Privacy-preserving authentication protocol for user personal device security in Brain–Computer Interface

Abstract

Brain–Computer Interface (BCI) technology has emerged as a transformative tool, particularly for individuals with severe motor disabilities. Non-invasive BCI systems, leveraging Electroencephalography (EEG), offer a direct interface between users and external devices, bypassing the need for muscular control. However, ensuring the security and privacy of users’ neural data remains a critical challenge. In this paper, we propose a novel privacy-preserving authentication scheme for EEG-based BCI systems, utilizing elliptic curve cryptography (ECC). Our scheme balances robust security with computational efficiency, making it suitable for resource-constrained environments. Since we are addressing security in a resource-constrained environment, such as EEG in BCI, we have constructed a lightweight authentication algorithm to meet the stringent requirements of minimal computational resources and energy consumption. The security analysis and performance evaluation of the authentication protocol show that our scheme is resistant to various attacks, such as replay, offline password guessing, privilege insider, user impersonation, and smart card stolen attacks. It offers mutual authentication and key agreement, requiring only 1632 bits of communication cost and 15.67139 ms of computational cost for the entire login authentication and key agreement phase. Our study lays a solid foundation for future investigation of innovative solutions for BCI security.