  Private voice communication often contains sensitive information, making it
critical to ensure that only authorized users have access to such calls.
Unfortunately, current authentication mechanisms, such as PIN-based passwords,
fingerprint recognition, and face recognition, fail to authenticate the call
receiver, leaving a gap in security. To fill the gap, we present EarPass, a
secure and implicit call receiver authentication scheme designed for
smartphones. EarPass sends inaudible acoustic signals through the earpiece
speaker to actively sense the outer ear, and records echoes using the top
microphone. It focuses on extracting ear-related signals from echoes and
performs spectrogram analysis in the magnitude and phase domains. To overcome
posture and position variability, EarPass utilizes a learning-based feature
extractor for extracting representative features, and a one-class classifier
for authentication. EarPass does not increase any burdens on users or change
users' call answering habits. Furthermore, it does not require extra devices
but only uses the speaker and microphone on the smartphone. We conducted
comprehensive experiments to evaluate EarPass's effectiveness and security. Our
results show that EarPass can achieve a balanced accuracy of 96.95% and an
equal error rate of 1.53%. Additionally, EarPass exhibits resilience against
potential attacks, including zero-effort attacks and mimicry attacks.
