Patent ID: 12242586

DETAILED DESCRIPTION

Unless defined otherwise, all technical and scientific terms used have the same meaning as commonly understood by one of ordinary skill in the art.

The articles “a” and “an” are used to refer to one to over one (i.e., to at least one) of the grammatical object of the article. For example, “an element” means one element or over one element.

The term “algorithm” can refer to the broadest interpretation of a process, mathematical operation, or method of any type that can be used to generate data, files, parameters, passwords, text, or information.

To “associate” means to identify one piece of information as related to a second piece of information.

The term “authenticated” or to “authenticate” refer to a device that grants the user the ability to perform one or more restricted functions.

The term “blacklisted device” or to “blacklist a device” refer to a device that cannot be used as an authentication device even if the device has a correct key file.

The term “client computer” refers to any computer programmed to, or running software for, creating an authentication device from a USB device. The term “client computer” is not meant to refer to any party having ownership or control over the computer or software.

The terms “communication,” “communicate,” “communicating,” and the like can refer to the ability to transmit electronic data, instructions, information wirelessly, via direct electrical connection, or any other electrical transmission means between one or more components.

The term “compare” means to determine whether two files or data are the same or different.

The term “comprising” includes, but is not limited to, whatever follows the word “comprising.” Use of the term indicates the listed elements are required or mandatory but that other elements are optional and may be present.

The term “consisting of” includes and is limited to whatever follows the phrase “consisting of.” The phrase indicates the limited elements are required or mandatory and that no other elements may be present.

The term “consisting essentially of” includes whatever follows the term “consisting essentially of” and additional elements, structures, acts or features that do not affect the basic operation of the apparatus, structure or method described.

The terms “decrypt” or “decrypted” refer to the process of converted encrypted values or characters back into the original values or characteristics prior to encryption.

The term “device,” as used herein, refers to any device that can authenticate a user or USB authentication device.

The term “determining” or to “determine” refers to ascertaining a particular state of a component or system.

The term “device” is to be interpreted in the broadest and can include anything made for a particular purpose; a contrivance of any type, particularly a mechanical or electrical component or hardware. Some examples of devices can include a medical device such as a dialysis machine, laptop, computer, computer peripherals of any type, computer terminals, portable devices, smart phones, and smart watches.

The terms “encrypt” or “encrypted” refer to a values or characters that have been converted to different values or characters according to an algorithm.

The term “execute” means to perform a step or series of steps.

The term “generate” means to create a file or information in electronic form.

To “grant access” means to allow a user to perform some function using a computer.

The term “input” refers to a port on a computer through which a peripheral device can be attached.

The term “key file” refers to a file containing information used for authentication of a device.

The term “key generation server” refers to any server or computer programmed to generate a key file that uniquely identifies a component.

The term “match” refers to two files that are identical.

The term “medical device” refers to a device used to perform medical treatment or diagnosis of any type.

The term “processor” or “microprocessor” as used is a broad term and is to be given an ordinary and customary meaning to a person of ordinary skill in the art. The term refers without limitation to a computer system, state machine, processor, or the like designed to perform arithmetic or logic operations using logic circuitry that responds to and processes the basic instructions that drive a computer. In any embodiment of the first, second, third, and fourth invention, the terms can include ROM (“read-only memory”) and/or RAM (“random-access memory”) associated therewith.

The term “product ID” refers to a series of characters that uniquely identify each component in a system.

The term “programmed,” when referring to a processor, can mean a series of instructions that cause a processor to perform certain steps.

The term “receiving” refers to the process of obtaining electronic information by any means.

A “restricted mode of operation” refers to a function or set of actions that can only be accessed or performed by specific users.

The term “save” or “saving” refers to storing information in a memory of any type. Often, the data can be stored in memory positioned within a device.

A “secure channel” is a mode of communication between two or more components that is resistant to tampering or eavesdropping.

A “serial number” is a series of characters that identify the position of a component in a series.

The term “token” refers to information containing security credentials necessary to perform a function.

The term “unique USB key file” refers to a file containing values that identify a single USB device.

The term “user identification information” refers to information that identifies a particular user of a system. The user identification information can include a user name and password or any other information that identifies the particular user.

A “USB device” is a peripheral device that can connect to an input of a computer via a port. The USB device can include a memory for storing information.

The term “USB identification characteristic” refers to any characteristic or value or set of characteristics or values unique to a specific USB device.

The term “vendor ID” refers to a series of characters that identify a component and the source of the component.

USB Authentication Device

FIG.1illustrates components that can be used to generate a USB authentication device. A user101can connect a client computer102to a USB device103using USB bus104. The client computer102is a computer hosting a client software utility can receive certain identification characteristics from the USB device103. As described, the USB identification characteristics can include any identification characteristics that are unique to the USB device103and do not change. For example, the USB identification characteristics can include a vendor ID, a product ID, and a serial number of the USB device. The USB identification characteristics are received by a processor of the client computer102and communicated to a key generation server106via a secure communication network105. The key generation server106uses the USB identification characteristics of the USB device103in an algorithm to generate a unique USB key file for the USB device103. Because the algorithm used to generate the key file uses the unique USB identification characteristics of the USB device103, any USB device used will result in a different key file.

The key generation server106communicates the key file back over the secure communication network105to the client computer102. The processor of client computer102can be programmed to save the key file on the USB device103. The USB device103now contains a unique USB key file that can be used for authentication.

In certain embodiments, the client computer102can also receive user identification information from user101. The user identification information can be communicated to the key generation server106and associated by the key generation server106with the USB identification characteristics. A list of USB devices and associated users can be maintained by the key generation server106to ensure that a single user is not associated with multiple USB authentication devices. As described, in certain embodiments, the key generation server106can maintain a device or user blacklist that will not allow authentication of certain blacklisted devices or users. In certain embodiments, the client computer102can be part of a device. The device can be made for a particular purpose such as mechanical or electrical component that can serve any purpose. Alternatively, client computer102can be a computer that is not a part of a device, the system including a separate device for which the USB device103is being authenticated.

FIG.2illustrates use of a USB authentication device. A USB device201containing a key file can be inserted into an input of a device202having a processor. In one embodiment, the device202is a medical device. However, numerous types of devices are contemplated including any device, component, or computer that authenticates and or provides access to other midpoints and/or endpoints, online or offline. For example, the device202can be a multi-function printer consumer electronics such as a smart refrigerator or television, industrial machinery, automobiles, or any other device that may have one or more restricted modes of operation. The devices of the invention may or may not require an operating system. The devices, systems, and method of the invention are not limited to any specific software and/or hardware, and may include and authenticate any entity such as users, other devices, applications, services, servers, software, and the like. The USB device201can communicate with the processor of the device202through USB bus203. The device processor can obtain the same USB identification characteristics as used for the key generation. The device processor can then use the same algorithm as the key generation server to regenerate the unique USB key file internally. The device processor can compare the generated USB key file to the key file saved on the USB device201. If the key files match, the USB device201is authenticated. If the key files do not match, the USB device201is not authenticated.

The device202can have at least one mode of operation to which access is controlled using the authentication system described. As a non-limiting example, the device202can be a medical device, such as a dialysis system. If used as a medical device, the device202can be programmed so that a therapy such as a dialysis therapy does not begin until an authenticated USB device is inserted. However, the device202need not be a medical device. In non-medical devices, the restricted modes of operation may include certain functions that may expose private information of an owner or user, or service modes of automobiles or industrial machinery. Once the USB device is authenticated, the system can grant access to the restricted modes of operation. If used as any other type of device or mechanical or electrical component, the device202can be used to authenticate an entity requiring access to the device202. The entity can be users, other devices, applications, services, servers, software, and the like. In certain embodiments, the device202can be isolated from the internet for security purposes. The authentication system described ensures that only authorized users can access the restricted modes of operation.

Creation of the Authentication Device

FIG.3is a flow chart illustrating steps used to create a USB authentication device from a standard USB mass storage device. In step301, a user inserts a USB device into a client computer. The client computer is a computer programmed to run a client software utility. The client computer can communicate with a key generation server over a network. The client software utility acts as a front end of the USB authenticator. The client software utility and the key generation server may be part of the same enterprise network. In certain embodiments, the connection to the enterprise network may be through Virtual Private Network. The client software utility may be a command line utility or a graphical user interface-based utility. In certain embodiments, the client computer can authenticate the user using a local machine-based authentication mechanism, such as a username and password. Alternatively, the client computer can authenticate the user using a network-based authentication mechanism, such as signing on to a network. In certain embodiments, the client computer can require a token from the user. If the token is valid, the client computer can authenticate the user. When using a network-based authentication method, the client computer hosting the client software utility can be connected to an enterprise network which enables the authentication of user. The client software utility may require the user to be authenticated prior to creation of the USB authentication device.

Once the user is authenticated and the USB device inserted into the client computer, the client computer can obtain certain USB identification characteristics. As described, the USB identification characteristics can include one or more of a vendor ID, a product ID, and a serial number of the USB device. Any information that can uniquely identify a USB device can be used as a USB identification characteristic. In step302, the client computer can transmit the USB identification characteristics to a key generation server over a secure network. In certain embodiments, the client computer may authenticate the key generation server before sending any data to the key generation server. The client computer can optionally also send login details, such as the user's username and time of request, or other user identification information that can uniquely identify a user, to the key generation server. If the user identification information shows that the user already has an authenticated USB device, the previously authenticated USB device can be blacklisted, so that each and every authentication device created can be uniquely attributed to a user. In step303, the key generation server can generate a key file using the USB identification characteristics. The USB identification characteristics are used as inputs to an algorithm to generate a key file unique to the specific USB device. In step304, the client computer receives the key file from the key generation server. In step305, the client computer saves the key file on the USB device. The USB device can now be used as an authentication device. In certain embodiments, the client computer can format the key file and USB device to avoid the key file mounting on an operating system. The client computer can format the USB device as a specific partition, for example FAT32. The client computer can check the partition table on the USB device to determine the starting logical block for the partition. The key file can be copied to the start of the partition, then the partition resized so that the starting logical block address of the partition shifts to a location just after the key file, placing the key file outside of the formatted partition of the USB device. Because the key file is not part of any partition, the key file will not be mounted by any operating system. In certain embodiments, the USB device can still be used as a mass storage device in addition to being an authentication device. The user can format the partition that is still visible to the user without affecting the key file and with no apparent change in size of the USB device.

In certain embodiments, the key generation server can generate and transmit to the client computer a key rather than a key file. In such embodiments, the client computer can be programmed to generate the actual key file and save the key file on the USB device.

Usage of USB Authentication Device

FIG.4is a flow chart showing a USB authentication device used with a device in a non-limiting embodiment. If the device is a medical device, the devices can be a dialysis machine of any type performing any therapy such as hemodialysis, hemofiltration, hemodiafiltration, and peritoneal dialysis, and any computer, peripheral devices such as sorbent cartridge recharges, peritoneal dialysis cyclers, and the like. The medical devices can be any type that requires authentication. For example, any device having a computer, process, electrical component, or data that requires authentication such as those in the fields of chemistry and toxicology devices, hematology and pathology devices, immunology and microbiology devices, anesthesiology devices, cardiovascular devices, dental devices, ear, nose, and throat devices, gastroenterology-urology devices, general and plastic surgery devices, general hospital and personal use devices, neurological devices, obstetrical and gynecological devices, ophthalmic devices, orthopedic devices, physical devices, and radiology devices. As described, the devices need not be medical devices. The device can be any device having a restricted mode of operation.

In step401, the user can insert the USB authentication device having a stored key file into an input of a device have one or more restricted modes of operation. The device may have one or more operating states where the USB authentication device can provide a specified level of access to the one or more operating states. For example, the USB authentication device can provide access to electronic, computers, or processers on the device. The USB authentication device can also provide access to a database server on the device or access to computer logic or processes which then can obtain data such as electronic medical records, prescriptions, maintenance and management of the device, one or more third party servers, user authentication data for managing user accounts, passwords, user authentication and authorization, a server configured to facilitate communication with other software systems, a server configured to manage display updates and reports of calls and notifications and/or generate printed reports, procedures or standards that apply to a healthcare facility, a locating and tracking server configured to manage the locating and tracking of peripheral devices and components such as sorbent cartridge and sorbent cartridge rechargers, or a text managing server configured to manage or facilitate the communication of messages within a system.

In step402, the processor of the device can obtain the USB identification characteristics from the USB device that were used to generate the key file stored on the USB device. In step403, the processor of the device can perform the same algorithm used to generate the key file, regenerating the key file. In step404, the processor of the device can retrieve the key stored on the USB device. In step405, the processor of the device can compare the regenerated key to the key stored on the USB device. In step406, the processor of the device can determine whether the keys match. If the keys do not match, access to the restricted functions can be denied in step407. Because the device obtains the identification characteristics from the USB device, the device can generate a different key value for any USB device. As such, even if a key file from one USB device is copied onto another USB device, the second device will not function as an authentication device because the copied key file will not match the key file generated by the device. If the keys match, the processor of the device can determine whether the USB device is a blacklisted device in step408. If the authenticated device is a blacklisted device, access to the restricted functions can be denied in step407. If the USB device is authenticated and not blacklisted, access to the restricted functions can be granted in step409. In any embodiment, if access is denied in step407, the device can display the reason why access is not granted. The owner of the device or administrator of the system can also be notified if an attempt to use an unauthenticated or blacklisted USB device is made. Although described in terms of a medical device, one of ordinary skill will understand that the invention can be applied to many settings outside of healthcare. For example, other settings where a device can be authenticated include a factory floor, at home or office, in an automobile or vehicle of any type, and the use of a personal device.

FIG.5is a flow chart illustrating an alternative method of using a USB authentication device. In step501, the user can insert the USB authentication device having a stored key file into an input of a device have one or more restricted modes of operation. As described, the key file includes one or more USB identification characteristics that have been encrypted. In step502, the device can decrypt the key file to generate the USB identification characteristics. In step503, the device can receive one or more USB identification characteristics directly from the USB device.

In step504, the device can compare the USB identification characteristics obtained by decrypting the key file with the USB identification characteristics received directly from the USB device. The device can determine whether the USB identification characteristics match in step505. If the keys do not match, access to the restricted functions can be denied in step506. Similar to the method illustrated inFIG.4, even if a key file from one USB device is copied onto another USB device, the second device will not function as an authentication device because the USB identification characteristics generated by decrypting the key file will not match the USB identification characteristics obtained directly from the second USB device. If the keys match, the processor of the device can determine whether the USB device is a blacklisted device in step507. If the authenticated device is a blacklisted device, access to the restricted functions can be denied in step506. If the USB device is authenticated and not blacklisted, access to the restricted functions can be granted in step508.

Blacklisting of USB Device

As described, in certain embodiments the system can maintain a list of blacklisted USB devices. The device can refuse to grant access to a blacklisted USB device, even if the key file is proper.FIG.6is a flow chart showing steps for revoking access to a device from a USB device when the device is not connected to the internet. The revoked entities can be users, other devices, systems. The revocation is not limited to any specific user, device, software and/or hardware.

In step601, the key generation server can maintain a list of blacklisted USB authentication devices. As described, USB authentication devices may be blacklisted if a user attempts to create a second authentication device. USB authentication devices may also be blacklisted for any other reason, such as revocation of rights of the user, suspected impermissible activity, or any other reason. In step602, the key generation server can notify all users when a device is blacklisted, such as through email, Application Programming Interface (API), text, or any other suitable communication. Step602may be performed by the key generation server in an automated fashion. The key generation server may be programmed to follow different rules for step602. As a non-limiting example, the notification process may be based on geographical boundaries. Any user outside of the boundary will not be notified of a new blacklisted device. In step603, the users can use the client utility or any other program to request a list of blacklisted devices from the key generation server. In step604, the client utility can load a list of backlisted devices onto an external memory, such as a USB device. In certain embodiments, a USB device serving as the external memory in step604can itself be an authentication device. The list of blacklisted USB authentication devices list may be a listing of USB identification characteristics or can be the keys used by blacklisted devices. If the keys used by blacklisted devices are provided to the user, the key can be in the form of a list of hashed or encrypted values. If so, the devices implementing the access control mechanism should have knowledge of the hashing or encryption mechanism used. In step605, the user can input the external memory into the device, which then reads the list of blacklisted devices. In step606, the device can update an internal listing of blacklisted devices. When a user attempts to gain access to restricted modes of operation of the device using a blacklisted USB authentication device, the device can refuse access to the user.

Key File Algorithm

As described, the key generation server is programmed to receive one or more USB device identification characteristics. Using the USB device identification characteristics, the key generation server generates a key file, or alternatively a key. The key file or key can be transmitted back to the client computer for saving on the USB device. As described, the key generation server can generate the key file using USB identification characteristics such as the vendor ID, product ID, and serial number. However, other identification characteristics of the USB device can be used if those identification characteristics can be obtained by the client computer and are unique to a specific USB device. Because the vendor ID, product ID, and serial number form a unique combination for each USB device, each USB device will have a unique key file.

The key generation server can execute an algorithm on the USB device identification characteristics to generate the key file. For example, the key generation server can use a hash-based message authentication code (HMAC) to generate the key file. Other methods known in the art can also be used to generate a key file using the USB identification characteristics. Preferably, the key file will be small, less than 10 Kbytes. However, larger key files are possible. The algorithm used to generate the key file should be secret, known only to the key generation server and the device for which the key is intended.

In certain embodiment, the key file can be generated using offsets to increase security. As a non-limiting example of a key file, the key file can include four sets of values: i) a cryptographic hash of the vendor ID at a pre-determined offset from the start of the file; ii) a cryptographic hash of the product ID at a pre-determined offset from the start of the file; iii) a cryptographic hash of the serial number at a pre-determined offset from the start of the file; and iv) random numbers occupying the rest of the file. Because the identification characteristics are encrypted and begin at different parts in the file unknown to any users, with random values interspersed, discovery of the key is exceedingly difficult. Optionally additional USB identification characteristics can be used, as well as a secret value known by both the key generation server and the device. The secret can be an encrypted PIN, a password, a passphrase, or any other item not generally known or discoverable by a user.

Serial numbers are mandatory for USB mass storage devices, bulk only transport, but are optional for USB mass storage class CBI transport. If the algorithm used to generate the key file uses the USB device serial number, the client computer can first check whether a valid serial number is available prior to the start of the process.

The algorithm used to generate the key file are known to the key generation server and the device. The algorithm is opaque to the user. Because the contents of the key file are not part of any partition, the key file cannot be found by a normal user. Even if an advanced user checks all the memory locations of the USB device, the user will not be able to infer anything from the contents which include cryptographic hashes or encryption of the USB identification characteristics and random numbers.

One skilled in the art will understand that various combinations and/or modifications and variations can be made in the described systems and methods depending upon the specific needs for operation. Various aspects disclosed herein may be combined in different combinations than the combinations specifically presented in the description and accompanying drawings. Moreover, features illustrated or described as being part of an aspect of the disclosure may be used in the aspect of the disclosure, either alone or in combination, or follow a preferred arrangement of one or more of the described elements. Depending on the example, certain acts or events of any of the processes or methods described herein may be performed in a different sequence, may be added, merged, or left out altogether (e.g., certain described acts or events may not be necessary to carry out the techniques). In addition, while certain aspects of this disclosure are described as performed by a single module or unit for purposes of clarity, the techniques of this disclosure may be performed by a combination of units or modules associated with, for example, a device.