Beyond Legitimacy, Also With Identity: Your Smart Earphones Know Who You Are Quietly

User authentication and identification on smart devices has great significance in keeping data privacy and recommending personalized services. With the rising popularity of smart earphones recently, they open up a new world for users to enjoy music individually, but also bring about privacy concerns at the same time. Existing few research works propose positive sensing systems that emit and receive inaudible acoustic signals to authenticate users. However, they share shortcomings of intrusiveness to users, high power consumption, and purely focusing on authentication. Instead, in this paper, we propose a passive sensing system called ${{\sf EarID}}$ with low-cost customized earphones which attains user authentication and identification at once. It makes use of a embedded microphone to sense body sounds spread out through ear canals and extract ‘fingerprints’ as a novel biometric feature. With self-designed earphones, we design a deep learning-based real-time data processing pipeline and cope with external interference. Extensive experiments under different real-world settings show that ${{\sf EarID}}$ can achieve a rather low false acceptance rate of $3.4\%$ for user authentication and a high $F1$ score of $95.5\%$ for legitimate user identification.