H2B: Heartbeat-based Secret Key Generation Using Piezo Vibration Sensors

TL;DR

H2B is a power-efficient system that uses piezo vibration sensors to generate shared secret keys from heartbeat signals, enabling secure wearable device pairing despite noisy measurements.

Contribution

This work introduces a novel heartbeat-based key generation method using inexpensive piezo sensors and a compressive sensing reconciliation technique to handle low SNR signals.

Findings

Achieved 95.6% pairing success rate across participants.

Demonstrated robustness against multiple attack types.

Proved power efficiency of the proposed system.

Abstract

We present Heartbeats-2-Bits (H2B), which is a system for securely pairing wearable devices by generating a shared secret key from the skin vibrations caused by heartbeat. This work is motivated by potential power saving opportunity arising from the fact that heartbeat intervals can be detected energy-efficiently using inexpensive and power-efficient piezo sensors, which obviates the need to employ complex heartbeat monitors such as Electrocardiogram or Photoplethysmogram. Indeed, our experiments show that piezo sensors can measure heartbeat intervals on many different body locations including chest, wrist, waist, neck and ankle. Unfortunately, we also discover that the heartbeat interval signal captured by piezo vibration sensors has low Signal-to-Noise Ratio (SNR) because they are not designed as precision heartbeat monitors, which becomes the key challenge for H2B. To overcome this problem, we first apply a quantile function-based quantization method to fully extract the useful entropy from the noisy piezo measurements. We then propose a novel Compressive Sensing-based reconciliation method to correct the high bit mismatch rates between the two independently generated keys caused by low SNR. We prototype H2B using off-the-shelf piezo sensors and evaluate its performance on a dataset collected from different body positions of 23 participants. Our results show that H2B has an overwhelming pairing success rate of 95.6%. We also analyze and demonstrate H2B's robustness against three types of attacks. Finally, our power measurements show that H2B is very power-efficient.

Figures

Tables

Table 1. Table 1. Comparison of entropy and mismatch rate.

Bit	piezo-based IPI		ECG-based IPI (H2H Results)
	Entropy	Mismatch Rate	Entropy	Mismatch Rate
8 (MSB)	0.05	0$\%$	0.27	0.1$\%$
7	0.44	1$\%$	0.80	0.3$\%$
6	0.64	6.9$\%$	0.90	0.4$\%$
5	0.98	14.4$\%$	0.98	0.6$\%$
4	1	32.8$\%$	1	0.9$\%$
3	1	42.8$\%$	1	1.8$\%$
2	1	45.2$\%$	1	3.9$\%$
1 (LSB)	1	49.8$\%$	1	8$\%$

Table 2. Table 2. Symbol notations

Symbol	Meaning
$F(\cdot )$	cumulative distribution function
$I(\cdot )$	quantile function or inverse cumulative distribution function
$\chi$, $X$	original IPI value and its domain (e.g. time)
$T_i$	quantization threshold
$n$	number of quantized IPI values
$H(\cdot )$	entropy function
$N$	signal length of bit vector
$M$	length of compressed key
$Q$	security threshold
$P$	effective threshold
$x$	bit vector (or raw key) after quantization
$y$	compressed key
$\Phi$	compressing matrix
$S$	sparsity, the number of non-zero elements in a vector
$S_{Alice}$	sparsity of key Alice $x_{Alice}$
$S_{\Delta A,B},S_{\Delta A,E}$	sparsity of mismatch vector between Alice and Bob, and between Alice and Eve

Table 3. Table 3. Results of quantization process.

Bit	Entropy	Mismatch Rate
6 (MSB)	0.96	12.9$\%$
5	0.96	12.4$\%$
4	1	19.4$\%$
3	1	35.8$\%$
2	1	34.8$\%$
1 (LSB)	1	43.2$\%$

Table 4. Table 4. NIST Test Results

NIST Test	p-value
Frequency	0.095581
FFT Test	0.046782
Longest Run	0.050684
Linear Complexity	0.985610
Block Frequency	0.208905
Cumulative Sums	0.098443
Approximate Entropy	1
Non overlapping Template	0.018382

Table 5. Table 5. Time and energy consumption of reconciliation.

Device	Time(ms)	Energy(mJ)
Samsung Smartwatch	135	83.8
Google Nexus 4	155	143.2

Table 6. Table 6. Comparison between piezo and ECG sensor.

	Size	Weight	Power	Price
	($m{m}^3$)	(g)	(mW)	(US$)
Piezo Sensor	$25\times 13\times 1$	0.05	0.49	5.6
ECG Sensor	$27.9\times 15.2\times 2.5$	0.13	2.5	55

Equations

$$T_i=I(p)p=(\frac{1}{n},\frac{2}{n},...,1)$$

$$y=\Phi x.$$

$$\hat{x}=\arg \underset{x}{\min }\Vert x{\Vert }_1\text{ subject to }\Vert y-\Phi x{\Vert }_2<ϵ,$$

$$\widehat{\Delta x_{A,B}}=\arg \underset{\Delta x_{A,B}}{\min }\Vert \Delta x_{A,B}{\Vert }_{1}s.t.\Vert \Delta y_{A,B}\oplus \Phi \Delta x_{A,B}{\Vert }_2<ϵ.$$

$$P<M<Q$$

Full text

Symmetric key generation, piezo vibration sensor, compressive sensing, heartbeat signal, interpulse interval

††journalyear: 2019††copyright: othergov††conference: The 18th International Conference on Information Processing in Sensor Networks (co-located with CPS-IoT Week 2019); April 16–18, 2019; Montreal, QC, Canada††booktitle: The 18th International Conference on Information Processing in Sensor Networks (co-located with CPS-IoT Week 2019) (IPSN ’19), April 16–18, 2019, Montreal, QC, Canada††price: 15.00††doi: 10.1145/3302506.3310406††isbn: 978-1-4503-6284-9/19/04††ccs: Security and privacy Security protocols††ccs: Human-centered computing Ubiquitous and mobile computing††ccs: Computer systems organization Embedded and cyber-physical systems

1. Introduction

With recent advances in wireless sensor networks and embedded computing technologies, the popularity of wearable devices, such as FitBit and Apple Watch, is skyrocketing. A recent survey (Seneviratne et al., 2017) shows that the wearable market is beaming with hundreds of different types of products including smart glasses, smart jewelery, electronic garments, smart shoes, skin patches, and even implanted medical devices (IMDs). We are heading to a future where users are expected to have more than one wearable device continuously monitoring their bodies and providing advanced health and other services (Hiremath et al., 2014).

In such multi-wearable scenario, wearable devices may deal with private sensory information for a range of tasks, such as data aggregation, sensing coordination, data relaying (from body to cloud). To protect private information, body area networks (BAN) usually rely on symmetric cryptographic keys for secure communication. Traditional key distribution approaches that require pre-deployment in the network initialization stage are not scalable with growing number of wearables. Exploiting biometrics such as gait (e.g, Walkie-Talkie (Xu et al., 2016) and BANDANA (Schürmann et al., 2017)), Electromyogram (e.g, EMG-KEY (Yang et al., 2016)), and ECG (e.g., Heart-to-Heart (Rostami et al., 2013)) as shared key sources has became a hot research field because biometrics is inherent, unique and hard to obtain or spoof.

In this paper, we explore and demonstrate the feasibility of using piezo sensors to detect heartbeat signal. We show that the minor vibrations caused by heartbeats can be detected on multiple body locations such as chest, wrist, waist, neck and ankle. Followed by that, we design and implement a key generation system, H2B, that can exploit the detected heartbeat to generate the same keys for two wearable devices on different body locations of the same user.

1.1. Motivations

Why heartbeats? Although various kinds of biometrics such as gait and Electromyogram (EMG) have been explored to pair devices, there exist some limitations. First, although gait-based authentication/key generation systems have been extensively studied (Xu et al., 2016; Schürmann et al., 2017; Xu et al., 2017), most existing work validate their systems on a limited dataset. It is still not clear whether gait-based methods apply to large-scale population. In contrast, authors of (Obrist, 2012; Rostami et al., 2013; Cherukuri et al., 2003) have shown that inter-pulse interval (IPI), i.e., the interval between two peaks in heartbeat signal, is highly random and can be used as a random source to generate keys.

In addition, some systems pose extra burden on the user. For example, gait-based methods require users to walk for a while to generate keys. EMG-based methods require the users to perform a gesture such as clenching the fist as a part of the pairing process. In comparison, heartbeat signal is spontaneous and thus can be measured at anytime and in anywhere.

Why piezo sensors? In current wearable devices, IPI readings are usually sampled by Electrocardiogram (ECG) or Photoplethysmogram (PPG) sensors. Meanwhile, studies also show that heartbeat signal can be measured by accelerometers in the smartphone and used to extract IPI (Wang et al., 2018; Ramos-Castro et al., 2012). Unfortunately, the accelerometer-based methods can measure seismocardiogram (SCG) only, which is chest movement in response to the heartbeat, and fail to detect heartbeats in other locations such as wrist. Furthermore, another advantage of piezo vibration sensor over ECG biosensor and accelerometer is its cost-efficiency and energy-efficiency, which makes it more suitable for resource-constrained wearable devices.

Although most current wearable devices are not fitted with piezo sensors, we have observed an increasing number of commercial products equipped with piezoelectric energy harvesters (PEHs) such as AMPY (AMPY, 2018), SOLEPOWER (SOLEPOWER, 2018), and KINERGIZER (KINERGIZER, 2018) to reduce dependency on batteries. Recent work has demonstrated that AC voltage generated by PEH can be effectively used for sensing and analyzing body vibrations (Khalifa et al., 2018). Additionally, researchers are considering using wearable piezo sensors to monitor biometrics such as respiration (Jeong et al., 2009). Therefore, we can expect that the PEH or piezo sensors will be embedded in wearable devices to enable more applications in the future.

An inherent problem with biometrics is that the measurement is never perfect (Cherukuri et al., 2003). Parallel measurements of the same source by multiple sensors at the same time differ from each other, though they maintain a certain proximity. Unlike ECG sensors or accelerometers, piezo sensors are not inherently designed for precise motion detection. Therefore, the IPI measured by the piezo sensors contains significant noise which becomes the key challenge for designing a system that requires 100% bit match between the keys generated by two devices independently. The low SNR poses two challenges. Firstly, as the measurements contain significant random noise, the amount of entropy in them, which is critically important for the quality of the keys, will be reduced significantly. Secondly, the noisy measurements lead to significant number of bit mismatches between the two keys. The mismatches will either cause key generation failure or increase the time required to generate matching keys, which in turn decreases user experience.

To this end, we apply a quantile function-based quantization method to fully extract useful entropy, and propose a novel Compressive Sensing (CS)-based reconciliation method to correct mismatches in quantized bits. To the best of our knowledge, this is the first work that explores and demonstrates the feasibility of using piezo vibration sensors to detect heartbeat signal and use the signal to generate keys.

The contributions of this work can be summarized as follows:

• •

We conduct the first study to experimentally analyze the potential of piezo-based IPIs. Our result shows that piezo-based IPIs have smaller entropy and higher mismatch rate than those measured by ECG. As a result, the shared key generation using the piezo-based IPIs takes longer time and has a lower success rate. [Section 2]

• •

We propose H2B, a symmetric key generation system exploiting IPIs captured by polyvinylidene difluoride (PVDF) piezo sensor. We apply a quantile function-based quantization to fully extract the entropy and propose a novel CS-based reconciliation to overcome the high level of variation inherent in the piezo sensor’s measurements.[Section 4]

• •

We provide a proof of concept implementation of H2B using off-the-shelf piezo sensors and evaluate H2B with 23 participants. Our results show that: 1. Quantile function-based quantization can extract $2.9$ bits entropy from each IPI while a naive Gray-coded representation can extract $1$ bit only; 2. CS-based reconciliation significantly improves the $128$-bit key generation success rate from a low $34.2\%$ to a $95.6\%$ compared to traditional error correction methods. [Section 5.1]

• •

We conduct comprehensive attack analysis to show that H2B is highly robust against typical attacks.[Section 5.7]

• •

Finally, we demonstrate that H2B is very power-efficient for sampling IPI and generating symmetric keys.[Section 5.8]

2. Feasibility Study

2.1. ECG

Figure 1(a) depicts two typical ECG waveforms of a healthy person. A heartbeat cycle in ECG is characterized by the combination of three graphical deflections (Q, R and S waves), which is also known as QRS complex. The R-peak is the most crucial feature of an ECG waveform as it corresponds to the ”beat” in a heartbeat. The time interval between two consecutive R-peaks is referred to inter-pulse interval (IPI).

The principle of using piezo vibration sensors to detect IPIs can be explained as follows. On the chest and waist, the heart contraction will cause regular vibrations in the chest which is called seismocardiogram (SCG). Such vibrations can be detected by the piezo vibration sensor attached to the chest and waist as shown in Figure 1(b). After each heartbeat, the blood is ejected from the heart into arteries all over the body. In order to accommodate the blood, the arteries need to expand and recoil regularly which produce ballistocardiogram (BCG) signal (Dart and Kingwell, 2001). The expansion and recoiling effect, also known as the blood pressure pulse, can be measured on skin near arteries (e.g. the radial artery in the wrist). Therefore, if we attach a piezo sensor near the artery in other locations (e.g., wrist), we can extract IPI information from the measurements as shown in Figure 1(c).

From Figure 1, we also find that the curves of heartbeat cycle measured from different body locations do not follow the same pattern as typical QRS complex. Nevertheless, we can apply a local peak point (either maximum or minimum) to represent each heartbeat and further extract IPIs. Then there is a question: How accurate is the IPI measured by a piezo sensor? To this end, we compare the measurement precision of a piezo sensor with a commercial heart rate monitor device Polar H10111https://www.polar.com/au-en/products/accessories/h10_heart_rate_sensor as the ground-truth. Our results from 23 participants show that the RMSE of IPIs measured by piezo sensors is 6ms only (dataset is explained in Section 5.2). Figure 2 plots a series of IPI measured by the piezo sensor and the ECG biosensor (i.e., Polar H10) respectively. We can see that piezo-based IPIs are very close to those measured by the ECG biosensor.

Based on the analysis above, it is feasible to use piezo sensors to measure accurate IPIs. However, there still exist two problems. Firstly, the IPIs measured form different body locations are slightly different. For example, the IPI measured in Figure 1(c) (wrist) is slightly longer than that in Figure 1(b) (chest). Secondly, the IPIs measured by the piezo sensors has some small deviations as can be seen from Figure 2. These two problems will lead to the low entropy in the signals and high mismatch rate between the two keys, which we will discuss next.

2.2. Piezo-based IPI as Secret Source

The secret source for symmetric key based secure communication protocols must satisfy randomness and proximity conditions (Cherukuri et al., 2003). Firstly, for security purpose, the generated key must be cryptographically random, or independently and identically distributed (i.i.d.). Secondly, for usability purpose, the final keys generated from the same source independently by two legitimate parties (i.e., Alice and Bob) must agree. In terms of randomness, IPI is random according to the features of heart rate variability (Oweis and Al-Tabbaa, 2014). Furthermore, previous studies (Xu et al., 2011; Rostami et al., 2013) on PhysioBank222https://physionet.org/physiobank/ database have demonstrated that IPI can be used to extract random keys. In terms of proximity, IPI measured from different locations are close to each other because, intuitively, they measure the same heartbeat signal. Therefore, IPI measured by piezo sensors at least contains a certain amount of information that satisfies both randomness and proximity conditions.

To this end, we benchmark piezo-based IPIs against ECG-based IPIs to show the potential of piezo-based IPIs as a secret source. We built several prototype wearable devices and collected a preliminary dataset. We use Heart2Heart (H2H) (Rostami et al., 2013), which is a state-of-the-art ECG-based system, as a baseline and follow its quantization process, which uses the Gray-code representation of raw IPI values.

We use entropy and mismatch rate as the evaluation metrics. The entropy denotes information contains in each bit. To satisfy the randomness condition, the entropy for each extracted bit must be sufficiently high. We empirically select an entropy threshold of 0.95 to determine valid bits. The mismatch rate is the probability of mismatched bits over all quantization bits produced from the IPI measurements captured by Alice and Bob respectively. To satisfy the proximity condition, the mismatch rate must be sufficiently small. We empirically select an mismatch rate threshold of $20\%$ as the proximity condition. Table 1 shows the entropy and the mismatch rate of Gray-coded bits of piezo-based and ECG-based IPI respectively. In terms of the entropy, both piezo-based IPI and ECG-based IPI have 5 high-entropy bits (Bit 1-5) that can be used as valid keys by satisfying the randomness condition of $\geq 95\%$ entropy per bit. In terms of the mismatch rate, however, bits generated from the piezo-based IPI have much higher mismatch rates than those of the ECG-based IPI. For example, the mismatch rate of Bit 4 is $32.8\%$ for the piezo-based IPI while the same bit extracted its ECG-based counterpart has $0.9\%$ mismatch rate only. Therefore, if we adopt the method in (Rostami et al., 2013) directly, we have to discard 4 least significant bits and keep Bit 5 only to satisfy the proximity condition with an mismatch rate of $\leq 20\%$. The result highlights that piezo-based IPIs as a secret source has a very significantly lower SNR compared to ECG, thus faces the challenges of significantly lower entropy and higher bit mismatch rate.

3. System Model

3.1. Trust Model

We envision the usage of H2B primarily for wearable devices that have close contact with user’s body as these devices can detect and measure user’s heartbeat pulses and further use them to establish common cryptographic keys for secure communications. For example, as shown in Figure 3, a user (Joe) gets up from bed and wears a smart wristband (Alice) on his wrist. He wishes to read some information from his pacemaker (Bob) which is inside his chest. Therefore, Joe launches H2B APP in the wristband, and after a short while Alice and Bob automatically establish a secret key by measuring Joe’s IPI. Finally, Bob transfers private data to Alice via the established secure channel protected by the common secret key. In a mobile environment, the demand for this type of temporal association is increasing. Therefore, H2B is well suited for frequent and short-lived data exchange between wearable devices. Moreover, it provides an unobtrusive, friendly, spontaneous key generation approach for users.

Same as previous biometrics-based key generation systems (Xu et al., 2016; Rostami et al., 2013), we assume that all on-body devices that can measure the heartbeat signals of a user are trustworthy. As discussed in (Mayrhofer and Gellersen, 2009), an attacker can neither control the vibration recorded locally by these devices nor perfectly estimate it; otherwise the protection of legitimate devices is impossible. The user is assumed to be capable of detecting such attacks if an attacker tries to modify the on-body devices or place an adversary device on her. In fact, there are a number of approaches to protect such attacks. For example, in order to make sure the devices have not been modified, the device manufacturers may apply tamper-resistant techniques (Ravi et al., 2004). ARM TrustZone extension may also be used to ensure the integrity of the sensors (Guan et al., 2016; Liu et al., 2012).

3.2. Adversary Model

We assume the presence of a strong attacker Eve during the key generation process of H2B. Eve has full knowledge of the system and control of the communication channel, i.e., she may monitor, jam, and modify messages at will. The detection of jamming attacks is out of the scope of this paper as jamming attacks have been extensively studied and we may adopt the methods in (Osanaiye et al., 2018; Xu et al., 2005). Compromising integrity such as modifying messages can be prevented by implementing Message authentication code (MAC) in transmitted messages. Apart from these attacks, there are three types of attacks particularly targeting H2B that may be used by Eve to recover the secret key: passive eavesdropping attacks, active presentation attacks and active video magnification attacks.

1. (1)

Passive eavesdropping attacks. A passive attacker understands the key generation mechanism and may monitor the communication between Alice and Bob. By eavesdropping the public components of key generation, Eve tries to generate a key based on her own heartbeat information and use this key to pair with one or both of the legitimate devices. In order to counter this type of attacks, H2B needs to make sure the extracted keys that are distinctive among different users. 2. (2)

Active presentation attacks. A presentation attacker may access historical IPI data of a user. Eve attempts to pair with legitimate devices by submitting key generated from historical data. In order to counter this type of attacks, the keys generated by H2B need to provide forward secrecy. 3. (3)

Active video attacks. A recent work presented a video-based head pulse motion detection method (Balakrishnan et al., 2013), which is able to detect heartbeat signals by magnifying subtle head motion caused by the influx of blood at each heartbeat. Therefore, an active video attacker may observe and film the head of a user, and use this method to extract IPIs to generate the same key as that produced by a legitimate device. Active video attacks may be considered as one form of side-channel attacks.

We will provide a more detailed discussion on the robustness of H2B against these attacks in Section 5.7.

4. Protocol Design

As shown in Figure 3, the protocol comprises of three stages: IPI extraction, quantization, and reconciliation. In the IPI extraction stage, we collect heart beat signal via piezo sensors and extract a series of consecutive IPIs. In quantization stage, the IPIs are quantized into bit vectors. IPI extraction and quantization stages are executed by Alice and Bob independently. Due to the measurement noise, there are usually mismatches in the quantized bits between the bit vectors produced by Alice and Bob respectively. Therefore, in the reconciliation stage Alice and Bob exchange a certain amount of information to correct all mismatches and generate a bit-for-bit matching key. Before we discuss the three stages of H2B in details, we summarize the mathematical symbol notations used in this paper in Table 2.

4.1. IPI Extraction

As discussed earlier in Section 2.1, although piezo sensors at different locations can capture heartbeat signal simultaneously, the measurements do not perfectly match and contain significant noise. To accurately extract IPI values, we first apply a Savitzky-Golay (SG) filter on the raw signal to reduce the impact of noise, which can smooth the original curves without changing the peak locations in the curves. Then, we locate each heartbeat using a local peak detection algorithm. IPI values can be finally computed from the time difference of consecutive heartbeats.

Synchronization is required to ensure all legitimate devices capture IPIs at the same time. In H2B, the synchronization of Alice and Bob is achieved using a time-slotted channel hopping-based (TSCH) (Group et al., 2011) time synchronization mechanism333Other time synchronization methods such as Cheepsync (Sridhar et al., 2016) may also be used.. With TSCH, the timers in the devices are synchronized when they join a network.

4.2. Quantization

A common method of converting IPIs into bits is directly using the Gray-code representation of IPI values (Rostami et al., 2013; Bao et al., 2008). However, as discussed in (Xu et al., 2011), the keys generated from such method are actually not random because IPI values fluctuates around the average value and follow a normal distribution. Therefore, attackers may perform statistical analysis and gain significant amount of knowledge about the key. For example, since the average of IPIs is 850ms, let us assume the first IPI value is 840ms and thus its corresponding Gray code is ”1011101100”. If the second IPI value is 860ms, its corresponding Gray code is ”1011110010”. We can see the the first 5 digits of the two produced Gray codes are exactly the same. Therefore, the randomness lies only in the lower digits. To address this problem and fully exploit the potential of keying material, we first convert the IPI readings into a dataset that follows a uniform distribution. Then the converted IPI values are quantized into bits using Gray code representation. Since the data used to generate the final key follow a uniform distribution instead of a normal distribution, all bits in the extracted keys have high entropy.

In details, we start at converting the raw IPI readings which follow a normal distribution into a dataset that follows uniform distribution. We use a quantile function approach similar to (Xu et al., 2011). Specifically, we segment the normal distribution into a set of $n$ discrete values with an equal probability $\frac{1}{n}$. Suppose we measure a series of IPI readings $X=\{\chi_{1},\chi_{2},\cdots,\chi_{N}\}$. The cumulative distribution function (CDF) of these readings is $F(\chi)$. The function $F(\chi)$ gives us the probability $p$ that $\chi$ will take a value $\leq\chi$. Instead, the quantile function which is defined as $I(p)=inf\{\chi\in\mathbb{R}:p\leq F(\chi)\}$ does the opposite: it produces a threshold value $\chi$ below which the random draws from $\chi$ will fall into $p$ percent of the time. Therefore, we can simply obtain the thresholds by choosing $p=(\frac{1}{n},\frac{2}{n},...,1)$ as follows:

[TABLE]

where $T_{i}$ is the $i$-th threshold. The design of quantization now becomes finding a proper $n$. As the extracted keys cannot exceed the theoretic entropy in the source, the number of quantized IPI values is thereby determined by the total entropy of the original IPI values. Therefore, we choose $n=2^{\lfloor H(X)\rfloor}$ where $H(X)$ is the entropy of IPI values and $\lfloor H(X)\rfloor$ is the maximum integer smaller than $H(x)$.

After finding the thresholds, the original IPI values falling into the $i$-th segmentation are quantized into $i-1$. For example, the IPI values falling into the first segmentation are quantized into 0, and the IPI values falling into the last segmentation are quantized into $n-1$. In order to distinguish IPI values before and after quantization, we term the IPI values after quantization as quantized IPIs. Figure 4 illustrates this process. Figure 4(a) shows that the original IPI values follow a normal distribution similar as (Xu et al., 2011). After quantization, the quantized IPIs roughly follow a uniform distribution as shown in Figure 4(b). The mismatches are caused by the noise.

Finally, we use Gray code to encode the quantized IPI values. After this step, each IPI value is represented by a bit strings containing ‘0’ and ‘1’. Then, all the bit strings generated from collected IPIs are concatenated to form an initial key $x_{Alice}$ and $x_{Bob}$, which are generated on two devices independently.

Here we briefly illustrate the advantage of this quantization process. We apply the above quantization process on the same data used in Section  2.2 and plot the results in Table 3. Compared to the results in Table 1, though our method can generate 6 bits per IPI only, we find that the first 3 most significant bits (i.e.m Bits 4, 5, 6) have high entropy and low mismatch rates. The result suggests that our method improves key generation rate by 3 times because a naive Gray code representation can only generate 1 bit with high entropy (Bit 5) based on the analysis in Section  2.2. However, quantization does not remove the random noise of original IPI values completely. From Table 3, we can see random noise still cluster in least significant bits (Bit 1-3) after quantization and causes high mismatch rates. Therefore, H2B discards the least 3 bits and keep Bits 4 to 6 only. In other words, H2B extracts 3 bits per IPI. In next section, we will address the challenge of the mismatches (between 10% and 20%) in Bits 4 to 6.

4.3. Reconciliation

4.3.1. Principles of Compressive Sensing

Before we introduce the CS-based reconciliation method to correct mismatches, we first review the principles of CS briefly. CS is an information theory (Wang et al., 2010; Baraniuk, 2007) that proposes a method to recover a high dimension sparse signal from a small number of (i.e., low dimension) measurements. Let $x\in\mathbb{R}^{N}$ be an unknown data vector, $y\in\mathbb{R}^{M}$ be a measurement vector, and $\Phi\in\mathbb{R}^{M\times N}$ be a projection matrix from a higher dimension ($N$) to a lower dimension ($M$), where $M<<N$. Here, both vector $y$ and matrix $\Phi$ are given, and the unknown vector $x$ needs to be determined. We can then write the problem in a linear form as:

[TABLE]

Since $M<N$, Eq. (2) is under-determined, and is impossible to be solved in a general form.

CS imposes the requirement that data vector $x$ is sparse; namely, most of the elements in $x$ are zeros. Let $S$ denote the number of non-zeros in $x$, then $x$ is sparse if $S<<N$. $S$ in CS is termed as sparsity. CS theory states that we can recover data vector $x$ with an overwhelming probability by solving the following $\ell_{1}$ minimization problem:

[TABLE]

where $\epsilon$ is noise and provided Conditions C1 and C2 as follows.

• •

C1. $\Phi$ must obey the restricted isometry property (RIP). For example, $\Phi$ satisfies RIP if each element in $\Phi$ is $\pm 1$ with equal probability, i.e., symmetric Bernoulli distribution.

• •

C2. $M>S*log(N/S)$.

Note that C2 is a sufficient condition, and Wang et. al show that the necessary condition is (Wang et al., 2010):

• •

C3. $M>S$.

A symmetric key secure communication protocol requires a bit-for-bit equal key for Alice and Bob. After quantization, Alice and Bob generate the bit vectors ($x_{Alice},x_{Bob}\in\mathbb{Z}_{2}^{N}$) respectively. However, we usually have $x_{Alice}\approx~{}x_{Bob}$ in practice (see Table 3). In the context of information reconciliation, our intuition is that the mismatched vector between two keys $x_{Alice}$ and $x_{Bob}$ is sparse as they are very close to each other (e.g., $\leq 20\%$ for Bits 4 to 6 in Table 3), therefore can be recovered from Eq. (3) efficiently.

4.3.2. Information Reconciliation Protocol with Compressive Sensing

Figure 5 illustrates the flowchart of proposed information reconciliation protocol. The roles of Alice and Bob are interchangeable. The proposed method is inspired by the application of CS in error correction (Fu et al., 2013), but our approach is based on different assumption (i.e., the mismatched vector is sparse) and is therefore different. In fact, the proposed method may be applied in all kinds of symmetric key generation system for information reconciliation.

Firstly, Alice and Bob derive their own key candidate vectors $x_{Alice}$ and $x_{Bob}$ from local observation independently. Secondly, they project the vectors to lower dimension spaces (i.e., from $N$ to $M$, where $N>>M$), with Eq. (2) respectively, namely $y_{Alice}=\Phi x_{Alice}$ and $y_{Bob}=\Phi x_{Bob}$, where $\Phi$ is a known key generation protocol parameter (i.e., a known Bernoulli matrix consisting of $\pm 1$ with equal probability). Thirdly, Alice transmits $y_{Alice}$ to Bob via an unauthenticated channel. On receiving $y_{Alice}$, Bob calculates the mismatched vector $\Delta y_{A,B}=y_{Alice}-y_{Bob}$ in a lower dimension space. According to the proximity condition in Section 2.2, the mismatched vector in a higher dimension space $\Delta x_{A,B}=x_{Alice}\oplus x_{Bob}$ will have less than $20\%$ non-zero elements only (sparse!), i.e., a small $S_{\Delta A,B}$. Furthermore, if project matrix $\Phi$ satisfies Conditions C1 and C2 in Section 4.3.1, $\Delta x_{A,B}$ can be recovered using Eq. (3) as:

[TABLE]

Finally, with $\Delta x_{A,B}$, Bob can correct mismatched bits by deriving a new key $x^{\prime}_{Bob}=x_{Bob}\oplus\Delta x_{A,B}$, and $x^{\prime}_{Bob}=x_{Alice}$.

As the compressed key $y_{Alice}$ is transmitted via a public channel, Eve may eavesdrop it. Therefore, there are two obvious potential vulnerabilities of this reconciliation protocol.

Vulnerability 1: Eve may reconstruct $x_{Alice}$ from $y_{Alice}$ directly using Eq.(3).

Vulnerability 2: Eve may perform the three types of attacks discussed in Section 3.2 to obtain IPI values. Then she can use them to derive her own key, i.e., $y_{Eve}$, to calculate $\Delta y_{A,E}=y_{Alice}-y_{Eve}$, where $y_{Eve}=\Phi x_{Eve}$. Therefore, she may recover $\Delta x_{A,E}$ with Eq. (4) by replacing $\Delta x_{A,B}$ and $y_{A,B}$ with $\Delta x_{A,E}$ and $y_{A,E}$ respectively, and obtain $x_{Alice}$.

The extreme case to consider a binary vector as a non-sparse vector is that it has exactly 50% ones and 50% zeros. Figure 6 shows that $x_{Alice}$ usually contains approximately 50% ones and 50% zeros after quantization, which implies that $x_{Alice}$ is not sparse. It is extremely hard for a potential attacker to exploit Vulnerability 1. On the other hand, the success rate to exploit Vulnerability 2 depends on how Eve can approximate inherent IPI without the contact of user’s body. In Section 3.2, we assume Eve can perform three types of attacks.

We now quantitatively demonstrate that these two vulnerabilities can be addressed by properly choosing the value of parameter $M$. Let us define $P=S_{\Delta A,B}*log(N/S_{\Delta A,B})$ and $Q=min(S_{Alice},S_{\Delta A,E})$, respectively. We have:

Corollary 1.

The CS-based reconciliation method is perfectly effective (i.e., Bob can recover $\Delta x_{A,B}$ and $x_{Alice}$ successfully) and secure (i.e., Eve is unable to recover $\Delta x_{A,E}$ and $x_{Alice}$ successfully) if**

[TABLE]

Proof: If Bob cannot recover $\Delta x_{A,B}$ and $x_{Alice}$ with a $\Phi$ that satisfies Condition C1 and $M>P$, it is contradictory to Condition C2, which defines the sufficient condition for successful CS decoding with $\ell_{1}$ minimization. If Eve can recover $\Delta x_{A,E}$ and $x_{Alice}$ with $M<Q$, it is contradictory to Condition C3, which defines the necessary condition for successful CS decoding with $\ell_{1}$ minimization for both Vulnerabilities 1 and 2 because $Q$ is the minimum of $S_{Alice}$, $S_{\Delta A,E}$, which are the necessary conditions for successful $x_{Alice}$ recoveries in Vulnerabilities 1 and 2 respectively.

The design for an effective and secure CS-based reconciliation becomes a problem to find a suitable $M$. The upper bound $Q$ is the secure threshold and the lower bound $P$ is the effective threshold. These two thresholds are determined by the population of mismatches among legitimate devices and attackers. Assume that H2B aims to generate a $128$-bit key, i.e., $N=128$. Figure 7 shows the distribution of $P$ and $Q$ in our dataset introduced in Section 5.2. While we cannot find an optimal value of $M$ that satisfies Corollary 1, we deliberatively selected a small $M$ value of 50 so that $M<Q$ to cover Vulnerabilities 1 and 2. However, there exists a small chance ($4.8\%$) that $M\leq P$, implying that there is $4.8\%$ possibility that the proposed CS-based reconciliation fails to correct all mismatches between $x_{Alice}$ and $x_{Bob}$. Note that we just consider two possible vulnerabilities and three types of attacks. Corollary 1 and the condition $M<Q$ aim to protect two defined vulnerabilities only.

As the attacker Eve has the full control of the public communication channel, she may modify $y_{Alice}$ in the reconciliation step. To maintain message integrity, a message authentication code (MAC) method is implemented to verify the message  (Bellare et al., 1996). Here, H2B codes $y_{Alice}$ to $L_{Alice}=\{y_{Alice},MAC(x_{Alice},y_{Alice})\}$, by treating $x_{Alice}$ as the shared secret. On receiving $L_{Alice}$, Bob can obtain $x_{Alice}$ as discussed above and also protect the integrity and the authenticity of the message via the MAC method. If the message is modified, the derived $x^{\prime}_{Bob}$ will be different from $x_{Alice}$ so that Bob cannot produce the correct $L_{Alice}$. The message is thereby discarded. The MAC method also allows Bob to examine the reconciliation results. As shown in Figure 5, Bob will notify Alice for the final result to determine whether the key generation is successful. Finally, we apply SHA2-256 hashing algorithm on the successfully generated key to further amplify privacy.

5. Evaluation

5.1. Prototype Device

Among known piezoelectric sensors, PVDF piezopolymer is usually used in low-frequency applications (Wang et al., 2011; Chiu et al., 2013). Therefore, we build the prototype of H2B using off-the-shelf PVDF piezopolymer sensors ($25\times 13\times 1mm^{3}$, US5.6, see Figure [8](#S5.F8)), produced by TE Connectivity444Piezo sensor LDT0-028K: http://www.te.com/global-en/product-CAT-PFS0006.html. The sensor features 180$Hz resonant frequency and$50$mV/g baseline sensitivity. The data logger used is the SensorTag produced by Texas Instruments555SensorTag: http://www.ti.com/ww/en/wireless_connectivity/sensortag2015 /index.html. Piezo sensors are sampled by the on-board$12$-bit Analog-to-Digital (ADC), and all data samples are stored on the onboard flash memory.

5.2. Data Collection

We collect a dataset using the designed prototype device666Ethical approval has been granted by the corresponding organization (Approval Number HC17008). The dataset consists of 23 healthy subjects (7 females and 16 males) aged from 24 to 40 with different skin tones. During data collection, we attach 5 prototype devices on the participant’s neck, chest, wrist, waist and ankle respectively as shown in Figure 8. The participants are asked to stand static, though we find that other still activities such as sitting and lying does not affect the performance. However, H2B does not apply to activities involving large body movements such as walking and running, and We will discuss this limitation in Section 6 later. Each experiment lasts for 5 minutes and the sampling rate is 400Hz.

5.3. Impact of Sampling Rate

We find that the sampling rate will affect how much entropy that can be extracted from measured IPI values. This is because the sampling rate determines the precision of measurement: the higher the sampling rate is, the more accurate the measured IPI is, so is noise. Therefore, the measurements will have more entropy with the increase of sampling rates. The measurements contain two parts: useful IPI (used to generate keys) and noise. As the entropy is a physical feature of a source, it has an upper limit. Although the entropy of measurements increases as sampling rate increases, the entropy of the generated key will not increase after it reaches a maximum value. In other words, there exist a threshold for sampling rate over which the entropy of the generated keys will not improve. To investigate this threshold, we downsample the dataset from 400Hz to 40Hz to find out how much entropy can be extracted for different sampling rate.

Figure 9 illustrates the impact of sampling rate on entropy. We can see that the entropy of measurements is positively related to the sampling rate as expected. After we separate the entropy of generated keys and that of random noise, we find that the entropy of generated keys reaches an upper limit (2.9 bits) and do not increase further. The results suggest that even if we increase sampling rates, the entropy of the generated keys will not increase. Therefore, we set sampling rate to 120Hz in H2B to save energy for resource-constrained wearable devices. In subsequential experiments and evaluation sections, we downsample the raw dataset from 400Hz to 120Hz to examine the performance at the desired sampling rate.

5.4. CS-based Reconciliation v.s. ECC

We benchmark the performance of the proposed CS-based reconciliation method against the state-of-the-art Error Correction Code (ECC)-based reconciliation (Mathur et al., 2011; Yang et al., 2016; Xu et al., 2016) using the collected dataset. Among various ECC methods, we select (15,3) Reed-Solomon (RS) code as it shows better performance in key reconciliation process than others as described in (Xu et al., 2016).

The major performance metric for symmetric key generation system is the probability that two keys generated by Alice and Bob can completely agree with each other. The probability of $100\%$ matching, or noted as success rate, is an important metric because only 1 bit mismatching can cause protocol failure. As a result, the key generation process has to re-start which results in prolonged delays, user dissatisfaction and extra device energy consumption.

As most current cryptographic systems require key length of 128 bits, we compare the success rate of CS-based reconciliation and ECC-based reconciliation to generate 128-bit keys. Evaluation results shows that the success rate of CS-based reconciliation approach is $95.6\%$ while RS(15,3) achieves $34.2\%$ success rate only. The poor performance of ECC-based reconciliation approach on this dataset is due to the high mismatched rates after quantization process that exceed the correction ability of ECC.

5.5. Impact of Different Body Locations

We examine the success rates of H2B for the devices on five different body locations: chest, neck, wrist, waist, and ankle, and Figure 10 shows the success rates on all pairing combinations. The highest success rate is $100\%$ when pairing a device on chest with another on waist because the chest and the waist are close to each other, and both piezo sensors on these two locations measure SCG signal. We also find that all pairing attempts with the device on the ankle result in success rates that are lower than $95\%$ (though larger than 90%). This is because ankle is the farthest location from the heart and there is a tiny delay when heartbeat signal is propagated from the chest (heart) to the ankle as shown in Figure 11.

5.6. Randomness of Keys

To validate the randomness of H2B keys, we apply the NIST statistical test (Rukhin et al., 2001) to the generated keys after quantization. P-values in Table 5 represent the probability that the dataset are generated from a random process. If a p-value is less than a threshold (usually 1% or 5%), the randomness hypothesis is rejected. Table 5 shows that all NIST tests have p-values larger than 1%. However, as a truly random source would have p-values from NIST tests uniform on [0,1] as described in (Rukhin et al., 2001), future work could provide more evidence on whether or not H2B keys truly meet the randomness condition.

5.7. Resiliency against Attacks

As discussed in Section 3.2, we model three types of attacks, by which Eve tries to derive a key. Here, we analyze the security of H2B against these attacks. The metric used in this section is the average bit agreement rate, which is different from success rate in previous evaluation. Bit agreement rate is the portion of matching bits over all bits in a key. A successful key generation process needs to produce a symmetric key with $100\%$ agreement rate.

5.7.1. Passive Attack

In an passive attack, Eve attempts to pair her device with the legitimate devices on a user by using her own heartbeat data. We simulate this scenario by pairing devices from the same body location but different users. For example, we pair the device on chest of subject 1 to the devices on the chest of other subjects to see if they can generate the same key. The results of passive attack is shown in Figure 12. We can see that passive attack can at most achieve $70\%$ agreement rate. Therefore, different users produce distinguishable heartbeat signals and H2B utilizes this characteristic to generate different keys.

5.7.2. Active Presentation Attack

In presentation attacks, we assume Eve can access the historical IPI data of a user and use these data to pair with the legitimate devices of the user in current time. To simulate this scenario, we segment the data of each user into two equal parts. The first half part is used as historical data to pair the second half part of the same user. The results in Figure 12 show that presentation attacks can achieve slightly higher agreement rate than passive attacks because the data are form the same user. However, it can at most achieve $75\%$ agreement rate which in turn demonstrates the randomness of IPI over time and hence the security of H2B against this type of attacks.

5.7.3. Active Video Attack

Recently Wu et. al. (Wu et al., 2012) developed a video magnification procedure that is capable of revealing bio-signals from a video footage of a person. The video is decomposed spatially and temporally to amplify variations occurring within a specified frequency (e.g., heart beating frequency range in our context). The technique has been employed in many applications including adult and infant heart beating tracking(Wu et al., 2012; He et al., 2014). We assume that an attacker Eve can film a video of user’s face and apply such technique to extract IPI data. She then use the extracted IPI data to launch an active attack attempt.

To simulate this attack, we ask a user to directly face a video camera situated at a very close distance to produce the best IPI results, which is an unfair advantage given to Eve deliberately. A video of the user’s face is analyzed using Eulerian Video Magnification (Wu et al., 2012) to extract the heart beating details as shown in Figure 13. The video frame rate is set to $30$ and $120$ fps respectively and the region of interest (ROI) is set to part of the user’s forehead. Due to the presence of noise in the video, the amplification is implemented by using a narrow band filter $0.5$ - $1.4$ Hz as recommended in (Wu et al., 2012), and the magnification factor is $60$.

By tracking the changes in mean intensity of pixels in ROI, Eve can obtain a heartbeat curve as shown in Figure 13(d). The raw IPIs are extracted using a peak detection algorithm. According to (Balakrishnan et al., 2013), the magnification method for detecting heart rates is not accurate as ECG biosensors. On the other hand, as discussed in Section 2.1, the performance of piezo sensor is close to ECG biosensors. Therefore, we can expect that the IPIs estimated from video attacks are different from that measured by piezo sensors. Indeed, the estimation differences of piezo sensor and video attacks can be up to $30\%$ on our dataset.

By using the IPI values estimated from video analysis to pair with those produced by the piezo sensor, the agreement rate is $64.53\%$ for 30fps video, and $66.67\%$ for 120fps video, respectively. This result validates our analysis above, i.e., the IPI values extracted from the video do not have good proximity with those from the piezo sensors. Moreover, to process a 90s video (approximate time of sufficient number of IPI values for H2B to produce 128-bit keys), the processing time is 16 minutes for the 30fps video, and 75 minutes for the 120fps video respectively with a computer that has 8GB RAM and an Intel i7 processor. Therefore, the valid period of the secret keys may be set to a short duration (e.g., 5 minutes) to protect against this types of attacks.

Finally, as in passive and active presentation attacks, active video attacks have 0 success rate. The analysis indicates H2B is highly attack-proof on three types attacks.

5.8. Power Consumption

Power consumption of H2B can result from three parts: data sampling, data processing, and data transmission. Due to recent development in ambient backscatter communication (Liu et al., 2013; Kellogg et al., 2014), the energy consumption of wireless communication is negligible for transmission. Therefore, we focus on evaluation of power consumption in data sampling and processing only.

5.8.1. Power Consumption of Data Sampling

In our power measurement experiment, we connect the prototype device to a GDS-800 digital oscilloscope 777GDS-800: http://www.gwinstek.com/en-GB/products/GDS-800 to measure the average power consumption for each sampling event. The measurement setup is shown in Figure 14. The SensorTag was running with the latest version of Contiki OS, in which the MCU was duty-cycled to save power. Moreover, all unnecessary components, including the ADC, SPI bus, and on-board sensors were powered-off when possible.

Our measurement shows that the sampling rate of $120$ Hz results in $491.55\mu W$ power consumption in sampling the heartbeat signal. The capacity of a typical battery for SensorTag, such as Panasonic CR2032, is $3$ V, $225$ mAh which is equivalent to $2.43\times 10^{6}$ mJ. Therefore, a typical battery can support piezo data continuously sampling at $120$ Hz for $4.96\times 10^{6}$ s ($\approx$ 57 days).

5.8.2. Time and Energy Consumption of Reconciliation

The most computational intensive operation in H2B is CS-based reconciliation. However, although $\ell_{1}$ optimization is known to be computationally intensive, the reconciliation only requires to be executed in one of the two devices. It enables H2B to exploit the heterogeneity of wearable IoT architecture. For example, during the key generation process, we can choose the device with more processing power such as smartwatch to run reconciliation process. The less powerful devices such as IMDs needs to transmit messages only. Therefore, we evaluate the power consumption of reconciliation on two modern wearable devices: Samsung Smartwatch and Google Nexus 4. The size of sensing matrix $\Phi$ is empirically chosen to be $50\times~{}128$ as discussed in Section 4.3. The $\ell_{1}$ optimization used in the system is $\ell_{1}$-Homotopy (Donoho and Tsaig, 2008).

Table 5 shows the mean result of the time and energy consumption in one reconciliation process. The results are obtained by running reconciliation 50 times and measured by a widely used open source tool PowerTutor888http://ziyang.eecs.umich.edu/projects/powertutor/. Let us take Google Nexus 4 as an example. According to the results, CS-based reconciliation takes $155$ ms and $143.2$ mJ on average. The average key generation rate of H2B is approximately 3 $bit/s$. Therefore, it takes approximately 42.7s to generate a 128-bit key. Consequently, the processing time of $155$ ms for CS-based reconciliation is only a small fraction of the total key generation process. The battery capacity of Google Nexus 4 is $3.8$ V, $2100$ mAh which is equivalent to $2.9\times 10^{4}$J. For example, if a user run H2B for 24 hours and generate a new key every 5 minutes, which can be considered as an extreme case, the energy consumed by CS-based reconciliation is $0.09\%$ of the total energy in Google Nexus 4 only.

6. Discussion

6.1. Piezo Sensor v.s. ECG

In this subsection, we benchmark the piezo sensor against ECG biosensor. For ECG biosensor, we use Neurosky’s TGAM1 ECG biosensor999http://neurosky.com/biosensors/ecg-sensor/ as the baseline. As shown in Table 6, the advantage of piezo sensor is that it is smaller, more light, and more cost and power efficient compared to ECG sensors. Moreover, piezo sensors do not require skin contact when they measure SCG on the chest or waist while ECG sensors always need skin contact.

Apart from piezo and ECG sensors, IPI values can be also measured by PPG sensors and accelerometers. PPG sensors that require the operation of LED that consumes more power. A state-of-the-art PPG sensor AnalogDevices ADPD2212 101010http://www.analog.com/cn/products/adpd2212.html consumes power of $2.8mW$ in operation. A recent study (Xu et al., 2017) shows that piezo sensor-based gait recognition system can save by $78.15\%$ compared to accelerometers. Therefore, H2B shows advantages over such sensors in terms of power savings.

6.2. Limitations

In this paper, we show the potential of using wearable piezo sensors to detect heartbeat signal and further utilize IPI information to generate keys. Although piezo sensors are not widely used in common wearable devices at the moment, more and more commercial devices have emerged in the market as discussed in Section 1. With the advancement of technology especially self-powering techniques, PEH or piezo sensors will be embedded in more future wearable devices. Therefore, we believe H2B makes a humble step towards securing the communication of these wearable devices.

Another limitation is that the key generation rate of H2B is 2.9 bit per IPI. Therefore, it takes approximately 40 seconds to generate a 128-bit key as a typical heart rate is 60 - 100 beats per minute (Obrist, 2012). In fact, this is a common problem in IPI-based key generation system because the limited entropy contained in the IPI. For example, the key generation rate of two recent work H2H (Rostami et al., 2013) and IMDGuard (Xu et al., 2011) is 4 bit per IPI. The lower key generation rate of H2B is because the signal measured by piezo sensors has low SNR.

In the current design, H2B only works when a user is in static activities such as sitting, standing still and lying. This is because piezo sensors are sensitive to all kinds of body motion artifacts. Therefore, the large motions will overwhelm the weak heartbeat signal when the user is moving. To address this problem, more advanced signal processing approaches are required such as source separation technique, which we leave as future work.

In Section 4.3.2, we defined two possible vulnerabilities and three attack attempts and found a security boundary $M<Q$ to protect these vulnerabilities. However, there may be other potential vulnerabilities due to the information leakage and there is also a possibility that effective attacks exploiting Vulnerability 2 may be developed in the future. Future work could provide comprehensive study on computational secrecy of CS-based reconciliation protocol theoretically.

7. Related Work

Biometrics has been well developed in two types of applications in the security of wearable devices, i.e. user authentication and symmetric key generation. Authentication systems (Xu et al., 2017; Wang et al., 2018) exploit a unique pattern (distinctiveness) for each individual. The pattern must be time-invariant so that the user can be identified by the corresponding feature set. Therefore, authentication systems usually normalize biometrics to remove randomness over time. On the contrary, symmetric key generation systems (Xu et al., 2016; Schürmann et al., 2017) need to exploit both distinctiveness and randomness of biometrics. Randomness over time (forward secrecy) can ensure that an attacker cannot guess the key from past data. Therefore, a symmetric key generation system usually extracts time-variant biometric features. Our work is a symmetric key generation system so we highlight this difference.

Biometrics is the most popular trend in key generation for BAN. Among all biometrics, IPI is the most common choice of key material. This trend starts from Poon et. al (Poon et al., 2006) when they exploited IPIs as the entropy source. The systems exploited IPIs include IMDGuard (Xu et al., 2011), OPFKA (Hu et al., 2013), ESDS (Zheng et al., 2014), Heart2Heart (Rostami et al., 2013). The previous works focus on either ECGs or PPG signals to extract IPIs. To the best of our knowledge, using IPI measured by piezo sensor has not been studied. To this end, H2B presents a humble first step to develop a cryptographic system based on IPIs extracted from noisy piezo signals.

8. Conclusion

We proposed and implemented a shared secret key generation system, called H2B, for secure BAN communications. H2B allows two wearable devices to dynamically generate the same key on-the-fly based on the IPI measured by inexpensive and energy efficient but noisy piezo sensors. By employing an quantile-based quantization and a CS-based reconciliation, H2B can successfully pair two wearable devices on the same user’s body with a probability of $95.6\%$. We also demonstrate that H2B is secured against three types of typical attacks and very power-efficient.

Acknowledgements.

The authors wish to thank Jimmy Chan from WBS Technology for hardware support, Guohao Lan and Dong Ma for experiment assistance, and the anonymous reviewers for providing valuable comments.