Security and Privacy for Implantable Medical Devices

Glucose control is the cornerstone of diabetes mellitus (DM) treatment. Although self-monitoring of blood glucose (SMBG) still remains the best procedure in clinical practise, continuous glucose monitoring systems (CGMSs) provide a dynamic assessment of shifting blood glucose concentrations and facilitate the making of optimal treatment decisions for the diabetic patient. As such, CGM systems could contribute to a paradigm shift in the management of glycaemic control, making insulin administration more personalised. Such an approach makes it possible to narrow the daily glucose fluctuations in blood whilst decreasing the incidence of hypoglycaemic phenomena. This aspect is of paramount importance because improved glycaemic control has been shown to be beneficial to patients – and to the healthcare industry– by reducing the frequency and severity of associated complications [55]. Moreover, tight glycaemic control (TGC) in acutely ill hospitalised patients significantly improves both mortality and morbidity but requires frequent (often hourly) and accurate glucose testing [32, 33]. To meet the specific needs of intensive care units ICUs, specifically designed glucose hospital meters are already commercially available whilst a new generation of intravascular CGM systems is presently under development and clinical testing.

Wireless potentiostats are being developed and commercialized for use in the development of implantable electrochemical biosensors for the monitoring of physiological markers in a wide range of pathologies. The merits and drawbacks of the Pinnacle Technology 8151 dual potentiostat are investigated for use with a novel implantable biotransducer, the dual responsive MDEA 5037 of ABTECH Scientific. In a laboratory setting, the 8151 potentiostat maintained a steady and unbroken signal as far away as 75 ft (23 m) and, when unobstructed, up to 100 ft (30 m). The percentage error between the two channels was determined to be 6.4 (±0.3) and 0.7 (±0.1) for resistor-capacitor dummy cells (RC = 10 MΩ and 1 μF) and resistor dummy cells (R = 10 MΩ), respectively. The intrachannel variability may be too large for exacting analyte determinations.

Modern medicine is now facing a new challenge: personalizing the cures supplied to patients. This challenge relates to the main problem encountered in the past of low cure efficacy when providing pharmacological therapy to patients [1]. As schematically shown in Fig. 4.1, when a group of patients that have exactly the same disease is treated with exactly the same pharmacological compound (or a set of compounds), the result is usually four different types of patient responses: the best subgroup benefits from the cure with no toxic reaction; the second group benefits from the therapy but also experiences toxic reactions; the third subgroup experiences neither benefits nor toxic reactions; the fourth subgroup receives no benefit but, what is more, experiences severe toxic reactions.

Since ancient times, we human beings have dreamed of creating our own tissue and organ substitutes. The oldest version of the dream dates back to the Bible, where it is mentioned that God took a rib from Adam to create Eve. More than 2000 years past, what is still preventing us from making this dream come true.

The book takes a significant turn at this point, moving from Part I, which involves the design of novel biosensors, to Part II, which shows the design of secure implantable medical devices. Key threads that cross between the two sections (Fig. 6.1) are:

Implantable medical devices (IMDs) are increasingly being used to improve patients’ medical outcomes. Designers of IMDs already balance safety, reliability, complexity, power consumption, and cost. However, recent research has demonstrated that designers should also consider security and data privacy to protect patients from acts of theft or malice, especially as medical technology becomes increasingly connected to other systems via wireless communications or the Internet. This survey paper summarizes recent work on IMD security. It discusses sound security principles to follow and common security pitfalls to avoid. As trends in power efficiency, sensing, wireless systems, and biointerfaces make possible new and improved IMDs, they also underscore the importance of understanding and addressing security and privacy concerns in an increasingly connected world.

Wearable and implantable medical devices are being increasingly deployed to improve diagnosis, monitoring, and therapy for a range of medical conditions.

In summary, this short book has provided a brief introduction to the new research area of security and privacy in the field of implantable medical devices (IMDs) by presenting two sides of the problem, namely, IMDs and embedded security. The book has four chapters written by international leaders in the field of implantable medical devices. These chapters introduce the latest advances and research problems in the area of IMDs. The first chapter is from an industry leader in the field of implantable devices for continuous glucose monitoring. Their subcutaneous system for glucose sampling is described in the chapter and the whole monitoring system is presented, including a palm device that wirelessly connects the sensors. This provides the first clear example in the book of a system that is already on the market and that presents a potential vulnerability for malicious attacks (the wireless connection between the handheld reader of the physician and the sensory device wore by the patient). The next two chapters are from scientists in two leading academic institutions (one in the United States and the other in Europe). These chapters present more advanced research results from the scientific literature concerning the monitoring of several metabolites (molecules related to metabolic states) for different applications in both unhealthy and healthy patients. These chapters show two different systems, recently published in the literature, that contain more than one sensor and that, therefore, could monitor several metabolites simultaneously. In both cases, the sensory device is a subcutaneous implant that is remotely connected with a device located externally with respect to the body. Therefore, a potential eavesdropping or impersonation vulnerability arises again, although reduced due to the short-range communication. The removability of the external device raises authentication and privacy concerns. The last chapter dedicated to implantable medical devices focuses on a new approach that is currently under development in regenerative medicine: the possibility of inserting in the body a bioreactor that might regenerate damaged tissue directly in the body region of interest. Of course, the future development of this extremely fascinating approach to regenerating human organs foresees the introduction of sensors and actuators that allow a deeper and closer control of bioreactors. Again, remote sensing and control of a bioreactor requires a reliable and secure channel for data communication and operation commands. Hopefully these four examples provide a background on the possibilities of IMDs, as well as the potential vulnerabilities and motivations for a malicious attack.