Dental system, device and method for secure communication of user applications

Abstract

According to an embodiment, a dental system and a method of ensuring secure communication of a user application installed on an external device of the dental system are provided. Ensuring secure communication of a user application includes obtaining inquiry data in a server device; transmitting the query data from the server device to a user application installed on the external device; sending an inquiry request containing inquiry data to the in-port scanning device from the user application program; receiving a query response containing response data from the intra-oral scanning device; forwarding the response data from the user application to the server device; validating the response data in the server device based on the query data; also, if the verification of the response data is successful, the user application is approved in the server device.

Description

Technical Field

[0001] The present disclosure relates to a dental system including a server device and an intraoral scanning device system, wherein the intraoral scanning device system includes an intraoral scanning device and an external device. Specifically, the present disclosure relates to a device for ensuring secure communication of a user application on an attached external device of a dental system including an intraoral scanning device, and a method for ensuring secure communication of a user application on an attached external device of a dental system including an intraoral scanning device. Background Art

[0002] The functionality of intraoral scanning devices has become increasingly advanced. Wireless communications between intraoral scanning devices and external devices such as clinical computers, scanning computers, dental software on computers, and custom computers have been developed. Typically, the wireless communication interface of an intraoral scanning device uses an interface based on open standards. However, this presents many challenges in terms of security. An intraoral scanning device may assume that any input data is legitimate and may allow memory to be written or altered by unauthorized parties. Any such attack may result in malfunction of the intraoral scanning device, or a battery drain attack may occur.

[0003] However, the intraoral scanning device is a small device with strict limitations in computing power, storage space, etc. Therefore, the device communicating with the intraoral scanning device cannot use the readily available security algorithms and protocols, which poses risks such as draining the battery of the intraoral scanning device or reducing the function of the intraoral scanning device, making intraoral scanning almost useless.

[0004] Existing intraoral scanning devices are part of a service infrastructure that includes intraoral scanning devices, scanning software for specific services, and communication between service providers. Services may include, for example, manufacturing braces, retainers, crowns, implants, braces, mouth guards, etc. In order to improve the availability of such infrastructure to dentists, a minimum interaction between the infrastructure and the dentist is required. One way to achieve this is by applying wireless communication between the intraoral scanning device and an external computer that is connected to a server that can forward the intraoral scan data to the service provider. The patient's scan data can be characterized as personal information, and therefore, any risk of a third party stealing or destroying at least the scan data, etc., needs to be minimized. The scan data is characterized as personal information, and, in some cases, other types of personal information (such as age, gender, location address, personal security number, etc.) are associated with the scan data. In this example, the security of wireless communication in the service infrastructure needs to be improved. Summary of the invention

[0005] It is an object of one aspect of the present disclosure to provide an apparatus, device and method for providing improved security for dental system communications.In addition, there is a need for apparatus and methods to reduce the risk of intraoral scanning devices and intraoral scanning functions being compromised by unauthorized parties.

[0006] Another aspect of the invention aims to reduce the risk of a third party accessing any part of an intraoral scanning device.There is a need for an intraoral scanning device that prevents unauthorized modifications to the intraoral scanning device and its operation.

[0007] Another aspect of the present disclosure is to improve the security of dental system communications. The dental system includes a server device, an external device and an intraoral scanning device, the external device having a user application installed thereon. The server device can be controlled by the manufacturer of the intraoral scanning device. The server device can be a distributed server device, that is, a server device with distributed processors. That is, the methods, user applications and server devices disclosed herein can make dental system communications robust against security threats, vulnerabilities and attacks by implementing appropriate security measures and countermeasures (such as security mechanisms) to resist threats and attacks. The present disclosure relates to dental system communications that are robust against replay attacks, unauthorized access, battery depletion attacks and man-in-the-middle attacks.

[0008] Another aspect of the present disclosure is to improve the security of an intraoral scanning device. Security includes assessing threats, vulnerabilities, and attacks, and developing appropriate security measures and countermeasures to prevent threats and attacks. The present disclosure relates to an intraoral scanning device including a processing unit, the processing unit being configured to process intraoral scan data of a patient and provide two-dimensional image data and / or three-dimensional image data.

[0009] An important advantage of the present disclosure is that the risk of sensitive user data (eg, intraoral scanning device settings and / or user-specific software updates) being sent or shared to a third-party user application or a compromised user application is greatly reduced or eliminated.

[0010] In addition, the present disclosure allows intraoral scanning device manufacturers to securely save and maintain updated and correct information about user applications. Further, a server device or intraoral scanning device manufacturer can save updated user application information and link the user application with a specific intraoral scanning device.

[0011] According to these aspects, a method for ensuring secure communication of a user application installed on an external device of a dental system is disclosed, the dental system including an intraoral scanning device, a server device, and an external device. Ensuring secure communication of the user application includes obtaining query data in the server device; sending the query data from the server device to the user application installed on the external device; sending a query request including the query data from the user application to the intraoral scanning device; receiving a query response including response data from the intraoral scanning device; forwarding the response data from the user application to the server device; verifying the response data in the server device based on the query data; and approving the user application in the server device if the verification of the response data is successful.

[0012] According to this aspect, a dental system is disclosed, which includes a server device and an intraoral scanning device system. The intraoral scanning device system includes an external device and an intraoral scanning device, and the server device is configured to ensure secure communication of a user application installed on the external device. The server device can be configured to approve the user application, wherein approving the user application includes obtaining query data; sending the query data to the user application; receiving a response message containing response data from the user application, the response data containing an intraoral scanning device identifier; verifying the response data based on the query data; and approving the user application if the response data is verified. The external device may include a processing unit, a memory unit; and a wireless interface, wherein the user application is configured to ensure secure communication of the user application. Ensuring secure communication of the user application may include obtaining query data from the server device; sending a query request containing query data to the intraoral scanning device of the intraoral scanning device system; receiving a query response containing response data from the intraoral scanning device; and forwarding the response data to the server device.

[0013] As used herein, the term "identifier" refers to a piece of data that is used to identify (e.g., for classification) and / or uniquely identify. An identifier can be in the form of a word, number, letter, symbol, list, array, or any combination thereof. For example, an identifier such as a number can be in the form of an integer, such as an unsigned integer, uint, having a length of, for example, 8 bits, 16 bits, 32 bits or more bits, such as an array of unsigned integers. An identifier can have a length of multiple bytes. For example, an intraoral scanning device identifier can have a length of 20 bytes.

[0014] The external device includes a memory unit and a wireless interface connected to the processing unit, respectively. The memory unit may include removable and non-removable data storage units, including but not limited to read-only memory (ROM), random access memory (RAM), etc. The memory unit has a user application stored thereon. The wireless interface includes an antenna and a wireless transceiver, for example, configured to communicate wirelessly at a frequency within the range of 2.4 GHz to 2.5 GHz or 2.4 GHz to 5 GHz or about 2.45 GHz or about 5 GHz. The wireless interface can be configured to communicate, for example wirelessly, with an intraoral scanning device including an antenna and a wireless transceiver.

[0015] The user application may be dental software configured to operate the intraoral scanning device.The user application may be dental software configured to receive two-dimensional image data and / or three-dimensional image data and visualize the image data in real time on a graphical user interface.

[0016] The method includes obtaining query data in a server device. Obtaining the query data may include generating the query data, for example, generating the query data based on a default query value and / or a time stamp. Therefore, the server device may be configured to generate the query data, for example, based on a default query value and / or a time stamp. The server device may be configured to generate the query data at a certain time interval (for example, every 5 minutes, every 10 minutes, or every 30 minutes). Although a shorter time between the generation of (different) query data can improve security, a too short time between the generation of (different) query data may place excessive timing requirements on the user application / intraoral scanning device, which in turn may lead to unnecessary false verifications and require the generation of power-consuming query responses in the intraoral scanning device. The query data may be random or pseudo-random. The query data may include at least 8 bytes, for example at least 16 bytes. The query data may be a 16-byte value. The server device may be configured to generate the query data based on a lookup table and / or a function (for example, with a time stamp as an input). Obtaining the query data based on the time stamp value allows and / or provides the query data with a built-in validity period. Obtaining the query data at a given time interval allows and / or provides the query data with a built-in validity period.

[0017] The present disclosure relates to secure communication between entities of a dental system. The dental system includes a server device and an intraoral scanning device system, and the intraoral scanning device system includes an external device and an intraoral scanning device. The external device forms a communication device that communicates with the intraoral scanning device. The external device is usually paired or wirelessly coupled with the intraoral scanning device.

[0018] Obtaining the query data may include storing the query data in the server device. The server device may be configured to delete the query data after verifying the response data. The method may include deleting the query data after a certain period of time and / or replacing the query data with new query data.

[0019] The method includes sending query data from a server device to a user application.

[0020] The method includes sending a query request including query data from a user application to an intra-oral scanning device.

[0021] The method includes receiving a query response, for example in a user application, the query response including response data from an intra-oral scanning device. The response data may include at least 8 bytes, for example at least 16 bytes or at least 32 bytes. The response data may have a length in the range of 16 to 72 bytes. The response data may include an intra-oral scanning device identifier. The response data may include a key identifier for enabling a server device to use or apply correct key material when verifying the response data. The response data may include intra-oral scanning device query data generated in the intra-oral scanning device.

[0022] The response data includes a response value (e.g., an inquiry response value) and / or intraoral scanning device data. The response data may include a checksum value based on the response value and / or the intraoral scanning device data. The response value may be based on the inquiry data and / or the intraoral scanning device data, such as an intraoral scanning device identifier. The response value may be generated based on one or more of the inquiry data from the server device, the intraoral scanning device key identified by the key identifier, the intraoral scanning device identifier, and the intraoral scanning device inquiry data. The response value may be based on a static string. The response value may be encrypted using one or more inquiry data from the server device, the key identified by the key identifier, the intraoral scanning device identifier, and the intraoral scanning device inquiry data as key material.

[0023] The method includes forwarding response data, such as in a response message, from a user application to a server device. Verifying the response data, such as a response value of the response data, in the server device based on the query data. Verifying the response data in the server device based on the query data may include, for example, calculating the query data based on a default query value and / or a time stamp. Verifying the response data in the server device based on the query data may include retrieving the query data from a memory of the server device. Verifying the response data in the server device may be based on an intraoral scanning device query data of the response data. Verifying the response data in the server device may be based on an intraoral scanning device identifier of the response data. Verifying the response data may include calculating a verification value based on the query data from the server device and / or an intraoral scanning device identifier of the response data, a key identified by a key identifier, and one or more of the intraoral scanning device query data. Verifying the response data may include comparing the verification value with the response value. If the verification value corresponds to the response value, the response data may be verified (verification successful).

[0024] The method optionally includes, if the verification response data is successful, approving the user application in the server device. Thus, if the verification response data is successful, the server device considers the user application as a trusted entity in the system. In other words, if the verification response data is successful, it can be said that the user application is whitelisted in the server device.

[0025] The method may optionally include, if the verification response data fails, disapproving the user application in the server device. Thus, if the verification response data succeeds, the server device may treat the user application as an untrusted entity in the system. If the verification response data fails, for example if the verification response data fails a plurality of times (e.g., two, three or more times), the user application may be blacklisted in the server device, for example for a period of time. The method may include, if the verification response data fails, setting the user application status identifier to a value indicating that the user application is not approved.

[0026] The method may include determining response data in the intraoral scanning device, or at least determining its response value, based on the query data and / or the intraoral scanning device identifier of the intraoral scanning device. Therefore, the intraoral scanning device can be configured to generate response data based on the query data and / or the intraoral scanning device identifier. The response data (e.g., the response value) based on the intraoral scanning device identifier enables the server device to authenticate the intraoral scanning device. The response data optionally includes or indicates the intraoral scanning device identifier. Therefore, the server device is able to identify a specific intraoral scanning device.

[0027] In the method, receiving a challenge response including response data from an intra-oral scanning device may be performed by a user application.

[0028] In the method, approving the user application includes setting a user application state identifier to a value indicating that the user application is approved.

[0029] The method may include, if validating the response data is successful, linking the user application to the intra-oral scanning device, such as to an intra-oral scanning device identifier of the intra-oral scanning device, in a memory of the server device.

[0030] The method may include sending a request for interrogation data from the user application. Thus, for example, if the user application is updated and / or if the external device and / or the user application is restarted, the user application and / or the intraoral scanning device can initiate a secure communication between the user application and the server device, thereby increasing the level of security.

[0031] If a first approval criterion is met (e.g., in the user application), a request for query data may be sent. The first approval criterion may include, for example, determining in the user application whether the user application has been previously approved, wherein the first approval criterion is met if the user application has not been previously approved. The first approval criterion may be met if the user application is started for the first time (e.g., after installing the user application and / or after powering the external device back on). The first approval criterion may be met if the user application has been updated to a new version.

[0032] The method may include storing an approval time stamp indicating the last approval time; determining whether a second approval criterion based on the approval time stamp is met; and initiating secure communication of the user application if the second approval criterion is met. This ensures that the server device approves / disapproves the user application at a certain frequency, further improves the security of the dental system by maintaining an updated user application database in the server device, and optimizes dental system communication.

[0033] In the method, approving the user application may include sending intraoral scanning device settings specific to the intraoral scanning device to the user application. Approving the user application may include sending intraoral scanning device operating parameters specific to the intraoral scanning device to the user application.

[0034] The method may include not approving or rejecting the user application if no response data is received within an approval period (e.g., from obtaining the query data or sending the query data). In one or more exemplary server devices / methods, the length of the approval period may be determined by the frequency of determining new query data. In one or more exemplary devices / methods, the query data is calculated or generated at a given time interval (e.g., every 5 minutes or every 10 minutes).

[0035] The method may include establishing a secure session between the user application and the intraoral scanning device, and optionally sending a challenge request in the secure session, such as an integrity-protected, encrypted, authenticated and / or mutually authenticated session. A challenge response may be received in the secure session.

[0036] The method may include establishing a secure session between the server device and the user application, such as an integrity protected, encrypted, authenticated and / or mutually authenticated session, and optionally sending the challenge data in the secure session. The response data may be forwarded from the user application to the server device in the secure session.

[0037] The server device may be configured to determine whether an approval criterion is satisfied, the server device being configured to initiate secure communication of the user application if the approval criterion is satisfied, wherein the approval criterion comprises a first approval criterion and a second approval criterion, and wherein the approval criterion is satisfied if the first approval criterion and / or the second approval criterion are satisfied. The second approval criterion may be satisfied if the time since the last approval is longer than an approval time threshold (e.g., one or more days, e.g., 7 days, 14 days). Thus, approving user applications at a minimum frequency may be employed to ensure that user application data is updated in the server device.

[0038] The present disclosure also relates to a user application for an external device of a dental system. The external device may be a tablet computer, a dental clinic computer, or a computer. When installed on the external device, the user application is configured to ensure secure communication of the user application.

[0039] The user application may be configured to determine whether a first approval criterion is met, and, if the first approval criterion is met, initiate secure communication of the user application, and wherein obtaining the query data comprises sending a request for the query data to the server device. The request for the query data is a message requesting the server device to send the query data to the user application. Thus, the user application and / or the intraoral scanning device (via the user application) may actively initiate approval of the user application in the server device.

[0040] By enabling dental system entities to initiate secure communication of user applications, the approval process can be optimized, for example by having the approval process only be initiated when necessary or when justified by changes in different entities in the dental system.

[0041] Methods for controlling access to intraoral scanning device services:

[0042] An object of one aspect of the present disclosure is to provide a client device and a method that attempts to mitigate, alleviate or eliminate one or more of the above-mentioned deficiencies and disadvantages in the art, either alone or in any combination.

[0043] Another aspect of the present disclosure aims to improve the security of wireless communications with an intraoral scanning device to protect the intraoral scanning device from potential attacks, such as providing an improved client device and a method for communicating with an intraoral scanning device to improve its security.

[0044] It is an object of yet another aspect of the present disclosure to provide a method of operating an intra-oral scanning device, wherein access of a client device to an intra-oral scanning service is controlled in an efficient manner.

[0045] According to these aspects, a method of controlling access of a client device to a service of an intra-oral scanning device is disclosed. The method may include the following steps: requesting access of the client device to the service of the intra-oral scanning device by providing a client device authenticator to the intra-oral scanning device; authenticating the client device based on confirmation of the provided client device authenticator by the intra-oral scanning device. In addition, the method may include, upon successful authentication, comparing a security level associated with the service requested by the client device with a highest security level assigned to the client device by the intra-oral scanning device, wherein the security level is selected from a plurality of hierarchical security levels; and granting the client device access to the service of the intra-oral scanning device if the requested security level is less than or equal to the highest security level assigned to the client device.

[0046] The present disclosure is beneficial in that it allows for service access control to be implemented on the intraoral scanning device at runtime without the need for an external entity, and it provides client-specific service access while having low resource requirements, considering that the resources of intraoral scanning devices are typically limited, especially in terms of storage space, power consumption, and computational workload. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Various aspects of the present disclosure can be best understood by reading the following detailed description in conjunction with the accompanying drawings. For clarity, the drawings are schematic and simplified, and they only show details used to improve the understanding of the claims, while other details are omitted. In this document, the same figure numbers are used for the same or corresponding parts. The various features of each aspect can each be combined with any or all features of the other aspects. These and other aspects, features and / or technical effects will become apparent from the illustrations described below and will be explained with reference to these illustrations, in which:

[0048] Figure 1 A dental system is schematically shown;

[0049] Figure 2 An exemplary signal diagram is shown;

[0050] Figure 3 is a flow chart of an exemplary method of the present invention;

[0051] Figure 4 An exemplary server device is schematically shown;

[0052] Figure 5 It shows the access of various clients to the intra-oral scanning device service according to the prior art;

[0053] Figure 6 is similar to Figure 5 , but with client-specific intraoral scanning device service access controls implemented;

[0054] Figure 7 is a block diagram of an intraoral scanning device wirelessly connected to an external device;

[0055] Figure 8 is an example of a message sequence chart, in which a user of an intra-oral scanning device authorizes an intra-oral scanning device service to the intra-oral scanning device by making a gesture to the intra-oral scanning device;

[0056] Fig. 9 Shows Figure 8 A variation of the message sequence diagram;

[0057] Fig.10 and Fig.11 is a message sequence diagram that is subsequently executed, wherein authorization to access services of the intra-oral scanning device is granted by an entity that is trusted by the intra-oral scanning device;

[0058] Fig.12 A message sequence diagram showing the client authenticating itself to the intra-oral scanning device;

[0059] Fig.13 Shows Fig.12 A variation of the message sequence diagram;

[0060] Fig.14 shows a hierarchical security classification of intraoral scanning device services; and

[0061] Fig.15 Assigning security levels to authorization methods is shown. DETAILED DESCRIPTION

[0062] The detailed description set forth below in conjunction with the accompanying drawings is intended to serve as an illustration of various configurations. The detailed description includes specific details that help to provide a thorough understanding of the various concepts. It will be apparent to those skilled in the art that these concepts can be practiced without these specific details. Aspects of the devices, systems, media, programs, and methods are illustrated by various blocks, functional units, modules, components, circuits, steps, processes, algorithms, etc. (collectively referred to as "elements"). Depending on the specific application, design constraints, or other reasons, these elements may be implemented using electronic hardware, computer programs, or any combination thereof.

[0063] The electronic hardware may include microprocessors, microcontrollers, digital signal processors (DSPs), field programmable gate arrays (FPGAs), programmable logic devices (PLDs), gated logic, discrete hardware circuits, and other appropriate hardware configured to perform the various functions described in the present disclosure. Computer programs should be broadly interpreted as instructions, instruction sets, codes, code segments, program codes, programs, subroutines, software modules, applications, software applications, software packages, routines, subroutines, objects, executable programs, execution threads, procedures, functions, etc., whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.

[0064] The scanning for providing intraoral scan data can be performed by a dental scanning system, which can include an intraoral scanning device, such as a TRIOS series scanner from 3Shape A / S. The dental scanning system can include wireless capabilities provided by a wireless network unit. The intraoral scanning device can adopt a scanning principle, such as scanning based on triangulation, confocal scanning, focused scanning, ultrasonic scanning, X-ray scanning, stereoscopic vision, motion structure, optical coherence tomography (OCT) or any other scanning principle. In one embodiment, the intraoral scanning device is operated by projecting a pattern and translating the focal plane along the optical axis of the intraoral scanning device and capturing multiple two-dimensional images at different focal plane positions, so that each captured two-dimensional image series corresponding to each focal plane forms a stack of two-dimensional images. The obtained two-dimensional image is also referred to as an original two-dimensional image in this article, where original means that the image has not been image processed in this article. It is preferred to move the focal plane position along the optical axis of the scanning system so that the two-dimensional images captured at multiple focal plane positions along the optical axis form a stack of two-dimensional images (also referred to as sub-scans in this article) for a given view of the object (i.e., for a given arrangement of the scanning system relative to the object). After moving the intraoral scanning device relative to the object or imaging the object in different views, a new stack of two-dimensional images of the view can be captured. The focal plane position can be changed by means of at least one focusing element (e.g., a moving focusing lens). The intraoral scanning device is usually moved and tilted during the scanning session so that at least some groups of sub-scans overlap at least partially so that they can be stitched in post-processing. The result of the stitching is a digital three-dimensional representation of a surface that is larger than the surface that can be captured by a single sub-scan (i.e., larger than the field of view of the three-dimensional scanning device). The working principle of stitching (also known as registration) is to identify the overlapping areas of the three-dimensional surface in each sub-scan and convert the sub-scans to a common coordinate system so that the overlapping areas match, ultimately generating a digital three-dimensional model. An iterative closest point (ICP) algorithm can be used for this purpose. Another example of an intraoral scanning device is a triangulation scanner, in which a time-varying pattern is projected onto a dental object, and a sequence of images of different pattern configurations is acquired by one or more cameras arranged at an angle relative to the projector unit.

[0065] The intraoral scanning device includes one or more light projectors configured to generate an illumination pattern to be projected onto a three-dimensional dental object during scanning. The (one or more) light projectors preferably include a light source, a mask having a spatial pattern, and one or more lenses, such as a collimating lens or a projection lens. The light source can be configured to generate light of a single wavelength or a combination of wavelengths (monochromatic or polychromatic). A light source can be used to generate a combination of wavelengths, and the light source is configured to generate light including different wavelengths (e.g., white light). Alternatively, the (one or more) light projectors may include multiple light sources, such as LEDs that generate light of different wavelengths (e.g., red, green, and blue), respectively, which can be combined to form light including different wavelengths. Therefore, the light generated by the light source can be limited by a wavelength that defines a specific color, or by a range of different wavelengths that define a combination of colors (e.g., white light). In one embodiment, the intraoral scanning device includes a light source configured to excite a fluorescent material of a tooth to obtain fluorescent data from a dental object. Such a light source can be configured to generate a narrow range of wavelengths. In another embodiment, the light from the light source is infrared (IR) light that can penetrate tooth tissue. The (one or more) projectors can be DLP projectors that use a micromirror array to generate a time-varying pattern, or a diffractive optical element (DOF), or a backlit mask projector, in which a light source is placed behind a mask having a spatial pattern, whereby the light projected on the surface of the dental object is patterned. The backlit mask projector can include a collimating lens for collimating the light from the light source, the collimating lens being placed between the light source and the mask. The mask can have a checkerboard pattern so that the generated illumination pattern is a checkerboard pattern. Alternatively, the mask can have other patterns, such as lines or small dots, etc.

[0066] The intraoral scanning device preferably also includes an optical component for directing light from the light source toward the surface of the dental object. The specific arrangement of the optical component depends on whether the intraoral scanning device is a focused scanning device, a scanning device using triangulation, or any other type of scanning device. The same applicant further describes a focused scanning device in EP 2 442 720 B1, the entire content of which is incorporated herein by reference.

[0067] Using the optical components of the intraoral scanning device, light reflected from the dental object in response to the irradiation of the dental object is directed to (one or more) image sensors. (One or more) image sensors are configured to generate multiple images based on the incident light received from the irradiated dental object. The image sensor can be a high-speed image sensor, such as an image sensor configured to acquire images with an exposure shorter than 1 / 1000 second or a frame rate exceeding 250 frames per second (fps). For example, the image sensor can be a rolling shutter (CCD) or a global shutter sensor (CMOS). (One or more) image sensors can be monochrome sensors including a color filter array, which can be configured to substantially eliminate one or more color components from the reflected light before the reflected light is converted into an electrical signal and retain only other components that are not eliminated. For example, such additional filters can be used to eliminate a portion of the white light spectrum (e.g., a blue component) from the signal generated in response to the excitation fluorescent material of the tooth, and retain only red and green components.

[0068] The network unit may be configured to connect the dental scanning system to a network including a plurality of network elements including at least one network element configured to receive the processed data. The network unit may include a wireless network unit. The wireless network unit is configured to wirelessly connect the dental scanning system to a network including a plurality of network elements including at least one network element configured to receive the processed data.

[0069] The dental scanning system preferably also includes a processor configured to generate scan data (e.g., intraoral scan data) by processing a two-dimensional (2D) image acquired by the intraoral scanning device. The processor may be part of the intraoral scanning device. For example, the processor may include a field programmable gate array (FPGA) and / or an advanced RISC computer (ARM) processor located on the intraoral scanning device. The scan data includes information related to a three-dimensional dental object. The scan data may include any of the following information: a two-dimensional image, a three-dimensional point cloud, depth data, texture data, intensity data, color data, and / or a combination thereof. For example, the scan data may include one or more point clouds, each of which includes a set of three-dimensional points describing a three-dimensional dental object. As another example, the scan data may include images, each of which includes image data, such as image data described by image coordinates and time stamps (x, y, t), wherein depth information may be inferred from the time stamps. The (one or more) image sensors of the intraoral scanning device may acquire multiple original two-dimensional images of the object in response to irradiating the dental object using one or more projectors. The multiple original two-dimensional images may also be referred to as a stack of two-dimensional images herein. The two-dimensional image can then be provided as an input to a processor, which processes the two-dimensional image to generate scan data. The processing of the two-dimensional image can include a step of determining which part of each two-dimensional image is in focus to infer / generate depth information from the image. The depth information can be used to generate a three-dimensional point cloud including a set of three-dimensional points in space, such as a three-dimensional point cloud described by Cartesian coordinates (x, y, z). The three-dimensional point cloud can be generated by a processor or another processing unit. Each two-dimensional / three-dimensional point can also include a timestamp indicating when the two-dimensional / three-dimensional point was recorded, that is, which image in the stack of two-dimensional images the point originated from. The timestamp is associated with the Z coordinate of the three-dimensional point, that is, the Z coordinate can be inferred from the timestamp. Therefore, the output of the processor is scan data, and the scan data may include image data and / or depth data, such as image data and / or depth data described by image coordinates and timestamps (x, y, t) or otherwise described as (x, y, z). In addition to scan data, the intraoral scanning device can be configured to send other types of data. Examples of data include three-dimensional information, texture information, such as infrared (IR) images, fluorescent images, reflectance color images, X-ray images, and / or combinations thereof.

[0070] Figure 1An exemplary dental system 2 is shown. The dental system 2 includes a server device 4 and an intraoral scanning device system 6, which includes an intraoral scanning device 8 and an external device 10. The external device 10 is a tablet computer configured to wirelessly communicate with the intraoral scanning device 8. A user application 12 is installed on the external device 10. The user application can be used to control the intraoral scanning device 8. In one or more exemplary user applications, the user application 12 is configured to transmit firmware, intraoral scanning device operating parameters and / or customized data (e.g., intraoral scanning device settings) to the intraoral scanning device.

[0071] The intraoral scanning device operating parameters may correspond to settings of the handheld intraoral scanning device, which may involve settings of an image sensor, a light projector, a wireless interface, a scanning sequence of the handheld intraoral scanning device, etc. The scanning sequence corresponds to scanning the patient's jaw with the handheld intraoral scanning device, and the handheld intraoral scanning device is configured to determine and transmit three-dimensional image data in real time based on intraoral scanning data acquired by the image sensor of the handheld intraoral scanning device during the scanning sequence.

[0072] Furthermore, the intraoral scanning device operating parameters relate to power management settings, configuration of a user interface of the intraoral scanning device and / or settings of an optical unit of the intraoral scanning device.

[0073] The handheld intraoral scanning device may include a user interface, which may include at least one touch sensor, at least one touch button, at least one light emitting diode, a tactile sensor and / or an accelerometer. The handheld intraoral scanning device may include a motion sensor configured to sense the movement of the handheld intraoral scanning device. The handheld intraoral scanning device is configured to wirelessly communicate with an external device connected to a display. The cursor on the display may move around based on a motion signal provided to the external device by the motion sensor. The user is able to navigate the cursor on the display by moving the handheld intraoral scanning device. The session data may include setting updates related to the motion sensor of the handheld intraoral scanning device, and the customization data may include settings for customizing the user interface of the handheld intraoral scanning device, which may involve graphical settings of a graphical user interface on the display. For example, when the handheld intraoral scanning device is connected to the external device, the handheld intraoral scanning device forwards the customization package to the external device via a wireless interface, and the external device is then configured to change the graphical settings based on the customization package. The customization package may be updated by the customization data provided by the session data.

[0074] The firmware data may include updates to the handheld intraoral scanning device that improve the functionality and features of the device.

[0075] The server device 4 and / or the user application 12 can be configured to perform any action of the method disclosed herein. The intraoral scanning device 8 can be configured to acquire intraoral scanning data from the three-dimensional dental object 290, process the intraoral scanning data of the patient, and provide two-dimensional image data and / or three-dimensional image data. The intraoral scanning device 8 is configured to communicate with the external device 10 / user application 12, for example using a wireless communication link 20. The first communication link 20 can be a single-hop communication link or a multi-hop communication link. The first communication link 20 can be carried by a short-range communication system such as Bluetooth, Bluetooth low energy or WIFI.

[0076] The external device 10 / user application 12 is configured to be connected to the server device 4 via a second communication link 22 through a network (e.g., the Internet and / or a mobile phone network). The server device 4 may be controlled by the manufacturer of the intraoral scanning device. The intraoral scanning device 8 comprises an antenna 24 and a radio transceiver 26 coupled to the antenna 4 for receiving / sending wireless communications including the first communication link 20. The intraoral scanning device 8 comprises a light projector 34 configured to emit light onto a dental object 290, and the device 8 comprises a camera 28 configured to receive reflected light from the dental object. The intraoral scanning device 8 comprises a memory unit 29 connected to the processor 32, wherein the intraoral scanning device settings are stored in the memory unit.

[0077] The intraoral scanning device 2 includes a processor 32 connected to the transceiver 26, the light projector 34 and the camera 28 for receiving and processing intraoral scanning data. The processor 32 is configured to process the intraoral scanning data and provide two-dimensional image data and / or three-dimensional image data.

[0078] The external device 10 includes a processing unit 36, a memory unit 38, and a wireless interface 40. The user application 12 is installed in the memory unit 38 of the external device 10 and is configured to ensure secure communication of the user application, wherein ensuring secure communication of the user application includes obtaining query data from the server device 4; sending a query request including the query data to the intra-oral scanning device 8; receiving a query response including the response data from the intra-oral scanning device 8; and sending the response data to the server device 4.

[0079] Figure 2An exemplary sequence diagram 100 between entities 4, 8, 12 of a dental system 2 is shown, illustrating an exemplary method of ensuring secure communication for a user application on an external device of a dental system including an intraoral scanning device. Ensuring secure communication for a user application includes obtaining challenge data from a server device 4. The method includes sending challenge data 102 from the server device 4 to the user application 12 in a challenge message 104. The user application 12 receives the challenge data and sends a challenge request 106 from the user application 12 to the intraoral scanning device 8 containing the challenge data 102. The intraoral scanning device 8 generates response data based on the challenge data and an optional intraoral scanning device identifier of the intraoral scanning device and sends a challenge response 108 to the user application 12, which receives the challenge response 108 containing response data 110 from the intraoral scanning device 8. The user application forwards the response data 110 to the server device 4 in a response message 112, the server device 4 verifies the response data 110 based on the challenge data, and, if the verification of the response data 110 is successful, authorizes the user application 12 in the server device 4.

[0080] Optionally, the method includes sending a request 114 for query data from the user application 12 to the server device, for example if a first approval criterion is met. In the dental system shown, the first approval criterion is met if the user application has been started for the first time or the user application has been updated. Receipt of the request for query data in the server device 4 (i.e., the first approval criterion is met in the server device) triggers secure communication of the user application. The server device 4 is configured to determine whether the approval criterion is met, and the server device 4 is configured to initiate secure communication of the user application if the approval criterion is met. The approval criteria in the server device include a first approval criterion and an optional second approval criterion. If the user application has not been approved within a certain time period (e.g., 14 days), the second approval criterion is met. Therefore, the second approval criterion can be based on an approval timestamp indicating the last approval time of the user application. If the first approval criterion or the second approval criterion is met, the approval criterion is met.

[0081] Figure 3A flow chart of an exemplary method of ensuring secure communication for a user application on an external device of a dental system including an intraoral scanning device is shown. In the method 200, ensuring secure communication for the user application includes obtaining 202 query data in a server device; sending 204 the query data from the server device to the user application; sending 206 a query request including the query data from the user application to the intraoral scanning device; receiving 208 a query response including response data from the intraoral scanning device; and forwarding 209 the response data from the user application to the server device. The method 200 includes validating 210 the response data in the server device based on the query data; and, if validating the response data is successful 214, approving 212 the user application in the server device. Optionally, the method includes determining 216 whether an approval criterion is met in the server device, and, if the approval criterion is met, starting to obtain 202 the query data. If so, the method initiates or starts to ensure secure communication for the user application.

[0082] Figure 4 An exemplary server device is shown for ensuring secure communication of a user application on an external device of a dental system 2 including an intraoral scanning device 8. The server device 4 comprises a processing unit 250, a memory unit 252 (e.g. comprising a database) and an interface 254. The server device 4 is configured to approve the user application, wherein approving the user application comprises obtaining query data, e.g. obtaining using an obtaining module 202a. Obtaining the query data comprises generating the query data, e.g. generating the query data based on a default query value and / or a timestamp. The query data has a length of 16 bytes. The server device is configured to send the query data to the user application of the external device in a query message via the interface 254, e.g. sending using a sending module 204a, and to receive a response message containing response data from the user application via the interface 254, e.g. receiving by a receiving module 256. The server device is configured to verify the response data, e.g. a response value of the response data, based on the query data and / or an intraoral scanning device identifier, e.g. by a verification module 210a. The server device may comprise a hardware security module, e.g. as part of the verification module 210a, which is configured to verify the response data / response value. If the response data is verified, the server device is configured to approve the user application, for example, using the approval module 212a. Verifying the response data optionally includes calculating the query data and verifying the response data based on the calculated query data. Calculating the query data as part of the response data verification eliminates the need for memory and storage of the query data in the server device. Verifying the response data includes verifying a response value of the response data, for example, based on the query data and / or the intra-oral scan device identifier of the response data. Verifying the response data in the server device may include verifying a checksum value of the response data.

[0083] The server device 4 is optionally configured to receive a request for query data from the user application via the interface 254, and to initiate secure communication of the user application upon receiving the request for query data from the user application. In addition, the server device 4 is optionally configured to determine whether a second approval criterion based on the last approval timestamp is met; and, if the second approval criterion is met, for example, if the user application has not been approved within a certain time period (e.g., 14 days), initiate approval of the user application.

[0084] The server device 4 may be arranged to perform at least a portion of the method for secure communication of a user application on an external device of a dental system as disclosed herein. The server device or processing unit 250 may also include a number of optional functional modules, such as any one of an acquisition module 202a configured to perform step 202, a sending module 204a configured to perform step 204, a receiving module 256 configured to receive a response message, a verification module 210a configured to perform step 210, and an approval module 212a configured to perform step 212. In general, each functional module may be implemented in hardware or software.

[0085] Figure 6 The present invention is directed to implementing such client-specific intraoral scanning service access on an intraoral scanning device in an efficient manner.

[0086] Figure 7 is a block diagram of an example of an intraoral scanning device 10 configured to acquire intraoral scan data from a three-dimensional dental object 290. The intraoral scanning device 10 includes a wireless interface 20 configured to exchange data with a client device 40, such as for receiving or sending customization data, update data, debugging data.

[0087] According to an example, the wireless interface 20 may be a Bluetooth interface, preferably a Bluetooth Low Energy (BTLE) interface, or a WIFI interface.

[0088] The intraoral scanning device 10 includes a control unit 38 and a memory 36 for controlling the operation of the intraoral scanning device 10. The control unit 38 acts on the processing unit 14 and the transceiver 28. The memory 36 is used to store data required for the operation of the intraoral scanning device 10 and data required for the operation of the wireless interface 20 (such as pairing / network data).

[0089] exist Figure 5In the example, the intraoral scanning device 10 includes a projector configured to emit light to a dental object, a camera configured to receive reflected light from the dental object, and a processing unit 14 configured to process intraoral scanning data and provide two-dimensional image data and / or three-dimensional image data to be forwarded via a wireless interface 20.

[0090] The intraoral scanning device service access control concept disclosed in the present invention includes the following main aspects: defining multiple intraoral scanning device services, each service has a specific criticality, and assigning a security level to each intraoral scanning device service according to the criticality of the intraoral scanning device service, and the security level is selected from the security levels of multiple hierarchical structures.

[0091] exist Fig.14 , it is shown that the security levels are hierarchical in the sense that access to the highest security level includes access to all lower security levels, ie access to the most critical service includes access to all lower security level services, all the way to the least critical service.

[0092] In addition, multiple authorization methods are defined, and at least one authorization method is assigned to each security level, so that each of the (one or more) authorization methods assigned to a certain security level is different from the authorization methods assigned to other security levels, wherein each authorization method is used to authorize a client to access (one or more) intraoral scanning device services assigned to the corresponding security level.

[0093] exist Fig.15 An example of such an assignment is schematically shown in the figure, wherein a first security level (corresponding to, for example, a firmware update) is assigned a first authorization method, such as authorization via an entity trusted by the intraoral scanning device, a second security level (corresponding to, for example, a customization process) is assigned a second authorization method, such as authorization via a first user gesture, and a third security level (corresponding to, for example, remote control access) is assigned a third authorization method, such as authorization via a second user gesture different from the first user gesture.

[0094] The authorization includes at least a client authenticator and a maximum security level granted to the client device, wherein a client having access to a certain security level (as a result of a corresponding authorization method) also has access to all security levels below that level. At least one authorization method may allow the user to autonomously grant authorization without involving a third-party entity trusted by the intraoral scanning device; such autonomous authorization includes performing an action on the intraoral scanning device itself or on an external device that communicates with the intraoral scanning device, in particular by a specific user gesture.

[0095] The granted authorization is stored on the intraoral scanning device to allow access control to be enforced on the intraoral scanning device during runtime without the need for a third party entity, such as a user account on a remote server.

[0096] Once the intra-oral scanning device receives an intra-oral scanning device service access request from a client device, the runtime implementation of the intra-oral scanning device service access begins. Once the client device is authenticated based on the stored client authenticator of the corresponding client device, the security level associated with the intra-oral scanning device service requested by the client is compared with the highest security level granted to the client device based on the stored authorization of the client device, wherein if the granted security level is not at least as high as the security level associated with the requested intra-oral scanning device service, the intra-oral scanning device denies access to the requested intra-oral scanning device service. If the granted security level is at least as high as the security level associated with the requested intra-oral scanning device service, the intra-oral scanning device will generally allow access to the requested intra-oral scanning device service.

[0097] Examples of authorization methods are as follows: authorization by a specific user gesture, authorization by a predefined shared key, authorization by a third party entity trusted by the intra-oral scanning device, and authorization by default.

[0098] When different user gestures are used for authorization, the user may, for example, use a first gesture to grant a customization station (in this case, the user may be a dentist or an operator) full access to the intraoral scanning device, while another gesture may be used to grant access to a restricted set of services of the intraoral scanning device (e.g., consisting only of customization data). The user may perform an authorization gesture in response to an authorization request from a client, and the intraoral scanning device notifies the user of receipt of the authorization request. If the user decides to grant the requested authorization, the user will perform the corresponding gesture. Preferably, the user authenticates the requesting client device before authorizing it. The notification may indicate to the user which permissions the client device has requested; such a notification may appear through a user interface of the intraoral scanning device. The user interface may include a vibrator, one or more LEDs, or a digital display. In Figure 8 , which involves a user 18, a client device 40, and an intra-oral scanning device 10. The intra-oral scanning device 10 receives 401 an authorization request from the client device 40, and the intra-oral scanning device 10 sends 402 an authorization request notification 402 to the user 18 via the client device 40. The user then authenticates 403 the requesting client device by forwarding a gesture 404 to the intra-oral scanning device 10, and the intra-oral scanning device grants 405 authorization based on the gesture. The gesture may be an input to a user interface of the client device 40.

[0099] Alternatively, the user may first perform an authorization gesture 502, thereby causing the intraoral scanning device to enter a state of accepting authorization requests from any client. Preferably, upon entering this state, the intraoral scanning device 10 informs the user which permissions will be assigned to the client device requesting 501 authorization in this state. The user may then cause 503 the desired client device to send 504 an authorization request to the intraoral scanning device, whereupon the intraoral scanning device notifies 505 the user that the authorization is successful; such notification may inform the user which client has been effectively granted authorization, allowing the user to revoke the authorization if it is realized that authorization has been granted to the wrong client. Fig. 9 An example of such an authorization method is shown in .

[0100] According to another example, in the case of a wireless connection, such as when a Bluetooth protocol or a WIFI protocol is used to connect the client device to the intraoral scanning device, the pairing / connection process (authorizing the device wirelessly connected to the intraoral scanning device) and the authorization of the client device (i.e., assigning permissions to use a set of services on the intraoral scanning device) can be combined into one procedure, as seen by the user. In this case, the same user gesture can be used for both the pairing / connection process and for the assignment of permissions (i.e., for the authorization process). Alternatively, the pairing / connection gesture can be different from the authorization gesture.

[0101] According to one example, the authorization gesture may be performed on the user interface of the client device 40 or the intraoral scanning device 10. For example, long pressing a button of the intraoral scanning device and short pressing a button of the intraoral scanning device may be used as different gestures to grant different authorizations (i.e., assign different permission groups).

[0102] According to another set of authorization methods, authorization may include authorization by a shared key, wherein the shared key is associated with one of the security levels, the shared key is stored on the intra-oral scanning device and provided to at least one client device, and wherein if the client device presents valid evidence to the intra-oral scanning device that it knows the shared key, the client device is granted the requested security level. In this case, different permission groups (i.e., different authorizations) may be associated with different key values ​​stored in the intra-oral scanning device, for example, at the time of manufacture. The problem of distributing the shared key to the client device may be solved in different ways, for example: (1) if the client is under the full control of the intra-oral scanning device manufacturer (e.g., it is a cloud service owned by the manufacturer), the shared key may be provided directly to the client device; and (2) if the client is a customization station, the shared key may be provided to the client when the manufacturer successfully authenticates and authorizes the customizer. If the shared key is not unique to the intra-oral scanning device, but is the same for all devices (a very weak solution from a security point of view), these keys may be distributed with the client installation package.

[0103] For example, in order to achieve full access to the intra-oral scanning device, the customization station must prove to the intra-oral scanning device that it knows the first key.

[0104] The client can prove to the intra-oral scanning device that it knows the key by using different methods. For example, the key can be transmitted in plain text over a communication channel that ensures confidentiality (such as an encrypted Bluetooth or WIFI link), or the client and the intra-oral scanning device can use an encrypted challenge-response protocol.

[0105] Another group of authorization methods is authorization through a trusted entity. In this case, an intraoral scanning device client device is authorized using an authorization service, which is an entity trusted by the intraoral scanning device, wherein a client device that wishes to access the intraoral scanning device service requests the desired access from the authorization service, such as via a user's login at the authorization service. If the authorization service decides to grant the requested authorization to the client device, it issues a token to the client device, which may include a set of granted permissions. In order to obtain the requested access to the intraoral scanning device service, the client device then presents the token to the intraoral scanning device, and if the intraoral scanning device successfully authenticates the token issued by the trusted authorization service, the client device is granted the requested set of permissions.

[0106] Because this approach is vulnerable to replay attacks, a more advanced alternative approach can be used in which the intraoral scanning device issues a 'token' to the client device. The client device provides the token to an authorization service, which (1) signs the token (a so-called random number); and (2) generates and signs a shared key to be used by the client device and the intraoral scanning device (i.e., establishes a trust relationship between them). The authorization service then distributes the signed token and key to the client device and the intraoral scanning device in a confidential manner. Typically, this is done via the client device. Therefore, two encrypted copies of the signed token-key pair are first provided to the client device. One copy is encrypted so that only the client device can decrypt it.

[0107] The other copy is encrypted so that only the intra-oral scanning device can decrypt it. The client device extracts its copy for itself and forwards the other copy to the intra-oral scanning device. The intra-oral scanning device verifies the authorization service signature and, if the authorization service signature is valid, accepts the shared key (which can be used as the client authenticator). The client also does this in the event that the confidentiality and integrity of the channel between the client and the authorization service cannot be guaranteed.

[0108] For example, if the authorization service can authenticate a person (usually via a user login) as a dentist who is authorized to customize a specific intraoral scanning device, the authorization service issues a first token to the person to grant full access to the intraoral scanning device. If the authorization service can authenticate a person as the owner / end user of the intraoral scanning device (via a user login to the authorization service), the authorization service issues a second token to the person to grant a limited set of permissions, which is, for example, sufficient only to send remote control commands to the intraoral scanning device but not to change its customized parameters.

[0109] The trust relationship between the authorization service and the intraoral scanning device can be established, for example, based on symmetric encryption, which uses a key pre-shared between the authorization service and the intraoral scanning device (for example, the shared key can be provided when the intraoral scanning device is manufactured); preferably, the shared key is unique for each intraoral scanning device.

[0110] Fig.10 and Fig.11 An example of establishing a trust relationship is shown, where Fig.10 The steps shown in Fig.11 The steps shown are performed previously, and this example involves the dentist 18, the client device (e.g., the customization station 42), the intraoral scanning device 10, and the manufacturer authorization service 46. Fig.10 In the example, the dentist 18 is logging into 701 a client device 42 or an application installed on the client device, and the username and password are being forwarded 702 to the intraoral scanning device 10 via the client device 42, and the intraoral scanning device 10 forwards 703 an access token to the client device 42, the access token containing information about whether the dentist is successfully authorized. The client device 42 notifies 704 the dentist whether the login is successful.

[0111] exist Fig.11 Prior to the message exchange shown, the client Fig.10The steps shown authenticate themselves to the authorization service 46. In step 801, the client device 42 requests authorization from the intraoral scanning device 10. In step 802, a random number and an intraoral scanning device ID are sent from the intraoral scanning device 10 to the client device 42; the message can be encrypted using a key pre-shared between the intraoral scanning device 10 and the authorization service 46, which can be a shared key or a public key. In step 803, the client device sends an authorization request to the authorization service 46, which clearly contains the random number, the intraoral scanning device ID, the client device ID, and the requested security level, whereby the authorization service 46 checks the access rights of the client (step 804) and sends an authorization license containing a client authenticator to the client device 42 (step 805). It is assumed that the channel between the client device 42 and the authorization service 46 is confidential and complete. In step 806, the authorization service 46 sends an authorization license confirmation message to the intraoral scanning device, which contains a random number, an intraoral scanning device ID, a client device ID, a requested security level, and a client authenticator. The authorization service 46 authenticates the message using a key pre-shared between the intra-oral scanning device and the authorization service 46 or through a private key of the authorization service 46. If the confidentiality of the channel cannot be guaranteed, the message can be encrypted using a key pre-shared between the intra-oral scanning device and the authorization service 46 or using a temporary key provided by the intra-oral scanning device in the message of step 802 (in this case, the message of step 802 must also be encrypted). The message of step 806 can be sent to the intra-oral scanning device 10 "directly" or through the client device 42. The client device ID, security level and authenticator (shared key) can be stored 807 on the intra-oral scanning device 10.

[0112] Therefore, a trust relationship can be established based on public key encryption, where the authorization service possesses a private key and the intraoral scanning device knows the corresponding public key (for example, the public key can be stored in a write-protected memory within the intraoral scanning device); preferably, the public key / private key pair is unique for the intraoral scanning device; alternatively, the public key / private key pair can be the same for all or a group of intraoral scanning devices.

[0113] The token can be a digital certificate issued to the client by the authorization service, wherein the digital certificate can be signed with the private key of the authorization service, and wherein the intraoral scanning device can use the public key to confirm the signature of the certificate in order to verify the certificate. Upon successful verification, the intraoral scanning device can install the certificate in its write-protected memory. The certificate can be in a standard format and can include an authenticator of the target client device to which the certificate is issued, a client public key generated by the client device and provided to the authorization service, and a security level granted to the client device. The client private key is stored as a secret by the client device. Subsequently, the intraoral scanning device can use the client public key to authenticate the client device, and / or the intraoral scanning device can use it for any other purpose requiring encryption-protected communication confidentiality and integrity, such as for key distribution.

[0114] The authorization service may be provided via a communication network (eg, the Internet); in particular, the authorization service may be implemented on a server operated by the manufacturer of the intraoral scanning device.

[0115] In addition to the authorization methods described so far, authorization can occur by default, in which the intraoral scanning device unconditionally assigns a given minimum security level to any client requesting authorization; this applies to non-critical intraoral scanning device services, such as settings unrelated to the acquisition of intraoral scan data and the processing of intraoral scan data.

[0116] As described above, the result of successful authorization is a client authenticator and the highest security level granted to the client. Preferably, the client authenticator contains a key shared between the client and the intraoral scanning device. According to one example, the shared key can be established by a cryptographic protocol (such as Diffie-Hellman). Alternatively, Figure 8 and Fig. 9 As exemplarily shown in the message sequence diagram in , during the authorization process, a shared secret (i.e., a shared key) can be established between the client device and the intra-oral scanning device by the authorization service. According to another alternative, if the underlying communication channel ensures confidentiality and integrity, the shared key can be generated by the client device and transmitted in plain text to the intra-oral scanning device (or vice versa). The key can be a shared key or a private key / public key pair.

[0117] Later, if the underlying communication channel passes through an untrusted entity, such as the Internet (for example, during remote customization updates, firmware updates, and debugging of the intraoral scanning device), then the shared key of the client authenticator (which is to be distinguished from the shared key mentioned with respect to the authorization method) can be used to achieve end-to-end security (i.e., confidentiality and integrity) of the communication between the client device and the intraoral scanning device.

[0118] Similar methods and mechanisms as described above may be used to revoke previously granted authorization for intra-oral scanning device services.

[0119] Only when the intraoral scanning device can successfully authenticate the client, it starts accepting service requests from the client device.

[0120] If the underlying communication channel between the client device and the intra-oral scanning device guarantees confidentiality and integrity, then the shared key established during authorization can be transmitted 901 from the client to the intra-oral scanning device in plain text to authenticate 902 the client device. An authentication response 903 is forwarded to the client device 42 to notify whether the authentication was successful. Fig.12 An example of such authentication is shown in FIG. 4 , which involves a client device 42 and an intra-oral scanning device 10. If the communication channel between the client device 42 and the intra-oral scanning device 10 guarantees integrity but not confidentiality, then the shared key established during authorization is used in an encrypted challenge-response protocol. Fig.13 An example of such authentication is shown in . In step 1001, the client device requests 1001 a challenge to the intra-oral scanning device 10, and the intra-oral scanning device 10 generates a random number (i.e., a challenge), which is then forwarded 1003 to the client device 42. The client device responds 1004 to the challenge by forwarding the randomly generated number that is verified 1005 by the intra-oral scanning device 10, and notifies 1006 whether the verification was successful.

[0121] In both cases, client authentication only needs to be performed once (e.g. when establishing a link) to achieve permanent authentication. However, if the communication channel between the client device and the intraoral scanning device cannot guarantee integrity, then each single service request from the client must be authenticated (i.e., only a one-time authentication); this can be achieved through known cryptographic techniques such as message authentication codes (MACs) or digital signatures. "Permanent" does not necessarily mean that authentication is only performed once and is valid forever. Instead, authentication is performed at the beginning of each session (assuming confidentiality and integrity of the channel). For example, it can be performed each time a smartphone reconnects to the intraoral scanning device via Bluetooth or WIFI, but authentication can also be performed more frequently, for example for each logically independent interaction (i.e., session) on the application layer.

[0122] Certain (non-critical) service requests may not require prior client authentication and will therefore always be accepted by the intra-oral scanning device (this corresponds to the "default authentication" described above).

[0123] As described above, once the intraoral scanning device successfully authenticates the client device and finds that the security level granted to the client device is at least as high as the security level associated with the service request, the intraoral scanning device typically allows access to the requested intraoral scanning device service.

[0124] Preferably, the security level is represented by a numerical value, and the order of the numerical values ​​is related to the hierarchy of the security level. For example, the higher the numerical value representing the security level, the higher the security level. According to one example, a call schedule table can be stored on the intraoral scanning device, for assigning each intraoral scanning device service that can be called by the client device to one of the security levels.

[0125] According to one example, the security level that a client device can access (and the intraoral scanning device services associated with that security level) can be represented by a whitelist (i.e., listing all services / security levels that the client can access) or by a blacklist (i.e., listing all services / security levels that the client device cannot access).

[0126] According to one instance, client devices can be grouped based on the highest security level that the client devices can access, and each group is assigned a corresponding highest security level that the client devices in the group can access, wherein if the security level associated with the requested intraoral scanning device service is not higher than the security level of the client devices in the group, then the intraoral scanning device is allowed to access the requested intraoral scanning device service, otherwise the intraoral scanning device is denied access to the service.

[0127] Client devices may include devices such as ordering stations, clinic computers, tablets, testing systems, repair and service stations, and the applications that run on these devices.

[0128] The present disclosure provides a number of benefits; for example, since the authentication method includes authentication via a user gesture, the user maintains control of the client device access to their intra-oral scanning device. In addition, the present disclosure protects the intra-oral scanning device from man-in-the-middle attacks during pairing, while still enabling access control in a manner that requires only a small amount of intra-oral scanning device resources.

[0129] Although some embodiments are described and shown in detail, the present disclosure is not limited to these details, and the present invention can be implemented in other ways within the scope of the subject matter defined in the appended claims. In particular, it should be understood that other embodiments can be utilized and structural and functional modifications can be made without departing from the scope of the present invention.

[0130] The benefits, other advantages and solutions to problems of the present invention are described herein with reference to specific embodiments. However, these benefits, advantages, solutions to problems, and any components / units that may bring any benefit, advantage or solution or make it more obvious should not be understood as being key, necessary or essential features or components / elements of any or all claims or the present invention. Therefore, the scope of the present invention is limited only by the appended claims, in which, unless otherwise expressly stated, references to components / units / elements in the singular are not intended to mean "one and only one", but rather "one or more". A claim may refer to any preceding claim, and "any" should be understood to mean "any one or more" of the preceding claims.

[0131] Structural features of the above-described apparatus in the detailed description and / or claims may be combined with steps of the method when appropriately replaced by corresponding processes.

[0132] As used herein, the singular forms "one", "an" and "the" are also intended to include plural forms (i.e., have the meaning of "at least one"), unless otherwise explicitly stated. It should also be understood that when used in this specification, the terms "include", "comprise" and their grammatical variations refer to the presence of the described features, integers, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, parts and / or their groups. It should also be understood that when an element is referred to as "connected" or "coupled" to another element, it can be directly connected or coupled to another element, but there can also be intermediate elements, unless otherwise explicitly stated. In addition, as used herein, "connected" or "coupled" can include wireless connections or couplings. As used herein, the term "and / or" includes any and all combinations of one or more related listed items. The steps of any disclosed method are not limited to the exact order described herein, unless otherwise explicitly stated.

[0133] It should be understood that references in this specification to "one embodiment" or "an embodiment" or "an aspect" or feature included as "possible" means that the specific features, structures or characteristics described in conjunction with the embodiment are included in at least one embodiment of the present disclosure. In addition, in one or more embodiments of the present disclosure, specific features, structures or characteristics may be appropriately combined. The foregoing description is provided to enable those skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applicable to other aspects.

[0134] The claims are not limited to the aspects shown herein, but are to be accorded the full scope consistent with the language of the claims, wherein reference to an element in the singular is not intended to mean "one and only one" but rather "one or more" unless otherwise specified. The term "some" means one or more unless otherwise specified.

[0135] Project List:

[0136] 1. A method of controlling access of a client device (42) to a service of an intra-oral scanning device (10), the method comprising the following steps:

[0137] Requesting access to services of the intra-oral scanning device (10) from the client device (42) by providing the client device authenticator to the intra-oral scanning device (10);

[0138] Authenticating the client device (42) based on confirmation of the provided client device authenticator by the intra-oral scanning device (10);

[0139] Features:

[0140] upon successful authentication, comparing a security level associated with the service requested by the client device (42) with a highest security level assigned to the client device (42) by the intraoral scanning device (10), wherein the security level is selected from a plurality of hierarchical security levels, and

[0141] If the requested security level is less than or equal to the highest security level assigned to the client device (42), then the client device (42) is granted access to the services of the intra-oral scanning device (10).

[0142] 2. A method according to item 1, wherein providing a client device authenticator includes granting authorization to each client device (42), and storing the intraoral scanning device (10) service authorization granted to the client device (42) on the intraoral scanning device (10); wherein if the security level assigned to the client device (42) is not at least as high as the security level associated with the service request, the intraoral scanning device (10) denies access to the requested intraoral scanning device service, wherein the authorization includes at least the client device authenticator and the highest security level assigned to the client device (42), and wherein a client device authorized to access a certain security level is also authorized to access all security levels below that security level.

[0143] 3. The method according to item 2 also includes: defining multiple authorization methods and assigning at least one authorization method to each security level, so that each authorization method assigned to a certain security level is different from the authorization methods assigned to other security levels, wherein each authorization method is used to grant a client device (42) authorization to access (one or more) intraoral scanning device services assigned to the corresponding security level.

[0144] 4. The method according to item 3, wherein at least one authorization method allows the user to autonomously grant authorization by performing actions on the intraoral scanning device (10) or on an external device that communicates with the intraoral scanning device (10) without involving additional devices.

[0145] 5. A method according to item 4, wherein the authorization method includes a user performing at least one selective gesture on a user interface of the intraoral scanning device (10) or on an external device (such as a computer) that communicates with the intraoral scanning device (10).

[0146] 6. The method according to item 5, wherein the external device is trusted by the intraoral scanning device (10).

[0147] 7. The method according to one of items 5 and 6, wherein the authorization method comprises a plurality of gestures performed by the user, wherein each gesture is dedicated to a different security level.

[0148] 8. A method according to any one of items 5 to 7, wherein the user gesture is performed in response to an authorization request received by the intra-oral scanning device (10) from a client device (42).

[0149] 9. The method of clause 8, wherein the client device (42) is authenticated by a user prior to performing the user gesture.

[0150] 10. A method according to either of items 8 and 9, wherein the intraoral scanning device (10) provides a tactile or visual / optical notification to the user that the intraoral scanning device (10) has received an authorization request, the notification containing information about the security level(s) to which the client device (42) requests access.

[0151] 11. A method according to any one of items 5 to 7, wherein the user gesture is performed in response to an authorization request received by the user from a client device (42), wherein the user gesture causes the intraoral scanning device (10) to enter an authorization acceptance state, in which the intraoral scanning device (10) accepts authorization requests from any client device (42), and wherein the user then causes the client device (42) to send an authorization request to the intraoral scanning device (10).

[0152] 12. The method according to item 11, wherein the intraoral scanning device (10) notifies the user, when in an authorization acceptance state, about a security level that a client device (42) requesting authorization in the authorization acceptance state can access.

[0153] 13. The method according to one of items 11 and 12, wherein the intraoral scanning device (10) notifies the user that authorization has been granted and to which client device (42) the authorization has been granted.

[0154] 14. The method according to item 13, wherein the intraoral scanning device (10) enables the user to revoke the granted authorization within a given time period after notification of the grant of the authorization.

[0155] 15. A method according to any one of items 11 to 14, wherein there are a plurality of different user gestures, each user gesture causing the intraoral scanning device (10) to enter a different authorization acceptance state with a different maximum accessible security level.

[0156] 16. A method according to any one of items 3 to 15, wherein the authorization method includes authorization by an authorization service (46), wherein the client device identifies itself to the authorization service (46) and requests authorization to access at least one intraoral scanning device service from the authorization service (46), wherein the authorization service (46) determines whether to grant or deny the requested authorization based on the identity of the client device, wherein the authorization service (46) issues a token containing the highest security level that the client device (42) is capable of accessing to the client device (42) when granting the requested authorization, wherein the client device presents the token to the intraoral scanning device (10), wherein a trust relationship is established between the intraoral scanning device (10) and the authorization service (46), and wherein the intraoral scanning device (10) grants the requested authorization to the client device upon successfully authenticating that the token was issued by the authorization service (46).

[0157] 17. The method of clause 16, wherein the token is a digital certificate issued to the client device (42) by an authorization service (46).

[0158] 18. The method according to any of the preceding items, wherein the client device authenticator comprises a secret key shared between the client device (42) and the intraoral scanning device (10).

[0159] 19. The method according to any of the preceding items, wherein the security level is represented by numerical values, the order of which is related to the hierarchy of the security levels.

[0160] 20. The method according to any of the preceding items, wherein a call schedule is stored on the intraoral scanning device (10) for assigning each intraoral scanning device service that can be called by a client device (42) to one of the security levels.

[0161] 21. A method according to any of the preceding items, wherein client devices (42) are grouped based on the maximum security level that the client devices (42) can access, and each group is assigned a corresponding higher maximum security level that the client devices (42) in the group can access, and wherein if the security level associated with the requested intraoral scanning device service is higher than the security level of the client devices (42) in the group, the intraoral scanning device (10) denies access to the requested intraoral scanning device service.

[0162] 22. A method according to one of the preceding items, wherein the intraoral scanning device (10) is configured to acquire intraoral scanning data from a three-dimensional dental object during a scanning session, and the intraoral scanning device includes a processing unit configured to process the intraoral scanning data and provide two-dimensional image data and / or three-dimensional image data.

Claims

1. A method (200) for ensuring secure communication of a user application installed on an external device of a dental system, the dental system comprising an intraoral scanning device, a server device and the external device, wherein: Ensuring secure communication of the user application includes: Obtaining (202) query data in the server device; sending (204) the query data from the server device to the user application installed on the external device; · sending (206) a query request including the query data from the user application to the intra-oral scanning device; receiving (208) a query response including response data from the intra-oral scanning device; forwarding (209) the response data from the user application to the server device; verifying (210) the response data in the server device based on the challenge data; and If the verification of the response data is successful, the user application is approved (212) in the server device.

2. The method according to claim 1, wherein: The method includes determining the response data in the intra-oral scanning device based on the query data and an intra-oral scanning device identifier of the intra-oral scanning device.

3. The method according to any one of claims 1 to 2, wherein: The response data includes an intra-oral scanning device identifier or indicates an intra-oral scanning device identifier.

4. The method according to any one of claims 1 to 3, wherein: Receiving a query response including response data from the intra-oral scanning device is performed by the user application.

5. The method according to any one of claims 1 to 4, wherein: Approving the user application includes setting a user application state identifier to a value indicating that the user application is approved.

6. The method according to any one of claims 1 to 5, wherein: The method includes setting a user application status identifier to a value indicating that the user application is not approved if validation of the response data fails.

7. The method according to any one of claims 1 to 6, wherein: The method includes linking the user application to an intra-oral scanning device in a memory of the server device if validating the response data is successful.

8. The method according to any one of claims 1 to 7, wherein: The method includes sending a request for interrogation data from the user application.

9. The method according to claim 8, wherein: If the first approval criterion is met, the request for query data is sent.

10. A method according to any one of claims 1-9, the method comprising storing an approval timestamp indicating the time of last approval; determining whether a second approval criterion based on the approval timestamp is met; and initiating secure communication of the user application if the second approval criterion is met.

11. The method according to any one of claims 1 to 10, wherein: Approving the user application includes sending intra-oral scanning device settings specific to the intra-oral scanning device to the user application.

12. The method according to any one of claims 1 to 11, wherein: Obtaining the challenge data comprises storing the challenge data in the server device, or wherein verifying the response data in the server device based on the challenge data comprises calculating the challenge data.

13. A dental system (2), comprising a server device (4) and an intraoral scanning device system, the intraoral scanning device system comprising an external device (10) and an intraoral scanning device (8), the server device (4) being configured to ensure secure communication of a user application (12) installed on the external device (10), wherein: The server device (4) is configured to approve the user application (12), wherein approving the user application (12) comprises: Obtain inquiry data; Sending the query data to the user application (12); receiving a response message from the user application (12) comprising response data, the response data comprising an intra-oral scanning device identifier; · verifying the response data based on the challenge data; and if the response data is verified, approving the user application (12), and The external device (10) comprises: Processing unit; Memory unit; and Wireless interface, wherein the user application (12) is configured to ensure secure communication of the user application, and wherein ensuring secure communication of the user application comprises: Obtaining inquiry data from the server device (4); Sending an inquiry request containing the inquiry data to the intra-oral scanning device (8) of the intra-oral scanning device system (2); receiving a query response including response data from the intra-oral scanning device (8); and · Forwarding the response data to the server device (4).

14. The dental system (2) according to claim 13, wherein: The server device (4) is configured to determine whether an approval criterion is met, and the server device (4) is configured to initiate secure communication of the user application (12) if the approval criterion is met, wherein the approval criterion includes a first approval criterion and a second approval criterion, and wherein the approval criterion is met if either the first approval criterion or the second approval criterion is met.

15. The dental system (2) according to any one of claims 13-14, wherein: The user application (12) is configured to determine whether a first approval criterion is met and, if the first approval criterion is met, initiate secure communication of the user application, and wherein obtaining challenge data comprises sending a request for challenge data to the server device.

Images