AuthIoT: A Transferable Wireless Authentication Scheme for IoT Devices Without Input Interface

Wireless Internet of Things (IoT) applications have penetrated every aspect of our society and become increasingly important in smart homes, smart cities, and smart hospitals. However, many WiFi-based IoT devices (e.g., light switches, door/window open alert sensors, and Google Home) do not have input interfaces such as keypad or touchscreen due to their limits in physical size, power consumption, and/or manufacturing cost, making it inconvenient and onerous for end users to authenticate those IoT devices for wireless Internet access. In this article, we present AuthIoT, a learning-based authentication scheme for wireless IoT devices without input interfaces. The key component of AuthIoT is a channel state information (CSI)-based character classification algorithm for a WiFi access point (AP), which recognizes the passcode from an IoT device when an end user holds it in hand and writes the passcode over the air. AuthIoT has two salient features: 1) it is transferable for cross-environment applications and 2) it works in more realistic scenarios where AP is equipped with nonlinear antenna array. We have built a prototype of AuthIoT and evaluated its performance on two testbeds: 1) Intel 5300 WiFi card with three linear antennas and 2) USRP N310 with four nonlinear (square-shaped) antennas. The experimental results show that AuthIoT achieves 84% and 83% recognition accuracy on the two testbeds.