SSVEP-driven BCI authentication with reduced number of EEG electrodes across high and low frequency ranges

Growing concerns over data privacy, credential theft, and spoofing attacks have highlighted the limitations of traditional authentication methods in high-security settings. To address these challenges, we propose a steady-state visual evoked potential (SSVEP)-based brain-computer interface (BCI) authentication system that verifies short-lived, session-specific identity prompts using neural activity. The proposed system uses a single flickering visual stimulus to encode a unique, system-generated random code that remains unknown to the user. Instead of relying on conscious input, the system directly extracts the user's brain responses to the stimulus. Authentication is achieved by matching the frequency components of the recorded electroencephalography (EEG) signals to those embedded in the visual stimulus, enabling implicit verification without prior training or manual interaction. In an online BCI study involving 21 healthy participants, we evaluated four configurations differing in stimulation frequencies and EEG electrode count. Mean symbol-level accuracy reached 99% (95% CI: 98.3 -99.6) for high-frequency stimulation with three electrodes, 95% (95% CI: 91.1 -98.2) for high-frequency stimulation with a single electrode, 97% (95% CI: 95.1 -98.4) for low-frequency stimulation with three electrodes, and 96% (95% CI: 94.5 -97.8) for low-frequency stimulation with a single electrode. The corresponding mean trial durations were 38.6 s, 76.6 s, 17.2 s, and 27.1 s, respectively. Participants generally rated high-frequency flickering stimuli as more comfortable, whereas setup time and EEG wearability were identified as the main barriers to usability. These findings demonstrate that SSVEP-based authentication can provide accurate and training-free implicit authentication, while also offering potential resistance to spoofing attacks. The results suggest that this passive BCI approach is a promising direction for secure authentication, although practical deployment will require further improvements in speed, comfort, and wearability.