Abstract:Since ancient Greece, handshaking has been commonly practiced between two people as a friendly gesture to express trust and respect, or form a mutual agreement. In this article, we show that such physical contact can be used to bootstrap secure cyber contact between the smart devices worn by users. The key observation is that during handshaking, although belonged to two different users, the two hands involved in the shaking events are often rigidly connected, and therefore exhibit very similar motion patterns. We propose a novel key generation system, which harvests motion data during user handshaking from the wrist-worn smart devices such as smartwatches or fitness bands, and exploits the matching motion patterns to generate symmetric keys on both parties. The generated keys can be then used to establish a secure communication channel for exchanging data between devices. This provides a much more natural and user-friendly alternative for many applications, e.g., exchanging/sharing contact details, friending on social networks, or even making payments, since it doesn't involve extra bespoke hardware, nor require the users to perform pre-defined gestures. We implement the proposed key generation system on off-the-shelf smartwatches, and extensive evaluation shows that it can reliably generate 128-bit symmetric keys just after around is of handshaking (with success rate >99%), and is resilient to different types of attacks including impersonate mimicking attacks, impersonate passive attacks, or eavesdropping attacks. Specifically, for real-time impersonate mimicking attacks, in our experiments, the Equal Error Rate (EER) is only 1.6% on average. We also show that the proposed key generation system can be extremely lightweight and is able to run in-situ on the resource-constrained smartwatches without incurring excessive resource consumption.

Handwaving Authentication: Unlocking Your Smartwatch Through Handwaving Biometrics.

Waving Gesture Analysis for User Authentication in the Mobile Environment

SmartHandwriting: Handwritten Chinese Character Recognition with Smartwatch.

G-PPG: A Gesture-related PPG-based Two-Factor Authentication for Wearable Devices.

User-Authentication on Wearable Devices Based on Punch Gesture Biometrics

Smartwatch User Authentication by Sensing Tapping Rhythms and Using One-Class DBSCAN

WristAuthen: A Dynamic Time Wrapping Approach for User Authentication by Hand-Interaction through Wrist-Worn Devices

Unlocking Smart Phone Through Handwaving Biometrics

WristPass: Secure Wearable Continuous Authentication Via Ultrasonic Sensing

ThumbUp: Identification and Authentication by Smartwatch Using Simple Hand Gestures

Hand-Interactive Behavior Analysis for User Authentication Systems with Wrist-Worn Devices

Securing Cyber-Physical Social Interactions on Wrist-Worn Devices

WristSpy: Snooping Passcodes in Mobile Payment Using Wrist-worn Wearables.

TouchTone: Smartwatch Privacy Protection Via Unobtrusive Finger Touch Gestures

An empirical study of touch-based authentication methods on smartwatches

Shake, Shake, I Know Who You Are: Authentication Through Smart Wearable Devices

PalmEcho: Multimodal Authentication for Smartwatch Via Beating Gestures

It's All in the Touch: Authenticating Users with HOST Gestures on Multi-Touch Screen Devices

A New Two-Factor Authentication Method Leveraging Vibration Feedback from Hand Gestures

Thinking Unveiled

Improving the Security of Smartwatch Payment with Deep Learning