Can Formal Security Verification Really Be Optional? Scrutinizing the Security of IMD Authentication Protocols

Abstract

The need for continuous monitoring of physiological information of critical organs of the human body, combined with the ever-growing field of electronics and sensor technologies and the vast opportunities brought by 5G connectivity, have made implantable medical devices (IMDs) the most necessitated devices in the health arena. IMDs are very sensitive since they are implanted in the human body, and the patients depend on them for the proper functioning of their vital organs. Simultaneously, they are intrinsically vulnerable to several attacks mainly due to their resource limitations and the wireless channel utilized for data transmission. Hence, failing to secure them would put the patient’s life in jeopardy and damage the reputations of the manufacturers. To date, various researchers have proposed different countermeasures to keep the confidentiality, integrity, and availability of IMD systems with privacy and safety specifications. Despite the appreciated efforts made by the research community, there are issues with these proposed solutions. Principally, there are at least three critical problems. (1) Inadequate essential capabilities (such as emergency authentication, key update mechanism, anonymity, and adaptability); (2) heavy computational and communication overheads; and (3) lack of rigorous formal security verification. Motivated by this, we have thoroughly analyzed the current IMD authentication protocols by utilizing two formal approaches: the Burrows–Abadi–Needham logic (BAN logic) and the Automated Validation of Internet Security Protocols and Applications (AVISPA). In addition, we compared these schemes against their security strengths, computational overheads, latency, and other vital features, such as emergency authentications, key update mechanisms, and adaptabilities.

Efficient palm vein authentication encryption technique in wireless implantable medical devices

“…Because of their size and location, these IMD have limited resources, including power, memory, and processing speed, that must be included in any proposed security measures. Zero watermarking approaches [23] This ID is a meaningless piece of paper devoid of personal or identifying information about the owner.…”

“…Mishra et al [21] comes with a lossless model for the identification of biometric images for the generation of unique digital code [22]. Although the admirable attempts created by the academic communities, there were still problems that need to be solved, including insufficient fundamental capabilities, higher communications and computational overheads, and formal lag in security verifications [23]. Dorsal hand vein (DHV) biometrics, one of the newest biometrics technologies, has drawn a lot of attention lately [24].…”