Implantable Medical Devices: Security and Privacy for Pervasive, Wireless Healthcare

Kevin Fu

Kevin Fu, Assistant Professor, University of Massachusetts, Amherst
Wednesday, April 7, 2010

Abstract

An incredible array of implantable medical devices treat chronic ailments such as cardiac arrhythmia, diabetes, Parkinson's disease, seizures, and even obesity with various combinations of electrical therapy and drug infusion. These devices use tiny embedded computers to control therapies and collect physiological data. To improve patient care and detect early warning signs, implantable medical devices are rapidly embracing wireless communication and Internet connectivity. Implantable cardioverter defibrillators (ICDs) are wirelessly reprogrammable and relay medical telemetry over the Internet via at-home monitors. Such devices will vastly improve care for chronic disease, but will also introduce fundamentally new risks because of global computing infrastructures such as the Internet that are physically infeasible to secure. Thus, new devices must not only prevent accidental malfunctions, but must also prevent *intentional* malfunctions caused by malicious parties lurking on the network.

Our interdisciplinary research team implemented several software radio-based methods that could compromise patient safety and patient privacy (e.g., disclosing patient data or inducing ventricular fibrillation via a wireless command). Addressing these new risks, our zero-power approaches help to mitigate the risk of intentional malfunctions.

This work is joint with researchers from the University of Massachusetts Amherst, the University of Washington, and the Harvard Medical School.

Bio

Kevin Fu is an assistant professor in the Department of Computer Science at the University of Massachusetts Amherst in the beautiful northeastern region of the United States. Prof. Fu investigates how to ensure the security and privacy of pervasive devices that must withstand determined, malicious parties. To this end, Prof. Fu works on energy-aware cryptography and compiler techniques to run secure software on computational RFIDs---tiny embedded computers that operate without batteries. A computational RFID serves as a modular platform to test improvements in the security and privacy of medical devices. Prof. Fu's contributions include the security analysis of several systems ranging from contactless no-swipe credit cards and implantable cardiac defibrillators to access-controlled Web sites and automated software updates.

Kevin is an Alfred P. Sloan Research Fellow, MIT Technology Review TR35 Innovator of the Year, and recipient of the NSF CAREER award. His research appears in computer science conferences, medical journals, and has been featured in media such as The New York Times, The Wall Street Journal, and various news programs. He served on numerous program committees of leading conferences in secure systems, and has given dozens of invited talks world-wide to industry, government, and academia.

Prof. Fu leads the UMass Amherst Security and Privacy Research (SPQR) lab. He serves as director of the RFID Consortium on Security and Privacy (RFID-CUSP.org) and co-director of the Medical Device Security Center. Prof. Fu received his Ph.D. in Electrical Engineering and Computer Science from the Massachusetts Institute of Technology. He also holds a certificate of achievement in artisanal bread making from the French Culinary Institute and maintains an active participation in the study of Latin and the Classics. For more information, visit http://www.cs.umass.edu/~kevinfu/

• Presentation Slides