Implantable medical devices (IMDs), such as pacemakers, implantable cardioverter defibrillators, or insulin pumps are widely deployed and evolving at a rapid pace [1]. Modern IMDs typically rely on a wireless interface to communicate with external devices. For instance, doctors use programmer devices to reprogram the patient’s IMD (eg, to change the patient’s therapy) and gather telemetry data. Such wireless connectivity can bring about much convenience to patients and doctors. However, it also poses new security and privacy threats, such as eavesdropping on sensitive medical data or hijacking life-critical functions. The consequences of such attacks can be severe because they can cause serious injuries or even death. However, these risks have often been overlooked. While no real-world attack against an IMD has been confirmed to date, previous research has demonstrated that many IMDs available on the market today severely lack effective security mechanisms, and that attacks on patients would be practically possible [2-6].

To protect wireless communication links, it is essential for the IMD and external device to undergo a pairing process. This process aims to exchange a cryptographic key between them, which can then be used to secure the wireless channel using standard protocols [7]. However, implementing such a key exchange in a secure manner is challenging because IMDs are resource-constrained with limited memory, computational power, and nonrechargeable and nonreplaceable batteries. Moreover, IMDs do not have physically accessible input or output interfaces, such as a keyboard or a screen once they are implanted. This obstructs traditional pairing methods used in technologies like Bluetooth, where manually typing a 4-digit PIN code on the devices is a standard procedure [8]. Furthermore, network connections with these devices can be ad-hoc. For instance, in an emergency (eg, patients with cardiac implants can experience syncope symptoms and become unconscious [9]), a doctor may quickly have to use a new programmer device to connect to the patient’s IMD. Due to these limitations of IMDs, conventional pairing techniques (such as the ones based on symmetric or public keys [10]) are often not a viable option [5,11].

Previous work has proposed a variety of pairing techniques to overcome this challenge [12]. Rasmussen et al [13] propose an approach where the IMD and external device send ultrasound to each other to verify each other’s legitimacy and exchange a key. Marin et al [5] and Tomlinson et al [14] propose a pairing method by transmitting a low alternating current through the patient’s skin and tissue. Denning et al [15] and Gollakota et al [16] propose to delegate security to a proxy device that the patient can carry around (such as a bracelet). [17-20] propose a pairing process by the IMD and external device synchronously and simultaneously measuring a human physiological signal (such as heartbeats).

Across those previous approaches, a crucial aspect has been systematically overlooked: user perception. We observe that previous work has attempted to follow a “seamless” design approach that makes the IMD pairing as unobtrusive as possible to the patient, rendering the pairing process almost imperceptible at the same time. This can prevent patients from detecting unexpected pairing attempts made by adversaries in proximity, thereby hindering their ability to appropriately respond to such security threats, for example, by seeking assistance or fleeing the scene. Although the “seamless” design principle is common in everyday security systems [21], we question its suitability in the IMD context, where the device is part of the patient, and its security is life-critical.

To address this issue, a pairing protocol needs to incorporate a perceivable and robust (ie, cannot be hidden or canceled by an adversary) signal. This leads us to consider vibration as an out-of-band (OOB) channel (ie, a communication channel other than a wireless channel) for pairing (Figure 1). Vibrations are highly perceivable and have been widely used in smart consumer devices for notification services [22]. In addition, accelerometers, the primary type of vibration receiver used in previous approaches, are already present in state-of-the-art IMDs for medical purposes [23-25]. Another advantage of using vibration is its limited range of reliable reception. In the IMD context, this implies that if an external device intends to transmit a vibration to an IMD, it must be physically attached to the patient’s skin for a while [26]. If an adversary overpowers the signal with a very strong vibration from a distance, the patient can easily notice this.

The objective of this paper is to explore the potential of using vibration for pairing with resource-constrained IMDs. This study aimed to (1) propose a novel technique that leverages vibration to extract secrets from the naturally random human motor behavior for pairing, (2) develop a prototype as a proof-of-concept to demonstrate our technique, and (3) evaluate our prototype’s accuracy, security, and usability in a lab study involving 24 participants.

The pairing process requires the user (patient or doctor) to repeatedly attach the external device to the patient’s body (near the IMD’s location) for a few times. In this work, each repetition was referred to as a cycle, and the complete pairing process (including several cycles) was defined as a run. Each cycle comprises three main steps:

The security of pairing relies on the randomness of the shared secret, which originates from the diverse physiological characteristics of the human body as well as the inherent variability of human behavior (eg, the varying attachment position and the grip strength) [45]. The vibration signal itself remains constant in each cycle and is not a source of randomness. Instead, it serves as a “catalyst” that allows the randomness of body and motion to be reflected in the accelerometer measurements.

The design of vibration strategy in each cycle—namely, the control of the motor to vibrate at a certain frequency for a certain time frame—is crucial. The feasibility of the aforementioned work [31] was first explored in the context of IMDs. The exact same experimental settings were replicated using our prototype that simulates the human body environment (elaborated in the following sections): the accelerometer sampling rates of the external device and IMD are set as 250 Hz. In each cycle, the motor is programmed to sweep between 20 Hz to 125 Hz within 1.75 seconds. During this period, 2 devices measure the z-axis acceleration data (aligning with the user’s sagittal plane) and subsequently generate the frequency spectrum by doing fast Fourier transform (FFT) [46].

One researcher of the team performs 100 cycles as a preliminary test. The results are shown in Figure 2 (the locations of the resonant frequency peaks shared by both devices were regarded as secrets in [31]). Among all, 72 cycles show one stable peak; 17 cycles have 2 common peaks; 2 possess 3 peaks; in 9 cycles, the data is too noisy to capture any shared peaks. The results differ significantly from [31] where an average of 4‐8 peaks can be obtained per cycle. In addition, the peaks in [31] are somehow uniformly distributed over the whole 20‐125 Hz range, while ours are almost always in the range of 80‐110 Hz. Our interpretation for the discrepancy in the performance of this strategy is the presence of the plastic board and shell in our prototype setup, which “masks” the resonant frequencies of the human body. Unfortunately, in the context of IMD pairing, the existence of such components (eg, a plastic or metal device housing) is inevitable.

Nevertheless, the above test implies the natural randomness inherent in the user attachment motions. Intuitively, we want to test if a constant-frequency vibration is a viable option. We program the motor to emit a 50 Hz vibration for 1 s per cycle, and the same researcher executes 100 cycles using our prototype. For each cycle, we collect z-axis acceleration data from both devices and generate the frequency spectrum using FFT. Figure 3 shows an example of the frequency spectrum in one cycle. It was observed that 2 devices can obtain very similar data, especially for a prominent amplitude peak. Figure 4 illustrates the spectrum change of the IMD over ten consecutive cycles. Each row in this figure corresponds to a frequency spectrum obtained in 1 cycle, and the bright spots indicate the prominent peaks on the curve. We observe that the peak locations vary around 50 Hz, suggesting the presence of a degree of randomness. These findings indicate that providing an excitement of a constant-frequency vibration, the prominent peak location in the frequency domain is a potentially qualified shared entropy source between the IMD and the external device, which can be used for pairing purposes.

Figure 5 shows the workflow of our pairing technique (assuming the IMD is a pacemaker). In each cycle, the patient holds the external device and attaches it on their chest. During the attachment, the motor vibrates, and both the IMD and the external device measure a pair of z-axis acceleration data.

To remove the noise of the direct current component, each device subtracts the acceleration data with its mean value. In addition, when the vibration motor is switched on from standstill or switched off, the generated vibration signal is not amplified or attenuated immediately but with a slow and damped response [26,27]. This means that the transition parts (ie, 2 ends) of a vibration signal segment are often noisy. This is addressed by applying a Hanning window on the data.

Subsequently, each device applies FFT on the acceleration signal to obtain the frequency spectrum. The frequency range of 0 to 20 Hz is then excluded to avoid the effects of noisy motion artifacts like human breathing movements, as well as ambient vibrations present in the patient’s environment [47]. As mentioned, there is a prominent amplitude peak in the frequency spectrum. In order to detect the location of this peak, each device simply traverses the frequency domain to find the frequency value corresponding to the maximum amplitude.

Based on the above procedure, after the user completes a pairing (ie, a run) by repeating the attachment for several times, each of the 2 devices will possess a sequence of peak locations. However, these sequences may not be exactly the same due to the measurement noise and human error (eg, hand wobbles). To resolve this, the peak locations are encoded into binary format using Gray code [48]. This coding method ensures minimal bit mismatches if the discrepant peak locations are very close on 2 devices, which is the case of our technique. Then, we use a cryptographic algorithm known as a fuzzy extractor [11,49] to reconcile any remaining bit differences between the 2 bitstrings without revealing the secret itself. If the rate of bit mismatches falls within the error-correcting capability of the fuzzy extractor, the IMD and the external device agree on an identical bitstring as a shared secret.

Given our review of relevant literature about IMD pairing techniques [3,12,13,16,19,40,50], we assume a sophisticated adversary following the Dolev-Yao model [51] who has full knowledge of our pairing protocol, has full control over the wireless communication channels, and can be a man-in-the-middle (MITM) attacker by intercepting legitimate devices’ signals and sending their own messages instead. In particular, the adversary can launch the following attacks relevant in the context of our pairing technique: (1) impersonation attack: the adversary uses a sequence of peak locations in an attempt to impersonate a legitimate device. They could succeed if their sequence closely matches the one measured by the IMD or external device. (2) Brute-Force attack: the adversary brute-forces possible peak location sequences and launches MITM attacks to decipher and manipulate the communication between legitimate devices. The brute force can be done online, that is, during the pairing process, the adversary tries every possible sequence until they hit a correct one. Alternatively, this can be done offline, where the adversary records the pairing traffic and performs offline analysis to crack the secret after pairing. (3) Acoustic eavesdropping: The adversary may also attempt to eavesdrop on the vibration signals using a microphone near the patient to reveal the secret.

The proposed pairing technique was validated through the design and testing of the prototype in a user study. It was assumed that the IMD is a pacemaker implanted beneath the chest and considered the external handheld device to resemble a smartphone with a plastic casing. Moreover, both devices contain an accelerometer, and the external device is equipped with a vibration motor.

We show an overview of our prototype in Figure 6A. The prototype consists of three main parts:

We first conducted a pilot study with 6 individuals (ages 22 to 32 years, 4 females and 2 males) to identify and resolve any problems with our experimental setup. Subsequently, we recruited 24 participants for the main study, including 11 males and 13 females of ages ranging from 18 to 52.

Moreover, given that patients who carry IMDs are often seniors [56], we also conducted a co-design workshop with 2 senior individuals who had intimate knowledge and experience with pacemakers: (1) a 74-year-old female cardiology doctor and (2) a 79-year-old male pacemaker patient.

In total, 2 essential vibration settings, frequency, and duration, were manipulated to measure the effect on pairing performance. Based on experiences gained from our pilot study, we set vibration motor frequencies to 50 Hz, 75 Hz, and 100 Hz, and vibration durations to 400 ms, 700 ms, and 1000 ms. The 9 frequency–duration combinations enabled successful pairing and avoided excessive participant workload.

During the user study, participants were instructed to wear our prototype and sit on a chair. Then they need to grasp the external device simulator and repeatedly attach it to the black pocket area of the chest strap, as shown in Figure 6D. They were advised to attach the device in a random manner (such as to random positions), and (in each cycle) stay attached until the vibration had completely ceased. Before starting the data collection, participants were asked to acquaint themselves with the prototype to understand the pairing process. This introductory process took under a minute for all participants. Subsequently, for each of the 9 vibration conditions, participants were asked to conduct the attachment for 5 consecutive cycles as one run and complete 4 such runs in total. The order in which participants used different vibration frequencies was counterbalanced.

At the end of the user study, participants were requested to fill out a standard system usability scale (SUS) questionnaire [57] to assess the usability of the pairing method. We then conducted an interview with them to gather further insights. Full details of the questionnaire and interview are given in Multimedia Appendix 1.

During the co-design workshop, we asked the two senior participants to try our prototype for only 6 runs (considering their physical conditions) and provide their opinions and advice.

Our study focuses on certain metrics to evaluate the pairing performance.

This study involved human participants and underwent thorough ethical review, particularly given the potential involvement of older participants. Ethics approval was obtained from the relevant institutions prior to participant recruitment and user study, in accordance with institutional regulations (the University of Melbourne: approved by the Human Ethics Committee, application number: 2022-24851-31088-3; the University of Birmingham: approved by the Science, Technology, Engineering and Mathematics Ethics Committee, application number: ERN_2022‐0255).

Participants were recruited via online advertisements and were offered US $30 for their time. All participants provided informed consent prior to participation. The data collected during the user study were specifically processed to ensure anonymity and untraceability of identity and were securely stored in the University of Melbourne’s data center. All participant data were anonymized by removing personally identifiable information before analysis, and participants were assigned unique identification codes to ensure confidentiality. The entire user study process was overseen by a departmental delegate of the university’s ethics committee, with all study details reported to them on a weekly basis.

Figure 7 shows the distribution of all peak locations (ie, the secret) collected by the IMD from 24 participants. We observe that for a specific vibration frequency, such as 50 Hz, the peak locations range between 30 and 70 Hz and generally approximate a normal distribution centered by the motor’s frequency, suggesting a certain degree of randomness from the user. Additionally, it appears that the distribution is slightly flatter (thereby the level of randomness increases) with an increase in vibration frequency. Notably, the possible options for peak locations in the frequency domain are not continuous due to the sample-based nature of the time domain acceleration data.

Mismatch is calculated by subtracting peak location values between the IMD and the external device and represents the level of noise and error. The mismatch distribution for our prototype, as illustrated in Figure 8A, resembles a normal distribution centered around a mean near zero and with a standard deviation of 2.8 Hz. This implies that user-induced errors and sensor noise are limited. Note that this result considers situations where participants did not strictly follow our pairing norms during the study. For instance, there were a number of occasions when participants released the external device while it was still vibrating. Such cases were not excluded from our dataset as they present a more realistic use scenario; otherwise, we expect that the mismatch levels would be even lower. On the other hand, Figure 8B and C show that the degree of mismatch does not have a straightforward correlation with either the vibration frequency or the duration.

Our work introduces a new and reliable vibration-based pairing approach for IMDs, which only requires a low sampling rate accelerometer and relies on the natural randomness inherent in human behavior. We empirically validate the feasibility of our technique through a user study. Overall, we find that the workload required to bootstrap a secure pairing is minimal, and we estimate that it requires the user to attach a device to the body only 4 times in roughly 5 s. With an FAR of 0 and an FRR of 0.6%, the risk posed by adversaries is low, and legitimate users will likely experience very few failures.

As mentioned in the related work section, the use of a PAKE eliminates offline brute-force attacks. In addition, it also restricts the number of online MITM attempts. Typically, the adversary has a very limited period to obtain the secret and usually only one chance for a MITM attack [44]. As an estimate, 4 motions with 15.5 bits entropy reduce the adversary’s success probability on online brute-force attacks to 0.002% [42] (assuming the adversary is limited to guessing only). Therefore, we believe these motions serve as adequate input for a PAKE. If needed, higher entropy can be easily achieved by performing more motions.

Our user study confirmed the high usability of our pairing method. Participants found it straightforward to understand, learn, and perform. The process of attaching the device is very intuitive, like using a stethoscope as described by the participants. Our technique also brings about certain entertainment to users, being both relaxing and enjoyable (such as described as hand massage). This could be advantageous in certain therapeutic treatments, where physical interaction can enhance memory, concentration, and mental health [64]. Moreover, it is worth noting that for patients who are unable (eg, due to disabilities or unconsciousness in emergencies) or unwilling to execute the motions, our pairing allows medical practitioners or caregivers (who have received appropriate training) to execute the motions on the patient’s body on their behalf.

Our proposed method only requires an accelerometer, a component already present in the latest generation IMDs [23-25]. The signal processing and other cryptographic algorithms for the IMD are computationally lightweight and work efficiently on 32-bit Cortex-M microcontrollers, which closely resemble IMDs’ capabilities [11,43,53]. Our approach solely depends on vibration at a constant frequency, which can be easily implemented on readily available consumer devices such as smartphones and tablets. This is beneficial considering that medical device companies already equip the IMDs with the ability to connect to personal mobile devices [65]. Moreover, while our work assumes that the IMD is a pacemaker, we argue that the technique can be easily transferred to other types of IMDs or even external wearables. Furthermore, our proposed pairing technique incurs minimal costs. In our prototype implementation, the combined cost of the vibration motor and accelerometer was under $30, and this cost could be further reduced during mass production.

Our pairing technique significantly relaxes the demands on the IMD’s sampling capability. We use an accelerometer operating at 250 Hz, in contrast to previous work that often relies on sampling rates of several thousand Hz or more. In particular, the sampling rate can be further decreased by using lower vibration frequencies. For example, with a 50 Hz vibration, the frequency domain peaks cluster between 30 and 70 Hz (see Figure 7), indicating that an accelerometer with a 140 Hz maximum is adequate.

Conventional approaches typically try to avoid user-generated noise. For instance, the user needs to ensure stable contact between devices during data transmission. Conversely, our method harnesses user noise and benefits from it as a source of entropy. Indeed, our dataset includes many instances with significant user error, like when a participant releases the external device before the vibration completely stops. In such scenarios, the IMD only captures a portion of the vibration within its measurement window. Despite this, our technique maintains high reliability.

Furthermore, previous work that encodes secrets into vibrations often demands precise time synchronization in milliseconds between devices, which itself is a challenging task for resource-constrained devices [66]. In contrast, our approach allows for more lenient synchronization—as long as the two devices capture similar vibration signals within most of their measurement windows, the peak locations effectively match. This aspect greatly enhances the feasibility of our technique for IMDs.

Notably, our data throughput is significantly lower than [26,27,29,32] and is comparable with [31,33]. Considering the scenario of transmitting a 4-digit PIN code for use in a PAKE, previous work [26,27,29,32] only needs 0.0004 to 0.665 s, which is much faster than the 4.8 seconds required by our method. However, this rapid transmission, while advantageous in many daily applications, may not be suitable for IMD pairing contexts, where the vibration serves not only for secret exchange but also as a crucial cue for patients to be aware of the pairing process. In contrast, we argue that a duration of 4.8 s strikes a balance: it is long enough to be noticeable, yet short enough to maintain usability and safety in emergencies.

Our proposed pairing technique incorporates vibration, a feature that naturally raises concerns regarding the potential long-term health impacts on patients. However, current research indicates that only long-term and excessive exposure to vibrations is linked to adverse effects on mental and physical health [67,68]. In contrast, our method involves brief vibrational interactions, which last less than 5 seconds and may not occur every day. This limited exposure could reduce the likelihood of the negative health consequences.

Vibration is essentially a low-frequency audio signal, which inevitably emits acoustic side-channel information that might be eavesdropped using a microphone. This is particularly threatening for methods that encode secrets within vibration signals. For example, Halevi and Saxena [69] found that secrets transmitted this way could be severely compromised using an off-the-shelf microphone from a few meters away. To mitigate this, Kim et al [26] and Anand and Saxena [70,71] proposed using Gaussian white noise or masking signals to obscure the acoustic leaks. These approaches have shown promise in reducing side-channel vulnerabilities against advanced eavesdropping attacks.

In comparison, as shown in [31], the risks associated with eavesdropping are significantly reduced when the vibration is not the carrier of the secret. Our research aligns with this guideline, using a constant vibration signal across sessions to minimize acoustic leakage. In addition, existing countermeasures [26,70,71] are also applicable to our method.

Our work has certain limitations. Our experiments did not explicitly recruit participants who were IMD patients (mainly due to ethics constraints of the institutions where the user study was conducted). Further validation of our approach with these patient groups is necessary.

We designed our prototype in line with previous work in the IMD security community [5,26,40]. However, there is room for enhancement, particularly in its size and weight. Future research should develop more skin-conformable and miniaturized prototypes.

Another aspect of future work is to empirically evaluate the susceptibility of our pairing technique against microphone-based eavesdropping attacks at a distance.

In this paper, we explore the potential of leveraging vibration to pair with an IMD. We propose a novel technique that uses a straightforward constant-frequency vibration to extract secrets from natural and random human motor behavior for device pairing. We implement and validate our technique through a user study. Overall, we show that it is feasible to establish a cryptographic key in 5 s with high usability, based only on standard vibration motors and accelerometers with low sampling capabilities. The ubiquity of accelerometers in today’s commercial smart devices and IMDs maximizes the chance of acceptance of our design. In general, we hope that our work will serve as a reference for pairing with resource-constrained devices using vibrations in body area networks.