Implantable Medical Devices : Device security and emergency access

Implantable Medical Devices (IMDs) are battery-powered devices that are implanted in the human body and which employ local (electric) stimulation to treat a wide range of medical conditions. IMDs have, for example, been used to suppress chronic pain through spinal cord stimulation or to regulate cardiac contractions using artificial pacemakers. Modern IMDs are commonly equipped with a wireless transceiver that facilitates wireless data exchange with an external (handheld) device. This wireless connectivity can, among others, be used to improve the longevity of an IMD through software maintenance, facilitates long-term patient monitoring and enables the customization of a patient's treatment to his or her needs. By simply adding wireless connectivity to an IMD, however, it also becomes possible for malicious entities to abuse this connectivity by, for example, stealing private patient data or, worse, halt treatment. It is, therefore, essential that the communication with an IMD is secured, commonly facilitated by secret keys that are only known to trusted entities. That is, anyone who does not own a secret key cannot communicate with the IMD. There are, however, situations in which a previously untrusted entity should have access to an IMD, as patient safety outweighs device security. For example, paramedics likely do not have access to a secret key for security reasons, yet, should always be able to access an IMD in case of emergency to expedite their diagnosis. In this thesis, I first discuss a novel seizure-detection algorithm that may be used by IMDs for the treatment of epilepsy and describe how such an IMD could benefit from wireless data exchange. I subsequently discuss how we secure an IMD assuming that trusted entities have access to a secret key, based on a heterogeneous system-on-chip architecture and a lightweight security protocol. Finally, I describe how we facilitate emergency access without compromising device security using dynamic cardiac biometrics (person- and time-unique biometric identifiers that are derived from the patient's own heartbeats) to generate a non-usable, entity-bound security key.