Researchers from the University at Buffalo have devised a security system based on your brain activity. We are all familiar with password protection and fingerprint locks on our phones. Conventional passwords can potentially be a very secure means of protecting your device or information. To be effective, passwords have to be sufficiently long, contain lots of special characters and be unpredictable. It is in general complicated for many people to remember a lot of complex passwords. For this reason, many users stick to simple words or phrases. Maybe they add a single digit or exclamation mark at the end to satisfy the password safety checker. This means that, in practice, passwords are not very secure because an attacker can often guess the correct phrase.
Image from Pixabay CC-0 license
This is why, during recent years, fingerprints and facial recognition have become a popular means of securing devices and restricting access to websites. These security barriers are much more complex and more difficult to imitate. But they are not 100% secure either. It is possible to imitate fingerprints or fool face recognition systems. Once these biometric security barriers have been broken down they expose a serious drawback. You only have one set of fingerprints. And you simply can’t reset your biometric parameters.
This problem has been recognised by a group around Wenyao Xu, PhD who is an assistant professor of computer science and engineering in the School of Engineering and Applied Sciences at the University at Buffalo. He devised a system that is based on the response of your brain to a number of different pictures. The system picks up your brain waves and these are then used to identify you.
The brainwaves are picked up through electrodes placed on your head. Normal devices for picking up brain waves use a method called electroencephalography. These systems can have up to 256 electrodes placed all over your skull. Naturally, this would be extremely problematic for a device that is supposed to be easily usable. Wenyao Xu has managed to reduce the number of electrodes down to 6. They have also integrated them into a standard Virtual Reality headset. This means that the device can be quickly put on and taken off when needed.
The procedure for passing security is relatively simple. The user is presented with three pictures in rapid succession. The pictures are not chosen at random but represent certain aspects of your brain function. This has to do with the way the 6 electrodes are placed on your head. They have been designed to pick up specific regions of your brain and measure the reactions. The researchers present the viewer with one picture of an animal. Animals usually trigger very personal memories. Everybody will have a different experience with animals and the intraparietal sulcus which controls the declarative memory will react differently. Some of the electrodes are placed on the intraparietal sulcus to pick up the reaction to these personal memories and each person will show a different reaction.
Similarly, electrodes are also placed on the inferior parietal lobule which processes face recognition. To get an individual reaction from this part of the brain the researchers chose to show a picture of a celebrity. In this case, they chose Leonardo DiCaprio. The final set of electrodes is placed on the temporo parietal junction which processed reading comprehension. For this, an image of a simple phrase was presented to the user. The images were shown for only 1.2 seconds. This is long enough for the brain to process the information contained in the picture but too short for any complex intentional reaction. The process was repeated four times to obtain an accurate reading. After just under 5 seconds the process is complete and the brain password is recorded.
In a study performed on 179 individuals comprised of 93 men and 86 women, the test subjects achieved an accuracy of 95 percent. This is not yet sufficient for a fully functioning password protection but it is an important step towards it. One main concern was the variability of the brain’s reaction. In real life, we need to pass the same security checks on a regular basis. The brain has a tendency to change and learn. This means that a repeated presentation of the same images could result in a slow change of the brain as it gets used to the repeated stimulus.
During the study, which lasted five months the subjects showed a decrease of the password accuracy of only 1 percent. This means that, for the specific brain waves picked up by the device, the learning effect can be neglected.
In the future Xu sees the system being incorporated into devices such as Google Glass or similar. He sais "These passwords contain information gathered from only three channels in less than five seconds. Semantic memory attacks need much more time than that." He wants to spend more research on improving and perfecting the system and make it ready for commercial use.