Threshold signature based medical device management
The present disclosure is directed to managing device authorization through the use of digital signature thresholds. Individual components of a device, or individual devices in a network environment, are associated with separate secret shares from which a digital signature can be derived. The digital signature may be used to authorize performance of a function. A threshold number of such secret shares are used in order to derive the digital signature. Therefore, an authorization process that relies on digital signature verification to determine that a function is authorized will do so if a threshold number of secret shares are available at authorization time.
1. An infusion pump comprising:
a security monitor;
a motor control unit configured to control infusion of medication, wherein the motor control unit is associated with a first component identifier;
a battery configured to power the infusion pump, wherein the battery is associated with a second component identifier;
a computer processor programmed with executable instructions, wherein the computer processor is associated with a third component identifier; and
a data store storing:
verification key data representing a verification key;
share data representing a plurality of secret shares for generating a digital signature, wherein a first secret share of the plurality of secret shares is associated with the first component identifier, wherein a second secret share of the plurality of secret shares is associated with the second component identifier, and wherein a third secret share of the plurality of secret shares is associated with the third component identifier; and
a plurality of weights, wherein individual weights of the plurality of weights are associated with individual secret shares of the plurality of secret shares;
wherein the computer processor is programmed by the executable instructions to at least:
determine that a command has been issued for execution of software that controls a function of the infusion pump;
determine a plurality of component identifiers, wherein individual component identifiers of the plurality of component identifiers correspond to individual components of the infusion pump present at a time the command is issued;
load at least a subset of the plurality of secret shares based at least partly on the plurality of component identifiers;
generate a plurality of signature shares using the subset of the plurality of secret shares, wherein a threshold number of weighted shares is required in order to generate a threshold number of signature shares;
generate the digital signature using the plurality of signature shares;
verify the digital signature using the verification key; and
authorize execution of the software; and
wherein the security monitor is configured to at least:
detect occurrence of a security event; and
reduce a value of a weight based at least partly on the security event,
wherein the weight is associated with a component of the infusion pump, and
wherein the security monitor is associated with the component of the infusion pump.
2. The infusion pump of claim 1 , wherein the security event comprises one of: a failed login attempt, a medication alert, a security override attempt, a repeated ping, network scanning activity, a denial of service event, or an error.
3. The infusion pump of claim 1 , wherein the computer processor is further programmed to execute the software in response to authorizing execution of the software, wherein executing the software causes one of: dispensing medication, or communicating with a network server.
4. The infusion pump of claim 1 , wherein the computer processor is further programmed to store the first secret share in a secure storage location associated with a corresponding component of the infusion pump.
5. The infusion pump of claim 1 , wherein the computer processor is further programmed to store an obfuscated version of the first secret share.
6. The infusion pump of claim 1 , wherein a second component of the infusion pump is configured to:
detect occurrence of a second security event, wherein the security event is an infusion-related event, and wherein the second security event is different from the security event; and
modify a value of a second weight associated with the second component based at least partly on the second security event.
7. The infusion pump of claim 1 , wherein to modify the value of the weight, the security monitor is further configured to:
determine, based on the security event, a first modification to be applied to the value of the weight, wherein the security event is associated with the first modification, wherein a second security event is associated with a second modification different from the first modification, wherein the security event is an infusion-related event, and wherein the second security event is different from the security event; and
apply the first modification to the value of the weight.
8. The infusion pump of claim 1 , wherein to reduce the value of the weight, the security monitor is further configured to apply an incremental modification to the value of the weight to produce a modified weight.
9. The infusion pump of claim 8 , wherein the security monitor is further configured to:
detect occurrence of a second security event, wherein the security event is an infusion-related event, and wherein the second security event is different from the security event; and
apply the incremental modification.
10. A computer-implemented method comprising:
under control of an infusion system comprising a security monitor, a motor control unit associated with a first component identifier and configured to control infusion of medication, a battery associated with a second component identifier and configured to power the infusion system, a computer processor associated with a third component identifier, a security monitor, and a data store:
determining that a command has been issued for execution of software that controls a function of the infusion system;
determining a plurality of component identifiers, wherein individual component identifiers of the plurality of component identifiers correspond to individual components of the infusion system present at a time the command is issued;
load at least a subset of a plurality of secret shares from the data store based at least partly on the plurality of component identifiers, wherein the data store stores:
verification key data representing a verification key;
share data representing the plurality of secret shares for generating a digital signature, wherein a first secret share of the plurality of secret shares is associated with the first component identifier, wherein a second secret share of the plurality of secret shares is associated with the second component identifier, and wherein a third secret share of the plurality of secret shares is associated with the third component identifier; and
a plurality of weights, wherein individual weights of the plurality of weights are associated with individual secret shares of the plurality of secret shares;
generating a plurality of signature shares using the subset of the plurality of secret shares, wherein a threshold number of weighted shares is required in order to generate a threshold number of signature shares;
generating the digital signature using the plurality of signature shares;
verifying the digital signature using the verification key;
authorizing execution of the software;
detecting occurrence of a security event; and
reducing a value of a weight based at least partly on the security event,
wherein the weight is associated with a component of the infusion system, and wherein the security monitor is associated with the component of the infusion system.
11. The computer-implemented method of claim 10 , wherein the security event comprises one of: a failed login attempt, a medication alert, a security override attempt, a repeated ping, network scanning activity, a denial of service event, or an error.
12. The computer-implemented method of claim 10 , further comprising executing the software in response to authorizing execution of the software, wherein executing the software causes one of: dispensing medication, or communicating with a network server.
13. The computer-implemented method of claim 10 , further comprising storing the first secret share in a secure storage location associated with a corresponding component of the infusion system.
14. The computer-implemented method of claim 10 , further comprising storing an obfuscated version of the first secret share.
15. The computer-implemented method of claim 10 , further comprising:
detecting occurrence of a second security event, wherein the security event is an infusion-related event, and wherein the second security event is different from the security event; and
modifying a value of a second weight based at least partly on the second security event.
16. The computer-implemented method of claim 10 , wherein reducing the value of the weight comprises:
determining, based on the security event, a first modification to be applied to the value of the weight, wherein the security event is associated with the first modification, wherein a second security event is associated with a second modification different from the first modification, wherein the security event is an infusion-related event, and wherein the second security event is different from the security event; and
applying the first modification to the value of the weight.
17. The computer-implemented method of claim 10 , wherein reducing the value of the weight comprises applying an incremental modification to the value of the weight to produce a modified weight.
18. The computer-implemented method of claim 17 , further comprising:
detecting occurrence of a second security event, wherein the security event is an infusion-related event, and wherein the second security event is different from the security event; and
applying the incremental modification.