  The Internet of Things (IoT) is increasingly empowering people with an
interconnected world of physical objects ranging from smart buildings to
portable smart devices such as wearables. With recent advances in mobile
sensing, wearables have become a rich collection of portable sensors and are
able to provide various types of services including tracking of health and
fitness, making financial transactions, and unlocking smart locks and vehicles.
Most of these services are delivered based on users' confidential and personal
data, which are stored on these wearables. Existing explicit authentication
approaches (i.e., PINs or pattern locks) for wearables suffer from several
limitations, including small or no displays, risk of shoulder surfing, and
users' recall burden. Oftentimes, users completely disable security features
out of convenience. Therefore, there is a need for a burden-free (implicit)
authentication mechanism for wearable device users based on easily obtainable
biometric data. In this paper, we present an implicit wearable device user
authentication mechanism using combinations of three types of coarse-grain
minute-level biometrics: behavioral (step counts), physiological (heart rate),
and hybrid (calorie burn and metabolic equivalent of task). From our analysis
of over 400 Fitbit users from a 17-month long health study, we are able to
authenticate subjects with average accuracy values of around .93 (sedentary)
and .90 (non-sedentary) with equal error rates of .05 using binary SVM
classifiers. Our findings also show that the hybrid biometrics perform better
than other biometrics and behavioral biometrics do not have a significant
impact, even during non-sedentary periods.
