Method, system, and computer-readable medium for authenticating a computing system using metadata signatures

Abstract

Computer code embedded in an electronic component (e.g., processor, sensor, etc.) of a medical device such as a dialysis machine can be authenticated by comparing a metadata signature derived from the computer code of the electronic component with a key derived from a pre-authentication code associated with the electronic component. The metadata signature can be derived by running an error checking / error correction algorithm (e.g., SHA256) on the computer code of the electronic component. The use of the metadata signature enables detection of any unauthorized changes to the computer code compared to the pre-authentication code.

Description

Technical Field

[0001] The present invention relates to authentication of electronic components of computing systems, such as computing systems of medical devices. Background Art

[0002] Data security is critical in computing systems. This is especially true for medical devices such as dialysis machines, including peritoneal dialysis machines and hemodialysis machines. Official agencies such as the U.S. Food and Drug Administration (FDA) require a high level of cybersecurity for medical and drug delivery devices. Unauthorized manipulation of the code of such medical devices may seriously compromise the data security of these devices. Summary of the invention

[0003] Embodiments of the present disclosure include computer-implemented methods for verifying and authenticating a computer system including multiple programmable subsystems (e.g., PCBs) and / or electronic components (e.g., processors, sensors, FPGAs, etc.). For example, embodiments provide techniques for verifying and authenticating computer code of a multi-processor dialysis machine.

[0004] In some embodiments, the computer-implemented method includes: requesting, by a security authentication engine (SAE) of a computing system and from an electronic component of the computing system, a metadata signature specific to the electronic component, receiving, by the SAE, the metadata signature from the electronic component, encrypting, by the SAE, the metadata signature to generate first encrypted metadata, and determining, by the SAE, that the first encrypted metadata substantially matches a first key associated with the electronic component and stored in the SAE, and in response, providing, by the SAE, the first key to the electronic component as an authentication key for use by the electronic device when communicating with other electronic components of the computing system. The metadata signature is derived from an error checking / error correction code paired with computer code embedded in the electronic component.

[0005] The first key may be stored in a lookup table. The lookup table includes a plurality of keys; each key in the plurality of keys is respectively associated with a corresponding electronic component of the computing system.

[0006] The first key may be part of a key pair associated with the electronic component. The key pair includes a second key. The SAE may request the metadata signature by sending a message including the second key to the electronic component. In some embodiments, the metadata signature is generated by decrypting the second key based on computer code embedded in the electronic component.

[0007] The computing system may include a plurality of subsystems, and the electronic component resides on a first subsystem of the plurality of subsystems. The SAE may request the metadata signature in response to determining that the first subsystem is a valid subsystem of the computing system.

[0008] In some embodiments, determining that the first subsystem is a valid system includes: receiving, by the SAE and from the electronic component, first identification data of the first subsystem, encrypting, by the SAE, the identification data to generate first encrypted identification data, and determining, by the SAE, that the first encrypted identification data is listed in a lookup table stored on the SAE. The lookup table includes a plurality of encrypted identifications associated with the plurality of subsystems.

[0009] The metadata signature may be a checksum obtained by running an error checking / error correction code on computer code embedded in the electronic component.

[0010] In some implementations, the first key is removed from the electronic component when the computing system is shut down or restarted.

[0011] The computing system may be (or may be a part of) a peritoneal dialysis machine or a hemodialysis machine.

[0012] In some embodiments, the computer-implemented method further comprises: determining, by the SAE, that the first encrypted metadata does not substantially match any key stored in a lookup table, and in response communicating with a central security system to verify whether an authorized change has been made to the computer code of the electronic component. The method may also include: receiving a message from the central security system confirming that an authorized change has been made to the computer code, and storing a new key in the lookup table for the electronic component. The new key may be generated based on the metadata signature.

[0013] The present disclosure also provides one or more non-transitory computer-readable storage media coupled to one or more processors and storing instructions, which, when executed by the one or more processors, cause the one or more processors to perform operations according to embodiments of the methods provided herein.

[0014] The present disclosure also provides a system for implementing the method provided herein. The system includes one or more processors, and a computer-readable storage medium coupled to the one or more processors, the computer-readable storage medium having instructions stored thereon, and when the instructions are executed by the one or more processors, the instructions cause the one or more processors to perform operations according to the implementation of the method provided herein.

[0015] Embodiments of the present disclosure provide one or more of the following technical advantages and / or technical improvements over previously available solutions. First, these embodiments provide a fast authentication technique. Metadata signatures generated based on computer code are much smaller than the code itself. For example, a metadata signature for 1 megabyte of code may only have a few bits. Such a small size makes the authentication process faster because instead of reviewing the entire code, only the metadata signature, which is much smaller than the code, is reviewed and processed.

[0016] Second, the present technology provides traceable keys. In contrast to conventional public-private key authentication techniques, the present technology provides component-specific keys and subsystem-specific keys. Each electronic component in the present disclosure is associated with a component-specific key, and each subsystem is associated with a subsystem-specific key. Using conventional public-private keys for each component would make the authentication process very slow and inefficient.

[0017] Third, the present technology eliminates the need to integrate authentication keys into each electronic component. Instead, the keys are stored in a lookup table at the Secure Authentication Engine (SAE) and do not take up any space in the electronic component.

[0018] Fourth, the key may be updated upon determining that a valid change has been made to the corresponding electronic component.

[0019] Fifth, when the system is turned on, each electronic component must receive an authentication key for its communication with other components of the computing system. SAE uses one-to-one communication with each electronic component to receive the metadata signature of the electronic component and provide an authentication key specific to the electronic component. The electronic component needs an authentication key to communicate with other electronic components of the system. When the system is shut down or restarted, the electronic component loses its authentication key. This feature allows detection of any unauthorized code operations that may occur between consecutive boots of the system.

[0020] The method according to the present disclosure may include any combination of aspects and features described herein. That is, the method according to the present disclosure is not limited to the combination of aspects and features specifically described herein, but also includes any combination of aspects and features provided.

[0021] The details of one or more implementations of the disclosure are set forth in the accompanying drawings and the description below. Other features and advantages of the disclosure will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1A and Figure 1B An example computing system is depicted in accordance with an implementation of the present disclosure.

[0023] Figure 1C Shows Figure 1A-1B Communications between an example host platform and an example security authentication engine (SAE) of a computing system depicted in FIG.

[0024] Figure 2A Depicted as a Figure 1A-1B An example of a computing system depicted in a medical device is a peritoneal dialysis (PD) system.

[0025] Figure 2B Depicted as an application Figure 1A-1B An example of a computing system depicted in a medical device is a hemodialysis (HD) system.

[0026] Figure 3A An example process for authenticating a subsystem of a computing system according to an embodiment of the present disclosure is depicted.

[0027] Figure 3B An example process for authenticating electronic components of a subsystem according to an embodiment of the present disclosure is depicted.

[0028] Figure 3C An example process for verifying and authenticating a computing system according to an implementation of the present disclosure is depicted.

[0029] Figure 4 is a block diagram of an example computing system according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] Like reference numerals in the various drawings represent like elements.

[0031] Computer code embedded in an electronic component (e.g., processor, sensor, etc.) of a medical device, such as a dialysis machine, can be authenticated by comparing a metadata signature derived from the computer code of the electronic component with a key derived from a pre-authentication code associated with the electronic component. The metadata signature can be derived by running an error checking / error correction algorithm (e.g., SHA256) on the computer code of the electronic component. The use of the metadata signature enables the detection of any unauthorized changes to the computer code compared to the pre-authenticated code.

[0032] A dialysis machine that may be used in conjunction with the treatment of kidney disease may include one or more subsystems (e.g., PCBs), each of which includes one or more electronic components (e.g., processors, sensors, etc.). The authentication process is performed by a security authentication engine (SAE) that may reside on the dialysis machine. Upon startup of the dialysis machine, the SAE performs a series of processes to (i) verify the subsystems of the machine, and (ii) authenticate computer code embedded in the electronic components of each subsystem.

[0033] Figure 1AAn example computing system 100 is depicted in accordance with an implementation of the present disclosure. Figure 2A depicts a peritoneal dialysis system 200, Figure 2B A hemodialysis system 250 is depicted as an example medical device for implementing the system 100. The peritoneal dialysis system 200 and the hemodialysis system 250 are described in detail below.

[0034] Although the present technology is described with reference to dialysis machines, including peritoneal dialysis machines and hemodialysis machines, the disclosed authentication process may be used to authenticate any other form of computing system, including computing systems used in conjunction with other types of medical devices.

[0035] Figure 1A The system 100 depicted in FIG. 1 includes a plurality of subsystems A, B, and C. One example of a subsystem is a printed circuit board (PCB).

[0036] Each subsystem includes corresponding electronic components. Subsystem A has electronic components A.1, A.2, A.3, ..., An, subsystem B has electronic components B.1, B.2, B.3, ..., Bm, and subsystem C has electronic components C.1, C.2, C.3, ..., CK. Examples of electronic components include, but are not limited to, sensors, microprocessors, programmable devices, and CPLD or FPGA devices. Each of the electronic components may include computer code ("code").

[0037] Figure 1A Also depicted is a security authentication engine (SAE) 102. Although the SAE 102 is shown as Figure 1A SAE 102 may be part of system 100, but in some embodiments it may be external to system 100 and in communication with system 100 or its electronic components. SAE 102 may be a field programmable gate array (FPGA).

[0038] Figure 1B The SAE 102 is depicted including a lookup table 104 and an authentication rule enforcer / checker 106. The lookup table may be stored on the SAE 102 or on a memory in communication with the SAE 102. The lookup table 104 includes one KEY for each subsystem (e.g., KEY.A for subsystem A), and one key pair for each electronic component (e.g., key pair "key.Ai; key.Ai1" for electronic component Ai in subsystem A).

[0039] As described above, SAE 102 is responsible for (i) verifying each of subsystems A, B, and C, and (ii) authenticating computer code embedded in the corresponding electronic components of those subsystems (eg, subsystems A.1, B.1, C.1). Figure 3AAn example process 300 for authenticating a subsystem of a computing system is depicted in accordance with an embodiment of the present disclosure. Figure 3B An example process 310 for authenticating components of a subsystem is depicted in accordance with an embodiment of the present disclosure. Figure 3A and Figure 3B The processes 300 and 310 are performed by the SAE 102 and are explained in more detail below.

[0040] For simplicity, the verification and authentication process is described below for subsystem A and electronic component A.1 of system 100. Similar processes can be applied to the verification of other subsystems B, C, and to authenticating their corresponding electronic components.

[0041] Verification Subsystem

[0042] Upon startup of the system 100, the SAE 102 requests identification data for each of the subsystems. The identification data for a subsystem may be a part number (eg, a PCB part number) or any other reference number specific to that subsystem.

[0043] The SAE 102 requests identification data for a subsystem by sending a message to one of the subsystem's electronic components. Figure 1B , the SAE 102 requests identification data of subsystem A from electronic component A.1. Electronic component A.1 may be predefined as an active component of subsystem A, or may be a random component used to authenticate subsystem A. Thus, the SAE 102 may send its request to electronic component A.1 or any other electronic component A.2, A.3, ..., An of subsystem A.

[0044] Electronic component A.1 responds by sending identification data of subsystem A to SAE 102. Upon receipt of such identification data ( Figure 3A 302 in the example above), SAE 102 encrypts the identification data to generate encrypted identification data (304). SAE 102 then searches for a KEY in lookup table 104 that matches or substantially matches the encrypted identification data of subsystem A. For example, the term “substantially matches” as used herein means that the number of characters or digits that differ between the encrypted identification data and the KEY is less than a predetermined threshold number.

[0045] If SAE 102 finds such a (substantially) matching KEY (306), SAE 102 determines that subsystem A is a valid part of system 100 (308). However, if no such KEY is found in the lookup table, SAE 102 determines that subsystem A is not a valid part of system 100 and may place system 100 in a hold state. SAE 102 may then provide an error message, such as: "Suspected programming data integrity failure."

[0046] Lookup table 104 stores a set of KEYs. Each KEY in the set of KEYs is respectively associated with a corresponding subsystem of system 100. In some embodiments, the KEYs are encrypted forms of identification data of the subsystems. For example, KEY.A can be an encrypted form of a PCB part number of subsystem A. As explained in more detail below, these KEYs are provided to SAE 102 by a master rapid design and test platform ("master platform") 108, for example, during the manufacture of system 100.

[0047] In some embodiments, to request identification data from subsystem A, the SAE 102 sends KEY.A together with a decryption algorithm to subsystem A. Subsystem A uses its identification information (e.g., its PCB part number) to decrypt KEY.A and returns the decrypted KEY.A (as its identification data) to the SAE 102. The SAE 102 then encrypts the decrypted KEY.A received from subsystem A to generate KEY.A' and checks the lookup table 104 for a (substantially) matching KEY. If subsystem A has decrypted KEY.A using valid identification information, KEY.A' (substantially) matches KEY.A and subsystem A will be authenticated.

[0048] Once the SAE 102 determines that subsystem A is a valid part of the system 100 , the SAE 102 begins authenticating subsystem A's electronic components A.1 , A.2 , . . . , An.

[0049] Certified Electronic Components

[0050] The SAE 102 checks the authenticity of the electronic components of the subsystem by checking the computer code of each of the electronic components.

[0051] To authenticate the code of the electronic component, SAE 102 requests identification information associated with the electronic code. For example, SAE 102 requests a metadata signature ( Figure 3B 1. In response, electronic component A.1 sends metadata signature A.1.1 associated with electronic component A.1. SAE 102 receives (314) metadata signature A.1.1 and encrypts it to generate encrypted metadata en.A.1.1 (316). SAE 102 searches for a key in lookup table 104 that matches or substantially matches the encrypted metadata en.A.1.1 (318). For example, the term "substantially matches" as used herein means that the number of characters or bits that differ between the encrypted metadata signature en.A.1.1 and the key (e.g., key.A.1.1) is less than a predetermined threshold number.

[0052] If the SAE 102 finds such a key, the SAE 102 concludes that the code of the electronic component is authentic (322). However, if the SAE 102 does not find such a key, the SAE 102 sends the metadata signature and / or identification information of the electronic component to the host platform 108 (320). The host platform 108 checks the metadata signature A.1.1 to determine whether authorized changes have been made to the computer code of the electronic component.

[0053] Typically, the metadata signature A.1.1 is derived from the computer code (or metadata) of the electronic component A.1. The metadata signature A.1.1 may be derived from an error checking / error correction code that is paired with (or applied to) the computer code of the electronic component A.1. For example, the metadata signature A.1.1 may be a Fletcher checksum, an Adler checksum, an XOR checksum, an inverse checksum, a complement checksum, a cyclic redundancy check, or any other checksum derived from an error checking / error correction algorithm. SHA256 is an example error checking / error correction algorithm that may be used to derive a metadata signature according to the present disclosure.

[0054] Lookup table 104 includes one or more authentication key pairs. Each authentication key pair is associated with a corresponding electronic component in system 100. For example, Figure 1B The key pair “key.A.1; key.A.1.1” in is associated with electronic component A.1 of subsystem A.

[0055] In some embodiments, the SAE 102 uses a key pair associated with an electronic component to request a metadata signature from the electronic component. For example, the SAE 102 sends key.A.1 associated with electronic component A.1 to request a metadata signature from electronic component A.1. Electronic component A.1 uses its metadata to decrypt key.A.1 and obtain metadata signature A.1.1. The metadata may be a code embedded in electronic component A.1. The code may be internal to a microprocessor, FPGA, etc. of electronic component A.1, or may be programmed into an EEPROM or flash memory of electronic component A.1.

[0056] Then, electronic component A.1 sends metadata signature A.1.1 to SAE 102. SAE 102 encrypts metadata signature A.1.1 received from electronic component A.1 to generate encrypted metadata en.A.1.1. SAE 102 compares encrypted metadata en.A.1.1 with key.A.1.1 paired with key.A.1 in lookup table 104. If encrypted metadata en.A.1.1 (substantially) matches key.A.1.1, SAE 102 deems metadata that has been used by electronic component A.1 to decrypt key.A.1 to be authentic. Therefore, SAE 102 deems (the code in) electronic component A.1 to be authentic.

[0057] In response to determining that electronic component A.1 is authentic, SAE 102 sends key.A.1.1 to electronic component A.1 (324). Electronic component A.1 uses key.A.1.1 as an authentication key for communications with other components of system 100 (including SAE 102) during operation of the system.

[0058] When the system 100 is shut down, the electronic component A.1 loses the key.A.1.1. The electronic component A.1 will need to go through another authentication process to receive the key.A.1.1 again when the system 100 is restarted.

[0059] Main Platform

[0060] In response to determining that the encrypted metadata en.A.1.1 does not match any authentication key in the lookup table 104, the SAE 102 sends the metadata signature A.1.1 to a central security system, such as the master platform 108, to determine whether an authorized change has been made to the computer code of the electronic component A.1. The SAE 102 may also place the system 100 in a hold state and / or may provide a warning message, such as: "Suspected Programming Data Integrity Failure", until the SAE 102 receives a response from the master platform 108. Such a message may be displayed on a screen of the system 100 (e.g., at Figure 2A and Figure 2B on screens 218 and 268).

[0061] The SAE 102 communicates with the host platform 108 through an authentication rule executor / checker ("rule checker") 106. For example, the SAE 102 encodes a message with the suspicious metadata signature A.1.1 and / or the identification of the electronic component A.1 and sends the message to the host platform through the rule checker 106. For more secure communication, the SAE or the rule checker may encrypt the message.

[0062] The master platform 108 decrypts and decodes the message and performs a deep analysis of the metadata signature A.1.1 to re-authenticate the electronic component A.1 or to determine that an unauthorized change has been made to the code of the electronic component A.1. For example, the master platform 108 may compare the metadata signature A.1.1 with data stored on a master lookup table. The master lookup table may record changes, such as updates, to the computer code of the electronic component of any system (e.g., system 100) in the network of the master platform 108.

[0063] In response to determining that metadata signature A.1.1 complies with the changes recorded in the master lookup table, master platform 108 re-authenticates electronic component A.1 by sending the new metadata signature newA.1.1 to rule checker 106 of SAE 102. SAE 102 then updates its lookup table, for example, by encrypting the new metadata signature newA.1.1 to obtain key.newA.1.1 and by replacing key.A.1.1 with key.newA.1.1.

[0064] The master platform 108 generates a new metadata signature by using an error checking / error correction algorithm, such as SHA256. The new metadata signature newA.1.1 may be the same as the metadata signature A.1.1 reflecting the authorized changes on the computer code, or may be different from the metadata signature A.1.1. For example, the new metadata signature newA.1.1 may reflect some other changes that are not reflected in the metadata signature A.1.1. Those other changes may be updates that are planned for the electronic component within a predetermined time period (e.g., the next 24 hours).

[0065] If the metadata platform 108 finds that the metadata signature A.1.1 does not conform to the changes recorded in the master lookup table, the master platform 108 sends a failure message to the rule checker 106 of the SAE 102. In response, the SAE 102 blocks the operation of the system 100 or the electronic component A.1. The SAE may provide an error message indicating the authentication failure.

[0066] The host platform 108 records the failed security event in a permanent (eg, flash) memory, and the record may include identification information of the electronic component A.1, the subsystem A to which the electronic component A.1 belongs, the SAE 102, and / or the system 100.

[0067] The main platform 108 can determine which problems caused the authentication failure. For example, the main platform 108 can determine the source of the error, such as whether the electronic component is facing a network attack, a machine error, a human error, etc.

[0068] The master platform 108 is also responsible for providing initial keys (e.g., KEY.A, key pair “key.A.1; key.A.1.1”) to the SAE 102. For example, during manufacturing of the system 100 or during testing of the system 100, the master platform 108 may survey the electronic components and / or subsystems of the system 100 and provide corresponding keys based on the code embedded in those electronic components and / or subsystems. The master platform 108 sends these keys to the SAE 102 for storage in the lookup table 104.

[0069] Figure 1C Communications between an example host platform 108 and the SAE 102 of the example computing system 100 are shown. Figure 1C The main platform 108 in includes a main design and test platform (“design / test platform”) 110 and a factory certification and acceptance test system (“factory test system”) 112. Figure 1C The SAE 102 in includes one or more master keys and one or more lookup tables 114 (eg, lookup table 104 ) and a rule checker 106 , which may include a memory for storing rules and constraints, such as an SAE authentication signature 118 .

[0070] Initially, design / test platform 110 generates authentication parameters for SAE 102 and passes the authentication parameters to factory test system 112. Factory test system 112 implements 122 the authentication parameters on SAE 102 during manufacture of SAE 102 or computing system 100. The authentication parameters include a master key, a lookup table, and a SAE authentication signature.

[0071] Thus, the factory test system 112 performs at least the following functions during manufacture and / or testing of the SAE 102: (i) loading the master security key and lookup table 114 into the SAE 102, (ii) authenticating the SAE 102 and / or any other components of the computing system 100, (iii) loading the SAE authentication signature 118 into the SAE 102, and (iv) loading authentication rules and constraints into the SAE 102. In some embodiments, at least a portion of the information received from the factory test system 112 is stored on the rule checker 106.

[0072] During operation of computing system 100 , when SAE 102 identifies a suspect subsystem or electronic component, SAE 102 communicates ( 120 ) directly with design / test platform 110 to verify and / or recertify the suspect subsystem or electronic component.

[0073] Thus, the design / test platform performs at least the following functions: (i) generates a master key and lookup table 114 including a master key, a verification key for a subsystem of the SAE 102, and an authentication key pair for an electronic component of the SAE 102, (ii) establishes rules and constraints, such as encryption / decryption procedures, mappings between verification KEYs and authentication key pairs, (iii) generates an SAE authentication signature 118 for the SAE 102, and (iv) performs system verification and authentication of the computing system 100 or the SAE 102.

[0074] The design / test platform 110 may verify / re-verify the SAE 102 before responding to the verification / certification request of the SAE. For example, the design / test platform 110 may set the SAE authentication signature 118 (e.g., the static portion of the master key of the SAE 102) during the manufacture of the SAE 102 and send the SAE authentication signature 118 to the factory test system 112. The factory test system 112 implements the SAE authentication signature 118 into the rule checker 106. The design / test platform 110 may then require (e.g., request) the SAE 102 to provide the SAE authentication signature 118 for each communication that the SAE 102 has with the design / test platform 110.

[0075] As described above, the SAE 102 may communicate with the host platform 108 via the rule checker 106. In some implementations, the rule checker 106 stores the rules and constraints received from the host platform 108. For example, the rule checker 106 may store an authentication signature 118 specific to the SAE 102, store encryption / decryption algorithms to be executed by the SAE 102, and update the master key and lookup table 114 based on communications from the host platform 108.

[0076] In some embodiments, before the SAE 102 initiates verification / authentication of the subsystems and electronic components of the computer system 100, the rule checker 106 checks whether the SAE's authentication signature 118 satisfies predetermined rules or constraints. If the authentication signature 118 does not satisfy the predetermined rules or constraints, the SAE will not initiate its verification / authentication process, and the subsystems and electronic components of the system 100 will not begin to work.

[0077] Data encryption

[0078] As described above, to authenticate subsystem A, SAE 102 encrypts the identification data received from subsystem A and compares the encrypted identification data with the KEY stored in lookup table 104. SAE 102 encrypts the identification data by using the master key.

[0079] The master key is provided to the SAE 102 by the host platform 108. For example, during manufacturing or testing of the system 100, the host platform 108 may audit the electronic components and / or subsystems of the system 100 and generate a master key for the system 100 based on the electronic components and / or subsystems of the system 100.

[0080] The master key has a static part and a dynamic part. The static part is specific to the system 100 and is generated for a specific parameter (eg, a subsystem) of the system 100.

[0081] The dynamic portion varies for each subsystem and each electronic component. The SAE 102 uses the master key to encrypt the identification data of subsystem A in order to determine the validity of subsystem A. In some embodiments, the SAE 102 uses (at least a portion of) the static portion of the master key to encrypt the identification data of the subsystem.

[0082] As described above, the SAE 102 encrypts the metadata signature received from each electronic component in order to determine whether the electronic component is authentic. The SAE 102 encrypts the metadata signature using a master key. In some embodiments, the SAE 102 encrypts the metadata signature using (at least a portion of) a dynamic portion of a master key associated with electronic component A.1. As described above, the master key has a dynamic portion that varies based on the electronic component for which the master key is used.

[0083] Authentication and Verification Systems

[0084] SAE 102 performs the above process to verify all subsystems A, B, C and certify all electronic components A.1, A.2, ..., An, B.1, B.2, ..., Bm, C.1, C.2, ..., Ck of system 100.

[0085] In some implementations, the SAE 102 verifies subsystems A, B, and C of the system 100 in parallel. In this case, if any subsystem is identified as invalid, the SAE 102 may place the system 100 in a hold state and provide an error message.

[0086] In some embodiments, the SAE 102 sequentially or at least partially sequentially verifies subsystems A, B, and C of the system 100. For example, the SAE 102 may begin verifying subsystem B after subsystem A has been verified, may verify subsystems B and C in parallel and begin verifying subsystems B and C only after subsystem A has been verified, or may begin verifying subsystem B only after subsystem A has been verified and all electronic components of subsystem A have been verified. The verification sequence of the subsystems may be predefined and stored in the SAE 102.

[0087] Some subsystems may have a higher priority than one or more other subsystems. Higher priority subsystems may be verified first. Some subsystems may depend on one or more other subsystems. The priority of the subsystems and / or the dependencies between the subsystems may determine the order in which the subsystems are verified.

[0088] Figure 3C An example process 350 for verifying and authenticating a computing system according to an embodiment of the present disclosure is depicted. As will be described in further detail below, process 350 verifies subsystems sequentially and begins verifying a subsequent subsystem only after all electronic components of the previous (verified) subsystem have been verified. However, in other embodiments, Figure 3C The multiple steps described in the above can be performed in parallel. For example, multiple subsystems can be verified in parallel; multiple electronic components can be verified in parallel; or when verifying a subsystem, one or more electronic components of other subsystems can be verified.

[0089] Upon booting up computing system 100 (352), SAE 102 identifies the subsystems of system 100. SAE 102 then begins verifying a first subsystem (e.g., subsystem A) by setting the current number N of verified subsystems to 0 (354). SAE 102 then checks whether the current number of verified subsystems is less than the total number of subsystems on system 100 (356). If the current number is not less than the total number of subsystems, all subsystems have been verified and their subcomponents have been authenticated; therefore, SAE 102 ends the process (372) and allows system 100 to operate.

[0090] If the current number of verified subsystems is less than the total number of subsystems of the system 100, the SAE 102 performs the above and Figure 3A The subsystem verification process (360) depicted in FIG.

[0091] When verifying the current subsystem (i.e., subsystem N), the SAE 102 begins authenticating the electronic components of the subsystem. To do so, the SAE 102 starts with the first electronic component of the subsystem (e.g., A.1) and sets the current number m of electronic components that have been authenticated within the subsystem to 0 (358). The SAE 102 then checks whether the current number m of electronic components that have been authenticated is less than the total number of electronic components in subsystem N (362).

[0092] If the current number m is less than the total number, the SAE 102 performs the above sum Figure 3B104. Once the electronic component is certified, the SAE 102 moves to the next electronic component of the subsystem that has not yet been certified and increments m by 1 (368). The SAE 102 continues this process until all electronic components of the current subsystem (N) are certified.

[0093] Once all electronic components of subsystem N are authenticated (ie, m=the total number of electronic components of subsystem N), SAE 102 increments N by 1 and moves to the next subsystem to verify and authenticate its electronic components (370).

[0094] Example Medical System

[0095] Figure 2A The peritoneal dialysis (PD) system 200 and the hemodialysis (HD) system 250 in FIG. 2 are shown for implementing Figure 1A For example, the computing system 100 may be part of the PD machine 202 in the PD system 200, may be part of the HD machine 252 of the HD system 250, or may communicate with the PD machine 202 or the HD machine 252, for example, via the transceiver 255.

[0096] In some embodiments, the PD system 200 is configured for use in a patient's home (eg, a home PD system). In some embodiments, the HD system 250 is configured for use in a patient's home (eg, a home HD system).

[0097] The peritoneal dialysis system 200 includes a PD machine (also commonly referred to as a PD cycler) 202 placed on a cart 204. The PD machine 202 includes a housing 206, a door 208, and a box interface 210. When the box 212 is disposed in a box compartment 214 formed between the box interface 210 and the closed door 208, the box interface 210 contacts the disposable PD box 212. A heater tray 216 is positioned on top of the housing 206. The size and shape of the heater tray 216 are designed to accommodate a bag of PD solution, such as dialysate (e.g., a 5-liter bag of dialysate). The PD machine 202 also includes a user interface, such as a touch screen display 218 and additional control buttons 220 that can be operated by a user (e.g., a caregiver or patient) to allow, for example, setting, starting and / or terminating PD therapy.

[0098] A dialysate bag 222 is suspended from fingers on the side of the cart 204, and a heater bag 224 is positioned in the heater tray 216. The dialysate bag 222 and the heater bag 224 are connected to the cassette 212 via a dialysate bag line 226 and a heater bag line 228, respectively. The dialysate bag line 226 can be used to transfer dialysate from the dialysate bag 222 to the cassette 212 during use, and the heater bag line 228 can be used to transfer dialysate back and forth between the cassette 212 and the heater bag 224 during use. In addition, a patient line 230 and a drain line 232 are connected to the cassette 212. The patient line 230 can be connected to the abdomen of the patient via a catheter, and can be used to transfer dialysate back and forth between the cassette 212 and the patient's peritoneal cavity during use. The catheter can be connected to the patient line 230 via a port such as a connector fitting. Drain line 232 may be connected to a drain system or container and may be used to transfer dialysate from cassette 212 to the drain system or container during use.

[0099] The PD machine 202 also includes a control unit 239 (e.g., a processor). The control unit 239 can receive signals from and transmit signals to the touch screen display 218, the control panel 220, and various other components of the PD system 200. The control unit 239 can control operating parameters of the PD machine 102. In some embodiments, the control unit 239 is an MPC823 PowerPC device manufactured by Motorola.

[0100] Figure 2B The HD system 250 shown in FIG. 1 includes an HD machine 252 to which a disposable blood component set 264 forming a blood circuit is connected. During hemodialysis, arterial and venous patient lines 256, 258 of the blood component set 264 are connected to the patient, and blood circulates through the various blood lines and components of the blood component set 264, including the dialyzer 260. At the same time, dialysate circulates through a dialysate circuit formed by the dialyzer 260 and various other dialysate components and dialysate lines connected to the HD machine 252. Many of these dialysate components and dialysate lines are located inside the housing 253 of the HD machine 252, so that the dialysate is not circulated in the housing 253 of the HD machine 252. Figure 2B The dialysate passes through the dialyzer 260 together with the blood. The blood and the dialysate passing through the dialyzer 260 are separated from each other by a semipermeable structure (e.g., a semipermeable membrane and / or semipermeable microtubes) of the dialyzer 260. Due to this arrangement, toxins are removed from the patient's blood and collected in the dialysate. The filtered blood leaving the dialyzer 260 is returned to the patient. The dialysate leaving the dialyzer 260 includes toxins removed from the blood and is generally referred to as "spent dialysate." The spent dialysate is directed from the dialyzer 260 to a discharge system.

[0101] One of the components of the blood component set 264 is an air release device 262. The air release device 262 includes a self-sealing vent assembly that allows air to pass through while inhibiting (e.g., preventing) the passage of liquid. Thus, if the blood passing through the blood circuit during treatment contains air, the air will be exhausted to the atmosphere when the blood passes through the air release device 262.

[0102] like Figure 2B As shown, the dialysate container 274 is connected to the HD machine 252 via a dialysate supply line 276. A drain line 278 and an ultrafiltration line 279 also extend from the HD machine 252. The dialysate supply line 276, the drain line 278, and the ultrafiltration line 279 are fluidly connected to various dialysate components and dialysate lines that form part of a dialysate circuit inside the housing 253 of the HD machine 252. During hemodialysis, the dialysate supply line 276 delivers fresh dialysate from the dialysate container 274 to the portion of the dialysate circuit located inside the HD machine 252. As described above, the fresh dialysate circulates through the various dialysate lines and dialysate components that form the dialysate circuit, including the dialyzer 260. As the dialysate passes through the dialyzer 260, it collects toxins from the patient's blood. The resulting spent dialysate is delivered from the dialysate circuit to the drain system via the drain line 278. When ultrafiltration is performed during treatment, a combination of spent dialysate and excess fluid withdrawn from the patient is delivered to the drain system via ultrafiltration line 279 .

[0103] The blood component set 264 is secured to a module 280 attached to the front of the HD machine 252. The module 280 includes a blood pump 282 capable of driving blood through the blood circuit. The module 280 also includes various other instruments capable of monitoring the blood flowing through the blood circuit. The module 280 includes a door that, when closed, Figure 2B As shown, the door cooperates with the front face of the module 280 to form a compartment sized and shaped to accommodate the blood component set 264. In the closed position, the door presses certain blood components of the blood component set 264 against corresponding instruments exposed on the front face of the module 280. This arrangement facilitates controlling blood flow through the blood circuit and monitoring blood flow through the blood circuit.

[0104] The blood pump 282 can be controlled by a blood pump module 284. The blood pump module 284 includes a display window, a start / stop key, an up key, a down key, a level adjustment key, and an arterial pressure port. The display window displays the blood flow rate setting during blood pump operation. The start / stop key starts and stops the blood pump 282. The up and down keys increase and decrease the speed of the blood pump 282. The level adjustment key raises the fluid level in the arterial drip chamber.

[0105] A medication pump 286 also extends from the front of the HD machine 252. The medication pump 286 is a syringe pump that includes a clamping mechanism configured to hold a syringe 288 of the blood component set 264. The medication pump 286 also includes a stepper motor configured to move a plunger of the syringe 288 along the axis of the syringe 288. The shaft of the stepper motor is fixed to the plunger so that the shaft forces the plunger into the syringe 288 when the stepper motor is operated in a first direction, and the shaft pulls the plunger out of the syringe 288 when operated in a second direction. Thus, the medication pump 286 can be used to inject liquid medication (e.g., heparin) from the syringe 288 into the blood circuit via the medication delivery line 290 during use, or to draw liquid from the blood circuit into the syringe 288 via the medication delivery line 290 during use.

[0106] The HD machine 252 includes a touch screen 268 and a control panel 270. The touch screen 268 and the control panel 270 allow an operator to input various treatment parameters to the HD machine 252 and to otherwise control the HD machine 252. In addition, the touch screen 268 functions as a display. The touch screen 268 is used to provide information to the patient and the operator of the HD system 250. For example, the touch screen 268 can display information related to the dialysis treatment to be applied to the patient, including information related to the prescription, as described above.

[0107] The HD machine 252 includes a processing module 251 that resides inside the machine and is configured to communicate with the touch screen 268 and the control panel 270. The processing module 251 is configured to receive data from the touch screen 268 and the control panel 270 and control the HD machine 252 based on the received data. For example, the processing module 251 can adjust the operating parameters of the HD machine 252.

[0108] The HD machine 252 is configured to be able to connect to a network 254. The HD machine 252 includes a transceiver 255 configured to facilitate connection to the network 254. Other medical devices (e.g., peripheral devices or monitors, other dialysis machines, etc.) can be configured to be able to connect to the network 254 and communicate with the HD machine 252. Similarly, one or more remote entities, such as an issuer of a digital prescription profile and / or an authorization service responsible for verifying the identity of the issuer and proving ownership of a public key corresponding to the issuer, can connect to the network 254 and communicate with the HD machine 252 to provide a digital prescription for implementation on the HD machine 252, a digital certificate, and / or a public key that can be used to check a digital signature, as described above.

[0109] Figure 41 is a block diagram of an example computer system 400 that can be used as part of the system 100 to, for example, perform the functions of the SAE 102 and is shown, for example, in conjunction with the hemodialysis system 250. A control unit, a computing device, and / or a microcontroller can be an example of the system 400 described herein. The system 400 includes a processor 410, a memory 420, a storage device 430, and an input / output device 440. Each of the components 410, 420, 430, and 440 can be interconnected, for example, using a system bus 450. The processor 410 is capable of processing instructions for execution within the system 400. The processor 410 can be a single-threaded processor, a multi-threaded processor, or a quantum computer. The processor 410 is capable of processing instructions stored on the memory 420 or the storage device 430. The processor 410 can perform operations such as causing the dialysis system to perform dialysis functions.

[0110] Memory 420 stores information within system 400. In some embodiments, memory 420 is a computer-readable medium. Memory 420 can be, for example, a volatile memory unit or a non-volatile memory unit. In some embodiments, memory 420 stores information for causing a pump of a dialysis system to operate as described herein.

[0111] The storage device 430 can provide mass storage for the system 400. In some embodiments, the storage device 430 is a non-transitory computer-readable medium. The storage device 430 may include, for example, a hard disk device, an optical disk device, a solid-state drive, a flash drive, a tape, or some other mass storage device. The storage device 430 may alternatively be a cloud storage device, for example, a logical storage device including multiple physical storage devices distributed on a network and accessed using the network.

[0112] The input / output device 440 provides input / output operations for the system 400. In some embodiments, the input / output device 440 includes one or more of a network interface device (e.g., an Ethernet card), a serial communication device (e.g., an RS-232 10 port), and / or a wireless interface device (e.g., an 802.11 card, a 3G wireless modem, or a 4G wireless modem). In some embodiments, the input / output device 440 may include a short-range wireless transmission and reception component, such as a Wi-Fi, Bluetooth, and / or a near field communication (NFC) component, etc. In some embodiments, the input / output device includes a driver device configured to receive input data and send output data to other input / output devices, such as a keyboard, a printer, and a display device (e.g., a touch screen display 118). In some embodiments, mobile computing devices, mobile communication devices, and other devices are used.

[0113] In some embodiments, system 400 is a microcontroller. A microcontroller is a device that contains multiple components of a computer system in a single electronic package. For example, a single electronic package may contain a processor 410, a memory 420, a storage device 430, and an input / output device 440.

[0114] A number of embodiments of the present disclosure have been described. However, it should be understood that various modifications can be made without departing from the spirit and scope of the present disclosure. Therefore, other embodiments are within the scope of the appended claims.

[0115] Claims follow.

Claims

1. A computer-implemented method comprising: Requesting, via a security authentication engine (SAE) of a computing system and from an electronic component of the computing system, a metadata signature specific to the electronic component; receiving, by the SAE, the metadata signature from the electronic component, the metadata signature derived from an error checking / error correction code paired with computer code embedded in the electronic component; encrypting the metadata signature through SAE to generate first encrypted metadata; as well as determining, by the SAE, that the first encrypted metadata substantially matches a first key associated with the electronic component and stored in the SAE such that the number of characters or bits that differ between the first encrypted metadata and the first key is less than a predetermined threshold number, and in response: The first key is provided to the electronic component through SAE as an authentication key used by the electronic component when communicating with other electronic components of the computing system.

2. The method according to claim 1, wherein: The first key is stored in a lookup table, the lookup table comprising a plurality of keys, each of the plurality of keys being respectively associated with a corresponding electronic component of the computing system.

3. The method according to claim 1, wherein: the first key is part of a key pair associated with the electronic component, the key pair comprising a second key, The SAE requests the metadata signature by sending a message including the second key to the electronic component.

4. The method according to claim 3, wherein: The metadata signature is generated by decrypting a second key based on computer code embedded in the electronic component.

5. The method according to claim 1, wherein: The computing system includes a plurality of subsystems, the electronic component resides on a first subsystem of the plurality of subsystems, Therein, the SAE requests the metadata signature in response to determining that the first subsystem is a valid subsystem of the computing system.

6. The method according to claim 5, wherein: Determining that the first subsystem is a valid system includes: receiving, by the SAE and from the electronic component, first identification data of the first subsystem; encrypting the first identification data by SAE to generate first encrypted identification data; and The first encrypted identification data is determined by the SAE to be listed in a lookup table stored on the SAE, the lookup table including a plurality of encrypted identifications associated with the plurality of subsystems.

7. The method according to claim 1, wherein: The metadata signature is a checksum obtained by running an error checking / error correction code on computer code embedded in the electronic component.

8. The method according to claim 1, wherein: When the computing system is shut down or restarted, the first key is removed from the electronic component.

9. The method according to claim 1, wherein: The computing system is a peritoneal dialysis machine or a hemodialysis machine.

10. The method according to claim 1, wherein: The method also includes determining by the SAE that the first encrypted metadata does not substantially match any key stored in a lookup table such that the number of characters or digits that differ between the first encrypted metadata and any key is not less than a predetermined threshold number, and in response communicating with a central security system to verify whether an authorized change has been made to the computer code of the electronic component.

11. The method according to claim 10, wherein: The method further comprises: receiving a message from the central security system confirming that an authorized change was made to the computer code; and A new key is stored in a lookup table for the electronic component, the new key being generated based on the metadata signature.

12. A non-transitory computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising: Requesting, via a security authentication engine (SAE) of a computing system and from an electronic component of the computing system, a metadata signature specific to the electronic component; receiving the metadata signature from the electronic component, the metadata signature derived from an error checking / error correction code paired with computer code embedded in the electronic component; encrypting the metadata signature to generate first encrypted metadata; as well as determining that the first encrypted metadata substantially matches a first key associated with the electronic component and stored in the SAE such that the number of characters or bits that differ between the first encrypted metadata and the first key is less than a predetermined threshold number, and in response: A first key is provided to the electronic component as an authentication key used by the electronic component when communicating with other electronic components of the computing system.

13. The non-transitory computer readable medium of claim 12, wherein: The first key is stored in a lookup table, the lookup table comprising a plurality of keys, each of the plurality of keys being respectively associated with a corresponding electronic component of the computing system.

14. The non-transitory computer readable medium of claim 12, wherein: the first key is part of a key pair associated with the electronic component, the key pair comprising a second key, The SAE requests the metadata signature by sending a message including the second key to the electronic component.

15. The non-transitory computer readable medium of claim 12, wherein: The computing system includes a plurality of subsystems, the electronic component resides on a first subsystem of the plurality of subsystems, Therein, the SAE requests the metadata signature in response to determining that the first subsystem is a valid subsystem of the computing system.

16. The non-transitory computer readable medium of claim 15, wherein: Determining that the first subsystem is a valid system includes: receiving first identification data of a first subsystem from the electronic component; encrypting the first identification data to generate first encrypted identification data; and A determination is made that the first encrypted identification data is listed in a lookup table stored on the SAE, the lookup table including a plurality of encrypted identifications associated with the plurality of subsystems.

17. A system for authenticating a computing system using metadata signatures, comprising: a security authentication engine (SAE) including one or more field programmable gate arrays (FPGAs); as well as a computer-readable storage device coupled to the SAE and having stored thereon instructions that, when executed by the SAE, cause the SAE to perform operations comprising: requesting, from an electronic component of a computing system, a metadata signature specific to the electronic component; receiving the metadata signature from the electronic component, the metadata signature derived from an error checking / error correction code paired with computer code embedded in the electronic component; encrypting the metadata signature to generate first encrypted metadata; and determining that the first encrypted metadata substantially matches a first key associated with the electronic component and stored in the SAE such that the number of characters or bits that differ between the first encrypted metadata and the first key is less than a predetermined threshold number, and in response: The first key is provided to the electronic component through SAE as an authentication key used by the electronic component when communicating with other electronic components of the computing system.

18. The system of claim 17, wherein: The first key is stored in a lookup table, the lookup table comprising a plurality of keys, each of the plurality of keys being respectively associated with a corresponding electronic component of the computing system.

19. The system of claim 17, wherein: the first key is part of a key pair associated with the electronic component, the key pair comprising a second key, The SAE requests the metadata signature by sending a message including the second key to the electronic component.

20. The system of claim 17, wherein: The computing system includes a plurality of subsystems, the electronic component resides on a first subsystem of the plurality of subsystems, The SAE requests the metadata signature by following steps in response to determining that the first subsystem is a valid subsystem of the computing system: receiving first identification data of a first subsystem from the electronic component; encrypting the first identification data to generate first encrypted identification data; and A determination is made that the first encrypted identification data is listed in a lookup table stored on the SAE, the lookup table including a plurality of encrypted identifications associated with the plurality of subsystems.

Images