Schneier on Security

A blog covering security and security technology.

« Hotel Safe Scam | Main | The Futility of Defending the Targets »

October 8, 2009

Detecting Forged Signatures Using Pen Pressure and Angle

Songhua Xu presented an interesting idea for measuring pen angle and pressure to present beautiful flower-like visual versions of a handwritten signature. You could argue that signatures are already a visual form, nicely identifiable and universal. However, with the added data about pen pressure and angle, the authors were able to create visual signatures that offer potentially greater security, assuming you can learn to read them.

A better image. The paper (abstract is free; paper is behind a paywall).

Posted on October 8, 2009 at 6:43 AM • 35 Comments

To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.

Comments

It doesn't sound very useful to me, how will they find the pressure and pen angle of the signature I put on a check or contract? It's not information that's available.

Posted by: A nonny bunny at October 8, 2009 7:16 AM

I guess you could find the angle and the pressure by measuring the angle and depth of the lines on the paper. However, handwritten signatures are (should be) pretty obsolete in my opinion, they are faked too easily, even with these techniques.

Posted by: A nonny mouse at October 8, 2009 7:55 AM

So the visual representation of your signature would have to be available to some system. All the forgers have to do now is to get a hold of that image and become good at reading and forging using it. The result is a more precisely forged signature.

Posted by: Wes P at October 8, 2009 7:58 AM

@ A nonny mouse

I disagree. I really doubt you could fake a signature and fool a Signature Authentication Expert.

Posted by: Ricky Bobby at October 8, 2009 8:00 AM

It's not new idea - http://www.biometriclabs.pl/index.php?... - research by Joanna Putz-Leszczynska in online signature verification based on pen angles and pressure starts back in 2003. unfortunatelly I don't have any paper available. Of course for such method you need tablet with ability to collect such data.

Posted by: jacekm at October 8, 2009 8:16 AM

It's interesting, but I see this sort of system generating too many false postives (forgery detections) for people, like me, whose signatures can be very... erratict at times.

Although inconsitencies in my signature could generate false positives currently, this sort of system would no doubt raise peoples standards and expectations of signatures.

Posted by: john greco at October 8, 2009 8:18 AM

IBM came up with this application over 20 years ago when they invented tiny accelerometers, and studied product ideas for it. Nothing happened. Was it the application or the company?

Posted by: Mike Laird at October 8, 2009 8:19 AM

I don't want a digital record of my signature to be kept anywhere as it would be as good as the real thing on any terminal. I would not have a rubber stamp with my signature for the same reasons. I do have a couple of low resolution jpegs of my signature but they would not pass muster on a legal document.

Posted by: Martin at October 8, 2009 8:23 AM

@A nonny bunny

I could potentially see this being put to use to supplement signature verification, not nessecarily actually replace signatures. For instance, with updated hardware it could probably be implemented rather easily and transparently in grocery stores that already have you sign on a tablet.

Posted by: john greco at October 8, 2009 8:23 AM

Many years ago (maybe 20+) I participated in a signature verification project at IBM research. They were looking at it for building entry (sign in). It used pressure sensitive pens. I could not forge my own signature well enough to ever get in. I don't believe any of this was ever published externally. As should be apparent, no product resulted from these studies.

Posted by: Walt Daniels at October 8, 2009 8:25 AM

The link to the paper is not working for me and produces a "Session Cookie Error". Does anyone have a working link?

Posted by: Gork at October 8, 2009 8:28 AM

In the example shown, the forger does a pretty good job of matching the appearance of the signature itself, but fails miserably at matching the pressure patterns.

However, isn't this just because in this example the forger is only aiming to replicate the visual appearance? If we replace signatures with signatures + pressure displays, and the forgers also have access to a pressure display system to practice on, couldn't they also match the pressure patterns?

Posted by: Nicholas Sherlock at October 8, 2009 8:31 AM

There are several patents on this type of electronic signature (which is not the same as digital signature). I don't know where they are today, but around 10 years ago a company called PenOp created several products using electronic signature pads that captured biometrics like pen angle, speed, pressure, etc., which were included along with the visual part of the handwritten signature, to create the electronic signature.

Posted by: Patents at October 8, 2009 8:35 AM

This is very nice research. I have always been interested in "side channel" authentication methods. Another interesting mechanism is password keystroke timing. I think these kinds of techniques could be very effective in validating authenticity if tools to measure these characteristics could be made widely available. And given that many POSs have an attached digital signature capture pad, the day may be sooner rather than later.

Posted by: Jim Kita at October 8, 2009 8:39 AM

It's interesting, but I see this sort of system generating too many false postives (forgery detections) for people, like me, whose signatures can be very... erratict at times.

Although inconsitencies in my signature could generate false positives currently, this sort of system would no doubt raise peoples standards and expectations of signatures.

Posted by: Marcio Rocon at October 8, 2009 8:50 AM

@Ricky Bobby

You are right, you most likely can't, but how many times will a signature get checked by a Signature Authentication Expert?

Posted by: A nonny mouse at October 8, 2009 9:29 AM

This wouldn't work for me. My signature has little consistency. Curse my lack of fine motor skills.

Posted by: Sleepy at October 8, 2009 9:59 AM

@Marcio Rocon

Couldn't have said it better myself. Oh wait...

Posted by: john greco at October 8, 2009 10:03 AM

At this point, you have to measure this with a special writing pad underneath the paper. In theory, it might be measured by a special writing instrument, even capturing another metric of the hand holding the pen.

I can see this being useful for UPS and FedEx delivery signature capture enhancement. I can see some financial businesses (car dealers) using it as a verification of identity.

Posted by: aikimark at October 8, 2009 10:52 AM

Gah.

I'm with all the folks who worry about false positives. What are the odds that several billion people can be trained to write their signatures with not only a consistent look but a consistent set of speeds, pressures and angles, versus the odds that a few dozen thousand motivated forgers can learn to do the same?

Of course, one big question here is which aspects of a signature get abstracted by the analysis algorithm. When I look at my signatures or those of others, I see some aspects that seem very much the same from exemplar to exemplar and others that vary wildly. Capturing that securely is an interesting problem.

Posted by: paul at October 8, 2009 11:52 AM

@Martin "they would not pass muster on a legal document"

Interesting thing about signatures, it's a legal not a technological...they can be anything even if you give your name to message for a telegraph operator who type in all caps

BUY PROPERTY STOP
MARTIN
becomes binding.

If I sent it morse code for you...the law still says you signed it.

\s\ Barthalomu Frankinsense Skinner
is binding

A signature under us law is ""an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record."

Clicking the ship now button is binding for Amazon

If agreement is repudiated then it's a matter for the courts to determine.

Posted by: BF Skinner at October 8, 2009 12:01 PM

Some people have been wondering about capture of a signature in general whereas some others are wondering specifically about capture on paper.

Concentrating on the first group I can see that no one has used a stylus on a tablet hooked up to a computer or a tabletpc with an active digitizer.

These convey position, tilt and pressure (up to thousands of gradations) as part of the data stream. In fact, this is what allows for brush artistic variation on an artist's tablet and assist in handwriting recognition on a tabletpc.

Posted by: MarceloR at October 8, 2009 12:30 PM

The point of this is not that they are using pressure information to detect forgeries (this is old hat). The interesting bit seems to be that they found a 2d visual depiction of the information which the human brain can do a half decent job of comparing.

I can't see this being used for automated authentication, but I can see it as being printed on your visa card, and having the clerk check it (perhaps only on multi thousand dollar purchases such as TVs)

Then again, given that the digital signature systems they use nowdays can't even BEGIN to produce a legible signature, I'm not sure they could stand capturing pressure information!

Posted by: RH at October 8, 2009 12:44 PM

I think the first "sign in" authentication system I saw must have been in the late 1980's/ early 90's.

All I can realy remember about it was that it had an interesting side property in that it had been found that peoples signitures changed predictably with their state of health...

Which begs the question what information are we giving away about ourselves, especialy as this system appears to pick up on small changes.

Posted by: Clive Robinson at October 8, 2009 2:03 PM

I have seen this even before the 2003 paper cited. As I recall, this is actually the method of the best eyeball processes as well, but for best results needs digitizing pens. Those used by graphic artists have, for a couple decades, been able to pick up not just pressure, but angle and distance from the surface (to many decimal places).

I have an intensely scribbly and variable signature. One demo I saw involved a similar one, a scribble and not a super-regular one. The procedure, with a digital pen, picked up the fundamentals of the stroke behavior anyway, and matched pretty well. Of course, it's not ID in the airport, just validation of a known person, but it was solid for that.

OTOH, has anyone seen the resolution of PINpads? The things you sign at POS terminals to authenticate your credit card? A joke. Though it would be nice to see this added to retail transactions as it's not a change in procedure to the clerk or customer, it's not a software or procedure change, sadly.

Posted by: Steven Hoober at October 8, 2009 2:20 PM

This is pretty ingenious. However, I assume it's not necessarily intended for use in financial transactions.

Chip + PIN is arguably better and in use all over Europe, if you're going to retool.

Posted by: Vincent at October 8, 2009 2:48 PM

Signatures: just cheap, unreliable biomterics. Good thing paper is being used less and less; digital signatures are the way to go.

Posted by: Hey nonny nonny at October 9, 2009 12:38 AM

Any midrange Wacom drawing tablet supports pressure and angle sensitivity, so recording/measuring is not a problem. In fact, this is why I suppose they picked these two variables (out of very many possible things to measure on someone holding a pen), exactly because you can easily measure this by giving test subjects a stylus and a drawing tablet :)

What I wonder about, this might be useful, how many bits of entropy are there in these diagrams? Cause you maybe could use them as simple passwords. A lot easier to remember. And if you use a secure sketch algorithm, you get built-in fault tolerance as well as a construction that does not necessarily let the server know what the signature exactly looks like.

Posted by: kaes at October 9, 2009 3:19 AM

Offtopic, but what is it with comments that repeat sections of other comments. For example, Ordis' comment above. Spammers?

Posted by: Gliptic at October 9, 2009 3:41 AM

@Clive "what information are we giving away about ourselves, especialy as this system appears to pick up on small changes."

Should always be a concern but I'll only start to worry when they hook my toilet up to monitor the contents of my daily...output.

Posted by: BF Skinner at October 9, 2009 6:10 AM

The description that you quoted has an error: the equipment measured the pressure and VELOCITY of the pen, nothing at all about angles.
The paper is not so much about signatures as it is about the presentation of the information. No one is selling this thing, it is all about gee whiz!

Posted by: gordon at October 9, 2009 6:26 AM

So, if you had one too many,
they won't let you sign into a motel to sleep it off?
Or, if you injure your hand,
all your transactions are disabled?
Such as signing for your medical care at the E.R.?

The growing reliance of those "paid not to think"
on the "magic" of identification-authorization-access
to discern one as all others is truly troubling.

It is introducing a kind of uncertainty at the granular level of the individual person
in order to favor some abstract systemic effeciency,
while ignoring or discounting or trying to erxternalize
the later responsibility costs for the consequences.

Posted by: Peter E Retep at October 9, 2009 6:12 PM

Even if the specifity of pressure and angle sensor can be taken for granted I suspect that this method will have a huge amount of active failures because a whole lot of the input generation system cannot be standardized: Do you have to sign standing or sitting? On which surface are you signing? In which mood are you? Are you intoxicated? Shivery? Ill?

Taking all this into account you might not want to rule out everyone who doesn't pass this signature test. So what do you do with the big rest? This smells like a "default to insecure" system for anyone who wants to earn money.

So it looks like you can't use this signature pressure/angle sensing as a highly specific detection countermeasure.

What you are left with is to use it as a prevention countermeasure. You may scare some bad people away by applying it.

Next thing to do: if you want to get rid of the brittleness, you will have to provide another dedicated detection countermeasure behind this prevention thing in order to establish some kind of in-depth security.

Looks like a lot of inconvenience as a trade-off for a suspectedly non-specific prevention countermeasure which you will have to backup with some robust detection countermeasure anyway.

--JR

Posted by: JR at October 10, 2009 10:55 AM

"So, if you had one too many, they won't let you sign into a motel to sleep it off?
Or, if you injure your hand, all your transactions are disabled?"

C'mon, a little bit of critical thinking here please. So if you can't sign today due to any of those, what happens?

As for the "folks won't be able to do it consistently" crowd above: again, the premise is that this analysis may vary *less* than the signature itself. Obviously if it's too picky, it won't fly -- as early fingerprint recognition systems didn't. The IBM non-product of a while ago probably suffered from being too early.

Posted by: S/N ratio improvement at October 15, 2009 4:22 PM

Signatures exist in all cultures and languages and have been used for hundreds of years to authenticate identity and documents. 2D representation of a Signature, and increasing security using pressure and angle is of great interest to me. I think I have a commercial model to make this work, and also the potential backing of the right Corporation. Is there any one out there who can put me in touch with Songhua Xu, or who is a software wizard? I want to have a technical business partner, who can create a demo of signature recognition. This is a classic analogue to digital problem, and would ideally need 95% accuracy, and I believe it can be done. Please contact me if you can help!!

Posted by: Peter Entrepreneur at February 16, 2010 4:02 PM

Subscribe to comments on this entry

Schneier on Security

October 8, 2009

Detecting Forged Signatures Using Pen Pressure and Angle

Comments

Post a comment

Search

Archives by Date