Secure access to implantable medical devices: A deep learning-driven protocol using ECG signals

The Internet of Things in medical applications demands strong privacy and security, particularly for implantable medical devices (IMDs) that must be reconfigured wirelessly through programmer devices. Existing IMD access-control protocols offer partial protection but still face challenges in accuracy and reliability. Biometric signals, especially Electrocardiogram (ECG), provide a promising alternative for secure and continuous authentication in such IoT systems. This work proposes four deep learning-based authorization approaches enabling secure communication between an IMD and a nearby programmer using ECG-derived representations. The methods fall into two categories: (1) Reliable IMD (RI) and unReliable IMD (uRI), where RI assumes the IMD’s internally recorded ECG is trustworthy (authentication uses only the programmer’s signal), while uRI requires cross-verification between IMD and programmer signals; and (2) Omni (multi-user authentication) versus Mono (single-user authentication). Mono-RI and Omni-RI employ convolutional neural network (CNN)-based architectures, whereas Mono-uRI and Omni-uRI use Siamese networks to support both authentication and replay attack detection. Experimental results show that all four models outperform state-of-the-art solutions. Mono-RI achieves 97.73% authentication accuracy, while Omni-uRI reaches 98.75%. Replay attack detection rates are 99.19% for Mono models and 90.73% for Omni models. These findings demonstrate that the proposed methods are effective across different operational scenarios, supporting both high-security modes and emergency modes that demand rapid access, depending on the desired balance between performance and computational complexity. • ECG authentication for medical devices using CNN and Siamese networks. • High accuracy in user verification and replay attack detection. • Balances security and speed for normal and emergency operation modes. • Prototype circuit validates authorization method and energy use.