2FiA: Towards WiFi Sensing-Based Authentication with Unique Biometrics

The emerging IEEE 802.11bf standard positions WiFi sensing as a key enabler of human biometric sensing for authentication. However, existing WiFi sensing-based authentication systems primarily depend on voluntary or semivoluntary biometric traits, such as body motions or respiration. While effective, these traits lack strong uniqueness and are susceptible to imitation, making WiFi sensing systems vulnerable to behavioral mimicry attacks. In this paper, we introduce 2FiA, the first dual-biometrics WiFi sensing-based authentication system integrating semi-voluntary respiration and involuntary heartbeat. Respiration serves as the primary factor, offering efficient and continuous identity verification, while heartbeat reinforces system robustness through its highly unique and hard-to-imitate nature. For the first time, we propose a novel WiFi sensing pipeline to extract weak heartbeat signals by statistically localizing the thoracic region, effectively suppressing non-thoracic interference, and separating co-located respiration to refine the heartbeat signals. Furthermore, we leverage Respiratory Sinus Arrhythmia (RSA) as a physiological constraint to validate and enhance the extracted heartbeat signals by exploiting the intrinsic coupling between respiration and heartbeat. We then build the authentication model by integrating features from both respiration and heartbeat signals in a unified framework. Through extensive experiments involving 36 participants across diverse environments, we demonstrate that $\mathbf{2} \mathbf{F i A}$ delivers reliable authentication performance, particularly in multi-user and impersonation attack scenarios.