Cybersecurity on Brain-Computer Interfaces

Résumé

Brain-Computer Interfaces (BCIs) are systems that permit the interaction between the brain and external devices, allowing both the acquisition of neural data and neurostimulation actions. These interfaces are widely used in medical scenarios, both for diagnostics and neurostimulation therapy, although in recent years, they have gained popularity in other areas such as entertainment. Additionally, invasive BCI technologies, which place electrodes within the skull to improve both acquisition and stimulation resolutions, are evolving towards the miniaturization of the technology, aiming to target the brain with single-neuron resolution. Despite the advantages of novel BCI technologies, they also present cybersecurity concerns. Cyberattackers could exploit vulnerabilities in BCIs to access highly sensitive data or to perform malicious stimulation actions to cause physical damage to patients. In this context, the main objective of this PhD Thesis is to investigate cybersecurity aspects of BCIs, identifying cyberattacks applicable to different dimensions relevant to BCI, the impact they cause, and possible countermeasures to mitigate them. Moreover, this work aims to study the feasibility of cyberattacks aiming to stimulate or inhibit specific neurons of BCI users in a particular way, analyzing the impact they could cause on spontaneous neural signaling. Based on this objective, the first publication of this thesis reviewed the state of the art of cybersecurity on BCI, documenting attacks, impacts, and countermeasures for both the stages of the BCI cycle and common architectural approaches. Finally, this work provided an analysis of the trend of these technologies and the challenges that they will face in the near future. The second publication detected vulnerabilities in next-generation neurostimulation BCIs. Based on them, we presented two neural cyberattacks, Neuronal Flooding (FLO) and Neuronal Scanning (SCA), able to stimulate a set of neurons. For that, we evaluated their impact on spontaneous neural signaling based on the definition of several metrics. The results presented showed that both attacks could considerably affect neural activity. Moreover, the third publication presented an additional cyberattack, Neuronal Jamming (JAM), which aims to inhibit neural activity. In this work, we simulated the impact that this cyberattack can cause on spontaneous neural activity, in addition to its impact on decision-making ability. This work concluded that this attack could effectively disrupt neural activity. Finally, the last work of this thesis presented a taxonomy of neural cyberattacks, introducing five new cyberattacks. Neuronal Selective Forwarding (FOR) consists in sequentially inhibiting neurons without repetitions along time, while Neuronal Spoofing (SPO) exactly replicates the activity recorded in a previous temporal window. Neuronal Sybil (SYB) forces a neuron to have the opposite voltage within the natural voltage range of a neuron. In contrast, Neuronal Sinkhole (SIN) consists in stimulating neurons from early cortical layers aiming to affect a particular neuron located in a deeper layer. Finally, Neuronal Nonce (NON) aims to attack a set of neurons in a given instant, deciding randomly for each one to stimulate or inhibit. Finally, this work compared the impact of these cyberattacks over the short and long terms. In summary, this PhD Thesis has first analyzed the state of the art regarding cybersecurity on BCI, documenting gaps and opportunities for improvement. Based on that, this work has presented a taxonomy of eight neural cyberattacks, studying their impact on spontaneous neural activity.