{"id":"3606609c-ddd0-4baf-b609-bfa051f9ab8c","arxiv_id":"1908.06086","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"An IoT insulin pump system combining an Alaris pump, Keil LPC-1768 board, SHA-256, and SSH is presented, with a Markov-model availability claim of 99.3%.","lead":"This paper describes an IoT system that connects a diabetic patient's insulin pump to a cloud server, using a microcontroller, SHA-256 hashes, and an encrypted SSH link. The authors report high system availability and secure data handling based on a Markov model and basic integrity tests.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 99.3% availability figure contradicts the paper's own Markov equations: using the Table III rates, P4 should be about 3.37e-7, not 3.0e-3, so the central reliability claim is internally inconsistent.","rationale":"The reader's verdict is REJECT with high correctness risk, and I agree, but my reason is stronger and more specific than the reader's stated weakest assumption. The reader identified that the failure and recovery rates in Table III are assumed from references rather than measured, and therefore the 99.3% availability figure is only as good as those assumptions. That is a valid criticism about input validity. However, the paper's reported state probabilities do not even satisfy the Markov chain's own balance equations with the stated rates. For example, state 4 has a single incoming transition lambda1,4 * P1 and a single outgoing transition mu4,1 * P4; the steady-state ratio must be P4/P1 = lambda1,4 / mu4,1 = 3.37e-7, yet the paper reports P4 = 3e-3. Since P4 starts at 0 and has one source, it cannot exceed lambda1,4 / mu4,1 at any time, so this is not a transient artifact. Similar order-of-magnitude mismatches appear in states 2, 3, 8, and 10. This shows the headline availability claim is internally inconsistent, independent of whether the input rates are empirically valid. Under the reviewing rule to treat all manuscript text as evidence, the equations and Table III are in-scope, and the contradiction between them and Section V-A is decisive. The paper's own stated limitation ('limitation can be seen in the case of a successful attack on the used security components') does not address this model inconsistency. Therefore the correct verdict remains REJECT, with the central claim invalidated by an intra-paper mathematical contradiction rather than solely by missing external validation.","tokens_in":13209,"tokens_out":5258,"duration_ms":48899,"concrete_test":"Re-derive the stationary distribution by solving the linear system A * pi = 0 with sum(pi) = 1, where A is the generator matrix implied by Equations (2)-(13) using the Table III rates (e.g., with numpy.linalg.lstsq or sympy). Compare the computed values of P1 and P4 against the reported P1 = 0.9925712 and P4 = 0.002998966. A minimal single check is to compute P4 = lambda1,4 / mu4,1 = 3.331e-7 / 0.9876 = 3.37e-7 and compare with the reported 2.998966e-3; if the recomputed values differ from the paper's table, the 99.3% availability claim is not supported by the model as written.","verdict_should_be":"REJECT","load_bearing_attack":"The most load-bearing concern is internal to the Markov-model argument that produces the headline availability. Section IV-C defines a 12-state Markov model and Table III supplies the transition rates; Section V-A reports the steady-state probabilities. Those reported probabilities do not satisfy the model's own balance equations with the stated rates. From Eq. (5), at steady state: mu4,1 * P4 = lambda1,4 * P1. Table III gives mu4,1 = 0.9876 and lambda1,4 = 3.331e-7, so for any P1 <= 1 the steady value of P4 is at most lambda1,4 / mu4,1 = 3.37e-7. The paper reports P4 = 2.998966e-3, four orders of magnitude larger, and since P4 has only one source and one sink, no transient solution can exceed this bound. Similar failures occur in state 8: with P2 = 2.091e-4, Eq. (9) has incoming rate lambda2,8 * P2 = 2.5e-7 * 2.091e-4 = 5.2e-11, while outgoing (lambda8,11 + mu8,2) * P8 = (2.00e-4 + 4.20e-4) * 1.9989e-3 = 1.24e-6; these are not equal, so the reported P8 is not a solution. The reported probabilities therefore are not a solution of equations (2)-(13) with the rates in Table III. Even if every failure and recovery rate were measured on the actual hardware, the 99.3% availability number would still not follow from the presented model. The conclusion's central claim rests on a quantitatively inconsistent calculation, not merely on unvalidated inputs.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an IoT-based embedded health care system for diabetic patients, integrating an Alaris 8100 infusion pump, a Keil LPC-1768 board, a cloud backend, SSH-based secure channels, and SHA-256 integrity checks. The authors describe the hardware setup, three control/storage/monitoring algorithms, and an experimental SHA-256 demonstration. The central quantitative claim is a 99.3% availability probability obtained from a 12-state Markov model whose input failure and recovery rates are listed in Table III. The conclusion asserts that the five reliability characteristics (availability, confidentiality, integrity, authentication, authorization) are accomplished.","tokens_in":13566,"tokens_out":2994,"duration_ms":30923,"significance":"If the security and availability claims were sound, a remotely controllable insulin pump with an explicit availability guarantee would be a practically relevant contribution to IoT health care. The paper deserves credit for constructing a working hardware integration and for demonstrating SHA-256 avalanche behavior on sample health records. However, the central availability result is not valid: the reported steady-state probabilities do not satisfy the paper's own Markov balance equations, and the input rates are assumed rather than measured. Consequently, the 99.3% figure is neither an empirical measurement nor a correct consequence of the presented model. The security claims are also asserted rather than demonstrated through a threat model or experiments. The significance of the paper is therefore not established at the level claimed.","major_comments":[{"comment":"The reported steady-state probabilities are not a solution of the paper's own Kolmogorov equations with the stated rates. For state 4, Eq. (5) at steady state gives mu4,1 * P4 = lambda1,4 * P1. With Table III's mu4,1 = 0.9876 and lambda1,4 = 3.331e-7, and since P1 <= 1, any valid steady-state value must satisfy P4 <= 3.331e-7 / 0.9876 = 3.37e-7. The paper reports P4 = 2.998966e-3, which is four orders of magnitude larger. Because state 4 has exactly one incoming transition and one outgoing transition, no transient solution can produce a limiting probability above this bound. The same inconsistency appears for state 8: the incoming rate from state 2 is lambda2,8 * P2 = 2.50e-7 * 2.091e-4 = 5.2e-11, while the outgoing rate is (lambda8,11 + mu8,2) * P8 = (2.00e-4 + 4.20e-4) * 1.9989e-3 = 1.24e-6; these are unequal, so P8 is not a steady-state solution either. The headline 99.3% availability therefore does not follow from the model as presented, even if all input rates were accepted.","section":"Section IV-C, Eq. (5), Table III, Section V-A"},{"comment":"The failure and recovery rates in Table III are stated to be collected from references, not measured on the proposed hardware or cloud configuration. Since the availability probability is a deterministic function of these rates, the resulting 99.3% value is an artifact of the assumed inputs rather than a validated property of the system. Additionally, the model includes an 'authority failure' state that is never given a quantitative definition, so the semantics of that state and its transition rates are unclear.","section":"Section IV-C, Table III"},{"comment":"The claims that confidentiality, authentication, and authorization are 'accomplished' are not supported by any threat model, attack experiments, or formal verification. The integrity experiment in Section V-C merely shows that SHA-256 produces a different digest when one field of a sample record is changed; this demonstrates a hash function property, not that the proposed system detects tampering under realistic adversarial conditions. No end-to-end test shows that an adversary cannot alter a record or command without detection, and no analysis addresses attacks on the SSH channel, the serial link, or the cloud storage.","section":"Section V-C through V-E"}],"minor_comments":[{"comment":"The board name is inconsistently spelled 'Kiel' in the abstract and 'Keil' elsewhere; 'Keil' is the correct spelling. Also, 'Islambad' in the author affiliation should be 'Islamabad.'","section":"Abstract and Section II-B"},{"comment":"The text alternates between 'Secure Socket Shell' and 'SSL/TLS.' The standard name of the protocol is 'Secure Shell' (SSH); please use one consistent terminology and clarify whether SSL/TLS or SSH is actually used for which connection.","section":"Section IV"},{"comment":"Figure 2 and Figure 5 have identical captions ('General architecture of the proposed scheme') and appear to show the same diagram; one of the figures should be removed or the captions and content differentiated.","section":"Figures 2 and 5"},{"comment":"The time units of the failure and recovery rates are not specified. Without units (e.g., per hour, per year), the numerical values cannot be interpreted or compared with published failure data.","section":"Table III"},{"comment":"The initial condition is written as 'P1(t) = 1, Pi(t) = 0,' which is dimensionally incorrect; it should be P1(0) = 1 and Pi(0) = 0 for i = 2, ..., 12.","section":"Section IV-C"},{"comment":"The text says 'The availability function is represented by the probability value of P1(t),' but the reported numbers are steady-state probabilities, not a time-dependent function. Additionally, the conclusion states 99.3% availability while Section V-A reports P1 = 0.9925712 (99.26%); the discrepancy should be reconciled.","section":"Section V-A"}],"recommendation":"reject","confidential_remarks":"The manuscript's central quantitative claim is internally inconsistent with its own Markov model, and the security evaluation is largely a demonstration of standard hash properties rather than a validation of the proposed system. Because the availability figure and the reliability conclusion depend on this flawed analysis, the paper would require a fundamental reworking of its evaluation, not just local revisions. I recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, the thing to know: the headline 99.3% availability figure is not supported by the paper's own math. Section IV-C defines a 12-state Markov model with Table III rates, and Section V-A reports steady-state probabilities that do not satisfy the balance equations. For state 4, Eq. (5) at steady state gives mu4,1*P4 = lambda1,4*P1, so P4 <= lambda1,4/mu4,1 = 3.37e-7 with the stated rates. The paper reports P4 = 2.998966e-3, four orders of magnitude larger. State 8 fails similarly: with the reported P2, the incoming and outgoing rates differ by four orders of magnitude. So the probabilities are not a solution to the model, and the 99.3% availability claim rests on an inconsistent calculation, not merely on unvalidated inputs.\n\nWhat the paper does do: it presents a real hardware integration—Alaris 8100 infusion pump, LPC1768 microcontroller, SSH, and cloud storage—with algorithms for monitoring, storing, and controlling prescriptions. That part is concrete and potentially useful to people building low-cost IoT medical devices. The SHA-256 integrity test is correct as far as it goes, though it only demonstrates a property of the hash function. The Markov case study is a reasonable idea, but the execution fails.\n\nThe other soft spots are the ones you'd expect. Failure and recovery rates in Table III are borrowed from the literature, not measured for this system, so even a correct model would not validate the availability number. Security claims (confidentiality, authentication, authorization) are asserted from the use of SSH and SHA-256 without a threat model, attack experiments, or formal verification. The contribution over prior work is incremental; the architecture closely follows the authors' own IARIA paper [1].\n\nWho gets value: a reader interested in a concrete example of pump-controller-cloud integration. The reliability analysis should not be cited until it is redone. I would not cite it as is. It probably deserves a serious referee, not a desk reject, because the hardware work is real and the model flaw is fixable—either by recomputing the steady-state probabilities correctly or by dropping the unsupported availability claim and reframing the paper as an implementation report. But as submitted, the central quantitative claim is wrong.","headline":"The 99.3% availability claim doesn't survive contact with the paper's own Markov equations—the reported state probabilities are orders of magnitude off from what the balance equations demand.","tokens_in":14108,"tokens_out":3120,"would_cite":false,"duration_ms":28043,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A cloud-connected insulin pump with SHA-256 and SSH is claimed to give secure remote control and about 99.3 percent steady-state availability.","keywords":["Internet of Things","diabetes","insulin pump","embedded system","health care data security","SHA-256","Markov availability model","remote patient monitoring"],"falsifier":"Measure the actual failure and recovery intervals of this exact pump-plus-board-plus-cloud configuration, plug the measured rates into the Markov model's differential equations, and check whether the steady-state probability of the normal state stays near 0.993; if the measured rates differ substantially from Table III, the availability claim will move accordingly.","tokens_in":13015,"feed_emoji":"💉","tokens_out":8995,"duration_ms":76849,"temperature":0.7,"pith_summary":"This paper claims that an insulin pump for diabetic patients can be integrated with a microcontroller board and cloud storage to make remote monitoring and control secure. The design attaches a SHA-256 hash to every health record and every prescription command, sends the data over an SSH-encrypted channel, and verifies the hash at the receiving end so tampering is detected. The authors argue that this meets five reliability characteristics: availability, confidentiality, integrity, authentication, and authorization. They further claim that a 12-state Markov model places the system in normal operation about 99.3 percent of the time and that processing 70 sample records takes about $5.8\\times10^{-4}$ seconds on average.","feed_headline":"Secure insulin pump system claimed available 99.3 percent","feed_subtitle":"SHA-256 hashes and SSH encryption protect patient records and pump commands in a cloud-connected embedded design.","key_machinery":"The load-bearing mechanism is the signed record pipeline: each health record or control command is hashed with SHA-256, the digest is appended to the data, the combination is sent over an SSH-encrypted channel, and the receiver rehashes and compares to accept or reject the message. SHA-256 is a 256-bit cryptographic hash standard, and SSH is a network protocol that encrypts and authenticates the connection. The availability claim is carried separately by a 12-state Markov model whose transition rates are failure rates ($\\lambda$) and recovery rates ($\\mu$) taken from published sources and solved for steady state.","core_discovery":"The central discovery is that an off-the-shelf Alaris 8100 infusion pump, an LPC-1768 Cortex-M3 board, and an IoT-cloud backend can be assembled into a closed control loop where every data record and every control command carries an appended SHA-256 digest and travels over an SSH connection. At the destination, the digest is recomputed and compared with the appended value; any mismatch causes the record or command to be discarded. Solving the system of differential equations for the 12-state Markov model yields a steady-state probability for the normal state of $P_1 \\approx 0.9926$, which the paper reports as 99.3 percent availability. In addition, a run over 70 diabetic sample records produced a mean processing time of $5.8\\times10^{-4}$ seconds, offered as evidence that the scheme is fast enough for routine use.","pith_inferences":["The 99.3 percent figure is a property of the assumed transition rates, not a measured availability of the deployed hardware; a real installation would need its own failure and recovery data before relying on the number.","The same append-hash-and-verify pattern could transfer to other home infusion or monitoring devices, as long as each device has a microcontroller capable of computing SHA-256.","An attacker who compromises the SSH key store or the serial link between the board and the pump would bypass the digest checks, a threat the paper does not model.","For time-critical insulin delivery, the reported latency spread (standard deviation $4.4\\times10^{-4}$ seconds) matters more than the mean, so a worst-case latency bound would be needed."],"forward_implications":["If a health record is changed by even one value, the receiver's SHA-256 digest will differ and the record will be rejected.","A physician holding an authorized SSH key can send a new insulin schedule to the pump, and the microcontroller will pass it to the pump only after the digest check succeeds.","Under the assumed failure and recovery rates, the system spends about 99.3 percent of its steady-state time in normal operation.","Patient records stored in the cloud remain accessible to authorized caregivers, including when the local physician is off duty.","An average processing time of $5.8\\times10^{-4}$ seconds over 70 records suggests the verification step is not a bottleneck for routine monitoring."],"supporting_citations":[{"why":"Defines the SHA-256 standard the paper uses for message digests and integrity checks.","marker":"[15]"},{"why":"Reviews security of insulin pump infusion systems and contributes to the Markov model failure-rate assumptions.","marker":"[18]"},{"why":"Introduces Markov modeling for failure probability of IoT storage components, the approach adapted here.","marker":"[24]"},{"why":"Builds a Markov model for IoT health care system component failures that this case study extends.","marker":"[25]"},{"why":"Describes an online patient monitoring design using the LPC-1768 board, the hardware platform used in this work.","marker":"[13]"},{"why":"Shows a data acquisition and control system on the ARM Cortex-M3 LPC-1768 board, supporting the control-path design.","marker":"[17]"},{"why":"Describes the infusion pump assembly the paper interfaces with the microcontroller.","marker":"[26]"},{"why":"Provides observational insulin pump failure data used in building the failure-rate assumptions.","marker":"[33]"},{"why":"Supplies the sample health record used to demonstrate that SHA-256 detects a one-value change in the data.","marker":"[34]"}],"fun_headline_variants":["Insulin pump with SHA-256 and SSH hits 99.3% availability","Secure IoT diabetic pump: hash and SSH give 99.3% uptime","Cloud insulin pump secures with SHA-256 and SSH, 99.3% available","Diabetic pump uses SHA-256 and SSH to hit 99.3% availability","Hash and SSH shield insulin pump data, 99.3% availability"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The availability result collapses if the failure and recovery rates in Table III, which are taken from published references rather than measured on this particular pump, board, and cloud connection, do not match the real system; the model also assumes constant rates and an authority-failure state it never defines quantitatively.","fun_headline_variants_meta":{"raw":{"variants":["Insulin pump with SHA-256 and SSH hits 99.3% availability","Secure IoT diabetic pump: hash and SSH give 99.3% uptime","Cloud insulin pump secures with SHA-256 and SSH, 99.3% available","Diabetic pump uses SHA-256 and SSH to hit 99.3% availability","Hash and SSH shield insulin pump data, 99.3% availability"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00157,"raw_usage":{"total_tokens":6265,"prompt_tokens":940,"completion_tokens":5325,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":556,"completion_tokens_details":{"reasoning_tokens":5218}},"tokens_in":556,"tokens_out":5325,"duration_ms":29360,"temperature":1.0,"reasoning_tokens":5218,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T13:02:47.684561+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure the actual failure and recovery intervals of this exact pump-plus-board-plus-cloud configuration, plug the measured rates into the Markov model's differential equations, and check whether the steady-state probability of the normal state stays near 0.993; if the measured rates differ substantially from Table III, the availability claim will move accordingly.","supporting_citations":[{"cited_title":"Secure hash standard (shs),","cited_arxiv_id":null,"evidence_quote":"Defines the SHA-256 standard the paper uses for message digests and integrity checks."},{"cited_title":"A review of the security of insulin pump infusion systems,","cited_arxiv_id":null,"evidence_quote":"Reviews security of insulin pump infusion systems and contributes to the Markov model failure-rate assumptions."},{"cited_title":"A dependability evaluation for internet of things incorporating redundancy aspects,","cited_arxiv_id":null,"evidence_quote":"Introduces Markov modeling for failure probability of IoT storage components, the approach adapted here."},{"cited_title":"A markov model of healthcare internet of things system considering failures of components,","cited_arxiv_id":null,"evidence_quote":"Builds a Markov model for IoT health care system component failures that this case study extends."},{"cited_title":"Design and implementation of online patient monitoring system,","cited_arxiv_id":null,"evidence_quote":"Describes an online patient monitoring design using the LPC-1768 board, the hardware platform used in this work."},{"cited_title":"Data acquisition and controlling system using cortex m3 core,","cited_arxiv_id":null,"evidence_quote":"Shows a data acquisition and control system on the ARM Cortex-M3 LPC-1768 board, supporting the control-path design."},{"cited_title":"Infusion pump assembly,","cited_arxiv_id":null,"evidence_quote":"Describes the infusion pump assembly the paper interfaces with the microcontroller."},{"cited_title":"Insulin pump failures: has there been an improve- ment? update of a prospective observational study,","cited_arxiv_id":null,"evidence_quote":"Provides observational insulin pump failure data used in building the failure-rate assumptions."},{"cited_title":"Sample Medical Record: Monica Latte | Agency for Healthcare Research & Quality,","cited_arxiv_id":null,"evidence_quote":"Supplies the sample health record used to demonstrate that SHA-256 detects a one-value change in the data."}],"review_version":1}