Ortiz-Martin Lara, Picazo-Sanchez Pablo, Peris-Lopez Pedro, Tapiador Juan
Department of Computer Science, Carlos III University of Madrid, 28911 Leganés, Spain.
Department of Computer Science and Engineering, Chalmers University of Technology∣Gothenburg University, 41296 Gothenburg, Sweden.
Entropy (Basel). 2018 Jan 30;20(2):94. doi: 10.3390/e20020094.
The proliferation of wearable and implantable medical devices has given rise to an interest in developing security schemes suitable for these systems and the environment in which they operate. One area that has received much attention lately is the use of (human) biological signals as the basis for biometric authentication, identification and the generation of cryptographic keys. The heart signal (e.g., as recorded in an electrocardiogram) has been used by several researchers in the last few years. Specifically, the so-called Inter-Pulse Intervals (IPIs), which is the time between two consecutive heartbeats, have been repeatedly pointed out as a potentially good source of entropy and are at the core of various recent authentication protocols. In this work, we report the results of a large-scale statistical study to determine whether such an assumption is (or not) upheld. For this, we have analyzed 19 public datasets of heart signals from the Physionet repository, spanning electrocardiograms from 1353 subjects sampled at different frequencies and with lengths that vary between a few minutes and several hours. We believe this is the largest dataset on this topic analyzed in the literature. We have then applied a standard battery of randomness tests to the extracted IPIs. Under the algorithms described in this paper and after analyzing these 19 public ECG datasets, our results raise doubts about the use of IPI values as a good source of randomness for cryptographic purposes. This has repercussions both in the security of some of the protocols proposed up to now and also in the design of future IPI-based schemes.
可穿戴和植入式医疗设备的激增引发了人们对开发适用于这些系统及其运行环境的安全方案的兴趣。最近备受关注的一个领域是将（人类）生物信号用作生物特征认证、识别和生成加密密钥的基础。在过去几年中，有几位研究人员使用了心脏信号（例如，心电图记录的信号）。具体而言，所谓的脉搏间期（IPIs），即两个连续心跳之间的时间，已被多次指出是潜在的良好熵源，并且是各种近期认证协议的核心。在这项工作中，我们报告了一项大规模统计研究的结果，以确定这样的假设是否成立。为此，我们分析了Physionet存储库中的19个心脏信号公共数据集，这些数据集涵盖了1353名受试者在不同频率下采样的心电图，时长从几分钟到几小时不等。我们认为这是文献中分析的关于该主题的最大数据集。然后，我们对提取的IPIs应用了一组标准的随机性测试。根据本文所述的算法，在分析了这19个公共心电图数据集之后，我们的结果对将IPI值用作加密目的的良好随机性来源提出了质疑。这对迄今为止提出的一些协议的安全性以及未来基于IPI的方案的设计都有影响。
