  Recent advances in machine learning and natural language processing have
fostered the enormous prosperity of smart voice assistants and their services,
e.g., Alexa, Google Home, Siri, etc. However, voice spoofing attacks are deemed
to be one of the major challenges of voice control security, and never stop
evolving such as deep-learning-based voice conversion and speech synthesis
techniques. To solve this problem outside the acoustic domain, we focus on
head-wearable devices, such as earbuds and virtual reality (VR) headsets, which
are feasible to continuously monitor the bone-conducted voice in the vibration
domain. Specifically, we identify that air and bone conduction (AC/BC) from the
same vocalization are coupled (or concurrent) and user-level unique, which
makes them suitable behavior and biometric factors for multi-factor
authentication (MFA). The legitimate user can defeat acoustic domain and even
cross-domain spoofing samples with the proposed two-stage AirBone
authentication. The first stage answers \textit{whether air and bone conduction
utterances are time domain consistent (TC)} and the second stage runs
\textit{bone conduction speaker recognition (BC-SR)}. The security level is
hence increased for two reasons: (1) current acoustic attacks on smart voice
assistants cannot affect bone conduction, which is in the vibration domain; (2)
even for advanced cross-domain attacks, the unique bone conduction features can
detect adversary's impersonation and machine-induced vibration. Finally,
AirBone authentication has good usability (the same level as voice
authentication) compared with traditional MFA and those specially designed to
enhance smart voice security. Our experimental results show that the proposed
AirBone authentication is usable and secure, and can be easily equipped by
commercial off-the-shelf head wearables with good user experience.
