Cyber physical security solutions for pervasive health monitoring systems

With a rapidly aging population, the healthcare community will soon face severe medical personnel shortage and rising costs. Pervasive Health Monitoring Systems (PHMS) can help alleviate this situation. PHMS provides continuous real-time monitoring of a person's health using a (usually wireless) network of medical and ambient sensors/devices on the host (patients), called Body Area Networks (BANs). The sensitive nature of health information collected by PHMS mandates that patient's privacy be protected by securing the medical data from any unauthorized access. The authors' approach for addressing these issues focuses on a key observation that PHMS are cyber-physical systems (CPS). Cyber-physical systems are networked, computational platforms, deeply embedded in specific physical processes for monitoring and actuation purposes. In this work, they therefore present a novel perspective on securing PHMS, called Cyber Physical Security (CYPSec) solutions. CYPSec solutions are environmentally-coupled security solutions, which operate by combining traditional security primitives along with environmental features. Its use results in not only secure operation of a system but also the emergence of additional "allied" properties which enhance its overall capabilities. The principal focus of this chapter is the development of a new security approach for PHMS called CYPsec that leverages their cyber-physical nature. The authors illustrate the design issues and principals of CYPSec through two specific examples of this generic approach: (a) Physiological Signal based key Agreement (PSKA) is designed to enable automated key agreement between sensors in the BAN based on physiological signals from the body; and (b) Criticality Aware Access Control (CAAC) which has the ability to provide controlled opening of the system for emergency management. Further, they also discuss aspects such as altered threat-model, increased complexity, non-determinism, and mixed critical systems, that must be addressed to make CYPSec a reality.