  The lack of standard input interfaces in the Internet of Things (IoT)
ecosystems presents a challenge in securing such infrastructures. To tackle
this challenge, we introduce a novel behavioral biometric system based on
naturally occurring interactions with objects in smart environments. This
biometric leverages existing sensors to authenticate users without requiring
any hardware modifications of existing smart home devices. The system is
designed to reduce the need for phone-based authentication mechanisms, on which
smart home systems currently rely. It requires the user to approve transactions
on their phone only when the user cannot be authenticated with high confidence
through their interactions with the smart environment.
  We conduct a real-world experiment that involves 13 participants in a company
environment, using this experiment to also study mimicry attacks on our
proposed system. We show that this system can provide seamless and unobtrusive
authentication while still staying highly resistant to zero-effort, video, and
in-person observation-based mimicry attacks. Even when at most 1% of the
strongest type of mimicry attacks are successful, our system does not require
the user to take out their phone to approve legitimate transactions in more
than 80% of cases for a single interaction. This increases to 92% of
transactions when interactions with more objects are considered.
