Where would an identity implant be implanted in the body? And what would make it secure?

Question

In this imaginary future, everyone carries an implant like an RFID chip that identifies them to scanners that then authorize access or orders. Today, such chips are usually implanted subdermally, often in the hand. But in a future where such chips are not experiments or gadgets for rare individuals and useless to anyone else, but ubiquitious and powerful, I think implanting them under the skin of the hand would allow criminals and hackers to tamper with them much too easily.

So I wonder if they would rather be implanted in a place were they would be difficult and dangerous to remove, e.g. in the brain. Or am I overthinking the issue, as passports are not implanted safely either and still difficult enough to "hack"?

Where would the president carry the implant that would authorize his order to launch a war? What would make it secure from hacking it remotely?

I think it needs to be difficult to remove and the ID must be hardwired. On the other hand it must be possible to insert and remove such an implant when a person is elected or resigns from an office, without any danger to his life, so an operation on the brain every now and then seems to be out of the question.

---

Please don't take the example of the president farther than is meaningful. The president today carries a passport as his ID. This is easy to steal, easy to fake. Still, the nuclear launch procedure is secure enough, as it doesn't depend on the president's passport alone. So of course in a future with RFID chips, the security of the nuclear launch procedure wouldn't depend on the president's chip alone.

Also, RFID was an example only. If you can come up with a better technology to wirelessly transmit (or read) a person's identity, then that is even better. But it has to work with sunglasses, so reading the retina is out of the question.

Finally, don't go over board. Nothing is unfakeable today, and we still get by. So nothing has to be totally unfakeable or unbreachable in the future. The requirement for security is that the chip has to be reasonably secure. Which, to return to the president, is why no sane person would rely on the chip alone in matters of national security.

Keep the question in context.

Answer 1

Make it a distributed system

You're worried that if it's implanted in the periphery of the body it could be cut out too easily and either re-used or dismantled as part of an attack. So make it two or more parts, linked by either hairlike wires or the user's own nervous system. Once live, cutting the link between the two parts will instantly disable both parts.

(Various authors have written "neural lace" implants which are embedded across the brain and cannot be removed intact.)

Answer 2

Chips would be personal and for life (or until it breaks or is superseded). You wouldn't do chips for certain functions, you would program the systems to accept the existing personal keys of people, so you would not regularly need to replace them. This is easy if you know asymmetric cryptography.

Existing cryptographic methods for protecting the chip (research credit cards) go without saying. Essentially you can just assume that it's really hard to tamper with the chip directly (without destroying it or triggering and alert or anything) and it's impossible to duplicate a chip or get at its secret. For the people who doubt this, there is a technical explanation at the bottom of the answer describing how such systems work right now. [1]

To keep the chip from working outside of the intended persons body and so you can get a probability of whether someone is acting by their free will and whether the chip is really still inside the proper body:

Make the chip monitor the health functions of its host, for example:

• DNA
• heart rate
• blood pressure
• oxygen level
• sugar level
• adrenaline level
• alcohol level and presence of other drugs

It could also monitor some other things, for example:

• location
• presence of other identities nearby
• time of day

When there are any abnormalities in this data, the chip can take appropriate measures.

Examples:

• pulse stops (and other signs of death or removal from the body): deactivate and require reactivation by an authority
• drug presence: don't do digital signatures (so the intoxicated person couldn't sign a contract, but other than that, stuff would still work)
• not in a secure location, unknown identities nearby, high stress level: don't confirm missile launches
• drug presence: don't do missile launches either

You could take that a step further and from all that data generate a probability that the chip is inside the proper person and that the person is acting by their free will (complicated algorithm). Then when the chip should authorize something, it also sends that probability and depending on the application there are defined minimum probabilities needed.

[1]: Those chips use asymmetric cryptography. Each person has a public and a private key. Everyone has the public one (or can get it from a government system). Using the public key, people can encrypt stuff which can only be decrypted using the private key. So when A wants to know if B really is B, A takes Bs public key, encrypts a random challenge message and sends it to B. B then decrypts it and sends the decrypted message back. If B succeeds, then B must have the private key and thus is really B. During this protocol, the private key never leaves Bs systems. By listening to their exchange, you gain nothing, you can't calculate the private key from it. So the only way to find Bs private key is to cut open its authentication chip, search where the key is physically stored and get it out by directly probing the chips memory cells. This is a really expensive, difficult procedure and even with the resources of a nation state the probability of destroying the chip before getting at its secret is pretty large.

Answer 3

The chips are as secure as the author says they are

I think implanting them under the skin of the hand would allow criminals and hackers to tamper with them much too easily.

Just forget about Hollywood hacking. Cracking the security of a computer system in fiction is always dependent on how quickly the heroes / antagonists need to get inside to make the story exciting. In Hollywood, hacking will succeed if it is needed for the story.

In real life it is both easier and harder to break computer security. Easier if you are dealing with people that do not take security seriously, or are incompetent. Harder, next to impossible, when you are dealing with people that know their stuff.

A subdermal chip will work just fine for your purposes. Do it right and it cannot be "tampered" with unless you have ridiculous amounts of money and an entire national defence agency to back you up. And even then the results are far from certain. The only way it could be used out of scope for how it was intended is if someone chops off the limb in question, scoops out the chip and implants it in someone else. And that you can make some simple safeguards against, like making the "chip" be a film wrapped around the skeleton.

The point is: the security of the chip will work if you as an author says it does. Some rather simple hand-waving will make it so that the implants are secure enough for everyday applications. And for those in your story that need extra security... well they will find ways to make the ID check better though for instance two/three/more factor authentication.

So in the case of the President, the subdermal chip plus a code that they memorize, plus the two-man rule are more than enough for your purposes.

Answer 4

It's your story so the RFID is there wherever you want or need it to be and is as secure or insecure as you want or need it to be.

However as this is Worldbuilding, I wonder firstly why would an RFID-like device become ubiquitous enough to use for identity?

A body implanted device just for identity is a hard sell to a population in the billions or even hundreds of millions especially if there is any democracy and civil liberties left in the world.

But I can see it becoming the equivalent of a Social Security Number in the USA. A non-documented, non-resident of the USA encounters tremendous difficulty conducting simple business without an SSN. This is getting harder with more and more regulation and data-sharing in banking & finance, government services and even medicine & insurance. But can an identity device get traction? Especially if any electronic device that can be manufactured can be cloned and artificial anti-copying steps become an arms race with the pirates.

If the device was primarily beneficial for health and longevity improvement then uptake becomes a lesser obstacle.

• Managing and reducing genetic and environmental risk factors relating to diseases (viral, bacterial, fungal, allergen).
• Improving a body's reaction to stress, toxins, pollution, aging, drugs and other environmental impacts.
• Allowing excess consumption of drugs, alcohol or food without negative physical consequences.
• Delivery the benefits of physical fitness with relatively small physical workouts.
• The simplest sales pitch would be "implant this device and you'll never get terminal cancer".

In order for such systemic benefits to accrue, the device must become holistically integrated with the individual. That means sensors, probes and nanotechnology bots. Securing the device then becomes relatively easy as it monitors, interacts and spreads throughout a person's body systems (circulatory, respiratory, lymphatic, endocrine, digestive, nervous, urinary, reproductive, skeletal, muscular, integumentary).

Side note: Such a human would be augmented beyond homo sapiens as their biology would be superior. Augmented humans would only reproduce with other augmented humans and have offspring that became augmented. The augmented would either become an elite or, if readily available to the masses, the un-augmented would die out.

Now you've got a device that is essentially an interface between the technological augments of an individual and their biology. Those augments give a huge improvement in quality of life. At the same time the interface becomes a proxy for first order identity. It reports that it is embedded in the individual, in my case paulzag, and here is a packet of biodata to verify this identity. The receiving system makes its own biodata scans and determines access.

Cyber-piracy stories can still be told as the interface attempts to pass itself and its host off as someone else. That would be expensive and technologically sophisticated.

However information-security principles of multi-factor authentication would still exist. Especially with a president's ability to start a war with a push of a button.

Answer 5

You can have the chip function much like some implementations of 2 factor authentication system today. The chip generates a new access code every X amount of time based on some unique signature. Since the chip needs only to transmit this information it cannot be hacked wirelessly.

If you have custody over the chip holder you probably already have power to force them to give you access to whatever it is you want so wireless hacking is the only thing I would be worried about. For things like nuclear launch codes it might be helpful to have some sort of a self destruct button for extreme situations in which case it might be useful to keep the chip in some place that is harmful to electronics such as inside the stomach.

Answer 6

A lot of people believe that a chip cannot be tampered with from a distance. This is not true, especially if you are setting your story in a future where technology has evolved.
Assuming your ID must be wirelessly communicated, I assume that the informations (whatever they are) stored in the RFID-like chip are encrypted. The problem with traditional cryptography, though, is that if you have the key(s), you have everything you need to decrypt your code... And the keys are too stored somewhere.

Quantum cryptography is said to be impossible to hack due to the fact that a "bit" of information alters its state when it's read (from third parties). Problem is: it alters its state when it's read by a machine too... and if a machine is expecting a certain sequence to launch the missiles, it means that there's too a key involved...

Assuming the worst case, terrorists have the key(s). A wireless transmission of a code is really a bad idea, since what the terrorists would do is simply set a smart-antenna to track the chip from a distance, and read its informations. What's indeed difficult is actually to get to the president physically.

So why bother with a chip, when a retinal scan (some users already pointed out that this is impossible to hack - and why can't the scan work with sunglasses? They can be "smart" ones, or the scanner can be), voice recognition, fingerprint analysis, password and a titanium bullet with a code inside hidden in the body are all things that need a physical abduction?

In short: I wouldn't rely on a (single) code stored on a (single) chip. Especially if transmission is considered.

Answer 7

Removal

So I wonder if they would rather be implanted in a place were they would be difficult and dangerous to remove, e.g. in the brain.

Today, there are copy protection schemes for µC's that basically work by enclosing the µC in some kind of gooey mass that hardens up and then is quite impossible to remove without damaging the µC beyond repair.

You would do the same in your future. Don't worry too much about where exactly the device is located, but implant it in a way so it cannot be removed without destroying it. Make the internal building blocks of your device flexible but very weak, like biological nerves, so any attempt to cut near them will invariably destroy them. Make it so it is very hard to use X-ray to actually detect them (it does not matter if you can still detect the general area where it is implanted), so you cannot use X-ray or other devices to find the place where you have to cut.

Implement it in some part of the trunk, not in a part of the body that can easily be cut off (i.e. cutting off the arm at the elbow might just be what you could fathom in your world; but if you implement it in, say, the upper layers of the stomach, then ripping off the stomach might be too far "out" to be considered a problem).

Hacking vs. private/public keys

What would make it secure from hacking it remotely?

That depends on what the implant actually contains. If you restrict yourself to a pure identity function, then it is pretty simple to make it hack-proof. It basically comes down to storing the private key inside the implant. Remember, when you rip out the implant, then it is destroyed. And obviously you will make very sure that the private key is stored nowhere else in the known universe, only the public key needs to be freely available.

You will of course also design the implant in such a way that it simply has no provision ("code") to "read out" the key. The key will not be stored like in a RAM/ROM area, but actually part of the physical structure.

This is all nothing special, it's just the way private/public key schemes work even today. The mathematics behind it are understood. All attacks against PPK schemes are either targetting bugs in the implementation or brute-forcing; there is by design no other way, the mathematics are sound and "perfect" (until they are found not to be, obviously...).

Now that the function of the implant is minimal, extremely well defined, not subject to change, the real security dangers are outside of the plant. Attackers will concentrate on breaking the external computers that store your "permissions". I.e., somewhere on the nuclear launch site, there will be a store that says "this is the public key of the president; only a message signed by the corresponding private key will be able to launch the missiles". Nobody will even think about ripping out the private key from the president (because it is well known that that is quite impossible); they will focus on attacking that information in the nuclear site instead.

Replacement

On the other hand it must be possible to insert and remove such an implant when a person is elected or resigns from an office,

No. The identity can stay from birth to death. The information that you are the president is stored somewhere else, not inside your body.

If you need to roll out a new version of your implant because technology advances (e.g., switching from 1024 bit keys to 2048 bits etc.) or they tend to degrade after a few years, then just create a new implant and place it somewhere else in the body in addition to the old one.

The new imlpant comes with a new private/public key and the identity of the old and new implant are simply coupled together externally. This gives you a nice time of running both implants in parallel, making it a trivial process (thinking in IT terms here), i.e. it is not so critical to update all worldwide stores of "permissions" for that person. Of course, your nuclear site would always require to use the newest, most secure key scheme. Your local grocery store could chose to accept your old insecure scheme for a few more years.

Answer 8

imaginary? They're actually doing trials with exactly such systems...
Ostensibly to make it easier to find alzheimer patients who wander from their retirement homes, people are being implanted with RFID chips and other devices on a trial basis.

For now they're just implanted under the skin, in a leg mostly.

Pets of course have been implanted with RFID chips for decades, usually injected into the shoulder.

In neither case is there much fear of the bearer trying to remove the chip, but some thought has gone into that too.
The most secure way would be to bond it to the spine or another major bone structure, the removal or serious damage to which would cause death or permanent disability.
doing this while the victim is still growing would allow the bone to grow around the chip capsule, making removal without destroying the bone itself nearly impossible.

Another option could be injecting it directly into the heart muscle or brain case.

Answer 9

I will tackle this from the perspective of information security.

An RFID is an element of multiple factor authentication, which can have one or more components from the categories below

• something you know (a password, PIN)
• something you have (a hardware key)
• something you are (your fingerprint, specific way of speaking etc.)

The general idea is that you should use more than one to reduce the risk (your password can be acquired/hacked, your hardware key stolen and your eye borrowed).

An implemented RFID chip lays somewhere in between case 2 and 3. This is something wich defines you (if it is unique) and something you have (because it is in your body and not naturally part of your body). You may however remove it, as you can take someone's fingerprints directly from their fingers.

In such a case I would look at improving the weakness of today's biometrics (the "something you are"), currently:

• it is expected that an eye outside of the socket will not work with a retina scanner (which looks for some activity which suggests that the eye in in the right place). There is not enough public data on whether this is bypassable

• Normally fingerprint readers make sure that there is blood activity. The fingerprints can be nevertheless faked, so this does not work that well.

Make your RFID truly non-operational outside of the body.

Note that this solves the question of positive identification but not the case where someone does not want to be identified (by removing the chip). In that case you can bind it to a key function of the body.

Answer 10

(Reusing parts of several other answers)

This is not only an ID chip, but it is your own personal AI doctor! This doctor is distributed in several chips in important places, brain, heart, spine, liver etc.

These chips monitor your health continuously and sending the information to a central register. (the AI isn't actually on the chips, but in this central register) If you develop some condition that requires medical intervention, you will get a phone call from a doctor asking you to come visit.

Since most conditions will be detected much earlier than today, much time and money will be saved and much suffering avoided.

Incidentally, this continuous data stream will also give away your position. Bad news for kidnappers. Kidnappers can obviously wrap people in tin foil or something, but that in itself sets off an alarm. Of course, in this Big Brotherish future, there will be HD cameras everywhere, so an alarm will be followed by pictures of the kidnappers being posted to all nearby police.

If you move a chip from one person to another, the data stream will be interrupted and will give different data when it comes back. You would also need to move all the chips at once since they are talking to each other.

If you anesthetize the person, this is very visible on the medical data. If you operate without anesthetics, the pain will also be very visible.

The chips have a private key that is used to authenticate you. A different key is used to encrypt the data so that only the medical center can use it. While it could be possible to fish the authentication key out using electron microscopes, magnetic resonance or whatever, it would not be possible without removing the chip from the person.

People can obviously remove or break their own chips, but then they will be non-persons. Apart from not being able to pay for things in shops, you will also stand out like a sore thumb. A camera or motion detector seeing a person where there is no ID chip will raise the alarm.

Civil liberty types will be very unhappy about this setup, and this should be reflected in the story. It is up you whether these people are heroic freedom fighters or foolish paranoid Luddites. The best stories will result from making both perspectives seem possible.

Answer 11

You does not even need to implant it

Everywere in public spaces, place automated scanners that verify the biometrics. If someone put a stolen chip, it will not pass. It possible to fake it in conjunction with fake biometrics tough.... but fake biometrics will require weird looking fantasies which stand out in the crowd.

Answer 12

Method 1

Implant a unique read-only RFID chip with bio-compatible coating in the brain of each fetus in the mother's womb around the age of 3 or 4 week weeks. The brain is still in an early developmental stage and will grow around it so that the chip cannot be removed later. The chip must be hardened against destruction by anything which will not kill the person.

Method 2

Alter each fetus' genes. Encode an ID encrypted with the private key of the government, readable by everybody using the government's public key from a trivial sample of the individual's DNA with a hand-held device, or a reader at doors etc. The ID will be as safe as the government's key. The cost of sequencing the human genome falls faster than exponential and will soon be trivial: