A system architecture, processor, and communication protocol for secure implants

Abstract

Secure and energy-efficient communication between Implantable Medical Devices (IMDs) and authorized external users is attracting increasing attention these days. However, there currently exists no systematic approach to the problem, while solutions from neighboring fields, such as wireless sensor networks, are not directly transferable due to the peculiarities of the IMD domain. This work describes an original, efficient solution for secure IMD communication. A new implant system architecture is proposed, where security and main-implant functionality are made completely decoupled by running the tasks onto two separate cores. Wireless communication goes through a custom security ASIP, called SISC (Smart-Implant Security Core), which runs an energy-efficient security protocol. The security core is powered by RF-harvested energy until it performs external-reader authentication, providing an elegant defense mechanism against battery Denialof-Service (DoS) and other, more common attacks. The system has been evaluated based on a realistic case study involving an artificial pancreas implant. When synthesized for a UMC 90nm CMOS ASIC technology, our system architecture achieves defense against unauthorized accesses having zero energy cost, running entity authentication through harvesting only 7.45μJ of RF energy from the requesting entity. In all other successfully authenticated accesses, our architecture achieves secure data exchange without affecting the performance of the main IMD functionality, adding less than 1‰ (1.3mJ) to the daily energy consumption of a typical implant. Compared to a singe-core, secure reference IMD, which would still be more vulnerable to some types of attacks, our secure system on chip (SoC) achieves high security levels at 56% energy savings and at an area overhead of less than 15%.

Securing Implantable Medical Devices Using Ultrasound Waves

“…There is a separate MCU/processor for executing the medical application (medical MCU), and for handling communication packets and running the security protocol (security MCU). This dual-processor architecture, which is based on [28], is a first step in protecting against DoS attacks in general: If an attacker sends continuous packets to prevent the IMD from running its main application, only the security MCU will be kept busy entertaining those messages, whereas the medical MCU will remain unaffected. However, in order to protect against battery DoS specifically, additional measures are required, as explained below.…”

Can Formal Security Verification Really Be Optional? Scrutinizing the Security of IMD Authentication Protocols

“…These components are optional, meaning they may not appear in all implanted devices. One good illustration is the Smart Implant Security Core (SISC) [35]. Communication between IMD and a programmer via wireless medium passes through this device.…”