  In this paper, we propose a system that enables photoplethysmogram
(PPG)-based authentication by using a smartphone camera. PPG signals are
obtained by recording a video from the camera as users are resting their finger
on top of the camera lens. The signals can be extracted based on subtle changes
in the video that are due to changes in the light reflection properties of the
skin as the blood flows through the finger. We collect a dataset of PPG
measurements from a set of 15 users over the course of 6-11 sessions per user
using an iPhone X for the measurements. We design an authentication pipeline
that leverages the uniqueness of each individual's cardiovascular system,
identifying a set of distinctive features from each heartbeat. We conduct a set
of experiments to evaluate the recognition performance of the PPG biometric
trait, including cross-session scenarios which have been disregarded in
previous work. We found that when aggregating sufficient samples for the
decision we achieve an EER as low as 8%, but that the performance greatly
decreases in the cross-session scenario, with an average EER of 20%.
