TWC TTP: Small: Security, Privacy, and Trust for Systems of Coordinating Medical Devices

TWC TTP：小型：协调医疗设备系统的安全性、隐私性和信任

• 批准号: 1224007
• 负责人: Eugene Vasserman
• 金额: $ 48.21万
• 依托单位: Kansas State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-09-01 至 2016-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1224007&HistoricalAwards=false
• 关键词: TWC; TTP; Small; Security; Privacy

To lower costs and improve outcomes in current medical practice we need integrated interoperable medical systems to provide machine-assisted care, interaction detection, and improved alarm accuracy, to name just a few uses. This project is developing both the theory and practice to ensure the safety of next-generation medical devices by allowing secure coordination and composition, in facilities as small as a local doctor's office or as large as a multi-campus hospital. Connected devices are part of a "medical coordination platform," which allows execution of "clinical workflows," such as having a blood pressure cuff automatically take a reading once an infusion pump stops delivering medication, or determining in real time whether prescribed medications are contraindicated by a patient's past health history.Such manufacturer- and integrator-agnostic communication is difficult to bootstrap and perform securely, but security is required, since networked insecure systems are fundamentally unsafe. Furthermore, medicine is more complex than many other domains: security and quality of service properties must hold even environments where many different people have physical access to devices and communication infrastructure. Without fully trusting individual components, we must provide strong resource isolation, patient privacy protection, and real-time trust reasoning in highly-dynamic, adversarial, and life-critical systems.We aim for speedy transition to practice by providing reusable security, privacy, and logging components for existing open medical application platforms, supporting varying hardware capabilities, laws, regulations, and facility-local policies, as well as software for pre-deployment and run-time trustworthiness reasoning about the system and individual devices.

为了在当前的医疗实践中降低成本并改善结果，我们需要集成的可互操作的医疗系统来提供机器辅助护理、交互检测和提高警报准确性，仅举几个用途。该项目正在开发理论和实践，通过允许安全的协调和组合，确保下一代医疗设备的安全，在小到当地医生办公室或大到多校区医院的设施中。互联设备是“医疗协调平台”的一部分，该平台允许执行“临床工作流程”，比如一旦输液泵停止输送药物，就让血压袖带自动读数，或者实时确定患者过去的健康史是否禁止服用处方药。这种与制造商和集成商无关的通信很难引导和安全地执行，但需要安全，因为联网的不安全系统从根本上是不安全的。此外，医学比许多其他领域更复杂：即使在许多不同的人可以物理访问设备和通信基础设施的环境中，安全和服务质量属性也必须适用。在不完全信任单个组件的情况下，我们必须在高度动态、对抗性和生命关键的系统中提供强大的资源隔离、患者隐私保护和实时信任推理。我们的目标是通过为现有的开放医疗应用平台提供可重用的安全、隐私和日志记录组件，支持不同的硬件功能、法律法规和设施本地政策，以及用于关于系统和个人设备的预部署和运行时可信度推理的软件，来快速过渡到实践。