Establishing a secure communication link between an implantable device and one or more external devices

Abstract

The present disclosure relates to devices, systems and techniques for establishing a secure link between two or more devices. In some instances, a device is configured to perform wireless communications. The device includes: a signal receiving circuit system, the signal receiving circuit system is configured to receive communications transmitted according to at least a first communication protocol; a communication circuit system, the communication circuit system is configured to perform wireless communications according to at least a second communication protocol; and a processing circuit system, the processing circuit system is electrically coupled to the signal receiving circuit system and the communication circuit system. The processing circuit system is configured to receive a first signal according to the first communication protocol through the signal receiving circuit system. In response to receiving the first signal, the processing circuit system is further configured to transmit a second signal according to the second communication protocol through the communication circuit system and establish a secure link according to the second communication protocol.

Description

Technical Field

[0001] The present disclosure relates to device communications, and more particularly, to establishing a secure communication link between two or more devices. Background Art

[0002] Computing devices may be configured to transmit communications to and receive communications from other computing devices. These communications may include data or any information transmitted between devices wirelessly or via a wired connection. Communications that are public or otherwise do not contain sensitive information may be unsafe. Communications intended to be exclusive to two or more devices may be encrypted so that the information contained therein is not easily accessible to unauthorized devices. For example, an implantable medical device (IMD) may exchange sensitive information with one or more external devices via an encrypted wireless communication link. However, communication environments outside the medical device space may also be used to exchange sensitive information.

[0003] IMD can be implanted in the patient's body through surgery to monitor one or more physiological parameters of the patient and / or delivery therapy to suppress one or more symptoms of the patient. For example, IMD can include a heart monitor, is configured to deliver cardiac pacing or another electrotherapy to the patient and / or is configured to terminate tachyarrhythmia by delivering high-energy electric shock. A clinician or patient can use an external device to retrieve the information collected by the IMD and / or configure or adjust one or more parameters of the monitoring and / or therapy provided by the IMD. Typically, the external device is connected to the IMD via a wireless connection. In some instances, a wireless connection is established between the external device and the IMD using Bluetooth® wireless protocol. In such instances, the external device is considered as a central device, and one or more IMDs are considered as peripheral devices.

[0004] In some instances, communications between an external device (e.g., a medical device programmer or data acquisition device) and an IMD (e.g., a pacemaker, defibrillator, neurostimulator, cardiac monitor, or drug pump, as examples) can be encrypted to protect sensitive information, such as collected patient data or programming instructions that at least partially define the operation of the IMD. Secure communications involving medical devices may involve encryption schemes known to both the external device and the IMD. For example, both the external device and the IMD can utilize stored encryption keys to encrypt and / or decrypt some or all information transmitted between the devices. Summary of the invention

[0005] In general, the present disclosure relates to devices, systems and techniques for establishing a secure link between two or more devices. For example, the present disclosure describes techniques for establishing a secure connection between an IMD, an external device and (in some cases) another external device using an external device. Before secure communication according to a second communication protocol, the external device may initiate a pairing procedure by transmitting a signal according to a first communication protocol. Although in some instances, the first communication protocol is unknown to the IMD, the IMD is configured to sense the first signal based on a change in the electric field caused by the signal. During the pairing procedure, the devices may each generate at least one encryption key (e.g., a session key) based on a random number generated by the device. The IMD may send a challenge to the external device, and based on verification of the challenge, the device may establish a secure link. Following the pairing procedure, the device may communicate securely using the session key until the secure link is terminated. For example, the external device or another external device may be a programming device configured to communicate with the IMD to modify one or more settings of the IMD and receive patient data from the IMD.

[0006] In some instances, the communication range of the second protocol is greater than the communication range of the first protocol. However, during the pairing procedure, communication with the IMD may be performed according to a low power mode, and therefore in some cases, according to a small-scale implementation of the second protocol. In some instances, after pairing, the power and communication range will no longer be reduced to communicate securely with the IMD according to the second protocol. In some instances, the signal according to the first protocol is a wake-up signal for the IMD, for example, converting at least a certain circuit system of the IMD (such as the communication circuit system) from a relatively low energy consumption mode to a relatively high energy consumption mode, in which communication with one or more external devices occurs. In one instance, the IMD converts its communication circuit system from being in a disconnected state to being in an on state, in which the communication circuit system does not transmit or receive, and during the on state, the communication circuit system is able to transmit and receive. In another instance, the IMD changes from a first relatively low energy consumption mode in which a notification signal is transmitted at a first rate to a second relatively high energy consumption mode in which a notification signal is transmitted at a second faster rate, which results in increased power consumption.

[0007] The techniques of the present disclosure may provide one or more advantages. For example, before a secure link is established between a first device and a second device, the second device may not have access to an encryption key used to encode or decode data exchanged with the first device. The example second device of the present disclosure may initiate the generation of an encryption key that enables the second device to communicate securely with the first device. The second device may send a relatively close-range signal to the first device to initiate the process of generating the encryption key. By using a close-range signal, the second device reduces the possibility that the signal may be fraudulently copied by a third-party device. After the encryption key is generated, the first device and the second device may exchange information at a relatively longer distance than the close-range signal initially sent from the second device to the first device. In addition, in some instances, the first device is configured to communicate exclusively using a specific protocol (such as the Bluetooth® protocol). At least some techniques of the present disclosure allow the first device to receive and identify signals that are not transmitted using the Bluetooth® protocol, enabling the second device to initiate the pairing process using a customized non-Bluetooth® signal that is not easily copied by any device with Bluetooth® functionality.

[0008] In some examples, a first device is configured to perform wireless communications. The first device includes a signal receiving circuit system, the signal receiving circuit system configured to receive communications transmitted according to at least a first communication protocol; a communication circuit system, the communication circuit system configured to perform wireless communications according to at least a second communication protocol; and a processing circuit system, the processing circuit system electrically coupled to the signal receiving circuit system and the communication circuit system. The processing circuit system is configured to receive a first signal according to the first communication protocol through the signal receiving circuit system. In response to receiving the first signal, the processing circuit system is further configured to transmit a second signal according to the second communication protocol through the communication circuit system and establish a secure link according to the second communication protocol, wherein to establish the secure link, the processing circuit system is configured to transmit at least one signal at a first power magnitude, and wherein the communications transmitted through the secure link are at a second power magnitude greater than the first power magnitude.

[0009] In other examples, a method includes receiving, by signal receiving circuitry of a first device configured to receive communications transmitted according to at least a first communications protocol, a first signal according to the first communications protocol. In response to receiving the first signal, the method further includes transmitting, by the communications circuitry, a second signal according to a second communications protocol and establishing a secure link according to the second communications protocol, wherein establishing the secure link includes transmitting at least one signal at a first power magnitude, and wherein communications transmitted over the secure link are at a second power magnitude greater than the first power magnitude.

[0010] In other examples, a system includes a first device, the first device including a signal receiving circuit system, the signal receiving circuit system is configured to receive communications transmitted according to at least a first communication protocol; a communication circuit system, the communication circuit system is configured to wirelessly communicate according to at least a second communication protocol; and a first processing circuit system, the first processing circuit system is electrically coupled to the signal receiving circuit system and the communication circuit system. The first processing circuit system is configured to receive a first signal according to the first communication protocol through the signal receiving circuit system. In response to receiving the first signal, the first processing circuit system is further configured to transmit a second signal according to the second communication protocol through the communication circuit system. The system further includes a second device, the second device including a second communication circuit system, the second communication circuit system is configured to wirelessly communicate according to a first communication protocol having a first range and a second communication protocol having a second range, the second communication protocol being different from the first communication protocol and the second range being greater than the first range, and a second processing circuit system, the second processing circuit system is electrically coupled to the second communication circuit system. The second processing circuit system is configured to transmit the first signal to the first device according to the first communication protocol through the second communication circuit system. In response to transmitting the first signal, the second processing circuit system is further configured to receive the second signal from the first device through the second communication circuit system according to the second communication protocol. In response to receiving the second signal, the second processing circuit system is further configured to establish a secure link according to the second communication protocol, wherein the secure link includes the first device and at least one of the second device and a third device, wherein to establish the secure link, the second processing circuit system is configured to receive at least one signal at a first power magnitude, and wherein communications transmitted over the secure link are at a second power magnitude greater than the first power magnitude.

[0011] This summary is intended to provide an overview of the subject matter described in this disclosure. This summary is not intended to provide an exclusive or exhaustive explanation of the systems, devices, and methods described in detail in the following figures and specification. Further details of one or more examples of the present disclosure are set forth in the following figures and specification. Other features, objects, and advantages will become apparent from the description and drawings, as well as from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 An environment of an example medical device system in conjunction with a patient and the patient's heart is presented in accordance with one or more techniques of the present disclosure.

[0013] Figure 2 is a block diagram illustrating an example configuration of components of an implantable medical device (IMD), in accordance with one or more techniques of the present disclosure.

[0014] Figure 3 is a block diagram illustrating an example configuration of components of an example external device in accordance with one or more techniques of this disclosure.

[0015] Figure 4 is a block diagram illustrating an example configuration of components of another example external device in accordance with one or more techniques of this disclosure.

[0016] Figure 5 is a flow diagram illustrating example operations in accordance with one or more techniques of this disclosure.

[0017] Like reference numerals refer to like elements throughout the specification and drawings. DETAILED DESCRIPTION

[0018] The present disclosure describes techniques for establishing a secure link between two or more devices. In some instances, a secure link is established between at least one implantable medical device (IMD) and at least one external device. The external device can be used, for example, to transmit a signal to the IMD to initiate an encryption key generation process that will enable at least one external device to exchange encrypted data with the IMD. However, the techniques of the present disclosure are not limited to implantable devices or medical devices. The techniques can be used to establish a secure link between any two or more devices that can communicate with each other.

[0019] In some instances, the IMD records one or more physiological signals of the patient, wherein the one or more physiological signals may indicate a medical condition. The IMD may sense the physiological signals using any combination of electrodes, chemical sensors, temperature sensors, or other sensors and store data indicating the physiological signals in a memory. In some instances, the IMD delivers therapy, such as cardiac pacing or anti-tachyarrhythmia shock, and stores data indicating the therapy delivered. In some instances, the IMD stores data about the status and performance of the IMD and its components and operating parameters that control the functions of the IMD, such as for sensing and / or delivering therapy.

[0020] Because the IMD is implanted in the patient, in some cases, the IMD can communicate wirelessly with an external device, for example, transmitting at least some of the data to the external device for analysis by a clinician. In addition, a user (e.g., a patient or a clinician) can provide user input to the external device to control the IMD. The external device can then transmit instructions to the IMD based on the user input. Because the information exchanged between the IMD and the external device may be sensitive and can be transmitted wirelessly, it may be beneficial to exchange data with the IMD using a secure link (e.g., an encrypted link).

[0021] In order to transmit data using an encrypted link, a variety of different encryption algorithms can be used. As examples, such algorithms may include Rivest–Shamir–Adleman (RSA), Advanced Encryption Standard (AES), Elliptic Curve Integrated Encryption Scheme (ECIES), Data Encryption Standard (DES), Two Fish Method, Three Fish Method, or Key Exchange Method. Although different encryption algorithms differ in their methods of encoding and decoding data, most encryption algorithms rely on encryption keys for the encoding and decoding process. For example, a first device may encode a message using a first encryption key and transmit the encoded message to a second device. The second device may decode the message using a second encryption key, wherein the second encryption key corresponds to the first encryption key. Therefore, if the external device does not possess an encryption key corresponding to the encryption key of the IMD, the external device may not be able to communicate securely with the IMD.

[0022] The external device is configured to initiate a process to generate a set of encryption keys (e.g., "session" keys) that allow one or more external devices to communicate with an implantable medical device. The external device can send an initial signal to the IMD to begin the process of creating the set of encryption keys. In some cases, the initial signal can also "wake up" the IMD for a communication session (e.g., causing the IMD to supply a greater amount of power to the IMD's communication circuit system). The initial signal can have a short transmission range (e.g., less than about 20 centimeters (cm)), thereby reducing the likelihood that a fraudulent device will be able to mimic the initial signal to initiate the key creation process. In some cases, the external device or a portion thereof used to facilitate communication with the IMD must be placed directly from the IMD across the patient's skin in order for the initial signal transmission to be successful. After the IMD receives the initial signal, the external device and the IMD can generate the set of encryption keys and establish a secure link.

[0023] Figure 1 An environment of an example medical device system 2 incorporating a patient 4 and a heart 6 of the patient 4 in accordance with one or more techniques of the present disclosure is shown. The example techniques may be used with an IMD 16 that may wirelessly communicate with at least one of an external device 18 and an external device 20. In some examples, the IMD 16 may be implanted outside of the chest of the patient 4 (e.g., subcutaneously). Figure 1 ). IMD 16 can be positioned near the sternum near or just below the level of heart 6, e.g., at least partially within the outline of the heart. In some examples, IMD 16 takes the form of a LINQ™ Insertable Cardiac Monitor (ICM) available from Medtronic plc, of Dublin, Ireland.

[0024] Clinicians sometimes diagnose a patient with a cardiac condition based on one or more observed physiological signals collected by a physiological sensor, such as an electrocardiogram (ECG) electrode, an electrocardiogram (EGM) electrode, a chemical sensor, or a temperature sensor. In some cases, the clinician applies a non-invasive sensor to the patient to sense the one or more physiological signals while the patient is attending a medical appointment at a clinic. However, in some instances, the physiological markers of a cardiac condition (e.g., an irregular heartbeat) are rare. Thus, in these instances, the clinician may not be able to observe the physiological markers needed to diagnose the patient with a cardiac condition while monitoring the patient's one or more physiological signals during the medical appointment. Figure 1 In the illustrated example, IMD 16 is implanted in patient 4 to continuously record one or more physiological signals of patient 4 over an extended period of time.

[0025] In some examples, IMD 16 includes a plurality of electrodes. The plurality of electrodes are configured to detect signals that enable the processing circuitry of IMD 16 to determine current values ​​of additional parameters associated with the cardiac and / or pulmonary function of patient 4. In some examples, the plurality of electrodes of IMD 16 are configured to detect signals indicative of electrical potentials of tissue surrounding IMD 16. Furthermore, in some examples, IMD 16 may additionally or alternatively include one or more accelerometers, temperature sensors, chemical sensors, optical sensors, pressure sensors. Such sensors may detect one or more physiological parameters indicative of a patient condition.

[0026] The external device 18 may include a housing that surrounds a processing circuit system electrically coupled to the communication circuit system, the memory, and the user interface. In some instances, the external device 18 is physically separated from the external device 20. The user interface of the external device 18 may include, for example, at least one button. Additionally or alternatively, the user interface of the external device 18 may include any other device, sensor, or medium configured to accept user input. In some instances, the user interface of the external device 18 enables the user to initiate one or more technologies of the present disclosure, which establish a secure (e.g., encrypted) link with the IMD 16 for a certain period of time. Although the external device 18 may be physically separated from the external device 20, the external device 18 is configured to, for example, establish a secure connection between the external device 20 and the IMD 16. In some cases, the external device 18 may act as an intermediary for communication between the external device 20 and the IMD 16, for example, during a secure communication session. In other cases, the external device 18 may establish a secure link with the IMD 16 without including any additional device (e.g., the external device 20).

[0027] In some instances, external device 18 is configured for handheld use. In fact, in some cases, the user may be able to fit external device 18 in the palm of a single hand while using at least one finger to interact with the user interface. In addition to being configured for handheld use, external device 18 may be configured to send signals according to at least one communication protocol through a communication circuit system. For example, a communication protocol may enable external device 18 to send signals to IMD 16 within a short distance (e.g., less than about 20 cm). For example, external device 18 may be through near field communication technology (e.g., inductive coupling, near field communication (NFC) or other communication technology that can operate at a range of less than 10-20 cm). Another example communication protocol may enable IMD 16, external device 18, and external device 20 to communicate over a relatively long range. For example, external device 18 may use far field communication technology (e.g., radio frequency (RF) telemetry according to 802.11 or Bluetooth® specification set or other communication technology that can operate at a range greater than near field communication technology).

[0028] The external device 20 is configured to wirelessly communicate with the IMD 16 as needed to provide or retrieve information. In some instances, the external device 20 acts as an external programming device for the IMD 16, such as a medical device programmer. The external device 20 is an external computing device that a user (e.g., a clinician and / or patient 4) can use to communicate with the IMD 16. For example, the external device 20 can be a clinician programmer used by the clinician to communicate with the IMD 16 and update one or more settings of the IMD 16. In addition or alternatively, the external device 20 can be a patient programmer that allows the patient 4 to control certain operations of the IMD 16 and / or view and modify one or more operating parameter values ​​of the IMD 16. The clinician programmer can include more programming features than the patient programmer. In other words, the clinician may only be allowed to perform more complex or sensitive tasks to prevent untrained patients from making undesirable changes to the IMD 16.

[0029] The external device 20 may be a handheld computing device having a display viewable by a user and an interface (i.e., a user input mechanism) for providing input to the external device 20. For example, the external device 20 may include a small display screen (e.g., a liquid crystal display (LCD) or a light emitting diode (LED) display) that presents information to the user. In addition, the external device 20 may include a touch screen display, a keypad, buttons, a peripheral pointing device, voice activation, or another input mechanism that allows the user to navigate through the user interface of the external device 20 and provide input. If the external device 20 includes buttons and a keypad, the buttons may be dedicated to performing specific functions, such as a power button, the buttons and keypad may be soft keys whose functions change depending on the user interface section currently viewed by the user, or any combination thereof.

[0030] In other examples, external device 20 may be a stand-alone application within a larger workstation or another multifunction device rather than a dedicated computing device. For example, the multifunction device may be a notebook computer, a tablet computer, a workstation, one or more servers, a cellular telephone, a personal digital assistant, or another computing device that can operate an application that enables the computing device to operate as a secure device. In some examples, a wireless adapter coupled to the computing device enables external device 18 to establish a secure link between the computing device and IMD 16.

[0031] When external device 20 is configured for use by a clinician, external device 20 may be used to transmit instructions to IMD 16. Example instructions may include a request to set an electrode combination for sensing and any other information that may be useful for programming into IMD 16. The clinician may also configure and store operating parameters for IMD 16 within IMD 16 with the aid of external device 20. In some instances, external device 20 assists the clinician in configuring IMD 16 by providing a system for identifying potentially beneficial operating parameter values.

[0032] Whether external device 20 is configured for use by a clinician or a patient, external device 20 is configured to communicate with IMD 16 and optionally another computing device (e.g., external device 18) via wireless communications. For example, external device 20 may communicate via near field communication techniques (e.g., inductive coupling, NFC, or other communication techniques operable at a range of less than 10-20 cm) and far field communication techniques (e.g., RF telemetry in accordance with the 802.11 or Bluetooth® specification sets or other communication techniques operable at a range greater than near field communication techniques).

[0033] Typically, IMD 16, external device 18, and external device 20 may exchange information using at least one communication protocol. Communication protocols define multiple sets of rules that define one or more aspects of data exchange between two or more entities in a network. In some instances, communication protocols are stored as a list of computer-readable instructions, and the communication protocols may be executed by any combination of hardware (e.g., physical circuit systems) and software. Organizations such as medical device manufacturers may create their own communication protocols, license communication protocols from third parties, use open source communication protocols, or implement any combination thereof. In some instances, communication protocols include security provisions, such as password requirements and data encryption, to protect data transmission between two or more devices in a network.

[0034] The IMD 16 collects sensitive physiological data from the patient 4. In addition, the IMD 16 may receive data indicating instructions from the external device 20, wherein the instructions cause the IMD 16, as examples, to update one or more settings, change one or more parameters, output data, or delete data. Thus, communications (e.g., information or data) transmitted between the external device 20 and the IMD 16 may be encrypted to protect communications from unauthenticated users and to prevent the external device 20 and the IMD 16 from being compromised. For example, a link key generated based on a public encryption key of the external device 20 and the IMD 16 may be used to encrypt communications transmitted between the external device 20 and the IMD 16 using a far-field communication protocol. The encryption key may define a string of characters that is used to convert data into an encrypted form, to decode encrypted data, or any combination thereof. Thus, if either of the first device and the second device does not possess a corresponding encryption key associated with a secure link between the first device and the second device, the first device may be unable to securely communicate with the second device.

[0035] In some cases, external device 20 does not have access to a public encryption key associated with IMD 16 and, therefore, is unable to transmit encrypted data to IMD 16. In these cases, techniques for establishing a secure link between external device 20 and IMD 16 may be beneficial. In some example techniques of the present disclosure, external device 18 is configured to establish a secure link by, in part, transmitting a short-range signal to IMD 16.

[0036] Any combination of IMD 16, external device 18, and external device 20 may exchange information and data with each other. Figure 1As shown, IMD 16 is configured to communicate with external device 18 via communication link 22, external device 18 is configured to communicate with external device 20 via communication link 24, and IMD 16 is configured to communicate with external device 20 via communication link 26. In some examples, each of communication links 22, 24, and 26 includes any combination of secure channels (e.g., encrypted channels) and unsecure channels (unencrypted channels). In other words, each of communication links 22, 24, and 26 represents all communications between the corresponding device pair.

[0037] In one example, external device 18 is configured to transmit unencrypted data to IMD 16 via communication link 22, and external device 18 is further configured to transmit encrypted data to IMD 16 via communication link 22. In some examples, the communication circuitry of external device 18 is configured to wirelessly communicate according to a first protocol and a second protocol, wherein the first protocol is different from the second protocol. For example, the first protocol defines a first range, and the second protocol defines a second range. In other words, the maximum distance over which a signal can be transmitted according to the first protocol is different from the maximum distance over which a signal can be transmitted according to the second protocol. In some examples, the second range is greater than the first range. However, in other examples, the second range is less than or equal to the first range.

[0038] The processing circuitry of external device 18 may transmit the first signal to IMD 16 according to a first protocol via the communication circuitry. In some examples, the first protocol includes any communication protocol that uses magnetic induction communication, RF communication, or tissue conduction communication (TCC) through the patient's tissue. In some examples, the first range (e.g., the maximum range of the first signal) is less than about 20 cm. In other examples, the first range is less than about 10 cm.

[0039] In some examples, the first signal is defined by an electromagnetic waveform that acts as a "wake-up" signal for IMD 16. The signal receiving circuitry of IMD 16 ( Figure 1 The signal receiving circuit system may be configured to sense the electromagnetic waveform. After receiving the first signal, the signal receiving circuit system may send data indicating the first signal to the Figure 1In some cases, the first signal may cause the processing circuit system of IMD 16 to transition at least a certain circuit system (such as the communication circuit system of IMD 16) from a relatively low energy consumption mode to a relatively high energy consumption mode in which communication with one or more external devices occurs. Because IMD 16 is powered by a power supply, which in some instances has a limited lifespan, it may be beneficial to power the communication circuit system only when the function of IMD 16 requires it. In this way, IMD 16 may use the communication circuit system only after receiving a "wake-up" signal such as the first signal transmitted by external device 18. For example, IMD 16 may transition the communication circuit system from an off state, in which the communication circuit system does not transmit or receive, to an on state during which the communication circuit system is able to transmit and receive. In some cases, the signal receiving circuit system of IMD 16 may be separate from the communication circuit system of IMD 16. In other cases, the signal receiving circuit system may be a component or part of the communication circuit system of IMD 16. In either case, the signal receiving circuitry is configured to sense the first signal transmitted from external device 18 to IMD 16. In some examples, the signal receiving circuitry may be configured to detect a TCC signal, wherein the first signal includes the TCC signal.

[0040] In some instances, the communication circuit system of IMD 16 periodically transmits a series of announcements according to a second protocol. The announcements transmitted by IMD 16 can broadcast to other devices that IMD 16 is close to communicate and / or ready to communicate. IMD 16 can transmit announcements at a first announcement rate before receiving a "wake-up" signal, and switch to a second faster announcement rate after receiving the "wake-up" signal. In one example, the first announcement rate can be greater than twenty announcements per hour and less than sixty announcements per hour. In other words, consecutive announcements in the announcement sequence can be separated by a time period that lasts greater than or equal to one minute and less than or equal to three minutes. In some instances, the first announcement rate may not be sufficient to establish a secure link with another device (e.g., external device 18, 20) within a desired amount of time. In response to detecting the first signal, IMD 16 increases the rate at which the communication circuit system of IMD 16 transmits announcements to a second rate. The increased second announcement rate increases the power consumption of IMD 16 (e.g., the communication circuit system of IMD 16). The second notification rate may be high enough to enable the IMD 16 to establish a secure link with the external devices 18, 20 within a desired amount of time (e.g., seconds instead of minutes). In some instances, the second notification rate is greater than one notification per second. Thus, the second notification rate is significantly higher than the first notification rate, and the communication circuit system of the IMD 16 consumes more power when operating at the second notification rate than when the communication circuit system operates at the first notification rate. In some instances, after receiving the first signal, the IMD 16 operates at the second notification rate for a period of time, such as up to thirty seconds, so as not to operate for too long in the increased higher power consumption mode. Since in some cases, the IMD 16 increases the notification rate from the first notification rate to the second notification rate only after receiving the first signal, the IMD 16 may reduce the total amount of power required to establish a secure link between the IMD 16 and the external devices 18, 20. This may increase the life of the power supply that provides power to the components of the IMD 16.

[0041] The processing circuitry of the external device 18 can be configured to cause the external device 18 to generate a first signal. In one example, the first signal includes a plurality of primary portions defining a first frequency value and a first duration. Additionally, the first signal includes a plurality of secondary portions defining a second frequency value and a second duration. The plurality of primary portions and the plurality of secondary portions are interleaved such that one primary portion appears between two consecutive secondary portions, and one secondary portion appears between two consecutive primary portions.

[0042] In some examples, the external device 18 is configured to transmit the first signal in response to a user input to a user interface of the external device 18 (e.g., pressing a button). Alternatively, the external device 18 may be configured to transmit the first signal in response to receiving data indicating an instruction from the external device 20. In some examples, the external device 18 transmits the first signal for a fixed amount of time lasting approximately 255 milliseconds (ms). Alternatively, in other examples, the external device 18 transmits the first signal for a fixed amount of time lasting greater than or less than approximately 255 milliseconds. In other examples, the external device 18 is configured to transmit the first signal for a period of time that lasts as long as the user presses a button defining the user interface.

[0043] IMD 16 is configured to receive the first signal. Although external device 18 transmits the first signal according to the first protocol, in some instances, IMD 16 is not configured to communicate (including transmitting and receiving information) according to the first protocol. However, the signal receiving circuitry ( Figure 1 The IMD 16 (not shown) is configured to detect electromagnetic field changes, where the electromagnetic changes may be caused by a TCC signal, a magnetic induction signal, an RF signal, or other types of signals. In this way, the IMD 16 is configured to detect the first signal because the first signal causes an electromagnetic field change within a first range of the external device 18. In practice, the IMD 16 may be configured to detect one or more parameters of the first signal based on the electromagnetic field changes, such as a first frequency value, a second frequency value, a first duration, a second duration, and a total duration.

[0044] In some instances, the IMD 16 is configured to cross-reference the values ​​of the one or more detected parameters of the first signal with one or more baseline values ​​of the detected parameters, wherein the one or more baseline values ​​are stored in a memory of the IMD 16. Subsequently, the IMD 16 is configured to determine whether the first signal matches an expected first signal associated with the external device 18. In response to determining that the external device 18 transmitted the first signal, the IMD 16 is configured to transmit a second signal to the external device according to a second protocol through the communication circuit system of the IMD 16. The second signal may include a set of notifications for establishing a secure link. The second protocol, which is different from the first protocol, may be a communication protocol known to both the IMD 16 and the external device 18. In some instances, the second protocol includes a Bluetooth® protocol such as a Bluetooth® Low Energy (BTLE) protocol.

[0045] A device (e.g., IMD 16, external device 18, or external device 20) may be configured to transmit signals according to a second protocol while the device is operating in a low power consumption mode or a normal power consumption mode. In some instances, the device may transmit a signal at 0 decibel milliwatts (dBm) while transmitting a signal according to the second protocol and operating in a normal power consumption mode. Additionally, in some instances, the device may transmit a signal at -20 dBm while transmitting a signal according to the second protocol and operating in a low power consumption mode. In other words, the power magnitude of a signal transmitted while the device is operating in a low power consumption mode may be reduced by one hundred times compared to the power magnitude of a signal transmitted while the device is operating in a normal power consumption mode. In other instances, the device may transmit a signal in the range of -50 dBm to -10 dBm while transmitting a signal according to the second protocol and operating in a low power consumption mode.

[0046] The second signal transmitted by the IMD 16 may include a set of notifications transmitted at a second notification rate. In some instances, before transmitting the second signal at the second notification rate in response to receiving the first signal, the IMD 16 may transmit notifications at a first notification rate, wherein the first notification rate is less than the second notification rate. In other instances, before transmitting the second signal at the second notification rate, the communication circuit system of the IMD 16 is powered off and the IMD 16 does not transmit notifications. In such instances, the second notification rate may be the only rate at which the IMD 16 transmits notifications. The external device 18 is configured to receive the second signal including the set of notifications. Subsequently, in some instances, the external device 18 is configured to generate a first set of random data. In other instances, the external device 18 may transmit a notification of receiving the second signal to the external device 20 via the communication link 24 and the external device 20 generates the first set of random data. The external devices 18, 20 may transmit the first set of random data to the IMD 16, and in response to receiving the first set of random data, the IMD 16 may generate a second set of random data. In some examples, the first set of random data and the second set of random data each comprise a 64-bit integer.

[0047] The IMD 16 may be configured to store the first encryption key in an encrypted form and the first encryption key in an unencrypted form. In some cases, the first encryption key may be a "device key" created and stored in the IMD 16 when the IMD 16 is manufactured. In some instances, the first encryption key in an encrypted form is encrypted using a public key of an ECIES security algorithm. After generating the second set of random data, the IMD 16 is configured to transmit the second set of random data, the challenge, and the first encryption key in an encrypted form to an external device 18. The IMD 16 may transmit the second set of random data, the challenge, and the first encryption key in an encrypted form according to a second protocol, but with reduced power relative to subsequent communications according to the second protocol. In some instances, for example, where the IMD 16 uses reduced power, the IMD 16 transmits the second set of random data, the challenge, and the first encryption key in an encrypted form with a power magnitude of less than about 150 nanowatts (nW). To improve security by limiting the range at which a device is configured to intercept the second set of random data, the challenge and the encrypted form of the first encryption key, it may be desirable to transmit at a reduced power, for example limiting the maximum range to approximately 1 meter.

[0048] In some cases, the challenge comprises an unencrypted 64-bit integer. IMD 16 may store the challenge as a template challenge in a memory for future verification. Additionally, in some instances, IMD 16 is configured to calculate a second encryption key based on the first set of random data, the second set of random data, and the first encryption key in an unencrypted form.

[0049] The external device 18 can receive the second group of random data, the challenge and the first encryption key in encrypted form. In some instances, the external device 18 relays the second group of random data, the challenge and the first encryption key in encrypted form to the external device 20 via the communication link 24. Each of the IMD 16, the external device 18 and the external device 20 is configured to submit the first group of random data and the second group of random data to a corresponding memory. In some instances, any combination of the external device 18 and the external device 20 is configured to decrypt the first encryption key using the private key of the ECIS security algorithm. In this way, the external device 18, 20 is configured to obtain the first encryption key in unencrypted form. The external device 18, 20 can calculate the second encryption key based on the first group of random data, the second group of random data and the first encryption key in unencrypted form. Therefore, the IMD 16 and the external device 18, 20 can each calculate the second configuration independently of each other. Independent generation of the second encryption key ensures that the second encryption key does not need to be wirelessly transmitted between IMD 16 and external devices 18, 20, thereby reducing the likelihood that the second encryption key may be intercepted or otherwise compromised.

[0050] In some examples, the external device 18, 20 is configured to encrypt a challenge received from the IMD 16 using the second encryption key. The external device 18 may transmit the encrypted challenge to the IMD 16. Since the IMD 16 is configured to calculate the second encryption key independently of the external device 18, 20, the IMD 16 may decrypt the encrypted challenge using the second encryption key. To verify the encrypted challenge transmitted by the external device 18 and decrypted by the IMD 16, the IMD 16 is configured to cross-reference the challenge received from the external device 18 with a template challenge, wherein the template challenge corresponds to the challenge originally sent to the external device 18. In other words, transmitting the challenge to the external device 18 and receiving the encrypted challenge from the external device 18 enables the IMD 16 to verify that the external device 18, 20 possesses the second encryption key.

[0051] The IMD 16 is configured to transmit the verification signal to the external device 18, which establishes a secure link between the IMD 16 and the external devices 18, 20. In some instances, the communication transmitted over the secure link is in a normal power consumption mode of the second protocol. The external device 18 is configured to receive the verification signal, and in some cases, add the external device 20 to the secure link, thereby enabling both the external device 18 and the external device 20 to communicate with the IMD 16 over the secure link. In one example, the external device 18 communicates with the external device 20 over the secure channel of the communication link 24, and also communicates with the IMD 16 over the secure channel of the communication link 22. Thus, in this example, the external device 18 acts as an intermediary between the external device 20 and the IMD 16, thereby establishing an indirect secure link between the external device 20 and the IMD 16.

[0052] In some cases, it may be desirable to terminate a secure link between any combination of IMD 16, external device 18, and external device 20. If any of IMD 16, external device 18, or external device 20 outputs an instruction to terminate the secure link, the secure link between external device 20 and IMD 16 may be terminated. Additionally, in instances where external device 18 acts as an intermediary between external device 20 and IMD 16, if external device 18 is out of range required to communicate with IMD 16 or external device 20, the secure link is terminated. In some instances, after external device 18 establishes a secure link with IMD 16, a time window begins, wherein the time window is set to expire after a predetermined amount of time. If the time window expires before the secure link is terminated, IMD 16 may terminate the secure link. In some instances, the predetermined amount of time is approximately one hour.

[0053] In some examples, IMD 16, external device 18, external device 20, or other external device ( Figure 1 The second encryption key may be used in any combination of the plurality of encryption keys (not shown) to create a set of additional encryption keys. Each additional encryption key in the set of additional encryption keys may enable encryption and decryption of a particular category of data. For example, an additional encryption key may enable encryption and decryption of physiological data stored in the IMD 16.

[0054] In some examples, the power magnitude of the transmission over the secure link is greater than the power magnitude of the second set of random data, the challenge, and the encrypted form of the first encryption key sent by IMD 16 to external device 18 as part of the key generation process.

[0055] Despite Figure 1 1 and 20 are shown as separate devices, but in some examples (not shown), a single external device performs the functions of both external device 18 and external device 20.

[0056] Although in one instance, IMD 16 takes the form of an ICM, in other instances, IMD 16 takes the form of any combination of an implantable cardioverter-defibrillator (ICD), a pacemaker, a cardiac resynchronization therapy device (CRT-D), a spinal cord stimulation (SCS) device, a deep brain stimulation (DBS) device, a left ventricular assist device (LVAD), an implantable sensor, an orthopedic device, or a drug pump, as examples. In addition, the technology of the present disclosure can be used to establish a secure connection with any of the aforementioned IMDs. In addition, the technology described in the present disclosure can be applied to establish a secure link between two or more devices, neither of which is an implantable device. In addition, in some instances, the technology described in the present disclosure can be applied to establish a secure link between two or more devices, neither of which is a medical device.

[0057] Figure 2 is a block diagram illustrating an example configuration of components of IMD 16 in accordance with one or more techniques of this disclosure. Figure 2 In the example of FIG. 1 , IMD 16 includes processing circuitry 30, sensing circuitry 32, electrodes 34A-34D (collectively, “electrodes 34”), sensor 35, switching circuitry 36, signal receiving circuitry 37, communication circuitry 38, antenna 39, memory 40, and power source 48. Memory 40 is configured to store communication protocols 42, operating parameters 44, collected data 45, and encryption keys 46.

[0058] In one example, processing circuitry 30 may include one or more processors configured to implement functions and / or process instructions for execution within IMD 16. For example, processing circuitry 30 may be capable of processing instructions stored in memory 40. Processing circuitry 30 may include, for example, a microprocessor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or equivalent discrete or integrated logic circuitry or a combination of any of the foregoing devices or circuitry. Thus, processing circuitry 30 may include any suitable structure, whether in hardware, software, firmware, or any combination thereof, to perform the functions attributed to processing circuitry 30 herein.

[0059] The sensing circuit system 32 monitors cardiac electrical signals from any combination of electrodes 34A-34D (collectively referred to as "electrodes 34"). In some instances, the sensing circuit system 32 may include one or more amplifiers, filters, and analog-to-digital converters. For example, the sensing circuit system 32 may include one or more detection channels, each of which may include an amplifier. The detection channels can be used to sense cardiac signals, such as cardiac EGM. Some detection channels can detect events, such as R waves, P waves, and T waves, and provide indications of the occurrence of such events to the processing circuit system 30. In addition or alternatively, some channels can detect cardiac EGM signals from specific combinations of electrodes 34. One or more other detection channels can provide signals to the analog-to-digital converter for conversion into digital signals for processing, analysis, storage, or output by the processing circuit system 30.

[0060] Each detection channel of the sensing circuit system 32 may include a filter configured to pass through a custom range of frequency values. For example, the sensing circuit system 32 may include one or more narrowband channels, each of which may include a narrowband filter sensing amplifier. Additionally or alternatively, the sensing circuit system 32 may include one or more wideband channels, each of which includes an amplifier having a relatively wide passband compared to the narrowband channel. The signals sensed by the narrowband channels and the wideband channels of the sensing circuit system 32 may be converted into multi-bit digital signals by an analog-to-digital converter (ADC) provided by, for example, the sensing circuit system 32 or the processing circuit system 30. In some instances, the processing circuit system 30 analyzes a digitized version of the signal from the sensing circuit system 32. In other instances, the processing circuit system 30 stores the digitized version of the signal in the memory 40 (e.g., as collected data 45), outputs the digitized version of the signal through the communication circuit system 38, or any combination thereof.

[0061] Processing circuitry 30 may use switching circuitry 36 to select which of electrodes 34 to use for sensing cardiac signals, e.g., via a data / address bus. Switching circuitry 36 may include a switch array, a switch matrix, a multiplexer, or any other type of switching device suitable for selectively coupling energy to selected electrodes.

[0062] In some examples, sensing circuit system 32 is electrically coupled to sensor 35. Sensor 35 may include any combination of accelerometers, temperature sensors, chemical sensors, optical sensors, and pressure sensors. Sensor 35 may, for example, sense one or more physiological parameters indicative of a cardiac condition. Additionally or alternatively, an accelerometer of sensor 35 may sense data indicative of at least one of a patient's posture and a patient's activity.

[0063] The signal receiving circuit system 37 may include hardware, firmware, software, or any combination thereof for receiving a signal from another device, such as the external device 18 or the external device 20. For example, the signal receiving circuit system 37 may be configured to detect electromagnetic changes indicating a signal. In some cases, the signal may include a TCC signal. In such cases, the signal receiving circuit system 37 may include a circuit system configured to detect electromagnetic field changes indicating a TCC signal. The signal receiving circuit system 37 may be powered by a power supply 48 to "listen" for signals from the external device 18 or the external device 20. In other examples, the power supply 48 may power the signal receiving circuit system 37 for a certain period of time every 250 milliseconds, wherein the period of time lasts for greater than 0.1 milliseconds and less than 50 milliseconds. In this way, the signal receiving circuit system 37 may alternate between an "off" state and an "on" state, wherein the signal receiving circuit system 37 is configured to detect a signal while the signal receiving circuit system 37 is powered by the power supply 48 during the on state.

[0064] The communication circuit system 38 may include any suitable hardware, firmware, software, or any combination thereof for communicating with another device, such as the external device 18 or the external device 20. Under the control of the processing circuit system 30, the communication circuit system 38 may receive downlink telemetry from the external device 18, the external device 20, or another device, and send uplink telemetry thereto, by means of an internal or external antenna (e.g., antenna 39). In addition, the processing circuit system 30 may communicate with networked computing devices through external devices (e.g., the external device 18) and computer networks such as the Medtronic CareLink® network developed by Medtronic, Inc. of Dublin, Ireland. The communication circuit system 38 may include any combination of a Bluetooth® radio, an electronic oscillator, a frequency modulation circuit system, a frequency demodulation circuit system, an amplifier circuit system, and a power switch such as a metal oxide semiconductor field effect transistor (MOSFET), a bipolar junction transistor (BJT), an insulated gate bipolar transistor (IGBT), a junction field effect transistor (JFET), or another element for which a voltage is controlled. In instances where IMD 16 receives the first signal from external device 18 via tissue conduction communication, communication circuitry 38 may receive the first signal via one or more of electrodes 34. In some cases, signal receiving circuitry 37 may be separate from communication circuitry 38. In other cases, signal receiving circuitry 37 may be a component or part of communication circuitry 38.

[0065] Memory 40 may be configured to store information within IMD 16 during operation. Memory 40 may include a computer-readable storage medium or a computer-readable storage device. In some examples, memory 40 includes one or more of a short-term memory or a long-term memory. Memory 40 may include, for example, a random access memory (RAM), a dynamic random access memory (DRAM), a static random access memory (SRAM), a magnetic disk, an optical disk, a flash memory, or various forms of electrically programmable memory (EPROM) or electrically erasable programmable memory (EEPROM). In some examples, memory 40 is used to store data indicative of instructions executed by processing circuit system 30.

[0066] In some instances, memory 40 is configured to store one or more communication protocols 42. Each of communication protocols 42 may define a set of rules that govern one or more aspects of data exchange between IMD 16 and other devices (e.g., external device 18 and external device 20). In some instances, communication protocols 42 are stored as a list of computer-readable instructions, and the communication protocols may be executed by any combination of hardware (e.g., processing circuit system 30) and software. In some instances, communication protocols 42 include Bluetooth® protocols such as BTLE protocols. In some instances, communication protocols 42 exclusively include Bluetooth® protocols. Alternatively, in other instances, communication protocols 42 may include any combination of Bluetooth® protocols, protocols developed by the manufacturer of IMD 16, and protocols licensed from third-party developers.

[0067] In some examples, memory 40 is configured to store operating parameters 44. Operating parameters 44 may govern various aspects of the operation of IMD 16. For example, operating parameters 44 may include a combination of electrodes 34 and sensors 35 for sensing physiological signals of patient 4. Additionally or alternatively, operating parameters 44 may include a sampling rate for sampling analog signals sensed by electrodes 34 and sensors 35. Operating parameters 44 may be updated based on instructions received from an external device (e.g., external device 20) via communication circuitry 38. In some examples, processing circuitry 30 of IMD 16 updates operating parameters 44 only when an instruction to update operating parameters 44 is received via a secure link.

[0068] In some instances, memory 40 is configured to store collected data 45. Collected data 45 may include any data sensed, processed, or analyzed by IMD 16, wherein the data is acquired through any combination of electrodes 34, sensors 35, signal receiving circuitry 37, and communication circuitry 38. In some instances, collected data 45 includes cardiac EGM records, which are sensed by sensing circuitry 32 through electrodes 34 and processed by processing circuitry 30. Additionally or alternatively, collected data 45 may include data acquired by one or more chemical sensors of sensor 35, wherein the data indicates the presence or possibility of at least one cardiac condition (e.g., heart failure). Thus, typically, collected data 45 may represent physiological signals acquired from patient 4 over a period of time. In some instances, the period of time lasts for more than 12 hours and less than 72 hours. In other instances, the period of time lasts for up to one month. In other words, IMD 16 is configured to continuously monitor physiological signals over the period of time and store at least some of these physiological signals as collected data 45 in memory 40.

[0069] Collected data 45 may contain sensitive information. Therefore, it may be desirable to limit access to collected data 45 to patient 4 and clinicians responsible for the medical care of patient 4. For at least these reasons, if a portion of collected data 45 is transmitted from IMD 16 to another device (e.g., external device 18 or external device 20), processing circuit system 30 may transmit a portion of collected data 45 through a secure link (e.g., an encrypted link). In order to transmit data through a secure link, processing circuit system 30 may encode the data using one or more encryption keys in encryption keys 46 stored in memory 40. Similarly, processing circuit system may decode encrypted data received by IMD 16 from other devices using encryption keys 46. At least one encryption key in encryption keys 46 may include an Advanced Encryption Standard (AES) key defining a 128-bit integer. In some instances, in order to improve security measures, IMD 16 transmits collected data 45 only through an encrypted communication link. In addition, in some instances, encryption keys 46 include device keys in encrypted form and device keys in unencrypted form. The device key may refer to a key stored in memory 40 when IMD 16 is manufactured. The encrypted form of the device key may be encrypted using a public key of an ECIES security algorithm.

[0070] Another device (e.g., external device 18) may attempt to establish a secure link with IMD 16. For example, signal receiving circuitry 37 of IMD 16 may receive a first signal from external device 18. In some instances, the first signal causes processing circuitry 30 to trigger communication circuitry 38 to begin transmitting announcements. In other instances, the first signal causes processing circuitry 30 to increase the rate at which communication circuitry 38 transmits announcements. In instances where the first signal causes processing circuitry 30 to trigger communication circuitry 38 to begin transmitting announcements, communication circuitry 38 may be disconnected before signal receiving circuitry 37 receives the first signal. In instances where the first signal causes processing circuitry 30 to increase the announcement rate, communication circuitry 38 may transmit announcements at the first announcement rate before IMD 16 receives the first signal, and transmit announcements at a second announcement rate after IMD 16 receives the first signal, wherein the second announcement rate is greater than the first announcement rate. When transmitting announcements, communication circuitry 38 may be powered by power supply 48 during the transmission of each announcement. In addition, communication circuit system 38 may be powered on for a period of time after each advertisement in order to listen for responses to the corresponding advertisement. In this way, increasing the advertisement rate may result in an increase in the rate at which power is consumed from power supply 48.

[0071] Communication protocol 42 may include one or more protocols and may enable IMD 16 to communicate according to a Bluetooth® protocol, as an example. However, in some instances, the first signal is transmitted according to a communication protocol other than a Bluetooth® protocol, wherein the communication protocol is unknown to IMD 16 (e.g., the communication protocol is not included in communication protocol 42 stored in memory 40). Even if IMD 16 is unaware of the communication protocol of the first signal, signal receiving circuit system 37 may sense the first signal, for example, by detecting changes in an electromagnetic field associated with the first signal. In addition, processing circuit system 30 may process the first signal to determine one or more parameters of the first signal, such as a frequency component or a signal duration. Based on comparing the one or more parameters of the detected signal with one or more known parameters stored in memory 40, processing circuit system 30 may verify that the first signal was transmitted by a trusted device (e.g., external device 18).

[0072] IMD 16 may be configured to transmit a second signal to external device 18 according to one of communication protocols 42 via communication circuit system 38. In this manner, the second signal is transmitted from IMD 16 to external device 18 in response to receiving the first signal according to a communication protocol different from the communication protocol associated with the first signal received by IMD 16. The communication protocol of communication protocol 42 used to transmit the second signal may be a BTLE protocol operating in a normal power consumption mode. In some instances, the second signal includes a set of notifications transmitted by IMD 16 at a second notification rate, wherein the second notification rate is significantly higher than the first notification rate, wherein the communication circuit system 38 transmits the notifications before IMD 16 receives the first signal. In other instances, the communication circuit system 38 does not transmit notifications before IMD 16 receives the first signal, and the communication circuit system 38 transmits the second signal including a set of notifications at the second notification rate after IMD 16 receives the first signal.

[0073] In some examples, in response to transmitting the second signal, the IMD 16 may receive a first set of random data from the external device 18. In other examples, the IMD 16 receives the first set of random data from the external device 20 via the communication link 26. Subsequently, the IMD 16 may generate a second set of random data. The IMD 16 is configured to transmit the second set of random data, the unencrypted challenge, and the first encryption key to any combination of the external devices 18, 20 according to the low power mode of the second protocol. In some examples, the IMD 16 transmits the second set of random data, the unencrypted challenge, and the first encryption key, wherein the signal strength of the transmission is less than about 150 nW. Transmitting the second set of random data, the unencrypted challenge, and the first encryption key at less than about 150 nW may limit the transmission range to about 1 meter, thereby reducing the probability that the second set of random data, the unencrypted challenge, or the first encryption key may be intercepted by an untrusted device other than the external device 18 and the external device 20. In some examples, the first encryption key includes an encrypted form of the device key stored in the memory 40 as part of the encryption key 46. Using the first set of random data, the second set of random data, and the device key in unencrypted form, IMD 16 may generate a second encryption key. The second encryption key may be a 128-bit "session" key that enables IMD 16 to encrypt and decrypt data exchanged with external device 18 and / or external device 20. IMD 16 may store the second encryption key in memory 40 as part of encryption keys 46.

[0074] IMD 16 may receive an encrypted challenge from external device 18 or external device 20, and IMD 16 may decrypt the encrypted challenge using the second encryption key. To verify the challenge, IMD 16 may cross-reference the challenge received from external device 18 or external device 20 with the unencrypted challenge originally sent to external device 18. After verifying the challenge, IMD 16 is configured to transmit a verification signal and establish a secure link with external device 18 and / or external device 20.

[0075] The second encryption key may be set to expire after a certain period of time. In some instances, the IMD 16 starts a time window after establishing a secure link, wherein the time window is set to expire after a predetermined amount of time. When the time window expires, the IMD 16 terminates the secure link. After establishing a secure link between the IMD 16 and another device such as the external device 18 and / or the external device 20, the IMD 16 may send and receive data through the secure link. The IMD 16 may, for example, receive encrypted data indicating instructions from the external device 20. In this way, the processing circuit system 30 may use the encryption key 46 (e.g., the second encryption key) to decode the encrypted data and implement the instructions in the IMD 16. For example, the instruction may include a request for the IMD 16 to output at least some of the collected data 45. Additionally or alternatively, the instruction may cause the processing circuit system 30 to record patient data using a specific combination of electrodes 34 and sensors 35. The instruction may also include a request for the IMD 16 to output other information, such as the battery life of the power source 48 or the impedance value of the electrode 34.

[0076] Secure communications between IMD 16 and other devices may occur according to at least one of communication protocols 42. As such, other devices that communicate with IMD 16 may be configured simultaneously via at least one of communication protocols 42.

[0077] Power source 48 is configured to deliver operating power to the components of IMD 16. Power source 48 may include a battery and a power generation circuit for generating the operating power. In some examples, the battery is rechargeable to allow for extended operation. In some examples, recharging is achieved through proximal inductive interaction between an external charger and an inductive charging coil within external device 18. Power source 48 may include any one or more of a plurality of different battery types, such as nickel-cadmium batteries and lithium-ion batteries.

[0078] Figure 3 is a block diagram illustrating an example configuration of components of external device 18 in accordance with one or more techniques of this disclosure. Figure 3 In the example of , external device 18 includes processing circuitry 60, communication circuitry 62, memory 64, user interface 72, and power supply 74. Memory 64 is configured to store signal program 66, communication protocol 68, and encryption key 70.

[0079] In one example, processing circuit system 60 may include one or more processors configured to implement functions and / or processing instructions for execution within external device 18. For example, processing circuit system 60 may be capable of processing instructions stored in memory 64. Processing circuit system 60 may include, for example, a microprocessor, a DSP, an ASIC, an FPGA, or an equivalent discrete or integrated logic circuit system or a combination of any of the foregoing devices or circuit systems. Thus, processing circuit system 60 may include any suitable structure, whether in hardware, software, firmware, or any combination thereof, to perform the functions attributed to processing circuit system 60 herein.

[0080] Communication circuit system 62 may include any suitable hardware, firmware, software, or any combination thereof for communicating with another device, such as IMD 16 or external device 20. Under the control of processing circuit system 60, communication circuit system 62 may receive downlink telemetry from IMD 16, external device 20, or another device, and send uplink telemetry thereto. In addition, processing circuit system 30 may communicate with a computer network such as the Medtronic CareLink® network developed by Medtronic, Inc. of Dublin, Ireland. Communication circuit system 62 may include any combination of a Bluetooth® radio, an electronic oscillator, a frequency modulation circuit system, a frequency demodulation circuit system, an amplifier circuit system, and a power switch such as a MOSFET, a BJT, an IGBT, a JFET, or another element for which a voltage is controlled. Communication circuit system 62 may transmit and receive signals through, for example, an antenna for radio frequency communication and / or an electrode for tissue conduction communication.

[0081] Memory 64 may be configured to store information within external device 18 during operation. Memory 64 may include a computer-readable storage medium or a computer-readable storage device. In some instances, memory 64 includes one or more of short-term memory or long-term memory. Memory 64 may include, for example, RAM, DRAM, SRAM, a magnetic disk, an optical disk, flash memory, or various forms of EPROM or EEPROM. In some instances, memory 64 is used to store data indicating instructions executed by processing circuit system 60. Memory 64 may be used by software or applications running on external device 18 to temporarily store information during program execution.

[0082] In some examples, external device 18 is used to establish a secure connection with IMD 16. For example, example techniques of the present disclosure enable IMD 16 to transmit a signal to IMD 16 via communication circuit system 62. The signal may represent a wake-up signal for initiating establishment of a secure link. Processing circuit system 60 is configured to generate a signal based on signal program 66. In some examples, external device 18 transmits a signal in response to receiving an instruction from external device 20. In other examples, external device 18 transmits a signal to user interface 72 based on user input.

[0083] The memory 64 is configured to store a signal program 66. The signal program 66 may include a list of computer-readable instructions that cause the processing circuit system 60 to generate a signal, wherein the signal includes a plurality of main parts defining a first frequency value and a first duration and a plurality of secondary parts defining a second frequency value and a second duration. The processing circuit system 60 is configured to interleave the plurality of main parts and the plurality of secondary parts so that a main part appears between two consecutive secondary parts, and a secondary part appears between two consecutive main parts. However, the first frequency part and the last frequency part, whether it is a main part or a secondary part, are bounded by a frequency part. In some examples, the first frequency value is about 200 kilohertz (kHz), the second frequency value is about 150 kHz, and the first duration and the second duration are each about 80 microseconds (µs). However, these values ​​are not meant to be limiting. The first frequency value, the second frequency value, the first duration and the second duration may include any value or range of values. In this way, the external device 18 is configured to generate a first signal defined by an electromagnetic waveform that alternates between two frequency values.

[0084] Processing circuit system 60 may transmit the signal generated by external device 18 based on signal program 66 to IMD 16 via communication circuit system 62. Processing circuit system 60 may transmit the signal according to at least one communication protocol of communication protocols 68 stored in memory 64. In some examples, Figure 1 At least some of communication protocols 68 are not included in communication protocols 42 of external device 18. In other words, external device 18 may have access to at least one communication protocol that is not available to IMD 16. In some examples, processing circuitry 60 transmits the signal generated based on signal routine 66 to IMD 16 according to a communication protocol that is not available to IMD 16. In some examples, the protocol includes any communication protocol that uses magnetic induction communication, RF communication, or tissue conduction communication.

[0085] After transmitting the signal, external device 18 may receive a subsequent signal including a set of announcements from IMD 16, wherein the subsequent signal is received by external device 18 according to at least one of communication protocols 68. In some examples, the subsequent signal is received according to a BTLE protocol, and the power of the subsequent signal may be less than about 150 nW. In some examples, external device 18 relays the set of announcements to external device 20. Any combination of processing circuitry 60 of external device 18 and processing circuitry 80 of external device 20 is configured to generate a first set of random data and transmit the first set of random data to IMD 16 according to a communication protocol of communication protocol 68, wherein the communication protocol is simultaneously stored in memory 40 of IMD 16. In the example where external device 20 generates the first set of random data, external device 18 may relay the first set of random data from external device 20 to IMD 16.

[0086] After transmitting the first set of random data to the IMD 16, the external device 18 may receive a second set of random data, an unencrypted challenge, and an encrypted form of the first encryption key from the IMD 16. In some instances, the external device 18 further transmits the second set of random data, the unencrypted challenge, and the encrypted form of the first encryption key to the external device 20. In this way, any combination of the external devices 18, 20 may decrypt the first encryption key to obtain the unencrypted form of the first encryption key. In some instances, the external devices 18, 20 calculate the second encryption key based on the first set of random data, the second set of random data, and the unencrypted form of the first encryption key. In addition, the external devices 18, 20 may encrypt the challenge and transmit the encrypted challenge to the IMD 16. If the IMD 16 is able to verify the challenge, the external device 18 may receive a verification signal from the IMD 16 and establish a secure link with the IMD 16. After establishing the secure link, in one instance, the external device 18 is configured to relay data between the external device 20 and the IMD 16 using a secure connection.

[0087] A user such as a clinician or patient 4 can interact with the external device 18 through the user interface 72. The user interface 72 can include an input mechanism to receive input from the user. The input mechanism can include, for example, a button, a keypad (e.g., an alphanumeric keypad), a peripheral pointing device or a touch screen or another input mechanism that allows the user to browse the user interface presented by the processing circuit system 60 of the external device 18 and provide input. In one example, the user interface 72 includes a single button that enables the user to instruct the external device 18 to perform one or more actions. In other examples, the user interface 72 also includes an audio circuit system for receiving audio instructions.

[0088] The power supply 74 is configured to deliver operating power to the components of the external device 18. The power supply 74 may include a battery and a power generation circuit for generating operating power. In some instances, the battery is rechargeable to allow for extended operation. Recharging may be accomplished by electrically coupling the power supply 74 to a cradle or plug connected to an alternating current (AC) outlet. In addition, recharging may be accomplished by proximal inductive interaction between an external charger and an inductive charging coil within the external device 18. In other instances, conventional batteries (e.g., nickel-cadmium or lithium-ion batteries) may be used. In addition, the external device 18 may be directly coupled to an AC outlet for operation.

[0089] Figure 4 is a block diagram illustrating an example configuration of components of external device 20 according to one or more techniques of this disclosure. Figure 4 In the example of , external device 20 includes processing circuitry 80, communication circuitry 82, memory 84, user interface 92, and power supply 94. Memory 84 is configured to store communication protocol 86, encryption key 88, operating parameters 90, and retrieved data 91.

[0090] In one example, processing circuit system 80 may include one or more processors configured to implement functions and / or processing instructions for execution within external device 20. For example, processing circuit system 80 may be capable of processing instructions stored in memory 84. Processing circuit system 80 may include, for example, a microprocessor, a DSP, an ASIC, an FPGA, or an equivalent discrete or integrated logic circuit system or a combination of any of the foregoing devices or circuit systems. Thus, processing circuit system 80 may include any suitable structure, whether in hardware, software, firmware, or any combination thereof, to perform the functions attributed to processing circuit system 80 herein.

[0091] The communication circuit system 82 may include any suitable hardware, firmware, software, or any combination thereof for communicating with another device, such as the IMD 16 or the external device 18. Under the control of the processing circuit system 80, the communication circuit system 82 may receive downlink telemetry from the IMD 16, the external device 18, or another device, and send uplink telemetry thereto. In some instances, the communication circuit system 82 includes a first set of communication circuit systems configured to transmit and receive signals according to a communication protocol developed by the manufacturer of the IMD 16 or a third-party developer. In some such instances, the communication circuit system 82 further includes a second set of communication circuit systems that defines a Bluetooth® radio that is configured to transmit and receive signals according to the Bluetooth® communication protocol. However, the communication circuit system 82 need not include separate sets of circuit systems corresponding to different communication protocols. In some instances, the communication circuit system 82 includes a single set of circuit systems configured to transmit and receive signals according to multiple communication protocols.

[0092] In some instances, the communication circuit system 82 includes any combination of a Bluetooth® radio, an electronic oscillator, frequency modulation circuit system, frequency demodulation circuit system, amplifier circuit system, and a power switch such as a MOSFET, BJT, IGBT, JFET, or another element for which a voltage is controlled.

[0093] The memory 84 may be configured to store information within the external device 20 during operation. The memory 84 may include a computer-readable storage medium or a computer-readable storage device. In some instances, the memory 84 includes one or more of a short-term memory or a long-term memory. The memory 84 may include, for example, RAM, DRAM, SRAM, a magnetic disk, an optical disk, a flash memory, or various forms of EPROM or EEPROM. In some instances, the memory 84 is used to store data indicating instructions executed by the processing circuit system 80. The memory 84 may be used by software or applications running on the external device 20 to temporarily store information during program execution.

[0094] The external device 20 can exchange information with other devices according to one or more communication protocols 86 through the communication circuit system 82. The communication protocol 86 stored in the memory 84 can include multiple sets of computer-readable instructions that determine how data is transmitted and processed. The communication protocol 86 can include one or more communication protocols, which are additionally included in each of the communication protocol 42 and the communication protocol 68. In other words, the IMD 16, the external device 18 and the external device 20 can be configured to exchange information according to at least one commonly used communication protocol. In some instances, the one or more commonly used communication protocols include at least one Bluetooth® communication protocol. In addition or alternatively, the communication protocol 86 can include a set of communication protocols that are not available in at least one of the IMD 16 and the external device 18. In some instances, the external device 20 is a consumer electronic device, such as a smart phone, a tablet computer or a laptop computer. In some such instances, the external device 20 may not be configured with a communication protocol developed by the manufacturer of the IMD 16.

[0095] External device 20 may transmit data using a secure link. For example, external device 20 may use at least one of encryption keys 88 stored in memory 84 to encode data to be transmitted to another device via communication circuit system 82 or decode data received from another device via communication circuit system 82. To securely transmit data to another device (e.g., IMD 16), external device 20 may encode the data using an encryption key, wherein IMD 16 is configured to decode the data using another encryption key that is a counterpart to the encryption key used by external device 20. In the event that external device 20 does not have access to an encryption key that has a counterpart stored in IMD 16, external device 18 is configured to establish a secure link between IMD 16 and external device 20, wherein external device 18 acts as an intermediary between IMD 16 and external device 20.

[0096] In some examples, external device 20 uses processing circuit system 80 to calculate a "session" key, where the session key is associated with a corresponding session key stored in IMD 16. For example, external device 20 may calculate the session key using a first set of random data, a second set of random data, and a device key. In some cases, processing circuit system 80 may generate the first set of random data or receive the first set of random data from external device 18 via communication circuit system 82. In addition, processing circuit system 80 may receive the second set of random data and the device key from IMD 16 via external device 18. Processing circuit system 80 may store the session key in memory 84. After creating the session key, processing circuit system 80 is configured to encode data to be transmitted to IMD 16 using the session key. Likewise, processing circuit system 80 is configured to decode data received from IMD 16 that is encrypted using the corresponding session key stored by IMD 16. In other examples, the external device 20 is configured to encode data to be transmitted to the external device 18 using an encryption key in the encryption keys 88 having a corresponding key stored in the memory 64 of the external device 18 as part of the encryption keys 70. The external device 18 can then decode the data, encode the data again using the session key, and transmit the data to the IMD 16 having the corresponding session key. In examples where the external device 20 creates the session key and in examples where the external device 20 does not create the session key, the external device 18 is configured to securely relay data between the IMD 16 and the external device 20.

[0097] The data exchanged between external device 20 and IMD 16 may include any of operating parameters 90 stored in memory 84. External device 20 may transmit data including computer-readable instructions that, when implemented by IMD 16, may control IMD 16 to change one or more operating parameters and / or export collected data in accordance with operating parameters 90. For example, processing circuitry 80 may transmit instructions to IMD 16 requesting IMD 16 to export collected data (e.g., a portion of collected data 45) to external device 20. In turn, external device 20 may receive the collected data from IMD 16 and store the collected data in memory 84 (e.g., as retrieved data 91). Additionally or alternatively, processing circuitry 80 may export instructions to IMD 16 requesting IMD 16 to update an electrode combination used for stimulation or sensing in accordance with operating parameters 90.

[0098] A user, such as a clinician or patient 4, can interact with external device 20 through user interface 92. User interface 92 includes a display (not shown), such as an LCD or LED display or other type of screen, which processing circuit system 80 can use to present information related to IMD 16 (e.g., EGM signals obtained from at least one electrode or at least one electrode). In addition, user interface 92 can include an input mechanism to receive input from the user. The input mechanism can include, for example, buttons, a keypad (e.g., an alphanumeric keypad), a peripheral pointing device, or a touch screen, or another input mechanism that allows a user to browse a user interface presented by processing circuit system 80 of external device 20 and provide input. In other examples, user interface 92 also includes an audio circuit system for providing auditory notifications, instructions or other sounds to patient 4, receiving voice commands from patient 4, or both. Memory 84 can include instructions for operating user interface 92 and for managing power supply 94.

[0099] The power supply 94 is configured to deliver operating power to the components of the external device 20. The power supply 94 may include a battery and a power generation circuit for generating operating power. In some instances, the battery is rechargeable to allow for extended operation. Recharging may be accomplished by electrically coupling the power supply 94 to a cradle or plug connected to an alternating current (AC) outlet. In addition, recharging may be accomplished by proximal inductive interaction between an external charger and an inductive charging coil within the external device 20. In other instances, conventional batteries (e.g., nickel-cadmium or lithium-ion batteries) may be used. In addition, the external device 20 may be directly coupled to an AC outlet for operation.

[0100] Figure 5 is a flowchart illustrating example operations according to one or more techniques of the present disclosure. Figure 1-4 Example operations are described with respect to IMD 16, external device 18, and external device 20, and components thereof.

[0101] The external device 18 is configured to generate a first signal (502). For example, the processing circuit system 60 of the external device 18 can generate the first signal, wherein the processing circuit system 60 is electrically coupled to the communication circuit system 62 configured to wirelessly communicate according to the first protocol and the second protocol. In some examples, the external device 18 is configured to generate the first signal based on a signal program 66 stored in the memory 64 of the external device 18. In some examples, the first signal generated by the processing circuit system 60 includes a plurality of primary portions defining a first frequency value and a first duration and a plurality of secondary portions defining a second frequency value and a second duration. The processing circuit system 60 is configured to interleave the plurality of primary portions and the plurality of secondary portions so that one primary portion appears between two consecutive secondary portions and one secondary portion appears between two consecutive primary portions. However, the first frequency portion and the last frequency portion of the first signal, whether it is a primary portion or a secondary portion, are bounded by one frequency portion. In some examples, the first frequency value is about 200 kilohertz (kHz), the second frequency value is about 150 kHz, and the first duration and the second duration are each about 80 microseconds (µs). However, these values ​​are not meant to be limiting. The first frequency value, the second frequency value, the first duration, and the second duration may include any value or range of values. In this way, the external device 18 is configured to generate a first signal defined by an electromagnetic waveform that alternates between two frequency values.

[0102] After generating the first signal, external device 18 is configured to transmit the first signal to IMD 16 (504). In some instances, external device 18 transmits the first signal according to a first protocol included in communication protocol 68 stored in memory 64. In some instances, the first protocol includes any communication protocol using magnetic induction communication, RF communication, or tissue conduction communication. IMD 16 receives the first signal (506). Even if IMD 16 is not configured for the first protocol associated with the first signal in some instances, IMD 16 can be configured to detect the first signal by detecting electromagnetic field changes. Signal receiving circuit system 37 of IMD 16 can include circuit system capable of sensing such electromagnetic field changes caused by the first signal. In addition, processing circuit system 30 of IMD 16 is configured to identify one or more parameters of the first signal based on the electromagnetic field changes sensed by signal receiving circuit system 37. By comparing the one or more parameters of the first signal to one or more known parameters stored in memory 40 of IMD 16 , processing circuitry 30 is configured to verify that the first signal was transmitted by an authentic device (eg, external device 18 ).

[0103] In response to receiving the first signal and verifying that the first signal originates from the external device 18, the IMD 16 is configured to transmit a set of announcements via a second signal (508). In some instances, the IMD 16 is configured to transmit a second signal including the set of announcements according to a second protocol, the second protocol being stored in the memory 40 as part of the communication protocol 42. The second protocol may include a Bluetooth® protocol such as a BTLE protocol, which has a low power consumption mode and a normal power consumption mode. In some instances, the IMD 16 is configured to transmit the second signal according to the second protocol when the IMD 16 operates in the normal power consumption mode. In other instances, the IMD 16 is configured to transmit the second signal according to the second protocol when the IMD 16 operates in the low power consumption mode. In some instances, before transmitting the set of announcements via the second signal, the IMD 16 transmits the announcements at a first announcement rate. In addition, the IMD 16 may transmit the set of announcements at a second announcement rate via the second signal, wherein the second announcement rate is greater than the first announcement rate. In this manner, receiving the first signal may cause IMD 16 to increase the rate at which announcements are transmitted by IMD 16. However, in other examples, IMD 16 does not transmit any announcements prior to receiving the first signal, and IMD 16 initiates transmission of announcements after receiving the first signal.

[0104] The external devices 18, 20 are configured to receive at least one of the set of announcements in some instances according to a second protocol stored in the memory 64 (510). In response to receiving the set of announcements, any combination of the external devices 18, 20 are configured to generate a first set of random data (512) according to, in some instances, a second protocol and transmit the first set of random data (514) to the IMD 16. In instances where the external device 20 generates the first set of random data, the external device 18 may relay the first set of random data from the external device 20 to the IMD 16. In some instances, the external device 18 transmits the first set of random data to the IMD 16 in accordance with the second protocol while the external device 18 is operating in a low power consumption mode. In other instances, the external device 18 transmits the first set of random data to the IMD 16 in accordance with the second protocol while the external device 18 is operating in a normal power consumption mode.

[0105] After the IMD 16 receives the first set of random data (516), the IMD 16 generates a second set of random data (518). In one example, the first set of random data and the second set of random data are both 64-bit integers. Subsequently, the IMD 16 is configured to transmit the second set of random data, the challenge, and the first encryption key to the external device 18, 20 according to a second protocol (520). In some examples, the IMD 16 is configured to transmit the second set of random data, the challenge, and the first encryption key to the external device 18, 20 according to the second protocol when the IMD 16 is operating in a low power mode. For example, while operating in a low power mode, the IMD 16 may transmit the second set of random data, the challenge, and the first encryption key such that the transmission has a maximum signal strength of 150 nW, thereby limiting the transmission range to 1 meter. In some examples, the challenge is a 64-bit random integer and the first encryption key is a 113-byte "device" key. In some examples, both the encrypted version of the first encryption key and the unencrypted version of the first encryption key are stored in the memory 40 of the IMD 16 as part of the encryption key 46. In some examples, the encrypted form of the first encryption key can be encrypted using an elliptic curve integrated encryption scheme (ECIES). In some examples, to prevent the first encryption key from being intercepted or otherwise compromised, the IMD 16 transmits the encrypted version of the first encryption key to the external device 18, 20.

[0106] Based on the first set of random data, the second set of random data, and an unencrypted version of the first encryption key, IMD 16 is configured to calculate a second encryption key (522). In some examples, the second encryption key may define a "session" key.

[0107] The external device 18, 20 receives the second set of random data, the challenge, and the encrypted version of the first encryption key from the IMD 16 (524). In some examples, the external device 18 receives the second set of random data, the challenge, and the encrypted version of the first encryption key and relays the second set of random data, the challenge, and the encrypted version of the first encryption key to the external device 20. In other examples, the external device 18 receives the second set of random data, the challenge, and the encrypted version of the first encryption key and does not transmit the second set of random data, the challenge, and the encrypted version of the first encryption key to the external device 20. In other examples, the external device 20 receives the second set of random data, the challenge, and the encrypted version of the first encryption key directly from the IMD 16, thereby bypassing the external device 18.

[0108] Any combination of external devices 18, 20 uses, in some instances, the ECIES private key to decrypt the first encryption key (526) to obtain an unencrypted version of the first encryption key. After the external devices 18, 20 decrypt the first encryption key, any combination of external devices 18, 20 calculates a second encryption key (528) based on the first set of random data, the second set of random data, and the unencrypted version of the first encryption key. In this way, each of the IMD 16, the external device 18, and the external device 20 is configured to independently calculate the second encryption key based on the same data segment. Such a method of independently calculating the second encryption key can be beneficial because the second encryption key does not need to be exchanged between any of the IMD 16, the external device 18, and the external device 20, thereby reducing the possibility that the second encryption key will be compromised.

[0109] As discussed above, the IMD 16 is configured to transmit a 64-bit challenge external device 18, 20. In some cases, the challenge is not encrypted when it is transmitted from the IMD 16 to the external device 18, 20. The external device 18, the external device 20, or any combination thereof, is configured to encrypt the challenge using a second encryption key (530) and transmit the challenge back to the IMD 16 in an encrypted form (532). The external device 18, 20 may transmit the challenge to the IMD 16 according to a second protocol. In some instances, the external device 18 transmits the challenge to the IMD 16 according to the second protocol while the external device 18 is operating in a normal power consumption mode. In other instances, the external device 18 transmits the challenge to the IMD 16 according to the second protocol while the external device 18 is operating in a low power consumption mode. The IMD 16 receives the challenge (534) and decrypts the challenge using the second encryption key (536). After decrypting the challenge, IMD 16 verifies the challenge by cross-referencing the decrypted challenge with the challenge originally transmitted to external device 18, 20 (538). IMD 16 continues to transmit the verification signal and establishes a secure link with external device 18, 20 (540). In some instances, IMD 16 transmits the verification according to the second protocol while IMD 16 operates in a normal power consumption mode. In other instances, IMD 16 transmits the verification according to the second protocol while IMD 16 operates in a low power consumption mode. External device 18, 20 receives the verification signal and establishes a secure link with IMD 16 (542). In some instances, external device 18 generates a session key and relays data between IMD 16 and external device 20, thereby acting as an intermediary device. In other instances, external device 20 generates a "session" key (e.g., a second encryption key) to enable external device 20 to enter the secure link established by external device 18 and exchange data indirectly with IMD 16. In some examples, external device 20 transmits the session key to external device 18 , thereby allowing external device 18 to communicate with IMD 16 independently.

[0110] In some examples, any combination of IMD 16, external device 18, and external device 20 exchange data according to a second protocol while communicating over the secure link, wherein IMD 16, external device 18, and external device 20 operate in a normal power consumption mode of the second protocol. In some examples, the power magnitude of the signals transmitted by the devices operating in the normal power consumption mode is one hundred times greater than the power magnitude of the signals transmitted by the devices operating in the low power consumption mode.

[0111] Any one or more of IMD 16, external device 18, and external device 20 are configured to issue an instruction to terminate the secure link at any time. For example, IMD 16 may issue an instruction to invalidate an encryption key corresponding to the secure link. In addition, IMD 16, external device 18, or external device 20 may set a time window associated with an encryption key corresponding to the secure link. If the time window reaches a predetermined expiration time, the secure link may be terminated.

[0112] The techniques described in the present disclosure may be implemented at least in part in hardware, software, firmware, or any combination thereof. For example, various aspects of these techniques may be implemented in one or more processors, DSPs, ASICs, FPGAs, or any other equivalent integrated or discrete logic QRS circuit systems, and any combination of such components, which are embodied in external devices (such as physician or patient programmers, simulators, or other devices). The terms "processor" and "processing circuit system" may generally refer to any of the aforementioned logic circuit systems, either alone or in combination with other logic circuit systems, or any other equivalent circuit system, either alone or in combination with other digital or analog circuit systems.

[0113] For various aspects implemented in software, at least some of the functionality attributed to the systems and devices described in this disclosure may be embodied as instructions on a computer-readable storage medium, such as RAM, DRAM, SRAM, magnetic disk, optical disk, flash memory, or various forms of EPROM or EEPROM. The instructions may be executed to support one or more aspects of the functionality described in this disclosure.

[0114] In addition, in some aspects, the functions described herein may be arranged in dedicated hardware and / or software modules. Depicting different features as modules or units is intended to highlight different functional aspects, and does not necessarily imply that such modules or units must be implemented by separate hardware or software components. On the contrary, the functions associated with one or more modules or units may be performed by separate hardware or software components, or integrated in shared or separate hardware or software components. Moreover, the technology may be implemented entirely in one or more circuits or logic elements. The technology disclosed herein may be implemented in a variety of devices or equipment (including an IMD, an external programmer, a combination of an IMD and an external programmer, an integrated circuit (IC) or a group of ICs, and / or a discrete circuit system located in an IMD and / or an external programmer).

[0115] Example 1. A method comprising receiving a first signal according to at least a first communication protocol through a signal receiving circuit system of a first device configured to receive communications transmitted according to the first communication protocol; transmitting a second signal according to a second communication protocol through the communication circuit system in response to receiving the first signal; and establishing a secure link according to the second communication protocol, wherein establishing the secure link includes transmitting at least one signal at a first power value, and wherein the communications transmitted through the secure link are at a second power value greater than the first power value.

[0116] Example 2. The method of example 1, wherein the first device is not configured to communicate according to the first communication protocol.

[0117] Example 3. The method of any of examples 1 or 2, wherein the first power magnitude is less than about 150 nanowatts (nW).

[0118] Example 4. A method according to any one of Examples 1 to 3, wherein the method further includes receiving a first set of random data in response to transmitting the second signal including a set of notifications; generating a second set of random data; transmitting the second set of random data, a challenge, and a first encryption key, wherein the first encryption key is encrypted and wherein the challenge is unencrypted; calculating a second encryption key based on the first set of random data, the second set of random data, and the first encryption key; receiving the challenge, wherein the challenge is encrypted; decrypting the challenge using the second encryption key; verifying the challenge by comparing the decrypted challenge with the transmitted challenge; and transmitting a verification signal confirming that the challenge has been verified.

[0119] Example 5. The method of example 4, wherein calculating the second encryption key comprises calculating an Advanced Encryption Standard (AES) key, and wherein the AES key defines a size of 128 bits.

[0120] Example 6. A method according to any one of Examples 4 or 5, wherein in response to receiving the first signal, the method further includes transmitting the second signal including the set of notifications for a period of time, the period of time lasting up to a time limit of 30 seconds.

[0121] Example 7. A method according to any one of Examples 1 to 6, wherein the first signal is from a second device, wherein the second signal is sent to the second device, and wherein establishing the secure link includes establishing a secure link including the first device and at least one of the second device or a third device.

[0122] Example 8. A method according to any one of Examples 1 to 7, wherein the first signal includes a plurality of main parts, wherein each of the plurality of main parts defines a first frequency value and a first duration; and a plurality of secondary parts, wherein each of the plurality of secondary parts defines a second frequency value and a second duration, wherein the plurality of main parts and the plurality of secondary parts are interleaved so that one main part appears between two consecutive secondary parts and one secondary part appears between two consecutive main parts, and wherein the method further includes, in response to receiving the first signal, authenticating the first signal by matching at least one of the first frequency value, the second frequency value, the first duration and the second duration with a known value stored by the first device.

[0123] Example 9. The method of any one of examples 1 to 8, wherein the first signal transmitted according to the first communication protocol comprises a transmission range of less than about 20 centimeters (cm).

Claims

1. A first device, comprising: signal receiving circuitry configured to receive communications transmitted in accordance with at least a first communications protocol; communications circuitry configured to communicate wirelessly according to at least a second communications protocol; and processing circuitry electrically coupled to the signal receiving circuitry and the communication circuitry, wherein the processing circuitry is configured to: At a first moment, receiving, by the signal receiving circuit system, a first signal according to the first communication protocol from one or more second devices; at a second time instant, based on receiving the first signal, transmitting, by the communication circuit system, a set of information including a challenge and an encryption key to the one or more second devices at a first power level according to the second communication protocol, wherein the encryption key is a device key that is encrypted and transmitted together with the challenge, wherein the challenge is not encrypted, and wherein the second time instant occurs after the first time instant; receiving, at a third time, the challenge through the communication circuit system according to the second communication protocol based on the transmission of the set of information including the challenge and the encryption key, wherein the challenge is encrypted, wherein the third time occurs after the second time, decrypting the challenge; verifying the challenge by comparing the decrypted challenge to the transmitted challenge; and Based on verifying the challenge, a secure link is established between the first apparatus and the one or more second devices by the communication circuit system according to the second communication protocol at a second power amount, wherein the first power amount is less than the second power amount.

2. The first device according to claim 1, wherein: The first device is configured to detect a first signal according to the first communication protocol by detecting a change in an electromagnetic field.

3. The first device according to claim 1 or 2, wherein the first power magnitude is less than 150 nanowatts.

4. The first device according to claim 1 or 2, wherein the first communication protocol comprises at least one of the following: a magnetic induction communication protocol, a radio frequency (RF) communication protocol, or a tissue conduction communication (TCC) protocol.

5. A first device according to claim 1 or 2, wherein the second communication protocol comprises a Bluetooth® Low Energy (BTLE) protocol having a low power consumption mode and a normal power consumption mode, wherein in order to establish the secure link, the processing circuit system is configured to transmit at least one signal according to the second communication protocol operating in the low power consumption mode, and wherein the processing circuit system is configured to transmit communication over the secure link according to the second communication protocol operating in the normal power consumption mode.

6. The first device according to claim 1, characterized in that The encryption key is a first encryption key, and the processing circuitry is further configured to: in response to receiving the first signal at the first time instant, transmit, by the communication circuitry at a fourth time instant, a second signal including a set of announcements according to the second communication protocol, wherein the fourth time instant occurs between the first time instant and the second time instant; In response to transmitting the second signal including the set of notifications, receiving a first set of random data from the one or more second devices according to the second communication protocol at a fifth time, the fifth time occurring between the fourth time and the second time; Generate a second set of random data; At the second time, transmitting the second set of random data to the one or more second devices at the first power value along with the challenge and the first encryption key; Calculating a second encryption key based on the first set of random data, the second set of random data, and the first encryption key; as well as decrypting the challenge using the second encryption key; Wherein, in order to establish the secure link, the processing circuit system is configured to transmit a verification signal to the one or more second devices, wherein the verification signal confirms that the challenge has been verified.

7. The first device according to claim 6, wherein: The second encryption key comprises an Advanced Encryption Standard (AES) key, and wherein the second encryption key defines a size of 128 bits.

8. The first device of claim 6 or 7, wherein in response to receiving the first signal, the first device is configured to transmit the second signal including the set of announcements for a period of time, the period of time lasting up to a time limit of 30 seconds.

9. The first device of claim 6 or 7, wherein the first signal is from a second device, wherein the second signal is sent to the second device, and wherein the secure link comprises a secure link between the first device and at least one of the second device or a third device.

10. A first device according to claim 6, wherein the first signal includes a wake-up signal of the first device according to the first communication protocol, and wherein based on receiving the first signal, the processing circuit system is configured to change the second communication circuit system from a first energy consumption mode to a second energy consumption mode, wherein the energy consumption of the second energy consumption mode is higher than that of the first energy consumption mode.

11. The first device according to claim 10, wherein: To transition the communication circuitry from the first energy consumption mode to the second energy consumption mode, the processing circuitry is configured to increase a rate at which the first device transmits advertisements from a first advertisement rate to a second advertisement rate.

12. The first device according to claim 11, wherein: The first notification rate is greater than twenty notifications per hour and less than sixty notifications per hour, and wherein the second notification rate is greater than one notification per second.

13. The first apparatus of claim 11 or 12, wherein the first advertisement rate is zero advertisements per second, and wherein the second advertisement rate is greater than one advertisement per second.

14. The first device according to claim 1, wherein the first signal comprises: a plurality of main sections, wherein each main section of the plurality of main sections defines a first frequency value and a first duration; as well as a plurality of minor portions, wherein each of the plurality of minor portions defines a second frequency value and a second duration, wherein the plurality of major portions and the plurality of minor portions are interleaved such that one major portion occurs between two consecutive minor portions and one minor portion occurs between two consecutive major portions, and wherein the processing circuitry is further configured to: The first signal is authenticated in response to receiving the first signal by matching at least one of the first frequency value, the second frequency value, the first duration, and the second duration to a known value stored by the first device.

15. The first device of any one of claims 1, 6, and 14, wherein the signal transmitted according to the first communication protocol comprises a transmission range of less than 20 centimeters.

16. The first device according to any one of claims 1, 6 and 14, wherein the first power magnitude is greater than -50 decibel milliwatts and less than -10 decibel milliwatts, and wherein the second power magnitude is 0 decibel milliwatts.

17. The first device according to any one of claims 1, 6 and 14, wherein the first device comprises an implantable medical device (IMD).

18. The first device of claim 1, wherein at least one of the first device and the one or more second devices comprises an implantable medical device configured for implantation in a patient, and at least another of the first device and the one or more second devices comprises an external device.

19. The first device of claim 1, wherein the first communication protocol is unknown to the first device and the first device is not configured to communicate according to the first communication protocol.

20. A system for establishing a secure link, comprising: A first device according to any one of claims 1 to 19; as well as A second device, the second device comprising: a second communications circuitry configured to communicate wirelessly according to a first communications protocol having a first range and a second communications protocol having a second range, the second communications protocol being different than the first communications protocol and the second range being greater than the first range; and a second processing circuitry electrically coupled to the second communication circuitry, wherein the second processing circuitry is configured to: transmitting the first signal to the first device according to the first communication protocol via the second communication circuit system; receiving, by the second communication circuitry, a signal including a set of announcements from the first device according to the second communication protocol in response to transmitting the first signal; and In response to receiving the signal including the set of notifications, establishing a secure link according to the second communication protocol, wherein the secure link includes the first device and at least one of the second device and a third device, wherein to establish the secure link, the second processing circuit system is configured to receive at least one signal at a first power value, and wherein communications transmitted over the secure link are at a second power value greater than the first power value.

Images