Tag Archives: healthcare-IT

THaW Comes to a Close

Posted on by
Reply

In 2013, the National Science Foundation’s Secure and Trustworthy Cyberspace program awarded a Frontier grant to a consortium of four institutions — Dartmouth College, the University of Michigan, the University of Illinois Urbana-Champaign, and Johns Hopkins University — to enable trustworthy cybersystems for health and wellness. Over the years, THaW grew to include researchers from Vanderbilt University, Morgan State University, and George Washington University.

Over 80 students and postdocs engaged in THaW research activities over the span of the project, and the project’s bibliography includes more than 130 significant publications. You can find an organized overview of these publications here. The THaW team devised systems and methods to enhance security, resulting in 11 patents. Team members were featured in various news outlets, and THaW PI Kevin Fu co-founded VirtaLabs to identify, assess, patch, and track clinical assets in health care environments.

THaW collaborated with The Archimedes Center for Medical Device Security in Michigan to offer a twice-annual training conference on how to integrate THaW security principles into the design of medical devices to clinical engineers and CISOs from hospitals and medical device manufacturers. Over 10,000 people and more than 100 industry organizations attended the events. In addition, Archimedes conducted on-site security training for more than 500 medical device engineers over the years.

If you are interested in taking advantage of any of the resources within this site, the contact us page of this website will remain active. The rest of the website will no longer be updated. Thank you to those of you who have followed this site and the THaW project over the past 11 years.

The THaW group at its annual meeting in 2017 (top) and its first annual meeting in 2013 (bottom)
The THaW group at its annual meeting in 2017 (top) and its first annual meeting in 2013 (bottom)

New THaW Patent: Secure Short-Range Wireless Communication

Posted on by
Reply

The THaW team is proud to announce the issuing of a patent for apparatuses, methods, and software for secure short-range wireless communication.

With the number and diversity of Internet of Things (IoT) devices growing, cryptography is not a blanket solution for secure message exchange. Devices may encounter dozens or hundreds of new devices each day, and many of these new IoT devices will have limited or non-existent user interfaces, making this manual secret entry even more cumbersome than configuring existing devices.

This work focuses on a secure method to wirelessly transmit data between devices that are in short-range of each other. In this setup, the sending device has two antennas and two transmitters. One transmitter sends a data signal via the first antenna, which is closer to the target device than the second antenna, and another transmits a jamming signal via the second antenna. Because of the close proximity between the target device and the first antenna, which results in a stronger signal, the receiving device can retrieve the data despite the presence of the jamming signal. This ensures a secure-communications process between the sending device and the target device.

To learn more, check out the patent. If you are interested in taking advantage of this patent, please contact us.

Timothy J. Pierson, Ronald Peterson, and David Kotz. Apparatuses, Methods, and Software for Secure Short-Range Wireless Communication. U.S. Patent 11,894,920 B2. February 06, 2024. Download from https://patents.google.com/patent/US11894920B2/en

See also: Timothy J. Pierson, Ronald Peterson, and David Kotz. Apparatuses, Methods, and Software For Secure Short-Range Wireless Communication. U.S. Patent 11,153,026, October 19, 2021. Download from https://patents.google.com/patent/US11153026B2/en

See also: Timothy J. Pierson, Travis Peters, Ronald Peterson, and David Kotz. CloseTalker: secure, short-range ad hoc wireless communication. Proceedings of the ACM International Conference on Mobile Systems, Applications, and Services (MobiSys), pages 340–352. ACM, June 2019. doi:10.1145/3307334.3326100. [Details]

New THaW Patent: Proximity Detection with Single-Antenna Device

Posted on by
Reply

The THaW team is proud to announce the issuing of a patent for new methods for single-antenna devices to determine proximity between themselves and another device. Previous work in this field provides a method for secure short-range information exchange between a multi-antenna device and a target device. However, a single-antenna device cannot use a multi-antenna-based method and, therefore, has no way to verify its proximity to the target device.

In this patented work, a single-antenna devices uses the phase and/or amplitude of a preamble received from a transmitting device, particularly a repeating portion of the preamble, to determine whether the receiving device is in close proximity to the transmitting device. If the transmitting device is close to the single-antenna device, the repeating portions of the preamble will differ in phase and amplitude, while a large distance between the two will cause the repeating portions to have a substantially consistent phase and amplitude. This can be helpful in preventing a distant adversary from tricking the single-antenna-device into believing that a malformed preamble is a legitimate signal from a nearby device.

Interested in learning more? Check out the patent here!

PIERSON, Timothy J., Ronald Peterson, and David F. KOTZ. System and method for proximity detection with single-antenna device. US 11,871,233 B2, issued January 9, 2024. https://patents.google.com/patent/US11871233B2/en.

New THaW Patent: Pairing Wireless Devices

Posted on by
Reply

The THaW team is proud to announce the issuing of a patent for new methods to pair wireless devices resulting from the THaW project.

Current Internet of Things (IoT) device authentication protocols are functional, but not scalable, which is increasingly pertinent as more and more homes and health-focused establishments have multiple ‘smart’ devices. For example, a manufacturer of an Internet-connected blood oxygen monitor will not know the name or Wi-Fi password of an end-user’s wireless network and cannot program the device to immediately pair with the user’s access point (AP). As a result, end-users may have to set up the monitor on their own… along with dozens of other home devices. Traditional pairing protocols also rely on a one-way authentication scheme, which does not prevent the user from pairing a new device with a spoofed AP.

This recently patented pairing process involves two devices sending signals between each other and leverages the movement of objects near both of these devices, which similarly impacts both devices’ signal strength. The devices can confirm trust in each other if the signal-strength-pattern they receive substantially matches the signal-strength-pattern the other device receives.

Interested in learning more? Check out the patent here or below!

Pierson, Timothy J., and Jonathan F. Alter. Methods and software for pairing wireless devices using dynamic multipath signal matching, and wireless devices implementing the same. US11856408B2, issued December 26, 2023. https://patents.google.com/patent/US11856408B2/en.

New THaW Patent

Posted on by
Reply

The THaW team is pleased to announce one new patent derived from THaW research. For the complete list of patents, visit our Tech Transfer page.

Abstract: Apparatuses that provide for secure wireless communications between wireless devices under cover of one or more jamming signals. Each such apparatus includes at least one data antenna and at least one jamming antenna. During secure-communications operations, the apparatus transmits a data signal containing desired data via the at least one data antenna while also at least partially simultaneously transmitting a jamming signal via the at least one jamming antenna. When a target antenna of a target device is in close proximity to the data antenna and is closer to the data antenna than to the jamming antenna, the target device can successfully receive the desired data contained in the data signal because the data signal is sufficiently stronger than the jamming signal within a finite secure-communications envelope due to the Inverse Square Law of signal propagation. Various related methods and machine-executable instructions are also disclosed.

Image describes the steps to ensure secure wireless data transfer between devices.

Timothy J. Pierson, Ronald Peterson, and David Kotz. Apparatuses, Methods, and Software For Secure Short-Range Wireless Communication. U.S. Patent 11,153,026, October 19, 2021. Download from https://patents.google.com/patent/US11153026B2/en

See also: Timothy J. Pierson, Travis Peters, Ronald Peterson, and David Kotz. CloseTalker: secure, short-range ad hoc wireless communication. Proceedings of the ACM International Conference on Mobile Systems, Applications, and Services (MobiSys), pages 340–352. ACM, June 2019. doi:10.1145/3307334.3326100. [Details]

THaW’s Eric Johnson on recent health system cyberattacks

Posted on by
Reply
Eric Johnson
Eric Johnson, PhD and dean of Vanderbilt University’s Owen Graduate School of Management

Cyberattacks targeting healthcare systems have been growing in prevalence and are wreaking more havoc with the healthcare industry’s increased dependence on electronic systems. Cyberattacks such as denial-of-service attacks, can have immediate impact on patient care by leaving medical staff without important patient records. The impacts don’t end there. With healthcare systems increasing their cybersecurity protocols in the aftermath of a cyberattack, patient information can be harder to access for those who should be accessing that information. Johnson’s research with co-author S.J. Choi, PhD, shows that at hospitals where security protocols slowed computer access by just a minute or so, people who came in with a heart attack were more likely to die. “When I talk to doctors about security, a lot of times they’re very negative,” Johnson said. “So they’re pretty far behind, and at this point, incredibly vulnerable.” It’s certainly not a stretch, Johnson says, to say that delays from a ransomware attack are likely to have more serious effects.

To read more about the recent cyberattacks on healthcare systems and coverage of THaW research on those topics, check out the THaW press page.

New THaW Paper on Recurring Device Verification

Posted on by
Reply

An IoT device user with a blood-pressure monitoring device should have the assurance that the device operates how a blood-pressure monitor should operate. If the monitor is connected to a measurement app that collects, stores, and reports data, but interacts in a way that is inconsistent with typical interactions for this type of device, there may be cause for concern. The reality of ubiquitous connectivity and frequent mobility gives rise to a myriad of opportunities for devices to be compromised. Thus, we argue that one-time, single-factor, device-to-device authentication (i.e., an initial pairing) is not enough, and that there must exist some mechanism to frequently (re-)verify the authenticity of devices and their connections.

In this paper we propose a device-to-device recurring authentication scheme – Verification of Interaction Authenticity (VIA) – that is based on evaluating characteristics of the communications (interactions) between devices. We adapt techniques from wireless traffic analysis and intrusion detection systems to develop behavioral models that capture typical, authentic device interactions (behavior); these models enable recurring verification of device behavior. 

To read more, check out the paper here.

Travis Peters, Timothy J. Pierson, Sougata Sen, José Camacho, and David Kotz. Recurring Verification of Interaction Authenticity Within Bluetooth Networks. Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec 2021), pages 192–203. ACM, June 2021. doi:10.1145/3448300.3468287. ©

Meaningful healthcare security

Posted on by
Reply

Juhee Kwon and Eric Johnson recently published an article aimed at the question Does “meaningful-use” attestation improve information security performance? 

Certification mechanisms are often employed to assess and signal difficult-to-observe management practices and foster improvement. In the U.S. healthcare sector, a certification mechanism called meaningful-use attestation was recently adopted as part of an effort to encourage electronic health record (EHR) adoption while also focusing healthcare providers on protecting sensitive healthcare data. This new regime motivated us to examine how meaningful-use attestation influences the occurrence of data breaches. Using a propensity score matching technique combined with a difference-in-differences (DID) approach, our study shows that the impact of meaningful-use attestation is contingent on the nature of data breaches and the time frame. Hospitals that attest to having reached Stage 1 meaningful-use standards observe fewer external breaches in the short term, but do not see continued improvement in the following year. On the other hand, attesting hospitals observe short-term increases in accidental internal breaches but eventually see long-term reductions. We do not find any link between malicious internal breaches and attestation. Our findings offer theoretical and practical insights into the effective design of certification mechanisms.

The full paper appears in in MIS Quarterly. Vol. 42, No. 4 (December), 1043-1067, 2018. DOI: 10.25300/MISQ/2018/13580

 

THaW paper at CIST (INFORMS)

Posted on by
Reply

THaW professor Eric Johnson (Vanderbilt) recently presented a new paper at the Conference on Information Systems and Technology (CIST), a division of INFORMS.

See the video abstract. A full version of the paper is under review at a journal.

Meaningful healthcare security: Does “Meaningful-use” attestation improve information security performance?
Juhee Kwon and M. Eric Johnson
Abstract:
Certification mechanisms are often employed to signal performance of difficult-to-observe management practices. In the healthcare sector, financial incentives linked to “meaningful-use” attestation have been a key policy initiative of the Obama administration to accelerate electronic health record (EHR) adoption while also focusing healthcare providers on protecting sensitive healthcare data. Given the rapid push for safe digitization of patient data, this study examines how hospital attestation influences the occurrence of subsequent data breaches and also how breach performance is associated with penalties from prior breaches. Using a propensity score matching technique combined with a difference-in-differences approach, we analyze a matched sample of 869 U.S. hospitals. We find that hospitals that attest to having reached Stage-1 meaningful-use standards observe reduced external breaches in the short term, but do not see continued improvement in the following year. On the other hand, attesting hospitals observe short-term increases in accidental internal breaches, but eventually see longer-term reductions. We do not find any link between malicious internal breaches and attestation. Further, we find that the interaction between meaningful-use attestation (carrot) and prior failure resulting in penalties (stick) enhances short-term reductions of accidental internal and external breaches. Our findings offer both theoretical and practical insights into the effective design of certification mechanisms and breach regulations.

Hospitals Must Develop IT Security Plans To Avoid Target’s Fate

Posted on by
Reply

In a recent study examining data from 243 hospitals, THaW researcher Eric Johnson found that while compliance with state and federal IT security mandates like HIPAA helps the worst hospitals protect patient information better, organizations that maintain and regularly update a security plan get far more from their security investments. Eric defines these organizations as “operationally mature.” These strategic plans — along with periodic reviews — enable organizations to learn of potential new risks and evaluate their own security posture. As a consequence, organizations’ security resources are better targeted to address their specific needs and the environments in which they operate. Eric’s results show that the impact of security investments varies depending on the operational maturity of the organization.

Read more about this study and its results in Eric’s blog. The study was funded by an earlier NSF grant on Trustworthy Information Systems for Healthcare.