Patent Description:
Many different types of implantable biomedical devices are used to provide aid to patients for a variety of reasons. Some are used for mechanical purposes, such as, for example, joint replacements, lens replacements, stents, etc. Other implantable biomedical devices perform data operations, and therefore include electronic processing capabilities. Such "smart" implantable biomedical devices might monitor biological functions and/or provide therapies to the patient in whom the implantable biomedical device resides. For example, such "smart" implantable biomedical devices can include cardiac monitors, pacemakers, implantable cardioverter-defibrillators, and neural stimulators, etc. These implantable biomedical devices can sense biometrics of the body and use these biometrics for diagnostic or therapeutic purposes. For example, such implantable biomedical devices can deliver electrical stimulations and/or deliver drugs to the body for therapeutic purposes. For instance, a pacemaker can sense a heart rate of a patient, determine whether the heart is beating too fast or too slow, and transmit electrical stimulation to the heart to speed up or slow down different chambers of the heart. An implantable cardioverter-defibrillator can sense a heart rate of a patient, detect a dysrhythmia, and transmit an electrical shock to the patient so as to normalize the heart rate of the patient. <CIT> describes a method for communicating medical data via a secure channel between medical devices connected to each other through a network. <CIT> describes the processing of encrypted data received from an Internet of Things enabled device, such as a heart monitoring implant.

Such "smart" implantable biomedical devices can be configured to communicate sensed biometric data to the external world, as well as receive various data therefrom. Such data communications to and/or from an implantable biomedical device can present various risks. For example, sensed biometric data can contain information that is private to the patient, and therefore communications of such sensed biometric data should be secure so that only the intended authorized recipient is able to receive this sensitive data. Furthermore, configuration data sent to the "smart" implantable biomedical device can result in changes in the behavior and/or operation of the reconfigured device. Such changes should be prescribed only by authorized persons who are responsible for the care of the patient in whom the "smart" implantable biomedical device has been implanted. Such authorized persons might include, for example, the patient's physician and/or the manufacturer of the implantable biomedical device. <CIT> describes a medical monitoring and communication system for wireless communication between an implantable medical device, a mobile user device, and a remote server.

Apparatus and associated methods relate to a method for providing secure gatekeeping of a communication transmitted from an implantable biomedical device to a remote internet-based website. The method includes wirelessly receiving, by a gatekeeping device, the communication transmitted from the implantable biomedical device. The communication wirelessly received is encoded by the implantable biomedical device using a first encoding algorithm. The method includes decoding, by the gatekeeping device, the communication wirelessly received. The method includes encoding, by the gatekeeping device, the communication decoded using a second encoding algorithm. The method also includes relaying, by the gatekeeping device, the communication encoded using the second encoding algorithm to the remote internet-based website via the internet.

Some embodiments relate to a system for providing secure gatekeeping of a communication transmitted from an implantable biomedical device to a remote internet-based website. The system includes a gatekeeping device in communication with both the implantable biomedical device and the internet and computer readable memory. The computer readable memory is encoded with instructions that cause the system to wirelessly receive, by the gatekeeping device, the communication transmitted by the implantable biomedical device. The communication wirelessly received is encoded by the implantable biomedical device using a first encoding algorithm. The computer readable memory is encoded with instructions that cause the system to decode, by the gatekeeping device, the communication wirelessly received. The computer readable memory is encoded with instructions that cause the system to encode, by the gatekeeping device, the communication decoded using a second encoding algorithm. The computer readable memory is also encoded with instructions that cause the system to relay, by the gatekeeping device, the communication encoded using the second encoding algorithm to the remote internet-based website via the internet.

According to a first aspect of the invention there is provided A method for providing secure gatekeeping of a communication transmitted from an implantable biomedical device to a remote internet-based website, the method comprising:.

Advantagesously, the method further comprises:
transmitting, by the gatekeeping device, a proximity signal to be used to determine proximity of the gatekeeping device to the implantable biomedical device.

The proximity signal may be a magnetic field.

The wirelessly receiving the communication may be contingent upon the proximity of the gatekeeping device to the implantable biomedical device being within a predetermined distance.

The method may further comprise:
secure pairing the gatekeeping device and the implantable biomedical device such that the implantable biomedical device can reject any rogue communications transmitted thereto by non-paired devices.

Secure pairing the gatekeeping device and the implantable biomedical device may comprise: transmitting, by the gatekeeping device if proximate the implantable biomedical device, authentication information pertaining to the gatekeeping device to the implantable biomedical device.

Secure pairing the gatekeeping device and the implantable biomedical device may comprise: receiving, by the gatekeeping device if proximate the implantable biomedical device, authentication information pertaining to the implantable biomedical device.

Secure pairing of the gatekeeping device and the implantable biomedical device may comprise: receiving, by the gatekeeping device if proximate the implantable biomedical device, a reference signal from the implantable biomedical device, the reference signal indicative of an initial time reference of the implantable biomedical device.

Secure pairing of the gatekeeping device and the implantable biomedical device may comprise: transmitting, by the gatekeeping device if proximate the implantable biomedical device, a reference signal to the implantable biomedical device, the reference signal indicative of an initial time reference of the implantable biomedical device.

According to a second aspect of the invention there is provided a system for providing secure gatekeeping of a communication transmitted from an implantable biomedical device to a remote internet-based website, the system comprising:.

The computer readable memory may be encoded with further instructions that cause the system to:
transmit, by the gatekeeping device, a proximity signal to be used to determine proximity of the gatekeeping device to the implantable biomedical device.

To wirelessly receive the communication the computer readable memory may be encoded with further instructions that cause the system to:
wirelessly receive, by the gatekeeping device if the proximity of the gatekeeping device to the implantable biomedical device being within a predetermined distance, the communication transmitted by the implantable biomedical device, wherein the communication wirelessly received is encoded using a first encoding algorithm.

The computer readable memory may be encoded with further instructions that cause the system to:
securely pair the gatekeeping device and the implantable biomedical device such that the implantable biomedical device can reject any rogue communications transmitted thereto by non-paired devices.

To securely pair the gatekeeping device and the implantable biomedical device the computer readable memory may be encoded with further instructions that cause the system to:
transmit, by the gatekeeping device if proximate the implantable biomedical device, authentication information pertaining to the gatekeeping device to the implantable biomedical device.

To securely pair the gatekeeping device and the implantable biomedical device the computer readable memory may be encoded with further instructions that cause the system to:
receive, by the gatekeeping device if proximate the implantable biomedical device, authentication information pertaining to the implantable biomedical device.

To securely pair the gatekeeping device and the implantable biomedical device the computer readable memory may be encoded with further instructions that cause the system to:
receive, by the gatekeeping device if proximate the implantable biomedical device, a reference signal from the implantable biomedical device, the reference signal indicative of an initial time reference of the implantable biomedical device.

To securely pair the gatekeeping device and the implantable biomedical device the computer readable memory may be encoded with further instructions that cause the system to:
transmit, by the gatekeeping device if proximate the implantable biomedical device, a reference signal to the implantable biomedical device, the reference signal indicative of an initial time reference of the implantable biomedical device.

Apparatus and associated methods relate to communications between an implantable biomedical device and various authorized entities via the internet. These apparatus and associated methods make secure communications between the implantable biomedical device and remote IP-addressable internet entities. Security for such communications to and/or from the implantable biomedical device are ensured via various security measures, such as, for example, proximal pairing, directional safety, and virtual mirroring of the implantable biomedical device. Communications between the implantable biomedical device and various of these authorized IP-addressable entities, such as a manufacturer of the implantable biomedical device or a physician of the patient in whom the implantable biomedical device has been implanted, can occur through a gatekeeping device - a paired proximate communications device, such as a cell phone of the patient, for example. Only if the gatekeeping device is proximate the implantable biomedical device, will some such communications be permitted. Furthermore, communications, such as updates or reconfigurations of the implantable biomedical device can be restricted to only those updates in which a direction of safety is increased for the patient (i.e., the implantable device will become more safe for the patient). Moreover, these updates and/or reconfigurations are performed first on a virtual device that mirrors the actual implantable biomedical device. Such updates and/or reconfigurations can be modeled and/or simulated so as to ensure increased safety of these changes to the implantable biomedical device. Security can be further strengthened using various additional methods, such as, for example, device authentication, and public-private security-key encoding, restrictions of some communications via intranets, virtual private networks, firewalls, etc..

<FIG> is a schematic diagram depicting Internet Protocol (IP) based communications between an implantable biomedical device and a remote internet-based entity. In <FIG>, patient <NUM> has implantable biomedical device <NUM> subcutaneously implanted within. Patient <NUM> is holding gatekeeping device <NUM> in his hand. In the depicted embodiment, gatekeeping device <NUM> is a smart phone, but gatekeeping device could be something different than a smartphone, such as, for example, a dedicated gatekeeping device specifically manufactured to perform such gatekeeping functions. Gatekeeping device <NUM> is depicted as facilitating communications between implantable biomedical device <NUM> and internet cloud <NUM>. Because gatekeeping device <NUM> is a smart phone in the depicted embodiment, communications between internet cloud <NUM> and gatekeeping device <NUM> are transmitted via cell-phone tower <NUM>. Gatekeeping device <NUM> is called such (i.e., "gatekeeping device") because gatekeeping device <NUM> operates as a gatekeeper for various communications between internet cloud <NUM> and implantable biomedical device <NUM>. Myriad other devices and systems are configured to communicate with internet cloud <NUM>, such as, for example, hosting server <NUM>, medical device manufacturer <NUM>, and personal computer <NUM>. Hosting server <NUM> can be configured to host IP-addressable website <NUM> on the internet, for example. Personal computer <NUM> might be used by physician <NUM> of patient <NUM>, for example.

IP-addressable website <NUM> includes virtual device <NUM> that is configured to precisely mirror implantable biomedical device <NUM>, which had been implanted into patient <NUM>. Hosting server <NUM> is configured to model or simulate the operation of implantable biomedical device <NUM> using virtual device <NUM>. Such modeling can be performed so as to ensure safe operation of implantable medical device <NUM>, before updates to and/or reconfigurations of actual implantable biomedical device <NUM> are performed. IP-addressable website <NUM> can have an IP address associated with the specific implantable biomedical device - implantable biomedical device <NUM> - that has been implanted into patient <NUM>. In some embodiment the IP address of IP-addressable website <NUM> is a static IP address that is secret (e.g., only known by a manufacturer, and perhaps the patient and/or physician). Implantable biomedical device <NUM> can also have a static IP address that is secret. The gatekeeping device can have either a static or a dynamic IP address, depending on the configuration of the gatekeeping device.

Because virtual device <NUM> is associated with implantable biomedical device <NUM>, IP-addressable website <NUM> can appear as if it were implantable biomedical device <NUM> to those who have need to communicate with implantable biomedical device <NUM>. For example, if physician <NUM> desires to update the configuration of implantable biomedical device <NUM> of patient <NUM>, physician <NUM> can communicate such desired updated configuration to IP-addressable website <NUM>, which is associated with implantable biomedical device <NUM>. IP-addressable website <NUM> can then validate safety of such an updated and/or reconfigured implantable biomedical device <NUM> based on modeling and/or simulation of virtual device <NUM>, before actually updating or reconfiguring implantable biomedical device <NUM> at a future time,. Upon such validation of safety, IP-addressable website <NUM> can then transmit the configuration data to the actual implantable biomedical device <NUM> through gatekeeping device <NUM>. In this way, it appears to physician <NUM> that when communicating with IP-addressable website <NUM>, physician <NUM> is communicating with implantable biomedical device <NUM>. Virtual device <NUM> will be described in more detail below in a section entitled: "Virtual Image (Mirrored Counterpart of Implantable Biomedical Device).

Direction of safety for such updates and reconfigurations can be determined by IP-addressable website <NUM> based on the simulations of updated virtual device <NUM>. If the direction of safety is improved (i.e., implantable biomedical device will operate in a manner that is more safe after the update or reconfiguration than before the update or reconfiguration) then the update or reconfiguration will be transmitted from IP-addressable website <NUM> to implantable biomedical device <NUM> (e.g., via gatekeeping device <NUM>). If, however, the direction of safety is not improved (i.e., implantable biomedical device will operate in a manner that is not safer after the update or reconfiguration than before the update or reconfiguration) then the update or reconfiguration will not be transmitted by IP-addressable website <NUM>. Directional safety will be described below in more detail below in a section entitled: "Directional Safety. "Gatekeeping device <NUM> provides security to communications between implantable biomedical device <NUM> and internet cloud <NUM> via various methods and protocols. For example, gatekeeping device <NUM> has been paired with implantable biomedical device <NUM> at an earlier time. Biomedical device <NUM>, for example, can be configured to ignore all attempted communications that are not originated by a device paired thereto, such as gatekeeping device <NUM>. Secure pairing of one or few devices with implantable biomedical device <NUM> can prevent rogue communications from unauthorized devices. Furthermore, communications to and/or from implantable biomedical devices can be limited by a proximity requirement. For example, implantable biomedical device <NUM> can be configured to communicate only with devices that are within a predetermined range from implantable biomedical device <NUM>. Methods for proximal limiting of communications to and/or from implantable biomedical device <NUM> will be described below.

In addition to using virtual device <NUM> and gatekeeping device <NUM>, other security measures provide additional safety to communications between implantable biomedical device <NUM> and authorized persons. For example, data encryption between gatekeeping device and IP-addressable website <NUM> can be used to verify and/or validate the authorized source and destination of such communications, as well as preventing unwanted persons from decrypting such sensitive and/or private data. Authentication of authorized entities can also be performed so as to limit the number of entities that have authority to communicate with implantable biomedical device <NUM>. Such gatekeeping security measures will be further described below in a section entitled: "Proximal Pairing.

<FIG> is a flow chart of a method for secure pairing of a gatekeeping device with an implantable biomedical device. In <FIG>, method <NUM> is described from a vantage point of a processor of gatekeeping device <NUM> (depicted in <FIG>). In some embodiments, method <NUM> will be performed at a time before or after implantable biomedical device <NUM> has been implanted into patient <NUM>. Such secure pairing can be performed in a hospital where the implantation is performed, or at a physician's office after implantation has been performed, for example. Method <NUM> begins at step <NUM>, where gatekeeping device <NUM> is associated with patient <NUM>. Such association can include password or fingerprint protecting operation of gatekeeping device <NUM>, for example, such that only patient <NUM> can operate gatekeeping device <NUM>. After gatekeeping device <NUM> is associated with patient <NUM>, method <NUM> proceeds to step <NUM>, where communications software is received by and installed into gatekeeping device <NUM>. Such communications software supports communications, encoding, validation of authorization, and other operations used to facilitate communications between implantable biomedical device <NUM> and remote authorized entities via the internet.

After such configuring of gatekeeping device <NUM>, method <NUM> proceeds to step <NUM>, where the processor of gatekeeping device <NUM> determines location of gatekeeping device (e.g., via a GPS location system. Then at step <NUM>, processor <NUM> compares the location determined with an authorized location or with a plurality of authorized locations for pairing gatekeeping device <NUM> with implantable biomedical device <NUM>. If, at step <NUM>, the location determined does not corresponds to the authorized location or locations for pairing, then method <NUM> ends. If, however, at step <NUM>, the location determined does correspond to the authorized location or locations for pairing, then at step <NUM>, gatekeeping device <NUM> transmits a Media Access Control (MAC) address to implantable biomedical device <NUM>. The MAC address transmitted to implantable biomedical device <NUM> corresponds to the communications channel used by gatekeeping device <NUM> for communications with implantable biomedical device <NUM>.

Method <NUM> then proceeds to step <NUM>, where gatekeeping device <NUM> receives a unique identifier associated with implantable biomedical device <NUM>. Such a unique identifier can be broadcast by implantable biomedical device <NUM> of can be provided by the manufacturer, physician, or hospital. For example, such a unique identifier can be transmitted by implantable biomedical device <NUM> in response to receiving the MAC address of gatekeeping device <NUM>. In some embodiments, such a unique identifier can be manually keyed into gatekeeping device <NUM> or can be transmitted to gatekeeping device <NUM> over a communications channel from some other source (e.g., personal computer <NUM> used by physician <NUM>). Method <NUM> then proceeds to step <NUM>, where gatekeeping device is provided with data pertaining to IP-addressable website <NUM> corresponding to implantable biomedical device <NUM>. Then, at step <NUM>, gatekeeping device communicates with IP-addressable website. Gatekeeping device <NUM>, for example, will communicate using a public/private encoding algorithm. Gatekeeping device <NUM> might send IP-addressable website <NUM> information pertaining to gatekeeping device <NUM>, so that IP-addressable website <NUM> can validate that gatekeeping device <NUM> is authorized to communicate with IP-addressable website <NUM>. Gatekeeping device <NUM> is now configured to provide gatekeeping function for communications between IP-addressable website <NUM> and implantable biomedical device <NUM>, and so method <NUM> ends.

<NUM>-<NUM> will describe communication methods used for communications between implantable medical device <NUM>, as depicted in <FIG>, with various authorized users. In <FIG>, communication methods of gatekeeping device <NUM> will be described. In <FIG>, a method for facilitating a remote internet-connected device to configure an implantable biomedical device will be described.

<FIG> is a flow chart of a method for providing secure gatekeeping of communications from an implantable biomedical device to a remote internet-based website. In <FIG>, method <NUM> is described from a vantage point of a processor of gatekeeping device <NUM> (depicted in <FIG>). Method <NUM> begins at step <NUM>, where gatekeeping device <NUM> waits to receive a communication from internet-based websites. If, at step <NUM>, no communication is received from a remote internet-based website, then method <NUM> remains (or returns to) step <NUM>. If, however, at step <NUM>, gatekeeping device <NUM> receives a communication from a remote internet-based website, then gatekeeping device <NUM> proceeds to step <NUM>.

At step <NUM>, gatekeeping device <NUM> compares an IP address corresponding to the communication received with an IP address corresponding to IP-addressable website <NUM>, which is the website that corresponds to implantable medical device <NUM>. If, at step <NUM>, gatekeeping device <NUM> determines that the communication received is from an IP address that does not correspond to IP-addressable website <NUM>, then method <NUM> returns to step <NUM> and awaits another internet-based communication. If, however, at step <NUM>, gatekeeping device <NUM> determines that the communication received is from an IP address that does correspond to IP-addressable website <NUM>, then method <NUM> proceeds to step <NUM>.

At step <NUM>, gatekeeping device decodes the communication received using a public key transmitted therewith by IP-addressable website <NUM> and private key of gatekeeping device <NUM>. Using such public and private keys to decode the communication ensures that the communication has originated by IP-addressable website <NUM> and is intended for reception by gatekeeping device <NUM>. Then at step <NUM>, gatekeeping device <NUM> encodes the communication decoded in accordance with an encryption algorithm used by implantable biomedical device <NUM>. Then, at step <NUM>, gatekeeping device performs a proximity test. The proximity test is to determine if gatekeeping device <NUM> is within a predetermined distance from implantable medical device <NUM>. Such proximity test is described below. If, at step <NUM>, gatekeeping device determines that gatekeeping device is not proximate implantable biomedical device <NUM>, then method <NUM> remains at step <NUM> until gatekeeping device <NUM> determines that it is proximate implantable medical device <NUM>. If, however, at step <NUM>, gatekeeping device determines that gatekeeping device is proximate implantable biomedical device <NUM>, then method <NUM> proceeds to step <NUM>.

At step <NUM>, gatekeeping device <NUM> transmits the encoded communication to implantable medical device <NUM>. Then method <NUM> proceeds to step <NUM>, where gatekeeping device <NUM> waits for a confirmation communication from implantable medical device <NUM>. If at step <NUM>, gatekeeping device <NUM> has not received a confirmation communication from implantable medical device <NUM> within a predetermined time frame, method <NUM> returns to step <NUM>, where gatekeeping device <NUM> again performs a proximity test. If, however, at step <NUM>, gatekeeping device <NUM> has received a confirmation communication from implantable medical device <NUM> within a predetermined time frame, method <NUM> proceeds to step <NUM>, where gatekeeping device <NUM> encodes and transmits an acknowledgement communication to IP-addressable website <NUM>. Then method <NUM> returns to step <NUM> and awaits another communication from internet-based websites.

<FIG> is a flow chart of a method for providing secure gatekeeping of communications from a remote internet-based website to an implantable biomedical device. In <FIG>, method <NUM> is described from a vantage point of a processor of gatekeeping device <NUM> (depicted in <FIG>). Method <NUM> begins at step <NUM>, where gatekeeping device <NUM> waits to receive a communication from implantable medical device <NUM>. If, at step <NUM>, no communication is received from implantable medical device <NUM>, then method <NUM> remains (or returns to) step <NUM>. If, however, at step <NUM>, gatekeeping device <NUM> receives a communication from implantable medical device <NUM>, then gatekeeping device <NUM> proceeds to step <NUM>.

At step <NUM>, gatekeeping device <NUM> decodes the communication received from implantable biomedical device <NUM>. Then, at step <NUM>, gatekeeping device <NUM> sends a confirmation communication to implantable biomedical device <NUM>. Method <NUM> then proceeds to step <NUM>, where gatekeeping device determines authenticity that the communication received was transmitted by implantable biomedical device <NUM>. Such determination of authenticity will be described in more detail below. If, at step <NUM>, the authenticity of the communication received is not determined, method <NUM> returns to step <NUM> and awaits another communication. If, however, at step <NUM>, the authenticity of the communication received is determined, then method <NUM> proceeds to step <NUM>, where gatekeeping device <NUM> encodes the communication decoded, using an encoding algorithm used for communications between gatekeeping device <NUM> and IP-addressable website <NUM>. Then, at step <NUM>, gatekeeping device transmits the encoded communication to IP-addressable website <NUM>. Method <NUM> then returns to step <NUM>, where gatekeeping device awaits another communication transmitted by implantable biomedical device <NUM>.

<FIG> is a flow chart of a method for facilitating a remote internet-connected device to configure an implantable biomedical device. In <FIG>, method <NUM> is described from a vantage point of a processor of hosting server <NUM> (depicted in <FIG>), which hosts IP-addressable internet site <NUM>. Method <NUM> begins at step <NUM>, where hosting server <NUM> hosts virtual image <NUM> of implantable biomedical device <NUM> at IP-addressable internet site <NUM> associated therewith. Such virtual image <NUM> of implantable biomedical device <NUM> can be configured to behave or operate identically to the corresponding actual implantable biomedical device <NUM>. Then, method <NUM> proceeds to step <NUM>, where IP-addressable internet site <NUM> receives, from the remote internet-connected device via the internet, configuration data for implantable biomedical device <NUM> at IP-addressable internet site <NUM>. Then, at step <NUM>, hosting computer <NUM> determines authorization of a remote entity transmitting the configuration data from the remote internet-connected device. If, authorization has not been determined at step <NUM>, method <NUM> returns to step <NUM> and waits to receive another communication containing configuration data for implantable biomedical device <NUM>.

If, however, at step <NUM>, authorization has been determined at step <NUM>, method <NUM> proceeds to step <NUM>, where hosting server <NUM> updates virtual image <NUM>. Method <NUM> then proceeds to step <NUM>, where safety of implantable biomedical device <NUM> is determined. Safety is determined based on virtual image <NUM> as updated. In some embodiments, simulations of virtual image <NUM> is performed. Such a safety determination can include a determination of directional safety - Is the safety improved or impaired by such an update? In some embodiments, the update will be permitted in the actual implantable biomedical device <NUM>, only if the directional safety is improved. In some embodiments a waiting time period is required following an update before the update is permitted to be performed on the actual implantable biomedical device <NUM>. If, at step <NUM>, the safety requirements of the update have not been met, method <NUM> proceeds to step <NUM>, where hosting server <NUM> restores virtual image <NUM> to its pre-update configuration, and then method <NUM> returns to step <NUM>.

If, however, at step <NUM>, the safety requirements of the update have not been met, method <NUM> proceeds to step <NUM>, where hosting server <NUM> transmits, from IP-addressable internet site <NUM> via the internet to implantable biomedical device <NUM>. Such transmission is encoded via an encryption method used for transmissions between IP-addressable internet site <NUM> and gatekeeping device <NUM>, which serves as a gatekeeper for all communications with implantable biomedical device <NUM>. Method <NUM> then returns to step <NUM>, where it awaits reception of another communication from a remote internet-connected device.

The various encoding, authorization, validation, and other security measures described in the methods corresponding to <FIG> will be described in more detail below. Various embodiments will use more or fewer steps in one or all of methods <NUM>, <NUM>, <NUM> and <NUM> described above. These methods above describe example embodiments of the gatekeeping function of gatekeeping device <NUM> and of the hosting server <NUM>. Gatekeeping device <NUM>, ensures that only authorized entities can send data (e.g., configuration data) to implantable biomedical device <NUM>. Similarly, gatekeeping device <NUM> relays communications received from implantable biomedical device <NUM> only if gatekeeping device can determine that such communications were transmitted by implantable biomedical device <NUM>. Hosting server <NUM> ensures safety of configuration updates and limits communications to implantable biomedical device therefrom.

Proximal pairing can be used to provide a high level of security by requiring some or all communications between implantable biomedical device <NUM> and a remote authorized entity to be conducted through gatekeeping device <NUM> that is proximate and paired with implantable biomedical device <NUM>. Gatekeeping device <NUM> can provide security to communications by restricting communications to and from implantable biomedical device <NUM> to only a paired (i.e., paired with the implantable biomedical device) device that is proximate implantable biomedical device <NUM> and which has been authorized to conduct such communications therewith. Only such a configured and authorized device can facilitate these communications between implantable biomedical device <NUM> and remote authorized entities, and then only if the configured and authorized device is proximate implantable biomedical device <NUM>. Implantable biomedical device <NUM> can be configured to have a limited range of wireless communication with the paired proximate device, such as, for example, gatekeeping device <NUM>. In this way, such a paired proximate device can operate as a gatekeeper for communications to and/or from implantable biomedical device <NUM> to which it is paired. By requiring communications to be relayed by such a paired proximate device, such a gatekeeping role can thwart attempted communications to and/or from implantable biomedical device <NUM> that are not conducted by authorized remote entities.

Various types of devices can be paired with implantable biomedical device <NUM>. For example, a manufacturer of implantable biomedical device <NUM> might provide a complementary pairing device specifically designed for such a gatekeeping role. Exemplary pairing operations for such gatekeeping devices will be described below. In some embodiments, a cell phone of patient <NUM> can be configured to perform these gatekeeping operations. In various embodiments, communication between implantable biomedical device <NUM> and the paired proximate device can be conducted using various protocols. For example, any protocol conducive to short-range communications between a proximate device and a subcutaneous implantable biomedical device can be used. Some such communications protocols include Bluetooth, Zigbee, Near-Field Communication (NFC), Wide-Field Communication (WiFi), etc. These various communications protocols can be used in various manners to ensure fast and securing pairing of and communicating between an implantable biomedical device and a proximate device. For example, in some embodiments, NFC communications can initiate Bluetooth pairing, for example.

Various ways of proximal pairing of implantable biomedical device <NUM> with a gatekeeping device, such as gatekeeping device <NUM>, can be performed, and various limits to the number of paired devices can be established. For example, a limit of a single, or two, or a limited few number of devices can be paired with a specific implantable biomedical device. This one or these few devices can be paired in a secure manner that precludes invasive pairings of other devices by unauthorized entities. Such secure pairing can be accomplished using various secure pairing protocols. For example, implantable biomedical device <NUM> can be configured to be paired in limited and/or controlled conditions. Such limited and/or controlled conditions can include limiting the times when pairings are performed, limiting locations where pairings are performed, authorizing pairings using a pairing-authorization device, and/or by using secure communications between implantable biomedical device <NUM> and the device to which it is to be paired (as well as any pairing-authorization device).

The times, during which pairing is permitted to occur, can be limited in various manners. For example, pairing of implantable biomedical device <NUM> to gatekeeping device <NUM> can be limited to the time of implantation of the implantable biomedical device. Other permitted times for pairing of implantable biomedical device <NUM> can be limited to times at which certain other events take place. For example, during hospital visits and/or doctors' appointments, pairing can be permitted to be performed. Devices can be paired in such circumstances as hospital visits and/or doctors' appointments using a doctor's pairing key and/or a pairing-authorization device, for example. Pairing can be authorized upon receipt of a doctor's pairing key, which can be a software key or a hardware key, for example. The key can be communicated to gatekeeping device <NUM>, thereby permitting pairing to commence.

The locations where pairings are permitted can be limited in various ways. For example, the pairings can be limited using a GPS location sensor contained in a proximate device to be paired with implantable biomedical device <NUM>. A predetermined number of locations where pairing is permitted can be compared with the location as sensed by the GPS location sensor of the proximate device to be paired. For example, the home address of patient <NUM> in whom implantable biomedical device <NUM> has been implanted can be a permissible location where pairing can be performed. Other permissible pairing locations can include locations of the manufacturer of implantable biomedical device <NUM>, locations of the doctors' offices where treatment patient <NUM> who has implantable biomedical device <NUM> are conducted, and/or locations of hospitals where implantation of the such implantable biomedical devices are performed.

In some embodiments the security of proximal pairing communications can be further bolstered using proximity sensing and/or proximity testing. For example, proximity between implantable biomedical device <NUM> and the gatekeeping device <NUM> can be sensed using a proximity sensor. This proximity sensor can sense relative proximity of implantable biomedical device <NUM> to gatekeeping device <NUM>. Communications to and/or from implantable biomedical device <NUM> can be enabled only when such relative proximity of implantable biomedical device <NUM> to gatekeeping device <NUM> meets a threshold condition. For example, if gatekeeping device <NUM> is within a predetermined distance from implantable biomedical device <NUM>, communications therebetween could be enabled. Various types of proximity sensors can be employed for such a purpose. For example, implantable biomedical device <NUM> could have a reed switch configured to sense a magnetic field generated by a magnet or by a magnetic field generated by an inductive coil of gatekeeping device <NUM>. In other embodiments, a signal strength of an attempted wireless communication can be compared with a predetermined threshold so as to determine if gatekeeping device <NUM> is within a predetermined distance of implantable biomedical device <NUM>.

In some embodiments, pairing can occur as follows. Before implantable biomedical device <NUM> is implanted, it is paired with gatekeeping device <NUM>. Gatekeeping device <NUM> is equipped with a gatekeeping app that has been programmed by the manufacturer of implantable biomedical device <NUM>. The gatekeeping app is configured to provide secret encryption and decryption of communications between gatekeeping device <NUM> and implantable biomedical device <NUM>. For example, in some embodiments, implantable biomedical device uses a secret encryption method that is based on a running timer that commences upon the first powering of implantable biomedical device <NUM>. Every minute, the counter advances and the encryption changes based upon that advanced count. Gatekeeping device <NUM> is provided with the time of first power up during this pairing operation, and gatekeeping device <NUM> synchronizes a counter to the counter of implantable biomedical device <NUM>. Gatekeeping device <NUM> is in this way able to encrypt and decrypt communications in synchrony with implantable biomedical device <NUM>.

Directional safety is a term indicative of whether safety in increased or decreased by a change in the configuration or programming of a device, such as an implantable biomedical device. In the context of an implantable biomedical device, the safety to which the term "direction safety" refers is the safety of the patient in whom the implantable biomedical device has been implanted. Some updates to an implantable device might not improve safety, but a physician of the patient might desire such an update in spite of its negative directional safety. Such an update can be performed in various secure fashions. For example, if a physician desires to update and/or reconfigure an implantable device in a manner having neutral or negative directional safety, such updates and reconfigurations can be restricted to local settings. Distal internet communications can be prohibited from performing such neutral or negative directional-safety updates and/or reconfigurations.

Furthermore, devices that communicate such neutral or negative directional-safety updates and/or reconfigurations can be restricted to special devices manufactured by the manufacturer of the implantable device. Secret encoding schemes can be used for such communications of neutral or negative directional-safety updates. Proximity requirements between the programming device and the implantable biomedical device can be required, so as to ensure that only local secure communications perform such neutral or negative directional-security updates and/or reconfigurations.

In some embodiments, any change to firmware of an implantable biomedical device can be considered to have a negative directional safety (or at least a non-insignificant potential for negative directional safety). Such firmware changes can be restricted to such local secure communications methods as other neutral or negative directional-safety updates and reconfigurations.

Data encryption for communications between implantable biomedical device <NUM> and the remote entity and/or between various intermediate devices facilitating such communications can be performed. For example, a relatively simple encryption can be performed for communications between implantable biomedical device <NUM> and gatekeeping device <NUM>, so as to enable low-power operation of implantable biomedical device <NUM>. In some embodiments, communications between implantable biomedical device <NUM> and gatekeeping device <NUM> can be encrypted by an encryption method that is secret - devised but unpublished by the manufacturer. Such a secret encryption method can make use of the Machine Access Control (MAC) address of the communicating device(s), such as for example a Bluetooth chip. Furthermore, a clock algorithm can be used to encrypt such proximate communications such that knowledge of the MAC address is insufficient to break the code.

More power-hungry encryption methods can be used for devices that have higher power budgets, such as gatekeeping device <NUM> and enterprise devices, such as hosting server <NUM>, conducting internet-based operations. Various such encryption methods can be used for communications between such higher-power-budget devices. For example, public/private key encryption can be used for communications between gatekeeping device <NUM> and internet-based servers, such as hosting server <NUM>.

In some embodiments, such public keys can be exchanged once or at various intervals. For example, a new private key can be generated by the paired proximate device every new day, new hour, or at five-minute intervals, for communications conducted by gatekeeping device <NUM> and remote internet-based servers. Gatekeeping device <NUM> can then generate a public key based on the private key generated. This public key can be communicated to the remote internet-based server, such as hosting server <NUM>, for use in decoding communications originated by gatekeeping device <NUM>. Similarly, the remote internet-based server can also generate a private/public key combination and transmit the public key to gatekeeping device <NUM>. Such frequent changing of these private/public key combinations can limit the time for a hacker to hack the private key to one day or less - a small fraction of the time required for such hacking for today's most powerful computers.

A proximate device that is to be paired with implantable biomedical device <NUM> can communicate therewith using an authentication protocol. Such authentication can be performed via various secure authentication methods. For example, at the time of implantation, implantable biomedical device <NUM> can be associated with patient <NUM> via secure registration of implantable biomedical device <NUM> at a secure internet sight of the manufacturer. The registration procedure can include providing the manufacturer with information regarding patient <NUM> as well as a serial number of the implantable biomedical device <NUM>, for example. In some embodiments, the manufacturer's website can request a login ID and password be supplied for patient <NUM>. The manufacturer's website can request information regarding the implantable biomedical device <NUM> and/or devices to be paired with implantable biomedical device <NUM>, such as, for example, gatekeeping device <NUM>.

In some embodiments, after or during the collection of information pertaining to patient <NUM> and/or implantable biomedical device <NUM>, the manufacturer can communicate with gatekeeping device <NUM>, which is to be paired with implantable biomedical device <NUM>. Such a communication can occur in various manners. For example, if gatekeeping device <NUM> is a cellphone, the manufacture can send a text message or a voice message to the cellphone. In other embodiments the manufacturer can display a key code for the user to use during the pairing procedure. For example, the manufacturer can display a key code that the patient inputs into the device to be paired. The key code then enables the pairing of the proximate device to implantable biomedical device <NUM>. In some embodiments, the manufacturer can maintain a log of all the devices that are and/or have been paired with implantable biomedical device <NUM>.

In some embodiments, a time synchronized code can be used for authentication and/or encryption purposes. A time sequence of codes can be synchronized at a time of implantation and/or pairing, for example. The code sequence can be synchronized between the communicating devices, such that the code communicated at a given time of communication can be anticipated by the device to which the code is communicated (e.g., implantable biomedical device <NUM>, gatekeeping device <NUM>, and/or hosting server <NUM>).

Communication between an authorized entity can be performed either indirectly, using virtual image <NUM> that is a mirrored counterpart to implantable biomedical device <NUM>, or directly, without such a virtual image. For example, programming updates to implantable biomedical device <NUM> can be required to be performed first on virtual image <NUM>. A doctor, for example, might want to change a therapy schedule that implantable biomedical device <NUM> performs for patient <NUM>. This change in the therapy schedule might have been in response to sensed biometric data indicative of condition of patient <NUM>, what has been provided by implantable biomedical device <NUM>. Virtual image <NUM> can then transmit the updated therapy schedule to implantable biomedical device <NUM> if the updated therapy schedule has been determined to meet certain safety requirements.

Virtual image <NUM> can mirror the actual implantable biometric device <NUM>, such that simulations of the behavior of virtual image <NUM> can be indicative of the performance of the actual implantable biometric device <NUM>, after such updated therapy schedule has been programmed. Because any programming changes are made first to virtual image <NUM>, all such programming changes can be vetted so as to ensure that such programming changes, when made to the actual implantable biomedical device <NUM>, will be safe for patient <NUM>, in whom the actual implantable biomedical device <NUM> has been implanted. Virtual image <NUM> is managed at an IP addressable website by hosting computer <NUM>. Hosting computer <NUM> is not power limited, and therefore can have any processing power that is needed to perform its duties. In one embodiment, hosting computer <NUM> can be an enterprise computer.

Such an enterprise computer, as is typically used for performing such simulations, has good computational power so as to be able good performance of complex algorithms, such as, for example, simulations of implantable biomedical device <NUM> configured in various manners. These simulations can be used to determine directional safety of any updates and/or reconfigurations to implantable biomedical device <NUM>. The enterprise computer can then act as a mediator for potential updates and/or reconfigurations of implantable biomedical device <NUM>. For example, the enterprise computer can accept or reject such potential changes based on the determined directional safety, which in turn is based on the virtual simulations of virtual image <NUM> as virtually updated with such potential updates and/or reconfigurations.

Hosting computer <NUM> can be configured to perform simulations on implantable biomedical devices for a great many patients. For example, if a manufacturer wants to upgrade the firmware of all implantable biomedical devices of a specific type, hosting computer <NUM> can run simulations based on all of the virtual devices corresponding to the implantable biomedical device implanted in these patients. Based on such a multitude of simulations, the manufacturer can decide whether or not to proceed with such updated firmware across the entire population of implantable biomedical devices.

In some embodiments, secure communications can be performed directly between implantable biomedical device <NUM> and internet cloud <NUM>. For example, implantable biomedical device <NUM> can be configured to communication directly with internet cloud <NUM> via <NUM> or <NUM> cell-phone communications protocols. In such systems, communications to and from implantable biomedical device <NUM> can be restricted to those with IP addressable website <NUM>. Static IP addresses of implantable biomedical device <NUM> and IP addressable website <NUM> can be secret so as to operate as a paired set only between which communications are permitted. To provide further security to such direct communications between implantable biomedical device <NUM> and IP addressable website <NUM>, public/private key encryption can be used.

Direct communications between implantable biomedical device <NUM> and IP addressable website <NUM> can incur a power cost that might be greater than the power cost associated with indirect communication via gatekeeping device <NUM>. Such power costs can be provided by rechargeable batteries that perform any therapeutic functions of implantable biomedical device <NUM> as well as providing such direct communications. Because the therapeutic function of implantable biomedical device <NUM> should not be interrupted, power provided for therapeutic function should not be interrupted. To ensure continuous power provision for therapeutic function, some embodiments have separate batteries, one for providing power for therapeutic function, and another for conducting communications. In other embodiments, a single rechargeable battery can be virtually partitioned such that a first battery partition is reserved for providing power for therapeutic function, and second battery partition is reserved for conducting communications. If, for example, the second battery partition is depleted and a communication is scheduled, the scheduled communication can be rescheduled to a later time window, so as to reserve the energy stored in the first battery partition for providing power for therapeutic function.

To further reduce power required for such direct communications, these direct communications can be limited to limited time windows. For example, implantable biomedical device <NUM> can wake up a receiver for a short duration time window every five minutes to determine if IP addressable website <NUM> is transmitting a communication thereto or to transmit a communication to IP addressable website <NUM>. IP addressable website <NUM> can maintain the schedule for such communications so as to synchronize transmissions and receptions with implantable biomedical device <NUM>.

Other power saving measures can also facilitate such direct communications. For example, for implantable biomedical devices that are implanted deep within patient <NUM>, a communications antenna of such deeply implanted biomedical devices can be subcutaneously situated just beneath a skin layer of the patient. Such situation of the communications antenna can permit lower power requirements for a given signal strength than would be required for a more deeply implanted antenna. Such antenna configurations are disclosed in <CIT>.

Claim 1:
A method for providing secure gatekeeping of a communication transmitted from an implantable biomedical device to a remote internet-based website, the method comprising:
wirelessly receiving, by a gatekeeping device, the communication transmitted from the implantable biomedical device, wherein the communication wirelessly received is encoded by the implantable biomedical device using a first encoding algorithm;
decoding, by the gatekeeping device, the communication wirelessly received wherein the communication is decoded using a secret encryption method that is based on a running timer that commences upon the first powering of the implantable biomedical device;
encoding, by the gatekeeping device, the communication decoded using a second encoding algorithm; and
relaying, by the gatekeeping device, the communication encoded using the second encoding algorithm to the remote internet-based website via the internet;
wherein the communication wirelessly received is decoded based, at least in part, upon a time difference between a communication time at which the communication is wirelessly received and an initial time reference of the implantable biomedical device.