Researchers have built a continuous authentication system called AccLock that identifies a wearer by the tiny vibrations a heartbeat makes inside the ear canal. The signal comes from an accelerometer of the kind already sitting inside many wireless earbuds, so no extra hardware is needed. The goal is to keep verifying that the person wearing the device is the legitimate user long after the initial unlock.

Each heartbeat sends a small mechanical pulse through the body. In the ear, that pulse shows up as a ballistocardiogram, or BCG signal, that an accelerometer can pick up. AccLock cleans the raw motion data, extracts features tied to the wearer's cardiac pattern, and compares those features to a registered template. If the match is close enough, the session stays trusted. If it drifts, the session gets revoked.

Key facts at a glance

• System name: AccLock.
• Biometric signal: ballistocardiogram (BCG) from heartbeat-induced vibrations in the ear canal.
• Sensor: standard accelerometer already found in many wireless earbuds.
• Purpose: continuous authentication after the initial unlock.
• Registration: about six minutes of sitting still; usable accuracy with as little as two minutes of enrollment data.
• Decision window: four seconds, with trust state updated roughly every half second.
• Study size: 33 participants.
• Tested conditions: sitting, lying down, light head movement, high-volume music playback, BLE packet loss, and several cardiac conditions.
• Handoff test: the system caught another person taking over the earbud within a few seconds in almost every trial.
• Failure cases: walking reduces accuracy, running breaks it almost completely, and talking causes interference.
• Long-term drift: accuracy held for about six weeks and began slipping by week eight.
• Hardware caveat: prototype used a 100 Hz accelerometer; mainstream earbuds often expose only downsampled motion data around 25 Hz.
• Retraining on a mainstream earbud roughly doubled error rates, from around 3% to around 7%.
• Untested threats: active vibration injection, replay of captured BCG streams, and reconstruction of cardiac signatures from other sensor data.

What the system does

Most biometric logins happen once, at the start of a session. After that, the device assumes the same person remains in control. AccLock is designed around a different premise: trust should be continuously re-earned. The system runs in the background, using the earbud's motion sensor to capture the wearer's cardiac rhythm. Because the heartbeat is internal and physiological, it is not something a nearby observer can easily copy from a distance.

The processing pipeline begins with raw accelerometer readings. Those readings contain the heartbeat signal, but they also contain motion from walking, head turns, jaw movement, and the earbud shifting against the ear. AccLock filters and segments the data, then extracts features that correspond to the timing and shape of the cardiac pulse. Those features are compared with a template created during enrollment. A close match keeps the session alive. A mismatch, or a sustained drop in confidence, revokes the session.

Registration takes about six minutes of sitting still, according to the study. The authors also show usable accuracy with as little as two minutes of enrollment data. Each authentication decision works on a four-second window, with a sliding step that updates the trust state roughly every half second. That timing matters for security: a handoff can be detected quickly, rather than waiting for the next full login prompt.

Reported accuracy

The headline numbers from a 33-person study are decent. Across sitting, lying down, light head movement, and even music playback at high volume, the system kept error rates in the low single digits. Older and younger users, men and women, and even people with several common heart conditions all landed in roughly the same range.

The more interesting test was the one that matters for security: what happens when the legitimate wearer takes the earbud out and someone else picks it up. The system caught the handoff within a few seconds in almost every trial. That is the entire point of continuous authentication, and on this one task the design held up well.

The study also examined Bluetooth Low Energy packet loss, posture changes, and environmental variation. None of those factors appeared to break the system outright. The results suggest that a heartbeat-based signal can survive the noisy, inconsistent conditions of everyday earbud use, at least in the short term and within the tested population.

Where it struggles

The system held up fine for desk work and casual movement. Walking knocked accuracy down noticeably. Running broke it almost completely. Talking also caused problems, since jaw motion and shifting contact with the ear produce vibrations in the same range as the heartbeat itself. Including some talking samples during enrollment recovered part of that loss, but it did not eliminate the challenge.

Long-term drift is another open question. Accuracy held steady for about six weeks and started slipping by week eight, which the authors attribute to gradual changes in fit, posture, and behavior. A background refresh routine using high-confidence samples seems to keep the profile current, but the study only ran for two months. What happens at six months or a year is anyone's guess.

A small group of users also produced consistently worse results than the rest, likely due to anatomy and how the earbud sits in the ear. Ear canal shape, sensor placement, and individual cardiac signal strength all vary. Until that gap closes, any deployment would need a fallback for the people the system simply does not read well. That could mean a secondary biometric, a PIN, or a different wearable form factor.

The hardware question

The prototype used a custom 3D-printed earbud with a standard commercial accelerometer running at 100 Hz. That sampling rate matters. A higher rate preserves more of the fine structure in the BCG signal, which helps distinguish one wearer from another. Many mainstream earbuds expose only heavily downsampled motion data to third-party developers, often around 25 Hz.

The team did get the system running on a leading consumer earbud using a lightweight retraining step, but error rates roughly doubled, from around 3% to around 7%. That is workable, though less accurate. It also depends on vendor cooperation if anyone wanted to ship this at scale. Without access to raw or less-processed accelerometer data, developers cannot build the same quality of continuous authentication on top of existing hardware.

The sampling-rate constraint is not just a technical detail. It shapes the business case. Earbud makers already have the sensors, the batteries, and the wearables on millions of ears. If they open the data pipeline, heartbeat-based authentication could become a software feature. If they keep it closed, the approach remains a research prototype or a niche product built on custom hardware.

How this fits the threat picture

Most consumer biometrics, including face and voice, have well-documented spoofing problems involving printed photos, deepfake audio, and silicone replicas. A BCG signal is harder to capture from a distance and harder to replay, since it arises from the wearer's own cardiac mechanics inside the ear canal. The study leans on that physiological origin as the basis for spoof resistance.

It is worth being honest about what was tested and what was skipped. The 33-user study covered movement, posture, environment, BLE packet loss, music playback, and several cardiac conditions, including bradycardia,

Source: Help Net Security News