{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,10]],"date-time":"2026-10-10T10:49:48Z","timestamp":1791629388791,"version":"4.3.4"},"reference-count":31,"publisher":"MDPI AG","issue":"19","license":[{"start":{"date-parts":[[2026,10,5]],"date-time":"2026-10-05T00:00:00Z","timestamp":1791158400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"},{"start":{"date-parts":[[2026,10,5]],"date-time":"2026-10-05T00:00:00Z","timestamp":1791158400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000266","name":"Engineering and Physical Sciences Research Council","doi-asserted-by":"publisher","award":["UKRI825"],"award-info":[{"award-number":["UKRI825"]}],"id":[{"id":"10.13039\/501100000266","id-type":"DOI","asserted-by":"publisher"},{"id":"https:\/\/ror.org\/0439y7842","id-type":"ROR","asserted-by":"crossref"}]},{"award":["UKRI825"],"award-info":[{"award-number":["UKRI825"]}],"id":[{"id":"https:\/\/ror.org\/0439y7842","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Smart sensing insoles are emerging medical IoT devices used primarily in diabetes care to monitor foot pressure, temperature and gait for preventing diabetic foot ulcers and lower-limb amputation. Despite growing healthcare use, the cybersecurity threats to these systems have received limited systematic analysis in the literature. This study aimed to provide a detailed threat modelling analysis of smart insole systems. The study developed a representative smart insole system architecture using public information, the literature, and manufacturer input. A data flow diagram mapped devices, processes, data stores, data flows, and trust boundaries across sensor, edge\/mobile, cloud and clinician zones. Potential cybersecurity threats were analysed using STRIDE, MITRE ATT&amp;CK mapping and attack trees. The modelled analysis identified potential threats across all STRIDE categories: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. Three attacker goals were modelled: stealing health data, reducing trust in the technology and inflicting patient harm. Key modelled threats include BLE interception, weak authentication, data tampering, service disruption, log deletion and manipulation of clinical outputs. Commercial systems varied substantially in their security features. The modelled findings show that cybersecurity threats to smart insoles extend beyond data privacy to include threats to patient safety. Disrupted alerts, altered pressure data or unavailable monitoring could delay clinical action and increase diabetic foot ulcer and amputation risk. The study highlights the need for secure-by-design systems, including BLE encryption, strong authentication, audit logging and clearer regulatory\/procurement standards.<\/jats:p>","DOI":"10.3390\/s26196298","type":"journal-article","created":{"date-parts":[[2026,10,5]],"date-time":"2026-10-05T12:31:31Z","timestamp":1791203491000},"page":"6298","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Cybersecurity of Smart Sensing Insole Systems: A Threat Modelling Approach to Understanding Security Vulnerabilities"],"prefix":"10.3390","volume":"26","author":[{"given":"Padideh","family":"Choobdar","sequence":"first","affiliation":[{"name":"Medical School, Faculty of Health and Medicine, Lancaster University, Lancaster LA1 4AT, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nigel","family":"Davies","sequence":"additional","affiliation":[{"name":"School of Computing and Communications, Faculty of Science and Technology, Lancaster University, Lancaster LA1 4WA, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1224-9228","authenticated-orcid":false,"given":"Emma D.","family":"Wilson","sequence":"additional","affiliation":[{"name":"School of Computing and Communications, Faculty of Science and Technology, Lancaster University, Lancaster LA1 4WA, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Steve","family":"Hodges","sequence":"additional","affiliation":[{"name":"School of Computing and Communications, Faculty of Science and Technology, Lancaster University, Lancaster LA1 4WA, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3186-4122","authenticated-orcid":false,"given":"Edward B.","family":"Jude","sequence":"additional","affiliation":[{"name":"Tameside and Glossop Integrated Care NHS Foundation Trust, Ashton-Under-Lyne, Manchester OL6 9RW, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4661-000X","authenticated-orcid":false,"given":"Matthew","family":"Bradbury","sequence":"additional","affiliation":[{"name":"School of Computing and Communications, Faculty of Science and Technology, Lancaster University, Lancaster LA1 4WA, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9213-4580","authenticated-orcid":false,"given":"Neil D.","family":"Reeves","sequence":"additional","affiliation":[{"name":"Medical School, Faculty of Health and Medicine, Lancaster University, Lancaster LA1 4AT, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,10,5]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"124","DOI":"10.1080\/07435800.2024.2341146","article-title":"Digital Health in Diabetes and Cardiovascular Disease","volume":"49","author":"Avoke","year":"2024","journal-title":"Endocr. Res."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"e3239","DOI":"10.1002\/dmrr.3239","article-title":"Leveraging smart technologies to improve the management of diabetic foot ulcers and extend ulcer-free days in remission","volume":"36","author":"Najafi","year":"2020","journal-title":"Diabetes. Metab. Res. Rev."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"e18907","DOI":"10.2196\/18907","article-title":"Wearable Health Devices in Health Care: Narrative Systematic Review","volume":"8","author":"Lu","year":"2020","journal-title":"JMIR Mhealth Uhealth"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"1004","DOI":"10.1016\/S1470-2045(25)00420-6","article-title":"Launch of a 10-Year Health Plan for England","volume":"26","author":"Burki","year":"2025","journal-title":"Lancet Oncol."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1143","DOI":"10.1177\/1932296815583334","article-title":"Cybersecurity for Connected Diabetes Devices","volume":"9","author":"Klonoff","year":"2015","journal-title":"J. Diabetes Sci. Technol."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"109091","DOI":"10.1016\/j.diabres.2021.109091","article-title":"An intelligent insole system with personalised digital feedback reduces foot pressures during daily life: An 18-month randomised controlled trial","volume":"181","author":"Chatwin","year":"2021","journal-title":"Diabetes Res. Clin. Pract."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"100539","DOI":"10.1016\/j.clinme.2025.100539","article-title":"Diabetes and technology\u2014An update for the general physician","volume":"26","author":"Khin","year":"2026","journal-title":"Clin. Med."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"McGill, J.B., Donihi, A.C., Akturk, H.K., Freeby, M., Gupta, A., Horton, W.B., Jadoon, M.N., Lathief, S., Miracle-Lopez, S., and Tan, C. (2026). American Association of Clinical Endocrinology Consensus Statement: Use of Diabetes Technology for Management of Adults with Diabetes. Endocr. Pract.","DOI":"10.1016\/j.eprac.2026.06.011"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"e308","DOI":"10.1016\/S2589-7500(19)30128-1","article-title":"Innovative intelligent insole system reduces diabetic foot ulcer recurrence at plantar sites: A prospective, randomised, proof-of-concept study","volume":"1","author":"Abbott","year":"2019","journal-title":"Lancet Digit. Health"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Matijevich, E., Minty, E., Bray, E., Bachus, C., Hajizadeh, M., and Liden, B. (2024). A Multi-Faceted Digital Health Solution for Monitoring and Managing Diabetic Foot Ulcer Risk: A Case Series. Sensors, 24.","DOI":"10.3390\/s24092675"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"1004","DOI":"10.2337\/dc23-1858","article-title":"Acute Effects of Vibrating Insoles on Dynamic Balance and Gait Quality in Individuals With Diabetic Peripheral Neuropathy: A Randomized Crossover Study","volume":"47","author":"Orlando","year":"2024","journal-title":"Diabetes Care"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3510424","article-title":"Threat-modeling-guided Trust-based Task Offloading for Resource-constrained Internet of Things","volume":"18","author":"Bradbury","year":"2022","journal-title":"ACM Trans. Sens. Netw."},{"key":"ref_13","unstructured":"Li, C., Raghunathan, A., and Jha, N.K. (2011, January 13\u201315). Hijacking an Insulin Pump: Security Attacks and Defenses for a Diabetes Therapy System. Proceedings of the 2011 IEEE 13th International Conference on e-Health Networking, Applications and Services, Columbia, MO, USA."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"104733","DOI":"10.1016\/j.cose.2025.104733","article-title":"Securing automated insulin delivery systems: A review of security threats and protective strategies","volume":"160","author":"Niu","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Marin, E., Singel\u00e9e, D., Yang, B., Verbauwhede, I., and Preneel, B. (2016, January 9\u201311). On the Feasibility of Cryptography for a Wireless Insulin Pump System. Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy, New Orleans Louisiana, MI, USA.","DOI":"10.1145\/2857705.2857746"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Alhussan, M., Boem, F., Ghoreishizadeh, S.S., and Mandalari, A.M. (2025, January 25\u201328). Hacking Health: Unveiling Vulnerabilities in BLE-Enabled Wearable Sensor Nodes. Proceedings of the 2025 IEEE International Symposium on Circuits and Systems (ISCAS), London, UK.","DOI":"10.1109\/ISCAS56072.2025.11043235"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Akinbi, A., and Raj, P.P. (2025). A systematic security analysis of medical internet of things (MIoT) ecosystems in threat modeling scenarios. Front. Internet Things, 4.","DOI":"10.3389\/friot.2025.1712430"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"144983","DOI":"10.1109\/ACCESS.2019.2946081","article-title":"Threat Analysis for Wearable Health Devices and Environment Monitoring Internet of Things Integration System","volume":"7","author":"Tseng","year":"2019","journal-title":"IEEE Access"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Khan, R., McLaughlin, K., Laverty, D., and Sezer, S. (2017, January 26\u201329). STRIDE-Based Threat Modeling for Cyber-Physical Systems. Proceedings of the 2017 IEEE PES Innovative Smart Grid Technologies Conference Europe (ISGT-Europe), Turin, Italy.","DOI":"10.1109\/ISGTEurope.2017.8260283"},{"key":"ref_20","unstructured":"Nagrare, T., Sindhwad, P., and Kazi, F. (2023). BLE Protocol in IoT Devices and Smart Wearable Devices: Security and Privacy Threats. arXiv."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"e4049","DOI":"10.1002\/ett.4049","article-title":"A Survey on Security Threats and Countermeasures in Internet of Medical Things (IoMT)","volume":"33","author":"Papaioannou","year":"2020","journal-title":"Trans. Emerg. Telecommun. Technol."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Severo, J.M., Herbert, J.S., and Franco, M.F. (2025, January 8\u201310). Threat Modeling in Healthcare: An Analysis of Trends, Gaps, and Emerging Challenges. Proceedings of the Escola Regional de Redes de Computadores, Porto Alegre, Brazil.","DOI":"10.5753\/errc.2025.17725"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"421","DOI":"10.1049\/cmu2.12301","article-title":"A review on security threats, vulnerabilities, and counter measures of 5G enabled Internet-of-Medical-Things","volume":"16","author":"Hasan","year":"2021","journal-title":"IET Commun."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Salayma, M. (2024). Threat modelling in Internet of Things (IoT) environments using dynamic attack graphs. Front. Internet Things, 3.","DOI":"10.3389\/friot.2024.1306465"},{"key":"ref_25","unstructured":"Li, Y., Mandalari, A.M., and Straw, I. (2025, December 31). Who Let the Smart Toaster Hack the House? An Investigation into the Security Vulnerabilities of Consumer IoT Devices. Available online: http:\/\/arxiv.org\/abs\/2306.09017."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"360","DOI":"10.1186\/s13256-024-04573-5","article-title":"Connected to the cloud at time of death: A case report","volume":"18","author":"Straw","year":"2024","journal-title":"J. Med. Case Rep."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"e50505","DOI":"10.2196\/50505","article-title":"Insights From a Clinically Orientated Workshop on Health Care Cybersecurity and Medical Technology: Observational Study and Thematic Analysis","volume":"26","author":"Straw","year":"2024","journal-title":"J. Med. Internet Res."},{"key":"ref_28","first-page":"20552076241247940","article-title":"Simulation-based research for digital health pathologies: A multi-site mixed-methods study","volume":"10","author":"Straw","year":"2024","journal-title":"Digit. Health"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"e252305","DOI":"10.1136\/bcr-2022-252305","article-title":"When brain devices go wrong: A patient with a malfunctioning deep brain stimulator (DBS) presents to the emergency department","volume":"15","author":"Straw","year":"2022","journal-title":"BMJ Case Rep."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3776549","article-title":"Security Modelling for Cyber-Physical Systems: A Systematic Literature Review","volume":"10","author":"Huang","year":"2026","journal-title":"ACM Trans. Cyber-Phys. Syst."},{"key":"ref_31","unstructured":"MITRE Corporation (2025, December 31). MITRE ATT&CK Framework. Version 18.1. Available online: https:\/\/attack.mitre.org."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/19\/6298\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,10]],"date-time":"2026-10-10T10:13:40Z","timestamp":1791627220000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/19\/6298"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10,5]]},"references-count":31,"journal-issue":{"issue":"19","published-online":{"date-parts":[[2026,10]]}},"alternative-id":["s26196298"],"URL":"https:\/\/doi.org\/10.3390\/s26196298","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,10,5]]}}}