Permission-based control of interfacing components with a medical device
Disclosed are embodiments directed to security methods applied to connections between components in a distributed (networked) system including medical and non-medical devices, providing secure authentication, authorization, patient and device data transfer, and patient data association and privacy for components of the system.
1. A patient monitoring medical device system, comprising:
a trusted component intended for communication with a patient monitoring medical device, the patient monitoring medical device comprising a wearable cardiac monitoring system, the trusted component including:
a processor configured to execute instructions;
a communication component configured to facilitate communication between the trusted component and other components; and
a memory including a certificate store in which is stored:
a security certificate, the security certificate including:
information that specifically identifies the trusted component,
a public key that enables encryption of data intended to be delivered to the trusted component,
at least one data field that implies at least one function that the trusted component may perform in connection with the patient monitoring medical device wherein the at least one data field comprises an element type, and further wherein the element type has an associated set of permissions that authorize a set of tasks that the trusted component may perform in connection with the patient monitoring medical device system, and
a signature that authenticates the security certificate as being attested to by a Certificate Authority; and
a private key corresponding to the public key;
wherein the processor is programmed to cause the communication component to transmit the security certificate to the patient monitoring medical device in support of a request for communication with the patient monitoring medical device.
2. The patient monitoring medical device system recited in claim 1 , wherein the Certificate Authority is a component of the patient monitoring medical device system.
3. The patient monitoring medical device system recited in claim 1 , wherein the wearable cardiac monitoring system comprises a Wearable Cardioverter Defibrillator.
4. The patient monitoring medical device system recited in claim 3 , wherein the wearable cardioverter defibrillator is further configured to deny secure communications with the trusted component if the security certificate is not properly attested to by the Certificate Authority.
5. The patient monitoring medical device system recited in claim 4 , wherein the wearable cardioverter defibrillator is further configured to deny secure communications with the trusted component if the security certificate is revoked.
6. The patient monitoring medical device system recited in claim 1 , wherein the patient monitoring medical device is further configured to deny secure communications with the trusted component if the security certificate is not properly attested to by the Certificate Authority.
7. The patient monitoring medical device system recited in claim 1 , wherein the patient monitoring medical device is further configured to deny secure communications with the trusted component if the security certificate is revoked.
8. The patient monitoring medical device system recited in claim 1 , wherein the trusted component is further configured to communicate data from the patient monitoring medical device to a cloud-based server.
9. The patient monitoring medical device system recited in claim 1 , wherein the secure communication includes patient physiological data that can be used in treating a medical condition.