Strong random number generation from body physiological signals for secure communication between implants inside the body and the gateway outside the body

智能植入式医疗设备(IMD)对患者和护理提供者都有许多好处，可以实时监控、根据患者的需求调整IMD、更新IMD固件以实现更好的功能，并为医学研究提供实时数据。根据《哈佛商业评论》2017年的一份报告，考虑到人口老龄化、慢性病增加和技术突破，电子医疗设备市场在2017年估计已达到3980亿美元，市场预计将以每年3%的速度增长，至少到2022年。与此同时，IMD的安全性也成为人们非常关注的问题，许多关于IMD脆弱性的报道也浮出水面。最近，在2016年，研究表明，对大脑IMD的攻击可以控制植入物，并对受害者的情绪产生一些改变。在2016年的另一个例子中，路透社报道了强生公司制造的胰岛素泵中的漏洞，攻击者能够拦截减刑和/或请求错误剂量的胰岛素。结果，超过10万名患者被建议停止使用该设备的远程控制功能。2017年，MedSec报告称，由于圣裘德起搏器中发现的漏洞，美国有超过50万人处于危险之中。根据WhiteScope于2017年5月发布的报告，评估了四种品牌的IMD，他们发现这些设备中近8000个漏洞主要是由于IMD与其网关之间没有使用或使用静态加密密钥造成的。为了解决这个问题，我们开发了一种新的协议，可以使用临时密钥在IMD和网关之间提供安全通信。该解决方案已经在一个非常大的数据池上进行了测试，并被证明与AES算法一样安全。这种方法不仅解决了IMD中的静态密钥问题，还提供了将多个设备配对到一个IMD或在IMD之间配对的机会。

Smart Implantable Medical Devices (IMDs) have many benefits for both patients and care providers, with real-time monitoring, tuning the IMD based on the patient's need, updating the IMD firmware for better functionality and contributing real-time data for medical research. Considering the aging population, increases in chronic disease and technological breakthroughs, the electronic medical device market has reached an estimated $398 billion in 2017 with the market expanding at an expected rate of 3% per year until at least 2022 based on a report in 2017 from Harvard Business Review. At the same time the security of IMDs, becomes a great concern by many reports have been surfaced regarding the vulnerabilities of IMDs. Recently, in 2016, it has been shown how an attack to a brain's IMD could take control of the implant and do some alteration on the victim's emotion. In another example in 2016, Reuters reported vulnerabilities in insulin pumps created by Johnson & Johnson, where the attacker is able to intercept the commutation and/or request for a wrong dosage of insulin. As the result, more than 100,000 patients were advised to stop using remote control functionality of the device. In 2017, MedSec reported that more than half a million people in US were in danger because of the vulnerabilities found in St. Jude pacemakers. Based on the report published by WhiteScope in May 2017 reviewing four brands of IMDs, they have found almost 8,000 vulnerabilities in these devices mostly caused because of no or static encryption keys used between IMD and its gateway. To solve this problem, we have developed a new protocol which can provide secure communication between IMD and the gateway using temporary keys. The solution has been examined on a very large pool of data and proved to be as secure as AES algorithm. This methodology not only solves the problem of static keys in IMDs, it provides the opportunity to pair more than one device to an IMD or among IMDs.