  With the advancement of technologies, market wearables are becoming
increasingly popular with a range of services, including providing access to
bank accounts, accessing cars, monitoring patients remotely, among several
others. However, often these wearables collect various sensitive personal
information of a user with no to limited authentication, e.g., knowledge-based
external authentication techniques, such as PINs. While most of these external
authentication techniques suffer from multiple limitations, including recall
burden, human errors, or biases, researchers have started using various
physiological and behavioral data, such as gait and heart rate, collected by
the wearables to authenticate a wearable user implicitly with a limited
accuracy due to sensing and computing constraints of wearables. In this work,
we explore the usefulness of blood oxygen saturation SpO2 values collected from
the Oximeter device to distinguish a user from others. From a cohort of 25
subjects, we find that 92% of the cases SpO2 can distinguish pairs of users.
From detailed modeling and performance analysis, we observe that while SpO2
alone can obtain an average accuracy of 0.69 and F1 score of 0.69, the addition
of heart rate (HR) can improve the average identification accuracy by 15% and
F1 score by 13%. These results show promise in using SpO2 along with other
biometrics to develop implicit continuous authentications for wearables.
