Attack-tree-based Threat Modeling of Medical Implants

Abstract

Modern Implantable Medical Devices (IMDs) are low-power embedded systems with life-critical functionalities. Almost all of these devices are equipped with wireless- communication capabilities in order to aid in diagnosis, in updating the functional settings and firmware and so on, without any surgical procedure to perform these tasks manually. There is, thus, a rising trend towards increased connectivity of these devices. The down- side of this trend is, however, a proportional increase in the attack surface that can be exploited by a malicious entity. In effect, threat modeling of IMDs becomes ever more important. This is reflected by an increase in the number of vulnerabilities being found consistently in the IMDs available in market. This paper proposes a threat-modeling analysis based on attack trees to evaluate the security of these devices. As an example, three recent lightweight IMD security protocols from literature are analyzed using this approach to demonstrate its effectiveness in suggesting security improvements.

Towards realistic battery-DoS protection of implantable medical devices

“…ZPD schemes primarily address Availability from the CIANA security services [37]: Confidentiality, Integrity, Authentication, Nonrepudiation and Availability. Ensuring the first four services can have an indirect impact on Availability.…”

“…Any ZPD scheme shall ensure that only the entity in close proximity to the patient for a prolonged period of time is allowed to access the IMD. This touch-to-access principle assumes that it is infeasible for the attacker to get in close proximity since the patient would reject physical contact with untrusted entities [34,37].…”

“…The typical operational lifetime of these battery-powered devices is around a decade or so while implanted in the patient's body. Almost all of these devices are equipped with wireless connectivity via a transceiver in order to support and complement their treatment capabilities [37]. They can communicate with an external reader (see Figure 1) for e.g.…”

“…Consequently, the IMD will run part of an energy-consuming authentication protocol for analyzing every request, which will drain the battery. As indicated in the IMD-threat-modeling analysis in [37], battery DoS is one of the easiest to mount and highly effective attacks. This is also backed by the majority of the IMD-specificethical-hacking efforts in which the batteries of commercial IMDs were depleted using black-box approaches [12,25].…”

Zero-Power Defense Done Right: Shielding IMDs from Battery-Depletion Attacks

“…One such attack is the battery-depletion (or battery-DoS) attack where the attacker can force the IMD to continuously run an energy-consuming operation, which ultimately results in power loss and IMD shutdown. As indicated in an exhaustive IMD-threat-modeling analysis in [47], battery DoS is one of the easiest to mount and highly effective attacks. This is also backed by the majority of the ethical-hacking efforts in which the batteries of commercial IMDs were depleted using black-box approaches [16,32].…”