Cyber securitY tooLbox for COnnected MEdical Devices

Informazioni relative al progetto

CYLCOMED

ID dell’accordo di sovvenzione: 101095542

DOI

10.3030/101095542

Progetto chiuso

Data della firma CE 28 Novembre 2022

Data di avvio 1 Dicembre 2022

Data di completamento 30 Novembre 2025

Finanziato da

• Health

Costo totale

€ 3 489 625,01

Contributo UE

€ 3 489 625,00

Coordinato da

CHARITE - UNIVERSITAETSMEDIZIN BERLIN
Germany

Periodic Reporting for period 2 - CYLCOMED (Cyber securitY tooLbox for COnnected MEdical Devices)

Periodo di rendicontazione: 2024-06-01 al 2025-11-30

Sintesi del contesto e degli obiettivi generali del progetto

CYLCOMED addresses the overall ambitious goal of strengthening the cybersecurity of connected, in vitro diagnostic and software as medical devices (CMDs, IVDs, SaMD), maintaining their performance and safety for patients and preserving or enhancing the confidentiality, integrity and availability of private data they exchange or allow to be remotely accessed and focusing on humans operating the technology as the weakest link in the chain for security and privacy, with training and awareness measures tailored to healthcare staff needs. It does so by enabling adoption by all ecosystem stakeholders of technologically sovereign and trustworthy cybersecurity methodologies and toolboxes for connected medical devices and the environments in which they are managed and operate (platforms), complemented with fit-for-purpose guidance covering identified risks and gaps.

Lavoro eseguito dall’inizio del progetto fino alla fine del periodo coperto dalla relazione e principali risultati finora ottenuti

Work Package 1 ensured that the project is managed efficiently and effectively, leading to successful delivery of expected outcomes within a collaborative consortium
Specifically in RP2 we delivered D1.3 Updated Data Management Plan.
Key results:
FAIR Principles Adherence, Ethical and Legal Compliance, Pilot and Toolbox Documentation, Long-term Preservation and Reuse

WP2 Ethics
Deliverable D2.3 assessed the legal and ethical considerations of the CYLCOMED project by evaluating the implementation of requirements identified in Deliverables D2.1 and D2.2. It highlighted gaps in the existing regulatory framework and provided policy recommendations, with particular emphasis on the MDCG 2019-16 Guidance on Cybersecurity for Medical Devices.

WP3 Requirements finalization and Initial guidelines
Description: This task has defined the final set of functional, non-functional, and end-user requirements for the CYLCOMED toolbox that has been elicited in relation to the legal and ethical requirements defined in WP2 so that the design technical solution considers different aspects regarding needed functionalities, compliance to the current regulations, performance, user-friendly and usability.
It has conducted an in-depth analysis specific to end-user operational domains in which CMD/IVD/SaMD integrate, covering all risk classes and corresponding threats, and attacks with potential propagation effects to map in detail the tools to act as effective countermeasures.

WP4 Risk Management
Results reported: Final release of the CYLCOMED risk management tool – a tool with the purpose of enabling agile processes of risk management in healthcare, general enough to be used with the analyzed risk management frameworks;
CYLCOMED benefit-risk analysis scheme, with the CYLCOMED Cybersecurity Risk Management framework supporting the analysis, as well as annexes covering the cybersecurity risks of emerging technologies;


WP5 Toolbox
Key Results M19-M36:
• Final architecture of LADS and LOMOS
• Implementation, testing and verification of new functionalities for LADS (RabbitMQ message broker, GUI-Dashboard)
• Provided updated docker images for LADS (https://github.com/Cylcomed/LADS) and LOMOS (https://github.com/Cylcomed/lomos-base-deployment; CLI: https://github.com/Cylcomed/lomos-cli).
• Successful deployment, integration and testing of LADS and LOMOS components in Pilot 1 and Pilot 2 (Hospitals).

WP 6 Clinical Studies
In RP2 the pilots successfully delivered a validated and clinically aligned cybersecurity solution ready for further development. These are the major results achieved:
Pilot 1: Testing verified that the incorporation of cybersecurity components (such as FE4MED and C-OPA) did not alter the essential safety functionalities or performance of the medical system.
Pilot 2: Deployment A successfully enrolled 12 patients with heart failure, proving the system's clinical utility in 45% of cases by facilitating therapy adjustments and enhancing patient adherence.
Qualitative interviews confirmed high relevance and acceptance among clinical and technical staff.

WP 7: Dissemination, communication, and exploitation
• Strong website engagement (over 10k page views), high time on site (over 2 minutes), LinkedIn and X impressions (around 9k and 5k respectively).
• Nearly all communication and dissemination KPIs have been met (except for publications, posters, and followers' numbers).
• Engagement and visibility, including participation in high-level events and synergies with the cluster projects.
• Most exploitation and standardisation KPIs have been met.

Progressi oltre lo stato dell’arte e potenziale impatto previsto (incluso l’impatto socioeconomico e le implicazioni sociali più ampie del progetto fino ad ora)

During RP2, significant advancements were made across various components of the CYLCOMED cybersecurity toolbox. One of the key innovations is the development of AI-based log monitoring methods using unsupervised machine learning to model normal CMD behavior on the network, allowing for the detection of potential attacks or malfunctions without relying on predefined rules. This led to successfully integrating the Live Anomaly Detection System (LADS) with Docker and Kubernetes environments, ensuring comprehensive analysis of the deployment environment. The training process was optimized to enable deployment on lower-end hardware like NUCs, maintaining model accuracy and performance.

In addition, the project developed tools for secure management of connected medical solutions, ensuring devices are up-to-date with security patches and configurations through over-the-air updates. This was achieved using an infrastructure-as-code approach, deploying Mender Server, Workstation, and Client for performing these updates to target machines like Ubuntu and Raspberry Pi. This approach allows for zero-touch operation, significantly enhancing the security and efficiency of device management.

Moreover, the project focused on designing and implementing decentralised, user-centric identity management and access control solutions based on Self-Sovereign Identity (SSI) and Attribute-Based Encryption (ABE). These solutions ensure secure identity management and privacy-friendly data exchange among devices and healthcare providers. The successful implementation and deployment of key generator, encryption/decryption modules, and secure data access flow were achieved, with initial integration and testing on RGB infrastructure.

Another significant development was the incorporation of security features into a standard external Linux-based board connected to medical monitoring devices. This approach avoids the need for re-certification of existing medical devices while ensuring robust security. The integration of ATOS’s encryption tools for secure data storage and transmission was a key achievement, with functional prototypes of security modules developed and initial testing completed.

We completed the clinical study per WP6.
In RP2 the pilots successfully delivered a validated and clinically aligned cybersecurity solution ready for further development.