CRII: SaTC CPS: RUI: Cyber-Physical System Security in Implantable Insulin Injection Systems

越来越多的医疗设备依赖于软件和无线信道进行操作，这也给其安全、可靠和可信的操作带来了新的漏洞。目前广泛使用的植入式胰岛素泵等医疗设备可以持续监测和管理患者的糖尿病，而无需对患者进行频繁的日常干预。这些设备最初并非针对网络安全威胁而设计，现在必须减轻这些威胁。该项目研究了这些植入式医疗设备系统中的安全漏洞，并提供了新的见解和理解，以保护这些设备，防止用户滥用和黑客滥用。具体来说，本研究解决了如何检测和防御中间人攻击和重放攻击之间的葡萄糖传感器和胰岛素泵或监测设备由患者持有。这种攻击的检测是通过一个个性化的模型来计算和识别异常的血糖水平。为了通过无线链路远程保护剂量设置，使用了基于每个糖尿病患者独特的个性化参数的生物密钥。身份验证通过基于声学的指纹方案与语音模式识别技术相结合进行。一种基于声波和无线电波的人工胰腺混合安全通道正在开发中，以测试和验证这种方法。虽然该项目侧重于葡萄糖传感器和胰岛素泵，但这些安全方案可以广泛应用于其他无线医疗设备。这个项目正在特拉华州立大学进行，这是一所历史上的黑人学院或大学，并利用与宾夕法尼亚大学和阿拉巴马大学的合作来设计一个安全的无线胰岛素泵系统，并将支持不同的本科生和研究生两年。研究成果还将用于设计和实施网络物理系统安全的课程材料，并将帮助培养学生成为未来的网络安全专业人员。

Increasingly medical devices are dependent on software and the wireless channel for their operations, which also pose new vulnerabilities to their safe, dependable, and trustworthy operations. Medical devices such as implantable insulin pumps, which are in wide use today, continuously monitor and manage a patient's diabetes without the need for frequent daily patient interventions. These devices, not originally designed against cyber security threats, must now mitigate these threats. This project examines security vulnerabilities in these implantable medical device systems and offers new insights and understanding to protect these devices and prevent their misuse by users and abuse by hackers.Specifically, this research addresses how to detect and defend against man-in-the-middle and replay attacks between the glucose sensor and the insulin pump or monitor device held by patients. Detection of such an attack is addressed via a personalized model to calculate and recognize abnormal glucose levels. To remotely secure the dosage setting over a wireless link, a bio-key based on personalized parameters unique to each patient with diabetes mellitus, is used. Authentication is carried out via an acoustic-based fingerprint scheme coupled with voice pattern recognition technology. A mixed acoustic and radio wave-based secure channel in an artificial pancreas is being developed to test and validate this approach. While this project focuses on glucose sensors and insulin pumps, these security schemes can be applied broadly to other wireless medical devices. This project is being carried out at Delaware State University, a historically black college or university, and leverages collaborations with the University of Pennsylvania and University of Alabama to design a secure wireless insulin pumping system, and will support diverse undergraduate and graduate students for two years. The research results will also be used to design and implement course materials on cyber-physical systems security and will help train students to become tomorrow's cyber security professionals.