Lead Institution: University of South Florida (formerly University of Tennessee)

Project Leader: Nathanael Paul

Research Progress

• Abstract
  During the last decade, portable insulin infusion pumps have increased functionality to help patients maintain good glucose control, but these features have also increased device complexity. This complexity makes it difficult to understand a system’s operation, and it makes the detection and prevention of malicious actions against the patient more difficult. When a system event occurs (e.g., an insulin bolus), the system may not provide enough forensic information to reason about a particular event being benign or harmless. In this project, we focus on building a system that provides additional information for system forensics. Patients, manufacturers, and caregivers can use these events to identify malicious events in a system.

• Focus of the research/Market need for this project
  This research focused on providing forensic data to detect and prevent malicious actions against patients wearing an implantable medical device. According to a recent study by the American Diabetes Association (see http://www.diabetes.org/advocacy/news-events/cost-of-diabetes.html), approximately 20% of the health care costs in the U.S. are attributable to diabetes, our prototype demonstration system is for an insulin pump. No current insulin pump system or artificial pancreas provides the capability to forensically determine if a system event is or was malicious.

• Project Aims/Goals
  Our goal is to show the feasibility of creating a system that provides detailed data that would allow one to forensically determine if a given diabetes system event is malicious.

• Key Conclusions/Significant Findings/Milestones reached/Deliverables

  • Summary and Deliverables: In our earlier work, we assessed current and near-future diabetes device security. As part of our findings, we better understood the absence of forensic data, and we refined our work to provide this needed data. We specifically identified the use of bowel sounds, and we received positive feedback for its application in glucose control from researchers, patients, and manufacturers. We built a system prototype to demonstrate using bowel sound data to provide forensic security data, and we have produced publications about this work. We are now preparing an additional publication for submission this summer.

  • Significant Impact: In December 2012, during a phone call with one of the world’s largest medical device manufacturers, they disclosed that they had recently changed their product design in their electronic diabetes therapy systems because of our SHARPS research and publications.

  • Significant Finding: Our current system prototype can detect a patient’s eating within 5-10 minutes from the start of eating. This not only has application in forensic data (by evaluating an insulin bolus), but it potentially enables greater functionality in the artificial pancreas.

• Materials Available for Other Investigators/interested parties
  We have publicly made our papers assessable at: http://www.cse.usf.edu/~pauln/papers/

• Market entry strategies
  Our results are positive, and our next steps are to collect more forensic data and broaden our system testing. We are working with Dexcom (an insulin pump sensor company) to do these steps, and we will be presenting our work to them at the end of this month. In parallel, we have a new partnership with BAE where we are evaluating a research project that will implement our work on a new secure hardware/software platform that was a result of a DARPA project (CRASH).

Bibliography
Using Bowel Sounds to Create a Forensically-aware Insulin Pump System
Nathan Henry, Nathanael Paul, and Nicole McFarlane
USENIX Workshop on Health Information Technologies, August 2013

Security Risks, Low-tech User Interfaces, and Implantable Medical Devices: A Case Study with Insulin Pump Infusion Systems
Nathanael Paul, and Tadayoshi Kohno
3rd USENIX Workshop on Health Security and Privacy (HealthSec ’12), August 6-7, 2012

A Review of the Security of Insulin Pump Infusion Systems
Nathanael Paul, Tadayoshi Kohno, and David C. Klonoff
Journal of Diabetes Science and Technology, 2011