Privacy and Security Issues in Brain Computer Interface
Total Page:16
File Type:pdf, Size:1020Kb
Privacy and security issues in Brain Computer Interface Kaushik Sundararajan A thesis submitted to the graduate faculty of Design and Creative Technologies Auckland University of Technology in partial fulfilment of the requirements for the degree of Master of Information Security and Digital Forensics School of Engineering, Computer and Mathematical Sciences Auckland, New Zealand 2017 i Declaration I hereby declare that this submission is my own work and that, to the best of my knowledge and belief, it contains no material previously published or written by another person nor material which to a substantial extent has been accepted for the qualification of any other degree or diploma of a University or other institution of higher learning, except where due acknowledgement is made in the acknowledgements. Kaushik Sundararajan ii Acknowledgements I would like to thank Auckland University of Technology for the opportunity to utilize my knowledge and hone my skills. I am in debt to my parents for giving me the chance to study in this esteemed university. They have been through many struggles to get me to this university and I will always be thankful for that. A special thanks to my supervisor Dr. Brain Cusack who has been the best supervisor I could have ever asked for. His guidance has been invaluable to get my thesis completed successfully. I am grateful to him for sharing his experiences. I am very fortunate to have had the opportunity to learn a great deal. I would like to thank Mr. Bryce Coad, my second mentor for the thesis. His support for my studies and the advice on the choices for the hardware and software is greatly appreciated. I also want to thank Dr. Alastair Nisbet to have accepted me in to this exciting course of MISDF. Finally, I would like to thank my friends Suraj and Shardul for having motivated me whenever I hit a dead end. iii Abstract Technologies that utilize the human brain energies for control have expanded in number and ease of use. A greater number of Brain-Computer Interfaces (BCIs) are being used in restorative and nonmedical fields, including advertising, gaming and media outlets. BCI- empowered innovation has an incredible potential to enhance and improve the quality of human lives. The BCI examined for this thesis is the Emotiv Insight, a 5 channel EEG headset used for monitoring brain activity and to control external devices such as, electronic wheelchairs and robotic arms. The functionality of BCIs is increasing in terms of treating motor disabilities, and enhancing abilities of users by extending their range of communication. The current problem is the consideration of security and privacy of the information being transmitted by the BCI technologies. The checks for the security and privacy in the use of the headsets and the devices, and the pairing connection, are not a high priority when utility is the design objective. This research study analyzed the various possibilities to capture information transmitted from the BCI and tested the feasibility for attacks, and vulnerability identification. The threats described in the study create an awareness of the implications for improved BCI security designs and for greater care in the production of the headsets so that privacy issues may be addressed. Systematic testing of the BCI technologies for security and privacy vulnerability is required before use. The research question pursued in this research is “What are the security and privacy vulnerabilities for information in the use of Brain Computer Interface devices?”. The developers of the hardware and the applications need to shift their focus from creating device longevity and portability, and consider the broader risks that include malicious intervention and service disruption. The successful attacks described in this research can be mitigated if manufacturers accept the performance costs associated with implementing the BLE 4.2 security standard in preference for the cheaper and more efficient BLE 4.0 standard that is generally used in the headsets. A comprehensive framework is required for developers to follow for better risk management and end-user protection. The research findings showed that with readily available basic hardware tools, information can be captured, read and manipulated. In addition, various types of attacks can be performed on the identified vulnerabilities and the intended purpose of the iv technology disrupted, changed, and corrupted. The implications of these findings are important for the users and their safety. The different types of attacks achieved in the laboratory included the following: • Passive eavesdropping: Listening to information transferred to the smartphone application from Emotiv Insight without the user’s knowledge. • Active interception: Interception of active information sent from the application to the headset. The intercepted data could be dropped or chosen to forward to the headset. • Denial of service: The connection of the Emotiv Insight to the smartphone application could be jammed by advertising bogus data packets. • Data modification attack: The intercepted data could be modified to a different data and forwarded to the Emotiv Insight to perform a different task. The importance of this thesis is to highlight the impact of the attacks and the level of damage that can be caused. It also points towards harm that may be caused to users dependent upon this technology for their daily life functionality. EEG headsets such as the Emotiv Insight are becoming increasing popular in terms of usability and functionality, and are easy to purchase. The EEG headsets have been used for medical applications, gameplay, learning, and in a wide variety of control situations. This research emphasizes the vulnerabilities in the devices that may be exploited and cause potential harm to users. The designers, developers, and manufacturers of these devices need to pay greater attention to protecting the confidentiality and integrity of information critical to the intended functionality. v Table of Contents Table of Figures ............................................................................................................ viii List of Tables ................................................................................................................... x Chapter 1 INTRODUCTION ..................................................................................... 11 1.0 INTRODUCTION .......................................................................................................... 11 1.1 MOTIVATION FOR RESEARCH ............................................................................... 11 1.2 RESEARCH APPROACH AND FINDINGS .............................................................. 13 1.3 THESIS STRUCTURE .................................................................................................. 16 Chapter 2 LITERATURE REVIEW ......................................................................... 18 2.0 INTRODUCTION .......................................................................................................... 18 2.1 HUMAN BRAIN ............................................................................................................. 19 2.1.1 Human Brain – The Anatomy ................................................................................... 19 2.1.2 Electroencephalography [EEG] ................................................................................. 23 2.1.3 Human Brain Mapping and EEG .............................................................................. 25 2.2 BRAIN COMPUTER INTERFACE: BRAINWEAR ................................................. 26 2.2.1 Mental Control Signals .............................................................................................. 29 2.2.2 BCI Hardware ........................................................................................................... 29 2.2.3 BCI Software ............................................................................................................. 32 2.2.4 BCI2000 .................................................................................................................... 34 2.3 SOCIAL APPLICATIONS OF BRAINWEAR ........................................................... 35 2.3.1 Emotiv Insight application ........................................................................................ 36 2.3.2 Parameters of Emotiv Insight .................................................................................... 36 2.3.3 Gaming using BCI ..................................................................................................... 37 2.3.4 Clinical Applications of BCI ..................................................................................... 38 2.3.5 BCI tools ................................................................................................................... 39 2.3.6 Challenges and Disadvantages .................................................................................. 41 2.3.7 BCI Standards ........................................................................................................... 42 2.4 POTENTIAL SECURITY AND PRIVACY ISSUES ................................................. 43 2.4.1 Security and Privacy Issues ....................................................................................... 43 2.4.2 Lie Detection and polygraph ..................................................................................... 45 2.5 SUMMARY OF ISSUES AND