SoK: Security and privacy in implantable medical devices and body area networks

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2014, Pages 524-539

  Rushanan, Michael ^a   Rubin, Aviel D ^a   Kune, Denis Foo ^b   Swanson, Colleen M ^b  

^a Johns Hopkins University   (United States)

^b UNIVERSITY OF MICHIGAN   (United States)

Author keywords

body area networks; health; implantable medical devices; privacy; security

Indexed keywords

DATA PRIVACY; HEALTH; TELEMETERING EQUIPMENT;

BODY AREA NETWORK; CRYPTOGRAPHIC KEY; HEALTH CONDITION; IMPLANTABLE MEDICAL DEVICES; REPRODUCIBILITIES; SECURITY; SECURITY AND PRIVACY; SENSOR INTERFACE;

NETWORK SECURITY;

EID: 84914104968     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2014.40     Document Type: Conference Paper

References (100)

1. K. E. Hanna, F. J. Manning, P. Bouxsein, and A. Pope, Innovation and Invention in Medical Devices: Workshop Summary. The National Academies Press, 2001.
2. (2011, Jun.) Insulin pumps - global pipeline analysis, opportunity assessment and market forecasts to 2016. [Online]. Available: http://www.globaldata.com.
3. (2011, Jun.) US healthcare equipment and supplies - diabetes. [Online]. Available: http://www.research.hsbc.com.
4. M. Patel and J. Wang, "Applications, challenges, and prospective in emerging body area networking technologies," Wireless Commun., vol. 17, no. 1, pp. 80-88, Feb. 2010.
5. G. Asada, M. Dong, T. S. Lin, F. Newberg, G. Pottie, W. J. Kaiser, and H. O. Marcy, "Wireless integrated network sensors: Low power systems on a chip," in Proc. 24th European Solid-State Circuits Conference (ESSCIRC '98), 1998, pp. 9-16.
6. J. Zheng and M. J. Lee, "Will IEEE 802.15.4 make ubiquitous networking a reality?: A discussion on a potential low power, low bit rate standard," IEEE Commun. Mag., vol. 42, no. 6, pp. 140-146, Jun. 2004.
7. X. Zhang, H. Jiang, X. Chen, L. Zhang, and Z. Wang, "An energy efficient implementation of on-demand MAC protocol in medical wireless body sensor networks," in Proc. IEEE International Symposium on Circuits and Systems (ISCAS 2009), 2009, pp. 3094-3097.
8. S. Ullah, H. Higgins, B. Braem, B. Latre, C. Blondia, I. Moerman, S. Saleem, Z. Rahman, and K. S. Kwak, "A comprehensive survey of wireless body area networks," J. Med. Syst., vol. 36, no. 3, pp. 1065-1094, Jun. 2012.
9. A. Kailas and M. A. Ingram, "Wireless communications technology in telehealth systems," in Proc. 1st International Conference on Wireless Communication, Vehicular Technology, Information Theory and Aerospace Electronic Systems Technology (Wireless VITAE 2009), 2009, pp. 926-930.
10. Code of Federal Regulations, "Title 47 Part 95 Section 401 (e) C.F.R 47, 95.401 (e), Federal Communications Commission - The Wireless Medical Telemetry Service (WMTS)," http://transition.fcc.gov/Bureaus/Engineering Technology/Orders/2000/fcc00211.pdf.
11. G. Kolata. (2013, Oct.) Of fact, fiction and Cheney's defibrillator. [Online]. Available: http://www.nytimes.com/2013/10/29/science/of-fact-fiction-and-defibrillators.html.
12. D. Halperin, T. S. Heydt-Benjamin, B. Ransford, S. S. Clark, B. Defend, W. Morgan, K. Fu, T. Kohno, and W. H. Maisel, "Pacemakers and implantable cardiac defibrillators: Software radio attacks and zero-power defenses," in Proc. 29th Annual IEEE Symposium on Security and Privacy (SP 2008), May 2008, pp. 129-142.
13. K. Fu and J. Blum, "Inside risks: Controlling for cybersecurity risks of medical device software," Communications of the ACM, vol. 56, no. 10, pp. 21-23, Oct. 2013.
14. W. Burleson, S. S. Clark, B. Ransford, and K. Fu, "Design challenges for secure implantable medical devices," in Proc. 49th Annual Design Automation Conference (DAC '12), 2012, pp. 12-17.
15. (2013, Jun.) Content of premarket submissions for management of cybersecurity in medical devices: Draft guidance for industry and Food and Drug Administration staff. http://www.regulations.gov/#!documentDetail;D= FDA-2013-D-0616-0002.
16. A. B. Mullen. (2013, Sep.) Premature enforcement of CDRH's draft cybersecurity guidance. http://www.fdalawblog.net/fda law blog hyman phelps/2013/09/premature-enforcement-of-cdrhs-draft-cybersecurityguidance.html.
17. D. Halperin, T. S. Heydt-Benjamin, K. Fu, T. Kohno, and W. H. Maisel, "Security and privacy for implantable medical devices," IEEE Pervasive Comput., vol. 7, no. 1, pp. 30-39, Jan. 2008.
18. C. Li, A. Raghunathan, and N. K. Jha, "Hijacking an insulin pump: Security attacks and defenses for a diabetes therapy system," in Proc. 13th IEEE International Conference on e-Health Networking Applications and Services (HealthCom 2011), 2011, pp. 150-156.
19. M. Rostami, W. Burleson, F. Koushanfar, and A. Juels, "Balancing security and utility in medical devices?" in Proc. 50th Annual Design Automation Conference (DAC '13), 2013, pp. 13:1-13:6.
20. M. Zhang, A. Raghunathan, and N. K. Jha, "Towards trustworthy medical devices and body area networks," in Proc. 50th Annual Design Automation Conference (DAC '13), 2013, pp. 14:1-14:6.
21. S. S. Clark and K. Fu, "Recent results in computer security for medical devices," in International ICST Conference on Wireless Mobile Communication and Healthcare (MobiHealth), Special Session on Advances in Wireless Implanted Devices, Oct. 2011.
22. D. Foo Kune, J. Backes, S. S. Clark, D. Kramer, M. Reynolds, K. Fu, Y. Kim, and W. Xu, "Ghost talk: Mitigating EMI signal injection attacks against analog sensors," in Proc. 34th Annual IEEE Symposium on Security and Privacy (SP 2013), 2013, pp. 145-159.
23. P. Bagade, A. Banerjee, J. Milazzo, and S. K. S. Gupta, "Protect your BSN: No handshakes, just namaste!" in IEEE International Conference on Body Sensor Networks (BSN), 2013, pp. 1-6.
24. S. Heath, Embedded Systems Design, 1st ed. Butterworth-Heinemann, 1997.
25. K. Sohraby, D. Minoli, and T. Znati, Wireless Sensor Networks: Technology, Protocols, and Applications. Wiley, 2007.
26. V. Shnayder, B. Chen, K. Lorincz, T. R. F. Fulford Jones, and M. Welsh, "Sensor networks for medical care," in Proc. 3rd International Conference on Embedded Networked Sensor Systems (SenSys '05), 2005, p. 314.
27. United States Statutes at Large, "Federal Food, Drug, and Cosmetic Act (FD&C Act), Section 201 (21 U.S.C. 321)," http://www.fda.gov/RegulatoryInformation/Legislation/FederalFoodDrugandCosmeticActFDCAct/FDCActChaptersIandIIShortTitleandDefinitions/ucm086297.htm.
28. (2011, Nov.) U.S Food and Drug Administration, Office of International Programs (OIP). [Online]. Available: http://www.fda.gov/AboutFDA/CentersOffices/OfficeofGlobalRegulatoryOperationsandPolicy/OfficeofInternationalPrograms/ucm236581.htm.
29. Federal Communications Commission, "Report and Order (FCC No 00-211), Paragraph 24," http://transition.fcc.gov/Bureaus/Engineering Technology/Orders/2000/fcc00211.pdf.
30. M. Pajic, Z. Jiang, I. Lee, O. Sokolsky, and R. Mangharam, "From verification to implementation: A model translation tool and a pacemaker case study," in Proc. IEEE 18th Real Time and Embedded Technology and Applications Symposium (RTAS '12), 2012, pp. 173-184.
31. R. K. Shepard and K. A. Ellenbogen, "Leads and longevity: How long will your pacemaker last?" Europace, vol. 11, no. 2, pp. 142-143, 2009.
32. Code of Federal Regulations, "Title 47 Part 95 Subpart I C.F.R 47, 95 Subpart I, Federal Communications Commission - Medical Device Radiocommunication Service (MedRadio)," http://transition.fcc.gov/Bureaus/Engineering Technology/Orders/2000/fcc00211.pdf.
33. B. Latré, B. Braem, I. Moerman, C. Blondia, and P. Demeester, "A survey on wireless body area networks," Wireless Networks, vol. 17, no. 1, pp. 1-18, Jan. 2011.
34. D. Foo Kune, K. K. Venkatasubramanian, E. Vasserman, I. Lee, and Y. Kim, "Toward a safe integrated clinical environment: A communication security perspective," in Proc. 2012 ACM workshop on Medical Communication Systems, 2012, pp. 7-12.
35. M. Clarke, D. Bogia, K. Hassing, L. Steubesand, T. Chan, and D. Ayyagari, "Developing a standard for personal health devices based on 11073," in Proc. 29th Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBS 2007), 2007, pp. 6174-6176.
36. (2011, Nov.) Health level seven international. http://www.hl7.org/.
37. (2014, Mar.) Integrating the healthcare enterprise. http://www.ihe.net/.
38. ASTM F-29.21, "Medical devices and medical systems - essential safety requirements for equipment comprising the patient-centric integrated clinical environment (ICE)," 2009.
39. T. Denning, A. Borning, B. Friedman, B. T. Gill, T. Kohno, and W. H. Maisel, "Patients, pacemakers, and implantable defibrillators: Human values and security for wireless implantable medical devices," in Proc. SIGCHI Conference on Human Factors in Computing Systems (CHI '10), 2010, pp. 917-926.
40. P. Kumar and H.-J. Lee, "Security issues in healthcare applications using wireless medical sensor networks: A survey," Sensors, vol. 12, no. 1, pp. 55-91, 2011.
41. S. Avancha, A. Baxi, and D. Kotz, "Privacy in mobile technology for personal healthcare," ACM Comput. Surv., vol. 45, no. 1, pp. 3:1-3:54, Dec. 2012.
42. K. Ellis and N. Serinken, "Characteristics of radio transmitter fingerprints," Radio Science, vol. 36, no. 4, pp. 585-597, 2001.
43. J. Hall, M. Barbeau, and E. Kranakis, "Detecting rogue devices in bluetooth networks using radio frequency fingerprinting," in IASTED International Conference on Communications and Computer Networks, 2006.
44. K. B. Rasmussen and S. Čapkun, "Implications of radio fingerprinting on the security of sensor networks," in Proc. 3rd International Conference on Security and Privacy in Communications Networks and the Workshops (SecureComm 2007), 2007, pp. 331-340.
45. M. Rostami, A. Juels, and F. Koushanfar, "Heart-to-heart (H2H): Authentication for implanted medical devices," in Proc. 20th ACM Conference on Computer and Communications Security (CCS 2013), Nov. 2013.
46. N. Henry Jr., N. Paul, and N. McFarlane, "Using bowel sounds to create a forensically-aware insulin pump system," in Proc. 4th USENIX Workshop on Health Information Technology (HealthTech), 2013.
47. C. Hu, X. Cheng, F. Zhang, D. Wu, X. Liao, and D. Chen, "OPFKA: Secure and efficient ordered-physiologicalfeature-based key agreement for wireless body area networks," Proc. 32nd IEEE International Conference on Computer Communications (INFOCOM 2013), 2013.
48. L. Shi, J. Yuan, S. Yu, and M. Li, "ASK-BAN: Authenticated secret key extraction utilizing channel characteristics for body area networks," in Proc. 6th ACM conference on Security and privacy in wireless and mobile networks (WiSec '13), 2013, pp. 155-166.
49. H. Alemzadeh, R. Iyer, Z. Kalbarczyk, and J. Raman, "Analysis of safety-critical computer failures in medical devices," IEEE Security Privacy, vol. 11, no. 4, pp. 14-26, 2013.
50. N. O. Tippenhauer, L. Malisa, A. Ranganathan, and S. Čapkun, "On limitations of friendly jamming for confidentiality," in Proc. 34th Annual IEEE Symposium on Security and Privacy (SP 2013), 2013, pp. 160-173.
51. M. Zhang, A. Raghunathan, and N. Jha, "MedMon: Securing medical devices through wireless monitoring and anomaly detection," IEEE Trans. Biomed. Circuits Syst., vol. 7, no. 6, pp. 871-881, Dec. 2013.
52. S. Chang, Y. Hu, H. Anderson, T. Fu, and E. Y. L. Huang, "Body area network security: Robust key establishment using human body channel," in Proc. 3rd USENIX Workshop on Health Security and Privacy (HealthSec), vol. 37, no. 6, Aug. 2012.
53. D. B. Kramer, M. Baker, B. Ransford, A. Molina-Markham, Q. Stewart, K. Fu, and M. R. Reynolds, "Security and privacy qualities of medical devices: An analysis of FDA postmarket surveillance," PLoS ONE, vol. 7, p. e40200, Jul. 2012.
54. L. Shi, M. Li, S. Yu, and J. Yuan, "BANA: Body area network authentication exploiting channel characteristics," in Proc. 5th ACM conference on Security and Privacy in Wireless and Mobile Networks (WiSec '12), 2012, pp. 27-38.
55. I. Martinovic, D. Davies, M. Frank, D. Perito, T. Ros, and D. Song, "On the feasibility of side-channel attacks with brain-computer interfaces," in Proc. 21st USENIX Security Symposium (USENIX Security '12), 2012, p. 34.
56. K. K. Venkatasubramanian, A. Banerjee, and S. K. S. Gupta, "PSKA: Usable and secure key agreement scheme for body area networks," IEEE Trans. Inf. Technol. Biomed., vol. 14, no. 1, pp. 60-68, 2010.
57. A. D. Jurik and A. C. Weaver, "Securing mobile devices with biotelemetry," in Proc. 20th International Conference on Computer Communications and Networks (ICCCN 2011), 2011, pp. 1-6.
58. Z. Jiang, M. Pajic, A. Connolly, S. Dixit, and R. Mangharam, "Real-time heart model for implantable cardiac device validation and verification," in Proc. 2010 22nd Euromicro Conference on Real-Time Systems (ECRTS '10), 2010, pp. 239-248.
59. S. Gollakota, H. Hassanieh, B. Ransford, D. Katabi, and K. Fu, "They can hear your heartbeats: Non-invasive security for implantable medical devices," SIGCOMM Comput. Commun. Rev., vol. 41, no. 4, pp. 2-13, Aug. 2011.
60. K. K. Venkatasubramanian and S. K. S. Gupta, "Physiological value-based efficient usable security solutions for body sensor networks," ACM Trans. Sen. Netw. (TOSN), vol. 6, no. 4, pp. 31:1-31:36, Jul. 2010.
61. T. Halevi and N. Saxena, "On pairing constrained wireless devices based on secrecy of auxiliary channels: The case of acoustic eavesdropping," in Proc. 17th ACM conference on Computer and Communications Security (CCS 2010), 2010, pp. 97-108.
62. F. Xu, Z. Qin, C. Tan, B. Wang, and Q. Li, "IMDGuard: Securing implantable medical devices with the external wearable guardian," in Proc. 30th IEEE International Conference on Computer Communications (INFOCOM 2011), 2011, pp. 1862-1870.
63. X. Hei, X. Du, J. Wu, and F. Hu, "Defending resource depletion attacks on implantable medical devices," in Proc. IEEE Global Telecommunications Conference (GLOBECOM 2010), 2010, pp. 1-5.
64. K. K. Venkatasubramanian, A. Banerjee, and S. K. S. Gupta, "Plethysmogram-based secure inter-sensor communication in body area networks," in Proc. Military Communications Conference (MILCOM 2008), Nov. 2008, pp. 1-7.
65. K. B. Rasmussen, C. Castelluccia, T. S. Heydt-Benjamin, and S. Čapkun, "Proximity-based access control for implantable medical devices," in Proc. 16th ACM conference on Computer and Communications Security (CCS 2009), 2009, pp. 410-419.
66. T. Denning, Y. Matsuoka, and T. Kohno, "Neurosecurity: Security and privacy for neural devices," Journal of Neurosurgery: Pediatrics, vol. 27, no. 1, p. E7, Jul. 2009.
67. L. Ballard, S. Kamara, and M. K. Reiter, "The practical subtleties of biometric key generation," in Proc. 17th conference on Security Symposium (SS '08), 2008, pp. 61-74.
68. K. K. Venkatasubramanian, A. Banerjee, and S. K. S. Gupta, "EKG-based key agreement in body sensor networks," in Proc. 2nd Workshop on Mission Critical Networks (INFOCOM Workshops 2008), 2008, pp. 1-6.
69. T. Denning, K. Fu, and T. Kohno, "Absence makes the heart grow fonder: New directions for implantable medical device security," in Proc. 3rd conference on Hot Topics in Security (HotSec '08), 2008, pp. 5:1-5:7.
70. K. K. Venkatasubramanian and S. K. S. Gupta, "Security for pervasive health monitoring sensor applications," in Proc. 4th International Conference on Intelligent Sensing and Information Processing (ICISIP), 2006.
71. S. Cherukuri, K. K. Venkatasubramanian, and S. K. S. Gupta, "BioSec: a biometric based approach for securing communication in wireless networks of biosensors implanted in the human body," in Proc. International Conference on Parallel Processing Workshops, 2003, pp. 432-439.
72. C. C. Y. Poon, Y.-T. Zhang, and S.-D. Bao, "A novel biometrics method to secure wireless body area sensor networks for telemedicine and m-health," IEEE Commun. Mag., vol. 44, no. 4, pp. 73-81, 2006.
73. M. Li, S. Yu, J. D. Guttman, W. Lou, and K. Ren, "Secure ad hoc trust initialization and key management in wireless body area networks," ACM Trans. Sen. Netw. (TOSN), vol. 9, no. 2, pp. 18:1-18:35, Apr. 2013.
74. C. Hu, N. Zhang, H. Li, X. Cheng, and X. Liao, "Body area network security: A fuzzy attribute-based signcryption scheme," IEEE J. Sel. Areas Commun., vol. 31, no. 9, pp. 37-46, Sep. 2013.
75. F. Miao, L. Jiang, Y. Li, and Y.-T. Zhang, "Biometrics based novel key distribution solution for body sensor networks," in Proc. Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC 2009), 2009, pp. 2458-2461.
76. G. Zhang, C. C. Y. Poon, and Y. Zhang, "A fast key generation method based on dynamic biometrics to secure wireless body sensor networks for p-health," in Proc. Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC 2010), 2010, pp. 2034-2036.
77. S. Hanna, R. Rolles, A. Molina-Markham, P. Poosankam, K. Fu, and D. Song, "Take two software updates and see me in the morning: The case for software security evaluations of medical devices," in Proc. 2nd USENIX conference on Health Security and Privacy (HealthSec '11), 2011, p. 6.
78. P. Roberts. (2011, Oct.) Blind attack on wireless insulin pumps could deliver lethal dose. [Online]. Available: http://threatpost.com/blind-attack-wireless-insulin-pumpscould-deliver-lethal-dose.
79. J. Radcliffe. (2011, Aug.) Hacking medical devices for fun and insulin: Breaking the human SCADA system. http://media.blackhat.com/bh-us-11/Radcliffe/BH US 11 Radcliffe Hacking Medical Devices WP.pdf.
80. S. Brands and D. Chaum, "Distance-bounding protocols," in Advances in Cryptology - EUROCRYPT'93, ser. Lecture Notes in Computer Science, vol. 765, 1994, pp. 344-359.
81. Z. Kfir and A. Wool, "Picking virtual pockets using relay attacks on contactless smartcard," in Proc. 1st International Conference on Security and Privacy for Emerging Areas in Communications Networks (SECURECOMM '05), 2005, pp. 47-58.
82. A. Czeskis, K. Koscher, J. R. Smith, and T. Kohno, "RFIDs and secret handshakes: Defending against ghost-andleech attacks and unauthorized reads with context-aware communications," in Proc. 15th ACM conference on Computer and Communications Security (CCS 2008), 2008, pp. 479-490.
83. C. Cremers, K. B. Rasmussen, B. Schmidt, and S. Čapkun, "Distance hijacking attacks on distance bounding protocols," in Proc. 33rd Annual IEEE Symposium on Security and Privacy (SP 2012), 2012, pp. 113-127.
84. M. Goodrich, M. Sirivianos, J. Solis, G. Tsudik, and E. Uzun, "Loud and clear: Human-verifiable authentication based on audio," in Proc. 26th IEEE International Conference on Distributed Computing Systems (ICDCS 2006), 2006, p. 10.
85. A. P. Felt, M. Finifter, E. Chin, S. Hanna, and D. Wagner, "A survey of mobile malware in the wild," in Proc. 1st ACM Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM '11), 2011, pp. 3-14.
86. T. H. Faris, Safe and Sound Software: Creating an Efficient and Effective Quality System for Software Medical Device Organizations. ASQ Quality Press, 2006.
87. Z. Jiang, M. Pajic, and R. Mangharam, "Model-based closed-loop testing of implantable pacemakers," in Proc. IEEE/ACM 2nd International Conference on Cyber-Physical Systems, 2011, pp. 131-140.
88. K. Sandler, L. Ohrstrom, L. Moy, and R. McVay, "Killed by code: Software transparency in implantable medical devices," http://www.softwarefreedom.org, Jul. 2010.
89. K. Fu, "Trustworthy medical device software," in Health Effectiveness of the FDA 510(k) Clearance Process: Measuring Postmarket Performance and Other Select Topics: Workshop Report, Jul. 2011.
90. (2014, Mar.) Peach fuzzer. http://peachfuzzer.com/.
91. (2014, Mar.) Archimedes: Ann Arbor Center for Medical Device Security. http://secure-medicine.org.
92. American National Standards Institute/Association for the Advancement of Medical Instrumentation (ANSI/AAMI), "Active implantable medical devices - Electromagnetic compatibility - EMC test protocols for implantable cardiac pacemakers and implantable cardioverter defibrillators," 2007.
93. A. L. Goldberger, L. A. N. Amaral, L. Glass, J. M. Hausdorff, P. C. Ivanov, R. G. Mark, J. E. Mietus, G. B. Moody, C. Peng, and H. E. Stanley, "PhysioBank, PhysioToolkit, and PhysioNet: Components of a new research resource for complex physiologic signals," Circulation, vol. 101, no. 23, pp. e215-e220, Jun. 2000.
94. I. Radojičić, D. Mandić, and D. Vulić, "On the presence of deterministic chaos in HRV signals," in Computers in Cardiology 2001, 2001, pp. 465-468.
95. (2010) NIST special publication 800-22rev1a: A statistical test suite for the validation of random number generators and pseudo random number generators for cryptographic applications. http://csrc.nist.gov/groups/ST/toolkit/rng/documents/SP800-22rev1a.pdf. NIST.
96. V. Fischer, "A closer look at security in random number generators design," in Constructive Side-Channel Analysis and Secure Design, ser. Lecture Notes in Computer Science, 2012, vol. 7275, pp. 167-182.
97. W. Schindler and W. Killmann, "Evaluation criteria for true (physical) random number generators used in cryptographic applications," in Cryptographic Hardware and Embedded Systems (CHES 2002), ser. Lecture Notes in Computer Science, 2003, vol. 2523, pp. 431-449.
98. M. Poh, D. J. McDuff, and R. W. Picard, "Advancements in noncontact, multiparameter physiological measurements using a webcam," IEEE Trans. Biomed. Eng., vol. 58, no. 1, pp. 7-11, Jan. 2011.
99. S. Kwon, H. Kim, and K. S. Park, "Validation of heart rate extraction using video imaging on a built-in camera system of a smartphone," in Proc. Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC 2012), Aug. 2012, pp. 2174-2177.
100. H. Wu, M. Rubinstein, E. Shih, J. Guttag, F. Durand, and W. Freeman, "Eulerian video magnification for revealing subtle changes in the world," ACM Trans. Graph. (SIGGRAPH), pp. 65:1-65:8, Jul. 2012.