35.4: A Miniature Biomedical Implant Secured by Two-Factor Authentication with Emergency Access

The advancement of miniature implantable medical devices (IMDs) has made remarkable progress toward creating minimally invasive and broadly accessible therapeutic and monitoring solutions for various complex health conditions [1], [2]. However, a critical challenge associated with this trend is ensuring the security of IMDs, which handle highly private data and life-critical therapies. This challenge is greatly amplified by the increasing need for Internet connectivity to remotely access IMDs by patients and doctors. While the adoption of standard cryptography with pre-shared keys (PSKs) [3] addresses many issues in the wireless channel, two major challenges specific to IMDs remain: 1) in emergencies, the responders may not have access to the server storing the PSK and thus cannot program the implant; 2) if the doctor's account is compromised, e.g., through phishing [4], and the attacker can therefore bypass all protections and hijack the implant using the doctor's credentials.