Keystroke Recognition Using WiFi Signals Kamran Alit Alex X.Liut+Wei Wang Muhammad Shahzad tDept.of Computer Science and Engineering,Michigan State University,USA #State Key Laboratory for Novel Software Technology,Nanjing University,China tfalikamr3,alexliu,shahzadm@cse.msu.edu,ww@nju.edu.cn ABSTRACT ways to recognize keystrokes,which can be classified into Keystroke privacy is critical for ensuring the security of com- three categories:acoustic emission based approaches,elec- puter systems and the privacy of human users as what being tromagnetic emission based approaches,and vision based typed could be passwords or privacy sensitive information. approaches.Acoustic emission based approaches recognize In this paper,we show for the first time that WiFi signals keystrokes based on either the observation that different keys can also be exploited to recognize keystrokes.The intuition in a keyboard produce different typing sounds 1,2 or the is that while typing a certain key,the hands and fingers of a observation that the acoustic emanations from different keys user move in a unique formation and direction and thus gen- arrive at different surrounding smartphones at different time erate a unique pattern in the time-series of Channel State as the keys are located at different places in a keyboard [3]. Information (CSI)values,which we call CSI-waveform for Electromagnetic emission based approaches recognize key- that key.In this paper,we propose a WiFi signal based strokes based on the observation that the electromagnetic keystroke recognition system called WiKey.WiKey consists emanations from the electrical circuit underneath different of two Commercial Off-The-Shelf (COTS)WiFi devices,a keys in a keyboard are different 4.Vision based approaches sender (such as a router)and a receiver (such as a laptop) recognizes keystrokes using vision technologies 5. The sender continuously emits signals and the receiver con- In this paper,we show for the first time that WiFi signals tinuously receives signals.When a human subject types on can also be exploited to recognize keystrokes.WiFi signals a keyboard,WiKey recognizes the typed keys based on how are pervasive in our daily life at home,offices,and even the CSI values at the WiFi signal receiver end.We imple- shopping centers.The key intuition is that while typing a mented the WiKey system using a TP-Link TL-WR1043ND certain key,the hands and fingers of a user move in a unique WiFi router and a Lenovo X200 laptop.WiKey achieves formation and direction and thus generate a unique pattern more than 97.5%detection rate for detecting the keystroke in the time-series of Channel State Information(CSI)values, and 96.4%recognition accuracy for classifying single keys. which we call CSI-waveform,for that key.The keystrokes In real-world experiments,WiKey can recognize keystrokes of each key introduce relative unique multi-path distortions in a continuously typed sentence with an accuracy of 93.5%. in WiFi signals and this uniqueness can be exploited to re- cognize keystrokes.Due to the high data rates supported by Categories and Subject Descriptors modern WiFi devices,WiFi cards provide enough CSI val- C.2.1 Network Architecturel:Wireless Communica- ues within the duration of a keystroke to construct a high tions;D.4.6 Security and Protectione:Keystroke re- resolution CSI-waveform for each keystroke. covery We propose a WiFi signal based keystroke recognition sys. tem called WiKey.WiKey consists of two Commercial Off- Keywords The-Shelf (COTS)WiFi devices,a sender (such as a router) Gesture recognition;Wireless security:Keystroke recovery: and a receiver(such as a laptop),as shown in Figure 1.The Channel State Information:COTS WiFi devices sender continuously emits signals and the receiver continu- ously receives signals.When a human subject types in a 1.INTRODUCTION keyboard,on the WiFi signal receiver end,WiKey recog- Keystroke privacy is critical for ensuring the security of nizes the typed keys based on how the CSI value changes. computer systems and the privacy of human users as what CSI values quantify the aggregate effect of wireless phenom- being types could be passwords or privacy sensitive in- ena such as fading,multi-paths,and Doppler shift on the formation. The research community has studied various wireless signals in a given environment.When the environ- ment changes,such as a key is being pressed,the impact Permission to make digital or hard copies of all or part of this work for personal or of these wireless phenomena on the wireless signals change classroom use is granted without fee provided that copies are not made or distributed resulting in unique changes in the CSI values.There are for profit or commercial advantage and that copies bear this notice and the full cita- three key technical challenges.The first technical challenge tion on the first page.Copyrights for components of this work owned by others than is to segment the CSI time series to identify the start time ACM must be honored.Abstracting with credit is permitted.To copy otherwise,or re- and end time of each keystroke.We studied the character- publish,to post on servers or to redistribute to lists,requires prior specific permission istics of typical CSI-waveforms of different keystrokes and and/or a fee.Request permissions from Permissions@acm.org. MobiCom'l5.September 7-11,2015,Paris.France. observed that the waveforms of different keys show a similar ©2015ACM.1SBN978-1-4503-3619-2/15/09$15.00 rising and falling trends in the changing rate of CSI values. D0L:http:/x.doi.org/10.1145/2789168.2790109Keystroke Recognition Using WiFi Signals Kamran Ali† Alex X. Liu†‡ Wei Wang‡ Muhammad Shahzad† †Dept. of Computer Science and Engineering, Michigan State University, USA ‡State Key Laboratory for Novel Software Technology, Nanjing University, China † {alikamr3,alexliu,shahzadm}@cse.msu.edu, ‡ww@nju.edu.cn ABSTRACT Keystroke privacy is critical for ensuring the security of com￾puter systems and the privacy of human users as what being typed could be passwords or privacy sensitive information. In this paper, we show for the first time that WiFi signals can also be exploited to recognize keystrokes. The intuition is that while typing a certain key, the hands and fingers of a user move in a unique formation and direction and thus gen￾erate a unique pattern in the time-series of Channel State Information (CSI) values, which we call CSI-waveform for that key. In this paper, we propose a WiFi signal based keystroke recognition system called WiKey. WiKey consists of two Commercial Off-The-Shelf (COTS) WiFi devices, a sender (such as a router) and a receiver (such as a laptop). The sender continuously emits signals and the receiver con￾tinuously receives signals. When a human subject types on a keyboard, WiKey recognizes the typed keys based on how the CSI values at the WiFi signal receiver end. We imple￾mented the WiKey system using a TP-Link TL-WR1043ND WiFi router and a Lenovo X200 laptop. WiKey achieves more than 97.5% detection rate for detecting the keystroke and 96.4% recognition accuracy for classifying single keys. In real-world experiments, WiKey can recognize keystrokes in a continuously typed sentence with an accuracy of 93.5%. Categories and Subject Descriptors C.2.1 [Network Architecture]: Wireless Communica￾tions; D.4.6 [Security and Protectione]: Keystroke re￾covery Keywords Gesture recognition; Wireless security; Keystroke recovery; Channel State Information; COTS WiFi devices 1. INTRODUCTION Keystroke privacy is critical for ensuring the security of computer systems and the privacy of human users as what being types could be passwords or privacy sensitive in￾formation. The research community has studied various Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full cita￾tion on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re￾publish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from Permissions@acm.org. MobiCom’15, September 7–11, 2015, Paris, France. c 2015 ACM. ISBN 978-1-4503-3619-2/15/09 ...$15.00. DOI: http://dx.doi.org/10.1145/2789168.2790109. ways to recognize keystrokes, which can be classified into three categories: acoustic emission based approaches, elec￾tromagnetic emission based approaches, and vision based approaches. Acoustic emission based approaches recognize keystrokes based on either the observation that different keys in a keyboard produce different typing sounds [1, 2] or the observation that the acoustic emanations from different keys arrive at different surrounding smartphones at different time as the keys are located at different places in a keyboard [3]. Electromagnetic emission based approaches recognize key￾strokes based on the observation that the electromagnetic emanations from the electrical circuit underneath different keys in a keyboard are different [4]. Vision based approaches recognizes keystrokes using vision technologies [5]. In this paper, we show for the first time that WiFi signals can also be exploited to recognize keystrokes. WiFi signals are pervasive in our daily life at home, offices, and even shopping centers. The key intuition is that while typing a certain key, the hands and fingers of a user move in a unique formation and direction and thus generate a unique pattern in the time-series of Channel State Information (CSI) values, which we call CSI-waveform, for that key. The keystrokes of each key introduce relative unique multi-path distortions in WiFi signals and this uniqueness can be exploited to re￾cognize keystrokes. Due to the high data rates supported by modern WiFi devices, WiFi cards provide enough CSI val￾ues within the duration of a keystroke to construct a high resolution CSI-waveform for each keystroke. We propose a WiFi signal based keystroke recognition sys￾tem called WiKey. WiKey consists of two Commercial Off- The-Shelf (COTS) WiFi devices, a sender (such as a router) and a receiver (such as a laptop), as shown in Figure 1. The sender continuously emits signals and the receiver continu￾ously receives signals. When a human subject types in a keyboard, on the WiFi signal receiver end, WiKey recog￾nizes the typed keys based on how the CSI value changes. CSI values quantify the aggregate effect of wireless phenom￾ena such as fading, multi-paths, and Doppler shift on the wireless signals in a given environment. When the environ￾ment changes, such as a key is being pressed, the impact of these wireless phenomena on the wireless signals change, resulting in unique changes in the CSI values. There are three key technical challenges. The first technical challenge is to segment the CSI time series to identify the start time and end time of each keystroke. We studied the character￾istics of typical CSI-waveforms of different keystrokes and observed that the waveforms of different keys show a similar rising and falling trends in the changing rate of CSI values