A Software Framework for Security Risk Assessment and Management in Life-critical Embedded Systems

With the advent of network connectivity and complex software, life-critical embedded systems like medical devices are strongly influencing advances in healthcare. Such devices are now part of a digital health ecosystem, providing continual patient monitoring, interoperability, and real-time data access. With a wide attack surface across the entire healthcare ecosystem, life-critical embedded systems are subject to a plethora of security risks and vulnerabilities. Security threats and attacks exploiting these vulnerabilities have been shown to compromise patient safety by hampering essential functionality. This necessitates incorporating security from the very design and development to deployment and long-term maintenance of such systems. Incorporating risk assessment and management for premarket and postmarket security management are now becoming a standard requirement by regulatory bodies.In this dissertation, we consider security during the software design of life-critical embedded systems with far-reaching goals of adaptive risk assessment and automatic runtime threat mitigation. We develop software models and a framework for security risk assessment and management in life-critical embedded systems from design to deployment. We present SAFES - a software-based architectural framework for ensuring security, and FIRE - a finely integrated risk evaluation method. Specifically, we make the following contributions: a trustworthy multi-modal model for software design, a deeply integrated composite adaptive risk assessment framework, an automatic runtime risk management, a threat mitigation method by mode switching, and developing formal models to ensure security. We formally model, design, and implement SAFES and FIRE for a smart-connected insulin pump model case study. We evaluate and simulate SAFES for the insulin pump by designing the insulin pump software in a hierarchical multi-modal fashion of operations, tasks, and modes while incorporating an essential mode to sustain critical functionality. Utilizing FIRE, a hierarchical control-flow risk graph is constructed for performing static risk evaluation during design and dynamic risk evaluation and management at runtime. Automatic threat mitigation is performed by evaluating operating system mode risks at runtime and switching modes until the threat is mitigated. Under normal and security compromised system operations, experimental results demonstrate effective threat mitigation by mode switching with a 0% false positive mode switching rate and an effective mitigation latency well within the essential functioning timing of the life-critical system