Use Case: Secure Patient Monitor on i.MX 8M Plus

A modern patient monitor is connected to the hospital network, displays complex data in real time and has a USB port for exporting measurements. Every one of those features adds value to the product — and every one adds an attack surface. To show how our portfolio addresses this in practice, we built a fully working patient monitor from products we supply. We call this a Logic Solution.

Background

The products Logic Technology supplies are the building blocks for your own application or intelligent product. Individually, each product solves a specific development challenge. When combined, they can form a complete, working system. This demo brings together a computer module, a UI framework solution and a runtime security layer into one connected medical device.

Challenge

A connected medical device has to meet three demands at once:

• Reliable hardware and OS that is ready to develop from day one, without months of board support development.
• A clear, responsive user interface for complex data — without the software team spending its time on implementing the visual details.
• Protection against attacks through the network connection and the USB port, two entry points that a patient monitor cannot do without.

Solution

The hardware core At the heart of the application is a TX8P computer module from our partner Ka-Ro electronics, mounted on the standard MIPI-LVDS development baseboard and connected to a 1280×800 touch display. This standard evaluation platform is built around an NXP i.MX 8M Plus application processor. The operating system is Linux based on Yocto, delivered plug-and-play together with a full featured BSP.

The user interface The UI was built with Storyboard Designer from our partner Crank Software. Storyboard lets teams design powerful UIs from scratch or import designs from tools such as Photoshop, Sketch or Illustrator. A well-documented API and a compact graphics engine decouple the design process from software integration. Graphic designers own the look and feel and see the effect of changes on the fly — even before the hardware is ready — while software engineers concentrate on application logic and the hardware interface.

The security layer To protect the device against attacks, Exein Runtime from our partner Exein has been added to the Linux kernel. Exein Runtime is a state-of-the-art runtime threat detection and incident response solution for intelligent systems, built on top of the open source IoT runtime security framework. At its core, it is a rule-based system that monitors the vital parts of an embedded system and responds to abnormal behaviour. Exein Runtime reports the abnormal behavior to a cloud service for further analysis.

The demo in practice

The patient monitor shows a graphical view of vital signs, with a simulated course of heart rate, blood pressure, oxygen saturation and more. Additional screens include a patient file with interactive 3D scans, an infusion control screen, and a system screen with physician reports, a secured section and system information.

Then an untrusted USB dongle is inserted. Before the system can access any file on it:

1. An incident report is sent to a cloud-based environment.
2. As a precaution, the system enters security lockdown and the network connection is cut.
3. A traffic-light indicator switches to red to show the lockdown status.

The Exein dashboard in the cloud environment gives a real-time overview of all connected devices of this product type in the world and their status. Incidents can be analysed by an AI engine, which proposes how to address the breach or vulnerability — for example an adjusted runtime script or a patch. The developer integrates this into their CI/CD environment, after which a firmware update can be rolled out to the devices, for example over the air (OTA).

Results

• Fast start: a plug-and-play platform with Yocto Linux and BSP, ready for application development.
• Parallel workflow: UI design and software integration run independently, shortening the path to a working interface.
• Security built in: threats are detected and contained at runtime, with a closed loop from incident to analysis to update.

One of many possible Logic Solutions

This patient monitor is just one example of what can be built with the computer modules, software stacks, and development and test tools in our portfolio. This demo could for instance be enhanced with a reliable encrypted filesystem from Tuxera to ensure that the data gathered remains consistent and safe at all times, or the eXtremeDB/rt realtime embedded database from McObject for fast throughput and filtering options.

Working on a connected device of your own? We are happy to think along about the right combination of building blocks.

There is always a Logic Solution!