⚡ electrical engineering

HHK: A Hardware-Oriented Cross-Location PPG Key Generation Architecture for Body Area Networks

This paper introduces HHK, a hardware-oriented, synthesizable RTL architecture for Body Area Networks that generates secure session keys from cross-location green-light PPG signals using Gray-coded quantization and polar code fuzzy commitment, achieving low power consumption and validated key agreement across multiple body sites in ambulatory settings.

Original authors: Jose Ilton de Oliveira Filho

Published 2026-05-26

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Jose Ilton de Oliveira Filho

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you and your friend are wearing smartwatches. You want to create a secret "handshake" code between your two watches so they can talk securely, but you don't want to type in a password or send a secret message over the air (which hackers could steal).

This paper introduces a clever new way to do this called HHK. Instead of using complex math that drains your battery, it uses your heartbeat as the secret key.

Here is how it works, broken down into simple steps:

1. The Problem: Heartbeats are Messy

Your heart beats the same rhythm whether you measure it on your wrist, your head, or your ankle. However, the shape of the signal changes depending on where the sensor is.

The Analogy: Imagine two people listening to the same drumbeat from different rooms. One hears a clear thump, the other hears a muffled thud. If you try to match the exact sound, they look different. But if you just count the time between the beats (the rhythm), they are almost identical.
The Challenge: Most previous systems tried to match the exact sound (the waveform), which fails when you are walking or moving. This new system only cares about the timing between beats.

2. The Solution: A "Hardware" Heartbeat Lock

The authors built a tiny, ultra-efficient computer chip (a hardware design) that does three main things:

Step A: The Filter (The Noise Canceler)
The chip looks at your heartbeat data and ignores the "static" caused by walking, running, or shivering. It only keeps the clean moments when the heart is beating steadily.
Step B: The Translator (The Rhythm Counter)
It measures the time between beats. It turns these time measurements into a string of 1s and 0s (a digital code). Because the rhythm is the same everywhere, your wrist watch and your head sensor will generate almost the same code.
Step C: The Fixer (The Puzzle Solver)
Since the sensors aren't perfect, the two codes won't match 100%. Maybe your wrist says "101" and your head says "100." The system uses a special "magic eraser" (called a Polar Code) to fix the small differences without ever sending the secret code over the air. It just sends a tiny hint to help the other device fix its own code.

3. The "Real World" Test

Many previous studies tested these systems while people were sitting still in a lab. This paper tested it on 16 real people during a mountain expedition in Switzerland.

They walked through snow, climbed stairs, and rode cable cars.
They measured heartbeats on the head, wrist, and ankle simultaneously.
The Result: Even while moving, the system successfully created matching secret keys between the different body parts about 51% to 70% of the time per attempt. If it failed once, it just tried again with the next 2 minutes of data.

4. Why This is a Big Deal

It's Tiny and Cheap: The design doesn't need expensive, power-hungry parts (like multipliers or big memory banks). It's so efficient that it uses almost no power—enough that a tiny solar panel or body heat could run it.
It's Built for Real Life: It's the first system proven to work while people are actually moving around, not just sitting in a chair.
It's Hardware, Not Just Software: Previous versions were just computer programs. This is a blueprint for a physical chip that can be built directly into wearable devices.

The Bottom Line

Think of HHK as a biological lock. Your heart is the key. Even if your watch and your headband "hear" your heartbeat differently because of where they are on your body, this new system is smart enough to ignore the noise, count the rhythm, and fix the small mistakes to create a perfect secret code. This allows your medical devices to talk securely to each other without draining your battery or needing a password.

Technical Summary: HHK – A Hardware-Oriented Cross-Location PPG Key Generation Architecture

Problem Statement
Wireless Body Area Networks (BANs) require frequent session key establishment to ensure forward secrecy and protect sensitive health data. However, traditional public key cryptography imposes computational and energy costs that exceed the budgets of deeply constrained wearable nodes, while symmetric pre-distribution lacks forward secrecy. Physiological signal-based key generation offers a solution by allowing nodes on the same body to derive matching keys from shared biometric data without transmitting secrets.

Despite prior research, two critical gaps remain:

Ambulatory Validation: Existing studies are largely confined to controlled, stationary, or single-location settings. Real-world BANs operate across diverse body sites during unconstrained daily activity, where motion artifacts and site-dependent waveform morphologies degrade Inter-Beat Interval (IBI) extraction and key agreement.
Hardware Implementation: Current physiological key generation systems (e.g., H2K, FaceFinger, E2P) are implemented entirely in software on host processors. This approach is unsuitable for autonomous BAN nodes that lack general-purpose processors due to energy constraints. No prior work has implemented a complete cross-location PPG key generation pipeline in synthesizable Register-Transfer Level (RTL) and validated it on silicon.

Methodology
The paper proposes HHK, a hardware-oriented architecture that generates keys using IBI timing from green-light Photoplethysmography (PPG) signals across multiple body sites. The system operates independently on two nodes, exchanging only public helper data.

The datapath consists of the following stages:

Signal Processing: Raw 16-bit PPG samples are processed using a causal, fixed-point (Q15) prefilter to attenuate noise without DSP multipliers.
Beat Detection: A local-maximum detector identifies beat foot points, enforcing a refractory period (150 BPM) to ensure valid timestamps.
Cross-Location Alignment: Beat timestamps from different sites (e.g., head, wrist, ankle) are aligned within a 300 ms tolerance window. Only matched pairs contribute to the IBI sequence, eliminating desynchronization errors common in naive sequential comparisons.
Quantization: The IBI range is partitioned into four equal-frequency bins using dataset-wide percentiles. Each IBI is mapped to a 2-bit Gray code. This Gray coding ensures that boundary crossings result in at most a 1-bit disagreement, reducing the effective channel error rate.
Key Reconciliation: A rate-1/3 Polar code (N=128, K=42) with Successive Cancellation (SC) decoding is employed. Node A generates a random key, encodes it, and broadcasts helper data ( $h = b_A \oplus c$ ). Node B uses this helper data to decode its own bit sequence and recover the shared key.
Motion Gating: To handle ambulatory noise, the system uses IMU-derived motion metrics to gate data windows. Windows with high motion artifacts (exceeding a 0.08 g threshold) or invalid heart rates (outside 45–120 BPM) are discarded before processing.

Key Contributions

Open Benchmark for Multi-Location PPG: HHK establishes the highest reported key agreement rates for multi-location PPG generation on free-living ambulatory data (216 hours from 16 participants). It re-evaluates five prior methods under identical conditions, demonstrating that their software-only approaches fail to produce matching keys on this challenging dataset.
First Synthesizable RTL Architecture: The paper presents the first complete, synthesizable RTL implementation of a cross-location PPG key generation pipeline validated on silicon. The design is multiplier-free, utilizing only standard logic cells, making it portable to ASICs and suitable for energy-harvesting nodes.

Experimental Results
Validation was conducted using the WildPPG dataset, collected during a mountain expedition involving snow, ice caves, and motorized transport.

Raw Bit Agreement: After Gray-coded quantization, raw bit agreement between nodes ranged from 86.0% to 90.1% across head-wrist, head-ankle, and wrist-ankle pairs.
Key Agreement: After Polar code reconciliation, the final key agreement rate ranged from 51.3% to 69.8% per 120-second window. The head-wrist pair performed best (69.8%), while the head-ankle pair was most challenging (51.3%) due to greater waveform distortion at distal extremities.
Hardware Performance: Synthesis on a Xilinx XC7Z020 FPGA mapped the datapath to 18,760 LUTs and 20,971 flip-flops. The system operates at 10 MHz with a latency of 3.2 ms per key generation event.
Energy Efficiency: The energy cost per key generation event is 48 µJ. Over a 120-second acquisition window, the average power consumption is 0.4 µW, well within the budget of energy-harvesting BAN nodes.
Silicon Validation: Bit-exact comparison between RTL simulation and physical FPGA execution confirmed zero disagreement in the raw bit strings, helper data, and reconciliation vectors.

Significance and Claims
The authors claim that HHK is the first synthesizable RTL key generation architecture for BANs validated across multiple body locations on ambulatory data. By relying on IBI timing rather than waveform morphology, the architecture is robust to the cross-location distortions and motion artifacts inherent in real-world settings. The paper emphasizes that while prior software-based methods achieve high agreement in controlled labs, they collapse to near-zero agreement when applied to free-living data without the specific error-correction and hardware optimizations provided by HHK. The design's multiplier-free nature and low power profile make it a viable candidate for deployment on autonomous, deeply constrained biomedical nodes where traditional cryptographic methods are infeasible.