Multi-Modal Biometric-Based Implicit Authentication of Wearable Device Users

TLDR

The Internet of Things has enabled wearable devices to collect extensive sensor data for health, finance, and access control, yet existing explicit authentication methods such as PINs or pattern locks are limited by small displays, shoulder‑surfing risk, and user recall burden, leading many users to disable security features. This study seeks a burden‑free implicit authentication mechanism for wearable users based on easily obtainable biometric data. We introduce an implicit authentication system that fuses three coarse‑grain minute‑level biometrics—behavioral step counts, physiological heart rate, and hybrid calorie burn/MET—using binary SVM classifiers. Across 400 Fitbit users in a 17‑month study, the system achieved average accuracies of 0.93 for sedentary and 0.90 for non‑sedentary subjects with an equal error rate of 0.05, showing hybrid biometrics outperform others while behavioral data had little impact.

Abstract

The Internet of Things (IoT) is increasingly empowering people with an interconnected world of physical objects ranging from smart buildings to portable smart devices, such as wearables. With recent advances in mobile sensing, wearables have become a rich collection of portable sensors and are able to provide various types of services, including tracking of health and fitness, making financial transactions, and unlocking smart locks and vehicles. Most of these services are delivered based on users' confidential and personal data, which are stored on these wearables. Existing explicit authentication approaches (i.e., PINs or pattern locks) for wearables suffer from several limitations, including small or no displays, risk of shoulder surfing, and users' recall burden. Oftentimes, users completely disable security features out of convenience. Therefore, there is a need for a burden-free (implicit) authentication mechanism for wearable device users based on easily obtainable biometric data. In this paper, we present an implicit wearable device user authentication mechanism using combinations of three types of coarse-grain minute-level biometrics: behavioral (step counts), physiological (heart rate), and hybrid (calorie burn and metabolic equivalent of task). From our analysis of over 400 Fitbit users from a 17-month long health study, we are able to authenticate subjects with average accuracy values of around .93 (sedentary) and .90 (non-sedentary) with equal error rates of .05 using binary SVM classifiers. Our findings also show that the hybrid biometrics perform better than other biometrics and behavioral biometrics do not have a significant impact, even during non-sedentary periods.