www. sec.org SECURE INFORMATION FLOW AWARENESS for smart wireless ehealth systems SSD 12 - SCI Chemnitz 2012 stefan pfeiffer, andreas lehmann, sebastian unger, dirk timmermann
Lab-on-a-Chip-Implants (Online Bio-Sensing) Remote Diagnosis Online Drugstores and Remote Drug Ordering Wireless Hospital Administration Online Health Monitoring Remote Patient Supervision
nurse nurse Primary Care Physician Primary Care Physician nurse
nurse nurse Primary Care Physician Primary Care Physician nurse
nurse nurse Primary Care Physician Primary Care Physician nurse
nurse nurse Primary Care Physician Primary Care Physician nurse
Reliable Secure?!?
Two-Layer-Approach
Two-Layer-Approach Technology Devices Users Network Technology
Two-Layer-Approach Technology Security Mechanisms Devices Cryptography Users Security Protocols Network Technology Security Architectures
Two-Layer-Approach Infrastructure Layer Technology Security Mechanisms Devices Cryptography Users Security Protocols Network Technology Security Architectures
Two-Layer-Approach Process Definition Layer (Workflows / Automation Processes) Infrastructure Layer Technology Security Mechanisms Devices Cryptography Users Security Protocols Network Technology Security Architectures
Process Definition Layer Security Information Flow Control Security Domain: Public (Low) Public Private Security Domain: Private (High)
Process Definition Layer Security Information Flow Control Security Domain: Public (Low) Information Flow: Low High Public Information Flow: High Low Private Security Domain: Private (High)
Example Process
Infrastructure Layer - Users Primary Care Physician Patient Emergency Physician
Infrastructure Layer - Devices Primary Care Physician Body Area Network Bluetooth Compliant 3G Smartphone Patient Sensor EHR Database Medical In-Car- Information-System Emergency Physician
Infrastructure Layer - Networking Primary Care Physician 3G Transmission Tower Body Area Network Internet Carrier Internet Gateway Forwarding Send / Receive Send / Receive Bluetooth Compliant 3G Smartphone Patient Sensor EHR Database Medical In-Car- Information-System Emergency Physician
Infrastructure Layer - Security Primary Care Physician 3G Transmission Tower Body Area Network Internet Carrier Internet Gateway Forwarding Send / Receive Send / Receive Bluetooth Compliant 3G Smartphone Patient Sensor EHR Database Medical In-Car- Information-System Emergency Physician
Process Definition Layer Process Security Policy: Only Primary Care Physician and Patient have access to the patients EHR database.
Process Definition Layer Process Security Policy: Only Primary Care Physician and Patient have access to the patients EHR database. Process Model (informal): FALL DETECTION sensor alarm patient fell to ground BLOOD PRESSURE sensor alarm drop in blood pressure
Process Definition Layer Process Security Policy: Only Primary Care Physician and Patient have access to the patients EHR database. Process Model (informal): FALL DETECTION sensor alarm patient fell to ground BLOOD PRESSURE sensor alarm drop in blood pressure EMERGENCY CALL sent autonomously (location, ID, )
Process Definition Layer Process Security Policy: Only Primary Care Physician and Patient have access to the patients EHR database. Process Model (informal): FALL DETECTION sensor alarm patient fell to ground BLOOD PRESSURE sensor alarm drop in blood pressure EMERGENCY CALL sent autonomously (location, ID, ) Emergency doctor receives call immediately STARTS DRIVING to location MEDICAL IN-CAR-INFORMATION-SYSTEM accesses the central EHR DATABASE requesting for: drug intolerances medicamentous specialities
Process Definition Layer Process Security Policy: Only Primary Care Physician and Patient have access to the patients EHR database. Process Model (informal): FALL DETECTION sensor alarm patient fell to ground BLOOD PRESSURE sensor alarm drop in blood pressure EMERGENCY CALL sent autonomously (location, ID, ) Emergency doctor receives call immediately STARTS DRIVING to location MEDICAL IN-CAR-INFORMATION-SYSTEM accesses the central EHR DATABASE requesting for: drug intolerances medicamentous specialities emergency doctor provides a PERSONALIZED EMERGENCY TREATMENT
Verification Framework
Verification Framework 1. Process Modeling w.r.t. Infrastructure Layer BPMN 2.0 Model: (ID)
Verification Framework 2. Security Annotation in Business Process Model w.r.t. Security Policy Annotated BPMN 2.0 Model: (ID)
Verification Framework 3. Transformation from Business Process Model to Formalism (here: Petri nets) Annotated BPMN 2.0 Model Petri net Model
Verification Framework 4. Fully Automated Verification of Process Definition Layer Security Properties Tool Support (Full Automation) ANICA secure?!? LoLA Information Flow Violations Witness Path
Verification Framework 5. Information Flow Violation BP-Model-Feedback (Witness Path) Petri net Model
Verification Framework 5. Information Flow Violation BP-Model-Feedback (Witness Path) BPMN 2.0 Model Petri net Model
Conclusion 1. Detect ALL Information Leaks in mhealth workflows 2. Reliable Secure Workflows in mhealth Applications
Thank you for your attention! For further information and details, don t hesitate to ask... Stefan Pfeiffer Andreas Lehmann... or visit our websites... www. sec.org
Backup Slides
ehealth Information Flow Violations 1. Emergency Information Flow Violation 2. Untrusted / Not Certified System Components 3. Information Flow Policy Violation by Design
Verification Framework
Security The Ancient Way Security Mechanisms: guarded single entry point guarded walls built upon hills ALARM in-castle information system
Security The Ancient Way