The time interval between consecutive heartbeats (interpulse interval, IPI) has previously been suggested for securing mobile-health solutions. This time interval is known to contain a degree of randomness, permitting the generation of a time- and person-specific identifier. It is commonly assumed that only devices trusted by a person can make physical contact with him/her, and that this physical contact allows each device to generate a similar identifier based on its own cardiac recordings. Under these conditions, the identifiers generated by different trusted devices can facilitate secure authentication. Recently, a wide range of techniques have been proposed for measuring heartbeats remotely, a prominent example of which is remote photoplethysmography (rPPG). These techniques may pose a significant threat to heartbeat-based security, as an adversary may pretend to be a trusted device by generating a similar identifier without physical contact, thus bypassing one of the core security conditions. In this paper, we assess the feasibility of such remote attacks using state-of-the-art rPPG methods. Our evaluation shows that rPPG has similar accuracy as contact PPG and, thus, forms a substantial threat to heartbeat-based-security systems that permit trusted devices to obtain their identifiers from contact PPG recordings. Conversely, rPPG cannot obtain an accurate representation of an identifier generated from electrical cardiac signals, making the latter invulnerable to state-of-the-art remote attacks.

The Inter-Pulse-Interval (IPI) of heart beats has previously been suggested for facilitating security in mobile health (mHealth) applications. In heart-beat-based security, a security key is derived from the time difference between consecutive heart beats. As two entities that simultaneously sample the same heart beats may generate the same key (with some inter-key disparity), these keys may be used for various security functions, such as entity authentication or data confidentiality. One of the key limitations in heart-beat-based security is the low randomness intrinsic to the most-significant bits (MSBs) in the digital representation of each IPI. In this paper, we explore the use of a von Neumann entropy extractor on these MSBs in order to increase their randomness. We show that our von Neumann key-generator produces significantly more random bits than a non-extracting key generator with an average bit-extraction rate between 13.4% and 21.9%. Despite this increase in randomness, we also find a substantial increase in inter-key disparity, increasing the mismatch tolerance required for a given true-key pair. Accordingly, the maximum-attainable effective key-strength of our key generator is only slightly higher than that of a non-extracting generator (16.4 bits compared to 15.2 bits of security for a 60-bit key), while the former requires an increase in average key-generation time of 2.5x.