[论文解读] Shake-n-Shack: Enabling Secure Data Exchange Between Smart Wearables via Handshakes

Yiran Shen, Fengyuan Yang+4 more|arXiv (Cornell University)|Jan 23, 2018

User Authentication and Security Systems参考文献 14被引用 3

一句话总结

Shake-n-Shack 提出了一种安全、轻量级的密钥交换协议，通过握手诱导的运动模式实现智能手表之间的密钥交换，无需额外硬件或用户干预，即可实现自动、用户友好的数据共享。该协议在 1.6% 的等错误率（Equal Error Rate）下，于 2 秒内实现 99% 的密钥生成成功率，且在市售设备上运行高效。

ABSTRACT

Since ancient Greece, handshaking has been commonly practiced between two people as a friendly gesture to express trust and respect, or form a mutual agreement. In this paper, we show that such physical contact can be used to bootstrap secure cyber contact between the smart devices worn by users. The key observation is that during handshaking, although belonged to two different users, the two hands involved in the shaking events are often rigidly connected, and therefore exhibit very similar motion patterns. We propose a novel Shake-n-Shack system, which harvests motion data during user handshaking from the wrist worn smart devices such as smartwatches or fitness bands, and exploits the matching motion patterns to generate symmetric keys on both parties. The generated keys can be then used to establish a secure communication channel for exchanging data between devices. This provides a much more natural and user-friendly alternative for many applications, e.g. exchanging/sharing contact details, friending on social networks, or even making payments, since it doesn't involve extra bespoke hardware, nor require the users to perform pre-defined gestures. We implement the proposed Shake-n-Shack system on off-the-shelf smartwatches, and extensive evaluation shows that it can reliably generate 128-bit symmetric keys just after around 1s of handshaking (with success rate >99%), and is resilient to real-time mimicking attacks: in our experiments the Equal Error Rate (EER) is only 1.6% on average. We also show that the proposed Shake-n-Shack system can be extremely lightweight, and is able to run in-situ on the resource-constrained smartwatches without incurring excessive resource consumption.

研究动机与目标

• 在不同用户佩戴的智能手表自然握手过程中，实现安全、零操作的数据交换。
• 利用握手过程中腕戴设备捕获的运动信号生成密码学强度强的对称密钥。
• 在不依赖云基础设施或额外硬件的前提下，确保对模仿攻击的抗性。
• 设计一种轻量级系统，使其能够在资源受限的智能手表上本地运行，且不会造成过度的电池消耗。

提出的方法

• 在握手过程中，从两台腕戴智能手表的加速度计中捕获同步的运动数据。
• 从两台设备中提取并对齐运动模式，利用相互交握的手部物理刚性确保信号相似性。
• 应用通用的量化与密钥协调技术，在两台设备上生成匹配的 128 位对称密钥。
• 使用生成的对称密钥建立安全的无线通信通道以实现数据交换。
• 在市售智能手表（如三星 Galaxy Watch、Apple Watch）上实现该系统，以确保实际可行性。
• 采用轻量级协议栈，以最小化可穿戴设备上的计算与能耗开销。

实验结果

研究问题

• RQ1 在握手过程中，来自两双手的运动信号是否可用于在独立的智能手表上生成密码学安全且匹配的密钥？
• RQ2 该密钥生成过程对环境噪声和用户特异性运动差异的鲁棒性如何？
• RQ3 该系统在对抗模仿攻击（攻击者试图复制握手模式）方面的抵抗能力如何？
• RQ4 该系统是否能在低功耗、资源受限的智能手表上实时高效运行，且无需外部依赖？

主要发现

• 该系统在握手约 1 秒内成功生成 128 位对称密钥，成功率超过 99%。
• 在实时模仿攻击抵抗测试中，系统仅实现 1.6% 的等错误率（EER），表明其安全性较强。
• 该系统可在市售智能手表上本地高效运行，计算与能耗资源消耗极低。
• 握手过程中两双手的运动模式相似性足够高，可实现跨不同用户的可靠密钥协商。
• 与现有方案相比，该方法在可用性、安全性和效率方面表现更优，尤其避免了对云验证或专用硬件的依赖。