Proximity-based Access Control for Implantable Medical Devices Author: Kasper B. Rasmussen Claude Castelluccia Thomas Heydt-Benjamin Srdjan Capkun

Introduction Recently, as the rapid development of IMD, new generation of IMD provide more convenience for the medical professionals to get access to data they need from the IMD. However, there is a trade-off in the process with some privacy and security challenges. We have to prevent the IMD from the unauthorized data access and certain malicious device’s attack. CS589: Access Control and System Security 11/12/2018

Introduction Originally, previous research about IMD access control was based on public-key cryptography or preloaded secret keys. Obviously, this kind of solutions will ignore some emergent scenarios where the IMD need to be accessible to emergency ambulance staffs. Occasionally, when a patient is in unconsciousness, the ambulance staffs have no way to access the patient’s IMD, which probably postpones the best time to save the patient. CS589: Access Control and System Security 11/12/2018

Introduction This paper implement a combination of classical public-key cryptography and proximity-based access control. There is two models for the system: Normal and Emergency. Both of modes are based on public-key and proximity. I will specific introduce this two mode in the later slides. CS589: Access Control and System Security 11/12/2018

System Reader IMD The basic system model: The reader (potentially malicious) can remotely modify the IMD internal configuration and collect data from the IMD. IMD could be any device implanted into a human body, such as pacemaker. Reader IMD Wireless Access CS589: Access Control and System Security 11/12/2018

Attacker Model In the first scenario, the attacker wants to get access to medical data stored in the IMD or change device settings. It is easily understood. Identity theft, blackmail… In the second scenario, the attacker wants to impersonate a device and make a reader talk to him. It is little complicated. Prevent emergent rescue, insurance fraud… CS589: Access Control and System Security 11/12/2018

Diffie–Hellman key exchange This system partly utilizes the DH key exchange as the credential communication between reader and device. Diffie–Hellman key exchange (D–H) is a cryptography protocol that allows two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure communications channel. CS589: Access Control and System Security 11/12/2018

DH Specification CS589: Access Control and System Security 11/12/2018

Basic Protocol Description Ultrasonic distance bounding. By measurement of sound signal bonding time, we can calculate the distance between the reader and device. During measurement process of proximity, we can establish a secret key shared by the two sides for further communication. CS589: Access Control and System Security 11/12/2018

CS589: Access Control and System Security 11/12/2018

Security Analysis If the attacker(malicious reader or device) actual location is beyond the accepted range, he has to guess every bit of Nv or Np in advance, which can shorten the time(t2 –t1 or t4 –t3) in order to deceit the device or reader. So we have to confirm that the Nonce is highly stochastic. In this case, the attacker’s accurate guessing is almost impossible. CS589: Access Control and System Security 11/12/2018

Protocol Defect My Personal Opinion In the proximity prove process, the hacker can receive the Nv and (Nv ⊕ gp). And then, because the public base g is known by the attacker, he can decrypt the private key p. In the proximity verification process, the hacker can receive the Np and (Np ⊕ gv). And then, because the public base g is known by the attacker, he can decrypt the private key v. Therefore, the secret public key gpv is hacked by the attacker. CS589: Access Control and System Security 11/12/2018

Protocol Extension Combination of the credential and proximity-based solution: Scenario 1: the credential is stolen or duplicated. Scenario 2: the patient doesn’t carry his credential. Scenario 3: the patient is not able to provide credential in emergency. Two mode of operation: Normal mode (credential and proximity-based). Emergency mode (only proximity-based). CS589: Access Control and System Security 11/12/2018

Normal Mode In this case, the patient will carry a credential (USB token, smart card, password, etc.) that share a secret key kshared with the IMD. Secondly, reader and device will initiate a process of rapid bit exchange to confirm the proximity. For example, the request with a distance beyond 5 meters will be denied. Finally, after confirming the secret pubic key and proximity, the reader and device are paired. CS589: Access Control and System Security 11/12/2018

Emergency Mode In this case, the credential is missing or the patient can not provide the crucial certification in emergency. Both reader and device verify by the proximity protocol that they are within each other’s security range (at most 4 centimeters) and generate a temporary secret key to communicate. Therefore, this mode deny any request outside the specific ranges, while permit any request unconditionally inside the range. CS589: Access Control and System Security 11/12/2018

Proximity-based Commands There are two kinds of command: Remotely monitor the patient, retrieve data and logs; Modify the IMD parameters and reconfigure the device. So we regard this two command groups as two different security levels. First kind of command is low security level; Second one is high security level. CS589: Access Control and System Security 11/12/2018

Proximity-based Commands CS589: Access Control and System Security 11/12/2018

Proximity-based Commands CS589: Access Control and System Security 11/12/2018

Feasibility Experiment CS589: Access Control and System Security 11/12/2018

Conclusion The proximity-based access control is an enforcement and supplement to the classic credential-based access control in IMD. It enhances the security by adding more restriction on IMD access control. CS589: Access Control and System Security 11/12/2018

Questions and Comments ? ! CS589: Access Control and System Security 11/12/2018