Standardizing the evaluation framework for ECG-based authentication in IoT devices

Devices on the Internet of Things (IoT) often have constrained resources and operate in diverse environments, making them vulnerable to unauthorized access and cyber threats. Electrocardiogram (ECG) signals have emerged as a promising biometric for authenticating users in such settings. However, current ECG-based authentication studies lack a standardized evaluation framework tailored to resource-limited IoT contexts and long-term usage, making it difficult to assess their practical reliability. In this paper, we introduce a new evaluation framework for ECG-based authentication on IoT devices and construct a standardized dataset to facilitate rigorous testing. We categorize performance metrics into four key dimensions: scalability, adaptability, efficiency, and cancelability. Using this framework, we evaluate four representative ECG authentication algorithms for IoT devices. The results show that these algorithms struggle to maintain consistent performance under cross-session authentication scenarios. These findings highlight the critical importance of addressing the temporal variability of ECG signals and the current gap in robust ECG-based authentication for IoT devices. We believe the proposed framework will guide future research toward more resilient and secure ECG authentication systems for the IoT.