Can cardiac rhythms be used to uniquely identify a person?

Question

Nymi, claims:

• "Like a fingerprint, your heartbeat is unique", and
• "Your Nymi lets you use your unique cardiac rhythm to authenticate your identity"

Is it true that heartbeats are unique, like fingerprints?

Is it true that Nymi can use your unique cardiac rhythm to authenticate your identity?

---

_{Now, I can imagine that using an ECG for this might be plausible, but to produce one you need 6-10 contact points (some at very specific locations on the body) and the person shouldn't be moving.}

_{With the wearable device being on the wrist, it only has one contact point so can't produce an ECG.}

_{This is without going into issues of people suffering from arrhythmia and other heart conditions or even the day to day changes in heart rate (resting, active etc...).}

Answer 1

The technology

There are actually two points of contact when Nymi is in use. You push the top of the sensor (the side that's like the face of the watch) with a finger from the opposite hand. The underside of the sensor touches your wrist. (http://www.getnymi.com/)

It appears the technology behind this device is "HeartID". (http://www.bionym.com/news/ - "See HeartID in action, enabling finger-touch based user authentication.")

This technology is described in (Fatemian et al. 2010) and in (Agrafioti, 2011).

One patent describing this technology is (Agrafioti, 2012).

Uniqueness of heartbeats

Quoting from the patent application (Agrafioti, 2012):

Uniqueness - while different signals may appear to conform to the same patterns, there is large inter-individual variability, resulting from different physiological parameters controlling the waveforms, and physiological factors (e.g., heart mass orientation, conductivity of various cardiac muscles, and cardiac activation order) can introduce significant variability among subjects (in fact, significant medical research had long sought to reduce this variability for universal diagnostic standards)

From the dissertation (Agrafioti, 2011):

Uniqueness is guaranteed in the ECG signal because of its physiological origin. While ECG signals of different individuals conform to approximately the same pattern, there is large inter-individual variability due to the various electrophysiological parameters that control the generation of this waveform.

The patent describes collecting the ECG signal from both wrists, but using one wrist and the opposite finger should have similar effect.

Authentication accuracy

(Agrafioti, 2010 at p. 91, Table 4.2), the error rate of their identification method at that time is shown.

Depending on the individual, equal error rates between 0 and 23% were achieved. The strictness of the classifier can be tuned depending on the target application to either be more lenient and allow more false authentications or be more strict and fail to authenticate the true individual more often. How they will choose this threshold for the production device, or if they will improve their classifier is not public knowledge.

References

Agrafioti, F. (2011). ECG in Biometric Recognition: Time Dependency and Application Challenges (Doctoral dissertation, University of Toronto).

AGRAFIOTI, F., BUI, F., & HATZINAKOS, D. (2012). WIPO Patent No. 2012151680. Geneva, Switzerland: World Intellectual Property Organization. Chicago

Fatemian, S. Z., Agrafioti, F., & Hatzinakos, D. (2010, September). Heartid: Cardiac biometric recognition. In Biometrics: Theory Applications and Systems (BTAS), 2010 Fourth IEEE International Conference on (pp. 1-5). IEEE.

Answer 2

Is it true that heartbeats are unique, like fingerprints?

This NewScientist article quotes Bionym's CEO as,

Bionym claims it has initial performance data, which it will release later this year, showing that its ECG system outperformed face recognition technologies, but that ECG was still not as accurate as the very top-of-the-line fingerprint systems. But for those concerned about identity theft, Martin points out that a three-tier system protects them: a person would have to steal the Nymi, replicate a user's unique heart rhythm and have access to their device. "In practical situations, the false positive rate of the system is effectively zero," he says.

If a user is stressed or exercises, the band should continue to function, Martin says. Although if you had just run a marathon, then immediately put the band on, the Nymi may struggle for a few minutes to get an accurate reading, he admits. "The system tolerates regular variation. It doesn't require your heartbeat to be exactly the same every time."