Abstract:The two-factor authentication ($2$FA) has drawn increasingly attention as the mobile devices become more prevalent. For example, the user's possession of the enrolled phone could be used by the $2$FA system as the second proof to protect his/her online accounts. Existing $2$FA solutions mainly require some form of user-device interaction, which may severely affect user experience and creates extra burdens to users. In this work, we propose a secure $2$FA system utilizing the proximity of a user's enrolled phone and the login device as the second proof without requiring the user's interactions. The basic idea of our $2$FA system is to derive location signatures based on acoustic beep signals emitted alternately by both devices and sensing the echoes with microphones, and compare the extracted signatures for proximity detection. Moreover, to further enhance the security of our system, we also design a device authentication scheme which derives the acoustic fingerprint between the login device and enrolled phone to verify the identity of two devices. Given the received beep signal, our system designs a period selection scheme to identify two sound segments accurately: the chirp period is the sound segment propagating directly from the speaker to the microphone whereas the echo period is the sound segment reflected back by surrounding objects. To achieve an accurate proximity detection, we develop a new energy loss compensation extraction scheme by utilizing the extracted chirp periods to estimate the intrinsic differences of energy loss between microphones of the enrolled phone and the login device. Our proximity detection component then conducts the similarity comparison between the identified two echo periods after the energy loss compensation to effectively determine whether the enrolled phone and the login device are in proximity for $2$FA. Moreover, to provide higher security, our device fingerprint-assisted proximity detection further utilizes the overall energy loss between the login device and enrolled phone as their hardware fingerprint to authenticate the identity of two devices. Our experimental results show that our system is accurate in providing $2$FA and robust to both man-in-the-middle (MiM) and co-located attacks across different scenarios and device models.

AcousAuth: An acoustic-based mobile application for user authentication

ToAuth: Towards Automatic Near Field Authentication for Smartphones

${\\ssr{PriWhisper}}$ : Enabling Keyless Secure Acoustic Communication for Smartphones

VocalLock

A Nonlinearity-Based Secure Face-to-Face Device Authentication for Mobile Devices

NAuth: Secure Face-to-Face Device Authentication Via Nonlinearity

(In)secure Acoustic Mobile Authentication

Securing Acoustics-Based Short-Range Communication Systems: an Overview

Quickauth: Two-Factor Quick Authentication Based on Ambient Sound

SoundID: Securing Mobile Two-Factor Authentication Via Acoustic Signals

Making It Trustable: Acoustic-Based Signcryption Mutual Authentication for Multiwearable Devices.

Robust Mobile Two-Factor Authentication Leveraging Acoustic Fingerprinting

CamAuth: Securing Web Authentication with Camera

ADEAS: Authentication Using Doppler Effect of Acoustic Signals Caused by Hands Moving

A Strong User Authentication Scheme with Smart Cards for Wireless Communications

Secure and Robust Two Factor Authentication Via Acoustic Fingerprinting.

Wireless Device Authentication Using Acoustic Hardware Fingerprints

Secure Mobile Two-Factor Authentication Leveraging Active Sound Sensing

EarPass: Secure and Implicit Call Receiver Authentication Using Ear Acoustic Sensing

PriWhisper+: an Enhanced Acoustic Short-Range Communication System for Smartphones

S2M: A Lightweight Acoustic Fingerprints-Based Wireless Device Authentication Protocol