With the rapid development of health equipments, increasingly more patients have installed the implantable medical devices (IMD) in their bodies for diagnostic, monitoring, and therapeutic purposes. IMDs are extremely limited in computation power and battery capacity. Meanwhile, IMDs have to communicate with an external programmer device (i.e., IMD programmer) through the wireless channel, which put them under the risk of unauthorized access and malicious wireless attacks. In this paper, we propose a proxy-based fine-grained access control scheme for IMDs, which can prolong the IMD's lifetime by delegating the access control computations to the proxy device (e.g., smartphone). In our scheme, the proxy communicates with the IMD programmer through an audio cable, which is resistant to a number of wireless attacks. Additionally, we use the ciphertext-policy attribute-based encryption (CP-ABE) to enforce fine-grained access control. The proposed scheme is implemented on real emulator devices and evaluated through experimental tests. The experiments show that the proposed scheme is lightweight and effective.
Some other two-party based access control schemes only check whether the programmer is in proximity. Specifically, IMD and the programmer need to extract certain features from the same source simultaneously, and generate the temporary keys based on the extracted feature, respectively. The source is usually the signal in an out-of-band channel, such as electrocardiography (ECG) signal @cite_44 , body-coupled electric signal @cite_39 , vibration @cite_7 , ultrasound @cite_26 , etc. If the programmer is close enough to the IMD, they will derive the same (symmetric) temporary key for the encryption of future communications. The real-time signal measurement and key extraction computations both bring in an extra burden to the resource-constrained IMD. Other works proposed to pre-load the patient's biometric information (e.g., fingerprint) or a password into the IMD. During access, the programmer operator can manually collect the biometric features from the patient @cite_36 or the password from a physical object carrying it @cite_15 , respectively. However, the bio-features and the password engraved on an object can be stole by the adversary. Besides, a common disadvantage of these two types of schemes is that they only provide a coarse-grained access control. No information about the access requestor is acquired and validated.
@cite_26 @cite_7 @cite_36 @cite_39 @cite_44 @cite_15
2155079825 2049509357 2079024329 2101188359
Implantable Medical Devices (IMDs) are widely used to treat chronic diseases. Nowadays, many IMDs can wirelessly communicate with an outside programmer (reader). However, the wireless access also introduces security concerns. An attacker may get an IMD reader and gain access to a patient's IMD. IMD security is an important issue since attacks on IMDs may directly harm the patient. A number of research groups have studied IMD security issues when the patient is in nonemergency situations. However, these security schemes usually require the patient's participation, and they may not work during emergencies (e.g., when the patient is in comma) for various reasons. In this paper, we propose a light-weight secure access control scheme for IMDs during emergencies. Our scheme utilizes patient's biometric information to prevent unauthorized access to IMDs. The scheme consists of two levels: level 1 employs some basic biometric information of the patient and it is lightweight; level 2 utilizes patients' iris data for authentication and it is very effective. In this research, we also make contributions in human iris verification: we discover that it is possible to perform iris verification by comparing partial iris data rather than the entire iris data. This significantly reduces the overhead of iris verification, which is critical for resource-limited IMDs. We evaluate the performance of our schemes by using real iris data sets. Our experimental results show that the secure access control scheme is very effective and has small overhead (hence feasible for IMDs). Specifically, the false acceptance rate (FAR) and false rejection rate (FRR) of our secure access control scheme are close to 0.000 with suitable threshold, and the memory and computation overheads are acceptable. Our analysis shows that the secure access control scheme reduces computation overhead by an average of 58 . Wireless Implantable Medical Devices (IMDs), including pacemakers and cardiac defibrillators, often have built-in wireless modules in order to facilitate non-invasive programming and data read-out; however, most IMDs lack a security mechanism. The unique challenge is that IMDs should be able to be accessed by doctors at any legitimate hospital for emergency purposes, but conventional security mechanisms using keys or credentials cannot guarantee that doctors could obtain keys timely in emergency situations. To address this unique challenge, we present an ECG-based Secret Data Sharing (ESDS) scheme for securing wireless IMDs which does not require pre-deployed keys or credentials. The ESDS scheme makes use of electrocardiograph (ECG) features to hide a secret within the IMD before transmission, and then reveal the secret with simultaneously measured ECG features by an external programmer. This scheme can protect IMDs against eavesdropping and other active attacks. In addition, the scheme uses an improved fuzzy vault scheme in which hash functions are substituted for chaff points to hide genuine points on a polynomial. This improvement saves IMD resources in terms of memory and communications, making the ESDS scheme lightweight. Performance analysis shows that the ESDS scheme meets our design goal of security. Common authentication methods based on passwords, tokens, or fingerprints perform one-time authentication and rely on users to log out from the computer terminal when they leave. Users often do not log out, however, which is a security risk. The most common solution, inactivity timeouts, inevitably fail security (too long a timeout) or usability (too short a timeout) goals. One solution is to authenticate users continuously while they are using the terminal and automatically log them out when they leave. Several solutions are based on user proximity, but these are not sufficient: they only confirm whether the user is nearby but not whether the user is actually using the terminal. Proposed solutions based on behavioral biometric authentication (e.g., keystroke dynamics) may not be reliable, as a recent study suggests. To address this problem we propose Zero-Effort Bilateral Recurring Authentication (ZEBRA). In ZEBRA, a user wears a bracelet (with a built-in accelerometer, gyroscope, and radio) on her dominant wrist. When the user interacts with a computer terminal, the bracelet records the wrist movement, processes it, and sends it to the terminal. The terminal compares the wrist movement with the inputs it receives from the user (via keyboard and mouse), and confirms the continued presence of the user only if they correlate. Because the bracelet is on the same hand that provides inputs to the terminal, the accelerometer and gyroscope data and input events received by the terminal should correlate because their source is the same - the user's hand movement. In our experiments ZEBRA performed continuous authentication with 85 accuracy in verifying the correct user and identified all adversaries within 11s. For a different threshold that trades security for usability, ZEBRA correctly verified 90 of users and identified all adversaries within 50s. We propose a proximity-based access control scheme for implantable medical devices (IMDs). Our scheme is based on ultrasonic distance-bounding and enables an implanted medical device to grant access to its resources only to those devices that are in its close proximity. We demonstrate the feasibility of our approach through tests in an emulated patient environment. We show that, although implanted, IMDs can successfully verify the proximity of other devices with high accuracy. We propose a set of protocols that support our scheme, analyze their security in detail and discuss possible extensions. We make new observations about the security of implementations of ultrasonic distance-bounding protocols. Finally, we discuss the integration of our scheme with existing IMD devices and with their existing security measures.