Nymi band brings biometrics to wearables; authenticates users with ECG pattern

Effective authentication security usually requires two factors: something you have, and something you know. This is the difference between using a password, pattern or PIN (something you know) and using a biometric ID or physical token (something you have). Two-factor authentication combines both, with the assumption that it would be very difficult for someone to replicate your password as well as a physical object or part of your body.

Still, biometrics company Bionym has demonstrated a new tool to up the ante with three-factor authentication, using a wristband that can detect the wearer's unique cardiac rhythm, much like an ECG scan. Called the Nymi, the wristband is one of the more innovative wearable gadgets currently in development.

The Nymi wristband itself can act as a security token using low-power Bluetooth, and with a press down onto the wearer's skin, it can detect the unique ECG pattern and transmit it as an additional identity verification mechanism. The third factor is the user's smartphone, with an app that actually manages passwords and accounts. Thus, if the Nymi band is lost or stolen, no actual ID data is lost with it.

The company asserts that ECG is unique enough to be considered a biometric parameter, even after considering variables such as heart rate, stress, emotional state and medication. Bionym says it will publish more detailed information closer to the product's launch date late this year.

The wristband does not continuously monitor a wearer's heart rate, but only uses it to authenticate the wearer and then unlock other devices. It can detect when it has been removed from the wearer's wrist, after which it will need to scan his or her pulse again. In order to authenticate, a user must press down on the wristband with his or her opposite hand, thus completing a circuit that runs across the heart. The scan result is not medically admissible.

Bionym asserts that each individual's heartbeat pattern is unique enough to replace fingerprints as an authentication factor. The Nymi wristband also recognises motion, so users could be able to unlock their cars, smartphones, and various other devices with just a flick of the wrist, and also transmit other commands. Multiple people could use Nymis to have cars and gadgets recognise them and load their profiles and preferences automatically. Simply walking away from a device would be enough to lock it again.

Privacy is important, and all services are opt-in. Usage patterns are not tracked, and no information is transmitted over the Internet for any purpose.

The Nymi will also offer notifications via Bluetooth, like other wearable smart accessories that various companies have demonstrated. At launch, the band will support unlocking Android devices, but iOS does not allow anything to bypass its lock screen. No further specifics are available as to compatible devices and services, but Bionym does say it is working with multiple developers to explore opportunities.

Nymi wristbands can be preordered for $79 (approximately Rs. 4,782) in black, white, or orange. Shipping is $10 extra, to anywhere in the world. The wristband can be charged via USB, and should last about a week between charges. It is water resistant, but not waterproof.