Subject: [Ecrit] Your feedback on an Internet of Things Health Monitoring Use Case

From: "Hannes Tschofenig" <[email-masked]>
Date: Thu, 6 Feb 2014 10:23:41 +0100 (CET)

Hi all, 

I am going to chair a BoF at the next IETF meeting related to Internet of Things authentication and authorization. Folks in the group are currently collecting use cases to derive requirements and the following emergency services related use case was brought forward. It would be great if the emergency services community could take a look at it and give me feedback whether you consider this use case realistic, whether you have heard about projects working on these topics, whether you have seen other approaches providing similar functionality, etc. 

Here is the relevant text from http://tools.ietf.org/html/draft-seitz-core-sec-usecases-00: 
---------
2.3. Personal Health Monitoring

The use of wearable health monitoring technology is expected to grow strongly, as a multitude of novel devices are developed and marketed. These devices are typically battery driven, and located physically on the user. They monitor some bodily function, such as e.g. temperature, blood pressure, or pulse. They are connected to the Internet, either through an intermediary base-station or directly, using wireless technologies. Through this connection they report the monitored data to some entity, which may either be the user herself, or some medical personnel in charge of the user.

Medical data has always been considered as very sensitive, and therefore requires good protection against unauthorized disclosure. A frequent, conflicting requirement is the capability for medical personnel to gain emergency access, even if no specific access rights exist.  As a result, the importance of secure audit logs increases in such scenarios. Since the users are not typically trained in security (or even computer use), the configuration must use secure default settings, and the interface must be well adapted to novice users.  Also the system must require very little maintenance, so e.g. frequent changes of battery are unacceptable.

2.3.1 John and the heart rate monitor

John has a heart condition, that can result in sudden cardiac arrests. He therefore uses a device called HeartGuard that monitors his heart rate and his position. In case of a cardiac arrest it automatically sends an alarm to an emergency service, transmitting John's current location. The device also functions as a implanted cardioverter defibrilator, i.e. it can deliver a shock in order to try and normalize Johns heart rate. John can configure additional persons that get notified in an emergency, for example his daughter Jill. Furthermore the device stores data on John's heart rate, which can later be accessed by a physician to assess the condition of John's heart. However John is a rather private person, and is worried that Jill might use HeartGuard to monitor his location while there is no emergency. Furthermore he doesn't want his health insurance to get access to the HeartGuard data, since they might refuse to renew his insurance if they decided he was too big a risk for them.

---------

Ciao
Hannes

---

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 7 Feb 2014 14:48:18 +0000

We expect emergency services to have credentials in a PKI with known (per country) roots of trust.  That will be helpful in this scenario.  I think you want to differentiate between unmediated and mediated access.  Mediated access means there is some service between the device and the emergency services.  That is the most common scenario today.  Whether unmediated access becomes common in the future is speculation.  I kind of hope it does, but not too optimistic.  Too much revenue opportunities are lost when vendors allow direct access.

Brian

On Feb 6, 2014, at 4:23 AM, Hannes Tschofenig <[email-masked]> wrote:

> _______________________________________________
> Ecrit mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ecrit

---

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 7 Feb 2014 14:48:31 +0000

Brian

---

From: Paul Kyzivat <[email-masked]>
Date: Fri, 07 Feb 2014 11:47:10 -0500

Every time I see an add for home security services (where they want to 
tap my bank account every month even though I might go years without an 
event) I wonder why I can't have a home security system that makes 
automated emergency calls direct to the public emergency services. (And 
same for the "Help, I've fallen and can't get up" services.)

Is there something that prevents that? I guess that a home security 
system that worked that way might result in many false alarms that might 
annoy the police or fire services. But is it illegal?

	Thanks,
	Paul

On 2/7/14 9:48 AM, Rosen, Brian wrote:
>> John has a heart condition, that can result in sudden cardiac arrests. He therefore uses a device called HeartGuard that monitors his heart rate and his position. In case of a cardiac arrest it automatically sends an alarm to an emergency service, transmitting John's current location. The device also functions as a implanted cardioverter defibrilator, i.e. it can deliver a shock in order to try and normalize Johns heart rate. John can configure additional persons that get notified in an emergency, for example his daughter Jill. Furthermore the device stores data on John's heart rate, which can later be accessed by a physician to assess the condition of John's heart. However John is a rather private person, and is worried that Jill might use HeartGuard to monitor his location while there is no emergency. Furthermore he doesn't want his health insurance to get access to the HeartGuard data, since they might refuse to renew his insurance if they decided he was too big a risk !
>   for them.
>>
>> ---------
>>
>> Ciao
>> Hannes
>>

---

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 7 Feb 2014 16:50:42 +0000

Yes.  Too many false positives.  There are actually laws in some jurisdictions that prohibit devices from autodialing emergency calls.  As we improve sensors, we can make it possible for that to happen.  The “Data Only” or “Non Human Initiated” calls are designed for that.  The emergency services folks are concerned by any form of autodialing, but if we give them appropriate controls, I think we can gain acceptance.

Brian

On Feb 7, 2014, at 11:47 AM, Paul Kyzivat <[email-masked]> wrote:

> Every time I see an add for home security services (where they want to tap my bank account every month even though I might go years without an event) I wonder why I can't have a home security system that makes automated emergency calls direct to the public emergency services. (And same for the "Help, I've fallen and can't get up" services.)
> 
> Is there something that prevents that? I guess that a home security system that worked that way might result in many false alarms that might annoy the police or fire services. But is it illegal?
> 
> 	Thanks,
> 	Paul
>

---

From: "DRAGE, Keith (Keith)" <[email-masked]>
Date: Mon, 10 Feb 2014 17:56:39 +0000

Every country is different.

For example, in the UK, burglar alarms may be connected to the police emergency control room, but this is not an emergency call and does not use the emergency network. Other burglar alarms go to a private control room.

Again, for the UK, medical devices dial a private control room, and it is the control room that decides whether to make an emergency call for an ambulance.

Keith 

> -----Original Message-----
> From: Ecrit [mailto:[email-masked]] On Behalf Of Rosen, Brian
> Sent: 07 February 2014 16:51
> To: Paul Kyzivat
> Cc: ECRIT
> Subject: Re: [Ecrit] Your feedback on an Internet of Things 
> Health Monitoring Use Case
> 
> Yes.  Too many false positives.  There are actually laws in 
> some jurisdictions that prohibit devices from autodialing 
> emergency calls.  As we improve sensors, we can make it 
> possible for that to happen.  The "Data Only" or "Non Human 
> Initiated" calls are designed for that.  The emergency 
> services folks are concerned by any form of autodialing, but 
> if we give them appropriate controls, I think we can gain acceptance.
> 
> Brian
> 
> > tap my bank account every month even though I might go 
> years without 
> > an event) I wonder why I can't have a home security system 
> that makes 
> > automated emergency calls direct to the public emergency services. 
> > (And same for the "Help, I've fallen and can't get up" services.)
> > 
> > Is there something that prevents that? I guess that a home 
> security system that worked that way might result in many 
> false alarms that might annoy the police or fire services. 
> But is it illegal?
> > 
> > 	Thanks,
> > 	Paul
> > 
> >> We expect emergency services to have credentials in a PKI 
> with known (per country) roots of trust.  That will be 
> helpful in this scenario.  I think you want to differentiate 
> between unmediated and mediated access.  Mediated access 
> means there is some service between the device and the 
> emergency services.  That is the most common scenario today.  
> Whether unmediated access becomes common in the future is 
> speculation.  I kind of hope it does, but not too optimistic. 
>  Too much revenue opportunities are lost when vendors allow 
> direct access.
> >> 
> >> Brian
> >> 
> >>> I am going to chair a BoF at the next IETF meeting 
> related to Internet of Things authentication and 
> authorization. Folks in the group are currently collecting 
> use cases to derive requirements and the following emergency 
> services related use case was brought forward. It would be 
> great if the emergency services community could take a look 
> at it and give me feedback whether you consider this use case 
> realistic, whether you have heard about projects working on 
> these topics, whether you have seen other approaches 
> providing similar functionality, etc.
> >>> 
> >>> Here is the relevant text from 
> http://tools.ietf.org/html/draft-seitz-core-sec-usecases-00:
> >>> ---------
> >>> The use of wearable health monitoring technology is 
> expected to grow strongly, as a multitude of novel devices 
> are developed and marketed. These devices are typically 
> battery driven, and located physically on the user. They 
> monitor some bodily function, such as e.g. temperature, blood 
> pressure, or pulse. They are connected to the Internet, 
> either through an intermediary base-station or directly, 
> using wireless technologies. Through this connection they 
> report the monitored data to some entity, which may either be 
> the user herself, or some medical personnel in charge of the user.
> >>> 
> >>> Medical data has always been considered as very 
> sensitive, and therefore requires good protection against 
> unauthorized disclosure. A frequent, conflicting requirement 
> is the capability for medical personnel to gain emergency 
> access, even if no specific access rights exist.  As a 
> result, the importance of secure audit logs increases in such 
> scenarios. Since the users are not typically trained in 
> security (or even computer use), the configuration must use 
> secure default settings, and the interface must be well 
> adapted to novice users.  Also the system must require very 
> little maintenance, so e.g. frequent changes of battery are 
> unacceptable.
> >>> 
> >>> John has a heart condition, that can result in sudden 
> cardiac arrests. He therefore uses a device called HeartGuard 
> that monitors his heart rate and his position. In case of a 
> cardiac arrest it automatically sends an alarm to an 
> emergency service, transmitting John's current location. The 
> device also functions as a implanted cardioverter 
> defibrilator, i.e. it can deliver a shock in order to try and 
> normalize Johns heart rate. John can configure additional 
> persons that get notified in an emergency, for example his 
> daughter Jill. Furthermore the device stores data on John's 
> heart rate, which can later be accessed by a physician to 
> assess the condition of John's heart. However John is a 
> rather private person, and is worried that Jill might use 
> HeartGuard to monitor his location while there is no 
> emergency. Furthermore he doesn't want his health insurance 
> to get access to the HeartGuard data, since they might refuse 
> to renew his insurance if they decided he was too big a risk !
> >>  for them.
> >>> 
> >>> ---------
> >>> 
> >>> Ciao
> >>> Hannes
> >>>

---

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 10 Feb 2014 17:58:46 +0000

That¹s pretty much how it works in the US

Brian

On 2/10/14, 12:56 PM, "DRAGE, Keith (Keith)"
<[email-masked]> wrote:

>For example, in the UK, burglar alarms may be connected to the police
>emergency control room, but this is not an emergency call and does not
>use the emergency network. Other burglar alarms go to a private control
>room.
>
>Again, for the UK, medical devices dial a private control room, and it is
>the control room that decides whether to make an emergency call for an
>ambulance.
>
>Keith 
>