Secure telemetric link

• US 8,102,999 B2
• Filed: 07/26/2007
• Issued: 01/24/2012
• Est. Priority Date: 08/18/2006
• Status: Active Grant

• Current Assignee: Medtronic Incorporated (Medtronic Plc)
• Original Assignee: Medtronic Incorporated (Medtronic Plc)
• Inventors: Corndorf, Eric D.
• Primary Examiner(s): HOFFMAN, BRANDON S
• Application Number:
  US11/828,940
• Publication Number:
  US 20080044014A1
• Time in Patent Office: 1,643 Days
• Field of Search: None
• US Class Current: 380/37
• CPC Class Codes: A61B 5/0031 Implanted circuitry
• CPC Class Codes: A61N 1/37252 Details of algorithms or data aspects of communication system, e.g. handshaking, transmitting specific data or segmenting data
• CPC Class Codes: A61N 1/37254 Pacemaker or defibrillator security, e.g. to prevent or inhibit programming alterations by hackers or unauthorised individuals
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/106 Packet or message integrity

Abstract

A communications protocol is used to provide data privacy, message integrity, message freshness, and user authentication to telemetric traffic, especially to and from implantable medical devices in a body area network. Encryption, message integrity, and message freshness are provided through use of token-like nonces and ephemeral session-keys derived from device identification numbers and pseudorandom numbers.

Claims

1. In a telecommunications network having at least a first and second node, a method of transmitting actionable data in a secured telemetry wake-up packet from the first node to the second node, the method comprising the steps of:

generating a message authentication code using a predefined protocol within the first node;

obtaining a current counter value from a memory of the first node indicative of a number of wake-up transmissions authored by the first node;

determining an identification of the second node;

composing a transmittable wake up message for the second node, wherein the transmittable wake up message includes the message authentication code, the current counter value and a predetermined amount of actionable data; and

transmitting the wake-up message.

2. The method of claim 1, wherein the message authentication code is generated with a 128 bit block cipher.

3. The method of claim 2, wherein generating the message authentication code further comprises:

inputting an identifier indicative of the first node into an input register of the block cipher;

inputting the current counter value into the input register;

inputting the actionable data into the input register;

inputting a receptor identification value indicative of the second node into the input register;

providing a network key to the block cipher; and

generating an output value from the block cipher at least a portion of which forms the message authentication code.

4. The method of claim 1, further comprising receiving an acknowledgement message from the second node.

5. The method of claim 1, wherein successful transmission of the wake-up message including actionable data initiates a native mode telemetry session, whereby any node in the native mode may send an ACK/NACK message upon receipt of the wake-up packet.

6. The method of claim 5, further comprising terminating the native mode session without permitting any additional data exchanges.

7. The method of claim 5, further comprising:

permitting each node engaged in the native mode session to send one or more of a single data packet and an ACK/NACK message; and

terminating the native mode session without permitting any additional data exchanges.

8. The method of claim 7, wherein permitting each node engaged in the native mode session to send one or more of the single data packet and the ACK/NACK message comprises permitting each node engaged in the native mode session to use wake-up security that does not require initiation of general security when sending the one or more of the single data packet and the ACK/NACK message.

9. The method of claim 1, further comprising:

receiving the wake-message at the second node;

identifying the sender of the wake-up message;

extracting the current counter value from the wake-up message;

comparing the current counter value to a first node counter value stored within a memory of the second node;

utilizing the comparison as a first mechanism to assess message validity;

extracting the message authentication code from the wake-up message;

calculating a first node message authentication code utilizing first node data in a block cipher accessible by the second node;

comparing the first node message authentication code with the message authentication code extracted from the wake up message as a second mechanism to assess message validity; and

accepting the actionable data from the wake-up message if both the first and second mechanisms indicate message validity.

10. The method of claim 9, wherein the first mechanism to assess message validity further comprises:

ignoring the wake-up message if the current counter value is less than the first node counter value stored in the memory of the second node;

advancing to the second mechanism and utilizing the first node counter value if the first node counter value is equal to the current counter value; and

advancing to the second mechanism and utilizing the current counter value if the current counter value is greater than the first node counter value.

11. The method of claim 10, further comprising replacing the first node counter value with the current counter value in the memory of the second node if the current counter value is greater than the first node counter value and the second mechanism indicates message validity.

12. The method of claim 10, further comprising incrementing the first node counter value in the memory of the second device if the second mechanism indicates message validity.

13. The method of claim 10, further comprising entering a native mode telemetry session if the second mechanism indicates message validity, wherein the second node is permitted to send an ACK message.

14. The method of claim 13, further comprising terminating the telemetry session without permitting additional data exchange.

15. The method of claim 13, further comprising:

allowing the receipt of a single additional data transmission from each node in the native telemetry mode;

permitting the transmission of a single data transmission from the second node; and

sending and receiving ACK/NACK messages prior to termination of the native telemetry mode.

16. A telecommunications network having at least a first and second node including transmitting actionable data in a secured telemetry wake-up packet from the first node to the second node comprising:

means for generating a message authentication code using a predefined protocol within the first node;

means for obtaining a current counter value from a memory of the first node indicative of a number of wake-up transmissions authored by the first node;

means for determining an identification of the second node;

means for composing a transmittable wake up message for the second node, wherein the transmittable wake up message includes the message authentication code, the current counter value and a predetermined amount of actionable data; and

means for transmitting the wake-up message.

17. The network of claim 16, wherein the means for generating the message authentication code further comprises:

means for inputting an identifier indicative of the first node into an input register of the block cipher;

means for inputting the current counter value into the input register;

means for inputting the actionable data into the input register;

means for inputting a receptor identification value indicative of the second node into the input register;

means for providing a network key to the block cipher; and

means for generating an output value from the block cipher at least a portion of which forms the message authentication code.

18. The network of claim 17, further comprising:

means for initiating a native mode telemetry session upon successful receipt of the wake-up message;

means for permitting each node engaged in the native mode session to send one or more of a single data packet and an ACK/NACK message; and

means for terminating the native mode session without permitting any additional data exchanges.

19. The network of claim 18, wherein the means for permitting each node engaged in the native mode session to send one or more of the single data packet and the ACK/NACK message comprises means for permitting each node engaged in the native mode session to use wake-up security that does not require initiation of general security when sending the one or more of the single data packet and the ACK/NACK message.

20. The network of claim 16, further comprising:

means for receiving the wake-message at the second node;

means for identifying the sender of the wake-up message;

means for extracting the current counter value from the wake-up message;

means for comparing the current counter value to a first node counter value stored within a memory of the second node;

means for utilizing the comparison as a first mechanism to assess message validity;

means for extracting the message authentication code from the wake-up message;

means for calculating a first node message authentication code utilizing first node data in a block cipher accessible by the second node;

means for comparing the first node message authentication code with the message authentication code extracted from the wake up message as a second mechanism to assess message validity; and

means for accepting the actionable data from the wake-up message if both the first and second mechanisms indicate message validity.

21. The network of claim 20, wherein the first mechanism to assess message validity further comprises:

means for ignoring the wake-up message if the current counter value is less than the first node counter value stored in the memory of the second node;

means for advancing to the second mechanism and utilizing the first node counter value if the first node counter value is equal to the current counter value; and

means for advancing to the second mechanism and utilizing the current counter value if the current counter value is greater than the first node counter value.

22. The network of claim 21, further comprising means for replacing the first node counter value with the current counter value in the memory of the second node if the current counter value is greater than the first node counter value and the second mechanism indicates message validity.

23. A first node that transmits actionable data in a secured telemetry wake-up packet to a second node, the first node comprising:

one or more processors that generate a message authentication code using a predefined protocol, obtain a current counter value from a memory of the first node indicative of a number of wake-up transmissions authored by the first node, determine an identification of the second node and compose a transmittable wake up message for the second node, wherein the transmittable wake up message includes the message authentication code, the current counter value and a predetermined amount of actionable data; and

a transceiver module that transmits the wake-up message.

24. The first node of claim 23, wherein the one or more processors further input an identifier indicative of the first node into an input register of the block cipher, input the current counter value into the input register, input the actionable data into the input register, input a receptor identification value indicative of the second node into the input register, provide a network key to the block cipher and generate an output value from the block cipher at least a portion of which forms the message authentication code.

25. The first node of claim 23, wherein the transceiver module, upon successful transmission of the wake-up message including actionable data, initiates a native mode telemetry session, whereby any node in the native mode may send an ACK/NACK message upon receipt of the wake-up packet.

26. The first node of claim 23, wherein the transceiver module terminates the native mode session without permitting any additional data exchanges.

27. The first node of claim 23, wherein the transceiver module permits each node engaged in the native mode session to send one or more of a single data packet and an ACK/NACK message and terminates the native mode session without permitting any additional data exchanges.

28. The first node of claim 27, wherein the transceiver module permits each node engaged in the native mode session to use wake-up security that does not require initiation of general security when sending the one or more of the single data packet and the ACK/NACK message.