Device interoperability and authentication for telemedical appliance based on the ISO or IEEE 11073 personal health device (PHD) standards - Caranguian, Luther Paul Dela Rosa
This study focuses on the interoperability and authentication of medical devices in the context of telemedical systems. With the recent developments in telemedical systems, it is necessary that devices of different models and manufacturers will be interoperable. This enables faster market adoption and product development cycle. A recent standard called the ISO/IEEE 11073 Personal Health Device (X73-PHD) Standards addresses the device interoperability problem by defining common protocols for agent (medical device) and manager (appliance) interface. The X73-PHD standard however has not addressed security and authentication of medical devices which is important in establishing integrity of a telemedical system. Moreover, authentication in the device level eliminates device counterfeiting which presents serious hazards to users. We have designed and implemented a security policy within the X73-PHD standards. The policy will enable device authentication using digital signatures and Asymmetric-Key Cryptography. The RSA algorithm was chosen as the digital signature scheme for this study. We used two approaches for performing the digital signatures: direct software implementation and use of embedded security modules (ESM). The two approaches were evaluated and compared in terms of execution time and memory requirement. For the standard 2048-bit RSA, ESM calculates digital signatures only 12% of the total time for the direct implementation. Moreover, analysis shows that ESM offers more security advantage such as secure storage of keys compared to using direct implementation. We have performed and end-to-end test of the system using pulse-oximeter as a device and Linux-based PC as manager. Interoperability with other systems was verified by testing the system with LNI Healthlink, a manager software that implements the X73-PHD standard. Lastly, security analysis was done and the system?s response to common attacks on the authentication systems was analyzed and several measures were implanted to protect the system against them.