Secure Connectivity for At-Home Healthcare— Part 1: Challenges Beyond the Clinic

質問:

Is encrypting patient data enough to guarantee secure connectivity in at-home healthcare?

回答:

Encryption is just one layer. Authentication, integrity checks, and secure firmware update are equally critical. If the source or integrity of data or updates isn’t verified, encryption alone can’t prevent the transmission of meaningless or malicious content. Secure connectivity means verifying who’s talking, what they’re saying, and ensuring it hasn’t been tampered with.

Introduction

Building on the foundation of secure authentication for medical disposables described in "Secure Authentication for Medical Disposables," this article explores the growing trend of shifting healthcare from hospitals to patients’ homes (Figure 1). It discusses the unique security challenges of providing healthcare outside a medical setting and the requirements for securing data during network transfer.

Growing Move to Guided Patient Self-Care

The trend toward guided patient self-care is gaining momentum, driven by technological innovations that empower patients to manage their health conditions from the comfort of their homes. Advanced tools such as wearable devices, mobile health apps, and telehealth platforms provide real-time health data and professional guidance, enabling patients to monitor their conditions and make informed decisions about their care. This shift toward self-care is not only about convenience but also about promoting sustainable healthcare practices. By allowing patients to maintain their independence and quality of life, guided self-care supports long-term health management and expands access to healthcare while simultaneously reducing the burden on healthcare facilities.

Increasing Regulatory and Quality Concerns

As at-home healthcare continues to expand, regulatory bodies like the FDA are implementing more stringent guidelines (FDA-2021-D-1158; Section 524B, HR 2617 Act of Congress; UL2900-2-1; and IEC62443) to ensure the safety and efficacy of medical devices used in home settings. These regulations are crucial for protecting patients and maintaining high standards of care. New devices, as well as modifications to existing ones, must now include detailed cybersecurity plans to address potential vulnerabilities and protect sensitive health data. This increased focus on regulatory compliance and quality assurance is essential for building trust in at-home healthcare solutions and ensuring that patients receive safe, reliable, and effective care.

Typical Workflow for At-Home Healthcare

1. Initial Evaluation and Device Programming: The process of at-home healthcare often begins with an initial visit to a hospital or clinic, where the patient meets with a clinician for a comprehensive evaluation (Figure 2). During this visit, the clinician assesses the patient’s condition and determines the appropriate treatment plan. The clinician then programs the medical device with settings tailored to the patient’s specific needs. Once configured, the patient receives detailed instructions on using the device effectively at home.
2. Start of Home Treatment: Upon returning home, patients begin their treatment by following the clinician’s instructions and using the medical device as prescribed. This period is critical for patients to become accustomed to the device and integrate it into their daily routine. Features like reminders, alerts, and user-friendly interfaces assist patients in adhering to their treatment plan, promoting independence and improving health outcomes.
3. Patient Data Upload: A key component of at-home healthcare is the continuous monitoring and transmission of patient data. This data can include vital signs, medication adherence, and other relevant health metrics. For example, daily activity tracking could be automatically uploaded to a local network when the device is attached to its charger while the patient sleeps, the device could send data only when a specific event occurs (for example, if a user error or adverse event is detected), or perhaps the data transfer relies on the patient manually inserting values into a mobile application. The seamless transfer of information ensures that the clinician has access to up-to-date data, enabling timely interventions and adjustments to the treatment plan if necessary.
4. Clinician Reviews Data: After a designated period, the clinician reviews the data collected by the medical device. This comprehensive analysis allows the clinician to assess the patient’s progress and determine whether any changes to the treatment plan are needed. The clinician’s review is informed by the detailed data provided by the device, offering a more accurate picture of the patient’s health status compared to traditional periodic check-ups. This proactive approach helps in identifying potential issues early and adjusting the treatment plan to better meet the patient’s needs.
5. Clinician Sends Update: If the clinician decides that adjustments are necessary, the settings can be remotely updated on the medical device. These changes in treatment could be adjusting a key sensing parameter such as the gain of a pressure sensor or changing the frequency of drug administration or therapy delivery. This usually manifests in the form of a new version of firmware that needs to be securely uploaded to the medical device in the patient’s home. This update is sent securely to the device, ensuring that the patient receives the most current and effective treatment. The ability to make remote adjustments is a significant advantage of modern at-home healthcare systems, reducing the need for frequent in-person visits and allowing for more flexible and responsive care.
6. Device Updates Firmware: Once the clinician sends an update, the medical device typically connects to the network to receive and install the firmware update. This process is typically automated, minimizing the need for patient intervention and ensuring that the device operates with the latest settings and security protocols. Once the update is complete, the patient continues to use the device as part of ongoing treatment. This cycle of data collection, review, and adjustment continues, creating a dynamic and responsive healthcare environment that adapts to the patient’s evolving needs.

Security Challenges in Home Healthcare

Ensuring the security of patient data and medical devices presents significant challenges. The reliance on digital platforms and connected devices exposes sensitive health information to potential cyber threats, including data breaches and unauthorized access. Addressing these security challenges is crucial to maintaining patient trust, ensuring compliance with healthcare regulations and protecting the integrity of at-home healthcare services. Security challenges unique to each step of the typical at-home healthcare workflow are described in the next section (Figure 3).

1. Initial Evaluation and Device Programming: During the initial clinic visit and the start of home treatment, several security concerns must be addressed. One critical aspect is secure boot, which ensures that the device only runs trusted software at startup. This prevents malicious software from being loaded, which could compromise the device’s functionality and patient safety. Additionally, secure data storage is essential to protect against unauthorized access and tampering. This involves encrypting data stored on the device and implementing robust access controls to ensure that only authorized personnel can modify the device settings. Finally, the integrity of the firmware parameters must be guaranteed. For example, ensuring that a dosage setting of 10 mL/hr is not erroneously changed to 100 mL/hr is crucial for patient safety. This can be achieved through cryptographic checksums and digital signatures that verify the authenticity and integrity of the firmware.
2. Patient Data Upload and Transfer: When patient data is uploaded from the medical device to the clinician, several security measures are necessary to protect the data during transmission. Authenticity is a primary concern, ensuring that the data received by the clinician is indeed from the correct patient. This can be achieved through unique patient identifiers and secure authentication protocols. Integrity is also critical, as it ensures that the data has not been altered during transmission. Techniques such as hashing and digital signatures can be used to verify that the data remains unchanged. Clinicians rely on accurate and reliable data to assess a patient’s condition and adjust treatment plans accordingly. If the data is corrupted, it can lead to incorrect assessments. For example, a corrupted data point might falsely indicate that a patient’s blood pressure is stable when it is dangerously high. Finally, ensuring confidentiality is paramount to protect sensitive patient information while it is in transit. This involves safeguarding this data from unauthorized access and ensuring that it remains private while in transit. This can be achieved through secure communication protocols like transport layer security (TLS) and virtual private networks (VPNs), which encrypt the data being transmitted. Additionally, implementing strict access controls and authentication mechanisms ensures that only authorized personnel can access patient information.
3. Firmware Updates: When the clinician sends an update to the medical device, it is essential to ensure that the update process is secure. Unauthorized access or updates can allow an intruder to alter the behavior of medical devices or, in the worst-case scenario, take complete control of them. One common attack method is malware injection, where malicious code is inserted into the firmware update. If an attacker successfully installs fraudulent firmware, it can lead to severe consequences. For instance, the compromised device might start transmitting confidential and sensitive data, such as private medical information from a portable health monitor, without authorization. In a broader context, malicious firmware could expose encryption keys to the public, undermining the security of the entire system. Additionally, the device could be forced to operate incorrectly, posing significant risks to patient safety and data integrity. Therefore, authenticity of the new firmware must be verified to confirm that it comes from a trusted source. This can be achieved through digital signatures and certificates that authenticate the source of the firmware. Just like when the medical device is first setup in the clinic, the integrity of the firmware update is crucial to ensure that all parameters are accurate and have not been tampered with. Cryptographic checksums and integrity checks can be used to verify the firmware’s integrity. Finally, confidentiality must be maintained during the transmission of the firmware update to protect sensitive data. Encrypting the firmware update ensures that it cannot be intercepted and accessed by unauthorized parties.

How the MAXQ1065 Addresses These Security Concerns

The MAXQ1065 is a security coprocessor that provides turnkey cryptographic functions for root-of-trust, mutual authentication, data confidentiality and integrity, secure boot, secure firmware updates, and secure communications (Figure 4). Key features are included in Table 1.

Table 1. MAXQ1065 Features

Secure Boot and Firmware Updates

The fundamental principle of a secure firmware download based on asymmetric cryptography involves the use of a private key for signing by the firmware developer, and a corresponding public key for verification that is stored on the medical device. This method, particularly when using elliptic curve digital signature algorithm (ECDSA), ensures that an attacker cannot retrieve the private key used for signing the firmware and data, even with sophisticated invasive attacks. The only information an attacker can obtain from the medical device is the public key; and with ECDSA, it is mathematically infeasible to derive the private key from the public key.

When firmware needs to be executed by the medical device’s microcontroller, the host MCU boot manager first retrieves it and delivers it to the MAXQ1065 for SHA-256 hash computation (Figure 5). After the SHA-256 hash computation is completed, the processor provides the ECDSA signature of the firmware or data, which was computed during the development phase and appended to the file. The main processor then sends the firmware or data file and its expected digital signature. The security coprocessor verifies the signature and returns the result, indicating if it is successfully verified or if there was an error. If the signature verification is successful, the firmware can be executed.

A more in-depth explanation of this process can be found at the following article, "The Fundamentals of Secure Boot and Secure Download: How to Protect Firmware and Data Within Embedded Devices."

Secure Storage and Tamper Detection: The MAXQ1065 includes tamper detection features to identify and respond to physical tampering attempts. This adds an extra layer of security, ensuring that the device remains trustworthy even in the face of potential intrusions. ADI’s ChipDNA^® embedded security physically unclonable function (PUF) technology provides an exponential increase in protection against the invasive and reverse engineering attacks that hackers use. Attempts to probe or observe ChipDNA operation modify the underlying circuit characteristics, preventing the discovery of the unique value used by the chip cryptographic functions. Similarly, more exhaustive reverse-engineering attempts are defeated due to the factory conditioning required to make the ChipDNA PUF circuitry operational. The per-device unique key is generated by the ChipDNA PUF circuitry only when needed for cryptographic operations and is then instantaneously deleted.

Transport Layer Security (TLS) Protection: The MAXQ1065 supports TLS/DTLS 1.2 protocols for secure data transmission, ensuring data confidentiality and integrity. This is crucial for at-home healthcare devices that need to communicate patient data to healthcare providers or cloud-based systems.

In this scenario, a medical device at the patient’s home uses TLS for secure communication with a cloud server. TLS has two phases: the handshake and secure communication. Secure ICs like the MAXQ1065 enhance TLS by storing certificate authority (CA) root certificates in nonvolatile memory, ensuring only authenticated administrators can replace them. The handshake phase involves negotiating security settings and establishing shared keys, while the secure communication phase uses these keys for encryption and authentication. Implementing TLS on embedded devices can be complex, with risks like skipping certificate verification or using weak cipher suites. The MAXQ1065 provides hardware-based protections, preventing unauthorized access and ensuring the integrity of TLS processes. It defends against attacks like man-in-the-middle and session key exposure, maintaining the confidentiality and integrity of healthcare data without compromising device performance.

Additionally, this cryptographic controller allows device manufacturers to establish their own CA for connected devices, securely storing root public keys and preventing unauthorized modifications. ChipDNA technology further secures the private key by making it a byproduct of the IC’s normal physical manufacturing distribution, making it resistant to hacking and reverse engineering.

For an in depth overview on using secure companion ICs to protect TLS implementations, please refer to the article “Using Secure Companion ICs to Protect a TLS Implementation.”

Conclusion

As the demand for at-home healthcare solutions continues to grow, the need for secure and reliable medical devices becomes increasingly important. ADI’s MAXQ1065 cryptographic controller addresses these needs with its advanced security features, low power consumption, and ease of integration. By incorporating this coprocessor into at-home healthcare devices, manufacturers can ensure that patient data remains secure and that devices perform reliably over the long term.

著者

Jackson Coole

Jackson Coole is a systems applications engineer with Analog Devices working in the Medical Instrumentation Team. He holds a bachelor’s degree in biomedical engineering from Mississippi State University and a doctoral degree in biomedical engineering from Rice University. He has experience in optical and hardware design for in vitro diagnostics and in vivo clinical imaging systems, and software design through development of clinical graphical user interfaces.

Michael Haight

Michael Haight is a director of product line management at Analog Devices where he is responsible for embedded HW-based security products. Originally coming from an IC design background, Michael has over 25 years of experience at ADI serving in various additional roles including new product definition, applications team management, and currently product line management. Prior to joining ADI, he held an IC design position at a defense contractor. Michael earned his B.S.E.E. with honors from the University of Florida.