Background: security risks of wireless medical devices
In 2007, former U.S. vice president Dick Cheney ordered physicians to turn off wireless signals connected to his networked pacemaker. Cheney later said the decision aimed to prevent terrorists from remotely accessing his pacemaker and delivering a lethal shock. His orders were cautious, but wireless-connected medical devices have shown exploitable vulnerabilities. For example, at conferences in 2011 and 2012, New Zealand hacker Barnaby Jack demonstrated that networked medical devices could be remotely attacked. Jack used a high?gain antenna to capture unencrypted electromagnetic signals transmitted from an insulin pump on a manikin 90 meters away, then used those signals to compromise the pump and alter its insulin delivery. He also compromised a pacemaker and induced a dangerous shock. Eight years after those demonstrations, networked medical devices remained vulnerable. In June 2020, U.S. authorities recalled a networked insulin pump that transmitted sensitive information without encryption, allowing anyone nearby to access the data. Medical devices are only part of the picture. Many wireless devices are on or in the body, including wireless earbuds, smartwatches, and virtual reality headsets. Emerging technologies face similar risks, such as smart contact lenses that display information and ingestible digital pills that transmit sensor data. All these devices need low?power, short?range secure data transfer. Researchers therefore treat them as body?scale wireless networks—body area networks. The concept of the Internet of Things (IoT) has extended into the Internet of Bodies (IoB), which addresses networked devices on and in the body. Currently, body devices typically use established wireless technologies such as Bluetooth. Although these technologies are low power, well understood, and easy to implement, they were not designed specifically for on?body networks. A key Bluetooth feature is enabling two devices several meters apart to discover and connect to each other, which also allows an attacker to eavesdrop on or attack devices worn on the body. Wireless technologies can transmit through air or vacuum as well, but they are less efficient than methods designed to remain confined to the body. Through research at Purdue University, we developed a new communication method that can make medical devices, wearables, and other on? or in?body devices more secure than devices that use low?power wireless signals. The system exploits the body’s ability to conduct tiny, harmless electrical signals and effectively turns the entire body into a wired communication channel. By using the body as the network medium, this approach reduces the risk that body device traffic will be intercepted.
Why local security matters beyond encryption
Sensitive personal medical data should be encrypted during transmission, whether by wireless, email, or other channels. But there are three additional reasons to prevent local attackers from compromising medical devices. First, medical data should be controlled. You do not want device broadcasts to be intercepted by others. Second, device integrity matters. For example, if a glucose monitor connected to an insulin pump is tampered with and sends corrupted data, the pump might deliver harmful insulin doses. Low blood glucose can cause headache, weakness, and fainting; excessive glucose can cause vision and nerve problems, nephropathy, stroke, or death. Third, device availability matters. If an attacker intercepts signals from an insulin pump or pacemaker, the device may fail to respond to sudden bodily changes. If security and privacy are so important, why not use wired connections? Cables can create a private channel between two devices that is difficult to tap. If a cable runs on or inside the body, interception becomes even harder. However, there are reasons to avoid wiring inside the body. Poorly insulated metal wires can corrode from the body’s biochemical environment, risking heavy?metal poisoning. There is also the inconvenience: repairing or replacing a wired pacemaker would require invasive procedures to rethread cables. Rather than choosing between potentially eavesdropped wireless signals and risky internal wiring, a third option combines their advantages: using the body itself as the communication medium. We call this approach electro?quasistatic body communication, or simply the body channel.
Principles of the body channel
The body channel uses the body’s conductive properties to avoid the main drawbacks of both wired and airborne wireless channels. Metals are excellent conductors for charge, and transmitting bits by encoding 1 and 0 as voltage levels is straightforward: define 1 as a certain voltage and let current flow, and define 0 as zero voltage with no current. By measuring voltage over time at the receiving end, one can recover the original bit sequence. But if we do not want metal wires to snake through the body, how can we do this? An adult’s body is roughly 60% water by mass. Pure water is not conductive, but the body’s water contains electrolytes, salts, and other conductive particles. Interstitial fluid—fluid under the skin and around cells—permeates the body and contains proteins, salts, sugars, hormones, neurotransmitters, and other molecules that support conductivity. Because interstitial fluid is widespread, two or more devices can establish a return path through many body locations. Consider a person with an insulin pump and a glucose monitor on the abdomen who wants a smartwatch to display blood glucose and pump status. Traditionally, these devices would communicate wirelessly, allowing, in principle, anyone to intercept and replay or tamper with data. Worse, many medical devices remain unencrypted, and even encryption does not guarantee complete security. In the body?channel approach, the pump, monitor, and smartwatch each have a small copper electrode that contacts the skin. Each device also has another electrode that does not touch the skin and serves as a floating ground, a local reference not directly connected to earth ground. When the monitor measures glucose, it encodes the measurement into a sequence of voltages and applies that voltage between its skin contact electrode and its floating ground electrode. The applied voltage slightly shifts the body’s potential relative to earth. The small potential change is only a fraction of the voltage between the monitor’s two electrodes and becomes smaller after traversing the body, but it remains detectable by other devices on the body. The pump at the waist and the watch at the wrist both sense the potential difference between their skin electrode and floating ground electrode. They convert those measured potentials back into data. During this process, the actual signal does not propagate beyond the skin.
Design challenge: selecting the right frequency
One of the biggest challenges is choosing the optimal signal wavelength for the electrical signals. The wavelengths considered here are much longer than those used in conventional radio frequency wireless communication. Choosing frequency is difficult because, in some frequency ranges, the body itself can act as an antenna. When alternating current causes electrons in an antenna material to oscillate and radiate electromagnetic waves, the antenna emits a signal. The frequency of emitted waves depends on the alternating current frequency. Similarly, driving the body with alternating current at certain frequencies causes it to radiate. Those emitted signals, although weak, can be received at a distance by suitable equipment. If the body acts as an antenna, it can also pick up unwanted external signals that interfere with on?body device communication. For the same reason we avoid Bluetooth?like technologies, we aim to confine electrical signals to the body rather than accidentally radiate them or receive external interference. We therefore avoid the frequency range that makes the body act as an antenna, roughly 10–100 MHz. Frequencies above that are standard wireless bands with their associated issues. The suitable range for body confinement lies roughly between 0.1 and 10 MHz, where signals remain largely restricted to the body. Early attempts to use the body for communication typically avoided these low frequencies because low frequencies often suffer high loss in human tissue, meaning more power is required to reach the receiver. In other words, a glucose monitor on the abdomen might not reach a wristwatch without significant power. Those earlier attempts focused on directly sending current signals rather than encoding information as potential changes. We found that parasitic capacitance between devices and the body is the key to creating a viable channel. Capacitance is the ability of objects to store charge. Parasitic capacitance arises unintentionally between two objects, such as between nearby conductors on a circuit board or between a hand and a phone. Although parasitic capacitance can be useful in some applications (for example, touchscreens), it is often unwanted. A critical circuit aspect is that electronic communication requires a closed loop. So far, we have discussed the forward path from transmitting electrode to receiving electrode, but a return path is also necessary. Thanks to parasitic capacitance between the devices’ floating ground electrodes and earth ground, a return path exists. Consider two loops. The first loop starts at the transmitting device’s skin electrode, traverses the body to the feet, reaches the earth, and then returns through air to the transmitter’s floating ground electrode. This is not a DC path, but because parasitic capacitances exist between arbitrary bodies and the environment—between feet and shoes, shoes and ground—small alternating currents can flow. The second loop starts at the receiving device’s skin electrode, traverses the body along the shared segment with the first loop to earth, and returns through air to the receiver’s floating ground electrode. The key is that the two loops share a section within the body. When the transmitter changes voltage across its electrodes, it induces tiny alternating currents in the circuit. The body and surroundings, behaving as capacitors with impedance, experience voltage changes. The receiving device’s electrodes detect these small potential variations and decode them into meaningful information. For robust operation, body devices should present a high capacitance to the body. If achieved, the transmitter can generate higher voltages while producing very low currents in the body. From a safety perspective this is important: we avoid high currents through tissue. High impedance and capacitive coupling also reduce channel loss because capacitors with high impedance are sensitive to small current variations. The result is that we can maintain low currents and safety while obtaining clear voltage measurements at the receiver. Compared with prior approaches that relied on current flow through the body, our technique reduces loss by about two orders of magnitude.
