Researchers have demonstrated a continuous authentication system, called AccLock, that identifies the wearer of wireless earbuds from the mechanical vibrations of their heartbeat. The work, published yesterday and available as a preprint on arXiv, uses the accelerometers already built into earbuds rather than adding new sensors.
AccLock relies on the ballistocardiogram, the small mechanical pulse a heartbeat sends through the body, which an earbud accelerometer can pick up as motion data. The system extracts cardiac pattern features from that signal and compares them against a registered template for the user. Instead of authenticating once when a device is unlocked, it re-checks identity on rolling four-second windows, updating its trust state roughly every half second so that a session is continuously tied to the enrolled person.
In a study of 33 participants, the researchers reported low single-digit error rates while users were sitting, reclining, moving their heads lightly, or listening to loud music. Performance held across age groups, genders, and several cardiac conditions, and the system reliably detected when an enrolled wearer removed the earbuds and another person put them on. Enrollment required about six minutes of stationary sitting, although the researchers found usable accuracy was achievable with roughly two minutes of data.
The study also documented clear limits. Walking significantly reduced accuracy and running caused near-total failure, because body motion overwhelms the heartbeat signal. Speech and jaw movement introduced interfering vibrations, and accuracy degraded after six to eight weeks as earbud fit and posture shifted. A small subset of users performed consistently poorly for anatomical reasons. When the team tested the approach on Apple AirPods, whose accelerometer data is downsampled to 25 Hz compared with the 100 Hz prototype, error rates roughly doubled to around 7 percent.
The researchers also noted a security gap: the study did not test AccLock against adversaries attempting to inject false vibrations, replay a captured heartbeat stream, or reconstruct a cardiac signature from other sensors. That leaves spoofing resistance an open question for future work.
Heartbeat has been used as a continuous authentication signal before, including in wrist-worn devices such as the Nymi band, which authenticates an enterprise user from cardiac biometrics while worn. AccLock applies a similar continuous-authentication idea to earbuds, a device category many people already wear for extended periods, while remaining a research prototype rather than a commercial product.
Sources: Help Net Security, arXiv
–
By Cass Kennedy
