An increasing number of patients receive implantable medical devices. For instance, more than 12,000 cardiac pacemakers are being implanted annually in the Netherlands alone. Medical implants can communicate wirelessly with other electronic devices such as smart phones. A patient can use this feature to monitor his health and to share the data with healthcare providers. This facilitates personalised treatment.

Big issue

“Medical implants need special security measures to prevent unauthorized access. This is to protect the patient’s privacy and to prevent attackers from affecting the implant’s performance. Current implants are not secure enough; this is a big issue”, says Dr Christos Strydis, researcher at Erasmus MC in Rotterdam, the Netherlands. Together with his PhD student Robert Seepers, he is developing methods to secure medical implants using the patient’s own heartbeat.

How it works

Traditional passwords can be misplaced, stolen or simply be inaccessible during a medical emergency. Robert Seepers explains the principle of heartbeat-based security: “It uses the time interval between consecutive heartbeats. This interval contains a degree of randomness which enables us to create highly secure passwords. Let us assume that a patient wants to use his smart phone to retrieve data from his cardiac pacemaker. The pacemaker can measure the patient’s heartbeat pattern. The smartphone can measure roughly the same heartbeats as the pacemaker by using its camera and an application. We are developing hardware and software that ensures that the smart phone can access pacemaker data if the two heartbeat patterns match.”

Not easy

But matching the two patterns is not easy. The measurements of the two devices will never be identical because of natural variations in heartbeat patterns when measured by two different devices. Robert Seepers: “So our technique should be secure, yet allow for some disparity between the two passwords.” Another challenge is the limited randomness of each heartbeat interval. “We are using so-called ‘entropy extraction’ to increase the strength of heartbeat-based passwords. This has the potential to drastically improve security. We are now in the process of further enhancing security by designing entropy extractors tailored to each patient’s cardiac signals."

Larger project

The study is part of a larger European project called ‘SHARCS’ (Secure Hardware-Software Architecture for Robust Computing Systems). Christos Strydis: “The SHARCS project is developing end-to-end security for various ICT systems, including medical implants, smart cars, and cloud-based systems. End-to-end means that you need to protect all parts of the system, from bottom to top. We do this by adapting both software and hardware.”

Into the future

“I expect that in the future, there will be a lot of mobile health apps that can read out implants. We hope that we can apply our method to secure any type of implant, from pacemakers to neural implants for Parkinson’s disease and optical implants”, concludes Dr Strydis.

Related projects and further reading

Read about BrainFrame, another project of Dr Strydis.

Read about European cardiac health research on www.HorizonHealth.eu.

Read about European e-health research on www.HorizonHealth.eu.