# Trusted Composition of Internet of Medical Things over Imperfect Networks
## 1 Introduction  
An Internet of Things (IoT) is a collection of inter-connected programmable _things_ with the ability to collect and exchange data [1]. Depending on the application domain, the things may include anything ranging from temperature sensors, cameras, smart phones, home appliances, cars, to medical devices, and so on. IoT systems combine functions of individual devices, communicating over a network, to perform operations impossible with individual devices. Such integration of heterogeneous things enables access from anywhere, anytime, and by anything through networks that span from Body Area Networks (BAN) to networks stretching across the globe. The term \"Internet of Medical Things\" (IoMT) refers to a composition of medical devices, applications, and healthcare IT systems that are connected through computer networks. Medical devices equipped with interoperable interfaces along with the communication network form the basis of IoMT. Under the purview of IoMT, medical device composition extends data sharing for electronic health records [2, 3] with therapeutic medical devices [4, 5]. The application of IoMT to control patient therapy has regulatory requirements in most countries where simply storing patient monitoring in electronic health records does not. The safety and effectiveness of IoMT systems requires both the correct functionality of individual devices and their communication with one another. Different wired and wirelesstechnologies and protocols establish the network that provides communication between the medical devices. Common networking technologies include cellular networks (LTE, 3G, 4G, 5G, etc. ), local and personal area networks (WiFi, Bluetooth), low-power wide area networks (LoRaWAN), and mesh networks (Zigbee, RFID). As non-regulated, commercial-grade networks are mostly used for availability and cost effectiveness, composition of IoMT must accommodate unreliable communication, yet still be at least safe. A network used for IoMT may become unreliable as a result of connecting devices from various manufacturers interacting in heterogeneous environments [6]. Vulnerabilities related to security, privacy, and confidentiality present in the individual devices also affect the integrated network. Several studies, like [7; 8; 9], have explored different trust issues in IoMT systems. Even correctly working networks can lose packets due to contention by wire or radio, and devices can be disconnected deliberately or inadvertently. The existing literature on the composition of medical devices for IoMT system design mostly focus on data and device interoperability assuming a secure and trusted network. Studies like [2; 4; 10] typically presume a trustworthy and reliable communication network when considering the safe interoperability of medical devices for application platforms and integrated clinical settings. In the United States, safety-critical devices are regulated as Class II (i.e., infusion pumps) or Class III (i.e., implanted cardiac defibrillators). Such devices require controlled and documented designs using medical-grade components, which have stringent tracing and reporting requirements. These requirements drive up medical device costs, exacerbated by liability insurance if patients are harmed. This paper describes the means of using high-quality, yet commercial-grade, networks to achieve medical-grade safety of IoMT. The trusted composition of IoMT aims to achieve high assurance of the system as a whole, even though certain components of the system may have lower assurance. Therefore, if we cannot verify that every execution is correct (as we can with rigorous formal verification), we can at least verify that each particular use of commercial-off-the-shelf (COTS) software and hardware is correct using loop-back. Every message is looped back to the sender to be compared with the original. If it does not match, or does not arrive in time, the sender can take other action to assure safety.