Computer System Security and Medical Devices Kevin Fu kevinfu@cs.umass.edu Department of Computer Science University of Massachusetts at Amherst, USA http://prisms.cs.umass.edu/ October 27, 2006 Computer Science 1
What’s special about security? Computer Science 2
Correctness is easy. Security is hard. Kevin Fu, Computer System Security Computer Science 3
Research in System Security ‣ Design, build, measure secure systems ‣ Analyze existing systems Kevin Fu, Computer System Security Computer Science 4
RFID Security & Privacy 5
RFID tags • Originally simple UPC replacement • Now are miniature, low-power computers • Applications ‣ e-commerce ‣ public transportation ‣ anti-counterfeiting medicine ‣ medical applications Kevin Fu, Computer System Security Computer Science 6
RFID tags will be everywhere … Wig model #4456 Replacement hip (cheap polyester) medical part #459382 Das Kapital and Communist-party handbook 500 Euros in wallet Serial numbers: 597387,389473… 30 items of lingerie Credit: Ari Juels Kevin Fu, Computer System Security Computer Science 7
Credit: MGH 8
Hospital Bracelet? 9
Prevent tag duplication • Don’t copy my car key! • How to prevent reverse-engineering? • Side channel analysis? Kevin Fu, Computer System Security Computer Science 10
Secure RFID Kevin Fu, Computer System Security Computer Science 11
Contactless Credit Cards Insecure? Kevin Fu, Computer System Security Computer Science 12
Privacy for Public Transit Kevin Fu, Computer System Security Computer Science 13
Secure Software Updates 14
15
Survey of Update Security Kevin Fu, Computer System Security Computer Science 16
http://www.cs.umass.edu/~kevinfu/secureupdates/ 17
http://www.soultek.com/clean_energy/hybrid_cars/toyota_prius_hybrid_car_shut_down_or_stall_problems.htm Automotive Updates 18
Updates in Voting Machines http://www.nytimes.com/2006/05/12/us/12vote.html?ex=1305086400&en=1b3554af6e2d524a&ei=5088&partner=rssnyt&emc=rss 19
Implanted medical devices use updates too What stops a computer viruses from infecting implants? A common wireless command on an ICD induces ventricular fibrillation. How is it authenticated? 20
Embedded Medical Software 21
Discussion • Technical ‣ What are the threat models for wirelessly reprogrammable medical implants? ‣ How to balance safety, privacy, security? • Philosophical ‣ What is the role of FDA for future implanted medical devices? ‣ Biggest challenges for next-generation implanted devices? Kevin Fu, Computer System Security Computer Science 22
System Security at UMass Amherst and affiliates Faculty Graduate Students www.rfid-cusp.org Kevin Fu, Computer System Security Computer Science 23
Computer Science at UMass/Amherst http://www.cs.umass.edu 43 faculty, ~230 graduate students, ~300 undergraduate students Computer Science 24
Recommend
More recommend