Use Your PIN Securely: Acoustic-Based Second-Factor User Authentication With Enhanced Tap Biometrics

The vulnerability of PIN-based user authentication on mobile phones has been widely criticized. Despite the ongoing research efforts, existing solutions still face significant limitations, including weak anti-interference capabilities, ambiguity/inconsistency of biometrics, and low adaptability over time. In this work, we design an acoustic-based second-factor user authentication mechanism, namedTapPass, which derives device-bound and user-specific tap biometrics from hand-reflected ultrasonic signals during PIN input. To overcome the issue of the inherent dynamics of behavioral patterns and the diversity of passcode patterns, we design a joint deep learning biometric representation framework that combines adversarial learning and contrastive learning to extract discriminative and consistent biometric features. Furthermore, based on the insights of unique acoustic patterns of tap behaviors, a lightweight and interpretable frame-wise augmentation strategy is proposed to improve the training efficiency. Lastly, an incremental learning-based long-term adaptation strategy is introduced to improve the stability over time and the scalability among new users. Through extensive experiments with 50 participants,TapPasscan yield an averaged authentication accuracy of 93.24%, outperforming the state-of-the-art work by 14.48%. Even in the 8-week longitudinal study, the authentication performance exhibited minimal fluctuation, with a standard deviation of just 1.42%, highlighting its long-term stability.