urgent and needed in 6 hours
Introduction
Implantable medical devices (IMDs) are improving patient’s health by assisting them and their doctors with managing various conditions. Some of these devices include cardiac pacemakers, insulin pumps, and even neurological sensors which all rely on both wireless connectivity and battery power. IMDs can be used to track the vitals of the patient, treat a condition, or even replace the function of a vital organ (Belkhouja, 2019). When the IMD is connected to the IoT this allows the health care provider to monitor vitals from the clinic and receive alerts if the patient is having complications. Some IMDs are capable of automatically administering corrective actions to get to condition back into a desirable state. Insulin pumps may inject insulin to the subjects while defibrillators can shock the heart to resume a regular beat pattern. The design of IMDs makes them vulnerable and devastating if compromised by threat actors who wish to cause harm to the individual (Ash, 2016). A malicious threat actor could adjust the corrective dosage of an IMD or even use a method of draining the battery rendering the device useless. Malicious attacks on IMDs can lead to permanent damage to vital organs or even loss of life. Due to these threats, many researchers are attempting to create secure and efficient methods of authentication.
One of the challenges with IMDs is to reduce the complexity of computation processes to extend the battery life of devices. Some devices cannot be charged wirelessly and must be surgically replaced if they are no longer functioning. In addition to the first challenge, security is important to safeguard the health of the patient but stronger security leads to complex authentication processes. The processing power and battery life is limited so overly complex encryption algorithms will shorten the lifespan of the device. In addition, wireless devices are vulnerable to types of sniffing, wardriving, or even denial of service attacks if they are in range of a threat actor or another compromised device. Public figures or important personnel may be a priority target which has prompted some to disable the wireless capability such as former Vice-President Dick Chaney (Ash, 2016). It is evident that IMDs are a critical part of modern health care, but there is much need for research and development to progress IMD usage.
IMD Authentication
Authentication has a huge role in the security of IMDs to ensure that genuine users are the only ones able to extract data or send commands to the device. One group of researchers has begun experimenting with authenticating a control device (e.g. smartphone) with IMDs through vibrations. During their testing it was determined that a 128-bit encrypted key could be negotiated in roughly 20 seconds with 90% accuracy (Dawson, 2017). This is a brilliant idea that could use more research as the experiment used synthetic human tissue so the method has yet to be tested in completely realistic conditions. Vibration authentication could circumvent the need for signals to be sent wirelessly over the air which could be captured and analyzed by threat actors. This would be a great improvement to the security of IMDs to protect patient data and commands to the devices.
Many IMDs rely on proprietary protocols to communicate wirelessly between the controller and implanted device. One group of researchers reverse engineered a neurotransmitter IMD to discover that the security of the protocol was severely lacking (Marin, 2020). They claimed that their findings displayed that the device could be attacked by controlling the electronic signals to the patient’s brain and prevent them from functioning, cause brain damage, or even kill them (Marin, 2020, p. 287). It was determined that certain improvements can greatly improve the integrity of the device by generating random sessions keys and transporting them securely between the IMD and communicating device (Marin, 2020). Improvements to protocols used in the software of IMDs will ensure that the patient does not become a victim of a malicious attack. One drawback of the suggested improvements will require additional strain on the IMD’s CPU and radio transmitter resulting in greater response times and shorter battery life.
IoT Networking & Process Enforcement
The integration of IMDs and the IoTs has increased health care providers ability to monitor patients from their clinic while the patients remain mobile. Patients will be connected to the system whether they are home, on vacation, or traveling for their daily routine. Some research has been conducted to determine how IMDs can fit within the Edge computing model. This will bring network resources closer to the end user to avoid latency and response times associated with traditional cloud models. The researchers suggest a unified platform solution which uses a central communication device that connects many IMDs to numerous medical providers (Moustafa, 2016). This central IoT gateway will also be capable of storing data as well as transmitting it so that it is ready for review by medical professionals when needed (Moustafa, 2016). While this will improve availability of IMD data and connectivity for remote functions, it also creates a single point of failure for many health care providers and patients. It will also be necessary to have many IoT gateways for the edge computing model. With countless nodes it will be difficult to monitor each gateway as thoroughly as a traditional large and centralized cloud system. If a threat actor were to compromise an IoT gateway they could conduct an attack from there to impact many devices instead of targeting one at a time.
Protecting IMDs from malicious commands or injecting false data runtime environments are considered to be an effective technique. An enforcer device is used to evaluate data readings from the IMD and commands from the controller device (Pearce, 2019). This evaluation is based off of policies preset on the enforcer device for what is determined to be normal readings or commands from either the IMD or controller. IMD runtime monitoring must consist of bi-directional monitoring which evaluates the state of the IMD and controller. This is essential to monitor the condition of both cyber-physical devices in real time (Pinisetty, 2017). Monitoring both devices will prevent dangerous commands from being injected by the controller and false readings from the IMD that prompt a dangerous input from the controller. One concern of the runtime enforcement models involves issues from the hardware and software of the enforcer device. The enforcer could potentially have complications with its error checking process policies. If the enforcer were to incorrectly interpret data or commands from either the IMD or controller, then this could have a negative impact on the functioning of the opposing device. In addition, the enforcer could potentially be vulnerable to exploitation which disrupts the entire runtime environment and monitorization (Pearce, 2019).
IMD Battery & DoS
A great concern of IMDs is their availability to perform and monitor life threatening conditions. When the battery of an IMD becomes depleted it will require a surgery to change out the device, and some circumstances may make them run out sooner than expected. This could be due to inefficient processes or the result of a threat actor overworking the device and draining the battery. In order to minimize demand on batteries a prototype device was built to extract the data from an IMD with a similar function to passive RFID tags. The TeleProbe works with a passive reader attached to the IMD to send a signal and extract the data related to the patient’s condition without involving the actual IMD (Lee, 2016). Leaving the IMD out of this process will allow health care providers with a TeleProbe to monitor patients without consuming any resources of the IMD. The TeleProbe would greatly improve availability of the device but introduce malicious probing as well. Threat actors could potentially use a probe reader to extract data about the patient and violate their privacy of health care data. The sensor that attaches to the IMD bypasses it entirely, so it will bypass the default authentication system built in the device. This may be viable method if an authentication process can be configured between the probe and sensor component.
Another effort to preserve IMD battery power has been worked on to authenticate devices with no power consumption. When a controller device attempts to authenticate with the IMD energy is harvested from the attempt and then used to complete the authentication process (Sliddiqi, 2019). Critical IMDs such as pacemakers cannot be recharged, so it is essential that an energy efficient method is used to complete authentication before data is extracted or commands are injected. This technology would greatly improve the battery life of IMDs by allowing them to remain in a sleep mode until a genuine authentication has been completed. Threat actors would not longer be able to conduct illegitimate authentication attempts to drain the battery of IMDs. However, this Zero Power Defense (ZPD) system assumes the authentication request will provide enough power to complete the entire authentication process between the IMD and controller device. Regulation authorities such as the FCC has limited the power of electromagnetic signals in order to protect humans (Sliddiqi, 2019). This could potentially limit the ability to provide enough power to complete the authentication process without the need of the IMD CPU and battery reservoir. A certain strength of encryption is needed to create a secure wireless authentication process, and this will require a certain amount of power to complete. If any battery power is required for this process it completely defeats the ZPD design for IMDs.
Conclusion
When improving upon IMDs risk will need to be evaluated based on the type of medical devices and the needs of the patient. Some patients may need a device that has the longest battery life possible, and others may be more reliant on IT security. The unique nature of IMDs and their remote functionality has created many new challenges to safeguard the patient’s health and develop a secure device. When attempting to improve this cyber-physical system a framework should be used to consider the issues exclusive them (Nomikos, 2020). This will provide an excellent approach to optimize battery efficiency, device authentication, and integration with the IoTs to actively monitor patients. The security of IMDs are critical to prevent threat actors from causing serious harm or loss of life to health care patients.
References
Ash, S. L. (2016). Cybersecurity of wireless implantable medical devices (Order No. 10109631). Available from ProQuest Dissertations & Theses Global. (1796055559). http://ezproxy.umgc.edu/login?url=https://www-proquest-com.ezproxy.umgc.edu/docview/1796055559?accountid=14580
Belkhouja, T. (2019). Effective Security Schemes for Wireless Implantable Medical Devices (Order No. 13812822). Available from ProQuest Dissertations & Theses Global. (2284215166). http://ezproxy.umgc.edu/login?url=https://www-proquest-com.ezproxy.umgc.edu/docview/2284215166?accountid=14580
Dawson, S. P. (2017). Implementing Vibration-based Communication Channels for Secure Implantable Medical Devices (Order No. 10615754). Available from ProQuest Dissertations & Theses Global. (1975370880). http://ezproxy.umgc.edu/login?url=https://www-proquest-com.ezproxy.umgc.edu/docview/1975370880?accountid=14580
Lee, W. S., Kim, Y., & Raghunathan, V. (2016). TeleProbe. Proceedings of the 2016 International Symposium on Low Power Electronics and Design - ISLPED 16, 28-33. Retrieved November 18, 2020, from https://doi-org.ezproxy.umgc.edu/10.1145/2934583.2934593
Marin, E., Singelée, D., Yang, B., Volski, V., Vandenbosch, G. A., Nuttin, B., & Preneel, B. (2018). Securing Wireless Neurostimulators. Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy, 287-298. Retrieved November 19, 2020, from https://dl-acm-org.ezproxy.umgc.edu/doi/pdf/10.1145/3176258.3176310
Moustafa, H., Schooler, E., Shen, G., & Kamath, S. (2016). Remote monitoring and medical devices control in eHealth. Fourth International IEEE Workshop on E-Health Pervasive Wireless Applications and Services 2016, 1-8. Retrieved November 19, 2020, from https://www-computer-org.ezproxy.umgc.edu/csdl/pds/api/csdl/proceedings/download-article/12OmNvmowUQ/pdf
Nomikos, K., Papadimitriou, A., Stergiopoulos, G., Koutras, D., Psarakis, M., & Kotzanikolaou, P. (2020). On a Security-oriented Design Framework for Medical IoT Devices: The Hardware Security Perspective. 2020 23rd Euromicro Conference on Digital System Design (DSD), 1, 204-209. Retrieved November 18, 2020, from https://www-computer-org.ezproxy.umgc.edu/csdl/pds/api/csdl/proceedings/download-article/1nLbEig1bvq/pdf
Pearce, H., Kuo, M. M., Roop, P. S., & Pinisetty, S. (2019). Securing implantable medical devices with runtime enforcement hardware. Proceedings of the 17th ACM-IEEE International Conference on Formal Methods and Models for System Design, 1-9. Retrieved November 18, 2020, from https://doi-org.ezproxy.umgc.edu/10.1145/3359986.3361200
Pinisetty, S., Roop, P. S., Smyth, S., Allen, N., Tripakis, S., & Hanxleden, R. V. (2017). Runtime Enforcement of Cyber-Physical Systems. ACM Transactions on Embedded Computing Systems. Retrieved November 19, 2020, from https://dl-acm-org.ezproxy.umgc.edu/doi/pdf/10.1145/3126500
Siddiqi, M. A., & Strydis, C. (2019). Towards realistic battery-DoS protection of implantable medical devices. CF '19: Proceedings of the 16th ACM International Conference on Computing Frontiers, 42-49. Retrieved November 18, 2020, from https://doi-org.ezproxy.umgc.edu/10.1145/3310273.3321555
Reply to Thread
Filter by:
Status: Unread
|
Top of Form
Bottom of Form