Increasingly, medical devices such as insulin pumps or pacemakers can be read or set by patients via an external device. This connectivity offers great convenience, but also poses security risks. If a malicious person manages to connect to the medical device and manipulate its operation, this can create dangerous and even life-threatening situations. A new communication method developed by Purdue University makes this connection significantly more secure.
Many medical devices communicate with external devices, such as smartwatches, remote monitors or smartphones, using radio frequency radiation or Bluetooth. These signals are relatively strong, allowing them to be picked up even metres away from the patient. This gives malicious parties the opportunity to intercept this signal, which poses great risks.
Security breach in pacemakers
In 2017, for instance, doctors and patients were startled by a security breach in pacemakers made by the company Abbott, which previously operated under the name St. Jude Medical. This leak allowed unauthorised people to remotely adjust settings on the pacemakers, which, among other things, allowed the battery to run down quickly. If the battery runs out, the device cannot deliver life-saving shocks, the US Food and Drug Administration warned.
In August 2016, security problems were also discovered in the company's pacemakers and defibrillators. The problem then was in the communication between these devices and the associated monitoring system. This communication was not encrypted, allowing malicious persons who managed to get their hands on such a monitoring system to connect to third-party implants. These monitoring systems are relatively easy to obtain via the internet, among others.
Abbott is not the only manufacturer with medical devices in which security problems have been discovered. For example, US-based Johnson & Johnson warned customers in 2016 about a security problem in an insulin pump, where falsified radio frequency signals could be sent to the pump to control it. If exploited, this leak would allow an overdose of insulin to be delivered. In 2011, a similar leak was discovered in insulin pumps made by the company Medtronic.
Communication via body fluids
Researchers at Purdue University have developed a communication method that can virtually eliminate such security problems. By sending signals through bodily fluids, the signal can be captured at most one centimetre away from the skin. This makes intercepting the signal and breaking into the connection with the implant significantly more difficult.
An important added benefit is that the communication method is significantly more energy efficient. The researchers claim that communication via body fluids requires 100 times less energy than traditional Bluetooth communication. This lower energy consumption means that the battery in an implant lasts longer.
"We are connecting more and more devices to the human body network, from smartwatches and fitness trackers to virtual reality headsets," says Shreyas Sen, assistant professor of electrical engineering and computer science at Purdue University. "The challenge is not only to keep these communications within the human body so that they cannot be intercepted, but also to achieve higher bandwidth and lower energy consumption." Sen developed the new communication method with students Debayan Das, Shovan Maity and Baibhab Chatterjee.
Signal capture
The signal can be picked up at any location on the human body. The thickness of the skin or the presence of hair has little impact on the signal strength, according to the researchers. To capture the signal, the researchers developed a prototype smartwatch.
Researchers see all kinds of possibilities for their new development. For example, the communication method could be used to let doctors reprogram medical implants without having to operate on the patient. The technology could also be used for 'bioelectronic medication', using a wearable or implantable device as a drug without side effects.
More information on the technology can be found at Nature Scientific Reports.
Author: Wouter Hoeffnagel
Source: Purdue University
Source: FDA
