Research Initiation Award: Designing Efficient Access Control Schemes for Implantable Medical Devices

研究启动奖为历史上黑人学院和大学的初级和中级职业教师提供支持，他们正在建立新的研究项目或重新定向和重建现有的研究项目。预计该奖项将有助于进一步提高教师的研究能力和效率，改善家庭机构的研究和教学，并使本科生参与研究经验。授予费耶特维尔州立大学的奖项在许多领域都有潜在的更广泛的影响。该项目的目标是研究植入式医疗设备的访问控制方案，以及通过开发课程和让本科生参与这项研究来加强大学的教学和学习。 本研究计画设计并实作新颖的轻量化及一般化存取控制机制，可有效地保护植入式医疗装置（IMD）在一般及紧急情况下免于未经授权的存取。智能手机被用作代理，以委托复杂的密码计算进行访问控制。此外，为了延长资源受限IMD的寿命，将使用修改的压缩感测技术来减少IMD和代理之间的数据加密的通信开销和计算开销。将采用密文策略基于属性的加密（CP-ABE）对IMD程控仪操作员（通常为医生）的资格进行细粒度访问控制。拟议的访问控制方案是完全自动化的，不需要病人参与。目前，IMD产品没有共同的安全标准或规范可供遵循。该项目的结果将促进和指导IMD行业制定有关商业IMD产品网络安全问题的标准和规范。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Research Initiation Awards provide support for junior and mid-career faculty at Historically Black Colleges and Universities who are building new research programs or redirecting and rebuilding existing research programs. It is expected that the award helps to further the faculty member's research capability and effectiveness, improves research and teaching at the home institution, and involves undergraduate students in research experiences. The award to Fayetteville State University has potential broader impacts in a number of areas. The goal of this project is to study access control schemes for implantable medical devices; as well as to enhance teaching and learning at the university by developing courses and involving undergraduate students in this research. This research project designs and implements novel lightweight and generalized access control schemes that can effectively secure implantable medical devices (IMDs) from unauthorized access in both regular and emergency situations. The smartphone is used as a proxy to delegate the complex cryptographic computations for access control. Additionally, to prolong the lifetime of the resource-constrained IMDs, a modified compressive sensing technique will be used to reduce both the communication overheads and the computational overheads for data encryption between the IMD and the proxy. The ciphertext-policy attribute-based encryption (CP-ABE) will be employed to provide fine-grained access control over the qualifications of IMD programmer operator, usually the physician. The proposed access control schemes are fully automated and no patient participation is required. Currently, there are no common security standards or specifications available for IMD products to follow. The results of this project will prompt and guide the IMD industry to develop standards and specifications on the cybersecurity issues for commercial IMD products. This project will be conducted in collaboration with Temple University.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.