隐藏你的信号：基于PPG的生物特征认证安全性分析
Hiding Your Signals: A Security Analysis of PPG-based Biometric Authentication
AI总结：
本文首次系统分析基于PPG的生物特征认证安全，验证rPPG远程窃密可威胁用户认证与通信协议，并提出隐藏面部生理信号的主动防御策略，将攻击成功率降至随机猜测水平。
摘要：
近年来，基于生理信号的生物特征系统受到广泛关注。与传统生物特征不同，生理信号不易被窃取（通常人眼无法观察）。光电容积脉搏波（PPG）信号易于测量，因此比许多其他生理信号更适合用于生物特征认证。然而，随着远程PPG（rPPG）的出现，当攻击者能够通过监控受害者面部远程窃取rPPG信号时，其不可观察性受到挑战，进而威胁基于PPG的生物特征认证。在基于PPG的生物特征认证中，现有攻击方法需要获取受害者的PPG信号，导致基于rPPG的攻击被忽视。本文首次分析了基于PPG的生物特征安全性，涵盖用户认证和通信协议。我们评估了五种rPPG方法提取的信号波形、心率和脉搏间间隔信息，包括四种传统光学计算方法（CHROM、POS、LGI、PCA）和一种深度学习方法（CL_rPPG）。我们在PURE、UBFC_rPPG、UBFC_Phys、LGI_PPGI和COHFACE五个数据集上开展实验，收集了全面结果。实证研究表明，rPPG对认证系统构成严重威胁：用户认证系统中rPPG信号欺骗攻击成功率达0.35；基于脉搏间间隔的安全协议中比特命中率为0.6。此外，我们提出一种主动防御策略，通过隐藏面部生理信号抵御攻击，将用户认证中rPPG欺骗攻击成功率降至0.05，比特命中率降至0.5（随机猜测水平）。该策略可有效防止PPG信号暴露，保护用户敏感生理数据。
英文摘要：
Recently, physiological signal-based biometric systems have received wide attention. Unlike traditional biometric features, physiological signals can not be easily compromised (usually unobservable to human eyes). Photoplethysmography (PPG) signal is easy to measure, making it more attractive than many other physiological signals for biometric authentication. However, with the advent of remote PPG (rPPG), unobservability has been challenged when the attacker can remotely steal the rPPG signals by monitoring the victim's face, subsequently posing a threat to PPG-based biometrics. In PPG-based biometric authentication, current attack approaches mandate the victim's PPG signal, making rPPG-based attacks neglected. In this paper, we firstly analyze the security of PPG-based biometrics, including user authentication and communication protocols. We evaluate the signal waveforms, heart rate and inter-pulse-interval information extracted by five rPPG methods, including four traditional optical computing methods (CHROM, POS, LGI, PCA) and one deep learning method (CL_rPPG). We conducted experiments on five datasets (PURE, UBFC_rPPG, UBFC_Phys, LGI_PPGI, and COHFACE) to collect a comprehensive set of results. Our empirical studies show that rPPG poses a serious threat to the authentication system. The success rate of the rPPG signal spoofing attack in the user authentication system reached 0.35. The bit hit rate is 0.6 in inter-pulse-interval-based security protocols. Further, we propose an active defence strategy to hide the physiological signals of the face to resist the attack. It reduces the success rate of rPPG spoofing attacks in user authentication to 0.05. The bit hit rate was reduced to 0.5, which is at the level of a random guess. Our strategy effectively prevents the exposure of PPG signals to protect users' sensitive physiological data.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
