SYSTEM AND METHOD FOR CONFIRMING IDENTITY AND AUTHORITY BY A PATIENT MEDICAL DEVICE

• US 20130185783A1
• Filed: 12/28/2012
• Published: 07/18/2013
• Est. Priority Date: 03/29/2007
• Status: Active Grant

• Current Assignee: Cardiac Pacemakers Incorporated (Boston Scientific Corporation)
• Original Assignee: Cardiac Pacemakers Incorporated (Boston Scientific Corporation)
• Inventors: Jelatis, George D., Healy, Scott J.
• Granted Patent: US 9,781,086 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: A61N 1/37252 Details of algorithms or data aspects of communication system, e.g. handshaking, transmitting specific data or segmenting data
• CPC Class Codes: A61N 1/37254 Pacemaker or defibrillator security, e.g. to prevent or inhibit programming alterations by hackers or unauthorised individuals
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G16H 40/63 for local operation
• CPC Class Codes: G16Z 99/00 Subject matter not provided for in other main groups of this subclass
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2209/88 Medical equipments
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A system and method for confirming identity and authority by a patient medical device is provided. Master credentials are issued to a requesting device and a receiving device from an authorizing agent. The master credentials include a public key of the authorizing agent and a digital signature of a root certification authority. Device credentials are issued to the requesting device from the authorizing agent. The device credentials include a public key of the requesting device and a digital signature of the authorizing agent. Identification credentials are provided to the receiving device and include the device credentials and a digital signature of the requesting device. The requesting device is authenticated. The digital signature of the authorizing agent in the device credentials is checked using the public key of the authorizing agent in the master credentials of the receiving device. The digital signature of the requesting device in the identification credentials is checked using the public key of the requesting device in the device credentials.

Claims

1. A system for confirming identity and authority by a patient medical device, comprising:

master credentials issued to a requesting device and a receiving device from an authorizing agent comprising a public key of the authorizing agent and a digital signature of a root certification authority;

device credentials issued to the requesting device from the authorizing agent comprising a public key of the requesting device and a digital signature of the authorizing agent;

identification credentials provided to the receiving device comprising the device credentials and a digital signature of the requesting device; and

an authentication module configured to authenticate the requesting device, comprising;

a device credential module configured to check the digital signature of the authorizing agent in the device credentials using the public key of the authorizing agent in the master credentials of the receiving device; and

an identification credential module configured to check the digital signature of the requesting device in the identification credentials using the public key of the requesting device in the device credentials.

2. The system of claim 1, wherein one of interrogation and programming of the receiving device are permitted upon successful authentication of the requesting device.

3. The system of claim 1, further comprising:

further master credentials issued to the requesting device and the receiving device from a verification agent comprising a public key of the verification agent and a digital signature of a root certification authority;

authorization credentials issued to the requesting device from the verification agent comprising a digital signature of the verification agent;

access credentials provided in lieu of the identification credentials to the receiving device and comprising the device credentials, the authorization credentials, and a digital signature of the requesting device; and

an authorization module configured to authenticate authorization of the requesting device, comprising;

a further device credentials module configured to check the digital signature of the authorizing agent in the device credentials using the public key of the authorizing agent in the master credentials of the receiving device;

an authorization credentials module configured to check the digital signature of the verification agent in the authorization credentials using the public key of the verification agent in the further master credentials of the receiving device; and

an access credentials module configured to check the digital signature of the requesting device in the access credentials using the public key of the requesting device in the device credentials.

4. The system of claim 3, further comprising:

at least one of permissions, limits, and restrictions on the requesting device included in the authorization credentials, wherein the at least one permission, limit, and restriction in the access credentials are checked.

6. The system of claim 4, wherein one of interrogation and programming of the receiving device within the at least one permission, limit, and restriction are permitted upon successful authentication of the requesting device.

7. The system of claim 3, wherein the master credentials, further master credentials, device credentials, and authorization credentials comprise digital asymmetric public and private key pairs.

8. The system of claim 1, further comprising:

a chain of trust, comprising a root certification authority, wherein the trust is delegated to one or more further certification authorities from the root certification authority.

9. The system of claim 8, wherein the chain of trust is structured as a hierarchy and the further certification authorities inherit the trust from the root certification authority.

10. The system of claim 1, wherein the requesting device is selected from the group comprising a programmer and a personal communicator, each of which can interrogate or program the receiving device using long range telemetry.

11. The system of claim 1, wherein the receiving device comprises an implantable medical device selected from the group comprising a pacemaker, implantable cardioverter-defibrillator, and cardiac resynchronization therapy device.

5. (canceled)

12. A method for confirming identity and authority by a patient medical device, comprising:

issuing master credentials to a requesting device and a receiving device from an authorizing agent comprising a public key of the authorizing agent and a digital signature of a root certification authority;

issuing device credentials to the requesting device from the authorizing agent comprising a public key of the requesting device and a digital signature of the authorizing agent;

providing identification credentials to the receiving device comprising the device credentials and a digital signature of the requesting device; and

authenticating the requesting device, comprising;

checking the digital signature of the authorizing agent in the device credentials using the public key of the authorizing agent in the master credentials of the receiving device; and

checking the digital signature of the requesting device in the identification credentials using the public key of the requesting device in the device credentials.

13. The method of claim 12, further comprising:

permitting one of interrogation and programming of the receiving device upon successful authentication of the requesting device.

14. The method of claim 12, further comprising:

issuing further master credentials to the requesting device and the receiving device from a verification agent comprising a public key of the verification agent and a digital signature of a root certification authority;

issuing authorization credentials to the requesting device from the verification agent comprising a digital signature of the verification agent;

providing access credentials in lieu of the identification credentials to the receiving device and comprising the device credentials, the authorization credentials, and a digital signature of the requesting device; and

authenticating authorization of the requesting device, comprising;

checking the digital signature of the authorizing agent in the device credentials using the public key of the authorizing agent in the master credentials of the receiving device;

checking the digital signature of the verification agent in the authorization credentials using the public key of the verification agent in the further master credentials of the receiving device; and

checking the digital signature of the requesting device in the access credentials using the public key of the requesting device in the device credentials.

15. The method of claim 14, further comprising:

including at least one of permissions, limits, and restrictions on the requesting device in the authorization credentials; and

checking the at least one permission, limit, and restriction in the access credentials.

17. The method of claim 15, further comprising:

permitting one of interrogation and programming of the receiving device within the at least one permission, limit, and restriction upon successful authentication of the requesting device.

18. The method of claim 14, wherein the master credentials, further master credentials, device credentials, and authorization credentials comprise digital asymmetric public and private key pairs.

19. The method of claim 12, further comprising:

defining a chain of trust, comprising a root certification authority; and

delegating the trust to one or more further certification authorities from the root certification authority.

20. The method of claim 19, further comprising:

structuring the chain of trust as a hierarchy, wherein the further certification authorities inherit the trust from the root certification authority.

21. The method of claim 12, wherein the requesting device is selected from the group comprising a programmer and a personal communicator, each of which can interrogate or program the receiving device using long range telemetry.

22. The method of claim 12, wherein the receiving device comprises an implantable medical device selected from the group comprising a pacemaker, implantable cardioverter-defibrillator, and cardiac resynchronization therapy device.

16. (canceled)

23. (canceled)