Privacy-protecting system and method for wireless medical devices

• US 10,230,699 B2
• Filed: 06/28/2016
• Issued: 03/12/2019
• Est. Priority Date: 07/06/2015
• Status: Active Grant

• Current Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Original Assignee: PCMS Holdings Incorporated (InterDigital, Inc.)
• Inventors: Juels, Ari
• Primary Examiner(s): Nguyen, David Q
• Application Number:
  US15/739,638
• Publication Number:
  US 20180191693A1
• Time in Patent Office: 987 Days
• Field of Search: 3405731
• CPC Class Codes: A61B 5/0031 Implanted circuitry
• CPC Class Codes: A61N 1/37254 Pacemaker or defibrillator security, e.g. to prevent or inhibit programming alterations by hackers or unauthorised individuals
• CPC Class Codes: G16H 10/65 stored on portable record carriers, e.g. on smartcards, RFID tags or CD
• CPC Class Codes: G16H 40/63 for local operation
• CPC Class Codes: G16H 40/67 for remote operation
• CPC Class Codes: H04L 12/00 Data switching networks interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units G06F13/00
• CPC Class Codes: H04L 12/6418 Hybrid transport
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Systems and methods are provided for protecting the privacy of wireless enabled medical device (WEMD) communications, particularly against traffic-analysis attacks. In an exemplary method, a WEMD measures a physiological parameter and conveys that physiological parameter to a WEMD-receiver using messages that simulate at least one message from a cover device, for example by embedding physiological data in a message from a simulated cover device. In some embodiments, the WEMD sends messages that simulate traffic patterns of the cover device. The cover device may be a device not associated with serious medical conditions, such as a fitness-oriented heart rate monitor. In some embodiments, the simulation is discontinued under emergency conditions or in particular regions that are deemed to be safe.

Claims

1. A method of concealing use of a wireless-enabled medical device (WEMD), the method comprising:

detecting at least one device type of at least one respective wireless device in a neighborhood of the WEMD;

selecting a cover device type based at least in part on the at least one detected device type, wherein the cover device type is selected so as to be different from the at least one detected device type;

operating the WEMD to measure physiological parameter data; and

wirelessly conveying the physiological parameter data from the WEMD by encapsulating the physiological parameter data in a message having a message type associated with the selected cover device type to simulate the selected cover device type.

2. The method of claim 1, wherein simulating the selected cover device type includes buffering the physiological parameter data prior to transmission from the WEMD.

3. The method of claim 1, wherein the detecting and the selecting are performed by a receiver device, further comprising transmitting the selected cover device type from the receiver device to the WEMD.

4. The method of claim 1, wherein simulating the selected cover device type includes sending a message using a packet length associated with the selected cover device type.

5. The method of claim 1, wherein simulating the selected cover device type includes sending a message using a packet timing associated with the selected cover device type.

6. The method of claim 1, further comprising:

determining whether the WEMD is in a predetermined safety zone; and

ending simulation in response to a determination that the WEMD is in the predetermined safety zone.

7. The method of claim 1, further comprising:

determining whether the WEMD is in an emergency override condition; and

ending simulation in response to a determination that the WEMD is in an emergency override condition.

8. The method of claim 1, wherein selecting a cover device comprises:

displaying a list of detected device types to the user; and

receiving user selection of at least one spurious detected device type that is not associated with a device carried by the user;

wherein the selection of the cover device type is based at least in part on the detected device types other than the spurious device type.

9. The method of claim 1, wherein simulating the selected cover device type comprises:

generating simulated data associated with the selected cover device type; and

transmitting the simulated data.

10. The method of claim 9, wherein the simulated data is simulated heart rate data.

11. The method of claim 1, wherein the WEMD is an implantable cardioverter defibrillator (ICD).

12. The method of claim 1, wherein the selected cover device type is in a set of at least two selected cover device types, and wherein wirelessly conveying the physiological parameter data comprises multiplexing the physiological parameter data across the at least two selected cover device types.

13. The method of claim 1, wherein the cover device type is selected from a predetermined list of available cover device types.

14. The method of claim 13, further comprising calculating a utility function for a plurality of the available cover device types, wherein the selection of the cover device type is based on at least in part on the calculated utility function.

15. A wireless enabled medical device (WEMD) system comprising:

a device-setting module operative to detect at least one device type of at least one respective wireless device in a neighborhood of the WEMD and to select a cover device type based at least in part on the at least one detected device type, wherein the device-setting module is operative to select the cover device type so as to be different from the at least one detected device type; and

a WEMD operative to measure physiological parameter data and to wirelessly convey the physiological parameter data from the WEMD, wherein the WEMD is operative to encapsulate the physiological parameter data in a message having a message type associated with the selected cover device type to simulate the selected cover device type.

16. The system of claim 15, further comprising a receiver device, wherein the device-setting module is included in the receiver device.