Secure LSL: A Unified Encryption Architecture for the Lab Streaming Layer

Abstract

ObjectiveThe Lab Streaming Layer (LSL) protocol, widely adopted for synchronized multimodal biosignal recording in neuroscience research, transmits all data in plaintext, exposing sensitive neural and physiological recordings to interception and tampering and creating regulatory liability for clinical and commercial deployments across most major international jurisdictions. We present Secure LSL, the unified encryption architecture for the protocol: a novel security layer that authenticates devices and encrypts biosignal streams through transparent, drop-in modifications to the core library, requiring no application changes and no recompilation for dynamically linked clients. ApproachWe implement encryption at the liblsl core library level using a shared keypair authorization model with ChaCha20-Poly1305 authenticated encryption. All authorized devices share a common Ed25519 keypair, and public key verification during connection establishment ensures only authorized devices communicate. The architecture enforces network-wide security consensus, requiring all connected devices to operate in either secure or insecure mode, eliminating vulnerable mixed environments, and operates transparently with zero code changes to existing applications. Main ResultsThe architecture preserves application programming interface (API) transparency, so existing applications need no code changes (legacy devices must update to connect to secured outlets). Across five hardware platforms spanning x86 desktop, Apple Silicon laptop, embedded ARM single-board, and Xtensa microcontroller targets, encryption adds sub-millisecond latency in all desktop and embedded ARM configurations, with overhead in the single-digit percent range (approximately 4 to 9%, the lowest values within measurement noise of zero) for typical 64-channel, 1000-Hz configurations. A clean-room ESP32 implementation extends transparent encryption to dual-core microcontrollers with no measurable push-path overhead and approximately 2 kB additional static random-access memory (SRAM) consumption, enabling secured wearable and ambulatory biosensor deployments. SignificanceBy implementing security within the protocol core rather than requiring application-level changes, we transform LSL from a research-only protocol to a security-capable platform for clinical settings, multi-institution collaborations, and commercial products, while preserving its zero-configuration philosophy.