There are many ways to approach the problem of using biosignals as potential passwords. We strongly believe that the most straightforward and established method to start is to use a very well-known neurophysiological phenomenon based on Event-Related Potentials (ERPs).
Let’s consider for a moment auditory ERPs only. An auditory event-related potential, essentially a change in the amplitude of the signal in specific time points, will be recorded when the subject receives an auditory stimulus that has specific characteristics. Most importantly, the characteristics of the challenge can be made to be known only to the person in question, according to previous training, novelty of stimulus, etc. The same applies, with minor variations, to visual stimuli.
The subsequent reaction, once filtered and combined with other neurophysiological modalities will provide a unique dynamic password that can be hashed for later validation. Since you are not constrained to one single biosignal, many sessions can provide added layers of security or be used for different levels of authentication (from local-private to global-public).
Let it be clear that the ERPs is only our starting point, but robust scientific evidence supports this is the best way to get going. Further down the road we plan to use more sophisticated ways to extract raw signal from the brain waves and other dynamic biometrics.
Nevertheless, one of our guiding lines is to keep costs low so everyone can be able to build the device with off-the-shelf components and open-source 3D printing plans and code. The workings of a device that deals with security should be transparent. Our ultimate goal here is to make a device that is affordable in a way that its adoption can scale quickly. This has been a major engineering hurdle in the past, since traditional neurophysiological lab equipment is immensely costly, albeit orders of magnitude more sensitive. ERPs is the safest bet to achieve this.
