Another day, another cybersecurity threat to worry about. Earlier this week, Johnson and Johnson told patients that it had discovered a security flaw in its insulin pumps, which left the pumps vulnerable to hacking—though the company said the risk of such a hack actually occurring is “extremely low.”
Meanwhile, a group of researchers at the University of Washington in Seattle is offering an alternative to wireless data transmission that could make medical devices and wearables more secure: transmitting the data through our bodies rather than broadcasting them over the air. Their premise is that it’s much harder to surveil a human body without someone noticing than it is to surreptitiously pluck a password from wireless signals in the air.
In tests with 10 subjects, the group showed that it’s possible to transmit passwords at speeds of up to 50 bits per second (bps) through the human body, using off-the-shelf products such as fingerprint scanners and iPhone fingerprint sensors. For comparison, a standard Internet package in the U.S. offers download speeds of 15 megabits-per-second, or 15 million bits per second.
“You can hold a phone in your hand and you can have a receiver on your leg, and you can actually receive signals very strongly,” says Shyamnath Gollakota, a wireless researcher at the University of Washington and collaborator on the project.
The experiments were led by graduate students Mehrdad Hessar and Vikram Iyer with the guidance of Gollakota. The group recently presented its work at the 2016 ACM International Joint Conference on Pervasive and Ubiquitous Computing in Germany.
If the technique were ever to catch on, it would be limited to applications such as wearables, medical implants, and digital door locks because it requires users to simultaneously touch both the device that is sending the password and the one that is receiving it.
And the low bit rate means it would work best for transferring short strings of numbers such as a passcode rather than full sentences, or high-definition films. As an example, the group says sending a four-digit numerical code to a digital door lock would require fewer than 16 bits, which could be transmitted through the body in less than a second. A 256-bit serial number could be sent to a medical device in under 15 seconds.
Jeffrey Walling, an assistant professor at the University of Utah who has studied capacitive touch, says even this method of on-body password transferral wouldn’t be hackproof. “Certainly, any time you’re transmitting any type of signal, you can't make it 100 percent secure,” he says. But it could be an improvement over the wireless channels used today.
In the past, other researchers have successfully demonstrated on-body communications but those projects often required users to add custom hardware onto their devices in order to pull it off. To see whether it was possible to do this with existing technology, the University of Washington group selected several commercial devices to test: an iPhone 5s; an iPhone 6s; a Lenovo touchpad; an Adafruit touchpad; and a Verifi P5100 fingerprint scanner.
The touchpad or fingerprint sensor on all of these devices use a concept called capacitive coupling—they connect to a 2-D grid of electrodes that measure capacitance, or the ability to store energy as an electric charge. When the device sends a voltage signal through either the row or column, it creates an electric field at the intersections. When a finger touches the screen, it affects the electric field and thereby changes the capacitance at that point. The device can use this change to detect the presence of a finger as well as characterize the peculiar patterns of swirls and ridges in a fingerprint.
When a finger touches the screen or scanner, it also offers a path for these signals to travel through the body. Skin isn’t a great conductor, so the signals travel instead through extracellular fluid found in blood vessels and muscles. The signals emitted by fingerprint sensors fall below 10 megahertz, which is important because higher-frequency signals would be absorbed by these same fluids. It’s an added bonus that sub–10 MHz signals do not travel well through the air. They degrade and become hard to detect after traveling just 6 centimeters from a fingerprint sensor or 20 centimeters from a touchpad.
For their demonstration, the researchers wanted to not only transmit a signal from a fingerprint sensor through the body, but also alter it in order to send a message. But due to security concerns, many device manufacturers don’t allow users to access the software or hardware that directly controls these signals.
So, the group had to improvise. They wrote software that initiated power cycling, which means it quickly turned the devices on and off, in effect sending a digital code with “on” equaling a 1 and “off” meaning a 0. By using this technique, they could transmit messages using the signals that commercial devices were already generating.
To receive those messages, the group developed a bracelet wrapped in conductive copper tape that they attached to a subject’s arm, leg, or chest. This bracelet was connected to a receiver built from a USB TV tuner, an upconverter that could boost the low frequency signal to make it readable to the receiver, and a software-defined radio platform housed on a laptop.
With this system and their on-off code, the team transmitted password data at a maximum of 25 bps with the Verifi scanner, but managed 50 bps with the Adafruit touchpad. They found that the signal’s strength remained steady as it traveled throughout the entire body instead of degrading, as it would over air. Transmission was not significantly impacted by the height, weight, or posture of users, and when the group tested their system in the presence of other electronic devices, they found virtually no interference.
Gert Cauwenberghs, a biomedical researcher who has studied similar methods at the University of California, San Diego, thinks the group could achieve even higher data rates—potentially hundreds of bits per second—by gaining direct access to the fingerprint sensors.
For now, the group says that even the relative snail’s pace of 50 bps is sufficient to send a passcode that could unlock a door if a user were to touch their smartphone’s fingerprint sensor and the door handle at the same time. But Cauwenberghs points out that the convenience of this method only increases with speed. At the present low rates, “you'd probably have to hold your finger on that patch for a few seconds for this to authenticate,” he says.
Before entrusting any such system with the passcodes to his own front door, Walling of the University of Utah says he’d like to see more statistical analysis about how often this technique generates false positive and negatives. “If they really can transmit a strong enough signal and do this repeatedly, I really do think it's something of potential,” he says.
Cauwenberghs would also like to learn more about the biological impact of such transmissions before people start making a habit of using their bodies as communication links. The low frequencies used in this study have no known health impacts, but he says it would be best to study the effects of repeatedly sending such signals through the body in this manner before ruling it safe.
