WiSecure: a physical-layer challenge-response framework for secure WiFi CSI-based human authentication

Existing WiFi CSI-based human authentication relies largely on passive pattern matching, leaving it vulnerable to replay, signal-injection attacks, and cross-environment degradation. We propose WiSecure, an active physical-layer challenge-response framework that binds each authentication attempt to a fresh RF challenge through subcarrier selection, phase rotation, and timing jitter, while treating human-body electromagnetic scattering as a PUF-inspired primitive under an empirically calibrated usable-entropy assumption. WiSecure combines WiID-Net++, a subcarrier-aware graph attention encoder regularized by the Hilbert–Schmidt Independence Criterion, with label-free test-time adaptation to preserve identity information while suppressing environmental leakage. A multi-modal liveness module further evaluates respiratory, cardiac, and residual micro-motion signatures through temporal, cross-modal, and challenge-response consistency checks. Experiments with 20 participants across three environments show that WiSecure achieves 93.8% closed-set authentication accuracy and 0.941 open-set AUROC while limiting cross-domain degradation to 5.6 percentage points without labeled target-domain data. Under the evaluated CSI feature-level injection protocol (not over-the-air SDR injection), attack success is 0.7% for random injection and 1.8% for targeted injection, increasing to 3.8% under an adaptive white-box GAN. The challenge-response primitive has an empirically estimated usable min-entropy of 68.7 bits and achieves 0% software-layer replay success across all tested delay conditions. GPU post-acquisition decision latency is 107 ms for a 3-s CSI observation window; over-the-air SDR validation remains future work.