Cyber-Physical Systems Security—A Survey <s> b) Intrusion detection systems: <s> Our study analyzes the security and privacy properties of an implantable cardioverter defibrillator (ICD). Introduced to the U.S. market in 2003, this model of ICD includes pacemaker technology and is designed to communicate wirelessly with a nearby external programmer in the 175 kHz frequency range. After partially reverse-engineering the ICD's communications protocol with an oscilloscope and a software radio, we implemented several software radio-based attacks that could compromise patient safety and patient privacy. Motivated by our desire to improve patient safety, and mindful of conventional trade-offs between security and power consumption for resource-constrained devices, we introduce three new zero-power defenses based on RF power harvesting. Two of these defenses are human-centric, bringing patients into the loop with respect to the security and privacy of their implantable medical devices (IMDs). Our contributions provide a scientific baseline for understanding the potential security and privacy risks of current and future IMDs, and introduce human-perceptible and zero-power mitigation techniques that address those risks. To the best of our knowledge, this paper is the first in our community to use general-purpose software radios to analyze and attack previously unknown radio communications protocols. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> b) Intrusion detection systems: <s> Wireless communication has become an intrinsic part of modern implantable medical devices (IMDs). Recent work, however, has demonstrated that wireless connectivity can be exploited to compromise the confidentiality of IMDs' transmitted data or to send unauthorized commands to IMDs---even commands that cause the device to deliver an electric shock to the patient. The key challenge in addressing these attacks stems from the difficulty of modifying or replacing already-implanted IMDs. Thus, in this paper, we explore the feasibility of protecting an implantable device from such attacks without modifying the device itself. We present a physical-layer solution that delegates the security of an IMD to a personal base station called the shield. The shield uses a novel radio design that can act as a jammer-cum-receiver. This design allows it to jam the IMD's messages, preventing others from decoding them while being able to decode them itself. It also allows the shield to jam unauthorized commands---even those that try to alter the shield's own transmissions. We implement our design in a software radio and evaluate it with commercial IMDs. We find that it effectively provides confidentiality for private data and protects the IMD from unauthorized commands. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> b) Intrusion detection systems: <s> Wearable and implantable medical devices are being increasingly deployed to improve diagnosis, monitoring, and therapy for a range of medical conditions. Unlike other classes of electronics and computing systems, security attacks on these devices have extreme consequences and must, therefore, be analyzed and prevented with utmost effort. Yet, very little work exists on this important topic and the security vulnerabilities of such systems are not well understood. We demonstrate security attacks that we have implemented in the laboratory on a popular glucose monitoring and insulin delivery system available on the market, and also propose defenses against such attacks. Continuous glucose monitoring and insulin delivery systems are becoming increasingly popular among patients with diabetes. These systems utilize wireless communication links, which are frequently utilized as a portal to launch security attacks. Our study shows that both passive attacks (eavesdropping of the wireless communication) and active attacks (impersonation and control of the medical devices to alter the intended therapy) can be successfully launched using public-domain information and widely available off-the-shelf hardware. The proposed attacks can compromise both the privacy and safety of patients. We propose two possible defenses against such attacks. One is based on rolling-code cryptographic protocols, and the other is based on body-coupled communication. Our security analysis shows that the proposed defenses have the potential to mitigate the security risks associated with personal healthcare systems. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> b) Intrusion detection systems: <s> In this paper we propose a behavior-rule specification-based intrusion detection (BSID) technique of medical devices (sensors or actuators) embedded in a medical cyber physical system (MCPS) in which the patient's safety is of the utmost importance. We investigate the impact of attacker behaviors on the effectiveness of our malware detection technique. Using vital sign monitor medical devices as an example, we demonstrate that our intrusion detection technique can effectively trade false positives for a high detection probability to cope with more sophisticated and hidden attackers to support ultra safe and secure MCPS applications. <s> BIB004 </s> Cyber-Physical Systems Security—A Survey <s> b) Intrusion detection systems: <s> Medical cyber-physical systems (MCPS) are life-critical, context-aware, networked systems of medical devices. These systems are increasingly used in hospitals to provide high-quality continuous care for patients. The need to design complex MCPS that are both safe and effective has presented numerous challenges, including achieving high assurance in system software, intoperability, context-aware intelligence, autonomy, security and privacy, and device certifiability. In this paper, we discuss these challenges in developing MCPS, some of our work in addressing them, and several open research issues. <s> BIB005 </s> Cyber-Physical Systems Security—A Survey <s> b) Intrusion detection systems: <s> Balancing security, privacy, safety, and utility is a necessity in the health care domain, in which implantable medical devices (IMDs) and body area networks (BANs) have made it possible to continuously and automatically manage and treat a number of health conditions. In this work, we survey publications aimed at improving security and privacy in IMDs and health-related BANs, providing clear definitions and a comprehensive overview of the problem space. We analyze common themes, categorize relevant results, and identify trends and directions for future research. We present a visual illustration of this analysis that shows the progression of IMD/BAN research and highlights emerging threats. We identify three broad research categories aimed at ensuring the security and privacy of the telemetry interface, software, and sensor interface layers and discuss challenges researchers face with respect to ensuring reproducibility of results. We find that while the security of the telemetry interface has received much attention in academia, the threat of software exploitation and the sensor interface layer deserve further attention. In addition, we observe that while the use of physiological values as a source of entropy for cryptographic keys holds some promise, a more rigorous assessment of the security and practicality of these schemes is required. <s> BIB006 </s> Cyber-Physical Systems Security—A Survey <s> b) Intrusion detection systems: <s> We present an electroc1ardiogram (ECG)-based data encryption (EDE) scheme for implantable medical devices (IMDs). IMDs, including pacemakers and cardiac defibrillators, perform therapeutic or even life-saving functions and store sensitive data; therefore, it is important to prevent adversaries from having access to them. The EDE is designed with the ability to provide information-theoretically unbreakable encryption where two well-known techniques of classic one-time pads (OTPs) and error correcting codes are combined to achieve a cryptographic primitive for IMDs. Unlike other ECG-based key agreement schemes where ECG features are used to facilitate a key distribution, in the EDE scheme, random binary strings generated from ECG signals are directly used as keys for encryption. OTP keys are generated by the IMD and the programmer, respectively, before each encryption attempt; thus, the EDE does not require a cryptographic infrastructure to support a key distribution, storage, revocation, and refreshment. Protected by the EDE, IMDs could not be accessed by adversaries; however, medical personnel can have access to them by measuring real-time ECG data in emergencies. Therefore, the EDE design achieves a balance of high security and high accessibility for the IMD. Our data and security analysis shows that the EDE is a viable scheme for protecting IMDs. <s> BIB007 </s> Cyber-Physical Systems Security—A Survey <s> b) Intrusion detection systems: <s> There is broad consensus that remote health monitoring will benefit all stakeholders in the healthcare system and that it has the potential to save billions of dollars. Among the major concerns that are preventing the patients from widely adopting this technology are data privacy and security. Wireless Medical Sensor Networks (MSNs) are the building blocks for remote health monitoring systems. This paper helps to identify the most challenging security issues in the existing authentication protocols for remote patient monitoring and presents a lightweight public-key-based authentication protocol for MSNs. In MSNs, the nodes are classified into sensors that report measurements about the human body and actuators that receive commands from the medical staff and perform actions. Authenticating these commands is a critical security issue, as any alteration may lead to serious consequences. The proposed protocol is based on the Rabin authentication algorithm, which is modified in this paper to improve its signature signing process, making it suitable for delay-sensitive MSN applications. To prove the efficiency of the Rabin algorithm, we implemented the algorithm with different hardware settings using Tmote Sky motes and also programmed the algorithm on an FPGA to evaluate its design and performance. Furthermore, the proposed protocol is implemented and tested using the MIRACL (Multiprecision Integer and Rational Arithmetic C/C++) library. The results show that secure, direct, instant and authenticated commands can be delivered from the medical staff to the MSN nodes. <s> BIB008
Halperinet et al. BIB001 proposed a detection mechanism that alarms patients of unauthorized communication attempts with their IMDs. In addition, Gollakota et al. BIB002 proposed the Shield, which detects and prevents malicious wireless-based attacks on IMDs. Although the Shield is not designed specifically as an IDS, it certainly serves as one. On the other hand, Mitchell and Chen BIB004 aim to detect compromised sensors and actuators that pose threat to patients' safety through behavior rule-based IDS. Their proposal is not intended for IMDs or wearable devices. Rather, it is mainly for standalone medical devices, such as vital sign monitor and cardiac device. Thus, there is a need for IDS solutions that consider implanted and wearable devices' unique properties, e.g., communication protocols, physical interaction with human bodies, and limited resources. c) Location-based controls: Some solutions utilize distance-bounding protocols that rely on the physical distance between communicating devices so that remote attackers cannot launch attacks remotely. The distance is determined by various techniques such as ultrasound signals, received signal strength, electrocardiography signals BIB007 , and body-coupled communication (BCC). This technique provides authentication but not authorization. Hence, other techniques must be incorporated BIB006 . d) Thwarting active and passive attacks: Li et al. BIB003 proposed the use of BCC, were they experimentally investigate the BCC's ability to prevent passive and active attacks against insulin delivery systems. This type of communication thwarts most passive and active attacks because of its dependence on the human body as its transmission medium, as opposed to conventional wireless communication where the air is the communication medium that is easily intercepted. When the human body becomes the transmission medium, an attacker needs a very close proximity to a patient or even direct body contact. This significantly mitigates the attacks and raises the bar for the attackers. e) Allowing versus disallowing remote functionalities: In order to prevent attackers from penetrating networks that make the interaction between remote physicians with patients' devices possible, manufacturers should disable remote capabilities from being sent through the network. They only allow remote parties to receive measures and logs, but not send commands. Although this is a good security practice to prevent attackers from sending remote commands, it limits the full utilization of such devices BIB005 . Therefore, there is a need to strike a balance between security and usability without introducing remote threats to patients. If remote commands are allowed, Hayajneh et al. BIB008 proposed an approach to protect patients from unauthenticated remote commands against their IMDs. The approach relies on Rabin public-key cryptosystem.