Implantable and wear­able med­ical devices are used for mon­i­tor­ing, diag­no­sis, and treat­ment of an ever-increas­ing range of med­ical con­di­tions, lead­ing to an improved qual­i­ty of life for patients. The addi­tion of wire­less con­nec­tiv­i­ty to med­ical devices has enabled post-deploy­ment tun­ing of ther­a­py and access to device data vir­tu­al­ly any­time and any­where but, at the same time, has led to the emer­gence of secu­ri­ty attacks as a crit­i­cal con­cern. While cryp­tog­ra­phy and secure com­mu­ni­ca­tion pro­to­cols may be used to address most known attacks, the lack of a viable secure con­nec­tion estab­lish­ment and key exchange mech­a­nism is a fun­da­men­tal chal­lenge that needs to be addressed. We pro­pose a vibra­tion-based secure side chan­nel between an exter­nal device (med­ical pro­gram­mer or smart­phone) and a med­ical device. Vibra­tion is an intrin­si­cal­ly short-range, user-per­cep­ti­ble chan­nel that is suit­able for real­iz­ing phys­i­cal­ly secure com­mu­ni­ca­tion at low ener­gy and size/weight over­heads. We iden­ti­fy and address key chal­lenges asso­ci­at­ed with the vibra­tion chan­nel, and pro­pose a vibra­tion-based wake­up and key exchange scheme, named Secure­Vibe, that is resis­tant to bat­tery drain attacks. We ana­lyze the risk of acoustic eaves­drop­ping attacks and pro­pose an acoustic mask­ing coun­ter­mea­sure. We demon­strate and eval­u­ate vibra­tion-based wake­up and key exchange between a smart­phone and a pro­to­type med­ical device in the con­text of a real­is­tic human body model.

• RESEARCH PUBLICATION