Information Theoretic Key Agreement Protocol based on ECG signals

TL;DR

This paper introduces an innovative information theoretic key agreement protocol leveraging ECG signals in WBANs to enhance security, authentication, and privacy, addressing vulnerabilities exposed during the COVID-19 pandemic.

Contribution

It presents a novel ECG-based key agreement protocol with analytical robustness, a unique information reconciliation matrix, and insights into security-performance trade-offs.

Findings

Robust authentication achieved through ECG signal analysis

A unique information reconciliation matrix improves performance

Trade-off identified between security level and error correction complexity

Abstract

Wireless body area networks (WBANs) are becoming increasingly popular as they allow individuals to continuously monitor their vitals and physiological parameters remotely from the hospital. With the spread of the SARS-CoV-2 pandemic, the availability of portable pulse-oximeters and wearable heart rate detectors has boomed in the market. At the same time, in 2020 we assisted to an unprecedented increase of healthcare breaches, revealing the extreme vulnerability of the current generation of WBANs. Therefore, the development of new security protocols to ensure data protection, authentication, integrity and privacy within WBANs are highly needed. Here, we targeted a WBAN collecting ECG signals from different sensor nodes on the individual's body, we extracted the inter-pulse interval (i.e., R-R interval) sequence from each of them, and we developed a new information theoretic key agreement protocol that exploits the inherent randomness of ECG to ensure authentication between sensor pairs within the WBAN. After proper pre-processing, we provide an analytical solution that ensures robust authentication; we provide a unique information reconciliation matrix, which gives good performance for all ECG sensor pairs; and we can show that a relationship between information reconciliation and privacy amplification matrices can be found. Finally, we show the trade-off between the level of security, in terms of key generation rate, and the complexity of the error correction scheme implemented in the system.