Towards Security Policy and Architecture for Managing Implantable Medical Devices

摘要

Implantable cardiac rhythm management devices (CRMDs) such as permanent pacemakers and internal car-dioverter defibrillators (ICDs) utilize embedded computers and radios to monitor chronic disorders and treat patients. Life-saving devices like ICDs, for instance, include pacemaker technology and are designed to communicate wirelessly with a nearby external device programmer (EDP) that can remotely read data and change settings without the need for surgery. An ICD implanted in a patient can sense a rapid heartbeat and administer an electric shock to restore normal heart rhythm. It is has been shown that current ICDs in the market can be reverse engineered and are prone to software radio-based attacks. The ICDs can be remotely disabled or be made to administer an electric shock at random. Existing defense mechanisms include a simple cryptographic approach where a symmetric-key based challenge-response protocol is used between the ICD and an authorized EDP. This approach does not scale. In the real world, large scale deployment and management of shared key material amongst various entities such as CRMDs, EDPs, hospitals, clinics, and ambulances is a major issue. In this paper, we investigate security policy issues applicable to the CRMD ecosystem and issues for architectures that enforce the policy. Given the nature of this domain, these solutions will need to balance security, privacy and risk. For instance, an unauthorized EDP may need to issue a command to the ICD in emergency situations.