Secure Telemetric Link

• US 20080044014A1
• Filed: 07/26/2007
• Published: 02/21/2008
• Est. Priority Date: 08/18/2006
• Status: Active Grant

• Current Assignee: Medtronic Incorporated (Medtronic Plc)
• Original Assignee: Medtronic Incorporated (Medtronic Plc)
• Inventors: Corndorf, Eric D.
• Granted Patent: US 8,102,999 B2
• Time in Patent Office: Days
• US Class Current: 380/37
• CPC Class Codes: A61B 5/0031 Implanted circuitry
• CPC Class Codes: A61N 1/37252 Details of algorithms or data aspects of communication system, e.g. handshaking, transmitting specific data or segmenting data
• CPC Class Codes: A61N 1/37254 Pacemaker or defibrillator security, e.g. to prevent or inhibit programming alterations by hackers or unauthorised individuals
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/106 Packet or message integrity

Abstract

A communications protocol is used to provide data privacy, message integrity, message freshness, and user authentication to telemetric traffic, especially to and from implantable medical devices in a body area network. Encryption, message integrity, and message freshness are provided through use of token-like nonces and ephemeral session-keys derived from device identification numbers and pseudorandom numbers.

Claims

1. In a telecommunications network having at least a first and second node, a method of transmitting actionable data in a secured telemetry wake-up packet from the first node the second node, the method comprising the steps of:

generating a message authentication code using a predefined protocol within the first node;

obtaining a current counter value from a memory of the first node indicative of a number of wake-up transmissions authored by the first node;

determining an identification of the second node; and

composing a transmittable wake up message for the second node include the message authentication code, the current counter value and a predetermined amount of actionable data; and

transmitting the wake-up message.

2. The method of claim 1, wherein the message authentication code is generated with a 128 bit block cipher.

3. The method of claim 2 wherein generating the method authentication code further comprises:

inputting an identifier indicative of the first node into an input register of the block cipher;

inputting the current counter value into the input register;

inputting the actionable data into the input register;

inputting a receptor identification value indicative of the second node into the imputer register;

proving a network key to the block cipher; and

generating an output value from the block cipher at least a portion of which forms the method authentication code.

4. The method of claim 1, further comprising receiving an acknowledgement message from the second node.

5. The method of claim 1, wherein successful transmission of the wake-up message including actionable data initiates a native mode telemetry session, whereby any node in the native mode may send an ACK/NACK message upon receipt of the wake-up packet.

6. The method of claim 5, further comprising terminating the native mode session without permitting any additional data exchanges.

7. The method of claim 5, further comprising:

permitting each node engaged in the native mode session to send a single data packet of a predetermined and each node may send an ACK/NACK message;

terminating the native mode session without permitting any additional data exchanges.

8. The method of claim 1, further comprising:

receiving the wake-message at the second node;

identifying the sender of the wake-up message;

extracting the current counter value from the wake-up message;

comparing the current counter value to a first node counter value stored within a memory of the second node;

utilizing the comparison as a first mechanism to assess message validity;

extracting the message authentication code from the wake-up message;

calculating a first node message authentication code utilizing first node data in a block cipher accessible by the second node;

comparing the first node message authentication code with the message authentication code extracted from the wake up message as a second mechanism to assess message validity; and

accepting the actionable data from the wake-up message if both the first and second mechanisms indicating message validity.

9. The method of claim 8, wherein the first mechanism to assess message validity further comprises:

ignoring the wake-up message if the current counter value is less than the first node counter value stored in the memory of the second node;

advancing to the second mechanism and utilizing the first node counter value if the first node counter value is equal to the current counter value; and

advancing to the second mechanism and utilizing the current counter value if the current counter value is greater than the first node counter value.

10. The method of claim 9, further comprising replacing the first node counter value with the current counter value in the memory of the second node if the current counter value is greater than the first node counter value and the second mechanism indicates message validity.

11. The method of claim 9, further comprising incrementing the first node counter value in the memory of the second device if the second mechanism indicates message validity.

12. The method of claim 9, further comprising entering a native mode telemetry session if the second mechanism indicates message validity, wherein the second node is permitted to send an ACK message.

13. The method of claim 12, further comprising terminating the telemetry session without permitting addition data exchange.

14. The method of claim 12, further comprising allowing the receipt of a single additional data transmission from each node in the native telemetry mode;

permitting the transmission of a single data transmission from the second node; and

sending and receiving ACK/NACK messages prior to termination of the native telemetry mode.

15. A telecommunications network having at least a first and second node including transmitting actionable data in a secured telemetry wake-up packet from the first node the second node comprising:

means for generating a message authentication code using a predefined protocol within the first node;

means for obtaining a current counter value from a memory of the first node indicative of a number of wake-up transmissions authored by the first node;

means for determining an identification of the second node; and

means for composing a transmittable wake up message for the second node include the message authentication code, the current counter value and a predetermined amount of actionable data; and

means for transmitting the wake-up message.

16. The network of claim 15, wherein the means for generating the method authentication code further comprises:

means for inputting an identifier indicative of the first node into an input register of the block cipher;

means for inputting the current counter value into the input register;

means for inputting the actionable data into the input register;

means for inputting a receptor identification value indicative of the second node into the imputer register;

means for proving a network key to the block cipher; and

means for generating an output value from the block cipher at least a portion of which forms the method authentication code.

17. The network of claim 16, further comprising:

means for initiating a native mode telemetry session upon successful receipt of the wake-up message;

means for permitting each node engaged in the native mode session to send a single data packet of a predetermined and each node may send an ACK/NACK message;

means for terminating the native mode session without permitting any additional data exchanges.

18. The network of claim 15, further comprising:

means for receiving the wake-message at the second node;

means for identifying the sender of the wake-up message;

means for extracting the current counter value from the wake-up message;

means for comparing the current counter value to a first node counter value stored within a memory of the second node;

means for utilizing the comparison as a first mechanism to assess message validity;

means for extracting the message authentication code from the wake-up message;

means for calculating a first node message authentication code utilizing first node data in a block cipher accessible by the second node;

means for comparing the first node message authentication code with the message authentication code extracted from the wake up message as a second mechanism to assess message validity; and

means for accepting the actionable data from the wake-up message if both the first and second mechanisms indicating message validity.

19. The network of claim 18, wherein the first mechanism to assess message validity further comprises:

means for ignoring the wake-up message if the current counter value is less than the first node counter value stored in the memory of the second node;

means for advancing to the second mechanism and utilizing the first node counter value if the first node counter value is equal to the current counter value; and

means for advancing to the second mechanism and utilizing the current counter value if the current counter value is greater than the first node counter value.

20. The network of claim 19, further comprising means for replacing the first node counter value with the current counter value in the memory of the second node if the current counter value is greater than the first node counter value and the second mechanism indicates message validity.