  Many Next Generation (NextG) applications feature devices that are capable of
communicating and sensing in the Millimeter-Wave (mmWave) bands. Trust
establishment is an important first step to bootstrap secure mmWave
communication links, which is challenging due to the lack of prior secrets and
the fact that traditional cryptographic authentication methods cannot bind
digital trust with physical properties. Previously, context-based device
pairing approaches were proposed to extract shared secrets from common context,
using various sensing modalities. However, they suffer from various limitations
in practicality and security.
  In this work, we propose the first secret-free device pairing scheme in the
mmWave band that explores the unique physical-layer properties of mmWave
communications. Our basic idea is to let Alice and Bob derive common randomness
by sampling physical activity in the surrounding environment that disturbs
their wireless channel. They construct reliable fingerprints of the activity by
extracting event timing information from the channel state. We further propose
an uncoordinated path hopping mechanism to resolve the challenges of beam
alignment for activity sensing without prior trust. A key novelty of our
protocol is that it remains secure against both co-located passive adversaries
and active Man-in-the-Middle attacks, which is not possible with existing
context-based pairing approaches. We implement our protocol in a 28GHz mmWave
testbed, and experimentally evaluate its security in realistic indoor
environments. Results show that our protocol can effectively thwart several
different types of adversaries.
