Securing Wireless Ingestible Medical Devices (Final Report)

View the PDF of this report here.

Researchers: Rabia Yazicigil Kirby (PI), David Starobinski (Co-PI), Alperen Yasar (RA)

I. INTRODUCTION

Ingestible medical devices (IMD) can provide continuous remote monitoring with respect to conventional healthcare technologies while ensuring a more comfortable diagnostic process for the patient. However, as in other intelligent wearable or implantable devices, physical layer security of the chip and reliability of the communication scheme is critical for patients privacy and health [1]. A breach in security may result in a wrong diagnosis, leak of monitored data or even a lethal action against the patient [2].

In this project, we investigated several attack schemes, their possible outcomes and countermeasures. Initially, we conducted research to uncover attacks on a variety of applications and communication schemes (cf. Section II). Later on, we focused on a case study of securing a threshold-crossing based bio-engineered sensor [3], [4], as shown in Fig. 6 (cf. Section III). We report on our publications and future plans in Section IV.

II. THREAT MODELS

The only way to build secure wireless ingestible medical devices is to understand the underlying vulnerabilities that attackers can exploit in the physical layer and analyze these vulnerabilities using security metrics.

A. Classification

Attack schemes can be classified in two groups as noninvasive and invasive methods. Non-invasive methods include attacks that do not require the attacker to damage the packaging of the chip, or make irreversible changes on it. A noninvasive attack can focus on the communication system to alter, capture or block the transmitted data. The attacker can try to communicate with the chip to request data or send a command. Another non-invasive method includes side-channel attacks, which tries to obtain data or bypass the security by monitoring or altering voltage levels, power consumption or EM radiation.

Invasive methods requires the attacker to have a hold of the chip and make an irreversible damage on it. These methods are effective in forensics where attacker tries to obtain some information, such as the cryptographic key, after the chip has been used. If chips do not have a unique identification system, attacker can invasively investigate one chip to perform an attack on the target chip. Invasive methods might require additional equipment such as EM analyzer or microscope, which makes it a more expensive approach than non-invasive methods.

B. Non-Invasive Methods

In this section, possible non-invasive attack schemes on a chip having a two-way communication protocol and an authentication system are investigated. One vulnerability of ingestible devices comes from its low-power nature. Since these devices rely on very small batteries or power harvesting, an attacker can take advantage of this. In the following methods, consequences of this situation will be considered.

1) Communication Attacks: These attacks focuses on capturing, altering or blocking the communication between the transmitter and receiver. The attack might be either passive or active. Passive attacks are the type where attacker eavesdrops without taking any action to alter or block the communication. These attacks can be used to gather information or store the transmitted data to process at a later time. Whereas active attacks aims to change or block the transmitted data, or target one of the devices to prevent it from functioning properly.

Common attack methods such as spoofing, Man-In-The-Middle (MITM) or Denial of Service (DoS) can be effective in IMD applications that has a duplex communication protocol. Spoofing can be defined as disguising as an authorized node to communicate with another node in the system. MITM or DoS typically require the attacker to use spoofing. Once disguised as the authorized server, an attacker can request data from, or send malicious commands to IMD.

In MITM attack, attacker uses spoofing to get in between the transmitter and receiver node, creating a link that goes through itself. This way, attacker can receive data from the server and send it to IMD (or vice versa) with or without altering the data depending on whether it is a passive or active attack. Since the receiver believes it receives data from an authorized node, detection is difficult especially in the passive case.

DoS is an attack type that might be very effective against IMD due to their low-power budget. Since they typically run on small batteries, a repeated data request would make the chip to use its RF front-end block frequently, which would deplete its battery. Since the output power of the IMD transmitter is low, the signal going to the server can be jammed fairly easy. An attack could include selective jamming that blocks the uplink from IMD while keeping the downlink. This would make the authorized server repeatedly request data from the IMD since the last transmission is blocked, which would cause depleting its battery faster.

2) Side-Channel Attacks: Side-channel attacks gathers additional information about the processes running on the chip

Fig. 1. PIC12 RF Front-End [3], [4]

TABLE I

JAMMING RESULTS

or data, or bypass some of the protocols such as authentication. Methods include investigating EM wave radiation, power consumption or decreasing supply voltage to increase delays and bypassing functionalities. Prevention of these attacks require both physical and procedural design choices. For instance, using an encoding that balances number of 0’s and 1’s would make it harder to get information by monitoring the power consumption. A cyber-security company, Fox IT, showed cracking an AES-256 in five minutes from a distance of one meter. This emphasizes that just being cryptographically secure is not enough for hardware security.

C. Invasive Methods

Invasive methods requires tampering of the device such as removing its packaging to reverse engineer the design under a microscope. These methods are effective in some side-channel attacks like optical radiation investigation. Once the package is removed, UV light can be used to flip the memory bits, potentially deactivating security protocols. Typically these attacks require special equipment which might be costly.

III. THRESHOLD-CROSSING-BASED BIO-ENGINEERED SENSOR

This section focuses on possible attacks and measures to be taken for a specific Ingestible Medical Device shown in Fig. 6. This device, designed by PI Yazicigil and her collaborators at MIT [3], [4], uses a PIC12 microcontroller for data transmission. This device is chosen due to its low power and miniaturized form factor with limited hardware resources. However, due to same reasons, this microcontroller