For manufacturers of medical devices and for operators of complex device technologies, such as hospitals, medical offices, diagnostic centres and service providers in the healthcare sector, the secure connection of high-tech medical devices is playing an increasingly important role. However, in addition to improved medical care, this network also leads to more attack surfaces and targets for cyberattacks. Building on a device landscape that in part does not have adequate or homogeneous security standards for data storage and exchange leads to a constantly growing threat and risk potential for both manufacturers and operators of medical devices.

A particular challenge for IoMT devices is that software updates in PCs, laptops and tablets commonly used in the office IT world cannot be transferred to medical devices. Medical devices are intended to save or prolong lives, are sometimes constantly in use and do not always operate in online mode. For example, complex medical diagnostic devices that are part of the network of an operating room often remain at the deployment site for a long time and are thus subject to the ageing of the software and of the protective measures against cyber attacks. Furthermore, they must meet data protection requirements and, depending on their classification, require product approval by a third party.

The project "Security for the Internet of Medical Things", or "Sec4IoMT" for short, is looking for solutions to ensure permanent protection against cyber attacks in the future as well as to make it economically viable. For example, it should be possible to update software, firmware, crypto libraries, certificates and keys for larger numbers of medical devices for different users without invalidating the product approval. The (further) development of appropriate tools for the proactive protection of software components through licensing and of sensitive keys are goals on the way to practical and economic solutions for the long-term preservation of the security of IoMT devices.

Within the Sec4IoMT project, the ITS is concentrating on ensuring security with a focus on the security of the update mechanism, as updates have the power to open up security gaps with serious consequences. Thus, possible threats and resulting requirements for the cryptographic primitives are identified as well as suitable architectural concepts. Special attention is given to the possible use of PQC algorithms and MPC-in-the-head protocols. Furthermore, the ITS is involved in the implementation of a demonstrator, which brings together the knowledge gained so far regarding automated software updates and crypto upgrades.