A Reference Architecture for Secure Medical Devices

Abstract

We propose a reference architecture aimed at supporting the safety and security of medical devices. The ISOSCELES (Intrinsically Secure, Open, and Safe Cyber-Physically Enabled, Life-Critical Essential Services) architecture is justified by a collection of design principles that leverage recent advances in software component isolation based on hypervisor and other separation technologies. The instantiation of the architecture for particular medical devices is supported by a development process based on Architecture Analysis and Design Language. The architecture models support safety and security analysis as part of a broader risk management framework. The models also can be used to derive skeletons of the device software and to configure the platform's separation policies and an extensive set of services. We are developing prototypes of the architecture and example medical device instantiations on low-cost boards that can be used in product solutions. The prototype and supporting development and assurance artifacts are being released under an open-source license.

Development of medical applications based on AI models and register data – regulatory considerations

“…Medical device regulation, referred above, is focused to ensure the safety and performance of the product. ML based medical software typically needs to be integrated in the information system environment of a healthcare service [18,19]. Such integration may be subject to additional regulation besides the MDR [20].…”

Assessing Support for Industry Standards in Reference Medical Software Architectures

“…Our SLR identified five reference architectures for constructing medical device software. These are serviceoriented medical device architecture (SOMDA) [7], Fuzzy-Based modular [8], intrinsically secure, open, and safe cyber-physically enabled, life-critical essential services (ISOSCELES) architectures [9], sensor information systems for active retires and assisted living (SISARL) [10] and model-based systems engineering (MBSE) [11].…”

“…The IEC 62366:2015 standard allows the integration of usability engineering processes (UEP) in their medical device design and development [6]. [9], sensor information systems for active retirees and assisted living [10], and model-based systems engineering [11]. We then evaluate the extent to which these architectures support each of the views in 4+1 Views, presented as a mapping in Sec.…”

“…For RQ2, we conduct a systematic literature review, discussed in Sec. 2, to identify five reference architectures for medical software: serviceoriented medical device architecture [7], fuzzy-based modular [8], intrinsically secure, open, and safe cyberphysically enabled, life-critical essential services architectures [9], sensor information systems for active retirees and assisted living [10], and model-based systems engineering [11]. We then evaluate the extent to which these architectures support each of the views in 4+1 Views, presented as a mapping in Sec.…”