Enhancing Heart-Beat-Based Security for mHealth Applications

Seepers, Robert M.; Strydis, Christos; Sourdis, Ioannis; Zeeuw, Chris I. De

doi:10.1109/jbhi.2015.2496151

Cited by 28 publications

(53 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We next evaluate this accuracy for a wide range of recording parameters and physiological phenomena, using a cPPG sensor as a model for a trusted device (a choice commonly made in related work [2], [4], [5]). We next detail our experimental setup, after which our evaluation ensues in Subsection V-B.…”

Section: Discussionmentioning

confidence: 99%

“…The default subject is a male adult with skin-type III according to the Fitzpatrick scale with his face visible on the camera [33]. The subject is illuminated by a frontal fluorescent lamp 4 and the duration of each recording is around 90 seconds (i.e., 1800 frames by a 20 FPS camera). It is expected that the accuracy at which individual IPIs can be detected using rPPG depends on various physiological phenomena and parameters, such as skin composition (fat), arterial stiffness, skin temperature, skin tone, motion and luminance.…”

Section: A Experimental Setupmentioning

confidence: 99%

“…In contrast to conventional biometrics, which uses a person's unique physiological features to generate a long lasting person-unique identifier [1], the IPI is a time-varying feature that is known to contain a degree of randomness, making it possible to derive a person-and time-unique identifier from it [2]- [4]. This identifier should be difficult to guess, yet, it is possible to obtain (roughly) the same identifier by simultaneously measuring a cardiac signal of the same person [2], [5].…”

Section: Introductionmentioning

confidence: 99%

“…To this end, we implement three stateof-the-art rPPG algorithms called CHROM [13], PBV [18] and 2SR [19], and evaluate how accurately these algorithms can obtain IPIs compared to a reference contact PPG (cPPG) sensor, which is often considered as a trusted device in related work [2], [4], [5]. We consider a wide range of settings and parameters that are expected to affect the accuracy of rPPG (and thus security) in practice, including subjects with different skin tones, different light sources, types and intensities of movement, video compression and camera-frame rate.…”

Section: Introductionmentioning

confidence: 99%

“…We consider a wide range of settings and parameters that are expected to affect the accuracy of rPPG (and thus security) in practice, including subjects with different skin tones, different light sources, types and intensities of movement, video compression and camera-frame rate. Based on our evaluation, we discuss the threat of remote attacks on (1,2) IPI (2,3) IPI (3,4) IPI (4,5) HBBS and highlight that only identifiers which are generated from electrical cardiac recordings are safe from such attacks.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Attacks on Heartbeat-Based Security Using Remote Photoplethysmography

Seepers

Wang

Haan

et al. 2018

IEEE J. Biomed. Health Inform.

Self Cite

View full text Add to dashboard Cite

Attacks on heartbeat-based security using remote photoplethysmographySeepers, R.M.; Wang, W.; de Haan, G.; Sourdis, I.; Strydis, C. • A submitted manuscript is the author's version of the article upon submission and before peer-review. There can be important differences between the submitted version and the official published version of record. People interested in the research are advised to contact the author for the final version of the publication, or visit the DOI to the publisher's website.• The final author version and the galley proof are versions of the publication after peer review.• The final published version features the final layout of the paper including the volume, issue and page numbers. Link to publication General rightsCopyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights.• Users may download and print one copy of any publication from the public portal for the purpose of private study or research.• You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal ? Take down policyIf you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Abstract-The time interval between consecutive heartbeats (interpulse interval, IPI) has previously been suggested for securing mobile-health (mHealth) solutions. This time interval is known to contain a degree of randomness, permitting the generation of a time-and person-specific identifier. It is commonly assumed that only devices trusted by a person can make physical contact with him/her, and that this physical contact allows each device to generate a similar identifier based on its own cardiac recordings. Under these conditions, the identifiers generated by different trusted devices can facilitate secure authentication. Recently, a wide range of techniques have been proposed for measuring heartbeats remotely, a prominent example of which is remote photoplethysmography (rPPG). These techniques may pose a significant threat to heartbeat-based security, as an adversary may pretend being a trusted device by generating a similar identifier without physical contact, thus bypassing one of the core security conditions. In this paper, we assess the feasibility of such remote attacks using state-of-the-art rPPG methods. Our evaluation shows that rPPG has similar accuracy as contact PPG and, thus, forms a substantial threat to heartbeat-based-security systems that permit trusted devices to obtain their identifiers from contact PPG recordings. Conversely, rPPG ca...

show abstract

Section: Discussionmentioning

confidence: 99%

Section: A Experimental Setupmentioning

confidence: 99%