Suitability of NFC for Medical Device Communication and PowerDelivery

Eric Freudenthal, David Herrera, Frederick Kautz, Carlos Natividad,Alexandria Ogrey, Justin Sipla, Abimael Sosa,

Carlos Betancourt, and Leonardo Estevez

Abstract- Near Field Communications (NFC) is a 13.56 MHz for example, delivering a sequence of signals that disrupt ainductively coupled power delivery and communication protocol seizure.that extends the ISO 14443 RFID standard. Low cost NFC Should substantial computation be required (e.g. for signalscanner subsystems are anticipated to be widely incorporatedin coming generations of commodity cellular phones. processing),eNF can provide a data communication link toWe consider the potential of this emerging infrastructure external computers thatpotentially have largerpowerbudgets

to provide convenient and low cost power distribution and than practical for implanted and/or field-powered devices.communication channels for a range of medical devices. For NFC data links can also be used to coordinate the behaviorexample, an NFC device within a cell phone could relay of several cooperative systems (e.g. components that measuremeasurements collected from a defibrillator-pacemaker to amonitoring physician, remotely control an insulin pump, or glCos and compone tha dins inin).activate an implanted neural simulation system. NFC is also suitable for providing communication for self-NFC devices pose similar bio-compatibility challenges to powered devices. Potential applications include collection of

other implanted electronics without requiring the provisioning historical data from and setting of operating parameters forof battery power to support communication. Furthermore, an ICDs (internal cardiac defibrillators) [18]. In such configura-NFC communication subsystem's power-independence provides tions NFC communication subsystems may be field-powereda measure of defense against potential denial-of-service attacks '. . .that consume power in order to discharge a capacity-limited and thus not Impose any additonal drain on limited batterypower source. resources.

The 13.56 MHz band has minimal interaction with human Direct internal electrical stimulation has been identifiedand animal tissues. We conducted several successful proof-of- as useful for a variety of medical conditions. This familyconcept experiments communicating with with ISO 14443 tags of applications is particularly well suited for NFC since thisimplanted at multiple locations within a human cadaver.

Magnetic field strength decays with the cube of distance-to- stiution reqisdvery sallamunsofcenergytha Canantenna, limiting limits the range of potential eavesdroppers. potentially be provided by batteries recharged via NFC [11].At present, NFC protocols do not provide an appropriate set of Furthermore, NFC can be used to adjust operating parametersprivacy properties for implanted medical applications. However, after implantation. Potential applications of implanted NFCNFC devices are implemented using embedded general purpose for stimulation include:processors and thus only software modifications would berequired to support protocol extensions with enhanced privacy. * Direct mitigation of chronic pain through the use of

spinal chord stimulation (see [9], [4]),I. POTENTIAL APPLICATIONS OF IMPLANTED RFID . Reduction of Parkinson's disease symptoms through

the use of deep brain stimulation (see Krausea, FogelaThere has been much excitement about the potential et al. [3]).

market for Digital Angel's implantable glucometer that . For patients with morbid obesity: The prevention ofcan utilize NFC for both communication and as a power excessive eating by gastric stimulation that creates asource [14]. Similarly, monitoring of brain function can feeling of satiation (see Wang. et al, [19])be provided by probes implanted within the brain [7] that . Mitigation of diabetic gastroparesis through the use ofcommunicate via an NFC transponder embedded within the high frequency stimulation (see Patterson, Thirlby andskull. These same probes may also be used therapeutically, Dobrio [12]).

This research was supported by a gift from Texas Instruments Incorpo- A. Related Approachesrated.Lo frqecRFD(rud14kzisuefrEric Freudenthal and Justin Sipla are faculty at the University of Low frequency RFID (around 134 kHz) is used forTexas at El Paso. 500 W. University Avenue, El Paso, TX, 79902, USA. implants that identify livestock and pets, and only permits{efreudenthal, jssipla} @utep.edu communication at low (5 kbit/s) data rates. RFID transpon-

David Herrera, Frederick Kautz, Carlos Natividad, Alexandra Ogrey andAbimael Sosa are students at the University of Texas at El Paso. 500 W. ders that operate in the UHF (900 MHz) band are alsoUniversity Avenue, El Paso, TX, 79902, USA. {daherrera, ffkautz, anogrey, available. Furthermore, the 402-405 MHz MICS band hascanatividad, sosaa} @miners.utep.edu been reserved for communication with medical devices, and

Carlos Betancourt and Leonardo Estevez are with Texas Instruments thscudbuedfril-pwedom ncaon ihIncorporated, 12500 TI Boulevard, Dallas, TX, 75243, USA. {carlosb, tu ol eue o il-oee omnchnwtleonardo}@ti.com implanted devices. Due to their higher carrier frequency,

978-1-4244-1626-4/07/$25.00 ©)2007 IEEE. 51

HF, UHF RFID (and potentially, MICS) offers significantlyhigher data rates than LF RFID, Recent research on short-range magnetically coupled UHF indicates that highly ef-ficient coupling through tissue is possible [13]. However,absorbtion; of energy at 400 and 900 MHz is significantlygreater than at 14MHz or 134kHz. This absorbtion can limitthe amount of power than can be safely transferred throughtissue due to thermal heating.

It is difficult to restrict the range of UHF scanners anddevices. UHF RFID is particularly prone to being reflectedlarge distances by small metallic objects. This effect mayfacilitate eavesdropping or confuse emergency responders'effoitsato iavesdentppatient withuseradio-equipped medcde-' Fig. 1. Texas Instruments' Tag-itTM Transponder Inlay Labeled "C"efforts to identify patients with radio-equipped medical de-vices. Finally, internationalization is difficult due to incon- TABLE Isistent allocation of LF and UHF bands among nations. DIMENSIONS OF TRANSPONDER INSETS

In order to enable the growth of field-powered e-commerceapplications such as smart billboards that communicate di- Label Length (mm) Width (mm) Area (mm2)rectly with consumer devices, the NFC (Near Field Com- Q 22 38 2025munication) Forum [10] has adopted protocols upon 13.56 c 65 34 2210MHz RFID that provide bidirectional communication chan- M 76 45 3420nels with a significantly higher data rates than available forUHF RFID (up to 400 kbit/s from powered "scanner" devicesand up to l00kbit/s from field-powered "passive" devices)[6]. implantable ECG[16]Unlike LF and UHF RFID, the 13.56 MHz channel is 1 IMPLANTATION PROOF-OF-CONCEPT ExPERIMENTSavailable internationally and short range HF scanners are notprone to UHF's distant phantom hot spot phenomenon. To validate that passive NFC is suitable for communica-

The increased bandwidth provided by NFC can enable tion with implanted medical devices, we conducted proof-a wide range of data-intensive applications and facilitates of-concept experiments in which 13.56 MHz RFID tagsthe inclusion of privacy- and integrity-preserving crypto- were implanted within a human cadaver. Measurements aregraphic protocols appropriate for medical systems. There are presented for four Tag-it' transponders whose dimensions are

standardization activities underway (such as HL7) to enable enumerated in Table I.the storage of electronic health records within NFC-enabledRFID tags. NFC uses magnetic coupling, which results in a I IMPLANTATION EXPERIMENTATIONvery localized range (generally less than 20cm), providing a RFID transmission range is normally dependent on ameasure of privacy against eavesdroppers. This short range number of factors including scanner power output and an-also facilitates patient selection in hospital and other "first tenna characteristics (for both scanner and transponder). Bothresponder" environments where it is important that medical scanner and transponder antennas serve for transmission andpersonnel reliably identify patients with radio-equipped med- reception; Generally larger size and greater scanner powerical devices. NFC is not substantially attenuated by tissue and provide longer range.thus ibbbs even suitable for communication with implanted There is a paucity of published research on HF RFIDmedical devices. transponders implanted within animals. An esoteric appli-

Incorporation of NFC within implanted or ingested med- cation of HF RFID implanted within a dog's tooth has beenical devices poses bio-compatibility challenges typical of investigated [1] that achieved very short-range communica-other electronic devices with the advantage of not necessarily tion, but we are unaware of other studies of communicationrequiring a battery or external electrical connections. Few with commodity printed-antenna transponders.additional components are required: A minimal commodity Our preliminary investigation indicates that HF RFID isNFC transponder is implemented as a flexible PCB (as small suitable for communication to transponders within cavitiesas a 2.5cm circular disk) on which a spiral antenna is printed at a wide range of depths. A variety of transponder in-(in metal or ink) and upon which a a single IC containing ra- lays whose antennas are printed upon flexible PCBs weredio, power supply and computational subsystems is mounted. implanted at three locations within a preserved cadaver ofProgrammable variants of these ICs are available with power an elderly male. An RFID scanner based on the Texasoutput and i/o pins. Instruments TRF7960 chipset with an integrated 4 x 5.5A range of packaging suitable for implantation are avail- cm PCB antenna was used to query the transponders. Raw

able. 13.56 MHz RFID tags are available for implantation beef fat was observed to have similar coupling and signalwithin livestock that are encapsulated within 2.5cm glass transmission properties to the preserved cadaver.disks. Layered epoxy and paraline were used successfullyto encapsulate Riistama et. al's field-powered experimental 'Tag-it is a registered trademark of Texas Instruments Incorporated

52

TABLE IIIMPLANTATION DEPTHS.

Location Depth (mm)(1) Below dermal fat 11(2) Below ribs 27 (includes 11mm dermal fat)(3) Within skull 15 (includes 6.5mm skin & superficial fascia)

TABLE IIISENSITIVITY TO INSULATOR THICKNESS FOR TRANSPONDER C

IMPLANTED BENEATH DERMAL FAT AND WITHIN BEEF FAT.

#)layers 6u m Minimum distance (cm) toplastic insulator chest fat1 1.5 2.52 6 4 (1(3) (4)3 10 74 9.5 not measured Fig. 2. Transponder implantation (1) below fat attached to chest derma,

(2) below ribs (not shown), (3) within skull, and (4) within layers of beeffat. Communication range was significantly affected by the thickness of

Ten transponders (5 to 35 cm2) with similar designs were insulation separating implanted transponders and nearby tissue.

implanted: TABLE IV

1) below the cadaver's chest's sub-cutaneous fat and SENSITIVITY TO INSULATOR THICKNESS FOR IMPLANTATIONS AT

directly above investing fascia of pectoralis major, LOCATIONS (1) AND (3)2) beneath the 6th rib, on anterolateral surface of the right

lung, and Location (1): Sub-dermal Chest Implant3) upon the dorsal surface of the brain's cerebral hemi- layers 6 anm Maximum distance (cm)

sphere. plastic insulator skin to scanner

TO determine correspondence between measurements taken 1I. 4.Q

within a preserved cadaver and more easily replicated condi- 2 4.5 7.5 5 3.5tions, in-vitro measurements were taken using transponders 3 5.5 8 6 5

implanted between 12 mm layers of fresh beef fat. Pho- as much al fromattographs of implantations appear in Figure 2. Implantation Location (3): Cee implantdepths are indicated in Table II. The maximum usable range flayers 6 thm Maximum distance (cm)at which each transponder could be reliably read (scanner- plastic insulator skin to scannerto-flesh)watnmeasured. ml of the m u 1 ~~~~~~~~36 5 4

Capacitance between a transponder and its carrier were 2 4 6.5 6 4.5observed to substantially affect the tuning of its antenna. To 3 5.5 7.5 6 7minimize mutual coupling among nearby transponders and tocompensate for capacitance to carriers, HF RFID transpon-ders are typically tuned not to resonate at the scanner's carrier All implanted Tag-it transponder inlays that were insulatedfrequency. Our range experiments indicate that proximity to by at least two 6 um layers of insulating film had sufficienttissue can dramatically affect transponder tuning and thus range to communicate with a scanner at least 4 cm, andcan modulate communication range. sometimes as much as 10 cm from the body in all locations.The Texas Instruments TRF7960 is a ISO 1443 evaluation Transponder inlay C (see Figure 1) had a particularly long

scanner with selectable power output of 100 and 200mW. range of more than 7 cm outside of the body when implantedWe found that the lower power level only slightly reduced at any of the locations we examined when insulated by atcommunication range. All of the measurements presented in least 12 rm of plastic film.this paper were obtained using the high power level except IV. DisCOVERY AND DisCLOSURE OF MEDICALthose presented in Table III. INFORMATION

Transponder antennas are uninsulated and unable to com-municate when in direct contact with tissue. For our inves- A NFC-enabled medical device could potentially also betigation, transponders were insulated from tissue by bags used to provide health history to first responders in anconstructed from 6,um plastic film. Transponder antennas emergency. This information could either be held within the

V. PRIVACY AND SECURITY CONCERNS REFERENCES

While NFC is a descendant of a communications protocol [1] Ishihata, Tomoe, Takei, Hirano, Yoshda, Shoji, Shuimauchi, andprincipally designed to expose the presence of tags and Horiuchi, "A radio frequency identification implanted in a tooth can

communicate with the outside world," IEEE TITB, to appear.transmit their contents, they can be extended to do neither. [2] A. Juels, R. L. Rivest, and M. Szydlo, "The blocker tag: SelectiveFurthermore, NFC provides a unique robustness to denial- blocking of rfid tags for consumer privacy," in Proc. ACM Conferenceof-service attacks upon limited battery power reserves. on Computer and Communications Security. ACM, 2003, pp. 103-

The presence of a medical device implementing RFID may [3] M. Krausea, W. Fogela, A. Heckb, W. Hackea, M. Bonsantob,be surreptitiously detected by scanners not authorized by C. Trenkwalderc, and V. Tronnierb, "Deep brain stimulation for thethe person wearing the device. This involuntary exposure treatment of parkinson's disease: subthalamic nucleus versus globus

oprnlnr to'location pallidus internu," J. Neurol Neurosurg Psychiatr, pp. 464-470, Apriof personal information iS related to Lee and Kim's locatlon2001.threat model [5]. We advocate the incorporation of strong [4] K. Kumar, N. R, and G. Wyant, "Treatment of chronic pain by epiduralcryptographic techniques in a manner that prevents such spinal chord stimulation; a 10-year experience," J. Neurosurg, vol. 75,

devices from emitting signals in response to queries from no. 3, pp. 402-407, September 1991.devices from emitting signals in response to queries from [5] H. Lee and J. Kim, "Privacy threats and issues in mobile RFID," inunauthorized readers. Proc. ARES. IEEE, 2006.The blocker tag approach of Rivest et al. [2] has been [6] Magellan Technology. (2006, March) White paper: A comparison

of RFID frequencies and protocols. [Online]. Available:proposed as appropriate for the protection of medical infor- http://www.magtech.com.au/downloads/White Paper Frequency Com-mation. A reader that does not possess an appropriate autho- parison 31 March 2006-1-I.pdfrization can not obtain any data from a blocker transponder. [7] D. McCreery, A. Lossinsky, V. Pikov, and X. Liu, "Microelectrode

array for chronic deep-brain microstimulation and recording," IEEEHowever, a device implementing this algorithm will engage Trans Biomedical Engineering, vol. 53, no. 4, April 2006.in a bi-directional conversation with unauthorized readers [8] Microsoft. Healthvault. [Online]. Available:and thus remains vulnerable to Lee and Kim's location threat. http://www.healthvault.com

[9] E. Monti, "Peripheral nerve stimulation: A percutaneous minimallyWe advocate the development and adoption of crypto- invasive approach," Neuromodulation, vol. 7, no. 3, pp. 193-196, 2004.graphic protocols that enable communication between a [10] NFC Forum. NFC forum. [Online]. Available: http://www.nfc-medical device and authorized readers, but inhibit the device forum.org

[11] C. Niu, H. Hao, L. Li, B. Ma, and M. Wu, "The transcutaneous chargerfrom responding in any manner to a unauthorized queries, for implanted nerve stimulation device," in Proc. IEEE EMBS, 2006,In their provocatively titled paper Is Your Cat Infected with pp. 4941-4944.

a Computer Virus [15], Rieback, Crispo, and Tannenbaum [12] D. Patterson, R. Thirlby, and M. Dobrio, "High-frequency gastric stim-ulation in a patient with diabetic gastroparesis," Diabetic Medicine,argue that RFID/NFC devices, like other networked systems, vol. 21, no. 2, p. 195, Feb 2004.

are vulnerable to various forms of attack by malicious soft- [13] A. S. Y. Poon, S. O'Driscoll, and T. H. Meng, "Optimal operatingware. We observe that a successful attack upon an implanted frequency in wireless power transmission for implantable devices," in

medical device couldisuptits c. TProc. IEEE EMBS, 2007.medical device could disrupt its life-critical functions. Thus, [14] RFID Gazette. VeriChip sticks it to diabet-it is imperative that these systems be rigorously engineered ics with glucose-sensing chip. [Online]. Available:and incorporate robust cryptographic access control mecha- http://www.rfidgazette.org/2006/10/verichip-sticks.htmlnisms. [15] M. R. Rieback, B. Crispo, and A. S. Tannenbaum, "Is your cat infectednisms. with a computer virus," in Proc. PERCOM. IEEE, 2006.We observe that field-powered devices provide a unique [16] J. Riistama, J. Visnen, S. Heinisuo, J. Lekkala, and J. Kaihilahti,

robustness to a radio-based power consumption attack: A "Evaluation of an implantable ecg monitoring device in vitro and invivo," in Proc. IEEE EMBS, 2007.conventional radio system must expend energy processing, [17] R. Spring, E. Freudenthal, and L. Estevez, "Practical techniques

and possibly replying to incoming messages. Therefore, a for limiting disclosure of rf-equipped medical devices," in Proc.such systems can be vulnerable to malicious radio requests Engineering in Medicine and Biology Workshop. IEEE, Novemberintended simply to expend the devices limited power re-

2007.inpower re- [18] M. Vailyadis. (2006, May) Pacemaker and auto-

sources. In contrast the communication subsystems of field- matic internal cardiac defibrillator. [Online]. Available:powered devices require no local power source and thus are http://www.emedicine.com/emerg/topic8O5.htmimmune to this type of attack. [19] G. Wang, G. Yang, N. Volkow, Y. Telang, F.and Ma, W. Zhu, C. Wong,D. Tomasi., P. Thanos, , and J. Fowler, "Gastric stimulation in obese

VI. SYNOPSIS subjects activates the hippocampus and other regions involved in brainVI.SYNOPSIS reward circuitry," in Proc. PNAS, 2006.

As confirmed by experiments with commodity transpon-ders and scanners, 13.56 MHz RFID is suitable for personalmedical networks including implanted devices. However,as with other applications of distributed systems, this con-nectivity can enable the unintended disclosure of privateinformation (including evidence of whereabouts and healthstatus) and corruption of system integrity.

Since the detection of implanted RFID may provide evi-dence of compromised health, and the corruption of deviceintegrity can be harmful to implantee health, it is imperativethat appropriate safeguards and engineering practices arerigorously applied.

54