Your Breath Doesn't Lie: Multi-user Authentication by Sensing Respiration Using mmWave Radar

User authentication is critical to privacy preservation. Most of the existing works focus on single-user authentication, which may not work efficiently and practically in multi-user scenarios. To this end, we present a Multi-user Authentication system (M-Auth) that employs a single COTS mmWave radar to capture the user's unique breathing pattern. It exploits the phenomenon that radio frequency (RF) signals are affected by chest displacements due to breathing. We specifically design an auxiliary rotating gadget to dynamically adjust radar orientation, making it more effective in capturing respiration signals from multiple users. To profile individual components from the entangled RF signals, we leverage mmWave's high directivity to locate each user and separately focus on reflections from different positions. We propose a signal energy comparison method to eliminate the irrelevant body movements for preserving fine-grained respiration traits. Afterward, we develop a feature selection pipeline to elicit the most informative features and train a machine learning-based classifier to identify each user. M-Auth is practical due to its non-contact and passive nature, and it is secure as respiration is unique and difficult-to-forge. Extensive experiments involving 37 participants demonstrate that M-Auth is effective in verifying legitimate users and thwarting spoofing attacks, with an authentication accuracy of over 96 % and an attack detection rate of over 95%.