Securing Wireless Neurostimulators [2018]

[This post based on the Securing Wireless Neurotransmitters, Marin et al., 2018]

How can we make sure Brain-Computer Interfaces (BCIs) don't get hacked?

A brain implant is a huge security risk. Currently, an attacker who successfully hacks such an implant could gain total control over a patient's life. In the future, if/when BCIs are able to read and write neural data at the thought level, a hacker could literally rewrite someone's thoughts, memories, and beliefs by compromising a target's BCI. The paper we discuss here proposes a method for securing current neurostimulators, with applications to all current and future wireless medical devices and BCIs. 

Executed Hack

Other researchers have already demonstrated that the implanted medical devices used for treating conditions like diabetes or irregular heartbeats are vulnerable to attack, and for the first time, this study demonstrated attacks on a device implanted in the brain. The researchers were able to carry out a broad array of attacks on the device, including delivering arbitrary messages to it, remotely reading its output data, and rapidly depleting its battery using a DoS attack.

The researchers' setup was simple and cheap, consisting solely of a laptop, antennas (for communicating with the device), and a USB-6351 DAQ (to connect the antennas to the laptop). This setup monitored the transmissions between the neurostimulator and its controller to obtain the necessary data to reverse-engineer the stimulator-controller communication protocol. After successfully deducing the message format and phases of a communication (initialization, reprogramming, and termination), the researchers moved on to executing four types of attacks:

1. Replay: Using valid, intercepted transmissions over again to modify the neurostimulator.
2. Spoofing: Sending arbitrary messages to the neurostimulator. 
3. Privacy: Intercepting communications to learn medical details, or even using the unique serial number as a way to track the patient physically.
4. DoS: Sending many messages to deplete stimulator resources quickly. 

The main takeaway from this portion of the study is that, even with limited resources, the neurostimulator was fairly easy to hack, and the successful hacks compromised essentially every part of the device. Given that this device has direct neural access, such poor security is extremely concerning.

Solution

Fortunately, the researchers were able to use this experience to devise an effective way for securing wireless neurotransmitters, taking into account the unique constraints these medical devices have (e.g., low resource availability and emergency access requirements). 

Their solution is designed to protect against a strong adversary that can be close to the patient for as much as a few seconds and can "eavesdrop or jam the wireless channel, as well as modify, replay, or forge messages." The three parts of the solution are as follows: 

1. Key Generation: A "128-bit symmetric key" is generated independently for each session, using the brain's local field potentials as an entropy source. 
2. Key Transport: The device programmer is placed on the skin directly above the neurostimulator to transmit the key using minimal power (<1mV). Experiments at a distance of "3 meters to a few centimeters" found eavesdropping remotely on this low-power communication was impossible.
3. Secure Data Exchange: A new message format that adds a counter field (to prevent replay attacks) and a 64-bit Message Authentication Code (MAC) to verify the sender was created. Since cryptographic energy costs are minimal compared to communication energy costs, no special encryption scheme beyond what already exists is needed.

Taken together, these elements form a solution that is practical, effective, and secure for resource-constrained wireless medical devices.

Applications & Conclusion

In addition to securing neurostimulators, other wireless medical devices implanted in or attached to the body that are controlled wirelessly -- like some insulin pumps -- can be properly secured. In industry, companies developing bi-directional BCIs (like Neuralink) are in particular need of a secure architecture like the one the researchers designed. Otherwise, the danger posed by an attacker's being able to arbitrarily read/write data (i.e., memories) to a brain will render such devices entirely unusable, and the advances BCIs promise will remain out of reach.

Sources

1. Securing Wireless Neurotransmitters: https://www.esat.kuleuven.be/cosic/publications/article-2803.pdf