## 3 Consumer Products and Active Implantable Medical Devices
### Security Trade-offs in Active Implantable Medical Device Designs  
In this section, we focus on active implantable medical devices (AIMDs), a category inclusive of pacemakers, implantable cardiac fibrillators (ICDs), and implanted drug delivery systems. Suchdevices are becoming increasingly technologically advanced; current generation devices already support remote monitoring by health professionals via 802.11 WiFi [44]. Although external personal medical devices (e.g. glucose meters) and passive implantable medical devices (e.g. replacement joints) are likewise advancing technologically, we do not consider them. Because AIMDs can be repaired or replaced only via highly invasive surgical procedures, and because technologically advanced AIMDs might be susceptible to network attacks, interesting choices must be made and often competing goals must be balanced in designing them. Designers of AIMDs must ensure that device security and patient privacy are maintained during attacks. However, design techniques aimed at addressing the goals of security and privacy are often at odds with other design goals. We highlight some of these trade-offs below, and, where possible, highlight some promising research in addressing them. In the following paragraphs, we use the term _security_ to refer to the information security principles of confidentiality, integrity, and availability. We do not concentrate on physical safety, except in the context of AIMDs carrying out their primary, possibly life preserving functionalities. **Security _vs._ energy usage: Designers must keep the power usage of AIMDs to a minimum, especially considering the physical inaccessibility of AIMDs [45]. This places constraints on the computational power and communications abilities of AIMDs. For example, asymmetric cryptography may not be suitable for use in AIMDs due to its computational requirements. Current-generation AIMD bearers commonly carry bracelets or other forms of identification to alert medical professionals of the AIMD's existence (e.g. in an emergency situation). Making these identifying bracelets or cards computationally powerful, and pairing them on a one-to-one basis with their AIMD, has been proposed [46]. An AIMD can offload long range communication and intensive processing onto an externally paired device. The one-to-one pairing between an AIMD and its external device allows the use of power-saving symmetric cryptography between the two. The lack of severe energy constraints on the external device allows for the use of computationally more-expensive asymmetric cryptography between it and other external devices (e.g. programmers). Certainly other power-saving measures are possible. Medical practitioners and AIMD designers must take care to ensure that communications with an AIMD have sufficient benefit to warrant energy usage. For example, medical practitioners might allow non-critical telemetry data to queue on an AIMD rather than fetching it in near-real time, thus avoiding unnecessary AIMD energy usage. **Security _vs._ device lifetime: AIMDs cannot be replaced or physically repaired without surgery. Similarly, they cannot be updated (e.g. software patching) without a patient visit to a trusted device programmer (e.g. physician). Because of these facts, AIMDs must be designed with longevity in mind. This requirement is in contrast to the security paradigm of, for example, desktop computers, which require frequent rollouts of software updates to correct security flaws. Protocols used to communicate with AIMDs must be designed for a very long lifespan. A single AIMD might serve a patient for 15 or more years, and this single AIMD might communicate with many different types and generations of external hardware throughout its lifespan. Each of these pieces of external hardware must support communication with the possibly obsolete AIMD; communication with a functioning AIMD cannot be hindered in the name of technological obsolescence [47].