Vücut Alan Ağlarındaki Medikal Cihazların ve Mobil Sağlık Uygulamaların Güvenlik Analizleri

Sağlık alanındaki teknolojik gelişmelerle birlikte insan vücudu ile etkileşimde bulunan medikal cihazlardan oluşan Vücut Alan Ağları (BAN) geliştirildi. Bu sayede örneğin insan kan basıncını ya da insülin değerini otomatik ölçen ve hastane yönetim sistemlerine aktaran mobil cihazlar günlük hayatta kullanılmaya başlandı. Bu medikal cihazlar bir yandan sağlık yönetimini iyileştirirken diğer taraftan bunlara yapılacak izinsiz müdahale ile insan sağlığını riske atabilmekte hatta ölümlere neden olabilmektedirler. Bu çalışmamızda Kablosuz Vücut Alan Ağları (WBAN)’nda kullanılan medikal cihazların ve mobil sağlık uygulamalarının güvenlik analizleri gerçekleştirildi. Öncelikle WBAN’ın tehdit modellemesi yapılarak WBAN’da ki özellikle uzaktan erişilebilir medikal cihazların karşı karşıya kaldıkları bütün tehditler ve riskler belirlendi. Akıllı cihazlar üzerinde çalışan mobil sağlık uygulamaları için güvenlik analizleri ve güvenlik sızma testleri gerçekleştirildi. Ayrıca, WBAN sistem tasarımı için güvenli mimari prensipleri belirlendi.

Security Analysis of Medical Devices within Wireless Body Area Networks and Mobile Health Applications

Body Area Networks (BAN) consisting of medical devices that interact with human body have been developed in accordance with technical developments in healthcare area. Providing this, devices automatically measuring human blood pressure or insulin value and feeding data into hospital management systems have started being used in daily-life. These medical devices help to improve health status of patients, however they are also subject to risks caused by unauthorized intervention. In this study, medical devices used in Wireless Body Area Networks (WBAN) and mobile health applications have been analyzed according to different security requirements and aspects. Initially, all threats and risks faced by remotely accessible medical devices in WBAN have been identified by applying WBAN threat modeling. Security analysis and penetration testing of mobile health applications running on smart devices have been conducted. In addition, secure architecture principles for WBAN design have been specified in detail.

Keywords:

WBAN architecture, WBAN security analysis mobile application penetration testing, health security,

PDF

___

H. F. Rashvand, V. T. Salcedo, E. M. Sanchez, D. Iliescu, “Ubiquitous Wireless Telemedicine”, Communications, IET, 2(2), pp.237-254, 2008.
R. Bults, K. Wac, A. Van Halteren, D. Konstantas, V. Jones, I. Widya, “Body Area Networks for Ambulant Patient Monitoring Over Next Generation Public Wireless Networks”, 3rd IST Mobile and Wireless Communications Summit, Lyon, France, 27/30, 27-30 June, 2004.
M. Li, W. Lou, K. Ren, “Data Security and Privacy in Wireless Body Area Networks”, IEEE Wireless Communications, ISSN 1536-1284, 17(1), pp.51-58, 2010, doi: 10.1109/MWC.2010.5416350.
IEEE Standard for Local and metropolitan area networks - Part 15.6: Wireless Body Area Networks,IEEE Std 802.15.6-2012, pp.1-271, Feb. 29 2012, doi: 10.1109/IEEESTD.2012.6161600.
Internet: Microsoft STRIDE Threat Model, https://msdn.microsoft.com/library/ms954176.aspx, 19.04.2016.
Internet: D. Galpin, I. Lewis, Google I/O 2012 - Ten Things Game Developers Should Know, https://www.youtube.com/watch?v=WDDgoxvQsrQ, 13.12.2015.
A. Demir, Vücut Alan Ağlarındaki Medikal Cihazların ve Mobil Sağlık Uygulamalarının Güvenlik Analizleri, Master Thesis, Istanbul Şehir University, Graduate School of Natural and Applied Sciences, 2016.
C. s. Jang, D. G. Lee, J. w. Han, “A Proposal of Security Framework for Wireless Body Area Network”, Security Technology, International Conference on’08, Los Alamitos, CA, USA, pp. 202-205, December, 2008, doi: 10.1109/SecTech.2008.32.
O. Garcia-Morchon, T. Falck, T. Heer, K. Wehrle, "Security for Pervasive Medical Sensor Networks," 2009 6th Annual International Mobile and Ubiquitous Systems: Networking & Services, MobiQuitous, Toronto, ON, pp. 1-10, July, 2009, doi: 10.4108/ICST.MOBIQUITOUS2009.6832.
C. Li, A. Raghunathan and N. K. Jha, "Hijacking an Insulin Pump: Security Attacks and Defenses for a Diabetes Therapy System," 2011 IEEE 13th International Conference on e-Health Networking, Applications and Services, Columbia, MO, pp. 150-156, June, 2011, doi: 10.1109/HEALTH.2011.6026732.
W. Burleson, S. S. Clark, B. Ransford, K. Fu, "Design Challenges for Secure Implantable Medical Devices," DAC Design Automation Conference 2012, San Francisco, CA, pp. 12-17, June, 2012, doi: 10.1145/2228360.2228364.
D. Halperin et al., "Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses," 2008 IEEE Symposium on Security and Privacy (sp 2008), Oakland, CA, pp. 129-142, May, 2008, doi: 10.1109/SP.2008.31.
L. C. Silva et al., “A Baseline Patient Model to Support Testing of Medical Cyber-Physical Systems”, MedInfo, Studies in Health Technology and Informatics, vol:216, Editor: Indra Neil Sarkar et al., IOS Press, pp. 549-553, 2015, doi: 10.3233/978-1-61499-564-7-549.
S. N. Ramli, R. Ahmad, M. F. Abdollah, E. Dutkiewicz, "A Biometric-based Security for Data Authentication in Wireless Body Area Network (WBAN)," 2013 15th International Conference on Advanced Communications Technology (ICACT), PyeongChang, pp. 998-1001, January, 2013.
S. N. Ramli, R. Ahmad, M. F. Abdollah, "Electrocardiogram (ECG) Signals as Biometrics in Securing Wireless Body Area Network," 8th International Conference for Internet Technology and Secured Transactions (ICITST-2013), London, pp. 536-541, December, 2016,doi: 10.1109/ICITST.2013.675025
Internet: OWASP Mobile Security Testing Guide, https://www.owasp.org/index.php/OWASP_Mobile_Security_Testing_Guide
M. Ogul, S. Baktir and E. I. Tatli, “Abused Android Permissions by Advertising Networks,” IEEE International Conference on IT Convergence and Security (ICITCS), Beijing, 2014, doi: 10.1109/ICITCS.2014.7021726.
Internet: Healthiply. Healthiply professionals, https://play.google.com/store/apps/details?id=com.health.doc, 2016.
Internet: KloudData Inc. mMR, https://play.google.com/store/apps/details?id=com.klouddata.mmr.main, 2016.
Internet: NFC MEDIC. Nfc medic, https://play.google.com/store/apps/details?id=com.gn4me.apps.NFCMedic2, 2016.
Internet: VitalHub Corp. Patient chart, https://play.google.com/store/apps/details?id=com.vitalhub.vitalchart, 2016.
Internet: Zibdy Inc. Zibdy health, https://play.google.com/store/apps/details?id=com.zibdy.VPB.client, 2016.
Internet: Tıpnet Yazılım. Yalova devlet hastanesi uygulaması, https://play.google.com/store/apps/details?id=com.yalovadh.monaca, 2016.
Internet: Diagnose Software Inc. Diagnose, https://play.google.com/store/apps/details?id=com.DiagnoseSoftware.diagnose, 2016.
Internet: Greenway Family Practice. Healty files, https://play.google.com/store/apps/details?id=com.healthfilesapp.mobileandroid, 2016.
Internet: Smart Medical Apps. Smart medical, https://apkpure.com/smart-medical-apps-h-p/com.smartmedicalapps.checklist, 2016.
Internet: AvvaStyle. Health records, https://apkpure.com/health-records/ com.AvvaStyle.medcard, 2016.
Internet: Caddy. Medical & health records caddy, https://apkpure.com/medical-health-records-caddy/com.medicalcalculations, 2016.
Internet: Tanya White. My medical history, https://apkpure.com/my-medical-history/com.droidcasa.tanyawhite, 2016.
Internet: LLC WebMD. Webmd, https://apkpure.com/webmd-for-android/com.webmd.android, 2016.
Internet: LifeGuard Global Ltd. My medical history, https://apkpure.com/my-medical-history/com.pirolor.steven.medhitory, 2016.