MWIoTAuth: Multi-wearable data-driven implicit IoT authentication

Abstract

Due to the advancement of wearables and the Internet of Things (IoT), end-users are using a range of wearables, such as smartwatches, fitness bands, and smart glasses, to receive a range of services, e.g., bank transactions and access several physical objects, e.g., smart cars/homes. While wearables collect various information, e.g., physiological and behavioral data of an IoT end-user, to provide different services, market-wearables often have no authentication or have knowledge-based authentications. This limitation brings additional security challenges. However, similar types of data, e.g., heart rate (source: both Wellue and Fitbit), or different types of data, e.g., oxygen saturation values (source: Wellue) and calorie burn (source: Fitbit), obtained from multiple IoT-connected wearables could contain complementary information (due to positional variation of different wearables on different body parts), which can be helpful in uniquely identifying a user. Therefore, in this work, we propose an implicit IoT end-user authentication (mWIoTAuth) approach utilizing data from two market wearables, i.e., Wellue (providing heart rate and oxygen saturation values) and Fitbit (providing heart rate, calorie burn, and step count). From our detailed analysis of a 2-phase study conducted with two separate cohorts of 40 subjects wearing Wellue and Fitbit in their daily life for continuous 8 h, we find that models developed from two wearables have 5%–14% higher accuracy and F1 score compared to the single-wearable models. These findings show the promise to develop multi-wearable implicit authentication for end-users to secure the IoT world accessible via wearables.