Secure pairing with wearable devices by using ambient sound and light

Abstract

Wearable devices usually work together with smart phones. To ensure only legitimate smart phones can read the data, they must conduct pairing to establish a shared key. Traditional pairing methods require that the pairing devices have a keyboard or screen for user interaction. However, due to the size limitation, keyboards or screens are hard to be installed in the wearable devices. To solve this problem, we propose a novel pairing method by using ambient sound and light. In this new scheme, any pairing request from smart phone will trigger wearable device vibration. Only after users press the confirm key on the device can the pairing process continues. Then pairing devices collect ambient sound and light at the predetermined time and establish a shared key by using the Diffie-Hellman protocol. To protect against potential man-in-the-middle attacks in the key establishment process, an improved interlock protocol with sound and light comparison is conducted to authenticate the key. If both the sound and light collected by the pairing devices are similar enough, the key is accepted. Otherwise, it is rejected. Compared with current context based pairing methods, our scheme does not impose strict synchronization on devices to collect ambient context data. Moreover, our scheme need not collect and exchange contextual information for multiple times to resist offline brute force attacks. The experimental results and security analysis prove the effectiveness of our scheme.