Incorporating health monitoring and duress detection into mobile device authentication

Smart phones and tablets are able to provide first responders unprecedented access to critical information and geospatially aware applications in order to support effective participation in emergency responses. These mobile devices furthermore provide a mechanism for first responders to gather and disseminate essential situation awareness information to coordinating agencies rapidly and accurately. Security organizations may, however, find it necessary to limit the sensitivity of information exchanged, both sent and received, by mobile devices based on concerns about the ease with which these devices may fall into the hands of criminals or unauthorized civilians. Modern authentication approaches for securing mobile devices can be cumbersome in time sensitive situations (e.g. strong passwords) or easily spoofed (e.g. a fingerprint scan can be forcibly captured against a user's will). This paper describes an innovative use of a low cost fitness tracker, connected to a user's mobile device via Bluetooth, to support a two factor authentication approach which is neither cumbersome nor easily spoofed and may offer stronger protections and greater availability than current approaches. Furthermore, the software application supporting it runs on the user's mobile device and does not require a network connection. The application may also implicitly provide essential health and status information involving the user which can enhance the safety of response operations. Our approach requires the mobile device user to enter a strong password at the time when they put on the fitness tracker. From that point on, the user has full access to his or her device as long as the authentication application is able to stay connected to the fitness tracker and recognizes that the user remains in control of the device and is not under duress. The application relies on a novel health monitoring and duress detection algorithm that continuously monitors the wearer's health statistics to detect hazards which might trigger the locking of the device.