  Voice biometrics is drawing increasing attention as it is a promising
alternative to legacy passwords for user authentication. Recently, a growing
body of work shows that voice biometrics is vulnerable to spoofing through
replay attacks, where an adversary tries to spoof voice authentication systems
by using a pre-recorded voice sample collected from a genuine user. To this
end, we propose VoiceGesture, a liveness detection solution for voice
authentication on smart devices such as smartphones and smart speakers.
VoiceGesture detects a live user by leveraging both the unique articulatory
gesture of the user when speaking a passphrase and the audio hardware advances
on these smart devices. Specifically, our system re-uses a pair of built-in
speaker and microphone on a smart device as a Doppler radar, which transmits a
high-frequency acoustic sound from the speaker and listens to the reflections
at the microphone when a user speaks a passphrase. Then we extract Doppler
shifts resulted from the user's articulatory gestures for liveness detection.
VoiceGesture is practical as it requires neither cumbersome operations nor
additional hardware but a speaker and a microphone commonly available on smart
devices that support voice input. Our experimental evaluation with 21
participants and different smart devices shows that VoiceGesture achieves over
99% and around 98% detection accuracy for text-dependent and text-independent
liveness detection, respectively. Results also show that VoiceGesture is robust
to different device placements, low audio sampling frequency, and supports
medium range liveness detection on smart speakers in various use scenarios like
smart homes and smart vehicles.
