# Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics
## 3 Methods
### Architecture and System Design  
As depicted in Figure 1, SA uses a client-server architecture comprising three components:  
* Front-End (FE)--this is the part that the user interacts with, designed to work only on devices that run the Android and Apple iOS mobile operating systems. It is built using React Native (RN), \"a JavaScript framework for writing natively rendering mobile applications for iOS and Android platforms\" [15]. The FE contains the following interfaces:  
Figure 1: SA high-level architecture and system design.  
1. App Registration Screen (ARS)--when the application (\"app\") is first installed, the app presents the ARS, where a username to be associated with the app is provided by the user via an input form. On submission of the form, the user is routed to the next section where their keystroke dynamics (typing pattern) is captured.
2. Typing Behaviour Capture Screen (TBS)--authentication schemes are usually designed to mitigate situations where users lose access to their account credentials. SA captures the user's typing pattern on TBS, on initial app installation, for the purpose of account recovery. Considering that people have unique patterns when typing on keyboards [16], this process replaces the need for security questions during account recovery, identifying the user by their behaviour instead. To achieve this, a typing biometric JavaScript library [17] is implemented on TBS; while the user is typing in the provided input field, their typing pattern is captured and assigned a unique identity. TBS is presented only when the app is first installed; once the user's typing pattern is captured to the degree acceptable per TypingDNA API requirement, TBS is not presented on subsequent app launches. The user is prompted a minimum of three times [17] on TBS to type in their email address. Copy and paste is also disabled on TBS to ensure that the user types in the input field.
3. Accounts List Screen (ALS)--a list of all accounts added to the app by the user. This is the default interface presented to the user when the app is launched.
4. New Account Screen (NAS)--provides functionality for adding accounts to the app and contains a section for the user to upload the image that will be embedded with credentials related to an account, using steganography.
5. Account Import Screen (AIS)--during account retrieval, a user needs to provide the image that had been pre-embedded with the account details and their typing ID during initial registration. AIS offers the functionality to accept the image and capture a typing pattern; the captured typing pattern is compared with the typing pattern pre-associated with the typing ID embedded in the image supplied. If there is a match, the retrieval is successful.
* Back-End (BE)--this is the application server that interacts with the FE and Database server, handling logic relevant to the operation of the authentication process. It is designed using the Node.js programming language, \"a JavaScript runtime built on Chrome's V8 JavaScript engine\" [18]. The BE comprises several API endpoints through which encrypted communication with the FE occurs in a request-response fashion over HTTPS.
* Database--this server stores data generated by the app using NoSQL (Firebase v10.7.1), i.e., a non-relational format using key-value data representation.