PPG as a Bridge: Cross-Device Authentication for Smart Wearables with Photoplethysmography

As smart wearable devices become increasingly powerful and pervasive, protecting user privacy on these devices has emerged as a critical challenge. While existing authentication mechanisms are available for interaction-rich devices such as smartwatches, enabling on-device authentication (ODA) on interaction-limited wearables, including rings, earphones, glasses, and wristbands, remains difficult. Moreover, as users increasingly own multiple smart devices, relying on device-specific authentication methods becomes redundant and burdensome. To address these challenges, we present PPGTransID, a ubiquitous and unobtrusive cross-device authentication (CDA) approach that leverages the real-time physiological consistency of photoplethysmography (PPG) signals across the human body. PPGTransID utilizes the widely available PPG sensors on wearable devices to capture users' physiological signals and compares them with remote PPG (rPPG) signals extracted from a smartphone camera, where robust face-based authentication is already established. In doing so, PPGTransID securely transfers the reliable authentication status of the smartphone to nearby wearable devices without requiring additional user interaction. An evaluation ( N =33) shows that PPGTransID achieves a balanced accuracy of 95.5% and generalizes across multiple wearable form factors. Robustness experiments ( N =10) demonstrate resilience to variations in lighting, camera placement, and user behavior, while a real-time usability study ( N =14) confirms reliable performance with minimal interaction burden. Finally, a deployment on commercial hardware ( N =10) confirms the practicability of PPGTransID in out-of-lab scenarios and its resistance to synchronized rPPG injection attacks.