  We propose Breath to Pair (B2P), a protocol for pairing and shared-key
generation for wearable devices that leverages the wearer's respiration
activity to ensure that the devices are part of the same body-area network. We
assume that the devices exploit different types of sensors to extract and
process the respiration signal. We illustrate B2P for the case of two devices
that use respiratory inductance plethysmography (RIP) and accelerometer
sensors, respectively. Allowing for different types of sensors in pairing
allows us to include wearable devices that use a variety of different sensors.
In practice, this form of sensor variety creates a number of challenges that
limit the ability of the shared-key establishment algorithm to generate
matching keys. The two main obstacles are the lack of synchronization across
the devices and the need for correct noise-induced mismatches between the
generated key bit-strings.
  B2P addresses the synchronization challenge by utilizing Change Point
Detection (CPD) to detect abrupt changes in the respiration signal and consider
their occurrences as synchronizing points. Any potential mismatches are handled
by optimal quantization and encoding of the respiration signal in order to
maximize the error correction rate and minimize the message overheads.
Extensive evaluation on a dataset collected from 30 volunteers demonstrates
that our protocol can generate a secure 256-bit key every 2.85 seconds (around
one breathing cycle). Particular attention is given to secure B2P against
device impersonation attacks.
