Bulwark: Securing implantable medical devices communication channels

• Published in: Computers & security 2019-09, Vol.86, p.498-511
• Main Authors: Bu, Lake, Karpovsky, Mark G., Kinsy, Michel A.
• Format: Article
• Language: English
• Subjects: AMD codes; Authentication; Communication; Controllers; Cybersecurity; Electronic devices; Electronic implants; Encryption; Implantable medical devices; Man-In-The-Middle; Medical devices; Medical electronics; Medical equipment; Power consumption; Robust codes; Security; Wireless communications
• ISSN: 0167-4048; 1872-6208
• DOI: 10.1016/j.cose.2018.10.011

•This work introduces a design of secure wireless transmission channel for implantable medical devices (IMDs).•The proposed technique is able to protect the IMDs from various attacks, such as being eavesdropped, receiving forged malicious commands, or being turned off by attackers.•The work leverages several lightweight techniques in order to achieve minimal modification to the original IMDs and extend their battery life.•In addition, it proposes a third party authorization protocol, where for trusted third party entities (e.g., emergency medical teams), it is able to allow the access to an IMD only when the overall security level of the team reaches to a certain threshold. Implantable medical devices (IMDs) have been used to manage a broad range of diseases and ailments. They are convenient for patients due to their small sizes, unobtrusiveness and portability using wireless monitors or controllers. However, the wireless communication between these devices and their controllers often lacks security features or mechanisms. This lack of security makes the use of these devices a fertile ground for passive and active attacks. Unlike other cyber attacks which target victims’ information or property, attacks on medical devices can threaten a victim’s life. Currently, there are very few efficient solutions to these attacks which balance security, reliability, and power consumption. Therefore, in this work, we propose a robust approach for guarding against existing and potential communication-based attacks on IMDs while keeping the added hardware and power consumption low. In addition, we introduce a secure and efficient protocol for authorizing third-party medical teams to access the IMDs in the case of an emergency.