Biometric signature on the document
In this post we will discuss the method of authenticating a person according to the dynamics of writing a handwritten password (signature). Recently, there has been great interest in this direction, and this is primarily due to the proliferation of mobile devices with touch screens. Agree, it would be great to receive a document by mail, open it, draw your signature with your finger and send it to the addressee. In this case, the document will have legal force. Abroad - this is a long time reality. In Russia, for the time being, they trust in a signed paper document, or an electronic document with officially registered EDS.
A significant disadvantage of EDS is that it can be transferred to another person, i.e. in contrast to the traditional signature, it is alienable from its owner. At the same time, the legal significance of documents signed by an EDS by an outsider will be preserved, which in some cases may be unacceptable. If we combine the EDS and the biometric signature in the electronic document flow, then we can solve the problem of the inalienability of a legally significant EDS from its owner!
Let us dwell on the technology itself ... To begin with, you should understand that from the point of view of the authentication method, there is no difference what you will use as a password: a fixed handwritten word or signature. The main thing is that the dynamics of writing and the geometry of your handwritten word remain more or less stable.
')
The author of this post in the team of the Scientific and Technical Center "KASIB" for more than 10 years engaged in research and development of algorithms in this area. 2 PhD dissertations defended (3rd in the near future), more than 5 R & D projects have been completed. Even 5-6 years ago, in order to implement the authentication method based on the dynamics of writing a handwritten password (signature), the purchase of additional equipment was necessary - a graphic tablet (digitizer) with a light pen ( Wacom ). The evolution of mobile devices in recent years towards the use of touch input screens has made this technology as accessible as possible. At the end of 2012, our center created the cloud service SignToLogin , which implements user authentication based on the dynamics of writing handwritten passwords as a service, and later an application of the same name appeared in the App Store. Further description of the technology will be accompanied by examples of this cloud platform.
The authentication procedure is reduced to the fact that for each user must first create a standard handwritten password. The process of creating a standard is reduced to the sequential input of 10 implementations of a handwritten password on the touch screen of a mobile tablet (possibly using a stylus), which can take an average of 3 minutes.
The user must write in his usual handwritten word. After entering the required number of implementations, they are statistically processed to obtain the attributes required later to authenticate the dynamic characteristics of writing the user's handwritten password. As a rule, these are only functions of the speed of the cursor in the plane of the touch screen. But if the user signs with a light pen that is sensitive to pressing the plane of a graphic tablet (such as Wacom), then the pressure function will also be used. This will increase the reliability of authentication.
The cloud service SignToLogin forms the reference values ​​of all the necessary characteristics of the user and "remembers" them. During the authentication procedure, each entered implementation of the handwritten password will be processed according to the same principle as the implementations included in the standard. In the authentication mode, the processed implementation is compared with the reference values ​​using special algorithms and methods that make the SignToLogin service as user friendly as possible. The entered handwritten word implementations (signatures) are automatically scaled and are not sensitive to rotations in the screen plane! In case of successful user authentication, the entered implementation of the handwritten word is added to the standard, displacing the latest implementation from it. Thus, the handwriting password standard is always updated and becomes insensitive to changes in the user's handwriting.
To ensure that all our scientific results do not “gather dust” on the shelves, we decided to create useful tools in the form of an API for developers of web and iOS applications, which will allow using this technology in real practice. Here you can read all the necessary documentation.
We also developed an iOS application for signing PDF documents, which demonstrates the use of the SignToLogin Mobile API. It is fundamentally different from the analogs on the market: SignNow , HelloSign , PDFpenPro , Signosign / 2 , QuickSign .
With the help of our application you can recognize handwritten signatures on documents of your remote partners. Sign on the document, and the caption-picture will contain a link to the site Signtologin API. By clicking it, you can find out:
Agree that there is more trustworthiness in the document with such an informative signature!
Application developers would like to give a number of recommendations on the practical and future use of our technology and API:
A significant disadvantage of EDS is that it can be transferred to another person, i.e. in contrast to the traditional signature, it is alienable from its owner. At the same time, the legal significance of documents signed by an EDS by an outsider will be preserved, which in some cases may be unacceptable. If we combine the EDS and the biometric signature in the electronic document flow, then we can solve the problem of the inalienability of a legally significant EDS from its owner!
Let us dwell on the technology itself ... To begin with, you should understand that from the point of view of the authentication method, there is no difference what you will use as a password: a fixed handwritten word or signature. The main thing is that the dynamics of writing and the geometry of your handwritten word remain more or less stable.
')
The author of this post in the team of the Scientific and Technical Center "KASIB" for more than 10 years engaged in research and development of algorithms in this area. 2 PhD dissertations defended (3rd in the near future), more than 5 R & D projects have been completed. Even 5-6 years ago, in order to implement the authentication method based on the dynamics of writing a handwritten password (signature), the purchase of additional equipment was necessary - a graphic tablet (digitizer) with a light pen ( Wacom ). The evolution of mobile devices in recent years towards the use of touch input screens has made this technology as accessible as possible. At the end of 2012, our center created the cloud service SignToLogin , which implements user authentication based on the dynamics of writing handwritten passwords as a service, and later an application of the same name appeared in the App Store. Further description of the technology will be accompanied by examples of this cloud platform.
The authentication procedure is reduced to the fact that for each user must first create a standard handwritten password. The process of creating a standard is reduced to the sequential input of 10 implementations of a handwritten password on the touch screen of a mobile tablet (possibly using a stylus), which can take an average of 3 minutes.
The user must write in his usual handwritten word. After entering the required number of implementations, they are statistically processed to obtain the attributes required later to authenticate the dynamic characteristics of writing the user's handwritten password. As a rule, these are only functions of the speed of the cursor in the plane of the touch screen. But if the user signs with a light pen that is sensitive to pressing the plane of a graphic tablet (such as Wacom), then the pressure function will also be used. This will increase the reliability of authentication.
The cloud service SignToLogin forms the reference values ​​of all the necessary characteristics of the user and "remembers" them. During the authentication procedure, each entered implementation of the handwritten password will be processed according to the same principle as the implementations included in the standard. In the authentication mode, the processed implementation is compared with the reference values ​​using special algorithms and methods that make the SignToLogin service as user friendly as possible. The entered handwritten word implementations (signatures) are automatically scaled and are not sensitive to rotations in the screen plane! In case of successful user authentication, the entered implementation of the handwritten word is added to the standard, displacing the latest implementation from it. Thus, the handwriting password standard is always updated and becomes insensitive to changes in the user's handwriting.
To ensure that all our scientific results do not “gather dust” on the shelves, we decided to create useful tools in the form of an API for developers of web and iOS applications, which will allow using this technology in real practice. Here you can read all the necessary documentation.
We also developed an iOS application for signing PDF documents, which demonstrates the use of the SignToLogin Mobile API. It is fundamentally different from the analogs on the market: SignNow , HelloSign , PDFpenPro , Signosign / 2 , QuickSign .
With the help of our application you can recognize handwritten signatures on documents of your remote partners. Sign on the document, and the caption-picture will contain a link to the site Signtologin API. By clicking it, you can find out:
- who signed the document
- Owner’s signature match percentage
- when the document was signed
- in which place on the planet the document is signed (when the option is enabled),
- Subscriber's IP Address
- photo of the partner at the time of signing (if he so wishes).
Agree that there is more trustworthiness in the document with such an informative signature!
Application developers would like to give a number of recommendations on the practical and future use of our technology and API:
- Do not use this method as the main authentication method, since the result depends on the psycho-emotional state of the person.
- For greater reliability of authentication, for example, of your remote employees, you can organize their registration in the presence of employees of the relevant security service of your company.
- If possible, use a biometric signature paired with a legally significant e-signature. In the future, this will provide an opportunity to organize a full-fledged hybrid workflow.
Source: https://habr.com/ru/post/189848/
All Articles