Abstract:Wearable and implantable medical devices (IMDs) are increasingly deployed to diagnose, monitor, and provide therapy for critical medical conditions. Such medical devices are safety-critical cyber-physical systems (CPSs). These systems support wireless features introducing potential security vulnerabilities. Although these devices undergo rigorous safety certification processes, runtime security attacks are inevitable. Based on published literature, IMDs such as pacemakers and insulin infusion systems can be remotely controlled to inject deadly electric shocks and excess insulin, posing a threat to a patient’s life. While prior works based on formal methods have been proposed to detect potential attack vectors using different forms of static analysis, these have limitations in preventing attacks at runtime. This paper discusses a formal framework for detecting cyber-physical attacks on a pacemaker by monitoring its security policies at runtime. We propose a wearable device that senses the Electrocardiogram (ECG) and Photoplethysmogram (PPG) of the body to detect attacks in a pacemaker. To facilitate the design of this device, we map the security policies of a pacemaker w.r.t ECG and PPG, paving the way for designing formal verification monitors for pacemakers for the first time using multiple physiological signals. The proposed monitoring framework allows the synthesis of parallel monitors from a given set of desired security policies, where all the monitors execute concurrently and generate an alarm to the user in the case of policy violation. Our implementation and the performance evaluation results demonstrate the technical feasibility of designing such a wearable device for attack detection in pacemakers. This device is separate from the pacemaker, ensuring no need for re-certification of pacemakers. Our approach is amenable to the application of security patches when new attack vectors are detected, making the approach ideal for runtime monitoring of medical CPSs.

EPA-RIMM: A Framework for Dynamic SMM-based Runtime Integrity Measurement

Process Variation and Temperature-Aware Reliability Management

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

HyperCheck: A Hardware-AssistedIntegrity Monitor

MIPE: a Practical Memory Integrity Protection Method in a Trusted Execution Environment.

DDM: A Demand-based Dynamic Mitigation for SMT Transient Channels

Practical Verifiable Computation–A MapReduce Case Study

A Hardware Platform for Ensuring OS Kernel Integrity on RISC-V

SEIMI: Efficient and Secure SMAP-Enabled Intra-process Memory Isolation.

Runtime Verification for Trustworthy Computing

Early Detection of In-Memory Malicious Activity based on Run-time Environmental Features

A Hidden Process Detection Model Based on System Management Mode

RDAMS: an Efficient Run-Time Approach for Memory Fault and Hardware Trojans Detection

Model Checking for Microarchitectural Data Sampling Security

SmmPack: Obfuscation for SMM Modules with TPM Sealed Key

RIM: A Method to Defend from JIT Spraying Attack

Jintide: Utilizing Low-Cost Reconfigurable External Monitors to Substantially Enhance Hardware Security of Large-Scale CPU Clusters

A Source-Level Instrumentation Framework for the Dynamic Analysis of Memory Safety

MOTEF: A Testing Framework for Runtime Monitoring Infrastructures

Securing Pacemakers using Runtime Monitors over Physiological Signals

JITScanner: Just-in-Time Executable Page Check in the Linux Operating System