DNA Sequencing Flow Cells and the Security of the Molecular-Digital Interface

Abstract

DNA sequencing is the molecular-to-digital conversion of DNA molecules, which are made up of a linear sequence of bases (A,C,G,T), into digital information. Central to this conversion are specialized fluidic devices, called sequencing flow cells, that distribute DNA onto a surface where the molecules can be read. As more computing becomes integrated with physical systems, we set out to explore how sequencing flow cell architecture can affect the security and privacy of the sequencing process and downstream data analysis. In the course of our investigation, we found that the unusual nature of molecular processing and flow cell design contributes to two security and privacy issues. First, DNA molecules are ‘sticky’ and stable for long periods of time. In a manner analogous to data recovery from discarded hard drives, we hypothesized that residual DNA attached to used flow cells could be collected and re-sequenced to recover a significant portion of the previously sequenced data. In experiments we were able to recover over 23.4% of a previously sequenced genome sample and perfectly decode image files encoded in DNA, suggesting that flow cells may be at risk of data recovery attacks. Second, we hypothesized that methods used to simultaneously sequence separate DNA samples together to increase sequencing throughput (multiplex sequencing), which incidentally leaks small amounts of data between samples, could cause data corruption and allow samples to adversarially manipulate sequencing data. We find that a maliciously crafted synthetic DNA sample can be used to alter targeted genetic variants in other samples using this vulnerability. Such a sample could be used to corrupt sequencing data or even be spiked into tissue samples, whenever untrusted samples are sequenced together. Taken together, these results suggest that, like many computing boundaries, the molecular-to-digital interface raises potential issues that should be considered in future sequencing and molecular sensing systems, especially as they become more ubiquitous.

IoT Health Devices: Exploring Security Risks in the Connected Landscape

“…DNA synthesis has become more common [155]. It now is a non-trivial threat [156] where genetic sequences being synthesized and analyzed for various purposes, such as medical research, drug development, and forensic analysis, can be leaked to unauthorized parties or corrupted.…”

“…To extrapolate, future cyberbiosecurity models may apply more complicated discriminative techniques to detect generic sequences of DNA synthesis or other important biological outputs or signatures. In terms of biomolecules, biosystems, biomachine interfaces, and biocomputing, there exist many new and dynamic targets [155,198]. A single organization or academic institute cannot make this approach.…”

“…However, less than twenty (20) years ago, considerable amounts of digital data were converted into DNA reliably stored and played back in text or video format. In the last decade, a researcher and his team managed to encode malware in DNA and use it to perform a remote attack on a DNA sequencer, which spelled immediate implications for future healthcare operations [155]. The takeaway is the value of pondering what creative teams may produce in their goal to produce novel attacks on IoTHDs.…”

Dynamic Sliding Window Encoding for Data Storage on DNA Under Biological and Indexing Constraints

“…Its rate tends to the ideal rate of 2 BPB with the increase of N while mCGR peaks at 1.9 BPB. For instance, when M = 76, DSW E (3,76,6) achieves an experimental rate of 1.73 BPB while mCGR provides a rate of 0.75 BPB and 1.3 BPB with DNA codewords of size l = 6 and l = 10, respectively. Indeed, mCGR collapses with large numbers of prohibited motifs with its dictionary cleaning procedure.…”

“…For instance, data confidentiality is at risk at all stages. An unauthorized user can spy on the sequencing [3] or synthesis [4] device, or secretly clone/steal the stored DNA molecules. This is why an encryption/decryption step should be added as shown in red in Fig.…”