[Paper Review] Shake-n-Shack: Enabling Secure Data Exchange Between Smart Wearables via Handshakes

Yiran Shen, Fengyuan Yang+4 more|arXiv (Cornell University)|Jan 23, 2018

User Authentication and Security Systems14 references3 citations

TL;DR

Shake-n-Shack proposes a secure, lightweight key exchange protocol between smartwatches using handshake-induced motion patterns, enabling automatic, user-friendly data sharing without extra hardware or user intervention. It achieves 99% key generation success in under 2 seconds with only 1.6% Equal Error Rate against mimicking attacks, running efficiently on off-the-shelf devices.

ABSTRACT

Since ancient Greece, handshaking has been commonly practiced between two people as a friendly gesture to express trust and respect, or form a mutual agreement. In this paper, we show that such physical contact can be used to bootstrap secure cyber contact between the smart devices worn by users. The key observation is that during handshaking, although belonged to two different users, the two hands involved in the shaking events are often rigidly connected, and therefore exhibit very similar motion patterns. We propose a novel Shake-n-Shack system, which harvests motion data during user handshaking from the wrist worn smart devices such as smartwatches or fitness bands, and exploits the matching motion patterns to generate symmetric keys on both parties. The generated keys can be then used to establish a secure communication channel for exchanging data between devices. This provides a much more natural and user-friendly alternative for many applications, e.g. exchanging/sharing contact details, friending on social networks, or even making payments, since it doesn't involve extra bespoke hardware, nor require the users to perform pre-defined gestures. We implement the proposed Shake-n-Shack system on off-the-shelf smartwatches, and extensive evaluation shows that it can reliably generate 128-bit symmetric keys just after around 1s of handshaking (with success rate >99%), and is resilient to real-time mimicking attacks: in our experiments the Equal Error Rate (EER) is only 1.6% on average. We also show that the proposed Shake-n-Shack system can be extremely lightweight, and is able to run in-situ on the resource-constrained smartwatches without incurring excessive resource consumption.

Motivation & Objective

• To enable secure, zero-effort data exchange between smartwatches worn by different users during natural handshakes.
• To generate cryptographically strong symmetric keys using motion signals captured from wrist-worn devices during handshakes.
• To ensure resilience against mimicking attacks without relying on cloud infrastructure or additional hardware.
• To design a system lightweight enough to run in-situ on resource-constrained smartwatches without excessive battery drain.

Proposed method

• Capture synchronized motion data from accelerometers on two wrist-worn smartwatches during a handshake.
• Extract and align motion patterns from the two devices, exploiting the physical rigidity of interlocked hands to ensure signal similarity.
• Apply common quantization and key reconciliation techniques to generate matching 128-bit symmetric keys on both devices.
• Use the generated symmetric keys to establish a secure wireless communication channel for data exchange.
• Implement the system on off-the-shelf smartwatches (e.g., Samsung Galaxy Watch, Apple Watch) to ensure real-world feasibility.
• Employ a lightweight protocol stack to minimize computational and energy overhead on wearable devices.

Experimental results

Research questions

• RQ1 Can motion signals from two hands during a handshake be used to generate cryptographically secure, matching keys on separate smartwatches?
• RQ2 How robust is the key generation process to environmental noise and user-specific motion variations?
• RQ3 To what extent can the system resist mimicking attacks where an adversary attempts to replicate handshake patterns?
• RQ4 Can the system operate efficiently in real-time on low-power, resource-constrained smartwatches without external dependencies?

Key findings

• The system successfully generates 128-bit symmetric keys with a success rate exceeding 99% within approximately 1 second of handshake.
• The system achieves an Equal Error Rate (EER) of only 1.6% in real-time mimicking attack resistance tests, indicating strong security.
• The system operates efficiently in-situ on off-the-shelf smartwatches, consuming minimal computational and energy resources.
• The motion pattern similarity between two hands during a handshake is sufficiently high to enable reliable key agreement across different users.
• The approach outperforms existing solutions in terms of usability, security, and efficiency, particularly avoiding reliance on cloud verification or bespoke hardware.