# Security in Brain-Computer Interfaces: State-Of-The-Art, Opportunities, and
Future Challenges

Sergio López Bernal<EMAIL_ADDRESS>University of Murcia - Departamento de
Ingeniería de la Información y las ComunicacionesMurciaSpain ,  Alberto
Huertas Celdrán<EMAIL_ADDRESS>Waterford Institute of Technology -
Telecommunication Software and Systems Group,WaterfordIreland University of
Zurich - Department of InformaticsZurichSwitzerland ,  Gregorio Martínez Pérez
<EMAIL_ADDRESS>University of Murcia - Departamento de Ingeniería de la
Información y las ComunicacionesMurciaSpain ,  Michael Taynnan Barros
<EMAIL_ADDRESS>University of Essex - School of Computer Science and
Electronic Engineering,EssexUK Tampere University - CBIG/BioMediTech in the
Faculty of Medicine and Health TechnologyTampereFinland and  Sasitharan
Balasubramaniam<EMAIL_ADDRESS>Waterford Institute of Technology -
Telecommunication Software and Systems Group,WaterfordIreland RCSI University
of Medicine and Health Sciences - FutureNeuro, the SFI Research Centre for
Chronic and Rare Neurological DiseasesDublinIreland

###### Abstract.

Brain-Computer Interfaces (BCIs) have significantly improved the patients’
quality of life by restoring damaged hearing, sight, and movement
capabilities. After evolving their application scenarios, the current trend of
BCI is to enable new innovative brain-to-brain and brain-to-the-Internet
communication paradigms. This technological advancement generates
opportunities for attackers since users’ personal information and physical
integrity could be under tremendous risk. This work presents the existing
versions of the BCI life-cycle and homogenizes them in a new approach that
overcomes current limitations. After that, we offer a qualitative
characterization of the security attacks affecting each phase of the BCI cycle
to analyze their impacts and countermeasures documented in the literature.
Finally, we reflect on lessons learned, highlighting research trends and
future challenges concerning security on BCIs.

Brain-computer Interfaces, BCI, cybersecurity, privacy, safety

††copyright: acmcopyright††journal: CSUR††journalyear: 2020††journalvolume:
1††journalnumber: 1††article: 1††publicationmonth: 1††price: 15.00††doi:
10.1145/3427376††journal: JACM††journalvolume: 0††journalnumber: 0††article:
0††publicationmonth: 0††ccs: Security and privacy Domain-specific security and
privacy architectures

##  1\. Introduction

Brain-Computer Interfaces (BCIs) emerged in the 1970s intending to acquire and
process users’ brain activity to perform later specific actions over external
machines or devices (Li et al., 2015). After several decades of research, this
functionality has been extended by enabling not only neural activity recording
but also stimulation (Tyler et al., 2017). Figure 1 describes a simplification
of the general components and processes defining a common BCI cycle in charge
of recording and stimulating neurons (Chizeck and Bonaci, 2014; Ienca and
Haselager, 2016; Ahn et al., 2014), later presented in Section 2. It is
important to note that these phases are not standard, so we include the most
common ones used in the literature. The clockwise direction, indicated in
blue, shows the process of acquiring neural data, and the counterclockwise
represents the stimulation one, which is highlighted in red. Regarding the
neural data acquisition, neurons interact with each other, producing neural
activity, either based on previously agreed actions, such as controlling a
joystick, or generated spontaneously (phase 1 of Figure 1). This activity is
acquired by the BCI and transformed into digital data (phase 2). After that,
data is analyzed by the BCI data processing system to infer the action
intended by the user (phase 3). Finally, applications execute the intended
action, enabling the control of external devices. These applications can
present optional feedback to the users, which allows the generation of new
neural activity. On the other hand, the counterclockwise direction of Figure 1
starts in phase 4, where applications define the intended stimulation actions
to perform. Phase 3 processes this action to determine a firing pattern
containing all the essential parameters required by the BCI to stimulate the
brain. Finally, the firing pattern is sent to the BCI, which is in charge of
stimulating specific neurons belonging to one or more brain regions and is
dependent on the technology used. In a nutshell, a BCI can be a unidirectional
or bidirectional communication system between the brain and external
computational devices. Unidirectional communications are when they either
acquire data or stimulate neurons, while bidirectional communications are when
they perform both tasks (Rao, 2019).

Figure 1. General functioning of a bidirectional BCI. The clockwise flow
indicated with a blue arrow represents the neural data acquisition process,
while the counterclockwise flow represented with a red arrow models the brain
stimulation.

From the security perspective, BCIs are in an early and immature stage. The
literature has not considered security a critical aspect of BCIs until recent
years, where terms such as neurosecurity, neuroprivacy, neuroconfidentiality,
brain-hacking, or neuroethics have emerged (Denning et al., 2009; Ienca, 2015;
Ienca and Haselager, 2016). Existing works of the literature have detected
specific security attacks affecting BCI integrity, confidentiality,
availability, and safety, but they do not perform a comprehensive analysis and
miss relevant concerns (Martinovic et al., 2012; Bonaci et al., 2015a; Li et
al., 2015; Takabi et al., 2016; Sundararajan, 2017). More specifically, the
use of neurostimulation BCIs in clinical environments introduces severe
vulnerabilities that can have a significant impact on the user’s health
condition (Pycroft et al., 2016). BCIs already existing on the market would
benefit from the implementation of robust security solutions, reducing their
impact, particularly in clinical environments. Furthermore, the expansion of
BCIs to new markets, e.g., video games or entertainment, generates
considerable risks in terms of data confidentiality (Martinovic et al., 2012;
Li et al., 2015; Takabi et al., 2016; Sundararajan, 2017). In this context,
users’ personal information, such as thoughts, emotions, sexual orientation,
or religious beliefs, are under threats if security measures are not adopted
(Martinovic et al., 2012; Ienca and Haselager, 2016; Takabi et al., 2016).
Besides, contemporary BCI approaches, such as the use of silicon-based
interfaces, introduce new security challenges due to the increase in the
volume of acquired data and the use of potentially vulnerable technology
(Obaid et al., 2020). The technological revolution of recent years, combined
with movements such as the Internet of Things (IoT), brings an acceleration in
the creation of new devices lacking security standards and solutions based on
the concepts of security-by-design and privacy-by-design (Bonaci et al.,
2015a; Takabi et al., 2016; Sundararajan, 2017; Ramadan and Vasilakos, 2017)
(Ienca et al., 2018). This revolution also brings to reality prospective and
disruptive scenarios, where we highlight as examples the direct communications
between brains, known as Brain-to-Brain (BtB) or Brainets (Pais-Vieira et al.,
2013; Zhang et al., 2019b; Pais-Vieira et al., 2015; Jiang et al., 2019), and
brains connected to the Internet (Brain-to-Internet (BtI)), which will require
significant efforts from the security prism.

Once summarized the functioning of BCIs and their security status, the scope
of this paper lies in analyzing the security issues of software components
that intervene in the processes, working phases, and communications of BCIs.
Besides, this work considers the security concerns of infrastructures, such as
computers, smartphones, and cloud platforms, where different BCI architectures
are deployed. It is also important to note that, despite this article
indicates overall impacts over the brain and the user’s physical safety, the
main focus of this work is to perform a security analysis from a technological
point of view. Aligned with these aspects, and to the best of our knowledge,
this article is the first work that exhaustively reviews and analyses the BCI
field from the security point of view. Since these aspects have not been
studied in depth before and BCI technologies are still immature, this line of
work has a particular interest in a medium to long term. However, this area of
knowledge is relevant nowadays, since devices already available on the market
need to be protected against attacks.

In this context, Section 2 focuses on analyzing the security issues related to
the design of the BCI life-cycle. We unify the existing heterogeneous BCI
life-cycles in a novel and common approach that integrates recording and
stimulation processes. Once proposed the new life-cycle design approach, we
review the attacks applicable to each phase of the cycle, the impact generated
by the attacks and the countermeasures to mitigate them, both documented in
the literature and detected by us. After highlighting the security issues
related to the BCI design, Section 3 reviews the inherent cyberattacks,
impacts, and countermeasures affecting current BCI deployments scenarios. This
section identifies the security issues generated by the devices implementing
each life-cycle phase’s responsibilities, as well as the communication
mechanisms and the application scenarios. The last main contribution of this
article is Section 4, where we give our vision regarding the trend of BCI and
the security challenges that this evolution will generate in the future.
Finally, Section 5 presents some conclusions and future work.

##  2\. Cyberattacks affecting the BCI cycle, impacts and countermeasures

This section reviews the different operational phases of BCIs detected in the
literature, known as the BCI cycle, and homogenizes them in a new approach
shown in Figure 2. After that, we survey the security attacks affecting each
phase of the cycle, their impacts, and the countermeasures documented in the
literature. We present as well unexplored opportunities in terms of
cyberattacks, and countermeasures affecting each phase.

The literature has proposed different configurations of the BCI cycle.
However, the existing versions only consider the signal acquisition process,
missing the stimulation of neurons. These solutions present various
classifications of the BCI cycle, as some do not consider the generation of
brain signals as a phase, or group several phases in only one, without
providing information about their roles (Chizeck and Bonaci, 2014; Ienca and
Haselager, 2016). Other solutions, as proposed in (van Gerven et al., 2009; Li
et al., 2015; Ienca and Haselager, 2016; Arico et al., 2018), are confusing
due to they define as new phases, transitions, and data exchanged between
different stages. In terms of applications, some authors define a generic
stage of applications (Ahn et al., 2014; Chizeck and Bonaci, 2014; Li et al.,
2015; Sarma et al., 2016) while others deal with the concept of commands sent
to external devices (Bonaci et al., 2015a, b; Sundararajan, 2017; Vaid et al.,
2015; Bentabet and Berrached, 2016; Hong and Khan, 2017; Chakladar and
Chakraborty, 2018). Also, just a few works define the feedback sent by
applications to users (van Gerven et al., 2009; Vaid et al., 2015; Li et al.,
2015; Bonaci et al., 2015a, b; Sundararajan, 2017; Bentabet and Berrached,
2016; Ienca and Haselager, 2016; Chakladar and Chakraborty, 2018). To
homogenize the BCI cycle and address the previously missing or confusing
points, we present a new version of the BCI cycle with five phases (with
clearly defined tasks, inputs, and outputs) that consider both acquisition and
stimulation capabilities. Figure 2 represents our proposal, where the
clockwise direction corresponds to the brain signal acquisition process. The
information and tasks concerning this functioning are indicated in blue. In
contrast, the stimulation process is indicated in the counterclockwise
direction, starting from phase 5, and, in each phase, the information and
tasks are identified in red.

According to the neural acquisition process (clockwise direction in Figure 2),
phase 1 focuses on the generation of brain signals. Generated data contain the
user’s intention to perform particular tasks; for example, controlling an
external device. This phase can be influenced by external stimuli, producing
modifications in the regular neural activity. In phase 2, the brain waves are
captured by electrodes using a wide variety of technologies, such as
Electroencephalography (EEG) or Functional Magnetic Resonance Imaging (fMRI).
Raw analog signals containing the user’s intention are then transmitted to
phase 3, where data processing and conversion are required. In particular,
this phase performs an analog-to-digital conversion procedure to allow further
processing of the data. One of the main goals of this phase is to maximize the
Signal-to-Noise Ratio (SNR), which compares the level of the target signal to
background noise level to obtain the original signal as accurately as
possible. Phase 4 processes the digital neural data to decode the user’s
intended action, where relevant features are calculated and selected from the
neural data. After that, different models (e.g., classifiers, predictors,
regressors) or rule-based systems determine the intended action (Chakladar and
Chakraborty, 2018; Sarma et al., 2016). The action finally arrives at
applications in phase 5, which execute the action. Applications can also send
optional feedback to the user to generate brain signals and thus new
iterations of the cycle.

Regarding the stimulation process (counterclockwise direction in Figure 2),
the loop starts in phase 5, where it is specified the stimulation action in a
general way (e.g. stimulate a particular brain region to treat Alzheimer’s
disease). This intended action is transmitted to phase 4, where this input is
processed by different techniques, such as Machine Learning (ML), to generate
a firing pattern that contains high-level information about the stimulation
devices to be activated, the frequencies used and the temporal planning. Phase
3 intends to transform the firing pattern received, indicated in a general
fashion, to specific parameters related to the BCI technology used. For
example, the identification of neurons to stimulate or the power and voltage
required for the process. Phase 2 transmits these stimulation parameters to
the stimulation system, that is in charge of the physical stimulation of the
brain. After this process, the brain generates neural activity as a response,
which can also be acquired by the BCI to measure the state of the brain after
each stimulation process. At this point, an alternation between brain
stimulation and signal acquisition is possible, moving from one direction of
Figure 2 to the other.

Figure 2. Bidirectional BCI functioning cycle representing, in black, the
common phases for neural data acquisition and brain stimulation. (Left side)
Representation, in blue, of the processes performed and the data transferred
by each phase of the neural data acquisition process. This cycle can be seen
as a closed-loop process because it starts and ends at the same phase. (Right
side) Representation, in red, of the processes and transitions of each phase
making up the stimulation process.

Before reviewing the attacks, impacts and countermeasures of each phase of the
BCI cycle, it is essential to accurately define the concept of security, which
refers to the ”protection of information and information systems from
unauthorized access, use, disclosure, disruption, modification, or destruction
to provide integrity, confidentiality and availability” (Scholl et al., 2008).
The concepts of integrity, confidentiality and availability, together with the
concept of safety, are used in this section as metrics to evaluate the impact
of security attacks against BCI systems. The standard definition of these
concepts is the following:

  * •

Integrity: ”protection against unauthorized modification or destruction of
information. A state in which information has remained unaltered from the
point it was produced by a source, during transmission, storage, and eventual
receipt by the destination”. (Kuhn et al., 2001)

  * •

Confidentiality: ”preservation of authorized restrictions on access and
disclosure, including means for protecting personal privacy and proprietary
information”. (Scholl et al., 2008)

  * •

Availability: ”property that data or information is accessible and usable upon
demand by an authorized person.” (Scholl et al., 2008)

  * •

Safety: ”freedom from conditions that can cause death, injury, occupational
illness, damage to or loss of equipment or property, or damage to the
environment.” (Ross et al., 2019). This work considers the safety concept from
the physiological, psychiatric, and psychological perspectives.

At this point, it is essential to note that in this document, the safety
concept refers to the preservation of the physical integrity of BCI users, not
focusing on the conservation of objects or the environment. To better
understand the attacks and countermeasures later discussed in this section,
Table LABEL:table:cycle_attacks offers a brief description of the attacks
affecting BCI, whereas Table LABEL:table:cycle_countermeasures describes their
countermeasures. For each phase of the BCI cycle, we detail the
particularities of these attacks and countermeasures.

Table 1. Definition of the attacks detected for the BCI cycle |
---|---
Attack |  Description
Adversarial attacks (Finlayson et al., 2019; Liu et al., 2018a) |  Presentation of intentionally crafted inputs to an ML system to disrupt its normal functioning and output.
Misleading stimuli attacks (Landau et al., 2020; Martinovic et al., 2012; Frank et al., 2017) |  Presentation of malicious sensory or motor stimuli to users aiming to generate a specific neural response.
Buffer Overflow attacks |
(Saito et al., 2016; Black and Bojanova, 2016; MITRE, 2019e) |  Access to out-of-bounds memory spaces due to insecure software implementations. They take advantage of operations over memory buffers whose boundaries are not well managed.
Cryptographic attacks (Ienca, 2015; Ienca and Haselager, 2016) |  Exploit vulnerabilities in the elements that define a system, such as algorithms, protocols or tools. A variety of techniques focused on evading the security measures of cryptographic systems.
Firmware attacks (Vasile et al., 2019; Bettayeb et al., 2019) |  Extract or modify the firmware of a device, a critical piece of software that controls its hardware.
Battery drain attacks (Camara et al., 2015) (Pycroft and Aziz, 2018) |  Consume the battery of a device, reducing its performance or even making it permanently inaccessible.
Injection attacks (Project, 2017; MITRE, 2019a) |  Present an input to an interpreter containing particular elements that can modify how it is parsed, taking advantage of a lack of verification of the input.
Malware attacks |
(Sibi Chakkaravarthy et al., 2019; Yan and Yan, 2018; Kurose and Ross, 2017) |  Use of hardware, software or firmware aiming to gain access over computational devices to perform malicious actions intentionally.
Ransomware attacks |
(Al-rimy et al., 2018; Fernández Maimó et al., 2019) |  Encrypt users’ data and demand later an economic ransom to decipher it.
Botnet attacks |
(Mahmoud et al., 2015; Amini et al., 2015) |  Use of botnets, networks of infected devices controlled and coordinated by an attacker, to perform particular attacks directed to specific targets.
Sniffing attacks (Anu and Vimala, 2017) |  Acquisition of private information by listening to a communication channel. When the data is not encrypted, attackers have access to the content of the whole communication.
Man-in-the-middle attacks (Sundararajan, 2017) |  Alteration of the communication between two entities, making the extremes believe that they are communicating directly between each other.
Replay attacks |
(Tanenbaum and Wetherall, 2011; Kurose and Ross, 2017) |  Retransmission of previously acquired data to perform a malicious action, such as the impersonation of one of the legitimate participants of the communication.
Social engineering attacks (Hatfield, 2018; Gupta et al., 2017) |  Psychological manipulation to gain access over restricted resources. An example is phishing attacks, based on the impersonation of a legitimate entity in digital communication.
Spoofing attacks |
(Stallings, 2017; Tanenbaum and Wetherall, 2011) |  Masquerade an entity of the communication, transmitting malicious data. Frequent spoofing attacks in network communications are, among others, IP spoofing and MAC spoofing.
Table 2. Definition of the countermeasures detected for the BCI cycle |
---|---
Countermeasure |  Description
Training sessions, demos |
and serious games (Ienca and Haselager, 2016) |  Initiatives to increase the awareness of the users about the risks of technology.
User notifications (Camara et al., 2015) |  Alert the users in case an attack is detected, to take part in the defence (e.g. stop using the device).
Directional antennas (Zou et al., 2016) |  Antennas that radiate or receive the energy mainly in particular directions, aiming to reduce interference.
Analysis of the medium |
(Ienca and Haselager, 2016) |  Sensing of the communication medium to detect abnormal behavior.
Low transmission power |
(Vadlamani et al., 2016) |  Reduction of transmission power to avoid the interception of the communication by malicious entities.
Frequency and channel |
hopping (Zou et al., 2016; Grover et al., 2014) |  Wireless communication models based on pseudo-random hopping patterns previously known by sender and receiver.
Spread spectrum |
(Vadlamani et al., 2016; Zou et al., 2016; Tanenbaum and Wetherall, 2011) |  Transmission of the information in a broader bandwidth to avoid interference in the wireless medium.
Access control mechanisms |
(Takabi et al., 2016; Takabi, 2016; Camara et al., 2015) |  Means of detecting and preventing unauthorized access to particular resources.
Privilege management |
(MITRE, 2019f, g, h) |  Assign privileges to different groups of users based on roles.
Whitelists and blacklists |
(MITRE, 2019b) |  List of entities, such as systems or users, that are allowed or forbidden, respectively, to perform specific actions.
Cryptographic mechanisms |
(Ballarin Usieto and Minguez, 2018) |  Use of encryption and decryption techniques to protect the privacy of data, since unprotected information can be accessed and modified by attackers.
Differential privacy (Liu et al., 2018a; Ienca et al., 2018) |  Cryptographic mechanism based on the addition of noise to the data aiming to suppress sensitive aspects, accessible when combined with a large amount of a user’s data.
Homomorphic encryption |
(Liu et al., 2018a) |  Cryptographic mechanism allowing the computation of mathematical operations over ciphered data, generating an encrypted result.
Functional encryption |
(Takabi et al., 2016; Takabi, 2016) |  Cryptographic mechanism where having a secret key allows to learn a function of encrypted data without revealing the data itself.
Authenticity verification |
(Ballarin Usieto and Minguez, 2018) |  Ensure that the data we are accessing, or the endpoint we are communicating, is who it claims to be.
Legitimacy verification |
(Ballarin Usieto and Minguez, 2018) |  Review if a malicious software application has replaced a legitimate one.
Feature limitation (Open Web Application Security Project, 2017a) |  Ensure that any software only implements the specific functionality for which it was intended.
Periodic updates (Fernández Maimó et al., 2019) |  Correct detected vulnerabilities and include new functionalities to reinforce the existing countermeasures.
Robust programming |
languages (MITRE, 2019f) |  Choose the most adequate languages taking into consideration their strengths and weaknesses.
Compilation techniques |
and options (MITRE, 2019g) |  Specific capabilities of compilers to protect out of bounds accesses to the device memory or CPU registers.
Application hardening |
(Haupert et al., 2018) |  Modification of an application to make it more resistant against attacks, such as the obfuscation of the application code.
Segmented application |
architectures (Saito et al., 2016) |  Isolation of architectures and systems, establishing different containers and security groups to communicate with each other.
Sandboxing (Miramirkhani et al., 2017) |  Isolate the execution of different programs, allowing its protection against attacks.
Antivirus (Stallings, 2017) |  Software focused on the prevention, detection, and elimination of malware attacks. Modern antivirus offer protection for a wide variety of threats.
Malware visualization (Fu et al., 2018) |  Technique focused on the analysis of software binaries in a graphical way to detect anomalous malware patterns.
Quarantine of devices (Amini et al., 2015) |  Isolation of infected or potentially infected software, to avoid further propagation and infection.
Backup plans (Amara et al., 2017) |  Recurrent copy of data stored in a different location to allow its recovery in case of data loss.
Defense distillation (Liu et al., 2018a) |  Creation of a second ML model based on the original, with less sensitivity regarding input perturbations and offering smoother and more general results.
Data sanitisation (Jagielski et al., 2018) |  Rejection of samples that can produce a negative impact on the model, preprocessing and validating all input containing adversarial information.
Adversarial training (Goodfellow et al., 2018) |  Inclusion of adversarial samples in the training process to allow the recognition of attacks in the future.
Monitoring systems (Birajdar and Mankar, 2013) |  Capture and analyze the behavior of the entities within a system and their communications.
Anomaly detection (Camara et al., 2015) |  Detection of odd behaviors on systems that can potentially correspond to an attack situation.
Firewall (Stallings, 2017) |  Cybersecurity system that only allows incoming or outgoing network communications previously authorized.
IDS (Stallings, 2017) |  Analysis of the network activity to identify potentially damaging communications aiming to disrupt the system.
Communication interruption (Kirubavathi and Anitha, 2018) |  Detention of an active communication to mitigate the impact of an attack if there is evidence of its presence.
Input validation (Project, 2017) |  Analysis and preprocessing of inputs presented to a system to suppress potential causes of failure.
Randomization (Takabi et al., 2016) |  Change of existing data in a way that does not follow a deterministic pattern and prevents privacy leakage.
BCI Anonymizer (Bonaci et al., 2015a) |  Anonymization of brain signals acquired from the brain to be shared without exposing users sensitive information.

Figure 3 indicates the attacks, impacts, and countermeasures described in this
section. As can be seen, each attack is represented by a color that associates
the impacts it generates and the countermeasures to mitigate it. For each
impact included in the figure, it includes a simplified version of the BCI
cycle. Those phases of the cycle marked in red indicate impacts detected in
the literature for that specific phase, whereas the blue color indicates our
contribution. Besides, the attacks, impacts and countermeasures marked with
references have been proposed in the literature, while those without
references are our contribution. It is important to note that this figure
highlights the limitations exposed by the literature, as can be appreciated by
the volume of our contributions. To simplify the image, we have synthesized
most of the safety impacts into a general entry ”Cause physical damage”,
describing the specific impacts over users’ health in detail throughout the
section.

###  2.1. Phase 1. Brain signals generation

####  2.1.1. Attacks

Considering the neural data acquisition flow, this first phase focuses on the
brain processes that generate neural activity, which can be influenced by
external stimuli. The literature has detected misleading stimuli attacks
(Landau et al., 2020; Martinovic et al., 2012; Frank et al., 2017), a
mechanism to alter the brain signals generation by presenting intentionally
crafted stimuli to BCI users. To understand these attacks, it is important to
introduce some concepts. Event-related Potentials (ERPs) are
neurophysiological responses to a cognitive, sensory, or motor stimulus,
detected as a pattern of voltage variation (Chizeck and Bonaci, 2014). Within
the different types of ERPs, Evoked Potentials (EPs) focus on sensory stimuli
and can be divided into two categories, Visual Evoked Potentials (VEPs) and
Auditory Evoked Potentials (AEPs), related respectively with visual and
auditory external stimuli. Specifically, P300 is a VEP detected as an
amplitude peak in the EEG signal about 300ms after a stimulus, extensively
used due to its quick response (Sowndhararajan et al., 2018).

On the one hand, Martinovic et al. (Martinovic et al., 2012) used the P300
potential to obtain private information from test subjects and demonstrated
misleading stimuli attacks. Visual stimuli were presented in the form of
images, grouped as follows: 4-digit PIN codes, bank ATMs and credit cards, the
month of birth and photos of people. The objective of the experiment was to
prove that users generate a higher peak in the P300 potential when faced with
a known stimulus and, therefore, be able to extract private information. The
authors used the Emotiv EPOC 14-channel headset (Emotiv, 2019c), a commercial
BCI EEG device, showing that information leakage, measured in information
entropy, was 10%-20% of the overall information, and could be increased to
approximately 43%. On the other hand, Frank et al. (Frank et al., 2017)
demonstrated the possibility of performing subliminal misleading stimuli
attacks. To perform the experiments, the same ERP concept with P300 potentials
was used. In this work, the authors showed information hidden within the
visual content projected to 29 subjects, in the form of stimuli with a
duration of 13.3 milliseconds, imperceptible to the human eye. The study used
EEG devices of the brands NeuroSky (NeuroSky, 2019) and Emotiv (Emotiv,
2019a). We consider that the previous works are relevant to highlight the
importance of security in BCI, and additional experiments with a higher number
of users are required.

The literature has documented some well-known methods to present stimuli to
users and analyze their neural responses (Sundararajan, 2017; Bonaci et al.,
2015a; Martinovic et al., 2012). For example, to study the neural activity
generated after a question in a lie detection test (Landau et al., 2020).
Although these methods do not represent attacks themselves, they are an
opportunity to develop new misleading stimuli attacks against BCIs, defined
as:

  * •

Oddball Paradigm: specific target stimuli, hidden between a sequence of common
non-target stimuli, would generate peaks in ERP. For example, to differentiate
a known face among several unknown ones.

  * •

Guilty Knowledge Test: the response generated by familiar stimuli can be
differentiated from the generated by unfamiliar elements. This principle has
been used for lie detection.

  * •

Priming: a stimulus can generate an implicit memory effect that later
influences other stimuli.

Despite the comprehensive study in the literature on AEPs, there are no
specific works, to the best of our knowledge, describing attacks over auditory
stimuli. However, Fukushima et al. (Fukushima et al., 2014) described that
inaudible high-frequency sounds could affect brain activity. We detect that
this scenario generates new opportunities for attackers since the generation
of inaudible auditory stimuli does not require close interaction with the
victim, helping the attacker to remain undetected.

Regarding neural stimulation, this phase represents the result of the
stimulation process within the brain. Based on a lack of literature defining
taxonomies of attacks over the brain, we identify two main attack categories
during neurostimulation. The first category consists of taking control of the
stimulation process to cause neural tissue damage. These attacks may reproduce
or worsen the secondary effects often present during the treatment of
neurological conditions, such as Parkinson’s disease, either by over-
stimulation actions or by preventing the treatment. The feasibility of these
attacks is supported by (Parastarfeizabadi and Kouzani, 2017; Hartmann et al.,
2019), who indicated that the adverse effects of neurostimulation are related
to the parameters and patterns of the stimulation. Additionally, we identify
another modality of attack in this category, based on recreating known
neurological conditions if there is an existing neurostimulation device with
access to the regions naturally affected by those diseases. As an example, we
identify the possibility of recreating neurodegenerative diseases, such as
Parkinson’s and Alzheimer’s diseases, based on a deterioration of cerebral
tissue, and epileptic seizures. Although these attacks are nowadays just
theoretical (Bernal et al., 2020), the advance of prospecting BCI technologies
like Neuralink (Musk and Neuralink, 2019), could result in neurostimulation
systems that can cover various parts of the brain, thus introducing these
threats.

The second category of attacks focuses on inducing an effect or perception in
the user. It is well known that neurostimulation can cause multiple
psychiatric and psychological impacts, such as mood variations, depression,
anxiety, or suicidal thoughts, as later indicated in Section 2.1.2. An
attacker could magnify these effects with malicious stimulation parameters to
take advantage of the user. As an example, the attack could aim to reduce the
patient’s inhibition to ease the extraction of private information. This
situation introduces the possibility of social engineering attacks to BCI,
where the attacker would not require sophisticated social techniques to
manipulate its victims psychologically.

####  2.1.2. Impacts

It is important to note that the misleading stimuli attacks detailed for this
phase have only been conducted against data confidentiality (Landau et al.,
2020; Frank et al., 2017), aiming to extract sensitive data from BCI users.
However, we consider that they can also affect BCI integrity, availability,
and safety. These stimuli can alter the normal functioning of this phase,
generating malicious inputs for the next stages that can derive on disruptions
of the service or incorrect actions aiming to cause physical damage to users.
Specifically, Landau et al. (Landau et al., 2020) identified that misleading
stimuli attacks performed during a medical diagnose, such as a photosensitive
epilepsy test in which different visual stimuli are presented, can derive in a
misdiagnosis, affecting the users’ safety. We also identify as feasible that
malicious stimuli, both perceptible or subliminal, can affect the users’ mood.

From the perspective of neurostimulation, the attacks above can affect users’
health differently according to their previously existing diseases, impacting
their physical and psychological safety. The issues related to different BCI
technologies are detailed in Section 2.2, indicating general impacts over the
brain in this phase. Table 3 presents the most common side effects during
particular neurostimulation therapies. As can be seen, performing an attack
during the stimulation process can aggravate or even generate a wide range of
negative impacts on BCI patients. Additionally, the authors of (Pycroft et
al., 2016; Pycroft and Aziz, 2018) highlighted common issues to neurological
diseases, such as tissue damage, rebound effects, and denial of stimulation
(also affecting the service availability). Besides, they identified that an
alteration of voltage, frequency, pulse width, or electrode contact used to
stimulate the brain could modify the volume of cerebral tissue activated,
inducing non-desired effects in the surrounding structures depending on the
electrode location and stimulation technique. Pycroft et al. (Pycroft and
Aziz, 2018) also indicated that an attack on neurostimulation could induce a
patient’s thoughts and behavior. In (Marin et al., 2018), the authors
highlighted that attacks on neurostimulation can prevent patients from
speaking or moving, cause brain damage or even threaten their life, while the
authors of (Landau et al., 2020) indicated the user’s frustration if the
result of the process is not adequate.

Pycroft et al. (Pycroft et al., 2016) indicated potential attacks and harms
against neurostimulation patients. First, they detected that an
overstimulation procedure could cause tissue damage, independently of the type
of stimulation and medical condition. For Parkinson’s disease, an attacker
could apply a ~10Hz stimulation over the STN region to produce hypokinesia or
akinesia. In patients with essential tremor, where the ventral intermediate
nucleus (VIM) is stimulated, both an increase of voltage and a decrease of
frequency could dangerously derive in exacerbated tremor. Finally, a variation
in the stimulation parameters during the treatment of obsessive-compulsive
disorder could generate alterations of reward processing or operant
conditioning.

Based on the above, safety impacts are the most damaging in this phase,
presenting a risk of irreversible physical and psychiatric issues. In
addition, taking advantage of the victim’s psychological status, it could ease
social engineering attacks as well. The attacker could aim to reduce or
inhibit the patient’s mental defense mechanisms, acquiring sensitive
information, thus impacting data confidentiality. However, more worrisome
would be to take advantage of the victim’s mental status, in which the patient
unconsciously accedes to undesired acts, such as gambling money, buying
unnecessary products, committing a crime, or participating in non-consensual
sexual intercourse.

Table 3. Summary of the most common side effects during FDA-approved
neurostimulation.

Technology | Condition | Brain region | Neurological side effects | Psychiatric/psychological side effects
---|---|---|---|---
DBS | Parkinson’s disease | STN |  | Akinesia, cramping in the face or hand,
---
dysarthria, dysphagia, eyelid apraxia, gait disturbance,
hypersalivation, impaired vision, incontinence, learning and
memory difficulties, paresthesia, postural instability,
speech disturbance, lack of verbal fluency,
vegetative symptoms, weakness (Society, 2020; Edwards et al., 2017; Buhmann et
al., 2017; Hartmann et al., 2019; Dembek et al., 2017)
| Anxiety, apathy, cognitive disturbance, confusion,
---
depression, hallucination, submanic state (Edwards et al., 2017; Buhmann et
al., 2017; Hartmann et al., 2019)
GPI |  | Similar to STN (Hartmann et al., 2019)
---
| Anxiety, depression, suicidal thoughts (Edwards et al., 2017; Hartmann et
al., 2019)
---
VIM |  | Dysphagia, fine motor disturbance,
---
speech disturbance (Society, 2020)
Essential tremor | VIM |  | Dysaesthesia, dysarthria, gait disturbance,
---
paresthesia, speech disturbance (Edwards et al., 2017; Buhmann et al., 2017)
Dystonia | GPI |  | Gait disturbance, paresis, speech disturbance,
---
tetanic muscle contractions, visual deficits (Edwards et al., 2017; Buhmann et
al., 2017)
| Anxiety, cognitive disturbance,
---
confusion, hallucination (Buhmann et al., 2017)
| Obsessive-compulsive
---
disorder
VC/VS, NAc |  |  | Depression, operant conditioning, reward processing
---
alteration, suicidal thoughts, suicide (Medtronic, 2020b)
RNS | Epilepsy | Seizure origin |  | Death, change in seizures,
---
hemorrhage, infection (NeuroPace, 2013)
| Anxiety, depression, suicide, suicididal thoughts (NeuroPace, 2013)
---

####  2.1.3. Countermeasures

Focusing on the countermeasures to mitigate misleading stimuli attacks,
multiple works (Landau et al., 2020; Pycroft and Aziz, 2018; Pycroft et al.,
2016; Camara et al., 2015) identified general measures to raise the awareness
of BCI users, such as spreading the risks of these technologies among
clinicians and patients and the education of the users in these technologies.
This is especially interesting since humans usually are the weakest element of
a security system. In particular, Ienca et al. (Ienca and Haselager, 2016)
indicated that specific training sessions could be beneficial to protect users
against potentially unsafe stimuli related to authentication methods and
banking-related information. Besides, the inclusion of demos and serious games
in commercial BCI devices may educate them on the risks of these technologies.
However, these countermeasures can only be applied when the user is aware of
the stimuli. Because of that, we consider that misleading stimuli attacks can
be reduced if BCIs are complemented with external systems that monitor the
stimuli presented and give users the possibility to evaluate if the content is
appropriate. For example, by analyzing if the multimedia contents showed to
users, such as images or videos, have been maliciously modified (Wahab et al.,
2014; Birajdar and Mankar, 2013), even if they are subliminal. Additionally,
we propose using predictive models based on anomaly detection systems, aiming
to detect an attack in its early stage and deploy mechanisms to mitigate them.

###  2.2. Phase 2. Neural data acquisition & stimulation

####  2.2.1. Attacks

This second phase focuses on the interaction of BCI devices with the brain to
acquire neural data or perform its stimulation. Regarding data acquisition,
the authors of (Li et al., 2015; Landau et al., 2020) identified the use of a
combination of replay and spoofing attacks in which previous signals from the
BCI user, signals from other users, or synthetic signals can impersonate the
legitimate brain waves. We detect the applicability of these attacks to
stimulation systems, where an attacker can force specific stimulation
behaviors based on previous actions. One possible outcome of this control can
be an increase in the voltage delivered to the patient’s brain (Marin et al.,
2018). Besides, the authors of (Ienca and Haselager, 2016; Landau et al.,
2020) detected the use of jamming attacks against the neural data acquisition
process, transmitting electromagnetic noise to the medium. Based on Vadlamani
et al. (Vadlamani et al., 2016), we also identify this problem in neural
stimulation, where jamming attacks can override the legitimate signals emitted
by the BCI electrodes if they are transmitted with enough power.

####  2.2.2. Impacts

Regarding the impacts produced by the previous attacks, Li et al. (Li et al.,
2015) identified that replay and spoofing attacks affect both data integrity
and availability, being able to disrupt the acquisition process. Landau et al.
(Landau et al., 2020) highlighted that these attacks could interfere with
clinical diagnosis procedures, replacing the legitimate brain signals by
malicious ones, concluding in misdiagnosis, and producing either an absence of
treatment or an unnecessary one on healthy patients. We identify that these
attacks, applied to the stimulation scenario, can disrupt the stimulation
process or acquire and modify the stimulation pattern used by the BCI to
maliciously stimulate the neurons, affecting data integrity, data and service
availability, and the patient’s safety. Focusing on jamming attacks, an
attacker can aim to prevent the electrodes from capturing brain signals due to
the noise transmitted (Ienca and Haselager, 2016; Landau et al., 2020),
affecting their availability and safety. We detect that jamming attacks can
also affect neurostimulation scenarios, where signals with enough power can
override the legitimate ones, affecting the integrity and availability of the
data, as well as the patient’s safety during stimulation actions.

Apart from the impacts derived from the previous attacks, it is important to
note that each specific BCI technology presents specific risks according to
their invasiveness and functioning, and thus the impact generated by an attack
differs. To analyze this situation, we select some of the most used BCI
technologies used to acquire neural data or stimulate the brain. For each one
of them, we address specific considerations to evaluate their impact.

Regarding the issues related to acquisition technologies, it is necessary to
consider both their temporal and spatial resolutions. We identify that a low
temporal resolution in acquisition technologies presents concerns on data and
service availability since the devices transmit a reduced amount of data that
can be affected more easily by electromagnetic interference and, especially,
jamming attacks. Besides, this situation can also be beneficial for replay and
spoofing attacks, since attackers have more time to prepare and send malicious
data. A high spatial resolution can impact on data confidentiality, allowing
attackers to have access to more sensitive neural data. It is worthy to note
that attacks on technologies such as fMRI or Magnetoencephalography (MEG) can
potentially have a higher economic impact due to the high cost of these
technologies compared to others like EEG (Ramadan and Vasilakos, 2017; Lebedev
and Nicolelis, 2017). Nevertheless, EEG is the most studied acquisition
technology from the security perspective, due to its wide availability outside
clinical environments, highlighting the feasibility of attacks such as
misleading stimuli attacks or jamming attacks.

Although the literature has documented some potential security impacts for
acquisition technologies, the impact of neurostimulation technologies on
patient’s health has been studied in a more detailed way, specifically in the
field of Implantable Medical Devices (IMDs). Because of that, we first
introduce the most common stimulation technologies nowadays to review their
specific impact later, mainly addressing safety issues.

Focusing on the specific impacts of neurostimulation technologies, Deep Brain
Stimulation (DBS) is the most studied one due to its invasiveness, where
Medtronic is one of the most popular brands commercializing open-loop DBS
devices (Parastarfeizabadi and Kouzani, 2017). The side effects of this method
have been extensively studied in the literature, where some of them have
previously been presented in Table 3 for the treatment of particular
conditions. According to Pycroft et al. (Pycroft et al., 2016), the use of DBS
with high charge densities can cause tissue damage. Furthermore, an increase
or decrease in the stimulation frequency can have a considerable impact on its
efficacy, even reversing the stimulation effect. Finally, an alteration of
emotion and affect processing can occur during DBS as side-effects, such as
pathological crying or inappropriate laughter, having a distressing impact.

Moving to Transcranial Magnetic Stimulation (TMS), Polanía et al. (Polanía et
al., 2018) indicated that pulses applied to particular areas could induce
suppression of visual perception or speech arrest, which serves as an
opportunity for attackers. León et al. (León Ruiz et al., 2018) highlighted
that TMS could produce side-effects such as headache and neck pain, being
epileptic seizures possible but improbable. The side effects of Transcranial
Electrical Stimulation (tES) usually are mild, such as skin tingling, itching,
and redness (Moreno-Duarte et al., 2014). Nevertheless, this technique can
have indirect effects on the stimulation of non-neuronal elements, such as
peripheral nerves, cranial nerves, or retina. Because of that, the stimulation
is limited to maximum tolerable doses (Liu et al., 2018b). Besides, in
patients with depression, Direct Current Stimulation (tDCS) can derive to
mania and hypomania cases (Matsumoto and Ugawa, 2017). It is worthy to note
that the side effects described above can naturally arise in controlled
environments where clinicians have strict control over the procedure. However,
if attackers alter the therapy, they could recreate or amplify malicious
conditions, generating a clear impact on patients’ health.

The Neuropace RNS is a closed-loop neurostimulation system for treating drug-
resistant epilepsy, performing both neural data acquisition and
neurostimulation procedures. It presents the advantage of delivering
stimulation only when detecting the beginning of seizure activity, reducing
secondary effects. Nevertheless, it introduces potential challenges than can
be used by an attacker to impact its users’ safety (Parastarfeizabadi and
Kouzani, 2017). First, we identify that the closed-loop behavior could induce,
in both clinicians and patients, a reduction of the perception of risks,
assuming that the device is working correctly. Furthermore, since the device
presents autonomous capabilities, an attacker could disrupt its behavior,
without the knowledge of the user, to generate an impact on data
confidentiality, service availability, and safety.

####  2.2.3. Countermeasures

Regarding the countermeasures to detect and mitigate replay and spoofing
attacks, Landau et al. (Landau et al., 2020) proposed, for data acquisition,
the use of anomaly detection mechanisms to detect modified inputs, as well as
the accuracy improvement of acquisition devices. Besides, we propose a
mechanism able to disable the electrodes not required for the current
application usage and avoid potential risks, such as the acquisition of P300
in brain signals. This action could be performed automatically by the BCI
system or based on the patient’s or clinician’s decision. Taking into account
neural stimulation, and specifically for IMDs, external devices to
authenticate and authorize the stimulation actions can be used (Camara et al.,
2015). The authors of (Grover et al., 2014; Zou et al., 2016; Vadlamani et
al., 2016) documented several detection mechanisms and countermeasures related
to the mitigation of jamming attacks. All detection procedures are based on an
analysis of the medium to detect abnormal behavior, as identified for neural
data acquisition by Ienca et al. (Ienca and Haselager, 2016). Specifically,
Landau et al. (Landau et al., 2020) proposed using an ensemble of classifiers
to detect the addition of noise to the benign input. As proposed
countermeasures, Vadlamani et al. (Vadlamani et al., 2016) identified the use
of low transmission power as a possible solution to harden the detection of
the legitimate transmission, and the use of directional antennas oriented to
the brain to avoid the jamming. The use of frequency hopping (Zou et al.,
2016) and channel hopping (Grover et al., 2014) after a particular duration of
time also aim to reduce the impact of these attacks. We detect that the use of
directional antennas is also a possible solution for replay and spoofing
attacks. Finally, it is worthy to note that the mitigation of the previous
impacts focused on user’s safety is the consequence of mitigating the attacks
spotted against BCI devices.

In the scenario of closed-loop neurostimulation systems, we identify as
essential to have information about the behavior of the device, from both
acquisition and stimulation procedures. These feedback mechanisms would allow
to externally analyze the status of the brain and the stimulation decisions.
Another proposal is the use of anomaly detection systems, included in the
device, to identify unusual stimulation parameters, or an absence of treatment
when a seizure occurs, notifying the user. This second approach could be more
energy preserving, and the election of the strategy would depend on the use
case.

###  2.3. Phase 3. Data processing & conversion

####  2.3.1. Attacks

This phase performs the data processing and conversion tasks required to allow
neural data and stimulation actions to be ready for subsequent stages.
Although the literature has not detected security problems in this phase,
according to the aspects indicated by Bonaci et al. in (Bonaci et al., 2015a,
b), we identify malware attacks as possible against this phase, taking control
over the BCI. These attacks are candidates to affect both acquisition and
stimulation processes, impacting the tasks performed in this phase. In
particular, we identify that malware can disrupt the analog-to-digital
conversion that occurs during neural data acquisition, as well as the
translation of firing patterns to particular stimulation devices. We also
detect that jamming attacks applied to the previous phase for data acquisition
can impact this phase since a distorted input signal with enough noise can be
difficult to filter and thus propagate this signal to subsequent phases.

####  2.3.2. Impacts

In this context, we identify that malware attacks have an impact on both
neural data acquisition and stimulation, where attackers alter or override the
data received from previous phases, generating malicious data sent to
subsequent phases. That is, the analog data recorded during neural data
acquisition or the firing pattern used in neurostimulation processes. These
attacks can gather the sensitive data managed in this phase, both analog and
digital, and send it to the attackers, affecting data confidentiality. For
example, information about private thoughts or neurological treatments. In
terms of data and service availability, both acquisition and stimulation are
potentially vulnerable to malware that avoids data transmission to subsequent
phases of the cycle. Malware affecting integrity and availability is also a
threat against users’ physical safety, generating damaging stimulation
patterns or dangerous actions sent to applications. Besides, the impacts and
countermeasures described in the first phase of the acquisition flow for
jamming attacks are also applicable to the current stage.

####  2.3.3. Countermeasures

Regarding the countermeasures to mitigate attacks affecting data
confidentiality, Chizeck et al. (Chizeck and Bonaci, 2014) defined a US patent
application entitled “Brain-Computer Interface Anonymize” that proposes a
technology capable of processing neural signals to eliminate all non-essential
private information (Bonaci et al., 2015a; Takabi et al., 2016). As a result,
sensitive information is never stored in the BCI device or transmitted
outside. We identify this method as especially relevant in this phase, as it
is the first stage after the BCI’s acquisition process. Although the authors
do not provide details about techniques or algorithms to understand how raw
signals are processed, they indicate that this process can only be performed
on hardware or software within the device itself, and not on external networks
or computer platforms, as a way to ensure the privacy of the information.
Besides, Ienca et al. (Ienca et al., 2018) proposed the use of differential
privacy to improve the security and transparency of data processing.

The countermeasures to mitigate malware depend on their type and behavior. We
consider the use of antivirus software and Intrusion Detection Systems (IDS)
as alternatives for the protection of individual devices, based on (Landau et
al., 2020). Besides, the authors of (Stallings, 2017; Yan and Yan, 2018)
considered perimeter security mechanisms, such as firewalls, responsible for
analyzing all incoming and outgoing communication of the device. We also
propose using ML anomaly detection systems to identify potential malware
threats (Camara et al., 2015) (Rathore et al., 2020). Finally, Chakkaravarty
et al. (Sibi Chakkaravarthy et al., 2019) reviewed current persistent malware
techniques able to bypass common countermeasures and proposed mitigation
techniques, such as sandboxing (Miramirkhani et al., 2017), application
hardening (Haupert et al., 2018) and malware visualization (Fu et al., 2018).
It is essential to highlight that the countermeasures applicable for this
phase highly depend on the device constraints that implement this phase, which
is typically the BCI device (see Section 3).

###  2.4. Phase 4. Decoding & encoding

####  2.4.1. Attacks

Decoding & encoding is the phase focused on identifying the action intended by
the users in neural data acquisition or the specification of the neural firing
pattern in neurostimulation. Malware attacks have been identified in the
literature by Bonaci et al. (Bonaci et al., 2015a, b) from the signal
acquisition perspective. Specifically, they identified that attackers could
use malware to either override the functioning of this phase or to implement
additional malicious algorithms. Besides, we identify that malware attacks can
also be applied to the stimulation flow, avoiding or disrupting a firing
pattern’s generation. Besides, we identify that adversarial attacks can also
be applied to this phase for both acquisition and stimulation tasks, taking
advantage of the classification algorithms used. These attacks affect all
types of ML models, and, because of that, they are currently an open challenge
(Finlayson et al., 2019). Liu et al. (Liu et al., 2018a) detected the
possibility of poisoning attacks, where attackers introduce crafted
adversarial samples to the data, aiming to change its distribution. Evasion
attacks aim to create samples that evade detection systems, whereas
impersonate attacks focus on adversarial samples that derive in incorrect
classification of the legitimate ones. Finally, two attack models exist
according to the knowledge about the model (Goodfellow et al., 2018). In
white-box attacks, adversaries know the model, while in black-box attacks,
they only have access to the model through a limited interface.

####  2.4.2. Impacts

The previously described attacks generate particular impacts on BCI. On the
one hand, malware has an impact on data integrity and availability, as it can
alter or ignore the received data from previous phases, and override the
output of the current one. That is, disrupt the intended action sent to BCI
applications in the acquisition process, such as preventing the control of a
wheelchair or changing its direction, or the firing pattern in neural
stimulation, enabling a wide variety of attacks as described in Section 2.1.
Besides, malware affects the availability of the ML process by the alteration
of the trained model or the ML algorithm. From a data confidentiality
perspective, malware can access the features used in the ML training phase, as
well as gather information about the model and the algorithm used. Malware
also affects users’ safety, as the previous integrity and availability impacts
derive in malicious actions and firing patterns that affect the integrity of
users, such as causing neural damage or inducing particular psychological
states. On the other hand, adversarial attacks also affect data integrity and
availability, as the introduction of malicious samples aiming to disrupt the
model can alter or avoid the generation of actions and firing patterns. Shokri
et al. (Shokri et al., 2017) demonstrated that ML models are sensitive against
adversarial attacks, aiming to detect if a sample exists in the model’s
training dataset. Based on that, an attacker may extract sensitive users’
data, such as previous intended actions or used patterns during stimulation
actions. Taking into account data confidentiality, Landau et al. (Landau et
al., 2020) detected that a malicious entity taking control of the output of
this phase could access the user’s intention. Finally, the use of malicious
samples, as is the case of poisoning attacks, alter the ML system, deriving in
safety impacts for both cycle directions.

####  2.4.3. Countermeasures

To mitigate the attacks on the ML training phase affecting integrity and
availability, we have identified several techniques proposed in the literature
for generic adversarial attacks, that can serve as an opportunity to improve
the security of BCI. First, data sanitization is useful to reject samples
containing adversarial information, thus disrupting the model. Jagielski et
al. (Jagielski et al., 2018) proposed a similar approach against poisoning
attacks applied to regression techniques, where noise and outliers are
suppressed from the training dataset. Nevertheless, it does not prevent
attackers from crafting samples similar to those generated by the legitimate
distribution. Countermeasures such as adversarial training or defense
distillation have been presented in this context. However, both have
limitations, as they depend on the samples used during the training and can be
broken using black-box attacks and computationally expensive attacks based on
iterative optimization (Goodfellow et al., 2018; Liu et al., 2018a).
Goodfellow et al. (Goodfellow et al., 2018) also proposed architecture
modifications, based on the improvement of ML models to be more robust, but
this derives in models difficult to train that have degradation in the
performance when used in non-adversarial situations. Liu et al. (Liu et al.,
2018a) documented the integration of techniques to mitigate the attacks,
called ensemble method. They also indicated two methods that can apply in both
training and testing phases: differential privacy and homomorphic encryption
(Liu et al., 2018a; Takabi et al., 2016; Huertas Celdrán et al., 2016).
Finally, it is worthy to note that the countermeasures to mitigate malware
attacks in the previous phase can apply to the current one.

###  2.5. Phase 5. Applications

####  2.5.1. Attacks

From the data acquisition context, applications perform in the physical world
the actions intended by users through their neural activity. These actions can
range from the interaction with a computer or smartphone, to the control of a
robotic limb. From the perspective of neural stimulation, applications are the
entry point of the information transmitted to the brain, like sensory stimuli
in prosthesis or cognitive enhancement. In this section, we consider attacks
on applications, without analyzing their communication with external systems,
addressed in Section 3.1.

Considering the issues of this phase, spoofing attacks over BCIs have been
detected in the literature, where an attacker creates malicious applications
identical to the original and make them available in app stores (Ballarin
Usieto and Minguez, 2018). The authors of (Li et al., 2015; Bonaci et al.,
2015a, b) identified malware attacks as a threat in BCI. Besides, Pycroft et
al. (Pycroft et al., 2016) identified that the use of consumer devices, such
as smartphones, generates new risks and security problems. Specific
considerations about malware are the same as detailed in Sections 2.3 and 2.4.
Moreover, we have found several opportunities related to cyberattacks
performed against applications. In particular, we detect security
misconfiguration issues, Buffer Overflow (BO) attacks, and injection attacks
over applications. However, the detailed analysis of these particular attacks
is out of the scope of this work, and we only address general aspects related
to BCI.

####  2.5.2. Impacts

Landau et al. (Landau et al., 2020) identified multiple risks on BCI
applications with the independence of any attack. They detected that an
attacker could interfere with the user’s ability to use the device, impacting
its availability. They also detected confidentiality concerns regarding the
identification of users by their neural data, illustrating a scenario in which
an attacker extracts EEG data from the application and compares it with the
EEG database of a hospital, identifying the user and accessing his or her
medical records. This identification can derive in a discrimination situation
based on the belonging of specific groups, such as religious beliefs. Besides,
most BCI development APIs offer full access over the information and do not
implement limitations on the stimuli presented to users, generating
confidentiality issues (Martinovic et al., 2012; Frank et al., 2017; Bonaci et
al., 2015a; Li et al., 2015; Takabi et al., 2016; Sundararajan, 2017).
Finally, all the attacks affecting this phase can force applications to send
malicious stimuli or actions, causing physical harm (Ballarin Usieto and
Minguez, 2018).

Considering the impact of the previous attacks, applications created by
spoofing attacks affect both data integrity and confidentiality, as they can
present malicious stimuli to obtain sensitive neural information, such as
thoughts or beliefs (Ballarin Usieto and Minguez, 2018). In neurostimulation
scenarios, we identify that these fraudulent applications could entirely
modify the firing patterns used to stimulate the patient, generating a high
impact over safety. More particularly, these applications could induce
psychological states in the victim, making them more willing to gamble, or
even generate adverse effects such as anxiety and depression. Based on that,
the attacker could take advantage of these mental states, injecting in-app
advertisements to earn money from the victim.

Malware attacks impact the integrity of the applications by altering their
services and capabilities, such as disabling the encryption of information.
Besides, they can compromise applications’ confidentiality, gaining access to
sensitive information such as medical records and user profiles used during
neurostimulation treatments. Concerning the availability of the application,
malware attacks can derive in denial of service over the application,
impacting in processes such as controlling prosthetic limbs or wheelchairs.

We detect that misconfiguration attacks present data integrity issues, where
attackers take advantage of the system to gain unauthorized access, such as
weak access control mechanisms. Data confidentiality issues are also present,
for example, on configuration files that have static predefined passwords,
allowing attackers to gain access to users’ private data. Applications’
availability problems are also possible, as a misconfiguration issue can serve
as a first step to disrupt the normal behavior of the BCI application.

Moving to injection attacks, they can produce data loss, modification, and
corruption, affecting the integrity of applications (Project, 2017; MITRE,
2019a). In terms of confidentiality, they can produce the disclosure of
sensitive information to unauthorized parties (Project, 2017; MITRE, 2019a),
such as insurance companies aiming to select the best candidates for their
products (Ballarin Usieto and Minguez, 2018). Availability can be affected by
a denial of access over an authentication system, or producing crash, exit or
restart actions on the applications, disrupting vital processes such as
clinical neurostimulation (Project, 2017; MITRE, 2019c).

BO attacks can derive in the execution of unauthorized code or commands, where
an attacker can alter the normal functioning of the application or access to
sensitive information (MITRE, 2019f). Furthermore, they can also aim to bypass
protection mechanisms by the execution of code outside the scope of the
program’s security policy. These actions can affect the data integrity,
confidentiality, and availability of the application (MITRE, 2019g).

####  2.5.3. Countermeasures

It is necessary to verify the legitimacy of the applications and ensure
sufficient control of the app stores to mitigate spoofing attacks (Ballarin
Usieto and Minguez, 2018). In that regard, Landau et al. (Landau et al., 2020)
proposed the use of applications developed by authorized organizations to
ensure their trustworthiness. When it comes to malware attacks, the same
countermeasures proposed for the Data processing & conversion phase also apply
for applications. That is, the use of antivirus, firewall, IDS, and anomaly
detection systems to identify and mitigate the attacks. Furthermore, Takabi et
al. (Takabi et al., 2016; Takabi, 2016) proposed the use of access control
mechanisms over the information to restrict its access and thus mitigate
confidentiality impacts. They also indicated the use of randomization and
differential privacy. Besides, they proposed the integration of homomorphic
encryption to operate with encrypted information combined with functional
encryption to access only to a subset of the information.

As an opportunity for BCI, we identify some preventive actions against
misconfiguration attacks defined by the Open Web Application Security Project
(OWASP) (Open Web Application Security Project, 2017a), such as the use of
minimal platforms with only necessary features, components, libraries, and
software to reduce the probability of misconfiguration issues. Moreover, a
periodic review and update of configuration parameters are also beneficial as
part of the management process of applications. It is also necessary to create
segmented application architectures that offer a division between components
and defines different security groups, using Access Control Lists (ACLs).

Concerning BO, it is important to use programming languages that protect
against these attacks, as well as the use of compilers with detection
mechanisms. (Saito et al., 2016). Developers must validate all inputs and
follow well practice rules when using memory (e.g., verification of the
boundaries of buffers). Moreover, sensitive applications must be ran using the
lowest privileges possible and even isolated using sandbox techniques (MITRE,
2019f, g, h). To detect injection attacks, both static and dynamic analysis of
applications’ source code have been proposed (Project, 2017). For their
mitigation, it is necessary to escape all special characters included in the
input (Project, 2017; MITRE, 2019c). Multiple solutions have been proposed,
such as the use of whitelists and blacklists (MITRE, 2019b), the use of safe
languages and APIs containing automatic detection mechanisms (Project, 2017;
MITRE, 2019a), the use of sandboxing techniques to define strict boundaries
between processes (MITRE, 2019c), the definition of different permissions on
the system (MITRE, 2019b), and error messages with minimal but descriptive
details.

Figure 3. Relationship between the attacks, impacts, and countermeasures over
the BCI cycle. The phases of the cycle colored in red for each impact
represent issues documented in the literature, while those marked in blue are
our contribution. The attacks, impacts and countermeasures followed by
references have been documented in the literature, and those without a cite
represent our contribution.

##  3\. Security issues affecting the BCI deployments

This section reviews the different architectural deployments of the BCI cycle
found in the literature. After that, we group them into two main families,
characterized by the BCI cycle implementation and its application scenario. In
contrast to Section 2, where the security analysis is independent of the
deployment, this section reviews the state of the art of existing attacks
affecting the devices implementing each phase of the BCI cycle, as well as
their impacts and countermeasures. New opportunities, in terms of attacks and
countermeasures, missed by the literature, are also highlighted in this
section. Figure 4 represents both architectural deployments defined, Local
BCIs, and Global BCIs, indicating the communication between their elements and
the phases of the BCI cycle that each element implements according to the type
of deployment.

Figure 4. Representation of Local BCI and Global BCI deployments, indicating
the communication between their elements and the stages of the BCI cycle that
each element implements according to the architectural deployment.

###  3.1. Local BCI

####  3.1.1. Architecture description

Local BCI deployments highlight by managing the neural data acquisition and
stimulation processes of single users. This architecture typically deploys the
BCI phases between two physical devices, as represented in Figure 4. The first
one, identified as BCI device, focuses on the neural acquisition and
stimulation procedures (phases 1 and 2 of the BCI cycle). In contrast, BCI
applications (phase 5) run in a Near Control Device (NCD), a PC or smartphone
that controls the BCI device using either a wired or wireless communication
link. Phases 3 and 4 of the cycle can be implemented equally in both devices,
where manufacturers make the final decision. At this point, it is essential to
note that alternative designs can arise due to specific requirements of the
deployments, such as the presence of multiple users. Moreover, we consider
fully implantable BCIs within this architecture, since they require an
external device for its configuration and verification.

####  3.1.2. Examples of deployments

This kind of architectural deployment is the most commonly implemented for
consumer-grade BCIs, where commercial brands like NeuroSky or Emotiv focus on
scenarios such as gaming and entertainment (Martinovic et al., 2012; McMahon
and Schukat, 2018; Ahn et al., 2014). Neuromedical scenarios also use this
approach, where an NCD placed in the clinical environment manages the
acquisition and stimulation processes. This section specifically addresses the
issues detected in physical BCI devices, the inherent problems of the NCD, and
those related to the communication between BCI and NCD. At this point, it is
important to note that the attacks, impacts, and countermeasures detected for
the BCI cycle are also applicable.

####  3.1.3. Attacks

Focusing on BCI devices, Ballarin et al. (Ballarin Usieto and Minguez, 2018)
identified attacks affecting the device firmware throw a configuration link
(e.g., USB ports), having an impact on data integrity and confidentiality,
also generating disruptions on the system. Pycroft et al. (Pycroft et al.,
2016) identified the possibility of injecting malicious firmware updates.
Moreover, we identify that these attacks can serve as an opportunity to
generate safety problems. Ienca et al. (Ienca, 2015; Ienca and Haselager,
2016) documented cryptographic attacks, indicating that Cody’s Emokit project
was able to crack the encryption of data directly from the Emotiv EPOC, a
consumer-grade BCI. They detected that these attacks affect data integrity and
confidentiality. Marin et al. (Marin et al., 2018) detected that current IMDs
lack robust security mechanisms. Yaqoob et al. (Yaqoob et al., 2019)
identified that neurostimulation devices lack encryption and usually define
default passwords, impacting integrity and confidentially, easing unauthorized
access to sensitive data. We also identify that they produce service
availability and safety issues if they can modify the data.

The authors of (Camara et al., 2015; Pycroft and Aziz, 2018) highlighted that
attackers could focus on draining the battery of the device and thus affect
both service availability and users’ physical safety. In neurostimulation
systems, losing the battery capacity would result in a loss of treatment,
where the disease symptoms would reappear. Due to this, some IMDs include
rechargeable batteries, reducing the risks of depleting them, and thus
defining more robust solutions. It is also essential to consider that, in non-
rechargeable systems, surgery is required to replace the batteries, increasing
the risk of both physical and psychological safety issues.

The authors of (Pycroft et al., 2016; Bonaci et al., 2015a) described the
possibility of hijacking attacks, referred to as brainjacking, where the
attacker acquires complete access over the device by any means. These attacks
generate an impact on all four security impact metrics. Finally, Pycroft et
al. (Pycroft and Aziz, 2018) identified general confidentiality impacts than
can be shared by multiple attacks. They identified that close-loop IMDs use
physiological data acquired by the BCI to improve the stimulation procedures
or drug delivery. However, this sensitive data can be used by attackers to
acquire information about the patient’s health condition. Furthermore, an
attacker can acquire sensitive information stored in the device, such as
stimulation settings, personal data, or battery status, useful to perform new
attacks.

Considering NCDs, Ballarin et al. (Ballarin Usieto and Minguez, 2018)
identified social engineering and phishing attacks against BCIs, focused on
the acquisition of users’ authentication credentials, affecting data
confidentiality. Although BCI applications do not require a connection to the
Internet, the NCD can be connected. Therefore, we detect that these systems
can suffer malware attacks and, specifically, ransomware (Al-rimy et al.,
2018) and those based on botnets (Kurose and Ross, 2017; Kolias et al., 2017;
Stallings, 2017), with an impact on the integrity and availability of data and
applications contained in the NCD, as well as users’ safety. In particular,
botnets also generate data confidentiality issues, since attackers have
control over the system. Moreover, we detect sniffing attacks on NCDs taking
advantage of networking configuration and protocols, such as MAC flooding,
DHCP attacks, ARP spoofing, or DNS poisoning (Anu and Vimala, 2017), affecting
service and data integrity, confidentiality and availability.

Focusing on the communication between BCI devices and NCDs, Sundararajan et
al. (Sundararajan, 2017) studied the security of the commercial-grade Emotiv
Insight, which implemented Bluetooth Low Energy (BLE) in its version 4.0 to
communicate with a smartphone that contains the application offered by Emotiv.
They successfully performed man-in-the-middle attacks over the BLE link, being
able to intercept and modify information, force the BCI to perform unwanted
tasks, and conduct replay attacks affecting, therefore, integrity,
confidentiality, and availability of sensitive data. The literature has
documented further integrity and confidentiality impacts, where attackers can
intercept and modify sensitive data even using encryption (Li et al., 2015;
Sundararajan, 2017; Ballarin Usieto and Minguez, 2018; Takabi, 2016) (Pycroft
and Aziz, 2018; Landau et al., 2020; Marin et al., 2018). These attacks are
related to the cryptographic attacks described above, where weak encryption of
the data stored in the device can derive in man-in-the-middle attacks.
Finally, it is important to note that the attacks related to user data and
credentials have a higher impact if multiple users use the system.

####  3.1.4. Countermeasures

To some of the previous attacks, different countermeasures have been proposed.
Related to firmware attacks, Ballarin et al. (Ballarin Usieto and Minguez,
2018) indicated the encryption of the firmware, as well as an authenticity
verification throw hash or signature. Pycroft et al. (Pycroft et al., 2016)
highlighted periodic firmware updates and the use of authorization mechanisms
for these updates. The authors of (Camara et al., 2015; Pycroft et al., 2016;
Pycroft and Aziz, 2018) identified the use of access control mechanisms placed
in external devices with proximity to the patient and anomaly detection
systems over the BCI device usage to face potential threats such as battery
drain attacks. In particular, for these attacks, rechargeable batteries are
recommended to avoid a surgical replacement. The authors of (Landau et al.,
2020) proposed, as general countermeasures, the regulation of neurotechnology
as a way to standardize its manufacturing processes, as well as a reduction of
BCI training process, which tends to frustrate the users, being less willing
to cooperate. These measures are complementary with those documented by
(Pycroft and Aziz, 2018), which considered that BCI devices should keep logs
and access events, including mechanisms for reporting bugs.

The use of robust cryptographic mechanisms and the latest protocol versions
are determinant to avoid cryptographic attacks, man-in-the-middle attacks, and
sniffing attacks (Sundararajan, 2017; Ballarin Usieto and Minguez, 2018).
Besides, anonymization of the information transmitted from BCI to NCD is also
recommendable against attacks impacting confidentiality, for example, using
the BCI Anonymizer (Takabi, 2016; Bonaci et al., 2015a, b). Social engineering
and phishing attacks focused on credential theft can be reduced by
implementing a second authentication factor to access the BCI and proper
access control mechanisms (Takabi et al., 2016; Ballarin Usieto and Minguez,
2018) (Pycroft and Aziz, 2018). The application of the malware countermeasures
indicated in Section 2.3 can evade global malware threats impacting NCDs, by
updating all software to the latest version and implementing periodic backup
plans. Moreover, the use of ML techniques, as proposed by Fernández-Maimó et
al. (Fernández Maimó et al., 2019) for Medical Cyber-Physical Systems (MCPS),
can also be used to detect, classify, and mitigate ransomware attacks.
Concerning botnets, a wide variety of detection techniques have been detected
by us for the BCI field, like the use of anomaly detection based on ML and
signatures, the quarantine of infected devices, and the interruption of
particular communication flows (Amini et al., 2015; Kirubavathi and Anitha,
2018; Mahmoud et al., 2015). Finally, we consider that the recommendations of
the U.S. Food and Drug Administration (FDA) for premarket and postmarket
management of security in medical devices apply to BCI (U.S. Food and Drug
Administration, 2018; Schwartz, 2018; U.S. Food and Drug Administration,
2016).

###  3.2. Global BCI

####  3.2.1. Architecture description

Global BCI architectures focus on the management of neural data acquisition
and neural stimulation of multiple users through an Internet connection. This
architecture considers three devices to deploy the phases making up the BCI
cycle, as can be seen in Figure 4. In this family, the BCI device remains
focused on data acquisition and stimulation (phase 2), whereas the NCD is in
charge of the execution of applications (phase 5), as well as conversion and
processing actions (phase 3). Finally, the new element introduced in this
architecture is the Remote Control Device (RCD), representing one or more
external resources or services accessible via the Internet, such as cloud
computing and storage. It typically implements phases 4 and 5 of the BCI
cycle, as it has the resources to run more complex applications and
information analysis. The main difference between this architecture and the
one described for Local BCIs in Section 3.1 is that, in Local BCIs, the NCD
does not send user information to external services (e.g., cloud). Finally,
this section focuses on the problems associated with the communication between
NCD and RCD, and the BCI-related attacks that can apply to RCDs. However,
these later attacks are addressed in a general way, as specific cloud
computing attacks are outside the scope of this article.

####  3.2.2. Examples of deployments

This architectural deployment is the most innovative, as it allows the
communication of multiples users with external services and the creation of
complex deployments, where the data and information of every user are stored
and managed in a shared infrastructure. From a commercial point of view,
Emotiv allows users to contrast their data with the data stored by other
users, as well as keep users’ neural recordings in the cloud to visualize and
manipulate them, also offering an API called Emotiv Cortex (Emotiv, 2019b).
Besides, several companies worldwide provide distributed BCI services, as is
the case of Lifelines Neuro (Lifelines Neuro, 2020), which offers a continuous
EEG acquisition, storage, and visualization in their cloud platform. These
scenarios are especially relevant in the context of personalized medicine and
early diagnosis.

####  3.2.3. Attacks and countermeasures

Considering the attacks on this deployment, the issues documented in Section
3.1 for Local BCIs are also applicable in this architecture. However, Global
BCIs present higher risks, since these deployments are an opportunity for
remote attacks against interconnected BCI devices, which derives in physical
harm for their users. Furthermore, Takabi et al. (Takabi et al., 2016)
detected that BCI applications could send raw brain signals to cloud services
that execute ML techniques to extract sensitive information and therefore
affect confidentiality. We identify that this problem can also be present in
Local BCIs if the NCD has an Internet connection. Ballarin et al. (Ballarin
Usieto and Minguez, 2018) identified that man-in-the-middle attacks could
occur in the communication channel between NCD and RCD, affecting the
integrity and confidentiality of the data transmitted as well as the service
availability. They also detected that attacks on RCDs could have a higher
impact on confidentiality than on Local BCIs, as these platforms store
sensitive information from multiple users, that can be stolen or sold to third
parties. Ienca et al. (Ienca et al., 2018) detected different issues in Global
BCIs in terms of their usage. First, they highlighted that current brands,
such as Emotiv (Emotiv, 2019a), indicate in their privacy policy that they can
gather personal data, usage information, and interactions with other
applications, and that they can infer information from these sources, with
potential confidentiality issues. The authors identified as possible the use
of big data to extract associations and share the data with third parties.
Moreover, they detected that the use of cloud services could derive in a
massive database theft with sensitive data, an unclear legal liability in case
of breaches.

We identify that this architecture is quite similar to those defined and
implemented for IoT scenarios, where constrained devices communicate with
external services via intermediate systems, especially when multiple devices
interact. We detect that most of the security attacks and impacts defined by
Stellios et al. (Stellios et al., 2018) are also applicable in this
architecture. Moreover, we consider that the issues highlighted by the OWASP
in their IoT projects are critical aspects of Global BCIs (Open Web
Application Security Project, 2018). This relationship between IoT and
external services has been previously studied in cloud computing scenarios
(Botta et al., 2016). Despite the advantages, attacks on cloud computing can
impact integrity, confidentiality and availability in different cloud
architecture levels, such as infrastructure, networking, storage, and software
(Basu et al., 2018; Singh et al., 2016). The evolution of NCDs derives in
mobile devices with higher computing capabilities, integrated into mobile
cloud computing systems. However, they also have an impact on the security of
deployments (Mollah et al., 2017). We also detect that the improvement of NCDs
capabilities can also allow the introduction of fog computing in Global BCIs,
where NCDs perform part of the computation, generating new security and trust
issues (Zhang et al., 2018; Roman et al., 2018; Mahmud et al., 2018). Malware
attacks are also present in cloud environments, where ransomware and botnets
are common threats (Singh et al., 2016).

Focusing on general cloud computing countermeasures, Amara et al. (Amara et
al., 2017) identified security threats and attacks, as well as the mitigation
techniques against them. The use of honeypots, firewalls, and IDS in cloud
scenarios is convenient to reduce the impact of malware attacks (Roman et al.,
2018).

Figure 5 summarizes the previous attacks, impacts, and countermeasures. This
figure first shows the list of attacks considered in this section, associated
with a unique icon, where those attacks with references indicate that they
have been detected in the literature, while those without references represent
our contribution. After that, we show the impacts that generate the previous
attacks, organized by category. For each impact, we indicate the specific
attacks that cause the impact, and which elements of the architectural
deployments presented in Figure 4 are affected. Moreover, we consider the
issues on the communication links between these elements. In particular, the
attacks and elements identified in red represent issues detected in the
literature, whereas those in blue are our contributions. Finally, this figure
lists countermeasures detected both in the literature and by us, associating
each attack with a list of countermeasures. The color and reference criteria
used before for the impacts also applies to the countermeasures, where an
attack represented with a particular color indicates that all their
countermeasures have the same color.

Figure 5. Attacks, impacts, and countermeasures associated with the BCI
architectural deployments. Elements indicated in red represent information
detected in the literature, while blue represents our contribution.

##  4\. BCI trends and challenges

One of the first BCI solutions was developed at the end of the 1990s. It
supposed a significant advancement in the medical industry, specifically in
neurorehabilitation, bringing to the reality the mental control of prosthetic
limbs and wheelchairs (Nicolelis, 2001). During the decade of the 2000s, a new
generation of neuroprosthetic devices was developed to restore the mobility of
patients severely paralyzed, creating communication links between the brain
and a wide variety of actuators, such as robotic exoskeletons (Lebedev and
Nicolelis, 2017). This trend in the field of BCI has resulted in new paradigms
and scenarios in the last decade, where acquisition and stimulation procedures
are used together to acquire brain activity and deliver feedback to the brain
or peripheral nerves, defining the concept of bidirectional, or closed-loop,
BCIs. Focusing on these systems, NeuroPace RNS is the only technology
clinically approved for closed-loop treatment (Edwards et al., 2017). DBS is
nowadays considered as a unidirectional BCI system, or open-loop, only
performing stimulation actions. Nevertheless, current research aims to develop
closed-loop DBS systems that are able to automatically identify the best
stimulation parameters based on the status of the brain (Hell et al., 2019).
This evolution is also applicable for neuroprostheses, where the users can
mentally control prosthesis while receiving stimulation to recover motor
abilities (Levi et al., 2018).

This evolution allowed the definition of prospect ways of interaction where
the BCI acts as an online communication element with other systems and users,
based on Global BCI architectures. In particular, we subsequently present
several examples of futuristic systems to highlight the importance of security
in the progress of BCI technologies. Zhang et al. (Zhang et al., 2016) defined
the concept of the Internet of Brain, also known as BtI, where the BCI uses an
NCD to access Internet services, such as search results or social media.
Lebedev et al. (Lebedev and Nicolelis, 2017) also described experiments where
monkeys controlled remote robotic arms using BCI devices. More recently, Saad
et al. (Saad et al., 2019) identified that 6G technologies could enable the
interconnection of BCIs with the Internet. Besides, Martins et al. (Martins et
al., 2019) documented a fusion between neuralnanorobotics and cloud services
to acquire knowledge, defining the concept of Human Brain/Cloud Interface
(B/CI). Another futuristic approach, BtB, allows direct communications between
two brains, known as BtB (Pais-Vieira et al., 2013; Zhang et al., 2019b),
where Pais-Vieira et al. (Pais-Vieira et al., 2013) documented the real-time
exchange of information between the brain of two rats. These systems have also
been extended to create networks of interconnected brains, known as Brainet,
which can perform collaborative tasks between users and share knowledge,
memories, or thoughts through remote brains (Pais-Vieira et al., 2015; Jiang
et al., 2019). Although these systems are in an early research stage, they
could be a reality in the next decades, where security aspects will gain
enormous importance. To represent this trend, Figure 6 illustrates this
evolution of the literature, indicating the years of publication and
approaches. Besides, current innovations, such as the use of silicon-based
chips, could increase the quantity of information that we can acquire from the
brain, and ease the development of electronic devices to improve the
resolution of the neural acquisition and sensitivity of the process (Obaid et
al., 2020).

The BCI research field has gained relevance in the last few years, where
different governments have funded and promoted BCI initiatives. In the United
States of America, the DARPA is supporting the BRAIN Initiative (Brain
Research through Advancing Innovative Neurotechnologies) (Initiative, 2019).
Canada has launched its research line, called the Canadian Brain Research
Strategy (Illes et al., 2019; Strategy, 2019). On the other side of the
Atlantic ocean, the European Union has also supported different projects, such
as the Human Brain Project (HBP) (Project, 2019) or the Brain/Neural Computer
Interaction (BNCI) project (Brain/Neural Computer Interaction project, 2015;
Brunner et al., 2015). Asia has also promoted several initiatives, such as the
China Brain Project (Poo et al., 2016) or the Brain/MINDS project in Japan
(Brain/MINDS project, 2019). All the previous initiatives and projects aim to
advance the understanding of the human brain through the use of innovative
technologies. As a consequence, emerging technologies offer precise
acquisition and stimulation capabilities that enable new BCI application
scenarios. The common interest in the study of the human brain and, in
particular, on BCI leads to new opportunities for manufacturers, who can
increase their competitiveness producing revolutionary BCI services based on
growing paradigms such as the IoT, cloud computing, and big data. This
development derives in the improvement of the usability, accuracy and safety
of the products, together with their expansion to non-medical economic sectors
such as entertainment. The result of the above is a trend of BCI towards
Global BCI architecture deployments, where multiple BCI devices can
communicate between them to perform collaborative tasks, based on the
approaches of BtI, BtB, and Brainet. Once summarized the evolution of BCI and
its trend, below, we highlight the most relevant current and future challenges
concerning security on BCI.

Figure 6. Timeline of the evolution of BCI research, seen from the perspective
of BtI, BtB, and Brainet approaches.

###  4.1. Interoperability between BCI deployments

Existing BCI deployments consider isolated devices without standards to
provide interoperability in terms of communication and data representation.
This is the case of commercial BCI brands and devices, which have been
designed to resolve particular problems and are not compatible between them
(Ramadan and Vasilakos, 2017). Moreover, deployments integrating the
communication between several BCIs are ad hoc; that is, manufacturers design
and implement them, considering only the requirements of a particular
scenario. In this context, the current trend of BCIs towards paradigms such as
the IoT and cloud computing will require an improvement in interoperability,
as it is essential to ensure the future expansion of BCI technologies.
Besides, the lack of interoperability limits the definition of global
cybersecurity systems and mechanisms that can be applied. In this sense,
current BCI solutions are device-oriented and do not offer collaborative
mechanisms against cyberattacks. We detect as a future opportunity the use of
well-known standardized APIs, communication technologies, and protocols to
offer seamless protection on BCI. We also propose the use of ontologies to
represent neural information in a formal and standardized fashion. Different
companies and products would use a joint representation to ease data
interpretation, processing, and sharing. This homogenization would have a
positive impact on cybersecurity, enabling the design and deployment of new
protocols and mechanisms for the secure exchange of particular pieces of
sensitive data between independent BCI solutions. In particular, the exchange
of medical information between different organizations can be accomplished
using well-known standards, as is the case of the HL7 standard (HL7
International, 2019).

###  4.2. Extensibility of BCI designs

Extensibility refers to the ability of BCIs to add new functionality and
application scenarios dynamically. Nowadays, BCI devices suffer a lack of
extensibility, as companies manufacture them to provide particular services on
fixed application scenarios. The neural data processing is performed in a
fixed way and according to predefined premises. It means that each layer
making up BCI architectures performs particular processing tasks, which can
not be changed or even modified on demand (Sundararajan, 2017). Since each
application scenario has its requirements and restrictions, the trend towards
Global BCI will need new automatic and flexible architectures and processing
mechanisms over the acquired neural data. These aspects also affect the
security solutions that can be applied, since current constraints of BCI
systems prevent the use of reactive and adaptive defensive mechanisms to face
the threats described in previous sections. In conjunction with a lack of
interoperability, the security responsibilities of each phase of the
architecture are predefined and cannot be extended within that element, or
delegated to be performed in other systems. As a future line of work, we
highlight the design of BCI deployments that allow the implementation of most
of the operations performed in software, instead of hardware, allowing
developers to change the system’s behavior. Another possible solution is a
modular design of BCI, including supplementary modules, according to the
requirements. However, these modifications introduce new security challenges,
since software developments are more prone to errors and attacks, and new
modular systems will address specific challenges, such as the verification of
their authenticity.

###  4.3. Data protection

Current BCI architectures and deployments do not consider the protection of
neural data and personal information, as detected in the literature
(Sempreboni and Viganò, 2018; Ramadan and Vasilakos, 2017; Takabi, 2016). The
evolution of BCIs towards distributed scenarios with heterogeneous and
ubiquitous characteristics, such as BtB approaches, will require the storage
and management of multiple users’ personal and sensitive data. Because of
that, future deployments should ensure that this critical information is
transmitted and processed securely. Specifically, robust cryptography
mechanisms need to be applied over data communication and storage, while
techniques such as differential privacy or homomorphic encryption would help
to ensure the anonymization of the data. Moreover, users do not have control
over their privacy preferences to define who has access to the information and
in which particular circumstances. Because of that, there are no specific
privacy regulations to ensure that applications and external services can
access only to the neural information accepted by users, nor any limitation on
manufacturers or third-parties to prevent the processing of sensitive neural
data without users authorization. To improve this situation, we propose
policy-based solutions that allow users to define their privacy preferences
based on their particular context. Besides, we propose the use of user-
friendly systems that also help users proposing privacy-preserving
recommendations. These initiatives must also align with the data protection
law applicable in each country.

###  4.4. Physical and architectural BCI threats

Nowadays, a considerable amount of BCI designs and deployments do not consider
cybersecurity issues such as the protection of communications, processing,
storage, and applications. Although some solutions include security
mechanisms, like Medtronic DBS products, some aspects must be improved. In
particular, these devices use proprietary telemetry protocols (Medtronic,
2020a), which recently has led to vulnerabilities ((CISA), 2020).
Nevertheless, companies such as Medtronic or Boston Scientific publish
security bulletins when a security vulnerability affecting their devices is
detected (Medtronic, 2020c; Scientific, 2020), highlighting the interest that
companies have on security. Moreover, the lack of BCI standards and,
specifically, cybersecurity standards, prevent the homogenization of the
security solutions implemented (Bonaci et al., 2015a; Takabi et al., 2016;
Sundararajan, 2017; Ramadan and Vasilakos, 2017). The expansion of BCI will
require robust dynamic cybersecurity mechanisms to face future challenges.
Moreover, the development of more precise BCI devices and the integration of a
large number of devices and systems, would result in a massive production of
sensitive data. In our opinion, this context could benefit the increase of
vulnerable systems and communication links. To address these challenges,
manufacturers should evaluate alternatives for the mitigation of cyberattacks
from multiple perspectives, aiming to implement seamless cybersecurity
solutions. Based on that, we propose using 5G network technologies, since they
have been designed to support a significant number of devices, which are
necessary for BtB and Brainet scenarios. In particular, we identify that
techniques and paradigms associated with 5G, such as Network Function
Virtualisation (NFV) and Software-Defined Networking (SDN) for the
virtualization and dynamic management of network communications, are useful
for the development of reactive cybersecurity solutions. Also, technologies
such as Blockchain can provide the tracking of the information and ensure that
it has not been modified, guaranteeing the integrity of the data. Moreover, we
identify the protection of network communications by using protocols such as
TLS (IETF, 2018) or IPsec (IETF, 2011) as an opportunity, which offers robust
mechanisms against cyberattacks. Moreover, we detect that the application of
information risk management standards, such as the ISO 27000 (ISO, 2018), and
the NIST Cybersecurity Framework (NIST, 2018) could benefit the creation of
homogeneous and robust solutions. Finally, we identify that game theory
applied to BCI security strategies can be useful to implement regularly
evolving systems. In particular, they can be useful to model how to establish
the most appropriate countermeasures against continuously and automatically
changing attacks, specifically in distributed scenarios such as BtB (Attiah et
al., 2018).

##  5\. Conclusion

This article performs a global and comprehensive analysis of the literature of
BCIs in terms of security and safety. Mainly, we have evaluated the attacks,
impacts and countermeasures that BCI solutions suffer from the software’s
architectural design and implementation perspectives. Initially, we proposed a
unified version of the BCI cycle to include neural data acquisition and
stimulation processes. Once having a homogeneous BCI cycle design, we
identified security attacks, impacts, and countermeasures affecting each phase
of the cycle. It served as a starting point to determine which processes and
functioning stages of BCIs are more prone to attacks. The architectural
deployments of current BCI solutions have also been analyzed to highlight the
security attacks and countermeasures related to each approach to understanding
the issues of these technologies in terms of network communications. Finally,
we provide our vision regarding BCI trends and depict that the current
evolution of BCIs towards interconnected devices is generating tremendous
security concerns and challenges, which will increase in the near future.

Among the learned lessons, we highlight the following five: (1) the field of
security oriented to BCI technologies is not yet mature, generating
opportunities for attackers; (2) even non-sophisticated attacks can have a
significant impact on both BCI technologies and users’ safety; (3) there is a
current opportunity for standardization initiatives to unify BCIs in terms of
information security; (4) well-studied fields, such as IMDs and IoT, can
define a guide to develop robust security mechanisms for BCIs; (5) users’
awareness of BCI security issues is vital.

As future work, we plan to focus our efforts on the design and implementation
of solutions able to detect and mitigate attacks affecting the stimulation
process in real time. In this context, we are considering using artificial
intelligence techniques to detect anomalies in the firing patterns and neural
activity controlled by BCI solutions in charge of stimulating the brain.
Besides, we also plan to contribute by improving the interoperability and data
protection mechanisms of existing BCI architectures. Finally, another future
work is the development of dynamic and proactive systems as an opportunity to
mitigate the impacts of the attacks documented in this work.

##  6\. Acknowledgments

This work has been supported by the Irish Research Council under the
government of Ireland post-doc fellowship (grant GOIPD/2018/466), by the
Science Foundation Ireland (SFI) under grant number 16/RC/3948 and co-funded
under the European Regional Development Fund and by FutureNeuro industry
partners, and by the European Union’s Horizon 2020 Research and Innovation
Programme through the Marie Skłodowska-Curie grant under Agreement 839553.
Finally, we would also like to thank Mattia Zago for his advice during the
development of the visual support of the work.

## References

  * (1)
  * Ahn et al. (2014) Minkyu Ahn, Mijin Lee, Jinyoung Choi, Sung Jun, Minkyu Ahn, Mijin Lee, Jinyoung Choi, and Sung Chan Jun. 2014\.  A Review of Brain-Computer Interface Games and an Opinion Survey from Researchers, Developers and Users.  _Sensors_ 14, 8 (Aug 2014), 14601–14633.
  * Al-rimy et al. (2018) Bander Ali Saleh Al-rimy, Mohd Aizaini Maarof, and Syed Zainudeen Mohd Shaid. 2018.  Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions.  _Computers & Security_ 74 (May 2018), 144–166.
  * Amara et al. (2017) Naseer Amara, Huang Zhiqui, and Awais Ali. 2017.  Cloud Computing Security Threats and Attacks with Their Mitigation Techniques. In _2017 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC)_. IEEE, Nanjing, China, 244–251.
  * Amini et al. (2015) Pedram Amini, Muhammad Amin Araghizadeh, and Reza Azmi. 2015.  A survey on Botnet: Classification, detection and defense. In _2015 International Electronics Symposium (IES)_. IEEE, Surabaya, Indonesia, 233–238.
  * Anu and Vimala (2017) P. Anu and S. Vimala. 2017\.  A survey on sniffing attacks on computer networks. In _2017 International Conference on Intelligent Computing and Control (I2C2)_. IEEE, Coimbatore, India, 5.
  * Arico et al. (2018) P. Arico, G Borghini, G Di Flumeri, N Sciaraffa, and F Babiloni. 2018.  Passive BCI beyond the lab: Current trends and future directions.  _Physiological Measurement_ 39, 8 (Aug 2018), 08TR02.
  * Attiah et al. (2018) A. Attiah, M. Chatterjee, and C. C. Zou. 2018\.  A Game Theoretic Approach to Model Cyber Attack and Defense Strategies. In _2018 IEEE International Conference on Communications (ICC)_. IEEE, Kansas City, MO, USA, 1–7.
  * Ballarin Usieto and Minguez (2018) Pablo Ballarin Usieto and Javier Minguez. 2018.  Avoiding brain hacking - Challenges of cybersecurity and privacy in Brain Computer Interfaces.  https://www.bitbrain.com/blog/cybersecurity-brain-computer-interface
  * Basu et al. (2018) Srijita Basu, Arjun Bardhan, Koyal Gupta, Payel Saha, Mahasweta Pal, Manjima Bose, Kaushik Basu, Saunak Chaudhury, and Pritika Sarkar. 2018.  Cloud computing security challenges & solutions-A survey. In _2018 IEEE 8th Annual Computing and Communication Workshop and Conference, CCWC 2018_. IEEE, Las Vegas, NV, USA, 347–356.
  * Bentabet and Berrached (2016) Nebia Bentabet and Nasr Eddine Berrached. 2016.  Synchronous P300 based BCI to control home appliances. In _Proceedings of 2016 8th International Conference on Modelling, Identification and Control, ICMIC 2016_. IEEE, Algiers, Algeria, 835–838.
  * Bernal et al. (2020) S. L. Bernal, A. H. Celdrán, L. F. Maimó, M. T. Barros, S. Balasubramaniam, and G. M. Pérez. 2020.  Cyberattacks on Miniature Brain Implants to Disrupt Spontaneous Neural Signaling.  _IEEE Access_ (2020).
  * Bernstein et al. (2012) Abraham Bernstein, Mark Klein, and Thomas W. Malone. 2012\.  Programming the global brain.  _Commun. ACM_ 55, 5 (May 2012), 41\.
  * Bettayeb et al. (2019) Meriem Bettayeb, Qassim Nasir, and Manar Abu Talib. 2019\.  Firmware Update Attacks and Security for IoT Devices. In _Proceedings of the ArabWIC 6th Annual International Conference Research Track_. ACM Press, New York, New York, USA, 6.
  * Bikson et al. (2018) Marom Bikson, Andre R. Brunoni, Leigh E. Charvet, Vincent P. Clark, Leonardo G. Cohen, Zhi-De Deng, Jacek Dmochowski, Dylan J. Edwards, Flavio Frohlich, Emily S. Kappenman, Kelvin O. Lim, Colleen Loo, Antonio Mantovani, David P. McMullen, Lucas C. Parra, Michele Pearson, Jessica D. Richardson, Judith M. Rumsey, Pejman Sehatpour, David Sommers, Gozde Unal, Eric M. Wassermann, Adam J. Woods, and Sarah H. Lisanby. 2018\.  Rigor and reproducibility in research with transcranial electrical stimulation: An NIMH-sponsored workshop.  _Brain Stimulation_ 11, 3 (2018), 465 – 480.
  * Birajdar and Mankar (2013) Gajanan K. Birajdar and Vijay H. Mankar. 2013.  Digital image forgery detection using passive techniques: A survey.  _Digital Investigation_ 10, 3 (Oct 2013), 226–245.
  * Black and Bojanova (2016) Paul E. Black and Irena Bojanova. 2016.  Defeating Buffer Overflow: A Trivial but Dangerous Bug.  _IT Professional_ 18, 6 (Nov 2016), 58–61.
  * Bonaci et al. (2015a) Tamara Bonaci, Ryan Calo, and Howard Jay Chizeck. 2015a.  App Stores for the Brain : Privacy and Security in Brain-Computer Interfaces.  _IEEE Technology and Society Magazine_ 34, 2 (Jun 2015), 32–39.
  * Bonaci et al. (2015b) Tamara Bonaci, Jeffrey Herron, Charles Matlack, and Howard Jay Chizeck. 2015b.  Securing the Exocortex: A Twenty-First Century Cybernetics Challenge.  _IEEE Technology and Society Magazine_ 34, 3 (Sep 2015), 44–51.  arXiv:hep-ph/0011146
  * Botta et al. (2016) Alessio Botta, Walter de Donato, Valerio Persico, and Antonio Pescapé. 2016.  Integration of Cloud computing and Internet of Things: A survey.  _Future Generation Computer Systems_ 56 (Mar 2016), 684–700.
  * Brain/MINDS project (2019) Brain/MINDS project. 2019\.  Brain/MINDS project.  https://brainminds.jp/en/
  * Brain/Neural Computer Interaction project (2015) Brain/Neural Computer Interaction project. 2015.  Brain/Neural Computer Interaction project.  http://bnci-horizon-2020.eu/
  * Brunner et al. (2015) Clemens Brunner, Niels Birbaumer, Benjamin Blankertz, Christoph Guger, Andrea Kübler, Donatella Mattia, José del R. Millán, Felip Miralles, Anton Nijholt, Eloy Opisso, Nick Ramsey, Patric Salomon, and Gernot R. Müller-Putz. 2015.  BNCI Horizon 2020: towards a roadmap for the BCI community.  _Brain-Computer Interfaces_ 2, 1 (Jan 2015), 10.
  * Buhmann et al. (2017) Carsten Buhmann, Torge Huckhagel, Katja Engel, Alessandro Gulberti, Ute Hidding, Monika Poetter-Nerger, Ines Goerendt, Peter Ludewig, Hanna Braass, Chi-un Choe, Kara Krajewski, Christian Oehlwein, Katrin Mittmann, Andreas K. Engel, Christian Gerloff, Manfred Westphal, Johannes A. Köppen, Christian K. E. Moll, and Wolfgang Hamel. 2017\.  Adverse events in deep brain stimulation: A retrospective long-term analysis of neurological, psychiatric and other occurrences.  _PLOS ONE_ 12, 7 (07 2017), 1–21.
  * Camara et al. (2015) Carmen Camara, Pedro Peris-Lopez, and Juan E. Tapiador. 2015\.  Security and privacy issues in implantable medical devices: A comprehensive survey.  _Journal of Biomedical Informatics_ 55 (Jun 2015), 272–289.
  * Chakladar and Chakraborty (2018) Debashis Das Chakladar and Sanjay Chakraborty. 2018.  Feature Extraction and Classification in Brain-Computer Interfacing : Future Research Issues and Challenges.  In _Natural Computing for Unsupervised Learning_. Springer, Cham, Cham, Switzerland, Chapter 5, 101–131.
  * Chizeck and Bonaci (2014) Howard Jay Chizeck and Tamara Bonaci. 2014.  Brain-Computer Interface Anonymizer. US Patent Application.  US20140228701A1.
  * (CISA) (2020) Cybersecurity & Infrastructure Security Agancy (CISA). 2020.  ICS Medical Advisory (ICSMA-19-080-01).  https://us-cert.cisa.gov/ics/advisories/ICSMA-19-080-01
  * Coogan and He (2018) Christopher G. Coogan and Bin He. 2018.  Brain-Computer Interface Control in a Virtual Reality Environment and Applications for the Internet of Things.  _IEEE Access_ 6 (2018), 10840–10849.
  * de Oliveira Júnior et al. (2018) Wilson G. de Oliveira Júnior, Juliana M. de Oliveira, Roberto Munoz, and Victor Hugo C. de Albuquerque. 2018\.  A proposal for Internet of Smart Home Things based on BCI system to aid patients with amyotrophic lateral sclerosis.  _Neural Computing and Applications_ (2018), 11.
  * Dembek et al. (2017) Till A. Dembek, Paul Reker, Veerle Visser-Vandewalle, Jochen Wirths, Harald Treuer, Martin Klehr, Jan Roediger, Haidar S. Dafsari, Michael T. Barbe, and Lars Timmermann. 2017\.  Directional DBS increases side-effect thresholds—A prospective, double-blind trial.  _Movement Disorders_ 32, 10 (2017), 1380–1388.
  * Denning et al. (2009) Tamara Denning, Yoky Matsuoka, and Tadayoshi Kohno. 2009\.  Neurosecurity: security and privacy for neural devices.  _Neurosurgical Focus_ 27, 1 (2009), E7.
  * Eckstein et al. (2012) Miguel P. Eckstein, Koel Das, Binh T. Pham, Matthew F. Peterson, Craig K. Abbey, Jocelyn L. Sy, and Barry Giesbrecht. 2012.  Neural decoding of collective wisdom with multi-brain computing.  _NeuroImage_ 59, 1 (Jan 2012), 94–108.
  * Edwards et al. (2017) Christine A. Edwards, Abbas Kouzani, Kendall H. Lee, and Erika K. Ross. 2017.  Neurostimulation Devices for the Treatment of Neurologic Disorders.  _Mayo Clinic Proceedings_ 92, 9 (2017), 1427–1444.
  * Emotiv (2019a) Emotiv. 2019a.  Emotiv.  https://www.emotiv.com/
  * Emotiv (2019b) Emotiv. 2019b.  Emotiv Cortex API.  https://emotiv.github.io/cortex-docs/{#}introduction
  * Emotiv (2019c) Emotiv. 2019c.  EMOTIV EPOC+.  https://www.emotiv.com/epoc/
  * Fernández Maimó et al. (2019) Lorenzo Fernández Maimó, Alberto Huertas Celdrán, Ángel Perales Gómez, Félix García Clemente, James Weimer, and Insup Lee. 2019.  Intelligent and Dynamic Ransomware Spread Detection and Mitigation in Integrated Clinical Environments.  _Sensors_ 19, 5 (Mar 2019), 1114\.
  * Finlayson et al. (2019) Samuel G Finlayson, John D Bowers, Joichi Ito, Jonathan L Zittrain, Andrew L Beam, and Isaac S Kohane. 2019\.  Adversarial attacks on medical machine learning.  _Science_ 363, 6433 (Mar 2019), 1287–1289.
  * Francis (2007) Heylighen Francis. 2007\.  The Global Superorganism: an evolutionary-cybernetic model of the emerging network society.  _Social Evolution & History_ 6, 1 (2007), 58–119.
  * Frank et al. (2017) Mario Frank, Tiffany Hwu, Sakshi Jain, Robert T. Knight, Ivan Martinovic, Prateek Mittal, Daniele Perito, Ivo Sluganovic, and Dawn Song. 2017.  Using EEG-Based BCI Devices to Subliminally Probe for Private Information. In _Proceedings of the 2017 on Workshop on Privacy in the Electronic Society - WPES ’17_. ACM Press, New York, New York, USA, 133–136.  arXiv:1312.6052
  * Fu et al. (2018) Jianwen Fu, Jingfeng Xue, Yong Wang, Zhenyan Liu, and Chun Shan. 2018.  Malware Visualization for Fine-Grained Classification.  _IEEE Access_ 6 (2018), 14510–14523.
  * Fukushima et al. (2014) Ariko Fukushima, Reiko Yagi, Norie Kawai, Manabu Honda, Emi Nishina, and Tsutomu Oohashi. 2014\.  Frequencies of Inaudible High-Frequency Sounds Differentially Affect Brain Activity: Positive and Negative Hypersonic Effects.  _PLoS ONE_ 9, 4 (apr 2014), e95464.
  * Gomes-Osman et al. (2018) Joyce Gomes-Osman, Aprinda Indahlastari, Peter J. Fried, Danylo L. F. Cabral, Jordyn Rice, Nicole R. Nissim, Serkan Aksu, Molly E. McLaren, and Adam J. Woods. 2018.  Non-invasive Brain Stimulation: Probing Intracortical Circuits and Improving Cognition in the Aging Brain.  _Frontiers in Aging Neuroscience_ 10 (2018), 177.
  * Goodfellow et al. (2018) Ian Goodfellow, Patrick McDaniel, and Nicolas Papernot. 2018\.  Making machine learning robust against adversarial inputs.  _Commun. ACM_ 61, 7 (Jul 2018), 56–66.
  * Grau et al. (2014) Carles Grau, Romuald Ginhoux, Alejandro Riera, Thanh Lam Nguyen, Hubert Chauvat, Michel Berg, Julià L. Amengual, Alvaro Pascual-Leone, and Giulio Ruffini. 2014\.  Conscious Brain-to-Brain Communication in Humans Using Non-Invasive Technologies.  _PLoS ONE_ 9, 8 (Aug 2014), e105225.
  * Grover et al. (2014) Kanika Grover, Alvin Lim, and Qing Yang. 2014.  Jamming and anti-jamming techniques in wireless networks: a survey.  _International Journal of Ad Hoc and Ubiquitous Computing_ 17, 4 (2014), 197.
  * Gupta et al. (2017) Surbhi Gupta, Abhishek Singhal, and Akanksha Kapoor. 2017\.  A literature survey on social engineering attacks: Phishing attack. In _Proceeding - IEEE International Conference on Computing, Communication and Automation, ICCCA 2016_. IEEE, Noida, India, 537–540.
  * Hartmann et al. (2019) Christian J. Hartmann, Sabine Fliegen, Stefan J. Groiss, Lars Wojtecki, and Alfons Schnitzler. 2019\.  An update on best practice of deep brain stimulation in Parkinson’s disease.  _Therapeutic Advances in Neurological Disorders_ 12 (2019).
  * Hatfield (2018) Joseph M. Hatfield. 2018\.  Social engineering in cybersecurity: The evolution of a concept.  _Computers and Security_ 73 (2018), 102–113.
  * Haupert et al. (2018) Vincent Haupert, Dominik Maier, Nicolas Schneider, Julian Kirsch, and Tilo Müller. 2018.  Honey, I Shrunk Your App Security: The State of Android App Hardening. In _Detection of Intrusions and Malware, and Vulnerability Assessment_. Springer International Publishing, Cham, 69–91.
  * He et al. (2017) Shenghong He, Tianyou Yu, Zhenghui Gu, and Yuanqing Li. 2017\.  A hybrid BCI web browser based on EEG and EOG signals. In _2017 39th Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC)_. IEEE, Seogwipo, South Korea, 1006–1009.
  * Hell et al. (2019) Franz Hell, Carla Palleis, Jan H. Mehrkens, Thomas Koeglsperger, and Kai Bötzel. 2019\.  Deep Brain Stimulation Programming 2.0: Future Perspectives for Target Identification and Adaptive Closed Loop Stimulation.  _Frontiers in Neurology_ 10 (2019), 314.
  * HL7 International (2019) HL7 International. 2019\.  Health Level Seven.  https://www.hl7.org/
  * Hong and Khan (2017) Keum Shik Hong and Muhammad Jawad Khan. 2017.  Hybrid brain-computer interface techniques for improved classification accuracy and increased number of commands: A review.  _Frontiers in Neurorobotics_ 11 (Jul 2017), 35\.
  * Hosseini et al. (2017) Mohammad-Parsa Hosseini, Dario Pompili, Kost Elisevich, and Hamid Soltanian-Zadeh. 2017.  Optimized Deep Learning for EEG Big Data and Seizure Prediction BCI via Internet of Things.  _IEEE Transactions on Big Data_ 3, 4 (Dec 2017), 392–404.
  * Huertas Celdrán et al. (2016) Alberto Huertas Celdrán, Ginés Dólera Tormo, Félix Gómez Mármol, Manuel Gil Pérez, and Gregorio Martínez Pérez. 2016.  Resolving privacy-preserving relationships over outsourced encrypted data storages.  _International Journal of Information Security_ 15, 2 (Apr 2016), 195–209.
  * Iandoli et al. (2009) Luca Iandoli, Mark Klein, and Giuseppe Zollo. 2009.  Enabling On-Line Deliberation and Collective Decision-Making through Large-Scale Argumentation.  _International Journal of Decision Support System Technology_ 1, 1 (Jan 2009), 69–92.
  * Ienca (2015) Marcello Ienca. 2015\.  Neuroprivacy, neurosecurity and brain-hacking: Emerging issues in neural engineering.  _Bioethica Forum_ 8, 2 (2015), 51–53.
  * Ienca and Haselager (2016) Marcello Ienca and Pim Haselager. 2016.  Hacking the brain: brain–computer interfacing technology and the ethics of neurosecurity.  _Ethics and Information Technology_ 18, 2 (Jun 2016), 117–129.
  * Ienca et al. (2018) Marcello Ienca, Pim Haselager, and Ezekiel J. Emanuel. 2018\.  Brain leaks and consumer neurotechnology.  _Nature Biotechnology_ 36, 9 (2018), 805–810.
  * IETF (2011) IETF. 2011.  IP Security (IPsec) and Internet Key Exchange (IKE) Document Roadmap.  https://tools.ietf.org/html/rfc6071
  * IETF (2018) IETF. 2018.  The Transport Layer Security (TLS) Protocol Version 1.3.  https://tools.ietf.org/html/rfc8446
  * Illes et al. (2019) Judy Illes, Samuel Weiss, Jaideep Bains, Jennifer A Chandler, Patricia Conrod, Yves De Koninck, Lesley K Fellows, Deanna Groetzinger, Eric Racine, Julie M Robillard, and Marla B Sokolowski. 2019.  A Neuroethics Backbone for the Evolving Canadian Brain Research Strategy.  _Neuron_ 101, 3 (Feb 2019), 370–374.
  * Initiative (2019) The BRAIN Initiative. 2019\.  The BRAIN Initiative.  https://braininitiative.nih.gov/
  * ISO (2018) ISO. 2018.  ISO/IEC 27001 Information security management.  https://www.iso.org/isoiec-27001-information-security.html
  * Jagielski et al. (2018) Matthew Jagielski, Alina Oprea, Battista Biggio, Chang Liu, Cristina Nita-Rotaru, and Bo Li. 2018\.  Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning. In _Proceedings - IEEE Symposium on Security and Privacy_. IEEE, San Francisco, CA, USA, 19–35.
  * Jiang et al. (2019) Linxing Jiang, Andrea Stocco, Darby M. Losey, Justin A. Abernethy, Chantel S. Prat, and Rajesh P. N. Rao. 2019.  BrainNet: A Multi-Person Brain-to-Brain Interface for Direct Collaboration Between Brains.  _Scientific Reports_ 9, 1 (Dec 2019), 6115\.
  * José and Méndez (2018) Sergio José and Rodríguez Méndez. 2018\.  Modeling actuations in BCI-O. In _Proceedings of the 8th International Conference on the Internet of Things - IOT ’18_. ACM Press, New York, New York, USA, 6.
  * Kapeller et al. (2014) Christoph Kapeller, Rupert Ortner, Gunther Krausz, Markus Bruckner, Brendan Z. Allison, Christoph Guger, and Günter Edlinger. 2014\.  Toward Multi-brain Communication: Collaborative Spelling with a P300 BCI. In _International Conference on Augmented Cognition_. Springer, Cham, Cham, 47–54.
  * Karim et al. (2006) Ahmed A. Karim, Thilo Hinterberger, Jürgen Richter, Jürgen Mellinger, Nicola Neumann, Herta Flor, Andrea Kübler, and Niels Birbaumer. 2006.  Neural Internet: Web Surfing with Brain Potentials for the Completely Paralyzed.  _Neurorehabilitation and Neural Repair_ 20, 4 (Dec 2006), 508–515.
  * Katona et al. (2019) Jozsef Katona, Tibor Ujbanyi, Gergely Sziladi, and Attila Kovari. 2019.  _Electroencephalogram-Based Brain-Computer Interface for Internet of Robotic Things_.  Springer International Publishing, Cham, Chapter 12, 253–275.
  * Khabarova et al. (2018) Elena Khabarova, Natalia Denisova, Aleksandr Dmitriev, Konstantin Slavin, and Leo Verhagen Metman. 2018\.  Deep Brain Stimulation of the Subthalamic Nucleus in Patients with Parkinson Disease with Prior Pallidotomy or Thalamotomy.  _Brain Sciences_ 8, 4 (Apr 2018), 66\.
  * Kirubavathi and Anitha (2018) G. Kirubavathi and R. Anitha. 2018.  Structural analysis and detection of android botnets using machine learning techniques.  _International Journal of Information Security_ 17, 2 (Apr 2018), 153–167.
  * Kolias et al. (2017) Constantinos Kolias, Georgios Kambourakis, Angelos Stavrou, and Jeffrey Voas. 2017.  DDoS in the IoT: Mirai and other botnets.  _Computer_ 50, 7 (2017), 80–84.
  * Kubanek (2018) Jan Kubanek. 2018\.  Neuromodulation with transcranial focused ultrasound.  _Neurosurgical focus_ 44, 2 (feb 2018), E14.
  * Kuhn et al. (2001) D. Richard Kuhn, Vincent C Hu, W. Timothy Polk, and Shu-Jen Chang. 2001.  _Introduction to Public Key Technology and the Federal PKI Infrastructure_.  Technical Report. National Institute of Standards and Technology. 1–54 pages.  https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-32.pdf
  * Kurose and Ross (2017) James Kurose and Keith Ross. 2017.  _Computer Networking: A Top-Down Approach_ (7 ed.).  Pearson, London. 852 pages.
  * Kyriazis (2015) Marios Kyriazis. 2015\.  Systems neuroscience in focus: from the human brain to the global brain?  _Frontiers in Systems Neuroscience_ 9 (Feb 2015), 7\.
  * Landau et al. (2020) Ofir Landau, Rami Puzis, and Nir Nissim. 2020.  Mind Your Mind.  _Comput. Surveys_ 53, 1 (2020), 1–38.
  * Laport et al. (2018) Francisco Laport, Francisco J. Vazquez-Araujo, Paula M. Castro, Adriana Dapena, Francisco Laport, Francisco J. Vazquez-Araujo, Paula M. Castro, and Adriana Dapena. 2018\.  Brain-Computer Interfaces for Internet of Things.  _Proceedings_ 2, 18 (Sep 2018), 1179\.
  * Le Groux et al. (2010) Sylvain Le Groux, Jonatas Manzolli, Paul F. Verschure, Marti Sanchez, Andre Luvizotto, Anna Mura, Aleksander Valjamae, Christoph Guger, Robert Prueckl, and Ulysses Bernardet. 2010\.  Disembodied and Collaborative Musical Interaction in the Multimodal Brain Orchestra. In _Proceedings of the International Conference on New Interfaces for Musical Expression_. MIME, Sydney, Australia, 309–314.
  * Lebedev and Nicolelis (2017) Mikhail A. Lebedev and Miguel A. L. Nicolelis. 2017.  Brain-Machine Interfaces: From Basic Science to Neuroprostheses and Neurorehabilitation.  _Physiological Reviews_ 97, 2 (Apr 2017), 767–837.
  * Lee et al. (2017) Wonhye Lee, Suji Kim, Byeongnam Kim, Chungki Lee, Yong An Chung, Laehyun Kim, and Seung-Schik Yoo. 2017.  Non-invasive transmission of sensorimotor information in humans using an EEG/focused ultrasound brain-to-brain interface.  _PLOS ONE_ 12, 6 (Jul 2017), e0178476.
  * León Ruiz et al. (2018) M. León Ruiz, M. L. Rodríguez Sarasa, L. Sanjuán Rodríguez, J. Benito-León, E. García-Albea Ristol, and S. Arce Arce. 2018\.  Current evidence on transcranial magnetic stimulation and its potential usefulness in post-stroke neurorehabilitation: Opening new doors to the treatment of cerebrovascular disease.  _Neurología (English Edition)_ 33, 7 (2018), 459–472.
  * Levi et al. (2018) Timothée Levi, Paolo Bonifazi, Paolo Massobrio, and Michela Chiappalone. 2018.  Editorial: Closed-Loop Systems for Next-Generation Neuroprostheses.  _Frontiers in Neuroscience_ 12 (2018), 26.
  * Li and Zhang (2016) Guangye Li and Dingguo Zhang. 2016.  Brain-Computer Interface Controlled Cyborg: Establishing a Functional Information Transfer Pathway from Human Brain to Cockroach Brain.  _PLOS ONE_ 11, 3 (Mar 2016), e0150667.
  * Li et al. (2015) Qianqian Li, Ding Ding, and Mauro Conti. 2015.  Brain-Computer Interface applications: Security and privacy challenges. In _2015 IEEE Conference on Communications and Network Security (CNS)_. IEEE, San Francisco, CA, USA, 663–666.
  * Lifelines Neuro (2020) Lifelines Neuro. 2020\.  Neurodiagnostics Without Boundaries.  https://www.lifelinesneuro.com/