Secure remote access for an implantable medical device

• US 7,890,180 B2
• Filed: 08/09/2004
• Issued: 02/15/2011
• Est. Priority Date: 08/09/2004
• Status: Active Grant

• Current Assignee: Cardiac Pacemakers Incorporated (Boston Scientific Corporation)
• Original Assignee: Cardiac Pacemakers Incorporated (Boston Scientific Corporation)
• Inventors: Quiles, Sylvia
• Primary Examiner(s): Bertram; Eric D.
• Application Number:
  US10/914,641
• Publication Number:
  US 20060030904A1
• Time in Patent Office: 2,381 Days
• Field of Search: 607 30- 32, 607 59- 60
• US Class Current: 607/60
• CPC Class Codes: A61N 1/37254 Pacemaker or defibrillator security, e.g. to prevent or inhibit programming alterations by hackers or unauthorised individuals

Abstract

This document discloses, among other things, a telemetry system that controls access to assets of an implantable device as a function of the manner of initiating the communication session or an access code. A tiered hierarchy of assets are associated with corresponding levels of access. A tiered array of security mechanisms are associated with the hierarchy of assets.

Claims

1. A method comprising:

receiving a request for a type of communication session from a user into an external device, wherein the requested communication session includes a request for access to a first set of implantable medical device (IMD) assets from among a plurality of sets of IMD assets;

determining with the external device a security protocol level required to access the first set of IMD assets from among a plurality of security protocol levels useable by that external device, wherein the security protocols have varying different levels of complexity according to a level of potential risk posed to patient health by the access to the set of IMD assets;

communicating the request to the IMD, wherein the determined security protocol level is applied to the communication, wherein access to different respective sets of IMD assets is granted by the IMD upon the IMD determining satisfaction of the security protocols of different respective complexity levels;

permitting, by the IMD to the external device, access to the first set of IMD assets when the security protocol meets a level of security required to access the first set of IMD assets; and

preventing access to the set of IMD assets when the level of security of the security protocol does not meet the level of security required to access the IMD assets.

2. The method of claim 1, further including identifying the plurality of assets of the implantable device.

3. The method of claim 2, wherein identifying the plurality of assets includes identifying an interface to the asset that presents a risk to a patient.

4. The method of claim 1, including generating the request for access from user-entered access information, wherein the user-entered access level information corresponds to a plurality of risks to a patient.

5. The method of claim 1, further including selecting, based upon user-entered access level information, a receiving antenna from a plurality of receiving antennas.

6. The method of claim 1, wherein the first selected set of assets includes reading a predetermined set of memory registers of the implantable device.

7. The method of claim 1, wherein the first selected set of assets includes an asset that affects an image generated by the implantable device.

8. The method of claim 7, wherein the asset includes a parameter for selecting an electrocardiogram display scale.

9. The method of claim 1, wherein the first selected set of assets includes at least one of an asset that affects communications with the implantable device, a diagnostic test, a command supported by a programmer during a patient follow-up, a command supported by a programmer during device implantation and a command for uploading software.

10. The method of claim 1, wherein a prohibited set of assets is an empty set.

11. The method of claim 1, wherein receiving the request includes receiving an access level change request.

12. The method of claim 11, wherein the request is encrypted.

13. The method of claim 11, wherein the request is in plaintext.

14. The method of claim 1, further including:

receiving an access level change request; and

checking authorization prior to changing access level.

15. The method of claim 1, wherein a second selected set of assets of the plurality of assets are accessible when the communication session is initiated using a near field coupling.

16. The method of claim 1, wherein a second selected set of assets of the plurality of assets are accessible when the communication session is initiated using a far field coupling.

17. The method of claim 1, wherein the plurality of assets are hierarchical and cumulative with increasing level.

18. The method of claim 1, wherein at least one access level permits reading of a memory register.

19. The method of claim 1, further including:

receiving an instruction to access an asset; and

receiving an affirming signal from a user operable switch.

20. The method of claim 19, further including, upon receiving the affirming signal, executing the instruction.

21. The method of claim 19, further including, upon receiving the affirming signal, storing a configuration parameter in a permanent memory.

22. The method of claim 1, wherein a parameter of the implantable device is restored to a previous value upon interruption of the communication session.

23. The method of claim 1, wherein the implantable device executes a cryptographic security algorithm to authenticate a message from the external device.

24. The method of claim 1, further including:

encrypting selected data stored in a memory of the implantable device; and

transmitting the encrypted selected data.

25. The method of claim 1, further including decrypting a received message.

26. The method of claim 1, further including configuring the implantable device to execute at least one of a protocol based security check and a message authentication algorithm.

27. The method of claim 1, further including receiving an instruction to change the implantable device from a first configuration to a second configuration wherein the first configuration differs from the second configuration.

28. The method of claim 27, further including implementing the change by storing a parameter in a temporary memory register.

29. The method of claim 27, further including monitoring for a manual activation of an external switch to affirm the change.

30. The method of claim 28, wherein the parameter is stored in permanent memory following manual activation of an external switch.

31. The method of claim 27, wherein the implantable device reverts to the first configuration if the communication session is interrupted.

32. The method of claim 1 wherein at least two security protocols differ in a measure of robustness.

33. The method of claim 1 wherein the plurality of security protocols includes at least one of a public key infrastructure (PKI) algorithm, a message authentication algorithm, and a non-repudiation algorithm.

34. The method of claim 1 wherein receiving the request includes receiving a far field telemetry signal.