Abstract:Wearable and implantable medical devices (IMDs) are increasingly deployed to diagnose, monitor, and provide therapy for critical medical conditions. Such medical devices are safety-critical cyber-physical systems (CPSs). These systems support wireless features introducing potential security vulnerabilities. Although these devices undergo rigorous safety certification processes, runtime security attacks are inevitable. Based on published literature, IMDs such as pacemakers and insulin infusion systems can be remotely controlled to inject deadly electric shocks and excess insulin, posing a threat to a patient’s life. While prior works based on formal methods have been proposed to detect potential attack vectors using different forms of static analysis, these have limitations in preventing attacks at runtime. This paper discusses a formal framework for detecting cyber-physical attacks on a pacemaker by monitoring its security policies at runtime. We propose a wearable device that senses the Electrocardiogram (ECG) and Photoplethysmogram (PPG) of the body to detect attacks in a pacemaker. To facilitate the design of this device, we map the security policies of a pacemaker w.r.t ECG and PPG, paving the way for designing formal verification monitors for pacemakers for the first time using multiple physiological signals. The proposed monitoring framework allows the synthesis of parallel monitors from a given set of desired security policies, where all the monitors execute concurrently and generate an alarm to the user in the case of policy violation. Our implementation and the performance evaluation results demonstrate the technical feasibility of designing such a wearable device for attack detection in pacemakers. This device is separate from the pacemaker, ensuring no need for re-certification of pacemakers. Our approach is amenable to the application of security patches when new attack vectors are detected, making the approach ideal for runtime monitoring of medical CPSs.

Apparatus and method for protection of critical embedded system components via hardware-isolated secure element-based monitor

Appareil et procédé de protection de composants système intégrés critiques au moyen d'un moniteur basé sur un élément sécurisé isolé du matériel

A Secure Scan Method for Crypto Chips

Apparatus and method for transparent, secure element-based mediation of on-board diagnostic operations

Fringing Electric Field Sensors for Anti-Attack at System-Level Protection

IMDGuard: Securing Implantable Medical Devices with the External Wearable Guardian

Hardware-Assisted Security Monitoring Unit for Real-Time Ensuring Secure Instruction Execution and Data Processing in Embedded Systems

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

Hardware Trojans in Chips: A Survey for Detection and Prevention

On Chip Electrostatic Discharge Protection for MEMS Gas Sensor System

Hardware-Assisted Monitoring For Instruction Security In Embedded System

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

A Method to Enhance SCADA Systems Survivability with Exogenous Monitors

Securing Pacemakers using Runtime Monitors over Physiological Signals

An attack-immune trusted architecture for supervisory aircraft hardware

You Can't Always Check What You Wanted: Selective Checking and Trusted Execution to Prevent False Actuations in Cyber-Physical Systems

Security Memory System for Mobile Device or Computer Against Memory Attacks

Physical Attack Protection Techniques for IC Chip Level Hardware Security

Securing Embedded System from Code Reuse Attacks: A Lightweight Scheme with Hardware Assistance

Design of Monitor and Protect Circuits against FIB Attack on Chip Security

Restart-Based Security Mechanisms for Safety-Critical Embedded Systems