Anti-repeater attack method, implantable medical device, medical system, and medium

Abstract

The application provides a relay attack prevention method for an implantable medical device, an implantable medical device, a medical system and a medium. The relay attack prevention method provided by the application controls a plurality of antennas of the implantable medical device to receive first information according to a preset rule, obtains second information according to the plurality of antennas and the first information received by the plurality of antennas, and judges whether the first information received by each antenna is relayed according to a preset relay prevention strategy and the plurality of second information. The second information includes one or more of the time of flight, the signal strength, the signal-to-noise ratio of the first information, and antenna information corresponding to the first information. The relay attack prevention method, the implantable medical device, the medical system and the medium provided by the application can effectively improve the relay prevention capability of the implantable medical device without affecting normal communication, thereby improving the security and reliability of communication.

Description

Technical Field

[0001] This invention relates to the field of medical device technology, and in particular to a method for preventing relay attacks, an implantable medical device, a medical system, and a medium. Background Technology

[0002] With the development of communication technology, the communication methods of implantable medical devices are gradually shifting from traditional wired communication to wireless communication. Wireless communication makes communication connections for implantable medical devices simpler, communication speeds faster, and communication methods more flexible.

[0003] In recent years, as people have gained a deeper understanding of the underlying protocols of wireless signal communication, the methods of wireless signal relay have gradually attracted attention. However, wireless signal relay also brings certain security issues. If implantable medical devices (active medical communication devices) are illegally relayed, it will pose a direct threat to the patient's life. See also Figure 1 , Figure 1 This is a schematic diagram illustrating the principle of normal communication in existing implantable medical devices. Figure 1 As can be seen, in the prior art, the implantable medical device 100 transmits signals wirelessly to a legitimate medical programming device 200. (See also...) Figure 2 , Figure 2 This is a schematic diagram illustrating the principle of illegal relaying of implantable medical devices in existing technology. From... Figure 2 It can be seen that when the wireless signal of the implantable medical device 100 is relayed, it can be understood that at a certain distance from the implantable medical device 100, there is a signal amplification device 310 that directly amplifies the wireless signal, allowing the wireless signal emitted by the implantable medical device 100 to be transmitted further, reaching another illegal medical control device 320 at a non-line-of-sight distance. The illegal medical control device 320 can then remotely and illegally operate the implantable medical device 100 from a distance. Therefore, while wireless communication brings convenience, it also brings certain security risks.

[0004] Therefore, in view of the above-mentioned defects in the existing technology, how to provide a secure wireless communication method to improve the anti-relay performance of medical devices has become one of the technical problems that urgently need to be solved by those skilled in the art.

[0005] It should be noted that the information disclosed in the background section of this invention is intended only to enhance the understanding of the general background of this invention, and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this invention is to address the aforementioned deficiencies in the prior art by providing a method for preventing relay attacks on implantable medical devices, comprising:

[0007] According to preset rules, several antennas of the implantable medical device are controlled to receive first information;

[0008] Second information is obtained based on the plurality of antennas and the first information received therefrom; wherein, the second information includes one or more of the flight time, signal strength, and signal-to-noise ratio of the first information and the antenna information corresponding to the first information, and each piece of the first information corresponds to one antenna;

[0009] Based on a preset anti-relay strategy and several pieces of the second information, it is determined whether the first information received by each antenna has been relayed. If so, the first information received by that antenna is ignored.

[0010] Optionally, before the implantable medical device receives the first information, it further includes:

[0011] The implantable medical device sends a third message to the medical control device, and the medical control device responds with the first message.

[0012] Wherein, the flight time of the first information is the time difference between the antenna receiving the first information and the implantable medical device sending the third information to the medical control device.

[0013] Optionally, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and a plurality of the second information includes:

[0014] Based on the flight speed of the first information received by the antenna and the distance between the implanted medical device and the medical control device, the theoretical flight time of the first information received by the antenna is obtained;

[0015] If the difference between the theoretical flight time and the actual flight time exceeds a first preset threshold, then the first information received by the antenna is relayed and ignored.

[0016] Optionally, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and a plurality of the second information includes:

[0017] Determine whether the difference between the flight time of the first information received by the antenna and the reference flight time exceeds a second preset threshold. If so, the first information received by the antenna is relayed and ignored. The reference flight time includes the average flight time of the first information received by the other N-1 antennas.

[0018] Where N≥3, and N is an integer.

[0019] Optionally, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and a plurality of the second information includes:

[0020] Step A: Based on the signal strength of the first information received by the antenna at the current time and the previous time, obtain the signal strength change amount and trend of the first information received by the antenna, and determine whether the trend of change is the same as the signal strength change trend of the first information of the other N-1 antennas. If yes, proceed to step B; if no, proceed to step C, where N≥3 and N is an integer.

[0021] Step B: Determine whether the difference between the signal strength change of the first information of the antenna and the reference signal strength change exceeds a third preset threshold, wherein the reference signal strength change includes the average of the signal strength changes of the first information of the other N-1 antennas;

[0022] If yes, proceed to step C; otherwise, the first information received by the antenna has not been relayed.

[0023] Step C: The first information received by the antenna is relayed, and the first information received by the antenna is ignored.

[0024] Optionally, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and a plurality of the second information includes:

[0025] Determine whether the signal-to-noise ratio of the first information received by the antenna exceeds a fourth preset threshold. If so, the first information received by the antenna is relayed and ignored.

[0026] Optionally, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and a plurality of the second information includes:

[0027] Determine whether the difference between the signal-to-noise ratio of the first information of the antenna and the reference signal-to-noise ratio exceeds a fifth preset threshold. If so, the first information received by the antenna is relayed and ignored. The reference signal-to-noise ratio includes the average value of the signal-to-noise ratios of the first information of the remaining N-1 antennas.

[0028] Where N≥3, and N is an integer.

[0029] Optionally, controlling a plurality of antennas of the implantable medical device to receive the first information according to a preset rule includes:

[0030] According to the preset period, the working time of each antenna, the preset timing sequence, and the preset frequency point corresponding to each antenna, several antennas that receive the first information are switched.

[0031] To achieve the second objective of the present invention, the present invention also provides an implantable medical device, which includes a medical device body and a multi-antenna communication device, wherein the medical device body is communicatively connected to a medical programmable device through the multi-antenna communication device.

[0032] The multi-antenna communication device includes an electrically connected microcontroller unit, a radio frequency signal processing unit, and several antennas;

[0033] The microcontroller unit is configured to control several antennas to receive first information according to preset rules;

[0034] The radio frequency signal processing unit is configured to receive the first information and to obtain second information based on the plurality of antennas and the first information received therefrom; wherein the second information includes one or more of the flight time, signal strength, and signal-to-noise ratio of the first information and the antenna information corresponding to the first information, and each piece of the first information corresponds to one antenna;

[0035] The microcontroller unit is further configured to determine, based on a preset anti-relay strategy and several pieces of the second information, whether the first information received by each antenna is relayed; if so, the first information received by that antenna is ignored.

[0036] Optionally, the implantable medical device further includes a single-pole multi-throw switch, which is connected to the radio frequency signal processing unit and the plurality of antennas;

[0037] The microcontroller controls the single-pole multi-throw switch to switch several antennas receiving the first information according to a preset period, the working time of each antenna, a preset timing sequence, and a preset frequency point corresponding to each antenna.

[0038] To achieve the third objective of the present invention, the present invention also provides a medical system, the medical system comprising a wireless medical device and a medical programming device connected by wireless communication, wherein the wireless medical device includes the aforementioned implantable medical device;

[0039] or

[0040] The wireless medical device and the medical programmable device employ any of the above-described anti-relay attack methods for anti-relay control.

[0041] To achieve the fourth objective of the present invention, the present invention also provides a computer-readable storage medium for an implantable medical device, wherein the readable storage medium stores a computer program, which, when executed by a processor, implements the relay attack prevention method described in any of the preceding claims.

[0042] Compared with the prior art, the anti-relay attack method, implantable medical device, medical system and medium for multi-antenna devices provided by the present invention have the following beneficial effects:

[0043] The anti-relay attack method provided by this invention controls several antennas of the implantable medical device to receive first information according to preset rules, and obtains second information based on the several antennas and the first information they receive; and determines whether the first information received by each antenna has been relayed according to a preset anti-relay strategy and the several pieces of second information. The second information includes one or more of the following: flight time of receiving the first information, signal strength, and signal-to-noise ratio, as well as the antenna information corresponding to the first information, with each piece of first information corresponding to one antenna. Therefore, the anti-relay attack method provided by this invention can not only switch different antennas to work, but also determine whether the first information received by each antenna has been relayed by using multiple antennas and one or more of the following: flight time, signal strength, and signal-to-noise ratio of the first information received by each antenna. Without affecting normal communication, it can effectively improve the anti-relay capability of the implantable medical device, thereby improving the security and reliability of communication. Attached Figure Description

[0044] Figure 1 This is a schematic diagram illustrating the principle of normal communication in existing implantable medical devices.

[0045] Figure 2 This is a schematic diagram illustrating the principle of illegal relaying of implantable medical devices in existing technologies.

[0046] Figure 3 A schematic diagram of the overall method flow for the anti-relay attack method provided by the present invention;

[0047] Figure 4This is a schematic diagram illustrating the normal communication time-of-flight principle of the anti-relay attack method provided in Embodiment 1 of the present invention.

[0048] Figure 5 This is a schematic diagram illustrating the relayed communication time-of-flight principle of the anti-relay attack method provided in Embodiment 1 of the present invention.

[0049] Figure 6 This is a schematic diagram illustrating the principle of the anti-relay attack method provided in Embodiment 2 of the present invention, showing the received signal strength at different times.

[0050] Figure 7 This is a schematic diagram illustrating the principle of the anti-relay attack method provided in Embodiment 2 of the present invention, showing the received signal strength at different times under relay conditions.

[0051] Figure 8 This is a schematic diagram illustrating the reception of a legitimate medical programmable device signal in the anti-relay attack method provided in Embodiment 3 of the present invention.

[0052] Figure 9 This is a schematic diagram illustrating the reception of signals from unauthorized medical program control devices in the anti-relay attack method provided in Embodiment 3 of the present invention.

[0053] Figure 10 A schematic diagram of a single-pole multi-throw switch corresponding to the anti-relay attack method provided in Embodiment 4 of the present invention;

[0054] Figure 11 This is a schematic diagram of the structure of the implantable medical device provided in Embodiment 5 of the present invention;

[0055] Figure 12 for Figure 11 A schematic diagram of the structure of the multi-antenna communication device in the provided active wireless medical device;

[0056] The reference numerals in the attached figures are explained as follows:

[0057] 100 - Implantable medical devices in the prior art; 200 - Medical programmed devices; 310 - Signal amplifiers; 320 - Illegal medical programmed devices;

[0058] 500-Implantable medical device, 510-Microcontroller unit, 520-Radio frequency signal processing unit, 521-Radio frequency processor, 522-Radio frequency front-end circuit, 530-Single-pole multi-throw switch, 540-Power supply module, 600-Medical device body. Detailed Implementation

[0059] To make the objectives, advantages, and features of the present invention clearer, the following detailed description of the anti-relay attack method, implantable medical device, medical system, and medium proposed by the present invention is provided in conjunction with the accompanying drawings. It should be noted that the drawings are all in a very simplified form and use non-precise proportions, used only to facilitate and clearly illustrate the embodiments of the present invention. It should be understood that the accompanying drawings do not necessarily show the specific structure of the present invention to scale, and the illustrative features used to illustrate certain principles of the present invention in the accompanying drawings are also drawn in a slightly simplified manner. Specific design features of the present invention disclosed herein, including, for example, specific dimensions, orientations, positions, and shapes, will be determined in part by the specific application and usage environment. Furthermore, in the embodiments described below, the same reference numerals are sometimes used across different drawings to denote the same parts or parts having the same function, omitting repeated descriptions. In this specification, similar reference numerals and letters are used to denote similar items; therefore, once an item is defined in one drawing, it does not need to be further discussed in subsequent drawings.

[0060] Where appropriate, these terms may be replaced. Similarly, if the methods described herein comprise a series of steps, and the order of these steps presented herein is not necessarily the only possible order in which these steps can be performed, and some of the described steps may be omitted and / or some other steps not described herein may be added to the method.

[0061] To facilitate understanding of the present invention, the overall process of the anti-relay attack method provided by the present invention will be briefly introduced first, and then each embodiment will be described in detail.

[0062] Specifically, see Figure 3 , Figure 3 This is a schematic diagram of the overall method flow for the anti-relay attack method provided by the present invention. From... Figure 3 As can be seen, the present invention provides a method for preventing relay attacks on implantable medical devices (active medical devices), comprising:

[0063] S1: According to preset rules, control several antennas of the implantable medical device to receive the first information.

[0064] It should be noted that the N related to the number of antennas mentioned in this document refers to N≥3, where N is an integer. In other words, in the various embodiments described below where the number of antennas N is mentioned, step S1 should be understood as: controlling at least three antennas of the implantable medical device to be in an operational state. In embodiments where the number of antennas N is not mentioned, step S1 should be understood as: controlling one or more antennas of the implantable medical device to be in an operational state. Those skilled in the art will understand that the first information includes the substantive content of the programmable device controlling the implantable medical device. This substantive information includes, but is not limited to, the programmable device's use to control the pacing frequency, pacing voltage threshold, pacing pulse width, and sensing settings of the implantable medical device.

[0065] S2: Based on the plurality of antennas and the first information received therefrom, second information is obtained; wherein, the second information includes one or more of the flight time, signal strength, and signal-to-noise ratio of the first information and the antenna information corresponding to the first information, each piece of the first information corresponds to one antenna, in other words, each piece of second information corresponds to one antenna information and the signal attributes of the first information received by the antenna and the substantive content of the first information, wherein the signal attributes include one or more of the signal strength and signal-to-noise ratio.

[0066] In particular, as those skilled in the art will understand, the antenna information includes, but is not limited to, identification information such as the antenna number, ID, and / or name used to distinguish it from other antennas.

[0067] S3: Based on the preset anti-relay strategy and several pieces of the second information, determine whether the first information received by each antenna has been relayed. If so, ignore the first information received by that antenna.

[0068] The anti-relay attack method provided by this invention controls several antennas of the implantable medical device to receive first information according to preset rules, and obtains second information based on the several antennas and the first information they receive; and determines whether the first information received by each antenna has been relayed based on a preset anti-relay strategy and the several pieces of second information. Therefore, the anti-relay attack method provided by this invention can not only switch different antennas to work, but also, according to the preset anti-relay strategy, determine whether the first information received by each antenna has been relayed by comparing one or more of the flight time, signal strength, and signal-to-noise ratio of the first information received by each antenna with their respective preset thresholds, and / or by cross-referencing one or more of the flight time, signal strength, and signal-to-noise ratio of the first information received by each antenna with one or more of the flight time, signal strength, and signal-to-noise ratio of the first information received by each antenna with one or more of the flight time, signal strength, and signal-to-noise ratio of the first information received by each antenna with one or more of the flight time, signal strength, and signal-to-noise ratio of the first information received by other antennas, without affecting normal communication. This effectively improves the anti-relay capability of the implantable medical device.

[0069] Example 1

[0070] The inventors of this invention discovered through research that when an implantable medical device 100 emits a wireless signal, the signal flight time from its arrival at the medical control device 200 to its return to the implantable medical device 100 is generally stable within a certain range, assuming this actual flight time is T1. Since wireless signals propagate at the speed of light in air, if the distance between the implantable medical device 100 and the medical control device 200 is D, the theoretical signal flight time from the implantable medical device 100 to the medical control device 200 is T2 = (2 × D) ÷ C, where C is the speed of light in a vacuum. Considering different antenna angles and environmental factors, the flight time will have some error and needs to be corrected by a factor ΔT. Therefore, the actual flight time T1 should be between T2 - ΔT and T2 + ΔT. Please refer to [link to relevant documentation]. Figure 4 , Figure 4 This is a schematic diagram illustrating the normal communication flight time principle of the anti-relay attack method provided in Embodiment 1 of the present invention. Once the wireless signal is relayed, because the distance between the illegal medical control device 320 and the implantable medical device 100 is several times greater than the distance between the implantable medical device 100 and the medical control device 200, the signal flight time T3 from the relayed signal to the implantable medical device 100 will inevitably exceed the ranges of T2-ΔT and T2+ΔT. Please refer to [link to relevant documentation]. Figure 5 , Figure 5 This is a schematic diagram illustrating the relayed communication time-of-flight principle of the anti-relay attack method provided in Embodiment 1 of the present invention. Therefore, it is possible to determine whether the received signal is being relayed based on the signal's time-of-flight.

[0071] Based on the above research, the inventors of this invention propose a method for preventing relay attacks, in one preferred embodiment of which step S1, before the implantable medical device receives the first information, further includes:

[0072] The implantable medical device sends a third message to the medical control device, and the medical control device responds with the first message.

[0073] In step S2, the flight time of the first information is the time difference between the antenna receiving the first information and the implantable medical device sending the third information to the medical control device.

[0074] Obviously, this is only a description of a preferred embodiment and not a limitation of the present invention. In other embodiments, the flight time of the first information may also be appended to the first information when it is sent by the medical control device, so that it can be directly obtained from the second information in step S3.

[0075] Correspondingly, in step S3, determining whether the first information received by each antenna has been relayed based on a preset anti-relay strategy and several pieces of the second information includes:

[0076] S311: Based on the flight speed of the first information received by the antenna and the distance between the implanted medical device and the medical control device, obtain the theoretical flight time of the first information received by the antenna;

[0077] S312: Determine whether the difference between the theoretical flight time and the actual flight time exceeds a first preset threshold. If so, the first information received by the antenna is relayed, and the first information received by the antenna is ignored. It is understood that the first preset threshold should be reasonably set based on the distance between the implantable medical device and the medical control equipment, the antenna performance, and the actual surrounding conditions during transmission. This invention does not impose any restrictions on this.

[0078] Accordingly, in step S1, controlling several antennas of the implantable medical device to receive the first information according to preset rules includes: controlling one or several antennas of the implantable medical device to be in working state.

[0079] With this configuration, the anti-relay attack method provided by the present invention can effectively improve the anti-relay capability of the implantable medical device, and is especially suitable for situations where the distance between the implantable medical device and the medical programmable device is known.

[0080] As will be understood by those skilled in the art, the differences in this document are the result of subtracting the smaller value from the larger value. For example, regarding the difference between the theoretical flight time and the actual flight time: if the theoretical flight time is greater than or equal to the actual flight time, then the difference between the theoretical flight time and the actual flight time is the result of subtracting the actual flight time from the actual flight time; if the theoretical flight time is less than the actual flight time, then the difference between the theoretical flight time and the actual flight time is the result of subtracting the theoretical flight time from the actual flight time. To avoid redundancy, the details of the differences mentioned herein will not be elaborated upon further.

[0081] Preferably, in another exemplary embodiment, step S3, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and a plurality of pieces of second information, includes:

[0082] S321: Determine whether the difference between the flight time of the first information received by the antenna and the reference flight time exceeds a second preset threshold. If so, the first information received by the antenna is relayed, and the first information received by the antenna is ignored. The reference flight time is the average of the flight times of the first information received by the remaining N-1 antennas. For example, if the implantable medical device has three antennas, in the same time period, the flight time of the first information received by the first antenna is T1, and the flight times of the first information received by the second and third antennas are T2 and T3, respectively. Due to the characteristics of each antenna and differences in the surrounding communication environment, the values ​​of T1, T2, and T3 may not be exactly the same, but should be within an error range (such as the second preset threshold). In other words, if the first information received by the first antenna is relayed, the flight time T1 of the first information will inevitably have a large deviation from the flight times T2 and T3 of the first information received by the second and third antennas. Based on this, it can be determined that the first information received by the first antenna is relayed, and the first information received by the first antenna can be ignored, interrupting the communication of the signal and effectively preventing relay.

[0083] Preferably, in another exemplary embodiment, step S3, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and a plurality of pieces of second information, includes:

[0084] S331: Based on the flight time of the first information received by the antenna and the flight time of the first information received by the other N-1 antennas, obtain the number of antennas whose flight time difference exceeds a preset flight time difference.

[0085] S332: Determine whether the number of antennas exceeds a preset antenna number threshold; if so, the first information received by the antenna is relayed and the first information received by the antenna is ignored.

[0086] For example, if the multi-antenna communication device has four antennas, within the same time period, the flight time of the first information received by the first antenna is T1, and the flight times of the first information received by the second, third, and fourth antennas are T2, T3, and T4, respectively. Due to the characteristics of each antenna and differences in the surrounding communication environment, the values ​​of T1, T2, T3, and T4 may not be exactly the same, but should be within an error range (e.g., a preset flight time difference). In other words, if the first information received by the first antenna is relayed, but the first information received by the second, third, and fourth antennas is not relayed, then the flight time T1 of the first information will inevitably deviate significantly from the flight times T2, T3, and T4 of the first information received by the second, third, and fourth antennas, while the deviations between T2, T3, and T4 will be smaller. Based on this, it can be determined that the first information received by the first antenna is relayed, and the first information received by the first antenna can be ignored, interrupting the communication of this signal and effectively preventing relaying.

[0087] With this configuration, the anti-relay attack method provided by the present invention compares the flight time of the first information received by each antenna of the multi-antenna communication device, making each antenna interdependent and referential to each other, thereby determining which antenna's first information was relayed, which can improve the communication security of the multi-antenna communication device.

[0088] It should be noted that the anti-relay strategy provided in this embodiment is based on the scenario in practical applications where an unauthorized programmable device attacks only a very small portion or even just one of the multiple antennas of the implantable medical device. For the low-probability scenario where an unauthorized programmable device attacks most of the multiple antennas (e.g., 4 out of 5 working antennas are illegally relayed), the anti-relay control strategy can be combined with the theoretical flight time and actual flight time from step S321 above. Alternatively, the historical flight time of the first information received by each antenna can be statistically analyzed. If the flight time of the first information received by that antenna at a certain moment differs significantly from the historically statistical flight time, then the first information received by that antenna at that moment may have been relayed. When determining whether the first information received by other antennas has been relayed, the flight time of the first information received by that antenna (where the flight time of the first information received at that moment differs significantly from the historical flight time) at that moment is no longer included in the calculation of the reference time in step S321 or the threshold comparison in step S331.

[0089] Example 2

[0090] Before detailing this embodiment, its basic principles will be explained. (See also...) Figure 6 , Figure 6This is a schematic diagram illustrating the principle of the anti-relay attack method provided in Embodiment 2 of the present invention, corresponding to the received signal strength at different times. Assume that the signal strength of the first information (from the legitimate medical programmable device 200) received by different antennas of the implantable medical device 100 at the current time T0 is RSSI_i (Received Signal Strength Indicator), such as RSSI_1, RSSI_2, ..., RSSI_N, etc., and the signal strength at the next time T1 is RSSI_ii, such as RSSI_11, RSSI_22, ..., RSSI_NN. The change in signal strength before and after is ΔRi, i.e.: ΔR1 = RSSI_1 - RSSI_11, ΔR2 = RSSI_2 - RSSI_22, ΔRN = RSSI_N - RSSI_NN. The inventors of this invention have discovered through research that, due to the differences in the performance of multiple antennas, the variation range of ΔRi is within a certain range under normal circumstances, and the trend of change is the same. See also... Figure 7 , Figure 7 This is a schematic diagram illustrating the principle of received signal strength at different times under relayed conditions in the anti-relay attack method provided in Embodiment 2 of the present invention. When the wireless signal of the implantable medical device 100 is relayed, the signal strength of a certain antenna suddenly increases from RSSI_R to RSSI_RR, and the amplitude and trend of the signal change ΔRR are different from those of other antennas. Based on this, it can be determined that the received signal is being relayed based on the change in signal strength of the first information received by each antenna, thus interrupting the communication of the signal and forcibly terminating the relay. This is the theoretical basis of this embodiment.

[0091] Based on the above research, the inventors of this invention propose an anti-relay attack method. In one preferred embodiment, step S3, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and several pieces of second information, includes:

[0092] Step A: Based on the signal strength of the first information received by the antenna at the current time and the previous time, obtain the signal strength change and trend of the first information received by the antenna, and determine whether the trend is the same as the signal strength change trend of the first information of the other N-1 antennas. If yes, proceed to step B; otherwise, proceed to step C.

[0093] Step B: Determine whether the difference between the signal strength change of the first information received by this antenna and the average signal strength change of the first information received by the other N-1 antennas exceeds a third preset threshold, wherein the reference signal strength change includes the average signal strength change of the first information received by the other N-1 antennas. If yes, proceed to step C; if no, the first information received by this antenna has not been relayed.

[0094] The relay attack prevention method provided in this embodiment differs from that in Embodiment 1 in that it compares the changes in signal strength of the first information received by each antenna with the changes in signal strength of the first information received by the other antennas, rather than comparing the time of flight of the first information as in Embodiment 1. To avoid redundancy, further detailed explanations can be found in the relevant examples in Embodiment 1; simply replace the time-of-flight adaptability with changes in signal strength and their trends.

[0095] Step C: The first information received by the antenna is relayed, and the first information received by the antenna is ignored.

[0096] Therefore, the anti-relay attack method provided by the embodiments of the present invention does not require knowledge of the distance between the implantable medical device and the medical programmable device. By comparing the changes and trends in the signal strength of the first information received by each antenna of the implantable medical device, it can be determined which antenna's first information is being relayed. This makes each antenna interdependent and referential to each other, thereby determining which antenna's first information is being relayed. This effectively reduces the risk of signal relay during information transmission between the implantable medical device and the medical programmable device, and improves the communication security of the implantable medical device.

[0097] It should be noted that the anti-relay strategy provided in this embodiment is based on the scenario in practical applications where an unauthorized programmable device attacks only a very small portion or even just one of the multiple antennas of the implantable medical device. For the low-probability scenario where an unauthorized programmable device attacks most of the multiple antennas (e.g., 4 out of 5 working antennas are illegally relayed), the signal strength of the first information received by each antenna can be statistically analyzed. If, at a certain moment, the signal strength of the first information received by that antenna differs significantly from the historical signal strength, then the first information received by that antenna at that moment may have been relayed. When determining whether the first information received by other antennas has been relayed, the signal strength of the first information received by that antenna (where the signal strength of the first information received at that moment differs significantly from the historical signal strength) at that moment is no longer included in the calculation of the reference signal strength change in step B.

[0098] Example 3

[0099] Before detailing this embodiment, the basic principle of this embodiment will be explained. The inventors of this invention discovered that when the implantable medical device 100 receives a response signal from a legitimate medical control device 200, the normally received wireless signal strength is low due to interference from the surrounding environment during transmission, resulting in a lower SNR (signal-to-noise ratio) when received from the legitimate medical control device 200. (See [link to relevant documentation]). Figure 8 , Figure 8This is a schematic diagram illustrating the reception of a legitimate medical control device signal in the anti-relay attack method provided in Embodiment 3 of the present invention. Figure 8 As can be seen, under normal circumstances (when the signal is not relayed), the SNR is approximately 3dB. However, once the wireless signal is relayed, the relay device needs to amplify the signal before it can be transmitted to the implantable medical device 100. At this point, the SNR received by the implantable medical device 100 from the illegal medical programming device 320 is significantly improved compared to the normal situation. (See also...) Figure 9 , Figure 9 This is a schematic diagram illustrating the reception of a signal from an unauthorized medical control device in accordance with the anti-relay attack method provided in Embodiment 3 of the present invention. Figure 9 As can be seen, the SNR is approximately 25 dB at this point.

[0100] Based on the above research, the inventors of this invention propose an anti-relay attack method. In one preferred embodiment, step S3, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and several pieces of second information, includes:

[0101] S341: Determine whether the signal-to-noise ratio of the first information received by the antenna exceeds a fourth preset threshold. If so, the first information received by the antenna is relayed and ignored. It is understood that the fourth preset threshold should be reasonably set based on the distance between the implantable medical device and the medical control device, the antenna performance, and the actual conditions around the transmission process. This invention does not impose any restrictions on this.

[0102] With this configuration, the anti-relay attack method provided by the present invention can effectively improve the anti-relay capability of the implantable medical device by determining whether the signal-to-noise ratio of the received first information exceeds a fourth preset threshold.

[0103] Preferably, in another exemplary embodiment, step S3, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and a plurality of pieces of second information, includes:

[0104] S351: Determine whether the difference between the signal-to-noise ratio of the first information of the antenna and the reference signal-to-noise ratio exceeds a fifth preset threshold. If so, the first information received by the antenna is relayed and the first information received by the antenna is ignored. The reference signal-to-noise ratio includes the average value of the signal-to-noise ratios of the first information of the remaining N-1 antennas.

[0105] Preferably, in another exemplary embodiment, step S3, determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and a plurality of pieces of second information, includes:

[0106] S361: Based on the signal-to-noise ratio of the first information of the antenna and the signal-to-noise ratio of the first information of the remaining N-1 antennas, obtain the number of antennas whose signal-to-noise ratio difference exceeds a preset signal-to-noise ratio difference;

[0107] If the number of antennas exceeds a preset antenna number threshold, the first information received by that antenna is relayed and ignored.

[0108] The relay attack prevention method provided in this embodiment differs from that in Embodiment 1 in that it compares the signal-to-noise ratio (SNR) of the first information received by each antenna with the SNR of the first information received by the other antennas, instead of comparing the SNR based on the flight time of the first information as in Embodiment 1. For further detailed explanation, please refer to the relevant examples in Embodiment 1; simply replace the flight time parameter with the signal-to-noise ratio.

[0109] With this configuration, the anti-relay attack method provided by the present invention compares the signal-to-noise ratio of the first information received by each antenna of the implantable medical device, making each antenna interdependent and referential to each other, thereby determining which antenna's first information is being relayed, which can improve the communication security of the implantable medical device.

[0110] It should be noted that the anti-relay strategy provided in this embodiment is based on the scenario in practical applications where an unauthorized programmable device attacks only a very small portion or even just one of the multiple antennas of the implantable medical device. For the low-probability scenario where an unauthorized programmable device attacks most of the multiple antennas (e.g., two out of three working antennas are illegally relayed), the anti-relay control strategy in step S341 can be combined with this strategy. Alternatively, the historical signal-to-noise ratio (SNR) of the first information received by each antenna can be statistically analyzed. If, at a certain moment, the SNR of the first information received by that antenna differs from the historically statistical SNR by more than a threshold, then the first information received by that antenna at that moment may have been relayed. When determining whether the first information received by other antennas has been relayed, the SNR of the first information received by that antenna (where the SNR of the first information received at that moment exceeds a threshold) is no longer included in the calculation of the reference SNR in step S351 or the threshold comparison in step S361.

[0111] Example 4

[0112] The inventors of this invention, through further research, discovered that illegal relay devices typically relay signals at one or more frequencies. Therefore, unlike the three embodiments described above, the anti-relay attack method provided in this embodiment achieves the attack of illegal relay devices by controlling the operating state of each antenna of the implantable medical device. Accordingly, in step S1, controlling several antennas of the implantable medical device to receive first information according to preset rules includes:

[0113] According to a preset period, the operating duration of each antenna, a preset timing sequence, and a preset frequency point corresponding to each antenna, several antennas receiving the first information are switched. For details, see the appendix. Figure 10 , Figure 10 This is a schematic diagram of a single-pole multi-throw switch corresponding to the relay attack prevention method provided in Embodiment 4. When multiple antennas of the implantable medical device communicate with the legitimate medical programming device 200, the single-pole multi-throw switch 530 is controlled to switch different antennas into working states. This allows signals to operate on different channels, i.e., different frequencies, at different times with a certain period and timing.

[0114] In one embodiment, the implantable medical device has antennas 1, 2, ..., N, with N different antennas corresponding to N different frequency points. At time T0, it operates on antenna 1. After working on antenna 1 for time t1, it switches to antenna K in a predetermined order. After working on antenna K for time t2, and so on, working on different antennas for a period of time before switching to another antenna in a predetermined order. Since the operating time of each antenna, the corresponding operating frequency, and the switching order between antennas are all preset, but also have a certain degree of randomness, the device's anti-relay capability can be greatly improved. When the relay device amplifies a signal for communication, switching using a single-pole multi-throw switch 530 (which can be a single-pole multi-throw RF switch) forces the relay to interrupt, thereby improving the anti-relay capability.

[0115] In summary, the anti-relay attack method for implantable medical devices proposed in this invention, based on different working principles, offers several different approaches to prevent relaying of implantable medical devices during communication. These include calculating signal time-of-flight differences, analyzing signal change trends and amplitudes, comparing signal SNR, and switching multiple antennas in a multi-antenna system to ensure each antenna operates on a different communication channel. By employing one or more of these methods, true anti-relay attacks can be achieved comprehensively against various illegal relaying devices, significantly improving the security and reliability of implantable medical device communication and reducing the threat to patient safety caused by signal relaying.

[0116] In particular, as those skilled in the art will understand, although the implementation strategies of the above embodiments are described independently, in practical applications, without conflict or contradiction, embodiments one, two, three, and four can be implemented simultaneously to further enhance anti-relay capabilities. For example, the anti-relay control strategy based on flight time of embodiment one and the anti-relay control strategy based on signal strength of embodiment two can be used simultaneously, or, based on controlling the operating status of each antenna of the implantable medical device in embodiment four, any one or more anti-relay control strategies from embodiments one, two, and three can be combined.

[0117] Example 5

[0118] This embodiment provides an implantable medical device, see [link to documentation]. Figure 11 and Figure 12 , Figure 11 This is a schematic diagram of the structure of the implantable medical device provided in this embodiment. Figure 12 for Figure 11 A schematic diagram of the structure of a multi-antenna communication device in a provided active wireless medical device. From... Figure 11 As can be seen, the implantable medical device provided in this embodiment includes an electrically connected medical device body 600 and a multi-antenna communication device 500. The medical device body 600 is communicatively connected to a medical programming device via the multi-antenna communication device 500.

[0119] Specifically, from Figure 12 As can be seen, the multi-antenna communication device 500 includes a microcontroller unit 510, a radio frequency signal processing unit 520, and several antennas that are electrically connected.

[0120] Specifically, the microcontroller unit 510 is configured to control a plurality of antennas to receive first information according to preset rules. The radio frequency signal processing unit 520 is configured to receive the first information and to obtain second information based on the plurality of antennas and the first information received therefrom; wherein the second information includes one or more of the flight time, signal strength, and signal-to-noise ratio of the first information and the antenna information corresponding to the first information, and each piece of the first information corresponds to one antenna.

[0121] Furthermore, the microcontroller unit 510 is also configured to determine whether the first information received by each antenna is relayed based on a preset anti-relay strategy and several pieces of the second information; if so, the first information received by that antenna is ignored.

[0122] The implantable medical device provided by this invention includes a microcontroller unit 510 that controls several antennas of the implantable medical device to receive first information according to preset rules, and obtains second information based on the several antennas and the first information received by them. The microcontroller unit 510 is also used to determine whether the first information received by each antenna has been relayed, based on a preset anti-relay strategy and the several pieces of the second information. The second information includes one or more of the flight time, signal strength, and signal-to-noise ratio of the first information, as well as the antenna information corresponding to the first information. Therefore, the implantable medical device provided by this invention can not only switch between different antennas, but also determine whether the first information received by each antenna has been relayed by using multiple antennas and one or more of the flight time, signal strength, and signal-to-noise ratio of the first information received by each antenna, effectively improving the anti-relay capability of the implantable medical device without affecting normal communication.

[0123] Preferably, in one exemplary embodiment, the implantable medical device further includes a single-pole multi-throw switch 530, which is connected to the radio frequency signal processing unit 520 and the plurality of antennas; the microcontroller unit 510 controls the single-pole multi-throw switch 530 to switch the plurality of antennas receiving the first information according to a preset period, the working duration of each antenna, a preset timing sequence, and a preset frequency point corresponding to each antenna.

[0124] Furthermore, the radio frequency signal processing unit 520 includes an radio frequency processor 521 and a radio frequency front-end circuit 522 electrically connected to each other. Specifically, the radio frequency processor 521 is connected to the microcontroller unit 510, and the radio frequency front-end circuit 522 is electrically connected to a plurality of the antennas through the single-pole multi-throw switch 530. Even further, the implantable medical device also includes a power module 540 electrically connected to the microcontroller unit 530 and the radio frequency processor 521, the power module 540 being used to supply power to the microcontroller unit 510 and the radio frequency processor 521.

[0125] Based on the same inventive concept, another embodiment of the present invention provides a medical system, which includes a wireless medical device and a medical programming device connected by wireless communication. Specifically, in one embodiment, the wireless medical device includes the implantable medical device described in the above embodiments; in other embodiments, the wireless medical device and the medical programming device employ the anti-relay attack method described in any of the above embodiments for anti-relay control.

[0126] For the medical system implementation, since its basic principle is similar to the implementation methods of the various anti-relay attack methods for implantable medical devices described above, the description is relatively simple. For relevant details, please refer to the description of the method implementation.

[0127] Since the medical system provided by this invention and the anti-relay attack method for implantable medical devices provided by this invention belong to the same inventive concept, they have at least the same beneficial effects, which will not be elaborated here.

[0128] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0129] It should be noted that the systems and methods disclosed in the embodiments herein can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings show the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments herein. In this regard, each block in a flowchart or block diagram may represent a module, program, or part of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system to perform the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0130] In addition, the functional modules in the various embodiments of this article can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0131] Another embodiment of the present invention provides a computer-readable storage medium for an implantable medical device, wherein the readable storage medium stores a computer program that, when executed by a processor, can implement the steps of the relay attack prevention method described above.

[0132] The readable storage medium of embodiments of the present invention can be any combination of one or more computer-readable media. The readable medium can be a computer-readable signal medium or a computer-readable storage medium. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: electrical connections having one or more wires, portable computer hard disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, apparatus, or device.

[0133] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0134] It should be noted that computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0135] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0136] In summary, the above embodiments have provided a detailed description of the different configurations of the anti-relay attack method, implantable medical device, medical system, and medium proposed in this invention. Of course, the above description is only a description of the preferred embodiments of this invention and is not intended to limit the scope of this invention in any way. This invention includes, but is not limited to, the configurations listed in the above embodiments. Those skilled in the art can draw inferences from the above embodiments. Any changes or modifications made by those skilled in the art based on the above disclosure are within the scope of protection of the claims.

Claims

1. A method for preventing relay attacks on implantable medical devices, characterized in that, include: According to a preset cycle, the working duration of each antenna of the implantable medical device, a preset timing sequence, and a preset frequency point corresponding to each antenna, several antennas are switched to control several antennas to receive first information; the first information includes the substantive content of the programmable device controlling the implantable medical device; Second information is obtained based on the plurality of antennas and the first information received therefrom; wherein, the second information includes one or more of the flight time, signal strength, and signal-to-noise ratio of the first information and the antenna information corresponding to the first information, and each piece of the first information corresponds to one antenna; Based on the preset anti-relay strategy and several pieces of the second information, it is determined whether the first information received by each antenna has been relayed. If so, the first information received by that antenna is ignored. The step of determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and several pieces of the second information includes: Step A: Based on the signal strength of the first information received by the antenna at the current time and the previous time, obtain the signal strength change amount and trend of the first information received by the antenna, and determine whether the trend of change is the same as the signal strength change trend of the first information of the other N-1 antennas. If yes, proceed to step B; if no, proceed to step C, where N≥3 and N is an integer. Step B: Determine whether the difference between the signal strength change of the first information of the antenna and the reference signal strength change exceeds a third preset threshold, wherein the reference signal strength change includes the average of the signal strength changes of the first information of the remaining N-1 antennas, and the signal strength of the first information received by the ignored antennas is no longer included in the calculation of the reference signal strength change. If yes, proceed to step C; otherwise, the first information received by the antenna has not been relayed. Step C: The first information received by the antenna is relayed, and the first information received by the antenna is ignored.

2. The method for preventing relay attacks according to claim 1, characterized in that, Before the implantable medical device receives the first information, it also includes: The implantable medical device sends a third message to the medical control device, and the medical control device responds with the first message. Wherein, the flight time of the first information is the time difference between the antenna receiving the first information and the implantable medical device sending the third information to the medical control device.

3. The method for preventing relay attacks according to claim 2, characterized in that, The step of determining whether the first information received by each antenna has been relayed based on a preset anti-relay strategy and several pieces of the second information includes: Based on the flight speed of the first information received by the antenna and the distance between the implanted medical device and the medical control device, the theoretical flight time of the first information received by the antenna is obtained; If the difference between the theoretical flight time and the actual flight time exceeds a first preset threshold, then the first information received by the antenna is relayed and ignored.

4. The method for preventing relay attacks according to claim 2, characterized in that, The step of determining whether the first information received by each antenna has been relayed based on a preset anti-relay strategy and several pieces of the second information includes: Determine whether the difference between the flight time of the first information received by the antenna and the reference flight time exceeds a second preset threshold. If so, the first information received by the antenna is relayed and ignored. The reference flight time is the average of the flight times of the first information received by the other N-1 antennas. Where N≥3, and N is an integer.

5. The method for preventing relay attacks according to claim 1, characterized in that, The step of determining whether the first information received by each antenna has been relayed based on a preset anti-relay strategy and several pieces of the second information includes: Determine whether the signal-to-noise ratio of the first information received by the antenna exceeds a fourth preset threshold. If so, the first information received by the antenna is relayed and ignored.

6. The method for preventing relay attacks according to claim 1, characterized in that, The step of determining whether the first information received by each antenna has been relayed based on a preset anti-relay strategy and several pieces of the second information includes: Determine whether the difference between the signal-to-noise ratio of the first information of the antenna and the reference signal-to-noise ratio exceeds a fifth preset threshold. If so, the first information received by the antenna is relayed and ignored. The reference signal-to-noise ratio includes the average value of the signal-to-noise ratios of the first information of the remaining N-1 antennas. Where N≥3, and N is an integer.

7. An implantable medical device, characterized in that, The device includes an electrically connected medical device body, a multi-antenna communication device, and a single-pole multi-throw switch. The medical device body is connected to a medical programmable device through the multi-antenna communication device. The multi-antenna communication device includes a microcontroller unit, a radio frequency signal processing unit, and several antennas; the single-pole multi-throw switch connects the radio frequency signal processing unit and the several antennas. The microcontroller unit is configured to control the single-pole multi-throw switch to switch several antennas according to a preset period, the working duration of each antenna, a preset timing sequence, and a preset frequency point corresponding to each antenna, so as to control the several antennas to receive first information; the first information includes the substantive content of the programmable device controlling the implantable medical device; The radio frequency signal processing unit is configured to receive the first information and to obtain second information based on the plurality of antennas and the first information received therefrom; wherein the second information includes one or more of the flight time, signal strength, and signal-to-noise ratio of the first information and the antenna information corresponding to the first information, and each piece of the first information corresponds to one antenna; The microcontroller unit is further configured to determine whether the first information received by each antenna is relayed based on a preset anti-relay strategy and several pieces of the second information; if so, the first information received by that antenna is ignored. The step of determining whether the first information received by each antenna is relayed based on a preset anti-relay strategy and several pieces of the second information includes: Step A: Based on the signal strength of the first information received by the antenna at the current time and the previous time, obtain the signal strength change amount and trend of the first information received by the antenna, and determine whether the trend of change is the same as the signal strength change trend of the first information of the other N-1 antennas. If yes, proceed to step B; if no, proceed to step C, where N≥3 and N is an integer. Step B: Determine whether the difference between the signal strength change of the first information of the antenna and the reference signal strength change exceeds a third preset threshold, wherein the reference signal strength change includes the average of the signal strength changes of the first information of the remaining N-1 antennas, and the signal strength of the first information received by the ignored antennas is no longer included in the calculation of the reference signal strength change. If yes, proceed to step C; otherwise, the first information received by the antenna has not been relayed. Step C: The first information received by the antenna is relayed, and the first information received by the antenna is ignored.

8. A medical system comprising a wireless medical device and a programmable control device connected by wireless communication, characterized in that, The wireless medical device includes the implantable medical device as described in claim 7; or, The wireless medical device includes an implantable medical device, and the wireless medical device and the programmable device are controlled against relay attacks using the anti-relay attack method described in any one of claims 1 to 6.

9. A computer-readable storage medium for an implantable medical device, characterized in that, The readable storage medium stores a computer program, which, when executed by a processor, implements the anti-relay attack method according to any one of claims 1 to 6.

Images