Today, medical devices are increasingly connected – ranging from sensors to remote patient monitoring equipment, and more.
While this evolution contributes to improve care, it also creates increased risks of cyberattacks targeting healthcare infrastructure. Indeed, unsecured devices can compromise patient safety, disrupt services and create major obstacles to regulatory compliance.
To address these challenges, The European MedSecurance project brings together leading European research and development organisations specialising in medical system technology. CEA-List is contributing to the project by applying its expertise in modelling and formal verification to enhance the cybersecurity of connected medical systems (IoMT).
The work carried out by CEA-List teams aligns with the « Security by design » approach, which involves integrating cybersecurity requirements from the earliest stages od design and throughout the development and certification cycle of medical technologies. This approach is being implemented through the evolution of two open-source software platforms from CEA-List: Papyrus-WEB et Frama-C.
Papyrus-WEB is the CEA-List platform for modeling complex systems and their interactions. It has been customised into a version dedicated to the IoMT sector to implement specific architectures, execute verification and validation rules, and generate reports and code templates.
For its part, Frama-C, a software verification tool, has been adapted for the new open-source Atmel AVR IoT platform – Arduino – which is representative of thise found in connected medical devices.
During the project’s final review by European Commission, these tools were applied to a case study involving a portable PCR analyser. The demonstration highlighted their suitability for this representative case study, as well as their interoperability with the tools developed by other project partners.
The solutions developed by CEA-List are being integrated into one of the software components created as part of the MedSecurance project. More broadly, the project has led to the creation of a toolkit to automate the security of connected medical devices. It comprises six integrated open-source tools that help developers, integrators and assessors to address cybersecurity and safety risks throughout the medical devices’ lifecycle.
These tools overcome the limitation of current approaches, which often rely on fragmented tools and manual processes that slow down compliance and development. All project results are available as open source to ensure transparency and widespread adoption.
For more information, please contact Frédéric Desages or Jean-Michel Côme-Corneille.