Cyber-Physical Systems Security—A Survey <s> D. Medical Devices Challenges 1) Security Versus Usability: <s> Our study analyzes the security and privacy properties of an implantable cardioverter defibrillator (ICD). Introduced to the U.S. market in 2003, this model of ICD includes pacemaker technology and is designed to communicate wirelessly with a nearby external programmer in the 175 kHz frequency range. After partially reverse-engineering the ICD's communications protocol with an oscilloscope and a software radio, we implemented several software radio-based attacks that could compromise patient safety and patient privacy. Motivated by our desire to improve patient safety, and mindful of conventional trade-offs between security and power consumption for resource-constrained devices, we introduce three new zero-power defenses based on RF power harvesting. Two of these defenses are human-centric, bringing patients into the loop with respect to the security and privacy of their implantable medical devices (IMDs). Our contributions provide a scientific baseline for understanding the potential security and privacy risks of current and future IMDs, and introduce human-perceptible and zero-power mitigation techniques that address those risks. To the best of our knowledge, this paper is the first in our community to use general-purpose software radios to analyze and attack previously unknown radio communications protocols. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> D. Medical Devices Challenges 1) Security Versus Usability: <s> Wireless communication has become an intrinsic part of modern implantable medical devices (IMDs). Recent work, however, has demonstrated that wireless connectivity can be exploited to compromise the confidentiality of IMDs' transmitted data or to send unauthorized commands to IMDs---even commands that cause the device to deliver an electric shock to the patient. The key challenge in addressing these attacks stems from the difficulty of modifying or replacing already-implanted IMDs. Thus, in this paper, we explore the feasibility of protecting an implantable device from such attacks without modifying the device itself. We present a physical-layer solution that delegates the security of an IMD to a personal base station called the shield. The shield uses a novel radio design that can act as a jammer-cum-receiver. This design allows it to jam the IMD's messages, preventing others from decoding them while being able to decode them itself. It also allows the shield to jam unauthorized commands---even those that try to alter the shield's own transmissions. We implement our design in a software radio and evaluate it with commercial IMDs. We find that it effectively provides confidentiality for private data and protects the IMD from unauthorized commands. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> D. Medical Devices Challenges 1) Security Versus Usability: <s> Implantable Medical Devices (IMDs) are being embedded increasingly often in patients' bodies to monitor and help treat medical conditions. To facilitate monitoring and control, IMDs are often equipped with wireless interfaces. While convenient, wireless connectivity raises the risk of malicious access to an IMD that can potentially infringe patients' privacy and even endanger their lives. Thus, while ease of access to IMDs can be vital for timely medical intervention, too much ease is dangerous. Obvious approaches, such as passwords and certificates, are unworkable at large scale given the lack of central authorities and frequent emergencies in medical settings. Additionally, IMDs are heavily constrained in their power consumption and computational capabilities. Designing access-control mechanisms for IMDs that can meet the many constraints of real-world deployment is an important research challenge. In this paper, we review proposed approaches to the access-control problem for IMDs, including the problem of secure pairing (and key distribution) between an IMD and another device, such as a programmer. (We also treat related technologies, such as body-area networks.) We describe some limitations of well-conceived proposals and reveal security weaknesses in two proposed cryptographic pairing schemes. Our intention is to stimulate yet more inventive and rigorous research in the intriguing and challenging areas of IMD security and medical-device security in general. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> D. Medical Devices Challenges 1) Security Versus Usability: <s> Wireless implantable medical devices (IMDs) are cyber-physical systems that deliver life-saving treatments to cardiac patients with dangerous heart conditions. Current access control models for these systems are insufficient; more security is necessary. In response to this problem, the technical security community has investigated new directions for improving security on these resource-constrained devices. Defenses, however, must not only be technically secure; in order to be deployable, defenses must be designed to work within the needs and constraints of their relevant application spaces. Designing for an application space---particularly a specialized one---requires a deep understanding of the stakeholders, their values, and the contexts of technology usage. Grounding our work in value sensitive design (VSD), we collaborated as an interdisciplinary team to conduct three workshops with medical providers for the purpose of gathering their values and perspectives. The structure of our workshop builds on known workshop structures within the human-computer interaction (HCI) community, and the number of participants in our workshops (N=24) is compatible with current practices for inductive, exploratory studies. We present results on: what the participants find important with respect to providing care and performing their jobs; their reactions to potential security system concepts; and their views on what security system properties should be sought or avoided due to side effects within the context of their work practice. We synthesize these results, use the results to articulate design considerations for future technical security systems, and suggest directions for further research. Our research not only provides a contribution to security research for an important class of cyber-physical systems (IMDs); it also provides an example of leveraging techniques from other communities to better explore the landscape of security designs for technologies. <s> BIB004 </s> Cyber-Physical Systems Security—A Survey <s> D. Medical Devices Challenges 1) Security Versus Usability: <s> Balancing security, privacy, safety, and utility is a necessity in the health care domain, in which implantable medical devices (IMDs) and body area networks (BANs) have made it possible to continuously and automatically manage and treat a number of health conditions. In this work, we survey publications aimed at improving security and privacy in IMDs and health-related BANs, providing clear definitions and a comprehensive overview of the problem space. We analyze common themes, categorize relevant results, and identify trends and directions for future research. We present a visual illustration of this analysis that shows the progression of IMD/BAN research and highlights emerging threats. We identify three broad research categories aimed at ensuring the security and privacy of the telemetry interface, software, and sensor interface layers and discuss challenges researchers face with respect to ensuring reproducibility of results. We find that while the security of the telemetry interface has received much attention in academia, the threat of software exploitation and the sensor interface layer deserve further attention. In addition, we observe that while the use of physiological values as a source of entropy for cryptographic keys holds some promise, a more rigorous assessment of the security and practicality of these schemes is required. <s> BIB005
Too much security could be result in counterintuitively result in the inability to reconfigure a device when a patient is in a critical condition. For example, a patient with an IMD might be in a situation that needs urgent intervention by another health care provider. The provider does not have the cryptographic credentials or the access privileges that allow him/her to reconfigure the IMD, so the unavailability of the IMD could be very dangerous  , BIB003 . Therefore, designers should strike a balance between usability and security in medical devices. The usability property should allow access in emergency situations, for example, while maintaining security as much as possible. Denning et al. BIB004 proposed a promising solution which uses a fail-open/safety wristband. A patient wears the band to prevent interactions with unauthorized programmers and other illegitimate parties. Whenever there is a need to access an IMD, this band is removed, allowing communication with any programmer. The authors also propose several design considerations for maintaining usability and security in. 2) Add-On Security ≈ Increased Code: Adding security directly to the IMDs could increase the size of code and hence the rate of medical device recalls. In addition, cryptographic operations could also affect the limited-power at the cost of the original purpose of a medical device BIB005 . Thus, it is more desirable to limit functions of IMDs to pure medical operations and shift security services to an external device BIB002 . 3) Limited Resources: Extensive computations that are usually needed in cryptographic mechanisms consume power, which is a critical resource in these small and limited-resource devices  , BIB003 . The devices must maintain power for a number of years depending on the nature of the device. For devices that require surgery to be placed into a patient's body, they must be able to function for at least a decade or two. Halperin et al. BIB001 proposed one of the first efforts to combine cryptographic techniques with battery-free consumption. The authors designed a cryptographic-based solution that relies solely on RF as a source of energy. In addition, some attacks might only aim to drain the battery to disable a device, resulting in a DoS attack BIB005 . Although a medical device might refuse to interact with an unauthorized party sending signals, the very fact that the device receives and processes the signals from illegitimate parties is problematic and results in battery depleting. Therefore, new controls should be developed to prevent such attacks by preventing medical devices from responding to any illegitimate interaction.