Source-linked AI summary
To Make a Robot Secure: An Experimental Analysis of Cyber Security Threats Against Teleoperated Surgical Robots
Tamara Bonaci, Jeffrey Herron, Tariq Yusuf, Junjie Yan, Tadayoshi Kohno, Howard Jay Chizeck
TL;DR
Remote and extreme uses of teleoperated surgery raise questions about cyberattacks, while the actual risks remain poorly understood. The paper experimentally analyzes attacks and defenses on Raven II, demonstrating malicious control and one-packet E-stop attacks. It also finds existing security mechanisms can be incorporated with modest memory overhead while maintaining real-time responsiveness, though security, safety, and usability can conflict.
Problem
Teleoperated surgery is envisioned for remote and extreme settings, but the actual risks of compromising these systems remain poorly understood.
Source: §1 · p. 1Method
The authors experimentally analyze Raven II, identifying attack classes and characterizing their attack surfaces and practical impacts.
Source: §1 · p. 2Results
Experiments demonstrate malicious control of robot functions, surgeon-input override, and efficient one-packet E-stop denial-of-service attacks.
Source: §1 · p. 2Takeaways & Limitations
The E-stop can protect safety in benign use yet be abused to reduce safety for patients, operators, and robots.
Source: §1 · p. 2Security, safety, and usability tensions may make existing solutions infeasible; encrypting and authenticating video feedback may unacceptably reduce packet throughput.
Source: §7 · p. 10
Abstract
from arXiv · showhide
Teleoperated robots are playing an increasingly important role in military actions and medical services. In the future, remotely operated surgical robots will likely be used in more scenarios such as battlefields and emergency response. But rapidly growing applications of teleoperated surgery raise the question; what if the computer systems for these robots are attacked, taken over and even turned into weapons? Our work seeks to answer this question by systematically analyzing possible cyber security attacks against Raven II, an advanced teleoperated robotic surgery system. We identify a slew of possible cyber security threats, and experimentally evaluate their scopes and impacts. We demonstrate the ability to maliciously control a wide range of robots functions, and even to completely ignore or override command inputs from the surgeon. We further find that it is possible to abuse the robot's existing emergency stop (E-stop) mechanism to execute efficient (single packet) attacks. We then consider steps to mitigate these identified attacks, and experimentally evaluate the feasibility of applying the existing security solutions against these threats. The broader goal of our paper, however, is to raise awareness and increase understanding of these emerging threats. We anticipate that the majority of attacks against telerobotic surgery will also be relevant to other teleoperated robotic and co-robotic systems.
1 Introduction
As teleoperated surgery is envisioned for remote and extreme settings, the paper addresses the limited understanding of its actual cyber risks. It experimentally analyzes Raven II attacks and defenses, finding that attacks can disrupt procedures and exploit the safety feature of the E-stop.
1 Introduction
- Remote surgical robots are envisioned for battlefields, disasters, and rural settings, while prior work had left the actual security risks poorly understood.Earlier approaches had focused mainly on private communication and verifying robot-side code.Source: §1 · pp. 1–2
- The study identifies three attack classes—intention modification, intention manipulation, and hijacking—and characterizes their exposed attack surfaces.The classes distinguish changes to surgeon messages, changes to robot feedback, and actions that make the robot ignore the surgeon.Source: §1 · p. 2
- Experiments show attackers can maliciously control robot functions or completely ignore or override the surgeon’s inputs.The analysis assesses practical attack examples and their impact on surgical procedures.Source: §1 · p. 2
- The authors experimentally examine proposed security solutions and report that they can be applied without significant impact on system usability or performance.The paper also considers attacker cost and benefit and discusses possible legal implications for surgeons, hospitals, and manufacturers.Source: §1 · p. 2
- The E-stop’s safety role can be inverted under attack: an attacker may abuse it to reduce safety for patients, operators, and robots.The authors report that this can support efficient, one-packet denial-of-service attacks.Source: §1 · p. 2
2 Related Work
The section introduces Raven II’s robot, control, and communication architecture, then surveys security work on networked control, medical systems, and teleoperated surgery.
2.1 Raven II R ⃝Surgical Robot
- Raven II uses two seven-degree-of-freedom manipulators, with base-mounted DC motors and power-off brakes on the first three axes.Its software runs a 1000 Hz servo loop; surgeon inputs and video and haptic feedback use the Interoperable Telesurgery Protocol (ITP).Source: §2.1 · pp. 2–3, Figure 1 · p. 3
- Raven II has been operated in extreme environments, including an internet-controlled Mojave deployment with a UAV-enabled wireless final link.Reliable performance was associated with latency, jitter, packet delays, out-of-order arrivals, packet losses, and device failures; open networks also expose links to disruption or takeover.Source: §2.1 · p. 3
2.2.1 Security of Networked Control Systems
- Networked-control research uses system dynamics, including linear-system assumptions with an optimal controller and Kalman filter, to target attack detection probabilities.The approach trades off cost assumptions against the probability of detecting attacks.Source: §2.2.1 · p. 3
2.2.2 Security of Medical Systems
- Medical-security work has addressed confidentiality of patient data and vulnerabilities that can expose information or change implantable-device settings affecting health.Examples include multimedia medical data and attacks on pacemakers and implantable cardioverter-defibrillators.Source: §2.2.2 · p. 3
2.2.3 Security of Telereobotic Surgery
- Telerobotic-surgery proposals have covered robot-side code verification, communication privacy and reliability, and TLS protection for ITP confidentiality, authentication, and authorization.These efforts followed recognition of the field’s security importance.Source: §2.2.3 · p. 4
3 Vulnerability Analysis
The analysis focuses on communication attacks in a setting where remote surgery may use open, wireless, or otherwise uncontrollable links. It classifies attacks by their effects on surgeon intent and by the attacker’s network role.
3.1 Attacker Model
- The attacker model considers endpoint compromise and network attacks, then focuses on disrupting or manipulating surgeon-robot communications as the more feasible route.The likely attack point is between the network uplink and robot, where wireless traffic can be disrupted or manipulated.Source: §3.1 · p. 4
3.2 Attack Classification
- Intention modification alters surgeon messages in flight, intention manipulation changes robot feedback, and hijacking makes the robot ignore the surgeon’s intent.Modification can cause observable unusual movements or delays; manipulated feedback may be subtler and can make valid surgeon actions harmful, while hijacking may be discreet or noticeable.Source: §3.2 · pp. 4–5
- Attackers are classified as network observers, who eavesdrop and inject while benign parties remain directly connected, or intermediaries, who prevent direct communication.A network intermediary is a man-in-the-middle attacker; ARP poisoning is one stated real-world method.Source: §3.2 · p. 5
4.1 Experimental Setup
The experiments place an external attacking computer on the same subnetwork as the surgical console and Raven II, enabling observation and modification of their communications.
4.1 Experimental Setup
- A network hub connects the surgical control console and Raven II, while an external computer joins their subnetwork to observe or modify traffic.Figure 3 depicts the experimental setup.Source: §4.1 · p. 5, Figure 3 · p. 5
- The attacking computer runs either Kali Linux or Windows 7 SP3.The platform options are shown in the experimental setup.Source: §4.1 · p. 5, Figure 3 · p. 5
- Attack implementations use either C# or Python with the Scapy framework.The experimental setup uses these languages and framework for the analyzed attacks.Source: §4.1 · p. 5, Figure 3 · p. 5
4.2 Experiment Description
The experiments used a simplified block-transfer task to focus on attack impacts rather than participant proficiency. Participants moved three blocks from left to right without required hand-to-hand transfers.
4.2 Experiment Description
- Twenty engineering students aged 19–28 participated; the authors note that their behavior may differ from surgeons, while citing evidence of similar proficiency after practice on simple tasks.The study had University of Washington IRB approval.Source: §4.2 · p. 5
- The standard FLS task moves six blocks left-to-right and back, but the experiments simplified it to three left-to-right transfers.Participants could choose either grasper and were not required to transfer blocks between hands.Source: §4.2 · pp. 5–6
- Figure 4 shows the pegboard positions used: participants moved a block from left-side position 4, 5, or 6 to right-side position 2, 3, or 6.Source: Figure 4 · p. 6
4.3 Intent Modification Attacks
The section evaluates attacks that reorder, drop, delay, or modify surgeon commands. These network-mediated changes can disrupt robot motion and task performance, though participants often adapted to modified commands.
4.3 Intent Modification Attacks
- The attacks use a man-in-the-middle proxy to reorder, drop, delay, or modify surgeon packets before forwarding them to Raven.Delay tests varied constant, uniform, and Gaussian delays; task times and subjects’ difficulty assessments were recorded.Source: §4.3 · p. 6, §4.3.3 · p. 7
4.3.1 Surgeon’s Intent Reordering
- Randomly reordering surgeon packets makes Raven skip out-of-sequence messages, producing immediately observable jerky arm motion despite negligible queue delay.Source: §4.3.1 · p. 6
4.3.2 Surgeon’s Intent Loss
- For individual packet drops, η ≥0.55 generally left the robot operable but difficult to use, while η=0.9 made it almost unusable for small, precise movements.For groups of 100 packets, η ≤0.2 left the robot generally operable but its movements jerky.Source: §4.3.2 · p. 6
4.3.3 Surgeon’s Intent Delay
- Delays increased task completion time by an average of 5 times, with Gaussian delays of 100–250 ms appearing most severe in preliminary results.With 10 subjects, the no-delay cases differed significantly, but the study could not distinguish difficulty among delay types; most subjects rated the 100–250 ms Gaussian delay hardest, with one clear outlier.Source: §4.3.3 · p. 7
4.3.4 Surgeon’s Intent Modification
- Subjects rated task difficulty on a 0–7 scale across reaching, grasping, moving blocks, and overall task performance; five subjects supplied results for modification attacks.Source: §4.3.3 · p. 7, §4.3.4 · p. 7, Figure 5 · p. 8
- Most command modifications were immediately noticeable; changing grasp state by even one packet had a profound task impact, while position changes within allowed limits were less noticeable.Excessive or too-fast position changes triggered current clipping and slower motion; participants completed tasks and adapted within 1–1.5 seconds, though random combinations caused errors including dropped blocks and E-stop triggers.Source: §4.3.4 · pp. 7–8
4.4 Hijacking Attacks
A hijacking attacker can take control by injecting packets with a leading sequence number, and can abuse the software E-stop to prevent a proper reset. Repeated malicious leading packets can keep the robot stopped and make a procedure impossible.
4.4 Hijacking Attacks
- A single observed packet provided the current sequence number; an injected packet with a random offset under 1000 let the attacker take control as Raven ignored the surgeon’s packets.The takeover persisted until the sequence number wrapped around, provided the system did not lose more than a second of data.Source: §4.4 · p. 8
- A malicious leading packet that commands excessive speed or a forbidden position can trigger E-stop; repeating it can prevent proper reset and make surgery impossible.Source: §4.4 · p. 8
5 Mitigation Strategies
The authors recommend securing communications between operator and robot, including encryption and authentication. Their intermediary-based AES test found no noticeable CPU increase and an average 3000KB increase in memory usage, though the setup does not reproduce encryption closer to the endpoints.
5 Mitigation Strategies
- Valid packets from any source enabled injection attacks, so communications should be protected against spoofing, including attackers that forge source IP and port information.Source: §5 · pp. 8–9
- Encrypting and authenticating data streams can severely hamper intention modification, manipulation, and hijacking attacks; out-of-band communication may support exchanging private authentication information.Source: §5 · p. 9
- AES encryption tests on an intermediary showed no noticeable CPU increase and an average memory increase of 3000KB, with no significant memory difference across 128-, 192-, and 256-bit keys.The authors caution that this intermediary setup may not match encryption performed closer to the surgeon and robot.Source: §5 · p. 9
6 Discussion
The attacks raise risks to patients, surgeons, robots, and patient privacy, while exposing tensions between emergency-stop safety, real-time control, and security. The discussion proposes targeted mitigations, including packet-rate limits, protocol changes, and network monitoring.
6.1 Implications of Presented Attacks
- Compromised systems could expose patients to injury and privacy risks, complicate surgeons’ legal responsibility, damage robots or equipment, and undermine public trust in surgical robotics.Modified haptic feedback may lead a surgeon to harm a patient, while video and haptic streams may contain private patient information.Source: §6.1 · p. 9
6.2 Challenges and Recommendations
- An E-stop can improve safety in benign use yet be abused by an attacker to render a robot unusable, making its safety role a security challenge.Leading packets with a sufficiently large change may permanently E-stop the system.Source: §6.2 · pp. 9–10
- Because teleoperated robots execute command packets on receipt, bursts can cause fast, jerky motion that may wear joints and motors or endanger a patient; the authors propose limiting processing rate.The proposed rate should be high enough not to be reached in benign scenarios, but low enough to protect against command floods.Source: §6.2 · p. 10
- Datagram protocols support fast operation and tolerate occasional benign packet loss, but an attacker may selectively drop packets to cause harm while conserving resources.The authors note that datagram protocols are likely to remain preferred, so mitigation is still needed.Source: §6.2 · p. 10
- Encrypting and authenticating all surgeon-robot communications may mitigate many attacks, but encrypting the video feedback channel may conflict with real-time operation and patient privacy.The authors recommend authenticating all packets at minimum on systems operating over public networks.Source: §6.2 · p. 10
- For ITP, sequence-number processing changes and checksum checking are described as minimal security improvements that would preserve interoperability.The changes could prevent sequence-number leading and operator-intent modification attacks, respectively.Source: §6.2 · p. 10
- Monitoring link and network status could reveal multiple data streams or increased out-of-order packets, while a more advanced mechanism could help prevent some denial-of-service attacks.The described denial-of-service attacks saturate network resources, delaying or dropping packets.Source: §6.2 · p. 10
7 Conclusion
The Raven II experiments demonstrate serious vulnerabilities, including attacks that can be executed with a single packet, and show that some established security mechanisms can be applied with modest memory overhead while maintaining real-time responsiveness. The authors caution that safety, security, and usability tensions constrain existing solutions, and argue that the concerns extend to teleoperated robots broadly.
7 Conclusion
- The experiments breached several concerning elements of Raven II across a wide attack surface, with some attacks requiring only a single packet.The authors report maintaining real-time responsiveness when incorporating security mechanisms.Source: §7 · p. 10
- Established mechanisms including encryption and authentication increased memory usage by about 3000KB on an average-quality computer while maintaining real-time responsiveness.The authors consider this increase likely acceptable for telerobotic surgery.Source: §7 · p. 10
- Safety, security, and usability tensions may make many existing solutions infeasible for telerobotic surgery; encrypting and authenticating video feedback will likely reduce packet throughput unacceptably.The authors state that the concerns also apply to teleoperated robots generally.Source: §7 · p. 10