Cybersecurity of Smart Sensing Insole Systems: A Threat Modelling Approach to Understanding Security Vulnerabilities.

Abstract

Smart sensing insoles are emerging medical IoT devices used primarily in diabetes care to monitor foot pressure, temperature and gait for preventing diabetic foot ulcers and lower-limb amputation. Despite growing healthcare use, the cybersecurity threats to these systems have received limited systematic analysis in the literature. This study aimed to provide a detailed threat modelling analysis of smart insole systems. The study developed a representative smart insole system architecture using public information, the literature, and manufacturer input. A data flow diagram mapped devices, processes, data stores, data flows, and trust boundaries across sensor, edge/mobile, cloud and clinician zones. Potential cybersecurity threats were analysed using STRIDE, MITRE ATT&CK mapping and attack trees. The modelled analysis identified potential threats across all STRIDE categories: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. Three attacker goals were modelled: stealing health data, reducing trust in the technology and inflicting patient harm. Key modelled threats include BLE interception, weak authentication, data tampering, service disruption, log deletion and manipulation of clinical outputs. Commercial systems varied substantially in their security features. The modelled findings show that cybersecurity threats to smart insoles extend beyond data privacy to include threats to patient safety. Disrupted alerts, altered pressure data or unavailable monitoring could delay clinical action and increase diabetic foot ulcer and amputation risk. The study highlights the need for secure-by-design systems, including BLE encryption, strong authentication, audit logging and clearer regulatory/procurement standards.