The effect of ECG data variability on side-channel attack success rate in wearable devices

Abstract

As the connectivity and number of health monitoring devices has increased dramatically in recent years, various security issues have become a serious threat to the integrity of patient data. Side-channel attacks are particularly dangerous for these devices because they do not rely on the mathematical complexity of the cryptographic algorithm, but instead exploit physical information leakage. In this work, we analyze electromagnetic and power side-channel attacks on portable electrocardiogram (ECG) monitoring devices. Unlike other work that uses random data, we analyze attacks based on real ECG data and show that the data distribution significantly affects the success rate of the attacks. We build a wearable ECG garment that records a single-lead ECG and sends it to a low-power microcontroller for encryption using AES. The results show that the first-round attack success rate is strongly influenced by the number of bits used to encrypt each ECG sample and the intensity level of the patient’s physical activity. More intense activity produces more artifacts in the ECG that increase the overall signal variability. An increase in variability generally results in an 86% reduction in the number of power samples required for an attack. The final attack also shows a dependence on input variability, but to a lesser extent. Input data with higher variability reduces the number of traces required for this attack by up to 50%, and the attack only becomes unsuccessful in the presence of extremely high levels of noise during the ECG recording. Based on these results, mitigation measures that exploit a change in signal variability are proposed.