Secure User Authentication Leveraging Keystroke Dynamics via Wi-Fi Sensing

User authentication plays a critical role in access control of a man-machine system, where the knowledge factor like a Personal Identification Number (PIN) constitutes the most widely-used authentication element. However, knowledge factors are usually vulnerable to the spoofing attack. Recently, the inheritance factor like fingerprints emerges as an efficient alternative resilient to malicious users, but it normally requires special equipment. To this end, we propose WiPass, a device-free authentication system only leveraging the pervasive WiFi infrastructure to explore keystroke dynamics (manner and rhythm of keystrokes) captured by the Channel State Information (CSI) to recognize legitimate users while rejecting spoofers. However, it remains an open challenge to characterize the behavioral features hidden in the human subtle motions like keystrokes. Therefore, we build a signal enhancement model using Ricean distribution to amplify user keystroke dymanics and a hybrid learning model for user authentication, which consists of two parts, i.e., CNN-based feature extraction and SVM-based classification. The former relies on visualizing the channel responses into time-series images to learn the behavioral features of keystrokes in energy and spectrum domains, while the latter exploits such behavioral features for user authentication. We prototype WiPass on the low-cost off-the-shelf WiFi devices and verify its performance. Empirical results show that WiPass achieves on average 92.1% authentication accuracy, 5.9% false accept rate, and 6.3% false reject rate in three real environments.