Solutions for Mitigating Cybersecurity Risks Caused by Legacy Software in Medical Devices: A Scoping Review

被引：16

作者：

Tervoort, Tom ^{[1
]}

De Oliveira, Marcela Tuler ^{[2
]}

Pieters, Wolter ^{[3
]}

Van Gelder, Pieter ^{[4
]}

Olabarriaga, Silvia Delgado ^{[2
]}

Marquering, Henk ^{[1
]}

机构：

[1] Univ Amsterdam, Dept Biomed Engn & Phys, Amsterdam UMC, NL-1105 Amsterdam, Netherlands

[2] Univ Amsterdam, Dept Epidemiol Biostat & Bioinformat, Amsterdam UMC, NL-1105 Amsterdam, Netherlands

[3] Delft Univ Technol, Dept Multiactor Syst, Fac Technol Policy & Management, NL-2600 Delft, Netherlands

[4] Delft Univ Technol, Fac Technol Policy & Management, Dept Values Technol & Innovat, NL-2600 Delft, Netherlands

来源：

IEEE ACCESS | 2020年 / 8卷

基金：

欧盟地平线“2020”;

关键词：

Healthcare; security; medical devices; legacy software; IMPLANTABLE CARDIAC DEFIBRILLATORS; INTRUSION DETECTION; SECURITY; SYSTEMS; ISSUES;

D O I：

10.1109/ACCESS.2020.2984376

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

Cyberattacks against healthcare institutions threaten patient care. The risk of being targeted by a damaging attack is increased when medical devices are used which rely on unmaintained legacy software that cannot be replaced and may have publicly known vulnerabilities. This review aims to provide insight into solutions presented in the literature that mitigate risks caused by legacy software on medical devices. We performed a scoping review by categorising and analysing the contributions of a selection of articles, taken from a literature set discovered through bidirectional citation searching. We found 18 solutions, each fitting at least one of the categories of intrusion detection and prevention, communication tunnelling or hardware protections. Approaches taken include proxying Bluetooth communication through smartphones, behaviour-specification based anomaly detection and authenticating signals based on physical characteristics. These solutions are applicable to various use-cases, ranging from securing pacemakers to medical sensor networks. Most of the solutions are based on intrusion detection and on tunnelling insecure wireless communications. These technologies have distinct application areas, and the decision which one is most appropriate will depend on the type of medical device.

引用

页码：84352 / 84361

页数：10

共 55 条

[21] Bidirectional Citation Searching to Completion: An Exploration of Literature Searching Methods [J].

Hinde, Sebastian ;

Spackman, Eldon .

PHARMACOECONOMICS, 2015, 33 (01) :5-11

[22] Cyber-Physical Systems Security-A Survey [J].

Humayed, Abdulmalik ;

Lin, Jingqiang ;

Li, Fengjun ;

Luo, Bo .

IEEE INTERNET OF THINGS JOURNAL, 2017, 4 (06) :1802-1831

[23]

Kulac S., 2018, P 11 IFIP WIR MOB NE, P3

[24] A New Externally Worn Proxy-Based Protector for Non-Secure Wireless Implantable Medical Devices: Security Jacket [J].

Kulac, Selman .

IEEE ACCESS, 2019, 7 :55358-55366

[25] Security Belt for Wireless Implantable Medical Devices [J].

Kulac, Selman .

JOURNAL OF MEDICAL SYSTEMS, 2017, 41 (11)

[26]

Kyaw AK, 2014, 2014 11TH ANNUAL HIGH CAPACITY OPTICAL NETWORKS AND EMERGING/ENABLING TECHNOLOGIES (PHOTONICS FOR ENERGY), P178, DOI 10.1109/HONET.2014.7029386

[27]

Li C., 2011, IEEE INT C E HLTH NE, P150, DOI 10.1109/HEALTH.2011.6026732

[28] Data-driven Anomaly Detection with Timing Features for Embedded Systems [J].

Lu, Sixing ;

Lysecky, Roman .

ACM TRANSACTIONS ON DESIGN AUTOMATION OF ELECTRONIC SYSTEMS, 2019, 24 (03)

[29]

Mancilla D., 2009, PERSPECT HLTH INF MA, V6, P1

[30] On the (in)security of the Latest Generation Implantable Cardiac Defibrillators and How to Secure Them [J].

Marin, Eduard ;

Singelee, Dave ;

Garcia, Flavio D. ;

Chothia, Tom ;

Willems, Rik ;

Preneel, Bart .

32ND ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE (ACSAC 2016), 2016, :226-236

← 1 2 3 4 5 6 →