Chapter 8: WIA-MEDICAL-DEVICE-SECURITY Standard

8.1 Standard Overview

The WIA-MEDICAL-DEVICE-SECURITY standard provides a comprehensive framework for securing medical devices throughout their lifecycle. Built on the WIA 4-phase architecture (Data, API, Protocol, Integration), this standard enables manufacturers and healthcare organizations to implement robust, interoperable security capabilities.

Guided by the principle of 弘益人間 (Hongik Ingan) - "Benefit All Humanity" - this standard aims to protect patients through effective cybersecurity while enabling the life-saving capabilities of connected medical devices.

8.2 WIA 4-Phase Architecture

The WIA-MEDICAL-DEVICE-SECURITY standard implements the WIA 4-phase architecture pattern, providing structured layers for data management, API access, protocol definition, and system integration.

Phase	Name	Purpose	Components
Phase 1	Data Layer	Information modeling and storage	Device models, vulnerability data, security events
Phase 2	API Layer	Programmatic access and operations	REST APIs, GraphQL, authentication
Phase 3	Protocol Layer	Communication and data exchange	Message formats, transport security
Phase 4	Integration Layer	External system connectivity	EHR integration, SIEM, vendor systems

8.3 Phase 1: Data Layer Specification

The Data Layer defines the core information models used throughout the WIA-MEDICAL-DEVICE-SECURITY standard. These models provide a common vocabulary for representing devices, vulnerabilities, and security events.

Core Data Models

Device Model

{
  "deviceId": "string (UUID)",
  "manufacturer": "string",
  "model": "string",
  "serialNumber": "string",
  "deviceType": "enum (implantable|life_support|imaging|monitoring|laboratory|administrative)",
  "riskLevel": "enum (critical|high|medium|low)",
  "networkInfo": {
    "ipAddress": "string",
    "macAddress": "string",
    "vlan": "integer",
    "segmentZone": "string"
  },
  "softwareInfo": {
    "operatingSystem": "string",
    "osVersion": "string",
    "firmwareVersion": "string",
    "sbomUrl": "string (URI)"
  },
  "securityProfile": {
    "lastAssessmentDate": "datetime",
    "securityLevel": "enum (SL1|SL2|SL3|SL4)",
    "complianceStatus": "enum (compliant|non_compliant|pending)",
    "openVulnerabilities": "integer"
  },
  "clinicalContext": {
    "department": "string",
    "location": "string",
    "primaryUse": "string",
    "patientContact": "boolean"
  },
  "metadata": {
    "createdAt": "datetime",
    "updatedAt": "datetime",
    "createdBy": "string"
  }
}

Vulnerability Model

{
  "vulnerabilityId": "string (UUID)",
  "cveId": "string",
  "affectedDevices": ["string (deviceId)"],
  "severity": {
    "cvssScore": "number (0.0-10.0)",
    "cvssVector": "string",
    "clinicalImpact": "enum (critical|high|medium|low)",
    "patientSafetyRisk": "boolean"
  },
  "status": "enum (identified|assessed|remediation_planned|remediated|accepted)",
  "exploitInfo": {
    "exploitAvailable": "boolean",
    "activelyExploited": "boolean",
    "exploitComplexity": "enum (low|medium|high)"
  },
  "remediation": {
    "patchAvailable": "boolean",
    "patchVersion": "string",
    "compensatingControls": ["string"],
    "remediationDeadline": "datetime"
  },
  "metadata": {
    "discoveredAt": "datetime",
    "discoveryMethod": "enum (scan|sbom|vendor|researcher)",
    "assignedTo": "string"
  }
}

Security Event Model

{
  "eventId": "string (UUID)",
  "deviceId": "string",
  "eventType": "enum (authentication|authorization|network|configuration|malware|anomaly)",
  "severity": "enum (critical|high|medium|low|informational)",
  "timestamp": "datetime",
  "eventData": {
    "sourceIp": "string",
    "destinationIp": "string",
    "protocol": "string",
    "action": "string",
    "outcome": "enum (success|failure|blocked)"
  },
  "clinicalContext": {
    "patientImpact": "boolean",
    "careDisruption": "boolean",
    "dataExposure": "boolean"
  },
  "responseStatus": {
    "acknowledged": "boolean",
    "incidentCreated": "boolean",
    "incidentId": "string"
  }
}

8.4 Phase 2: API Layer Specification

The API Layer provides programmatic access to medical device security operations. APIs follow RESTful design principles with JSON payloads and OAuth 2.0 authentication.

API Endpoints Overview

Category	Endpoint	Method	Description
Device Management	/api/v1/devices	GET	List all devices
	/api/v1/devices/{id}	GET	Get device details
	/api/v1/devices/{id}/sbom	GET	Get device SBOM
	/api/v1/devices/{id}/security	GET	Get security profile
Vulnerability	/api/v1/vulnerabilities	GET	List vulnerabilities
	/api/v1/vulnerabilities/{id}	GET	Get vulnerability details
	/api/v1/vulnerabilities/{id}/remediate	POST	Initiate remediation
	/api/v1/vulnerabilities/assess	POST	Assess new vulnerability
Events	/api/v1/events	GET	Query security events
	/api/v1/events	POST	Submit security event
	/api/v1/events/stream	WSS	Real-time event stream
Incidents	/api/v1/incidents	GET	List incidents
	/api/v1/incidents	POST	Create incident
	/api/v1/incidents/{id}/status	PUT	Update incident status

Authentication and Authorization

8.5 Phase 3: Protocol Layer Specification

The Protocol Layer defines message formats and communication protocols for medical device security data exchange. This layer enables interoperability between systems from different vendors.

Message Format

Messages use JSON with a standard envelope structure:

{
  "header": {
    "messageId": "string (UUID)",
    "messageType": "string",
    "version": "1.0",
    "timestamp": "datetime (ISO 8601)",
    "sender": {
      "systemId": "string",
      "organizationId": "string"
    },
    "recipient": {
      "systemId": "string",
      "organizationId": "string"
    }
  },
  "payload": {
    // Message-type specific content
  },
  "signature": {
    "algorithm": "string",
    "value": "string (base64)"
  }
}

Message Types

Message Type	Direction	Purpose
DEVICE_REGISTRATION	Device → Platform	Register new device
DEVICE_HEARTBEAT	Device → Platform	Device health check
SECURITY_EVENT	Device → Platform	Report security event
VULNERABILITY_ALERT	Platform → Device	Vulnerability notification
POLICY_UPDATE	Platform → Device	Security policy change
COMMAND_REQUEST	Platform → Device	Device action command
COMMAND_RESPONSE	Device → Platform	Command execution result

Transport Security

• Encryption: TLS 1.3 required for all communications
• Authentication: Mutual TLS with device certificates
• Message Signing: ECDSA signatures for integrity
• Key Management: PKI with hardware security modules

8.6 Phase 4: Integration Layer Specification

The Integration Layer connects the WIA-MEDICAL-DEVICE-SECURITY platform with external systems including EHRs, SIEM platforms, vulnerability databases, and manufacturer systems.

Integration Patterns

System Type	Integration Method	Data Exchanged
EHR Systems	FHIR R4, HL7v2	Device-patient association, clinical context
SIEM Platforms	Syslog, CEF, REST API	Security events, alerts
Vulnerability Databases	REST API (NVD, vendor)	CVE data, advisories
CMDB/Asset Management	REST API, ServiceNow	Device inventory, ownership
Manufacturer Systems	Vendor-specific APIs	Patches, SBOMs, advisories

FHIR Integration

The standard supports FHIR Device resource for healthcare interoperability:

{
  "resourceType": "Device",
  "identifier": [{
    "system": "urn:wia:device-security",
    "value": "device-uuid"
  }],
  "status": "active",
  "manufacturer": "Device Manufacturer",
  "modelNumber": "Model-123",
  "serialNumber": "SN-456789",
  "type": {
    "coding": [{
      "system": "http://snomed.info/sct",
      "code": "706687001",
      "display": "Medical device"
    }]
  },
  "extension": [{
    "url": "http://wia.org/fhir/StructureDefinition/device-security",
    "valueReference": {
      "reference": "SecurityProfile/profile-id"
    }
  }]
}

8.7 Implementation Guidelines

This section provides guidance for implementing the WIA-MEDICAL-DEVICE-SECURITY standard in healthcare organizations.

Implementation Phases

Phase	Activities	Duration
Assessment	Inventory devices, assess current state, identify gaps	4-8 weeks
Design	Architecture design, integration planning, policy development	4-6 weeks
Implementation	Deploy platform, configure integrations, migrate data	8-12 weeks
Validation	Testing, validation, clinical acceptance	4-6 weeks
Operations	Go-live, monitoring, continuous improvement	Ongoing

8.8 Compliance Mapping

The WIA-MEDICAL-DEVICE-SECURITY standard maps to major regulatory and industry frameworks:

Framework	Standard Elements	Coverage
FDA Premarket	Data models, API security, SBOM	Full
FDA Postmarket	Vulnerability management, incident response	Full
IEC 62443	Security levels, zone model	Aligned
EU MDR	Security controls, documentation	Full
HIPAA Security	Access control, audit, encryption	Supports
NIST CSF	All five functions	Aligned

8.9 Reference Architecture

The following reference architecture illustrates a typical deployment of the WIA-MEDICAL-DEVICE-SECURITY platform:

8.10 Future Roadmap

The WIA-MEDICAL-DEVICE-SECURITY standard continues to evolve with emerging technologies and threats:

Planned Enhancements

• AI/ML Integration: Behavioral analysis, threat prediction
• Zero Trust Architecture: Enhanced micro-segmentation support
• Cloud-Native: Kubernetes-native deployment options
• Extended SBOM: Hardware bill of materials, AI/ML models
• Quantum-Safe: Post-quantum cryptography support