1. Xiali Hei, Xiaojiang Du, Shan Lin Temple University
PIPAC: Patient Infusion Pattern based Access Control Scheme for Wireless Insulin Pump System
Xiali Hei, Xiaojiang Du, Shan Lin
Temple University
Insup Lee
University of Pennsylvania

2. §Agenda Background Motivation Overview of our solution Details Results
Conclusions
Temple University & University of Pennsylvania

3. Background: attacks in labs
In 2009, Kevin Fu et al. launched a replay attack using USRP board + software radio.
In 2011, Jack and Radcliffe demonstrated attacks targeted to wireless insulin pumps, respectively.
Jack can deliver a lethal dose 300u to a diabetes.
Radcliffe can make the meter get wrong blood glucose numbers

4. §Motivation
In USA, there will be 580,000 diabetics with pumps by 2015 [1,2,3].
Protecting the patients are very important.
Design secure schemes to calculate the safe dose range in real time.
Mitigate the attacks.

5. Purpose and assumptions (1)
The wireless links in the system is not encrypted. So attackers can easily compromise them.
Insulin pump users can change the pump settings using the Carelink Pro software in a computing device, such as a laptop. The new settings are uploaded to the pump using the Carelink USB via wireless link 5.
In this case, attackers may use customized software and a wireless sniffer to obtain the serial number of all pumps within 300 feet and can compromise wireless link 5 to change the settings of the pump without being notice.

6. A real time insulin pump system

7. Purpose and assumptions (2)
Using this security flaw, an attacker can
disable the alarms of the pump,
change the maximum allowable dosage of the pump.
deliver a fatal dose to the insulin pump user.
We focus on the attacks that compromised wireless link 5. Specifically, we focus on two types of attacks:
1) Single acute overdose.
2) Chronic overdose.

8. System model
The system has basic authentication scheme, however, it cannot defend against the overdose attack
Bolus dose: to cover food eaten or to correct a high BG level.
Basal dose: pumped continuously at an adjustable basal rate to deliver insulin needed between meals and at night.

9. Infusion record analysis
Take efforts to get the useful data from the raw data on
devices
Through infusion record analysis, we found that a patient
has specific infusion dosage patterns.
The features include:
Time, Estimate Bolus, Target High BG, Target Low BG, Carb Ratio,
Insulin Sensitivity, Carb Input, BG Input, Correction Estimate,
Food Estimate, Active Insulin, Daily Total Insulin, Basal Pattern Name,
Index, Basal Rate, and Start Time.
All of these features are expected to have a strong correlation
with the timestamps of the records.

10. Temple University & University of Pennsylvania

11. Temple University & University of Pennsylvania

12. Temple University & University of Pennsylvania

13. Safety Range Definition
According to the definition of MSE (mean squared errors) and SCC (squared correlation coefficient), we define the safety range SR for bolus dosage and basal rate as follows.
Temple University & University of Pennsylvania

15. Temple University & University of Pennsylvania

16. Temple University & University of Pennsylvania

17. Results
Temple University & University of Pennsylvania

18. Results
Temple University & University of Pennsylvania

19. §Performance analysis
Safety analysis: the cumulative dosage error in one day < 1u.
Overhead analysis: less than 0.5ms to finish the detection.
Security analysis: can defend against the two attacks and adjust during emergencies automatically.
Temple University & University of Pennsylvania

20. §Conclusions
We proposed a PIP based access control scheme that can defend against the single acute overdose and chronic overdose attacks. It is the first scheme to defend against such attacks.
Our scheme leverages the patient dosage history to generate two SVMs. Then we determined the safety ranges for each input vector.
We employed real patient data to test our scheme, and the results show that our scheme works well.
Our scheme can be generalized to other infusion systems as well.
Temple University & University of Pennsylvania

21. Questions ?
Temple University & University of Pennsylvania