论文标题
部分可观测时空混沌系统的无模型预测
Hiding Your Signals: A Security Analysis of PPG-based Biometric Authentication
论文作者
论文摘要
最近，基于生理信号的生物识别系统已广泛关注。与传统的生物特征特征不同，生理信号不容易被妥协（通常对人眼无法观察）。光杀解物学（PPG）信号易于测量，使其比许多其他生物特征验证的生理信号更具吸引力。但是，随着远程PPG（RPPG）的出现，当攻击者可以通过监视受害者的脸部远程窃取RPPG信号时，挑战不可观察到，随后对基于PPG的生物识别构成威胁。在基于PPG的生物识别身份验证中，当前的攻击方法要求受害者的PPG信号，从而忽略了基于RPPG的攻击。在本文中，我们首先分析了基于PPG的生物识别技术的安全性，包括用户身份验证和通信协议。我们评估了通过五种RPPG方法提取的信号波形，心率和脉冲间间隔信息，包括四种传统的光学计算方法（Chrom，POS，LGI，PCA）和一种深度学习方法（CL_RPPG）。我们在五个数据集（纯，UBFC_RPPG，UBFC_PHYS，LGI_PPGI和COHFACE）上进行了实验，以收集一系列全面的结果集。我们的实证研究表明，RPPG对身份验证系统构成了严重威胁。用户身份验证系统中RPPG信号欺骗攻击的成功率达到0.35。在基于脉冲间间隔的安全协议中，位命中率为0.6。此外，我们提出了一种积极的防御策略，以隐藏面部的生理信号以抵抗攻击。它将用户身份验证中RPPG欺骗攻击的成功率降低到0.05。位命中率降低到0.5，这是一个随机猜测的水平。我们的策略有效地阻止了PPG信号的暴露，以保护用户的敏感生理数据。
Recently, physiological signal-based biometric systems have received wide attention. Unlike traditional biometric features, physiological signals can not be easily compromised (usually unobservable to human eyes). Photoplethysmography (PPG) signal is easy to measure, making it more attractive than many other physiological signals for biometric authentication. However, with the advent of remote PPG (rPPG), unobservability has been challenged when the attacker can remotely steal the rPPG signals by monitoring the victim's face, subsequently posing a threat to PPG-based biometrics. In PPG-based biometric authentication, current attack approaches mandate the victim's PPG signal, making rPPG-based attacks neglected. In this paper, we firstly analyze the security of PPG-based biometrics, including user authentication and communication protocols. We evaluate the signal waveforms, heart rate and inter-pulse-interval information extracted by five rPPG methods, including four traditional optical computing methods (CHROM, POS, LGI, PCA) and one deep learning method (CL_rPPG). We conducted experiments on five datasets (PURE, UBFC_rPPG, UBFC_Phys, LGI_PPGI, and COHFACE) to collect a comprehensive set of results. Our empirical studies show that rPPG poses a serious threat to the authentication system. The success rate of the rPPG signal spoofing attack in the user authentication system reached 0.35. The bit hit rate is 0.6 in inter-pulse-interval-based security protocols. Further, we propose an active defence strategy to hide the physiological signals of the face to resist the attack. It reduces the success rate of rPPG spoofing attacks in user authentication to 0.05. The bit hit rate was reduced to 0.5, which is at the level of a random guess. Our strategy effectively prevents the exposure of PPG signals to protect users' sensitive physiological data.
