KEP: Keystroke Evoked Potential for EEG-Based User Authentication

In recent years, the rapid proliferation of Brain-Computer Interface (BCI) applications has made the issue of security increasingly important. User authentication serves as the cornerstone of any secure BCI systems, and among various methods, EEG-based authentication is particularly well-suited for BCIs. However, existing paradigms, such as visual evoked potentials and motor imagery, demand significant user efforts during both enrollment and authentication phases. To address these challenges, we introduce a novel paradigm–Keystroke Evoked Potentials (KEP) for EEG-based authentication, which is secure, user-friendly, and lightweight. Then, we design an authentication system based on our proposed KEP. The core concept involves generating a shared cryptographic session key derived from EEG data and keystroke dynamics captured during random button-pressing activities. This shared key is subsequently employed in a Diffie-Hellman Encrypted Key Exchange (DH-EKE) to facilitate device pairing and establish a secure communication channel. Based on a collected dataset, the results demonstrate that our system is secure against various attacks (e.g., mimicry attack, replay attack) and efficient in practice (e.g., taking only 0.07 s to generate 1 bit).