Schneier on Security

Clive Robinson • July 9, 2019 5:59 AM

@ Bruce,

I have my usual questions…

Well if people think about it the first thing the opperators of such systems have to get is a clean copy of your heart rate for comparison purposes, and that might not be easy.

Also I know for certain my heart pattern has changed dramatically over the recent past as my cardiac specialist would confirm (or you can just look at the ECG tracings). More recently it has undergone a series of what you might call bursts of changes which is why I now have a box in my chest to keep the darn thing beating (my heart randomly stopped for 5-15 seconds which might acount for my habit of finding myself face down in all sorts of places) at other times it beats so fast (over 200BPM) that again I find myself heading for the floor. The question then arises are you seeing the persons natural heart rate or that of their cardiac assist device?

But to say my heart rate and rhythm are eratic is one of lifes little understatments… Which I’m reasonably sure for increasing numbers of people is also true, as survival rates from first cardiac events is steadily rising in many places (but apparently not so much in the US).

@ All,

But… If we look at the article we see the following,

By contrast, the new device, called Jetson, uses a technique known as laser vibrometry to detect the surface movement caused by the heartbeat. This works though typical clothing like a shirt and a jacket (though not thicker clothing such as a winter coat).

We see “laser vibrometry” which is a fancy term for the effect “laser microphones” that have been around for something like four decades use. And more recently a passive effect where high resolution digital cameras that could hear things in a room by looking at the light reflected from a crumpled up crisp packet through a couple of windows (ie in a building across the street).

So a prediction… The next step in this technology will be not an active system using a lazer which can be detected, to a passive system focused in on the reflected light from your eyeball or jewelry or other hard light reflecting surface in contact with your body, say the surface of a watch or it’s metal strap etc, even the key you hold out to open your door. (yes I copyright (c) this idea and want royalties).

People can sit down and work out the “forward gain” of such a laser device, it’s not exactly difficult just tedious and you can get the information from any book on Radar or more sprcifically “Lidar”. But I can tell you now it’s going to be very low and unlike the lower EM spectrum of microwaves the background noise is going to be very high. So inherently a very low signal to noise ratio without any man made noise or natural interferance… Such “extra noise’ is more than likely to “swamp” the required signal, when intentional we call it “jamming”. Either way it means the system designers would have to use either “averaging” or “estimation techniques” to dig a sufficiently clean signal out of the noise.

The problem is that averaging needs to “double the samples to get each 3dB increase in signal power, and to work even that well the period (1/f) of the signal has to be quite stable over the entire averaging period, which heart rates have a habit of only doing at rest even in healthy individuals… Thus to find a signal that they want in any kind of sensible time period they would also have to use some kind of estimation technique such as a matched filter. Then run a sampled period through it at different rates to get some kind of correlation to use to make averaging more effective. Which will burn a fair old amount of CPU cycles…

Thus if you know the way the signal recovery part of this sytstem works you can exploit it’s weaknesses very advantageously at quite low cost. Whilst forcing their costs to rise quite dramatically to a power law. Which is the same game we play with “adding an extra bit” to the length of an encryption system.

I don’t know about others but I can think of numerous was to do this sort of “jamming” 😉

@ Bob Paddock,

So it has major fail in groups?

Most probably… It’s been long known that when people live in tight groups their biological cycles come into alignment. The earliest records I’ve ever seen from this was in the calculation of the size of sewer pipes for the number of people in dormitories etc.

If the people living in dormitories and the like did not sync up then you could “root mean squared” to get the average flow rate and then double it for a safety margin etc. That is if the events were truely independebt of each other they would follow a Poisson distribution… This works for the likes of housing estates and streets etc because the people there don’t sync up very much beyond that of the “daily grind times”. But not for dormitories where the people become almost one living entity, thus you have to design for “peak flows” not “average flows”…

We also see such syncing in other areas look into the history behind Agner Krarup Erlang’s capacity planning and queuing theories for telecommunications circuits Erlang B, Extended Erlang B and Erlang C.

Basically normal loads follow a Poisson distribution as they are unrelated to each other. However as you aproach “chord capacity” the distribution starts to change as people don’t connect thus “redial” their calls are nolonger independent of each other. If you add a connected but waiting or holding que at the destination end then the number of connected calls again follow a different distribution due to the metrics of the holding que. The same logic holds true for nearly all gueuing systems including those you find humming along in your personal computer and in servers, where it can likewise be shown the event/job distributions are markedly different due to their various levels of independence from each other.

But the classic example of peak not mean capacity planning is what got called “half time load” in the UK. England’s alledged national drink is tea, and this requires about a two KW load for two minutes with an electric kettle. Likewise the alledged national sport of the UK is “football”[1] or as those in the US call it “soccer”. Every year in England we have the Football Association (FA) Cup Final that gets broadcast on radio, television, satellite television and of course these days the Internet, but more of the problems that brings later…

Well as the famous quote has it “football is a game of two halves” with a break in the middle called “half time”. Where traditionaly the players rest a short while and have a cup of beef tea for strength and a several slices of orange to “zest them up” (the reality these days we are led to believe is they go into a room where the manager screams, shouts and throws football boots at star players as a form of encoragement, knowing how humans think I think that would be better viewing than the game ;-). Anyway many spectators at home likewise have a cup of tea etc at the same time… So the load on the National Grid in England goes from lower than normal to a dramatic peak as five to ten million kettles get turned on all within a four or five minute period.

Traditional steam powered generators can not deal with such sudden changes in load, which is where Wales, France and one or two other nations have come to help out. In Wales there is a large lake at the top of a mountain with one at the bottom, also many hydro powered generators that can spin up from idle to full power in just seconds, so it makes a very large capacity high power kinetic battery. Likewise other countries with cables into England can dump excess capacity from their closer to quiescent networks etc. Unfortunately one of the scourges of satellites and the Internet is there are now very large numbers of people in other countries watching, including many European ones but India and Argentina so that peak demand problem is nolonger “localised” to just a few million homes…

It’s these little problems that are “an engineers lot in life” because if they get it perfectly right, nobody thanks them, if they predict the capacity to low, then you could end up with cascade overload failures all over the place which would get a lot of peoples backs up fairly instantly as they loose power for half a day. Oh and if the engeneers err to much the other way, first the accountants, then the bill payers will be screaming at them about the waste of money… Because those that offer such peak capacity want a lot of money, not just for the power supplied but also being on stand by to maybe supply it… Because whilst external combustion power generation can be made more efficient than internal combustion power generation for continuous loads it has significantly more lag, that can be measured in hours not seconds due to heating up the “working fluid” in sufficient bulk to be ready for the peak load.

[1] It’s not, fishing with a rod and line is by numbers of participents. But then fishing does not make a good real time spectator sport, watching paint dry would be better because atleast is guarrnteed to have a finish 😉