ACM Workshop on Medical Communication Systems

The ACM Workshop on Medical Communication Systems (MedCOMM) seeks short research papers. Research communities such as communications, networking, sensor networks, cyberphysical systems, human-computer interaction, security, and wireless are highly relevant. This workshop is co-located with ACM SIGCOMM in Helsinki, Finland.

From the CFP:

We solicit submissions on topics including, but not limited to, the following:

• Safe and effective network architectures and protocols for highly interoperable wireless medical devices

• Applications of cognitive radio to maximize spectrum utilization and spectrum sharing on unlicensed bands

• Data integrity and reliability issues in allocated or unlicensed spectrum

• Mobile phones as medical sensor gateways

• Ultra-low power communications

• Deployment of open medical communication systems

• Communications and computer networks designed for validation, formal verification, or hazard analysis

• Usability issues, security/privacy issues, regulatory/policy issues

• Industrial experiences, provider experiences, regulator experiences

As a workshop, the focus is on position papers and early-stage works. The submission deadline is March 23rd. Please consider submitting.

The full CFP with all of the relevant deadline information is available here.

Amphion Forum discusses medical device security in Minneapolis on November 3

Join MDSC co-director Dr. Kevin Fu and several other experts on medical device security at the Amphion Forum in Minneapolis on November 3. Request an invitation and then take a morning break from MDM to learn about the emerging security risks of software-based medical devices.

It's not too surprising that medical devices have security risks. The bigger question is how to find effective and balanced ways to reduce security risks in a landscape where threats can emerge without warning. Dr. Fu explains that if a medical device company wishes to attract hackers to devices, the company should follow this simple, four-step program:

1. Increase software complexity so that testing becomes an ineffective technique for risk management. Make extensive use of pointers and non-type-safe programming languages.
2. Add unprotected radio communication so that previous physical barriers no longer keep out the bad. Special overconfidence points are awarded for using "proprietary techniques" to "secure" a radio/wireless link.
3. Trust the Internet for clinical decision making; add decades of Internet security holes and web browser vulnerabilities to your trusted computing base.
4. Be complacent. Assume that absence of a security problem today means there never will be.

Software race conditions in intravascular radiation delivery systems

There are very few MAUDE reports that cite "race conditions" in medical device software as a cause of malfunction, patient harm, or death. But to a computer scientist, this 2002 MAUDE report on a radiation delivery device sounds like it's describing a classic race condition:

The root cause for the appearance of the partial treatment button is the result of a software anomaly combined with the user not following the ifu. The time window necessary for this anomaly to occur (after completion of the treatment and prior to the treatment summary screen being displayed) is small (approximately 1 second),...

The phrase "race condition" does appear occasionally in MAUDE. Here's a sample excerpt.

Engineering investigation determined that after the table top is tilted to 88 degees, releasing and engaging the angulation knob very quickly when the table is near its extension limit creates a software race condition that allows the table to continue its motion towards the floor.