analyses can be implemented to derive the son's unique neural pathway patterns. The unique- unique brainwave fingerprint of an individual user ness of these signals is what makes user-specific [18]. The advantages afforded by collecting brain- brainwaves challenging to recreate as they can be waves through an EEG is the accessibility and ease made distinct from the mood, mental state, and ge- with which it can acquire the data. It can capture netic makeup of the user. Such electrophysiological quality temporal resolution and is relatively tolerant traits also naturally allow detecting whether the of subject movement [68]. All of these benefits are subject is alive at the time of attempted authentica- in addition to being non-invasive through external tion. This is an additional security measure afforded electrode placement. Commercial-grade devices to behavioral biometrics connected to conscious- are even now readily available making this form of ness that static biometrics systems, such as finger- authentication both safe and feasible. print and palm print, do not possess [24]. EEG-biometry requires modeling or classifying IV. AUTHENTICATION of the extracted EEG features from the collected signals from the scalp channels. These scalp sig- This section will contain information on basic nals, however, are not the source signals inside the forms of authentication such as passwords and brain. An EEG is the summation of synchronous PINs (I). It will then discuss what biometric au- signal activity among thousands of neurons; thus, thentication entails and how matches are made signals read may not have come from the location (II).