BANDANA — Body area network device-to-device authentication using natural gAit

Abstract

Abstract-Secure spontaneous authentication between devices worn at arbitrary location on the same body is a challenging, yet unsolved problem. We propose BANDANA, the first-ever implicit secure device-to-device authentication scheme for devices worn on the same body. Our approach leverages instantaneous variation in acceleration patterns from gait sequences to extract alwaysfresh secure secrets. It enables secure spontaneous pairing of devices worn on the same body or interacted with. The method is robust against noise in sensor readings and active attackers. We demonstrate the robustness of BANDANA on two gait datasets and discuss the discriminability of intra-and inter-body cases, robustness to statistical bias, as well as possible attack scenarios.

Secure key generation using gait features for Body Sensor Networks

“…3(a), to identify and split repetitive gait cycles in Acc −G . 10Hz is chosen as the cut-off frequency because human motion has no significant effects on frequencies above 10Hz [15]. Assuming N gait cycles are found, the detected gait cycles a = [a 1 , ..., a i , ..., a N ] are then interpolated or decimated to the same length, T , and the average gait cycle a is obtained.…”

“…In addition to the design complexity, the key generation scheme in [13] requires a number of message exchanges during key establishment, which results in more overheads in the channel. Another device-to-device authentication scheme using gait was recently proposed in [15], where gait fingerprint bits are extracted from energy level difference between each gait cycle and the average gait cycle. In a similar work [16], the secret key is generated from a set of extracted features in both time and frequency domains from gait signals.…”

Security Properties of Gait for Mobile Device Pairing

“…Note that, in contrast to exploiting gait for authentication, the existence of a unique and reproducible biometric gait sequence is not required for these approaches. Instead, the protocols exploit instantaneous, correlated acceleration sequences that can not be re-used at different time as the system can be restricted to single attempts [10]. The above described weaknesses for gait as biometric pattern therefore do not apply.…”

“…Gait-based pairing schemes [10] (extended in [11]), [12], [13], [14] (extended in [15] ), [16] share the common goal to protect against Man-in-the-Middle (MitM) attacks, where an attacker actively places herself between devices to modify intercepted communication. In contrast to other schemes such as Bluetooth Secure Simple Pairing (SSP) that typically requires the comparison of PINs, gait is leveraged for automatic MitM protection.…”

Perils of Zero-Interaction Security in the Internet of Things

“…For example, similarity in ambient audio sensed by two colocated devices was successfully used in both ZIP [24] and ZIA [14], with the latter scheme becoming part of a commercial product [11]. Other research explored the applicability of different context information in ZIS schemes: temperature, humidity, pressure, and luminosity [20,28], magnetic fields, acceleration and rotation rates [23,26], as well as observed WiFi and Bluetooth beacons [36].ZIS schemes have three main advantages compared to traditional approaches. First, they offer high usability by minimizing user involvement in pairing and authentication procedures.…”