Identity-based secure medical device communications

1. A system comprising:

a plurality of medical devices, wherein a medical device of the plurality of medical devices comprises:

an input device configured to:

read encoded control data from a medication container; and

decode the encoded control data to obtain encrypted control data;

a trusted processor comprising:

a secure data store storing a master secret key and a master public key;

a secret key generator configured to self-provision a device identifier-specific secret key, wherein to self-provision the device identifier-specific secret key, the secret key generator is configured to:

generate the device identifier-specific secret key using the master secret key and an identifier uniquely associated with the medical device; and

store the device identifier-specific secret key in the secure data store; and

a cryptography subsystem configured to:

receive the encrypted control data; and

generate decrypted control data using the encrypted control data and the device identifier-specific secret key, wherein the decrypted control data comprises a control device identifier;

wherein the trusted processor is configured to prohibit output, from the trusted processor, of the device identifier-specific secret key and the master secret key; and

a motor configured to cause fluid to be administered from the medication container, wherein the motor is permitted to be activated based at least partly on the control device identifier matching the identifier uniquely associated with the medical device; and

a setup system comprising computer-readable memory and one or more computer processors, wherein the setup system is configured to:

generate the master secret key and the master public key; and

provision the master secret key and the master public key to the trusted processor of each of the plurality of medical devices.

2. The system of claim 1 , further comprising a verification system comprising computer-readable memory and one or more computer processors, wherein the verification system is configured to:

generate a random nonce;

encrypt the random nonce to generate an encrypted nonce based at least partly on the master public key and an identifier of the medical device;

send the encrypted nonce to the medical device;

receive a response from the medical device; and

determine whether the response satisfies one or more identification verification criteria.

3. The system of claim 1 , further comprising a verification system comprising computer-readable memory and one or more computer processors, wherein the verification system is configured to:

generate a random nonce;

send the random nonce to the medical device;

receive a response from the medical device, wherein the response comprises encrypted data;

decrypt the encrypted data using the master public key and an identifier of the medical device; and

determine whether the response satisfies one or more identification verification criteria.

4. The system of claim 1 , further comprising an initial configuration system comprising computer-readable memory and one or more computer processors, wherein the initial configuration system is configured to:

execute an identification verification protocol with the medical device based at least partly on the master public key and an identifier of the medical device; and

in response to successful completion of the identification verification protocol, send a configuration file to the medical device.

5. The system of claim 1 , further comprising a medication preparation system comprising computer-readable memory and one or more computer processors, wherein the one or more computer processors are configured to:

generate control data comprising:

a device identifier associated with the medical device; and

a medication identifier associated with a medication container;

generate encrypted control data using the control data, the master public key, and the device identifier; and

generate an encoded label for the medication container using the encrypted control data.

6. The system of claim 1 , wherein the medical device is further configured to:

generate log data;

sign the log data using the cryptography subsystem to generate signed log data; and

export the signed log data to a third-party device.

7. The system of claim 1 , wherein the medical device is further configured to:

generate a configuration backup file;

sign the configuration backup file using the cryptography subsystem to generate a signed configuration backup file; and

export the signed configuration backup file.

8. A system comprising:

an infusion pump comprising:

an input device configured to:

read encoded control data from a medication container; and

decode the encoded control data to obtain encrypted control data;

a trusted processor comprising:

a secure data store storing a master secret key;

a secret key generator configured to self-provision an identifier-specific secret key associated with an identifier of the infusion pump, wherein to self-provision the identifier-specific secret key, the secret key generator is configured to:

generate the identifier-specific secret key using the master secret key and the identifier of the infusion pump; and

store the identifier-specific secret key in the secure data store such that the identifier-specific secret key is not accessible outside the trusted processor; and

a cryptography subsystem configured to:

receive the encrypted control data; and

decrypt the encrypted control data using the identifier-specific secret key to generate decrypted control data comprising a control device identifier; and

a motor configured to cause fluid to be administered from the medication container, wherein the motor is permitted to be activated based at least partly on the control device identifier matching the identifier of the infusion pump; and

a setup system comprising computer-readable memory and one or more computer processors, wherein the setup system is configured to:

generate the master secret key and a master public key; and

provision the master secret key and the master public key to the trusted processor.

9. The system of claim 8 , the infusion pump further comprising a network interface configured to receive a nonce from a verification system,

wherein the cryptography subsystem is further configured to encrypt the nonce using the identifier-specific secret key to generate an encrypted nonce, and

wherein the network interface is further configured to send the encrypted nonce to the verification system.

10. The system of claim 8 , the infusion pump further comprising a network interface configured to receive an encrypted nonce from a verification system,

wherein the cryptography subsystem is further configured to decrypt the encrypted nonce using the identifier-specific secret key to generate a decrypted nonce, and

wherein the network interface is further configured to send the decrypted nonce to the verification system.

11. The system of claim 8 , the infusion pump further comprising a network interface configured to:

execute an identification verification protocol with an initial configuration system based at least partly on the identifier-specific secret key; and

in response to successful completion of the identification verification protocol, receive a configuration file from a verification system.

12. The system of claim 8 , the infusion pump further configured to:

generate log data;

sign the log data using the cryptography subsystem to generate signed log data; and

export the signed log data to a third-party device.

13. The system of claim 8 , the infusion pump further configured to:

generate a configuration backup file;

sign the configuration backup file using the cryptography subsystem to generate a signed configuration backup file; and

export the signed configuration backup file.