S²Pair: secure and simple device pairing using human bone as a key generator

Secure pairing is an essential measure to ensure user privacy and data security on smart devices. Traditional pairing approaches predominantly rely on manual interactions, which may be cumbersome, susceptible to human error, and often problematic to deploy on devices with poor user interfaces. Despite prior attempts to mitigate these shortcomings, their efficacy has been impeded by the complexities in key generation or reliance on wireless channels for key transmission, leaving them vulnerable to potential man-in-the-middle (MITM) attacks. Therefore, the development of a pairing approach that focuses on security with user-friendly characteristics is important. In this paper, we introduce a novel paradigm that harnesses human bones to generate and transmit pairing keys derived from ambient sound. It spontaneously generates keys using the interference of vibrations passing through the bone, eliminating the complex process of key generation. We explore the unique characteristics of bones as a key generator and develop a quantitative model of this process for key confirmation. Our approach also enhances security by avoiding public wireless links for key transmission. We design a pairing protocol and build a prototype system using off-the-shelf sensors. Extensive experiments involving 44 participants demonstrate that our system has a true acceptance rate of 96.64% and an equal error rate of 1.96%, while also being resilient to various attacks.