Method and system for managing access to an implantable medical device

Abstract

An external device for wireless communication with an implantable medical device can include a memory having stored thereon instructions for a first application and authentication credentials specific to the first application, and a processor configured to transmit the authentication credentials specific to the first application to the implantable medical device to authorize access to the implantable medical device by the first application. An external device for wireless communication with an implantable medical device can include a memory including authentication credentials stored thereon, and a processor configured to transmit the authentication credentials to the implantable medical device to authorize access, receive a request that facilitates authorization of a second device, and receive a second authentication credential from the second device, determine authentication or authorization of the second device, and transmit a token or authorization credential that directs the implantable medical device to authorize access by the second device.

Description

[0001] Cross-references to related applications

[0002] This application claims the benefit of U.S. Provisional Patent Application Serial No. 63 / 109,749, filed November 4, 2020, under 35 U.SC §119(e), which is incorporated herein by reference. Technical Field

[0003] This disclosure relates to the field of methods and systems for managing access to implantable medical devices from external devices. This disclosure also relates to methods and systems for managing access to implantable medical devices using authentication credentials. Background Technology

[0004] Implantable electrical stimulation systems have been proven therapeutically effective for various diseases and disorders. For example, deep brain stimulation systems have been used as a treatment for Parkinson's disease, essential tremor, and other conditions.

[0005] Stimulators have been developed to provide therapy for a variety of treatments. A stimulator may include an implantable pulse generator (IPG), one or more leads, and an array of stimulator electrodes on each lead. The stimulator electrodes are in contact with or near the nerve, muscle, or other tissue to be stimulated. The pulse generator in the IPG generates electrical pulses that are delivered to the body tissue by the electrodes.

[0006] Implantable medical devices (IMDs), including those with IPGs, typically have the ability to transmit data to external devices (such as clinician programmers or remote controllers) via radio frequency telemetry links or other wireless communication methods. Clinician programmers can program the operating parameters of the implantable medical device. Remote controllers can switch programs. Modern implantable devices also include the ability for bidirectional communication, enabling information to be transmitted from the implantable medical device to the clinician programmer or remote controller. Summary of the Invention

[0007] One aspect is an external device for wirelessly communicating with an implantable medical device. The external device includes: a memory storing instructions for a first application configured to interact with the implantable medical device and application-specific authentication credentials thereon; and a processor coupled to the memory and configured to perform actions including: executing the first application using the instructions; and transmitting application-specific authentication credentials to the implantable medical device for authorizing access to the implantable medical device by the first application.

[0008] In at least some aspects, the memory also stores thereon instructions for a second application configured to interact with an implantable medical device and authentication credentials specific to the second application. In at least some aspects, the authentication credentials specific to the first application include: an identifier of at least one specific implantable medical device or at least one specific type of implantable medical device to which the first application is configured to interact.

[0009] In at least some aspects, the authentication credentials specific to the first application include an endpoint entity certificate. In at least some aspects, the endpoint entity certificate includes an identifier of the first application in custom metadata or a certificate extension of the endpoint entity certificate.

[0010] In at least some aspects, the authentication credentials specific to the first application include: an identifier of at least one interactive capability of the first application relative to an implantable medical device. In at least some aspects, at least one of the at least one interactive capability is selected from reading data, writing data, selecting from an existing program, modifying the programming settings of an existing program, creating a program, modifying or updating software / firmware, or having full control. In at least some aspects, the authentication credentials specific to the first application include a terminal entity certificate, and the terminal entity certificate includes an identifier of the at least one interactive capability in custom metadata or certificate extensions of the terminal entity certificate.

[0011] On the other hand, there is a system that includes any of the external devices described above, as well as an implantable medical device configured to communicate with the external device.

[0012] In at least some aspects, the application-specific authentication credential includes an identifier of the implantable medical device within the authentication credential. In at least some aspects, the application-specific authentication credential includes an identifier of at least one interactive capability of the first application relative to the implantable medical device, and the implantable medical device is configured to restrict authorized access by the first application to the implantable medical device to at least one interactive capability identified in the authentication credential.

[0013] Another aspect is an external device for communicating with an implantable medical device. This external device includes: a memory including authentication credentials stored thereon; and a processor coupled to the memory and configured to perform the following actions: transmitting authentication credentials to the implantable medical device for authorizing access to the implantable medical device by the external device; receiving a request facilitating authorization of a second device by the implantable medical device, and receiving a second authentication credential from the second device; using the second authentication credential to determine authentication or authorization of the second device; and after authorization of the second device by the implantable medical device and determination of authentication or authorization of the second device, transmitting a token or authentication credential to at least one of the implantable medical device or the second device to instruct the implantable medical device to authorize access to the implantable medical device by the second device.

[0014] In at least some respects, the token or authorization credential is limited to a specific time period. In at least one respect, the token or authorization credential is limited to a single session.

[0015] The other aspect is a system comprising: any of the external devices described in the preceding two paragraphs, and a second device including a memory storing thereon a second application and second application credentials configured to interact with an implantable medical device, and a processor coupled to the memory and configured to perform actions including: executing the second application using instructions and transmitting a second authentication credential specific to the external device.

[0016] In at least some aspects, the memory of the external device also stores thereon instructions for a first application configured to interact with an implantable medical device, wherein authentication credentials are specific to the first application and identify at least one interactive capability of the first application relative to the implantable medical device, and wherein a second authentication credential identifies at least one interactive capability of a second application relative to the implantable medical device.

[0017] In at least some aspects, the token or authorization credential identifies at least one interactive capability of the first application. In at least some aspects, the token or authorization credential identifies at least one interactive capability of the second application.

[0018] In at least some aspects, the system also includes: an implantable medical device configured to wirelessly communicate with an external device and a second device. In at least some aspects, the implantable medical device is configured to: restrict authorized access to the second device based on an identifier of at least one interactive capability, such as a token or authentication credential. Attached Figure Description

[0019] Non-limiting and non-exhaustive embodiments of the invention are described with reference to the following accompanying drawings. In the drawings, unless otherwise stated, the same reference numerals refer to the same parts in each figure.

[0020] To better understand the present invention, reference will be made to the following detailed description, which should be read in conjunction with the accompanying drawings, in which:

[0021] Figure 1 This is a schematic diagram of one embodiment of an electrical stimulation system, which includes one or more leads that can be coupled to an IPG;

[0022] Figure 2 It is a block diagram of the components of an electrical stimulation system;

[0023] Figure 3 This is a diagram illustrating the authentication process between IPG and two external devices;

[0024] Figure 4 This is a diagram illustrating the authentication process between IPG and applications on two external devices;

[0025] Figure 5 This is a flowchart of one embodiment of a method for authorizing access to an IPG by an external device;

[0026] Figure 6 It is a diagram illustrating the authentication between IPG and external devices or applications of external devices, as well as the ability of external devices or applications to interact.

[0027] Figure 7 This is a flowchart of an embodiment of a method for authorizing access to the IPG by an external device and authorizing the interaction capabilities of an external device or an application on an external device;

[0028] Figure 8 This is a diagram illustrating how an authorized first external device authenticates a second external device, thereby authorizing access to the IPG by the second external device; and

[0029] Figure 9 This is a flowchart of an embodiment of a method for authorizing access to the IPG by the second external device by authenticating the second external device using an authorized first external device. Detailed Implementation

[0030] This disclosure relates to the field of methods and systems for managing access to implantable medical devices from external devices. This disclosure also relates to methods and systems for managing access to implantable medical devices using authentication credentials.

[0031] The systems and methods described herein can be used with any suitable implantable medical device instrument. Implantable medical stimulation systems and devices are used herein as examples of the invention, but it will be understood that these inventions can be used with other implantable medical devices. Examples of implantable electrical stimulation systems include, but are not limited to, at least one lead having one or more electrodes disposed along the distal end of the lead and one or more terminals disposed along the proximal end of the lead. Examples of electrical stimulation systems with leads can be found, for example, in U.S. Patent Nos. 6,181,969; 6,295,944; 6,391,985; 6,516,227; 6,609,029; 6,609,032; 6,741,892; 7,244,150; 7,450,997; 7,672,734; 7,761,165; 7,783,359; 7,792,590; 7,809,446; 7,949,395; 7,974,706; 8,831,742; 8,688,235; 817 5710; 8224450; 8271094; 8295944; 8364278; and 8391985; U.S. Patent Application Publication Nos. 2007 / 0150036; 2009 / 0187222; 2009 / 0276021; 2010 / 0076535; 2010 / 0268298; 2011 / 0004267; 2011 / 0078900; 2011 / 0130817; 2011 / 0130818; 201 1 / 0238129; 2011 / 0313500; 2012 / 0016378; 2012 / 0046710; 2012 / 0071949; 2012 / 0165911; 2012 / 0197375; 2012 / 0203316; 2012 / 0203320; 2012 / 0203321; 2012 / 0316615; 2013 / 0105071; 2011 / 0005069; 2010 / 0268 298; 2011 / 0130817; 2011 / 0130818; 2011 / 0078900; 2011 / 0238129; 2011 / 0313500; 2012 / 0016378; 2012 / 0046710; 2012 / 0165911; 2012 / 0197375; 2012 / 0203316; 2012 / 0203320; and 2012 / 0203321, all of which are incorporated in their entirety by reference.

[0032] Go to Figure 1One embodiment of the electrical stimulation system 10 includes one or more stimulation leads 12 and an implantable pulse generator (IPG) 14. The system 10 may also include one or more of an external remote control (RC) 16, a clinician's programmer (CP) 18, an external trial stimulator (ETS) 20, or an external charger 22. IPG and ETS are examples of control modules for an electrical stimulation system.

[0033] An IPG 14, optionally physically connected to one or more stimulation leads 12 via one or more lead extensions 24, carries a plurality of electrodes 26 arranged in an array. The IPG 14 includes a pulse generation circuit that delivers electrical stimulation energy to the electrode array 26 in the form of, for example, pulsed electrical waveforms (i.e., time-series electrical pulses) based on a set of stimulation parameters. The implantable pulse generator can be implanted into a patient, for example, below the patient's clavicle, in the patient's abdominal cavity, or at any other suitable site. The implantable pulse generator 14 can have multiple stimulation channels, which can be independently programmable to control the amplitude of the current stimulation from each channel. In some embodiments, the implantable pulse generator 14 can have any suitable number of stimulation channels, including but not limited to 4, 6, 8, 12, 16, 32, or more. The implantable pulse generator 14 can have one, two, three, four, or more connector ports for receiving terminals of the leads and / or lead extensions.

[0034] The ETS 20 may also, optionally, be physically connected to the stimulation lead 12 via a percutaneous lead extension 28 and an external cable 30. The ETS 20 (which may have a pulse generation circuit similar to that of the IPG 14) also delivers electrical stimulation energy to the electrode array 26 in the form of, for example, pulsed electrical waveforms, according to a set of stimulation parameters. One difference between the ETS 20 and the IPG 14 is that the ETS 20 is typically a non-implantable device, used experimentally after the neurostimulation lead 12 has been implanted and before the IPG 14 has been implanted to test the responsiveness to the stimulation to be provided. Any functionality described herein with respect to the IPG 14 can also be performed with respect to the ETS 20.

[0035] RC 16 can be used to telemetry communicate with or control IPG 14 or ETS 20 via one-way or two-way wireless communication link 32. Once IPG 14 and neurostimulation leads 12 are implanted, RC 16 can be used to telemetry communicate with or control IPG 14 via one-way or two-way communication link 34. Such communication or control allows IPG 14 to be turned on or off and programmed with different sets of stimulation parameters. IPG 14 can also be operated to modify the programmed stimulation parameters to actively control the characteristics of the electrical stimulation energy output by IPG 14. CP 18 allows users (such as clinicians) to program the stimulation parameters for IPG 14 and ETS 20 in the operating room and subsequent sessions. Alternatively or additionally, in at least some embodiments, the stimulation parameters can be programmed via wireless communication (e.g., Bluetooth) between RC 16 (or an external device, such as a handheld electronic device like a mobile phone, tablet, etc.) and IPG 14.

[0036] CP 18 can perform this function by indirectly communicating with IPG 14 or ETS 20 via RC 16 through wireless communication link 36. Alternatively, CP 18 can communicate directly with IPG 14 or ETS 20 via wireless communication link (not shown). The stimulation parameters provided by CP 18 are also used to program RC 16 so that the stimulation parameters can be subsequently modified by operating RC 16 in stand-alone mode (i.e., without the assistance of CP 18).

[0037] Additional examples of RC 16, CP 18, ETS 20, and external charger 22 can be found in the references cited herein and in U.S. Patent Nos. 6,895,280; 6,181,969; 6,516,227; 6,609,029; 6,609,032; 6,741,892; 7,949,395; 7,244,150; 7,672,734; and 7,761,165; 7,974,706; 8,175,710; 8,224,450; and 8,364,278; and U.S. Patent Application Publication No. 2007 / 0150036, all of which are incorporated herein by reference in their entirety.

[0038] Figure 2 This is a schematic overview diagram of one embodiment of the components of an electrical stimulation system 200, which includes components disposed in IPG 14 ( Figure 1 The electronic sub-component 210 within the ) will be understood. It will be understood that an electrical stimulation system may include more, fewer, or different components and may have a variety of different configurations, including those disclosed in the stimulator references cited herein.

[0039] IPG 14 ( Figure 1The device may include, for example, a power supply 212, an antenna 218, a receiver 202, a processor 204, and a memory 205. External devices (such as a CP or RC 206) may include a processor 207 and a memory 208. If desired, some components of the electrical stimulation system (e.g., power supply 212, antenna 218, receiver 202, processor 204, and memory 205) may be located in IPG 14. Figure 1 On one or more circuit boards or similar carriers within a sealed enclosure. Any power source 212 can be used, including, for example, batteries (such as primary or rechargeable batteries). Examples of other power sources include supercapacitors, nuclear or atomic batteries, mechanical resonators, infrared collectors, thermal power sources, bending power sources, bioenergy sources, fuel cells, bioelectric batteries, osmotic pumps, and the like, including those described in U.S. Patent No. 7,437,193, which is incorporated herein by reference in its entirety.

[0040] As an alternative, power can be supplied by an external power source via inductive coupling through optional antenna 218 or a secondary antenna. The external power source can be located in the device mounted on the user's skin, or in a unit that is permanently or periodically provided near the user.

[0041] If the power source 212 is a rechargeable battery, the battery can be recharged using an optional antenna 218, if needed. Power can be supplied to the battery for recharging by inductively coupling the battery through the antenna to a recharging unit 216 external to the user. Examples of this arrangement can be found in the references mentioned above.

[0042] In one embodiment, current is emitted from electrodes 26 on the lead body to stimulate nerve fibers, muscle fibers, or other body tissues near the electrical stimulation system. A processor 204 is typically included to control the timing and electrical characteristics of the electrical stimulation system. For example, if desired, the processor 204 can control one or more of the timing, frequency, amplitude, width, and waveform of the pulses. Additionally, if desired, the processor 204 can select which electrodes can be used to provide stimulation. In some embodiments, the processor 204 can select which electrodes(s) are cathodes and which electrodes(s) are anodes. In some embodiments, the processor 204 can be used to identify which electrodes provide the most useful stimulation to the desired tissue. Instructions for the processor 204 can be stored in memory 205. Instructions for the processor 207 can be stored in memory 208.

[0043] Any processor 204 can be used for the IPG, and can be as simple as an electronics device that generates pulses at regular time intervals, or the processor can be able to receive and interpret signals from the CP / RC 206 (such as...). Figure 1The processor 204 receives instructions (CP 18 or RC 16) that, for example, allow modification of pulse characteristics. In the illustrated embodiment, the processor 204 is coupled to the receiver 202, which is in turn coupled to an optional antenna 218. This allows the processor 204 to receive instructions from an external source, such as those instructing pulse characteristics and electrode selection, if needed. Any suitable processor 207 can be used for the CP / RC 206.

[0044] Any suitable memory 205, 208, including computer-readable storage media, may be used, including but not limited to volatile, non-volatile, non-transitory, removable, and non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks ("DVD") or other optical storage, magnetic tape cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible by a processor.

[0045] In one embodiment, antenna 218 is capable of receiving signals from CP / RC 206 (see [link]). Figure 1 The signal (e.g., an RF signal) of the CP / RC 206 (CP 18 or RC 16) is programmed by the user or otherwise operated. The signal transmitted to the processor 204 via the antenna 218 and receiver 202 can be used to modify or otherwise instruct the operation of the electrical stimulation system. For example, the signal can be used to modify the pulses of the electrical stimulation system, such as modifying one or more of the pulse width, pulse frequency, pulse waveform, and pulse amplitude. The signal can also instruct the electrical stimulation system 200 to stop operation, start operation, start charging the battery, or stop charging the battery. In other embodiments, the stimulation system does not include the antenna 218 or receiver 202, and the processor 204 operates as programmed.

[0046] Optionally, the electrical stimulation system 200 may include a transmitter (not shown) coupled to the processor 204 and the antenna 218 for transmitting signals back to the CP / RC 206 or another unit capable of receiving signals. For example, the electrical stimulation system 200 may transmit signals indicating whether the electrical stimulation system 200 is operating correctly or indicating when the battery needs to be charged or the remaining charge level in the battery. The processor 204 may also be able to transmit information about the pulse characteristics, allowing a user or clinician to determine or verify these characteristics.

[0047] Signal transmission can be performed using any suitable method, technology, or platform, including but not limited to inductive transmission, radio frequency transmission, and Bluetooth. TM Wi-Fi, cellular transmission, near-field transmission, infrared transmission, or any combination thereof. Additionally, the IPG can be wirelessly coupled to the RC or CP using any suitable arrangement, including direct transmission or transmission over a network (such as a LAN, WAN, the Internet, or any combination thereof).

[0048] Back Figure 1 The CP 18 or RC 16 (or other external devices) communicates with the IPG 14 using software applications. These software applications are typically custom-designed, and the instructions for the software applications may be stored in the memory of the CP, RC, or other external devices. In at least some embodiments, depending on their purpose, each software application may have the ability (or permission) to perform one or more of the following: read data, write data, select from existing programs, modify the programming settings of existing programs, create programs, modify or update software / firmware, have full control (which may include all the previously listed capabilities), or otherwise interact with the IPG, or any combination of these capabilities (or permissions).

[0049] It will also be understood that although the methods, techniques, and systems described herein are presented in the context of external devices (such as CP or RC) communicating with IPG, these methods, techniques, and systems can be used for communication and authentication between external devices and any medical device. Furthermore, while the methods, techniques, and systems described herein are presented in the context of electronic stimulation systems, it will be recognized that these methods, techniques, and systems can be used with optical stimulation systems or electrical / optical stimulation systems. Examples of optical stimulation systems or electrical / optical stimulation systems can be found in U.S. Patent Application Publications Nos. 2013 / 0317572; 2013 / 0317573; 2017 / 0259078; 2017 / 0225007; 2018 / 0110971; 2018 / 0369606; 2018 / 0369607; 2019 / 0209849; 2019 / 0209834; 2020 / 0094047; and 2020 / 0155854, as well as U.S. Patent Application No. 16 / 883,404, all of which are incorporated herein by reference in their entirety.

[0050] CP, RC, or other external devices can use any suitable authentication mechanism (such as certificate or credential authentication, encrypted messages, or both) to securely communicate with the IPG. In at least some embodiments, the authentication mechanism involves the external device (such as CP or RC) transmitting authentication credentials, such as a digital certificate (e.g., an end-entity certificate), to the IPG to authenticate the external device. The authentication credentials can be stored in the external device's memory. Once authenticated by the IPG, the IPG authorizes the external device to access the IPG. Examples of authentication credentials and authentication of medical devices by external devices are described in U.S. Patent No. 9,781,086, which is incorporated herein by reference in its entirety. In at least some embodiments, transmissions between the external device and the IPG are encrypted. Examples of encryption methods are described in U.S. Patent No. 8,706,251, which is incorporated herein by reference in its entirety. Any other suitable encryption methods and techniques may be used, including but not limited to public-key encryption (e.g., RSA encryption) or AES encryption.

[0051] Certificates or other authentication credentials are typically issued and signed by a trusted authority, such as a certification authority. An IPG (or other medical device) can authenticate the external device by comparing a certificate or other authentication credential received from an external device with a certificate or authentication credential that the IPG has already received from a trusted authority (which may be stored in the IPG's memory). In at least some embodiments, the authentication credential issued to the external device can identify one or more specific IPGs (e.g., by serial number, etc.) or one or more specific types of IPGs (e.g., by model or serial number range, etc., or any combination thereof).

[0052] In at least some embodiments, authentication and subsequent authorized access may be time-limited or session-limited. In at least some embodiments, after the time limit or session, the external device must be re-authenticated to be authorized to access the IPG. In at least some embodiments, authorized access to the IPG may also be limited by the number of connections, the duration of the connection, location, etc., or any combination thereof.

[0053] This article uses an endpoint entity certificate as an example of an authentication credential. However, it will be understood that any other suitable authentication credential may replace the endpoint entity certificate, and those credentials may include or be modified to include the elements described herein and be used in accordance with the methods described herein.

[0054] In at least some embodiments, the terminal entity certificate is organized according to the X.509 (e.g., X.509v3) certificate specification from the International Telecommunication Union (ITU). Any other suitable certificate type or specification may be used. The terminal entity certificate may include information such as: the certificate specification and version (e.g., X.509v3 certificate); the certificate serial number; the signature algorithm used to sign the certificate; the issuer name (e.g., the name of the certificate authority that issued the certificate); the certificate validity period (e.g., start date / time and end date / time); identification information about the terminal entity intended to receive the certificate (e.g., the certificate subject) (e.g., type, model, serial number, etc., or any combination thereof); the public key algorithm and public key used by the terminal entity; optional certificate extensions (such as constraints, certificate type, certificate policy, or custom metadata that may be provided by the manufacturer, supplier, or user of the external device or terminal entity); the certificate signing algorithm; the certificate signature, etc., or any combination thereof. Other certificates may contain more or fewer information elements.

[0055] In at least some embodiments, the terminal entity certificate (or other authentication credential) transmitted from an external device to a medical device such as an IPG is not specific to a particular application on the external device. However, the external device may have multiple applications stored thereon. For example, the external device may have different applications, allowing it to interact with different types of IPGs. In at least some embodiments, only a subset of those applications (e.g., only one or more, but not all) is suitable for any specific type of IPG with which the external device wishes to communicate. For example, a CP or RC may include a first application suitable for use with a first type of IPG and a second application suitable for use with a second type of IPG. This arrangement can be useful, preventing the CP or RC from being limited to use only with a specific type or type of IPG or other medical device.

[0056] As another example, a CP or RC may include a first application suitable for patient use and a second application suitable for clinician use. These applications may require an individual (e.g., a patient or clinician) to enter a password or other identifier to access the appropriate application. The first and second applications may have different capabilities. For example, the patient-accessible first application may allow the patient to choose from many different stimulation programs, but not to modify or create them. Conversely, the clinician-accessible second application may allow modification or creation of stimulation programs. This arrangement can be useful because it provides a single device with different capabilities for different users.

[0057] Since a specific CP or RC may have many different software applications, controlling which specific applications and devices are authorized to access a specific IPG can be useful. In at least some embodiments, application-specific terminal entity certificates (or other application-specific authentication credentials) are issued individually (or collectively for a subset of applications) to one or more (or all) applications on external devices. In at least some embodiments, the application-specific terminal entity certificate or (other application-specific authentication credentials) can securely transmit identity information about the application and external device to the IPG to obtain authorized access to the IPG. For example, the terminal entity certificate (or other authentication credentials) may contain information about the type or identity of the IPG with which the application is authorized to communicate, or information about the application or application type associated with the terminal entity certificate (or other authentication credentials). In at least some embodiments, this information may be included in custom metadata or other optional certificate extensions of the terminal entity certificate issued to the application and transmitted to the IPG.

[0058] In at least some embodiments, the IPG authenticates and positively identifies external devices and applications (or application types), and uses information provided in the terminal entity certificate (or other authentication credentials) to determine whether the external device and application (or application type) are authorized to access and communicate with the IPG. For example, the IPG may use information about one or more types or identities of the IPG with which the application is authorized to communicate, or information about the application or application type, to authorize access by external devices and applications identified in the terminal entity certificate (or other authentication credentials).

[0059] In at least some embodiments, an IPG terminates or blocks communication with an unauthenticated application or external device, and is therefore not authorized to communicate or interact with that IPG. For example, if the IPG identified in the terminal entity certificate (or other authentication credential) does not match the IPG receiving the terminal entity certificate (or other authentication credential), the IPG terminates or blocks communication with the application or external device, or terminates or blocks access by the application or external device. As another example, if the application identified in the terminal entity certificate (or other authentication credential) does not match the application authorized on the IPG receiving the terminal entity certificate (or other authentication credential), the IPG terminates or blocks communication with the application or external device, or terminates or blocks access by the application or external device.

[0060] Figure 3IPG 314, a first external device 350 (such as a CP or RC), and a second external device 354 (such as a CP or RC) are illustrated. The first external device 350 has an application associated with a first terminal entity certificate 352 (or other authentication credential), which may be an application-specific terminal entity certificate. The second external device 354 has an application associated with a second terminal entity certificate 356 (or other authentication credential), which may be an application-specific terminal entity certificate.

[0061] In the illustrated embodiment, the first terminal entity certificate 352 identifies IPG 314 within the first terminal entity certificate 352, and therefore, the first external device 350 is authenticated by IPG 314 using IPG certificate 351, and because the first external device is authorized to access the IPG, communication 358 continues between IPG 314 and the first external device 350. Conversely, the second terminal entity certificate 356 identifies a different IPG within the second terminal entity certificate 356, rather than IPG 314, and therefore, the second external device 354 is not authenticated by IPG 314, and communication 360 between the second external device 354 and IPG 314, or access to the IPG, is terminated or unauthorized.

[0062] Figure 4 IPG 314 and external device 350 are shown, the external device 350 having a first terminal entity certificate 352 specific to a first application and a second terminal entity certificate 356 specific to a second application (for ease of description, external device 350 is shown in...). Figure 4 (Shown twice). In at least some embodiments, a first application-specific first terminal entity certificate 352 identifies IPG 314 and the first application within the first terminal entity certificate 352, and therefore, the application is authenticated by IPG 314 using IPG certificate 351, and because the first application is authorized to access the IPG, communication 358 continues between IPG 314 and the first application. Conversely, a second application-specific second terminal entity certificate 356 identifies a different IPG within the second terminal entity certificate 356, not IPG 314, and therefore, the second application is not authenticated by IPG 314, and communication 360 between the second application and IPG 314 is terminated or unauthorized.

[0063] In other embodiments, in Figure 4In this process, IPG 314 identifies the first application as authorized to interact with IPG, and therefore, the application is authenticated by IPG 314 using IPG certificate 351. Because the first application is authorized to access IPG, communication 358 continues between IPG 314 and the first application. Conversely, if IPG 314 identifies the second application as not authorized to interact with IPG, the second application is not authenticated by IPG 314, and communication 360 between the second application and IPG 314 is terminated or unauthorized.

[0064] Figure 5 This is a flowchart of one embodiment of a method for authorizing access to an IPG (or other medical device) by an external device (such as an RC or CP). In step 502, the external device transmits authentication credentials (such as an terminal entity certificate) to the IPG (or other medical device). In at least some embodiments, the authentication credentials may be application-specific. In step 504, the IPG (or other medical device) authenticates the received authentication credentials. In step 506, the IPG (or other medical device) determines from the received authentication credentials whether access by the external device or its application is authorized. If yes, in step 508, access by the external device or its application is authorized. If no, in step 510, communication with the external device is terminated, or access by the external device or its application is blocked.

[0065] In at least some embodiments, the external device may include more than one application capable of connecting to the IPG. In at least some embodiments, these applications each have one or more interaction capabilities relative to the IPG, and these interaction capabilities may differ between the applications. The term "permission" may be used interchangeably with the term "capability." Examples of interaction capabilities include, but are not limited to, reading data, writing data, selecting from an existing program, modifying the programming settings of an existing program, creating a program, modifying or updating software / firmware, full control (which may include all the previously listed capabilities), and any combination thereof.

[0066] As an example, one application may be authorized only for read capabilities, while another application may be authorized for full control capabilities. Other examples include: i) patient applications with, for example, read and program selection capabilities; ii) clinician applications with, for example, read, write, program selection, modification of existing program programming settings, and program creation (or even full control); and iii) manufacturer applications with, for example, full control or read, write, and software / firmware update capabilities. Other applications, including other patient, clinician, or manufacturer applications, may have different interactive capabilities or sets of interactive capabilities.

[0067] Each application is limited to the interactive capabilities authorized for that application. Examples of other interactive capabilities or limitations may include, for example, security-based restrictions, clinician-controlled settings, and remote treatment adjustments.

[0068] In at least some embodiments, the application-specific endpoint entity certificate (or other application-specific authentication credential) may include information about the application's interactive capabilities. For example, information about the application's interactive capabilities may be included in custom metadata or other certificate extensions of the endpoint entity certificate issued to the application and passed to the IPG. In at least some embodiments, the interactive capabilities in the application-specific endpoint entity certificate (or other application-specific authentication credential) include all interactive capabilities that the application is capable of performing. In at least some embodiments, interactive capabilities may be determined or limited by (or given to) the signing entity of the endpoint entity certificate (or other authentication credential) (e.g., a certificate authority or subcertificate authority).

[0069] In other embodiments, the interactive capabilities in an application-specific terminal entity certificate (or other application-specific authentication credentials) may not include all interactive capabilities the application is capable of, but only a subset of those capabilities. For example, an application may be used by both a patient and a clinician, but the application on the patient's RC may have a terminal entity certificate (or other application-specific authentication credentials) that only includes, for example, read and program selection capabilities. The application on the clinician's CP may have a terminal entity certificate (or other application-specific authentication credentials) that includes, for example, read, write, program selection, modifying the programming settings of existing programs, and creating programs (or even full control).

[0070] Alternatively, in at least some embodiments, the terminal entity certificate (or other authentication credential) for an external device may specify the interactive capabilities for all applications using that external device. For example, the RC may have a terminal entity certificate (or other application-specific authentication credential) that only has capabilities such as reading and program selection. The CP may have a terminal entity certificate (or other application-specific authentication credential) that only has capabilities such as reading, writing, program selection, modifying programming settings of existing programs, and creating programs (or even full control).

[0071] In at least some embodiments, the IPG uses an endpoint entity certificate (or other authentication credentials) to authenticate or verify application capabilities. In at least some embodiments, the IPG authenticates or verifies the application's interactive capabilities by identifying the capabilities listed within custom metadata of the application-specific endpoint entity certificate or other certificate extensions.

[0072] In at least some embodiments, the IPG allows or authorizes access to the IPG based on the interactive capabilities listed for the application or external device in the terminal entity certificate (or other credentials). For example, if the application interactive capabilities in the terminal entity certificate (or other authentication credentials) only allow read access, the IPG will block write operations.

[0073] Figure 6 IPG 614, a first external device 650 (such as an RC), a second external device 654 (such as a CP), and a third external device 662 (such as a second RC) are illustrated. The first external device 650 has an application associated with an application-specific first terminal entity certificate 652 (or other authentication credential). The second external device 654 has a second terminal entity certificate 656 (or other authentication credential) for the second external device. The third external device 662 has a third terminal entity certificate 652 (or other authentication credential) for the third external device.

[0074] In the illustrated embodiment, an application-specific first terminal entity certificate 652 identifies IPG 614 within the first terminal entity certificate 652 and instructs such application to have read-only capabilities. Therefore, the application of the first external device 650 is authenticated by IPG 614 using IPG certificate 651, and because the application of the first external device is authorized to access the IPG, communication 658 continues between IPG 614 and the application of the first external device 650. However, the application of the first external device 650 only has read-only capabilities.

[0075] The second terminal entity certificate 656 identifies IPG 614 within the second terminal entity certificate 656 and instructs the second external device 654 to have full control. Therefore, the second external device 654 is authenticated by IPG 614 using IPG's certificate 651, and because the second external device is authorized to access IPG, communication 660 continues between IPG 614 and the second external device 654. The second external device 654 has full control over its application.

[0076] The third terminal entity certificate 664 identifies IPG 614 within the second terminal entity certificate 664 and instructs the third external device 664 to have the ability to read, write, and modify the programming settings of existing programs, as well as to create programs. Therefore, the third external device 664 is authenticated by IPG 614 using IPG certificate 651, and because the third external device is authorized to access the IPG, communication 666 continues between IPG 614 and the third external device 664. The application of the third external device 654 has the ability to read, write, and modify the programming settings of existing programs, as well as to create programs.

[0077] Figure 7This is a flowchart of one embodiment of a method for authorizing access to an IPG (or other medical device) by an external device. In step 702, the external device transmits authentication credentials (such as an end-entity certificate) to the IPG (or other medical device). The authentication credentials include indications of one or more interactive capabilities of the external device or one or more applications of the external device. In at least some embodiments, the authentication credentials may be application-specific. In step 704, the IPG (or other medical device) authenticates the received authentication credentials. In step 706, the IPG (or other medical device) determines from the received authentication credentials whether access by the external device or its application is authorized. If yes, in step 708, access by the external device or its application is authorized. If no, in step 710, communication with the external device is terminated, or access by the external device or its application is blocked.

[0078] In step 712, it is determined whether an external device (or its application) is interacting with the IPG. If so, in step 714, the IPG determines whether the interaction falls within the interaction capabilities specified in the authentication credentials. If yes, in step 716, the IPG and the external device continue interacting. If not, in step 718, the IPG blocks the interaction.

[0079] In some embodiments, an authorized first external device may facilitate authentication or authorization of a second external device. For example, an RC authorized to access an IPG using authentication credentials as described above may facilitate authentication or authorization of a CP to provide authorized access to the IPG by the CP. This can be particularly useful, for example, when the RC (which is intended to communicate with a specific IPG) has authorization credentials for the designated IPG while the CP (which is intended to communicate with any suitable IPG) does not.

[0080] In at least some embodiments, a first external device may present authentication credentials to the IPG (or other medical device) to obtain authorized access to the IPG, as described above. A second external service presents authentication credentials to the first external device, which verifies the credentials. For example, the first external device may compare authentication credentials from the second external device with authentication credentials on its own device (e.g., a certificate from a trusted authority). Upon verification, the first external device provides a token or other authorization credential to the IPG or the second external device, authorizing access to the IPG by the second external device.

[0081] Figure 8IPG 814, a first external device 850 (such as RC), and a second external device 854 (such as CP) are shown. The first external device 850 has a first authentication credential 852 (such as a first terminal entity certificate), which may be an application-specific authentication credential. The second external device 854 has a second authentication credential 856, which may be an application-specific authentication credential.

[0082] In the illustrated embodiment, the first authentication credential 852 identifies IPG 814 within the first authentication credential 852, and therefore the first external device 850 is authenticated by IPG 814 using IPG's certificate 851, and because the first external device is authorized to access IPG, communication 858 continues between IPG 814 and the first external device 850.

[0083] The second external device 854 does not possess the authentication credentials specified for IPG 314, therefore it cannot directly authenticate using IPG. The second external device 854 communicates with the first external device 850 860 and presents a second authentication credential 856 to the first external device. The first external device 850 uses the second authentication credential 856 to authenticate the second external device 854 and authorizes access to IPG 314, which may be based on authorized access already obtained by the first external device using its own first authentication credential 852. The first external device 850 provides a token or other authorization credential to the second external device 854 or IPG 314, enabling the second external device to communicate with IPG 314 862 and have authorized access to IPG 314.

[0084] In some embodiments, the interactive capabilities described above can be specified in one or both of the first authentication credential 852 and the second authentication credential 856. In at least some embodiments, the first external device 850 can authorize any interactive capability specified in the second authentication credential 856. In at least some embodiments, the first external device 850 can authorize only those interactive capabilities specified in the first authentication credential 852.

[0085] Figure 9This is a flowchart of one embodiment of a method for authorizing access to an IPG (or other medical device) by authorizing access to a second external device using a first external device. In step 902, the first external device transmits authentication credentials (such as an terminal entity certificate) to the IPG (or other medical device). In at least some embodiments, the authentication credentials may be application-specific. In step 904, the IPG (or other medical device) authenticates the received authentication credentials to authorize access by the first external device (e.g., see the method described above). In step 906, the second external device transmits authentication credentials to the first external device. In step 908, the first external device authenticates the authentication credentials received from the second external device to authorize access to the IPG by the second external device. In step 910, the first external device provides a token or other authorization credential to the second external device or the IPG, or both. In step 912, the IPG and the second external device use the token or other authorization credential for authorized access to the IPG by the second external device.

[0086] In at least some embodiments, the token or other authorization credential may be time-limited, session-limited, or subject to any other suitable restriction. Such restriction may be imposed by a first external device, an IPG, or a second external device, or any combination thereof.

[0087] Any system or method described herein may also incorporate two-factor authentication. For example, the system or method may also require a user to provide identification to an external device, such as a password, fingerprint, or code sent to another user's device, or any combination thereof. In at least some embodiments, the IPG may require two-factor authentication by entering a password or by applying a magnet near the IPG. For example, the IPG may require a specified on-off sequence of steps for the second authentication factor, where "on" indicates that the magnet is near the IPG, and "off" indicates that the magnet has been removed from the vicinity of the IPG. An example of such a sequence could be "on"-"off"-"on".

[0088] In at least some embodiments, the patient can provide a fingerprint, password, or other identifier to register a first external device (such as an RC) with the patient. The first external device can provide a fingerprint, password, or other identifier to the IPG. Subsequently, each second external device to be authenticated by the IPG will also provide a fingerprint, password, or other identifier, as well as other authentication credentials, to prove that the patient has consented to access the IPG. In at least some embodiments, the patient can request the first external device to provide a fingerprint, password, or other identifier to the second external device. Such a request may require the patient to provide or enter a fingerprint, password, or other identifier to the first external device.

[0089] It will be understood that each box in the flowchart illustration, and combinations of boxes in the flowchart illustration with the methods disclosed herein, can be implemented by computer program instructions. These program instructions can be provided to a processor to manufacture a machine or engine, such that instructions executing on the processor create instructions for implementing the processes disclosed herein. Figure 1 The means for specifying actions in one or more frames or engines. Computer program instructions can be executed by a processor to cause a series of operational steps performed by the processor to produce a computer-implemented process. The computer program instructions can also cause at least some operational steps to be performed in parallel. Furthermore, some steps can be performed on more than one processor (such as in a multiprocessor computing device). Additionally, without departing from the scope or spirit of the invention, one or more processes can be performed simultaneously with other processes, even in a different order than illustrated.

[0090] Computer program instructions may be stored on any suitable computer-readable medium, including but not limited to RAM, ROM, EEPROM, flash memory or other storage technologies, CD-ROM, Digital Universal Disc (“DVD”) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible by a computing device. Computer program instructions may be stored locally or remotely (e.g., in the cloud).

[0091] The foregoing description and examples provide a depiction of the arrangement and use of the invention. Because many embodiments of the invention can be made without departing from its spirit and scope, the invention is also subject to the appended claims.

Claims

1. An external device for wirelessly communicating with an implantable medical device, the external device comprising: A memory, the memory including a first authentication credential stored thereon; as well as A processor, coupled to the memory, and configured to perform the following actions: The first authentication credential is transmitted directly to the implantable medical device for authorizing access to the implantable medical device by the external device, wherein the first authentication credential includes a first certificate issued to the external device by a certificate authority, wherein the first certificate identifies the external device; Receive a request to facilitate authorization of the second device by the implantable medical device, and receive a second authentication credential from the second device, wherein the second authentication credential includes a second certificate issued to the second device by a certificate authority, wherein the second certificate identifies the second device; Use the second authentication credential to determine the authentication or authorization of the second device; and After the implantable medical device authorizes the external device and determines the authentication or authorization of the second device, a token or third authorization credential is transmitted to at least one of the implantable medical device or the second device to instruct the implantable medical device to authorize direct access to the implantable medical device by the second device, such that both the external device and the second device are authorized to direct access to the implantable medical device.

2. The external device according to claim 1, wherein, The token or third-party authorization credential is limited to a specific time period.

3. The external device according to claim 1, wherein, The token or third-party authorization credential is limited to a single session.

4. A system comprising: External device according to any one of claims 1 to 3; as well as The second device, including A memory, on which instructions for a second application and the second authentication credential are stored, the second application being configured to interact with an implantable medical device, and A processor, coupled to the memory, and configured to perform the following actions: The second application is executed using the instructions; and The second authentication credential is transmitted to the external device.

5. The system according to claim 4, wherein, The external device's memory also stores instructions thereon for a first application configured to interact with an implantable medical device. The first authentication credential is specific to the first application and identifies at least one interaction capability of the first application relative to the implantable medical device. The second authentication credential identifies at least one interactive capability of the second application relative to the implantable medical device.

6. The system according to claim 5, wherein, The token or third authorization credential identifies at least one interactive capability of the first application.

7. The system according to claim 5, wherein, The token or third authorization credential identifies at least one interactive capability of the second application.

8. The system according to claim 5, wherein, The token or third authorization credential identifies at least one interactive capability between the first application and the second application.

9. The system according to claim 4, further comprising: The implantable medical device is configured to communicate wirelessly with the external device and the second device.

10. The system according to claim 9, wherein, The implantable medical device is configured to restrict authorized access to the second device based on an identifier of at least one of the interactive capabilities of the token or a third authorization credential.

Images