With the rapid development of health equipments, increasingly more patients have installed the implantable medical devices (IMD) in their bodies for diagnostic, monitoring, and therapeutic purposes. IMDs are extremely limited in computation power and battery capacity. Meanwhile, IMDs have to communicate with an external programmer device (i.e., IMD programmer) through the wireless channel, which put them under the risk of unauthorized access and malicious wireless attacks. In this paper, we propose a proxy-based fine-grained access control scheme for IMDs, which can prolong the IMD's lifetime by delegating the access control computations to the proxy device (e.g., smartphone). In our scheme, the proxy communicates with the IMD programmer through an audio cable, which is resistant to a number of wireless attacks. Additionally, we use the ciphertext-policy attribute-based encryption (CP-ABE) to enforce fine-grained access control. The proposed scheme is implemented on real emulator devices and evaluated through experimental tests. The experiments show that the proposed scheme is lightweight and effective.
Protecting implantable medical devices against attack without compromising patient health requires balancing security and privacy goals with traditional goals such as safety and utility. Implantable medical devices monitor and treat physiological conditions within the body. These devices - including pacemakers, implantable cardiac defibrillators (ICDs), drug delivery systems, and neurostimulators - can help manage a broad range of ailments, such as cardiac arrhythmia, diabetes, and Parkinson's disease. IMDs' pervasiveness continues to swell, with upward of 25 million US citizens currently reliant on them for life-critical functions. Growth is spurred by geriatric care of the aging baby-boomer generation, and new therapies continually emerge for chronic conditions ranging from pediatric type 1 diabetes to anorgasmia and other sexual dysfunctions. Moreover, the latest IMDs support delivery of telemetry for remote monitoring over long-range, high-bandwidth wireless links, and emerging devices will communicate with other interoperating IMDs. The use of radio for communication with medical devices provides important convenience and safety features. However, devices that respond to unauthorized queries may inadvertently disclose their presence. It is reasonable for users to expect that their devices' detectability by third parties to be limited, and thus even eavesdroppers to an authorized conversation (e.g. a command sent to an insulin pump) should observe an access code of minimal utility for triggering future transmissions. Access rights should be revocable in a manner that limits that harm that can be caused by authorized devices in the possession of unauthorized users. In order to detect inappropriate use, it may be desirable for access history to be available for audit. We describe a family of replay-attack resistant protocols suitable for embedding into query messages that can authorize users with a range of differentiated access rights. Implanted devices utilizing these techniques can evade detection by suppressing responses to queries that do not contain appropriate authorization. Techniques are described that can support revocation of authorization and audits of access history. Finally, we observe that the processing of unauthorized queries consumes power and thus can be used to mount a potentially devastating denial-of-service attack against the batteries of both conventional devices and devices that utilize the cryptographic protocols we describe. Since field-powered communication systems (e.g. HF-RFID) contain embedded general-purpose processors that operate using only power extracted from externally applied fields, they are substantially more robust against such forms of attack.