WristPass: Secure Wearable Continuous Authentication via Ultrasonic Sensing

Smartwatches have become increasingly prevalent in people’s daily lives, offering support for a wide range of privacy and security-sensitive applications, such as SMS messaging and mobile payment. Consequently, there is an imperative need for independent user authentication on smartwatches to safeguard against property loss and personal privacy breaches. However, current authentication methods rely on passwords, leaving users vulnerable to shoulder surfing attacks. Moreover, existing biometric-based authentication methods either require dedicated sensors or cannot support continuous authentication. In this paper, we propose a replay-resistant continuous authentication system on smartwatches, namely WristPass. It extracts acoustic impedance biometrics from ultrasonic signals. Leveraging a theoretical model based on the principle of ultrasound propagation, WristPass correlates spectrograms of reflected signals with impedance features of wrist skin. Utilizing a deep learning model as a feature extractor, WristPass mines fine-grained impedance features from the spectrograms for accurate user authentication. Additionally, to prevent WristPass from replay attacks, we design a device fingerprinting method to detect replayed signals. Extensive experiments show that WristPass can achieve 96.7% accuracy in user authentication. Furthermore, WristPass exhibits robustness for long-term usage.