EMBEDDED MODULE SYSTEM WITH ENCRYPTED TOKEN AUTHENTICATION SYSTEM

• US 20130332730A1
• Filed: 03/15/2013
• Published: 12/12/2013
• Est. Priority Date: 06/12/2012
• Status: Active Grant

• Current Assignee: MEDTRONIC CARE MANAGEMENT SERVICES, LLC (Medtronic Plc)
• Original Assignee: Cardiocom LLC (Medtronic Plc)
• Inventors: Cosentino, Daniel L., Abrahamson, Christopher T.
• Granted Patent: US 9,338,141 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

Method and systems for accessing and providing protected content are disclosed herein. An example system includes a client configured to access a third-party application to receive at least one piece of content associated with a first identifier; wherein the client comprises a token generator configured to generate a token requesting the at least one piece of content, the token comprising at least one private encryption key and the first identifier. The system further includes an embedded module system comprising a database of content, the content separated into a plurality of modules, the embedded module system configured to receive the token and decrypt the at least one private encryption key. The embedded module system may further authorize the client by comparing the first identifier with a second identifier stored in the database.

Claims

1. system for providing content, the system comprising:

a client configured to access a third-party application to receive at least one piece of content associated with a first identifier;

wherein the client comprises a token generator configured to generate a token requesting the at least one piece of content, the token comprising at least one private encryption key and the first identifier;

an embedded module system comprising a database of content, the content separated into a plurality of modules, the embedded module system configured to receive the token and decrypt the at least one private encryption key;

wherein the embedded module system further authorizes the client by comparing the first identifier with a second identifier stored in the database; and

wherein if the second identifier matches the first identifier, the embedded module system transfers the at least one piece of content to the client for a session, wherein the at least one piece of content is received through at least one embedded user interface on the third-party application.

2. The system of claim 1, wherein the first identifier is one of:

a patient identifier, a client identifier, and a user identifier.

3. The system of claim 1, wherein the token further comprises a third identifier, wherein the third identifier is one of:

a patient identifier, a client identifier, and a user identifier.

4. The system of claim 1, wherein the token further comprises a module identifier and token lifetime information, wherein the module identifier identifies the at least one piece of content being requested, and wherein the token lifetime information includes a time period of the session.

5. The system of claim 1, wherein the at least one piece of content is interactive.

6. The system of claim 1, wherein the token generator is sent to the client from the embedded module system prior to token generation.

7. The system of claim 1, wherein the database includes at least one of:

a list of authorized users, a list of authorized patients, a list of authorized clients, wherein each list is associated with a different module in the plurality of modules.

8. The system of claim 1, wherein the token further comprises an IFRAME location.

9. The system of claim 1, wherein the at least one piece of content includes patient vital sign information, wherein the patient vital sign information includes at least one of weight measurements, blood pressure measurements, glucose measurements, peak flow measurements, O₂ saturation measurements, and heart rate measurements.

10. A method of requested embedded module content from an embedded module server comprising:

receiving a first request from a client device to open a frame on a third-party application;

sending a second request to a token generator to generate a token, wherein the second request includes a module identifier;

receiving a string from the token generator, the string including a base URL and a generated token;

appending the string with an assigned IFRAME location;

sending a third request for the embedded module content to the base URL, the third request including the appended string; and

receiving the embedded module content at the third-party application.

15. The method of claim 10, wherein the token generator is pre-stored in the client device prior to sending the first request.

11. The method of claim 11, wherein the generated token includes at least one of:

a patient identifier, a client identifier, a user identifier, and token lifetime information.

12. The method of claim 11, wherein sending the second request to the token generator causes the token generator to:

locate a configuration file on the client device;

retrieve information from the configuration file, the information including a local location of a private key and the base URL;

create the generated token based on the retrieved information; and

output the string.

13. The method of claim 11, wherein sending the third request for the embedded module content to the base URL causes the embedded module server to:

receive the appended string;

extract the generated token from the appended string;

authenticate the token;

retrieve the embedded module content that is requested; and

transmit the embedded module content to the third-party application.

14. The method of claim 13, wherein when the requested embedded module content is interactive, authenticating the token comprises more than one level of authentication.

16. A system for providing content, the system comprising:

a client device having a pre-stored token generator, the client device arranged and configured to access a third-party application stored on the client device, the third-party application further configured to;

receive a request from the client device to request specified content from an embedded module server;

send a second request to a token generator to generate a token, wherein the request includes a module identifier;

receive a string from the token generator, the string including a base URL and a generated token;

append the string with an assigned IFRAME location;

send a third request for the specified content to the base URL, the third request including the appended string; and

the embedded module server in communication with the third-party application, the embedded module server arranged and configured to;

receive the appended string;

extract the generated token from the appended string;

authenticate the generated token;

retrieve the specified content that is requested; and

transmit the specified content to the third-party application.

17. The system of claim 16, wherein the embedded module transmits the specified content to the third-party application in a PDF format.

18. The system of claim 16, wherein the PDF format includes an exception report.