Apparatus and method for protecting a medical device and a patient treated with this device against harmful influences from a communication network

• US 20080040788A1
• Filed: 06/01/2007
• Published: 02/14/2008
• Est. Priority Date: 06/03/2006
• Status: Active Grant

• Current Assignee: B Braun Medizinelektronik GmbH & Company KG
• Original Assignee: B Braun Medizinelektronik GmbH & Company KG
• Inventors: Steinkogler, Alexander, Lauer, Hans, Preus, Niko
• Granted Patent: US 8,146,149 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: G16H 40/67 for remote operation
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention relates to an apparatus for interacting with a medical device (10) which is suitable for connection into a communication network (11) which comprises at least one insecure area (11b) and a secure area (11a) on the device side, wherein the apparatus comprises transmission means (12; 44, 45) for transmitting communication packets to and from the medical device (10) via the communication network (11), it comprises monitoring means (13; 42, 43) for monitoring the state of the connection of the device (10) to the network (11), and it comprises breaker means (14; 40, 41) for breaking an existing connection between the secure area (11a) and the insecure area (11b) of the network (11) if, during the monitoring process, a state of the network connection is detected which poses a risk to a patient treated with the device (10) or to the correct functioning of the device (10). The invention also relates to a medical device comprising at least one such apparatus and to a medical system comprising a plurality of such medical devices (10) or sub-devices (15, 16). The present invention also relates to a corresponding method for controlling such aforementioned apparatuses.

Claims

1. An Apparatus for interacting with a medical device which is suitable for connection into a communication network which comprises at least one insecure area and a secure area on the device side, comprising:

a transmission means for transmitting communication packets to and from the medical device via the communication network;

a monitoring means for monitoring the state of the connection of the device to the network; and

a breaker means for breaking an existing connection between the secure area and the insecure area of the network, if, during the monitoring process, a state of the network connection is detected which poses a risk to a patient treated with the device or to the correct functioning of the device.

2. The Apparatus according to claim 1, wherein the transmission means comprises a packet filter which carries out packet filtering on the communication packets transmitted between the insecure area and the secure area of the communication network, wherein the packet filter is suitable for blocking communication packets which pose a potential risk to the medical device, the breaker means comprises at least one breaker switch, and the monitoring means comprises at least one control logic which, when a state of the network connection which poses a risk to a patient or to the correct functioning of the device is detected, triggers opening of one of the breaker switches so as to separate the insecure area from the secure area of the communication network which is connected directly to the medical device.

3. The Apparatus according to claim 2, wherein the packet filter performs bidirectional packet filtering on the communication packets transmitted between the insecure area and the secure area of the communication network.

4. The Apparatus according to claim 2, wherein the packet filter partially or completely replaces at least one of the monitoring means or the breaker means by blocking harmful communication packets or all communication packets when a state of the network connection which poses a risk to the patient or to the correct functioning of the device is detected.

5. The Apparatus according to claim 1, wherein separation between the secure area and the insecure area of the communication network is implemented as logical segmentation.

6. The Apparatus according to claim 1, wherein the separation between the secure area and the insecure area of the communication network is implemented as physical segmentation.

7. The Apparatus according to claim 6, wherein physical segmentation is achieved by different physical transmission paths in the secure area and in the insecure area of the communication network or by different instances of the same transmission path.

8. The Apparatus according to claim 6, wherein the communication network comprises at least one of cable-based or radio-based transmission paths.

9. The Apparatus according to claim 1, wherein the transmission path in the secure area of the communication network comprises optical fibers.

10. The Apparatus according to claim 2, wherein the packet filter is suitable for carrying out one of a translation or an encryption of the communication protocols used in the insecure area or in the secure area of the communication network in such a way that communication packets that have been modified with respect to the communication packets originating from the original protocol are used in the respective other area of the communication network.

11. The Apparatus according to claim 2, wherein control logic includes means for carrying out a static and/or dynamic check of the data to be transmitted in the communication network, the result of which check leads to an existing connection between the secure area and the insecure area of the network being maintained or cut by triggering the breaker switch(es).

12. The Apparatus according to claim 2, wherein one of the breaker switches is located on one of the sides connected to the secure area of the communication network or on the side of the apparatus connected to the insecure area of the communication network, so as to be able to separate only the medical device or both the medical device and the apparatus itself from the insecure area.

13. The Apparatus according to claim 1, further comprising a redundant architecture by integrating in the monitoring means a model of the function of the transmission means which makes it possible to check the correct functioning thereof.

14. The Apparatus according to claim 1, further comprising at least two diverse channels, each with their own transmission means, monitoring means and breaker means, wherein each channel can monitor both itself and also the other channel independently and can separate from the insecure area of the communication network when a state of the network connection which poses a risk to the patient or to the correct functioning of the device is detected.

15. The Apparatus according to claim 2, further comprising a comparator for comparing the results of the packet filtering in each channel with one another and forwarding the communication packets to be transmitted only if they are the same in each channel.

16. The Apparatus according to claim 14, further comprising in each channel a security logic which is suitable for separating the insecure area of the communication network from the secure area thereof, independently of the security logic of any other channel, when a state of the network connection which poses a risk to the patient or to the correct functioning of the device is detected.

17-20. -20. (canceled)

21. A method for controlling an apparatus for interacting with a medical device which is suitable for connection into a communication network which comprises at least one insecure area and a secure area on the device side, the method comprising

ensuring the transmission of communication packets to and from the medical device via the communication network'"'"'s,

monitoring the state of the connection of the device to the network, and

breaking an existing connection between the secure area and the insecure area of the network if, during the monitoring process, a state of the network connection is detected which poses a risk to the patient or to the correct functioning of the device.

22. The method according to claim 21, further comprising packet filtering during the transmission of the communication packets transmitted between the insecure area and the secure area of the communication network, wherein filtering is suitable for blocking communication packets which pose a potential risk to the medical device.

23. The method according to claim 21, further comprising bidirectional packet filtering on the communication packets transmitted between the insecure area and the secure area of the communication network.

24. The method according to claim 21, further comprising allowing logical segmentation between the secure area and the insecure area of the communication network.

25. The method according to claim 21, further comprising allowing said monitoring and/or breaking steps to be partially or completely replaced by the packet filtering during the transmission by blocking, during the packet filtering, harmful communication packets or all communication packets when a state of the network connection which poses a risk to the patient or to the correct functioning of the device is detected.

26. The method according to claim 21, wherein packet filtering is suitable for carrying out one of a translation or encryption of the communication protocols used in the insecure area or in the secure area of the communication network in such a way that communication packets that have been modified with respect to the communication packets originating from the original protocol are used in the respective other area of the communication network.

27. The method according to claim 21, wherein monitoring includes performing one of a static or dynamic check of the data to be transmitted in the communication network is carried out, the result of which check leads to an existing connection between the secure area and the insecure area of the network being maintained or cut.

28. The method according to claim 21, further comprising operating operating redundantly by integrating in the monitoring step an at least partial model of the function of the transmission step which makes it possible to check the correct functioning thereof.

29. The method according to claim 21, further comprising operating in at least two diverse channels, each with their own transmission, monitoring and breaking, wherein each channel can monitor both itself and also the other channel independently and can separate from the insecure area of the communication network when a state of the network connection which poses a risk to the patient or to the correct functioning of the device is detected.