Heartbeats Do Not Make Good Pseudo-Random Number Generators: An Analysis of the Randomness of Inter-Pulse Intervals

Abstract

Abstract:The proliferation of wearable and implantable medical devices has given rise to an interest in developing security schemes suitable for these systems and the environment in which they operate. One area that has received much attention lately is the use of (human) biological signals as the basis for biometric authentication, identification and the generation of cryptographic keys. The heart signal (e.g., as recorded in an electrocardiogram) has been used by several researchers in the last few years. Specifically, the so-called Inter-Pulse Intervals (IPIs), which is the time between two consecutive heartbeats, have been repeatedly pointed out as a potentially good source of entropy and are at the core of various recent authentication protocols. In this work, we report the results of a large-scale statistical study to determine whether such an assumption is (or not) upheld. For this, we have analyzed 19 public datasets of heart signals from the Physionet repository, spanning electrocardiograms from 1353 subjects sampled at different frequencies and with lengths that vary between a few minutes and several hours. We believe this is the largest dataset on this topic analyzed in the literature. We have then applied a standard battery of randomness tests to the extracted IPIs. Under the algorithms described in this paper and after analyzing these 19 public ECG datasets, our results raise doubts about the use of IPI values as a good source of randomness for cryptographic purposes. This has repercussions both in the security of some of the protocols proposed up to now and also in the design of future IPI-based schemes.

ECG-RNG: A Random Number Generator Based on ECG Signals and Suitable for Securing Wireless Sensor Networks

“…Apart from the poor randomness quality of IPI-based approaches [33], the throughput is also a bottleneck. Generally, in this sort of approach, four random bits (LSB) are extracted after the observation of two heart-beats [27,31].…”

“…Although the entropy value is high, the chi-square test clearly shows that this file is not random. In line with this, in [33], the randomness quality of IPI values was scrutinized in-depth using 19 public datasets with healthy and unhealthy subjects. Two main conclusions were drawn from this study: (1) IPI values can generate short bit streams that behave as a random variable; and (2) large files with IPI values have poor randomness quality.…”

Review on Using Biometric Signals in Random Number Generators.

“…Similar application of ECG in Random Number generation is discussed in the paper, "ECG-RNG: A Random Number Generator based on ECG Signals and Suitable for Securing Wireless Sensor Networks" [6]. In the article, "Heartbeats do not make good pseudo random number generators: An analysis of the randomness of the Inter-Pulse Intervals" [5], the suspicion of using IPI as the source of randomness which is the basis of the method suggested in paper [4] is raised. According to the research done in paper [5], there were weaknesses in the previous study that considers Heart-beats a source of randomness.…”

“…In the article, "Heartbeats do not make good pseudo random number generators: An analysis of the randomness of the Inter-Pulse Intervals" [5], the suspicion of using IPI as the source of randomness which is the basis of the method suggested in paper [4] is raised. According to the research done in paper [5], there were weaknesses in the previous study that considers Heart-beats a source of randomness. First, tests were only performed to test the entropy of generated random bit sequence are random or not.…”

On the Entropy of Oscillator-Based True Random Number Generators under Ionizing Radiation

“…TRNGs are used in a wide variety of applications ranging from cryptographic protocols [ 14 ] to Monte Carlo simulations [ 15 ]. From a security point of view, TRNGs are particularly important because they are typically used to add freshness to cryptographic algorithms.…”