Hi, my name is Yuxin.
Zhuolin and I would like to introduce ElectricAuth,
which uses electrical muscle stimulation, or EMS, to authenticate users.
Our team is from University of Chicago.
Let me show you an example. Here I put on my VR headset,
and it wants to authenticate me using our system.
It sends EMS stimuli to my arm; my fingers move;
it tracks my finger movements; and then authenticates me.
So ElectricAuth is a biometric system. But it differs from today's biometrics.
Today's biometrics passively capture our face, iris or fingerprints.
They work but they are *vulnerable* to data breach or replay attacks.
Once someone records my face or fingerprints, I cannot trust them anymore.
Instead, ElectricAuth is an *active* biometric. It authenticates by sending a
challenge to the user, and collecting the response.
A different challenge will lead to a different response.
To run authentication, the system uses a new challenge each time.
So, replaying previous responses will fail the authentication.
Also given the complexity of human biology, one cannot predict responses to unseen challenges.
Therefore, active biometrics are robust against data breach and replay attacks.
The more challenges the system can generate, the more robust the system is.
In this work, we want to know: can we use our muscles as an active biometric?
This motivates us to consider EMS, which stimulates muscle and generate movements.
And our conclusion is that EMS is a great modality for active biometrics,
because of two key properties.
The first one is intersubject variability. It is a well-known property of EMS.
Basically because everybody’s biology is different,
different users respond differently to the same EMS trigger.
In fact, this has been treated as the biggest disadvantage of EMS.
But in this work, we show that we can actually use it for user authentication.
For example, in this video,
we attached the electrodes to these two persons at the same position,
and apply the same impulse. As you can see, they respond differently.
The second property is temporal dependency,
that is muscles respond differently depending on their current state.
With this property, we can create a large pool of challenges.
So in our system, EMS challenges consist of a sequence of EMS impulses.
And we vary the time gaps in between to create different challenges.
Here is an example. We send the first impulse at the same time,
but send the second one at different time. As you can see, they respond differently.
So,
without varying time gaps, we can only create 4k challenges using 6 impulses;
but with varying time gaps, we can create 68M challenges.
Next, Zhuolin will show a quick demo of our IMU-based prototype.
Hi, I’m Zhuolin and now I am going to talk about our prototype.
It consists of three components.
The first one is a challenge component.
Here you see an EMS device, which is connected to my forearm muscles
via these electrodes, and I also have a list of preregistered challenges here.
The second one is a sensing component.
I have five IMUs attached to my fingers, which will capture my response to the EMS challenge.
We show the real-time signal here.
The third one is an authentication model,
which takes my response as input and will output an authentication result.
Later the result will be shown at this part.
So now I am going to select one challenge and start the authentication.
Let’s pick Challenge 19.
So it works.
Let’s try another one.
Works again.
Ok. So the final thing I am going to do is I will turn off the device
and mimic the response myself, and see if I can bypass the system.
So it failed.
Ok. That’s all.
Thanks.
We validated ElectricAuth using 4 types of evaluations.
We also considered many types of attacks beyond what Zhuolin has demoed.
Let me summarize the key results.
We found ElectricAuth is accurate in authenticating users;
and robust against data breach and replay attacks.
It's stable over time, against different humidity and muscle conditions.
It runs fast on mobile devices and supports multiple hand tracking systems including camera.
To conclude,
We show that EMS is a new and practical form of active biometrics.
It leverages intersubject variability to authenticate users,
and temporal dependency to create many challenges.
Thanks for listening. Please join us in our demo,
and visit our website for more info.