BioMoTouch: Touch-Based Behavioral Authentication via Biometric-Motion Interaction Modeling

TL;DR

BioMoTouch is a novel multi-modal touch authentication framework that combines physiological and behavioral data from capacitive screens and inertial sensors to enhance security on mobile devices.

Contribution

It introduces a joint modeling approach of physiological and behavioral touch features, improving robustness without additional hardware.

Findings

Achieves 99.71% accuracy and 0.27% EER in realistic tests.

Maintains false acceptance below 0.90% under attack scenarios.

Operates implicitly during natural interactions without extra hardware.

Abstract

Touch-based authentication is widely deployed on mobile devices due to its convenience and seamless user experience. However, existing systems largely model touch interaction as a purely behavioral signal, overlooking its intrinsic multidimensional nature and limiting robustness against sophisticated adversarial behaviors and real-world variations. In this work, we present BioMoTouch, a multi-modal touch authentication framework on mobile devices grounded in a key empirical finding: during touch interaction, inertial sensors capture user-specific behavioral dynamics, while capacitive screens simultaneously capture physiological characteristics related to finger morphology and skeletal structure. Building upon this insight, BioMoTouch jointly models physiological contact structures and behavioral motion dynamics by integrating capacitive touchscreen signals with inertial measurements. Rather than combining independent decisions, the framework explicitly learns their coordinated interaction to form a unified representation of touch behavior. BioMoTouch operates implicitly during natural user interactions and requires no additional hardware, enabling practical deployment on commodity mobile devices. We evaluate BioMoTouch with 38 participants under realistic usage conditions. Experimental results show that BioMoTouch achieves a balanced accuracy of 99.71% and an equal error rate of 0.27%. Moreover, it maintains false acceptance rates below 0.90% under artificial replication, mimicry, and puppet attack scenarios, demonstrating strong robustness against partial-factor manipulation.