Echolock: Towards Low Effort Mobile User Identification
Total Page：16
File Type：pdf, Size：1020Kb
EchoLock: Towards Low Effort Mobile User Identification Yilin Yang Chen Wang Yingying Chen Rutgers University Louisiana State University Rutgers University yy450@scarletmail. [email protected] ∗ yingche@scarletmail. rutgers.edu rutgers.edu Yan Wang Binghamton University [email protected] ABSTRACT User identification plays a pivotal role in how we interact with our mobile devices. Many existing authentication ap- proaches require active input from the user or specialized sensing hardware, and studies on mobile device usage show significant interest in less inconvenient procedures. In this paper, we propose EchoLock, a low effort identification scheme that validates the user by sensing hand geometry via com- modity microphones and speakers. These acoustic signals produce distinct structure-borne sound reflections when con- tacting the user’s hand, which can be used to differentiate Figure 1: Capture of hand biometric informa- between different people based on how they hold their mo- tion embedded in structure-borne sound using bile devices. We process these reflections to derive unique commodity microphones and speakers. acoustic features in both the time and frequency domain, convenient practices [37]. Techniques such as facial recog- which can effectively represent physiological and behavioral nition or fingerprinting provide fast validation without traits, such as hand contours, finger sizes, holding strength, requiring considerable effort from the user, but demand and gesture. Furthermore, learning-based algorithms are de- dedicated hardware components that may not be avail- veloped to robustly identify the user under various environ- able on all devices. This is of particular importance in ments and conditions. We conduct extensive experiments markets of developing countries, where devices such as with 20 participants using different hardware setups in key the Huawei IDEOS must forgo multiple utilities in or- use case scenarios and study various attack models to demon- der to maintain affordable price points (e.g. under $80) strate the performance of our proposed system. Our results [13, 15]. Secure and effective functionality necessitates show that EchoLock is capable of verifying users with over a lightweight protocol to distinguish between different 90% accuracy, without requiring any active input from the users, both to facilitate intelligently tailored services as user. well as maintain privacy. To this end, we propose EchoLock, an original and 1. INTRODUCTION inexpensive technique capable of secure, fast, and low- arXiv:2003.09061v2 [cs.HC] 9 Apr 2020 User identification is a fundamental and pervasive as- effort user identification utilizing only commodity speak- pect of modern mobile device usage, both as a means of ers and microphones. EchoLock uses a carefully de- maintaining security and personalized services. Verify- signed inaudible signal to measure acoustic reflections ing oneself is necessary to gain access to smartphones, and structural vibrations produced by the user's hand bank accounts, and customized news feeds; informa- when holding their mobile devices, such as smartphones, tion and resources which must be available on demand. tablets, smart remotes, or wireless mouses. Sound waves As such, repeated acts of authentication can quickly produced by speakers propagate through physical medi- grow tedious and consume unnecessarily long portions ums such as the aforementioned devices in the form of of daily routines involving mobile devices. Studies on structure-borne sound. Pressure from the hand applied cellphone addiction suggest that user identification pro- to the device has a unique and observable impact on cedures encompass up to 9.0% of daily usage time [17], structure-borne sound propagation. This information with related inquiries showing strong interest in more is representative of the user's hand geometry, a biomet- ∗This work was done during Chen Wang's Ph.D. study at ric indicator well studied in medical fields and known Rutgers University. to be accurate [7], yet rarely employed in mobile ap- 1 plications due to obstacles in obtaining accurate mea- in airborne and structure-borne signals that are hard surements with limited hardware. We find that acous- to distinguish from each other. Moreover, the ambi- tic sensing of these characteristics is not only feasible, ent noises and acoustic signals reflected off surrounding but also low-effort as no conscious action is required obstacles create serious interference that needs to be by the user; holding the device itself is the validating accounted for. Last but not least, many factors could action, rather than typing a password or pressing a fin- impact the robustness of the proposed approach, such gerprint scanner, as shown in Figure 1. This can be as different device shapes or materials. achieved using only speakers and microphones found on To address these challenges, EchoLock utilizes an ul- most commercial-off-the-shelf (COTS) devices, making trasonic signal to sense a user's mannerisms when hold- our system non-intrusive and low cost. The availability ing a device. A high-frequency, short duration trans- of these hardware components is only expected to in- mission is selected to reduce audible disturbances to the crease with the rising prevalence of integrated IoT de- user and provide prompt validation. The signals coming vices built with virtual assistants and voice controllers, through the structure-born and near-surface airborne projected to reach an install base of over 75 billion by propagation are separated based on different sound speeds 2025 [4]. in the air and solid materials [5]. The system applies a Existing solutions in the market are typically consid- band-pass filter to remove the ambient acoustic noises ered effective and fast, but do have some limitations that do not share the same spectrum as the designated regarding ease of use. Actions such as password en- ultrasonic signal. We derive fine-grained acoustic fea- try, voice utterances, or finger presses demand, however tures, including statistic features in the time and fre- briefly, the user's attention and active participation in quency domain as well as MFCC features, to capture the process. In contrast, EchoLock is a passive pro- the unique hand holding biometrics. We find simple cedure. Our technique serves as a viable standalone learning-based algorithms (i.e., SVM and LDA) are suf- identification system, or as a complementary system for ficient to robustly identify the user considering various multi-factor authentication due to its naturally low in- impact factors. There is no dependence on specialized volvement. Password security, for example, can be en- cameras or other dedicated hardware to accomplish this, hanced by simultaneously sampling hand geometry dur- requiring only the use of readily accessible microphones ing typing or swiping actions, compensating for com- and speakers found on most modern mobile devices. mon vulnerabilities (e.g. PIN codes spied on through Most significantly, no active input is required from the shoulder-surfing attacks cannot be used if the attacker's user, making our system low effort. hand is not recognized by the device). Our main contributions in this work are as follows: As a standalone technique, EchoLock is applicable • We develop a low-effort user identification system to a wide variety of services. Resources such as finan- for mobile and smart handheld devices (e.g. smart- cial accounts or health apps on smartphones can trig- phones, smart remotes, wireless mouses) that vali- ger a single-instance identification check to verify the dates hand biometric information based on acous- user's hand before divulging sensitive information. Pri- tic sensing. The proposed system does not require vate message notifications can be displayed or hidden any input from the user and is non-invasive by uti- onscreen depending on which person is currently hold- lizing a inaudible frequencies. Moreover, our min- ing the device. The low costs of small-scale microphone imal hardware requirements make our system easy and speaker sensors can enable even unconventional de- to be deployed on most COTS devices. vices to be compatible with EchoLock. Door handles • We design an acoustic sensing-based approach to augmented with such components can passively sense study the unique signal interferences caused by structure-borne sound propagation as the user holds an individual's hand on sound propagation result- them and open or lock accordingly. The speed of sound ing from their different curvatures, finger sizes and propagation is rapid, even when traveling through phys- holding behavior. We demonstrate that structure- ical mediums, enabling our identification checks to be born sound propagation of a carefully designed completed within milliseconds. Continuous authenti- acoustic signal is able to carry physiological and cation can also be implemented via periodic measure- behavioral hand information, which previously re- ments. lied on imaging techniques to measure. Building EchoLock for such applications does present • We identify unique acoustic features, including time- many challenges, however. The most prominent is the domain, frequency domain, and MFCC features, challenge in leveraging a single pair of low-fidelity speaker to capture the user's biometrics and apply signal and microphones to capture the unique characteristics processing and learning-based methods to distin- of a user's hand geometry, which usually has only minute guish the users based on their phone-holding be- differences