Using heartbeats as passwords to secure medical devices

library
crime | hacking | security

It is time to start thinking of our hearts as random number generators. That’s so they can serve as passwords to secure medical devices that are vulnerable to hacking, researchers at Rice University have proposed.

In their paper on the authentication technique – called Heart-to-Heart (H2H) – the researchers note that the use of implantable medical devices (IMDs) is growing in the US: for example, each year, over 100,000 patients receive implantable cardioverter defibrillators that detect dangerous heart rhythms and administer electric shocks to restore normal activity.

Other IMDs – a category that includes devices either partially or fully implanted into patients’ bodies – include pacemakers, neurostimulators, and insulin or other drug pumps.

The researchers at the US university in Houston, Texas, say that H2H addresses a fundamental tension between two critical requirements for IMDs:

Emergency responders have to be able to swiftly reprogram or extract data from the devices, lest treatment delays prove fatal to patients as they hunt for keys or passwords, and
The devices’ wireless access must be protected from hackers who might harm patients or expose their medical data.

The researchers – Rice electrical and computer engineer Farinaz Koushanfar, graduate student Masoud Rostami, and collaborator Ari Juels, former chief scientist at RSA Laboratories – describe H2H as implementing a “touch-to-access” control policy.

H2H involves a medical instrument that the researchers generically call a programmer. This is allowed to wirelessly access a patient’s medical device only when it has direct contact with a patient’s body.

A medical technician uses the programmer to pick up a waveform generated by the patient’s beating heart – i.e., an electrocardiogram (ECG) signature.

The external device – that is, the programmer – compares the ECG details with the internal medical device. Only if the signals collected by both at the same time match up is access granted.

Rostami told Softpedia’s Eduard Kovacs that, in essence, given a heartbeat’s variability, the heart can function as something of a random number generator:

The signal from your heartbeat is different every second, so the password is different each time. You can’t use it even a minute later.

Hacking of medical devices is, at this point, demonstrably feasible.

The US government in October 2012 told the US Food and Drug Administration (FDA) to finally start taking medical device security seriously, whether we’re talking about intentional hacking, unencrypted data transfer that can be manipulated or a host of other threat vectors.

In June 2013, the FDA complied, calling on medical device manufacturers and health care facilities to start addressing medical devices’ vulnerability to cyberattack.

Koushanfar and Rostami will present the system in November at the Conference on Computer and Communications Security in Berlin.

Before we see H2H debut, it will need to obtain FDA approval. After that, it’s up to medical device manufacturers to adopt the technology.

It’s a fascinating approach to authentication.

My insulin pump and I look forward to seeing whether it wins approval and achieves adoption in the medical device industry.

After that, who knows?

Perhaps our beating hearts will someday be a viable alternative to the easily guessable, completely hackable security questions that are now used to supposedly verify that we are, indeed, who we say we are.