Intraoral scanning device with communication protection and related methods

Abstract

In accordance with an embodiment, a handheld intraoral scanning device and related methods are disclosed that includes a processing unit configured to process intraoral scan data of a patient and provide 2D image data and / or 3D image data. The intraoral scanning device includes a memory unit and a wireless interface. The processing unit is configured to: receive a session request for a session via the wireless interface; obtaining and / or storing a session key; and encrypts the session key based, for example, on an intra-oral scanning device key. The processing unit is configured to send a session response, for example comprising the encrypted session key; and receive session data in the session via the wireless interface. Also disclosed is a method for communication of a handheld intraoral scanning device comprising a processing unit, a memory unit, and a wireless interface. The method includes receiving a session request for a session via the wireless interface; obtaining and / or storing a session key, for example in the memory unit; and encrypting the session key, for example based on an intra-oral scanning device key. The method includes transmitting the encrypted session key; and receiving session data in the session via the wireless interface.

Description

Technical Field

[0001] The present disclosure relates to an intra-oral scanning device with communication protection and related methods, and in particular, to an intra-oral scanning device and related methods for securely communicating with an accessory device / system. Background Art

[0002] The functionality of intraoral scanning devices has become increasingly advanced. Wireless communications between intraoral scanning devices and external devices, such as clinic computers, scanning computers, dental software on computers, and custom computers, have been developed. Typically, the wireless communication interface of intraoral scanning devices uses an interface based on open standards. However, this presents many challenges in terms of security. Intraoral scanning devices may assume that any input data is legitimate and may allow memory to be written or changed by unauthorized parties. Any such attack may result in malfunction of the intraoral scanning device, or a battery drain attack may occur.

[0003] However, the intraoral scanning device is a small device with strict limitations in computing power, storage space, etc. Therefore, the device communicating with the intraoral scanning device cannot use the readily available security algorithms and protocols, otherwise there are risks such as exhausting the battery of the intraoral scanning device or reducing the function of the intraoral scanning device, making the intraoral scanning almost useless.

[0004] Existing intraoral scanning devices are part of a service infrastructure that includes intraoral scanning devices, scanning software for specific services, and communication between service providers. Services may include, for example, manufacturing aligners, retainers, crowns, implants, stents, night guards, and the like. In order to improve the availability of such infrastructure to dentists, minimal interaction between the infrastructure and the dentist is required. One way to achieve this is by applying wireless communication between the intraoral scanning device and an external computer that is connected to a server that can forward the intraoral scan data to the service provider. The patient's scan data may be characterized as personal information, and therefore, any risk of a third party stealing or destroying at least the scan data, etc., needs to be minimized. The scan data is characterized as personal information, and, in some cases, other types of personal information, such as age, gender, location address, personal security number, etc., are associated with the scan data. In this example, the security of wireless communication in the service infrastructure needs to be improved. Summary of the invention

[0005] One aspect of the present disclosure is to provide an intra-oral scanning device that reduces the risk of a third party accessing any part of the intra-oral scanning device.

[0006] It is a further aspect of the present disclosure to provide intra-oral scanning apparatus and methods which seek to mitigate, alleviate or eliminate one or more of the above mentioned deficiencies and disadvantages in the art, either singly or in any combination.

[0007] Another aspect of the present disclosure is to improve the security of intraoral scanning devices. Security includes assessing threats, vulnerabilities and attacks, and developing appropriate security measures and countermeasures to prevent threats and attacks. The present disclosure relates to an intraoral scanning device, which includes a processing unit configured to process intraoral scan data of a patient and provide 2D image data and / or 3D image data.

[0008] According to multiple aspects, an intraoral scanning device for acquiring intraoral scan data from a three-dimensional dental object during a scanning session is disclosed. The intraoral scanning device may include a processing unit configured to process the intraoral scan data of a patient and provide 2D image data and / or 3D image data; a memory; and a wireless interface configured to transmit the 2D image data and / or the 3D image data. In addition, the processing unit may be configured to: receive a session request for a session via the wireless interface; obtain and store a session key; sign the session key via an intraoral scanning device key, and wherein the intraoral scanning device key may be stored in a permanent memory of the intraoral scanning device. The processing unit may be configured to send a session response that may include the signed session key and receive session data in the session via the wireless interface.

[0009] According to multiple aspects, an intraoral scanning device for acquiring intraoral scan data from a three-dimensional dental object during a scanning session is disclosed. The intraoral scanning device may include a processing unit configured to process the intraoral scan data of a patient and provide 2D image data and / or 3D image data; a memory; and a wireless interface configured to transmit the 2D image data and / or the 3D image data. In addition, the processing unit may be configured to: receive a session request for a session via the wireless interface; obtain and store a session key; encrypt the session key based on the intraoral scanning device key, and wherein the intraoral scanning device key may be stored in a permanent memory of the intraoral scanning device. The processing unit may be configured to send a session response that may include the encrypted session key and receive session data in the session via the wireless interface.

[0010] According to multiple aspects, an intraoral scanning device for acquiring intraoral scan data from a three-dimensional dental object during a scanning session is disclosed. The intraoral scanning device may include a processing unit configured to process the intraoral scan data of a patient and provide 2D image data and / or 3D image data; a memory; and a wireless interface configured to transmit the 2D image data and / or the 3D image data. In addition, the wireless interface may be configured to transmit a session request to the processing unit. In addition, the processing unit may be configured to obtain and store a session key, and to encrypt the session key based on an intraoral scanning device key, which may be stored in a permanent memory of the intraoral scanning device. The processing unit may also be configured to send a session response that may include an encrypted session key and receive session data in the session via the wireless interface.

[0011] According to multiple aspects, a method of communicating with an intraoral scanning device is disclosed for acquiring intraoral scan data from a three-dimensional dental object during a scanning session. The method may include a processing unit, a memory unit, and a wireless interface, the processing unit being configured to process intraoral scan data of a patient and provide 2D image data and / or 3D image data. In addition, the method may include: receiving a session request for a session via the wireless interface; obtaining and storing a session key; and signing the session key with an intraoral scanning device key, wherein the intraoral scanning device key may be stored in a permanent memory of the intraoral scanning device. In addition, the method may include sending a session response including the signed session key, and receiving session data in the session via the wireless interface.

[0012] According to various aspects, a method of communicating with an intraoral scanning device is disclosed for acquiring intraoral scan data from a three-dimensional dental object during a scanning session. The method may include a processing unit, a memory unit, and a wireless interface, wherein the processing unit is configured to process intraoral scan data of a patient and provide 2D image data and / or 3D image data. In addition, the method may include: receiving a session request for a session via the wireless interface; obtaining and storing a session key; and encrypting the session key based on an intraoral scanning device key, wherein the intraoral scanning device key may be stored in a permanent memory of the intraoral scanning device. In addition, the method may include sending a session response including the encrypted session key, and receiving session data in the session via the wireless interface.

[0013] According to multiple aspects, a method of communicating with an intraoral scanning device for acquiring intraoral scan data from a three-dimensional dental object during a scanning session is disclosed. The method may include a processing unit, a memory unit, and a wireless interface, the processing unit being configured to process the intraoral scan data of a patient and provide 2D image data and / or 3D image data. In addition, the method may include transmitting a session request to the processing unit, obtaining and storing a session key, and encrypting the session key based on an intraoral scanning device key, wherein the intraoral scanning device key may be stored in a permanent memory of the intraoral scanning device. In addition, the method may include sending a session response including the encrypted session key, and receiving session data in the session via the wireless interface.

[0014] An intra-oral scanning device is in a scanning session when it is being used intentionally, such as for scanning the oral cavity of a patient.

[0015] The session key may be signed before being encrypted based on the intra-oral scanning device key, and wherein the session response contains the encrypted session key. The processing unit may be configured to verify the integrity of the session data. Encryption of the session key provides an additional layer of security when distributing the session key between the intra-oral scanning device and the external device(s).

[0016] The intraoral scanning device includes a processing unit. The processing unit may be configured to process intraoral scan data of the patient and provide 2D image data and / or 3D image data. The 2D image data and / or 3D image data may contain information about the anatomical structure of the patient's oral cavity, such as teeth, gums, bone levels, and / or information about diagnostic indicators, such as caries, bone loss, gingivitis, gum recession, periodontitis, bone loss, cracks, and bite.

[0017] The 2D image data and / or the 3D image data may be image data configured to be visualized on a display in 2D or 3D, respectively.

[0018] The session data may include customization data, and the customization data may include, for example, settings for a color image sensor of an intraoral scanning device. The intraoral scanning device may include a color image sensor, such as an RGB image sensor, wherein the customization data may include information about different color areas to be deactivated and / or activated during at least one scanning session. Thus, the customization data may relate to which color areas of the RBG image sensor should be activated or deactivated during a scanning session. The intraoral scanning device may include a monochrome image sensor and a color light emitting diode, and in this example, the customization data may include information about which of the different color light emitting diodes should be deactivated and / or activated during a scanning session. Thus, the customization data may include information about which color light emitting diodes should be activated or deactivated during a scanning session. The color light emitting diode may be configured to emit light having a color such as blue, red, green, etc. In another example, the intraoral scanning device may include one or more near-infrared light emitting diodes, which may also be set to be activated and / or deactivated during a scanning session by customization data. The customization data may include setting data, such as power management settings, configuration of a user interface of the intraoral scanning device, and / or settings of an optical unit of the intraoral scanning device.

[0019] The optical unit may include one or more light projectors, one or more optical components, and one or more image sensors.

[0020] The intraoral scanning device may include a processing unit, a memory unit and a wireless interface. The wireless interface may include a wireless transceiver configured, for example, for wireless communication in a frequency range from 2.4 GHz to 2.5 GHz, 2.4 GHz to 5 GHz, or about 2.4 GHz or about 5 GHz.

[0021] The processing unit may be configured to receive a session request for a session via the wireless interface. The processing unit may be configured to verify the session request, such as authenticating a sender of the session request, such as a client device or a server device. It is contemplated that the intra-oral scanning device and the sender of the session request have a pre-established authentication connection, which pre-established authentication connection thus permits the session request to be authenticated by the intra-oral scanning device. The session request may include a digital signature enabling the session request to be authenticated.

[0022] In one or more exemplary intraoral scanning devices, the session request includes a digital signature. The processing unit can be configured to verify the integrity of the session request, for example by verifying the digital signature. For example, a verifier of the processing unit can be configured to verify the digital signature. The processing unit verifies the digital signature using a signature verification function and a public key of the sender, which has generated the digital signature and included the digital signature in the session request. If the intraoral scanning device / processing unit determines that the digital signature has not been successfully verified using the so-called public key of the sender, the intraoral scanning device ignores the session request and terminates the session. This can provide the advantage that the intraoral scanning device rejects session requests from unauthenticated parties, thereby reducing the risk of battery drain attacks or limiting their impact.

[0023] Before receiving the session request, the intra-oral scanning device may be paired with the sender of the session request. In pairing, the intra-oral scanning device and the sending / client device may have exchanged one or more of the intra-oral scanning device identifier, the sender identifier, the session key / identifier, etc.

[0024] The processing unit is configured to obtain and / or store a session key; and optionally encrypt the session key based on the intraoral scanning device key. The session key may be a symmetric key. The symmetric session key may provide lightweight processing of security algorithms on the processing unit, such as lightweight encryption, lightweight decryption, lightweight integrity protection, etc.

[0025] The processing unit is configured to obtain a session key, and obtaining the session key may include generating the session key, for example, a random number or a pseudo-random number. Therefore, the intra-oral scanning device and / or the processing unit may include a number generator, for example, configured to generate a random number or a pseudo-random number. By using a unique session key or a session key from a large number of available session keys, the processing power requirements in the intra-oral scanning device may be reduced. In addition, simple encryption is facilitated and replay attacks are prevented.

[0026] The intra-oral scanning device key may be a symmetric key or a public key of a private key-public key pair. The intra-oral scanning device key may be stored in a permanent memory of the intra-oral scanning device, for example during manufacturing or during a customization session.

[0027] The processing unit is configured to send a session response in response to the session request. The session response may include an encrypted session key. The session response may include an intra-oral scanning device identifier and / or a session key. Therefore, the processing unit may be configured to send the intra-oral scanning device identifier and / or the session key in the session response. The session response including the intra-oral scanning device identifier may enable the sender of the session request to obtain the intra-oral scanning device key from a database or by requesting the intra-oral scanning device key from the manufacturer, which in turn enables the sender of the session request to decrypt the session key and use the session key when sending session data to the intra-oral scanning device.

[0028] The intra-oral scanning device disclosed herein has the advantage of verifying the integrity of received data, detecting any changes and ignoring the changed data. The intra-oral scanning device disclosed herein has the advantage of only opening a session with an authenticated party (such as an authenticated custom device, an authenticated accessory device, an authenticated external device and / or an authenticated server).

[0029] The processing unit is configured to receive session data in the session via the wireless interface. The processing unit may be configured to verify the integrity of the session data. The session data may include a message authentication code. Verifying the integrity of the session data may include, for example, verifying the message authentication code with a stored session key. The session data may include a digital signature. Verifying the integrity of the session data may include verifying the digital signature.

[0030] The processing unit may be configured to terminate the session if the integrity of the session data is compromised (ie, the integrity verification fails).

[0031] The processing unit may be configured to decrypt the session data using the session key. The processing unit may be configured to store at least a portion of the decrypted session data in the memory unit. The processing unit may be configured to terminate the session if the decryption of the session data fails. The session data may include customization data, intraoral scanning device operating parameters, and / or firmware data.

[0032] The intraoral scanning device operating parameters may correspond to settings of the handheld intraoral scanning device, which involve settings of an image sensor, a light projector, a wireless interface, a scanning sequence of the handheld intraoral scanning device, etc. The scanning sequence corresponds to scanning of a patient's jaw with the handheld intraoral scanning device, and the handheld intraoral scanning device is configured in real time to determine and transmit 3D image data based on intraoral scanning data acquired by the image sensor of the handheld intraoral scanning device during the scanning sequence.

[0033] Furthermore, the intraoral scanning device operating parameters relate to power management settings, configuration of a user interface of the intraoral scanning device and / or settings of an optical unit of the intraoral scanning device.

[0034] The handheld intraoral scanning device may include a user interface, which may include at least one touch sensor, at least one touch button, at least one light emitting diode, a tactile sensor and / or an accelerometer. The handheld intraoral scanning device may include a motion sensor configured to sense the movement of the handheld intraoral scanning device. The handheld intraoral scanning device is configured to wirelessly communicate with an external device connected to a display. The cursor on the display can move around based on the motion signal provided to the external device by the motion sensor. The user can navigate the cursor on the display by moving the handheld intraoral scanning device. The session data may include setting updates related to the motion sensor of the handheld intraoral scanning device, and the customization data may include settings for customizing the user interface of the handheld intraoral scanning device, which may involve graphic settings of a graphical user interface on the display. For example, when the handheld intraoral scanning device is connected to an external device, the handheld intraoral scanning device forwards the customization grouping to the external device via a wireless interface, and then the external device is configured to change the graphic settings based on the customization grouping. The customization grouping can be updated by the customization data provided by the session data.

[0035] The firmware data may include updates to the handheld intraoral scanning device that improve the functionality and features of the device.

[0036] The processing unit may be configured to process the intraoral scan data of the patient and provide 2D image data and / or 3D image data according to the received session data. Thus, the sender of the session request may control the operation of the intraoral scanning device by sending customization data, intraoral scanning device operating parameters and / or firmware data. The disclosed intraoral scanning device and method prevent unauthorized access or control of the intraoral scanning device.

[0037] The session data may be related to providing image data with improved quality or more features. In this example, the session data may be related to the optical unit or to a firmware update that improves the process of processing intraoral scan data into image data.

[0038] An intraoral scanning device capable of sending a session response may be scheduled at a specific time of the day when the intraoral scanning device is not used. The schedule may be determined by a processing unit based on the historical usage time of the intraoral scanning device and a machine learning model. The machine learning model receives a timestamp and input information about when the intraoral scanning device is used in a scanning session from a clock in the intraoral scanning device. The machine learning model contains a training data set, which contains the historical usage time of the intraoral scanning device in the scanning session. Based on the machine learning model and the timestamp defining the time of the day, if a mode request is received, the processing unit will know when to set to the requested mode. The advantage of this schedule is that the session request does not interfere with the dentist's work using the intraoral scanning device. In addition, the processing unit can be configured to perform time-consuming updates within (one or more) specific time periods. For example, an update that lasts for more than 30 minutes will be automatically scheduled to be performed within a time period of more than 30 minutes when the intraoral scanning device is not used, such as outside of working hours or during a break at the dentist / clinic. In other words, the processing unit is configured to schedule updates based on an estimated time for installing the update to the firmware of the memory unit.

[0039] The processing unit may be configured to send the session response if the timestamp is within a certain time period. The timestamp is generated by a clock of the intra-oral scanning device and received by the processing unit.

[0040] The processing unit may include a machine learning model that includes a training data set that includes historical data regarding when an intraoral scanning device is used in a scanning session, and wherein the machine learning model receives a timestamp from a clock in the intraoral scanning device and input information regarding when the intraoral scanning device is used in the scanning session, and if the machine learning model outputs a trigger that allows the processing unit to send a session response, the processing unit may be configured to send a session response.

[0041] The session data may relate to optical data associated with an optical unit for processing intraoral scan data, and for providing image data. The optical data may include settings for the light projector(s), image sensor(s), motors for focusing lenses, or firmware / settings for providing triangulation calculations involving emitted light from the light projector(s) and reflected light received by the image sensor(s). Furthermore, the optical data may include modified, updated, or new computer-implemented methods for processing intraoral scan data into 2D image data and / or 3D image data.

[0042] The session request corresponds to an optical session request associated with transmitting session data involving optical data.

[0043] As used herein, the term "intraoral scanning device" refers to a device configured to scan the inside of a patient's oral cavity or one or more parts thereof (such as one tooth, multiple teeth, gums, etc.) or obtain 2D image data and / or 3D image data of the patient's oral cavity or a part thereof (such as one tooth, multiple teeth, gums, etc.), and the intraoral scanning device may be an intraoral scanner that is fully or partially inserted into the patient's oral cavity, such as a wireless intraoral handheld scanner.

[0044] Client devices for secure communication with intraoral scanning devices:

[0045] Aspects of the present disclosure are to provide client devices and methods that seek to mitigate, alleviate or eliminate one or more of the above-mentioned deficiencies and disadvantages in the art, either singly or in any combination.

[0046] A further aspect of the present disclosure is to improve the security of wireless communications with an intra-oral scanning device to protect the intra-oral scanning device from potential attacks, such as an improved client device, and a method of communicating with an intra-oral scanning device that improves security.

[0047] According to multiple aspects, a client device for intraoral scanning device communication is disclosed. The client device may include a processing unit, a memory unit, and a wireless interface, the wireless interface being configured to receive 2D image data and / or 3D image data from the intraoral scanning device. The processing unit may be configured to send a session request for a session to the intraoral scanning device via the wireless interface, receive a session response from the intraoral scanning device via the wireless interface, the session response including an intraoral scanning device identifier. Furthermore, the processing unit may be configured to obtain a session key based on the session response. Additionally, the processing unit may be configured to determine intraoral scanning device data, generate session data based on the session key and the intraoral scanning device data, and send the session data to the intraoral scanning device via the wireless interface.

[0048] According to multiple aspects, a client device for intraoral scanning device communication is disclosed. The client device may include a processing unit, a memory unit, and a wireless interface, the wireless interface being configured to receive 2D image data and / or 3D image data from the intraoral scanning device. The processing unit may be configured to send a session request for a session to the intraoral scanning device via the wireless interface, and receive a session response from the intraoral scanning device via the wireless interface, the session response including an intraoral scanning device identifier. In addition, the processing unit may be configured to obtain a session key based on the session response, wherein obtaining the session key includes: establishing a connection to a session key generator via the wireless interface; sending a session key request to the session key generator via the wireless interface, the session key request including the intraoral scanning device identifier; receiving a session key response from the session key device via the wireless interface; and determining the session key based on the session key response. Additionally, the processing unit may be configured to determine intraoral scanning device data, generate session data based on the session key and the intraoral scanning device data, and send the session data to the intraoral scanning device via the wireless interface.

[0049] According to one aspect, a method for intraoral scanning device communication is performed in a client device, the client device comprising a processing unit, a memory unit, and a wireless interface, the wireless interface being configured to receive 2D image data and / or 3D image data from the intraoral scanning device. The method may include: sending a session request for a session to the intraoral scanning device via the wireless interface; receiving a session response via the wireless interface; obtaining a session key based on the session response, wherein obtaining the session key includes establishing a connection to a session key device; sending a session key request to the session key device; receiving a session key response from the session key device; and determining the session key based on the session key response. In addition, the method may include determining intraoral scanning device data, generating session data based on the session key and the intraoral scanning device data, and sending the session data to the intraoral scanning device via the wireless interface.

[0050] An intraoral scanning device is a handheld scanning device used to scan the inside of a patient's oral cavity. The intraoral scanning device differs from other types of dental scanning devices in that the intraoral scanning device is a handheld scanning device that can be easily operated by a user with one hand and has no wired connection to any external device during scanning of the inside of a patient's oral cavity. Therefore, the only attack that the intraoral scanning device may suffer is via a wireless interface.

[0051] The disclosed method and intraoral scanning device provide secure configuration of the intraoral scanning device, such as secure access to the memory of the intraoral scanning device. An advantage of the present disclosure is that the intraoral scanning device can only be configured or updated by an authorized party. Therefore, the disclosed intraoral device has the advantage of detecting and preventing any modification by an unauthorized party. The intraoral scanning device disclosed herein is advantageously protected from attacks, such as spoofing attacks, man-in-the-middle attacks, and / or replay attacks.

[0052] The intraoral scanning device is a key element to provide the required level of security for wireless communications in a service infrastructure that consists at least of the intraoral scanning device and the scanning computer or the dental software installed on the computer. It is not possible for a third party to attack the wireless communications, since this person would need to physically hold the intraoral scanning device in their hands. It would not even be sufficient to access the scanning computer or the dental software.

[0053] The disclosed method and client device provide secure communication from the client device to the intra-oral scanning device, such as providing the client device with secure and / or authorized access to the memory of the intra-oral scanning device. An advantage of the present disclosure is that the communication between the client device and the intra-oral scanning device is protected from any action or at least some actions from undesired parties. Therefore, the disclosed client device has the advantage of allowing the intra-oral scanning device to detect any modification by unauthorized parties. The client device provides secure communication for the intra-oral scanning device, which in turn can securely communicate with legitimate parties such as the client device and counter attacks such as spoofing attacks, man-in-the-middle attacks and / or replay attacks.

[0054] The methods disclosed herein provide for secure configuration and / or updating of intraoral scanning devices.

[0055] The present disclosure provides improved security for communications performed between a client device and an intraoral scanning device. Security includes assessing threats, vulnerabilities, and attacks, and developing appropriate security measures and countermeasures to protect against threats and attacks. The present disclosure provides an intraoral scanning device, which includes a processing unit configured to process intraoral scan data of a patient and provide 2D image data and / or 3D image data. The 2D image data and / or 3D image data may contain information about the patient's oral anatomical structure (such as teeth, gums, bone levels) and / or information about diagnostic indicators (such as caries, bone loss, gingivitis, gum recession, periodontitis, bone loss, cracks, and bites).

[0056] The processing unit can be configured to obtain a session key, and obtaining the session key includes: establishing a connection to a session key device via a wireless interface; sending a session key request to the session key device via the wireless interface, the session key request including an intra-oral scanning device identifier; receiving a session key response from the session key device via the wireless interface; and determining the session key based on the session key response.

[0057] The processing unit may be configured to obtain a session key including verifying the intra-oral scanning device identifier based on the client device key and deriving the session key based on the intra-oral scanning device identifier.

[0058] The processing unit can be configured to process the received 2D image data and / or 3D image data for use in visualizing the data on a display, for use in designing dental accessories such as aligners, retainers, crowns, implants, stents, night guards, etc., and / or for providing diagnostic data.

[0059] The 2D image data and / or the 3D image data may be image data configured to be visualized on a display in 2D or 3D, respectively.

[0060] The term "client device" as used herein refers to a device that communicates with an intraoral scanning device. A client device may refer to a computing device that acts as a client. Client devices may include customized devices, handheld devices, repeaters, tablet computers, personal computers, mobile phones, and / or USB dongles that are plugged into a personal computer. The client device may control the operation of the intraoral scanning device by sending customization data, intraoral scanning device operating parameters, and / or firmware data. The disclosed client device and method support the intraoral scanning device against attacks, such as unauthorized access or control of the intraoral scanning device, while still allowing access by legitimate parties such as client devices for, for example, customization purposes, update purposes, maintenance purposes.

[0061] The intraoral scanning device may operate in one or more modes. The one or more modes may include a first mode and / or a second mode. The one or more modes may include a third mode and / or a fourth mode. The one or more modes may include a default mode.

[0062] The client device may include a memory unit and a wireless interface connected to the processing unit, respectively. The wireless interface may include a wireless transceiver, which is configured to, for example, wirelessly communicate in a frequency range of from 2.4 GHz to 2.5 GHz, 2.4 GHz to 5 GHz, about 2.45 GHz, or about 5 GHz. The wireless transceiver may be a Bluetooth transceiver, a Bluetooth low energy transceiver, or a wireless fidelity (WIFI) transceiver. The wireless interface may form a connection to one or more other devices, such as a computer, and / or a scanning computer, and / or a tablet computer, and / or a smart phone.

[0063] In an embodiment, the wireless interface is configured for communication, such as wireless communication, with an intra-oral scanning device comprising a wireless transceiver.

[0064] The processing unit may be configured to send a session request for a session to the intraoral scanning device via a wireless interface. The processing unit may be configured to receive a session response from the intraoral scanning device via the wireless interface, for example, from the intraoral scanning device and / or a session key device. The session response may include an intraoral scanning device identifier or an identifier derived therefrom. In an exemplary client device, the client device may receive the intraoral scanning device identifier during pairing of the client device and the intraoral scanning device. Therefore, the processing unit includes, for example, a receiving / sending unit configured to send data (such as a session request) and / or receive data (such as a session response) via the wireless interface. The processing unit may be configured to obtain a session key based on, for example, a session response, such as extracting the session key from the session response or extracting the session key based on the session response. Therefore, the processing unit includes an acquirer. The processing unit may retrieve the session key from, for example, a key library stored in a memory unit. The processing unit may be configured to obtain the session key, wherein obtaining the session key may include establishing a connection to the session key device via the wireless interface. The processing unit may send a session key request to a session key device, such as a session key server, via the wireless interface, for example, via a wireless communication link established between the client device and the session key device via the wireless interface. The processing unit may receive a session key response from the session key device via the wireless interface, and may determine the session key based on the session key response.

[0065] The session response may include an intra-oral scanning device identifier. The intra-oral scanning device identifier may include a hardware number of the intra-oral scanning device and / or a serial number of the intra-oral scanning device. The client device may retrieve the session key from the session key device by providing the intra-oral scanning device identifier to the session key device, e.g., as part of a session key request, and requesting a session key or an intra-oral scanning device key from the session key device and / or requesting the session key device to decrypt the session response and / or the session key.

[0066] In one or more exemplary client devices, a processing unit configured to obtain a session key may be configured to: establish a connection to a session key device via a wireless interface; send a session key request to the session key device via the wireless interface; receive a session key response from the session key device via the wireless interface; and determine the session key based on the session key response. The session key request may include an intra-oral scan device identifier. The connection to the session key device may be a secure connection over a network, such as including private and / or public networks.

[0067] The session key means may be a custom accessory device; wherein the custom accessory device optionally includes a storage device containing a list configured to provide a session key and / or a session key response based on a session key request.

[0068] The processing unit may be configured to determine intraoral scanning device data. Thus, the processing includes, for example, a determiner. The intraoral scanning device data includes, for example, firmware, customization data, and / or intraoral scanning device operating parameters. The customization data may, for example, be setting data of the intraoral scanning device, such as power management settings, configuration settings, configuration of a user interface of the intraoral scanning device, and / or settings of an optical unit of the intraoral scanning device. Firmware may refer to a computer program provided by a manufacturer of the intraoral scanning device and to be installed on the intraoral scanning device to control the intraoral scanning device. For example, firmware is to be installed to upgrade the operation and capabilities of the intraoral scanning device.

[0069] The optical unit may include one or more light projectors, one or more optical components, and one or more image sensors.

[0070] The user interface of the intraoral scanning device may include at least one touch sensor, at least one touch button, at least one light emitting diode, a tactile sensor and / or an accelerometer.

[0071] The session response may include an encrypted session key.The processing unit may be configured to determine the session key by retrieving the session key from the session key response.

[0072] In one or more exemplary client devices, determining the session key includes retrieving the intra-oral scanning device key from the session key response or from the memory unit and decrypting the encrypted session key based on the intra-oral scanning device key. Alternatively, determining the session key may include decrypting the encrypted session key with a global key. For example, the global key is a key common to a group of client devices. The processing unit may be configured to retrieve the intra-oral scanning device key from the session key response and decrypt the encrypted session key based on the intra-oral scanning device key. The processing unit may include a decryption / encryption unit. The intra-oral scanning device key may be, for example, a symmetric key or a public key of a private key-public key pair. The intra-oral scanning device key may include an AES-128-bit key as a symmetric key. Using a symmetric key as the intra-oral scanning device key provides the advantage of being able to use a hardware accelerator. The intra-oral scanning device key may include a public key of a private key-public key pair, such as a public key of a private key-public key pair of an authorized publisher of the session key (such as a client device or a session key device).

[0073] The processing unit may be configured to determine the session key by including decrypting the encrypted session key with the global key, i.e., determining the session key may include decrypting the encrypted session key with the global key. The global key may be, for example, a symmetric key or a public key of a private key-public key pair. The session key may conform to an encryption standard, such as the Advanced Encryption Standard, AES, RSA encryption system, triple data encryption algorithm.

[0074] The processing unit may be configured to generate session data based on the session key and the intraoral scanning device data, for example including a message authentication code. Therefore, the processing unit may include a generator. The processing unit may generate a message authentication code based on the session key and the intraoral scanning device data. The message authentication code may be included in the session data. The processing unit may be configured to generate session data based on the intraoral scanning device key. The processing unit may be configured to digitally sign the intraoral scanning device data, such as digitally signing the intraoral scanning device data using a private key of a client device and / or a group of client devices. The processing unit may be configured to digitally sign the intraoral scanning device data using a private key obtained from a session key device, for example as part of a session key response. The processing unit may generate a digital signature using a signature generation function and the private key of the client device, and attach the digital signature to the session data. The intraoral scanning device may then verify the digital signature when receiving the session data. If the digital signature is not successfully verified using the so-called public key of the client device, the intraoral scanning device may ignore the session data and / or terminate the session. This may provide the advantage that the client device enables the intra-oral scanning device to reject session data that has been tampered with or received from an unauthenticated party, and communications with the intra-oral scanning device may therefore be robust against impersonation and spoofing attacks.

[0075] The processing unit may be configured to send the session data to the intra-oral scanning device via the wireless interface, for example using the receiving / transmitting unit. The session data may include intra-oral scanning device data encrypted with the session key. To encrypt the session data with the session key, the client device may utilize any of the above-mentioned encryption standards. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Various aspects of the present disclosure may be best understood from the following detailed description in conjunction with the accompanying drawings. For clarity, the drawings are schematic and simplified and they only show details that improve understanding of the claims, while other details are omitted. Throughout the text, the same reference numerals are used for the same or corresponding parts. The various features of each aspect may each be combined with any or all features of the other aspects. These and other aspects, features and / or technical effects will be apparent from and explained with reference to the illustrations described below, in which:

[0077] Figure 1 shows an exemplary architecture according to the present disclosure;

[0078] Figure 2 An exemplary intraoral scanning device is shown;

[0079] Figure 3 An exemplary sequence diagram between an intra-oral scanning device and a client device is shown.

[0080] Figure 4 shows an exemplary sequence diagram;

[0081] Figure 5 An exemplary flow chart illustrating a method;

[0082] Figure 6 shows an exemplary architecture according to the present disclosure;

[0083] Fig. 7A An exemplary intraoral scanning device is shown;

[0084] Figure 7B An exemplary client device is shown;

[0085] Figure 8 shows an exemplary sequence diagram; and

[0086] Fig. 9 An exemplary flow chart of a method is shown. DETAILED DESCRIPTION

[0087] The specific embodiments described below in conjunction with the accompanying drawings are intended as descriptions of various configurations. The specific embodiments contain specific details for the purpose of providing a thorough understanding of various concepts. However, it is apparent to those skilled in the art that these concepts can be practiced without these specific details. Several aspects of the devices, systems, media, programs, and methods are described by various blocks, functional units, modules, components, circuits, steps, processes, algorithms, etc. (collectively referred to as "elements"). Depending on the specific application, design constraints, or other reasons, these elements can be implemented using electronic hardware, computer programs, or any combination thereof.

[0088] The electronic hardware may include microprocessors, microcontrollers, digital signal processors (DSPs), field programmable gate arrays (FPGAs), programmable logic devices (PLDs), gated logic, discrete hardware circuits, and other appropriate hardware configured to perform the various functions described throughout the present disclosure. Computer programs should be broadly interpreted as instructions, instruction sets, codes, code segments, program codes, programs, subroutines, software modules, applications, software applications, software groupings, routines, subroutines, objects, executable programs, threads of execution, processes, functions, etc., whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.

[0089] The scanning for providing intraoral scan data can be performed by a dental scanning system, which can include an intraoral scanning device (such as the TRIOS series scanner from 3Shape A / S). The dental scanning system can include wireless capabilities provided by a wireless network unit. The intraoral scanning device can adopt scanning principles such as triangulation-based scanning, confocal scanning, focused scanning, ultrasonic scanning, x-ray scanning, stereoscopic vision, motion structure, optical coherence tomography OCT, or any other scanning principle. In an embodiment, the intraoral scanning device operates by projecting a pattern and translating the focal plane along the optical axis of the intraoral scanning device and capturing multiple 2D images at different focal plane positions, so that each captured 2D image series corresponding to each focal plane forms a stack of 2D images. The acquired 2D image is also referred to herein as an original 2D image, where original in this context means that the image has not been image processed. The focal plane position is preferably moved along the optical axis of the scanning system so that for a given view of the object, that is, for a given arrangement of the scanning system relative to the object, the 2D images captured at multiple focal plane positions along the optical axis form a stack of the 2D images (also referred to herein as sub-scans). After moving the intraoral scanning device relative to the object or imaging the object in different views, a stack of new 2D images of the view can be captured. The focal plane position can be changed by means of at least one focusing element (e.g., moving the focusing lens). The intraoral scanning device generally moves and tilts during the scanning session so that at least some groups of sub-scans overlap at least partially to enable stitching in post-processing. The result of the stitching is that the digital 3D representation of the surface is larger than the surface that can be captured by a single sub-scan, that is, it is larger than the field of view of the 3D scanning device. Stitching, also called registration, is performed by identifying overlapping areas of the 3D surface in each sub-scan and converting the sub-scans to a common coordinate system so that the overlapping areas match to ultimately produce a digital 3D model. For this purpose, an iterative closest point (ICP) algorithm can be used. Another example of an intraoral scanning device is a triangulation scanner, in which a time-varying pattern is projected onto a dental object, and a sequence of images of different pattern configurations is acquired by one or more cameras positioned at an angle relative to the projection unit.

[0090] The intraoral scanning device includes one or more light projectors configured to generate an illumination pattern to be projected onto a three-dimensional dental object during a scanning session. (One or more) light projectors preferably include a light source, a mask having a spatial pattern, and one or more lenses, such as a collimating lens or a projection lens. The light source can be configured to generate light of a single wavelength or a combination of wavelengths (monochromatic or polychromatic). The wavelength combination can be generated by using a light source configured to generate light including different wavelengths (such as white light). Alternatively, (one or more) light projectors may include multiple light sources, such as LEDs, which respectively generate light of different wavelengths, such as red, green, and blue, which can be combined to form light including different wavelengths. Therefore, the light generated by the light source can be defined by a wavelength that defines a specific color, or by a range of different wavelengths that define a combination of colors, such as white light. In one embodiment, the intraoral scanning device includes a light source configured to excite a fluorescent material of a tooth to obtain fluorescent data from a dental object. Such a light source can be configured to generate a narrow range of wavelengths. In another embodiment, the light from the light source is infrared (IR) light that can penetrate dental tissue. The (one or more) light projectors can be a DLP projector using a micromirror array for generating a time-varying pattern, or a diffractive optical element (DOF), or a backlit mask projector, wherein a light source is placed behind a mask having a spatial pattern, whereby the light projected on the surface of the dental object is patterned. The backlit mask projector can include a collimating lens for collimating light from the light source, the collimating lens being placed between the light source and the mask. The mask can have a checkerboard pattern so that the generated illumination pattern is a checkerboard pattern. Alternatively, the mask can feature other patterns, such as lines or dots, etc.

[0091] The intraoral scanning device preferably also includes an optical component for directing light from the light source to the surface of the dental object. The specific arrangement of the optical component depends on whether the intraoral scanning device is a focused scanning device, a scanning device using triangulation, or any other type of intraoral scanning device. The same applicant further describes a focused scanning device in EP 2 442 720 B1, the entire content of which is incorporated herein by reference.

[0092] Using the optical components of the intraoral scanning device, light reflected from the dental object in response to the illumination of the dental object is directed toward (one or more) image sensors. (One or more) image sensors are configured to generate multiple images based on the incident light received from the illuminated dental object. The image sensor can be a high-speed image sensor, such as an image sensor configured to acquire images with an exposure of less than 1 / 1000 seconds or a frame rate of more than 250 frames per second (fps). As an example, the image sensor can be a rolling shutter (CCD) or a global shutter sensor (CMOS). (One or more) image sensors can be monochrome sensors that include a color filter array (such as a Bayer filter and / or additional filters) that can be configured to substantially remove one or more color components from the reflected light before the reflected light is converted into an electrical signal and retain only other components that have not been removed. For example, such additional filters can be used to remove a portion of the white light spectrum (such as a blue component) and retain only the red component and the green component in the signal generated in response to the excitation fluorescent material of the tooth.

[0093] The network unit may be configured to connect the dental scanning system to a network including a plurality of network elements, the plurality of network elements including at least one network element configured to receive the processed data. The network unit may include a wireless network unit. The wireless network unit is configured to wirelessly connect the dental scanning system to a network including a plurality of network elements, the plurality of network elements including at least one network element configured to receive the processed data.

[0094] The dental scanning system preferably also includes a processor configured to generate scan data (such as intraoral scan data) by processing a two-dimensional (2D) image acquired by the intraoral scanning device. The processor may be part of the intraoral scanning device. As an example, the processor may include a field programmable gate array (FPGA) and / or an advanced RISC machine (ARM) processor located on the intraoral scanning device. The scan data includes information related to a three-dimensional dental object. The scan data may include any of the following: a 2D image, a 3D point cloud, depth data, texture data, intensity data, color data, and / or a combination thereof. As an example, the scan data may include one or more point clouds, each of which includes a set of 3D points describing a three-dimensional dental object. As another example, the scan data may include an image, each image including image data described, for example, by image coordinates and a timestamp (x, y, t), wherein the depth information may be inferred from the timestamp. The (one or more) image sensors of the intraoral scanning device may acquire multiple original 2D images of the dental object in response to irradiating the object using one or more light projectors. Multiple original 2D images may also be referred to herein as stacks of 2D images. The 2D image can then be provided as an input to a processor that processes the 2D image to generate scan data. The processing of the 2D image can include a step of determining which portion of each of the 2D images is focused in order to infer / generate depth information from the image. The depth information can be used to generate a 3D point cloud, which includes, for example, a set of 3D points in a space described by Cartesian coordinates (x, y, z). The 3D point cloud can be generated by a processor or another processing unit. Each 2D / 3D point can also include a timestamp that indicates when the 2D / 3D point was recorded, that is, which image in the stack of 2D images the point originated from. The timestamp is related to the z coordinate of the 3D point, that is, the z coordinate can be inferred from the timestamp. Therefore, the output of the processor is scan data, and the scan data may include image data and / or depth data, such as data described by image coordinates and timestamps (x, y, t) or alternatively described as (x, y, z). In addition to scan data, the intraoral scanning device can be configured to transmit other types of data. Examples of data include 3D information, texture information such as infrared (IR) images, fluorescent images, reflectance color images, X-ray images, and / or combinations thereof.

[0095] Figure 1An exemplary architecture 100 according to the present disclosure is schematically shown. The architecture 100 includes an intraoral scanning device 10, a client device 110, and a server device 111. The client device 110 may include a computing device that acts as a client, such as a customized device, a handheld device, a repeater, a tablet computer, a personal computer, a mobile phone, and / or a USB dongle plugged into a personal computer. The server device 111 may include a computing device configured to act as a server, i.e., to serve requests from the client device 110 and / or from the intraoral scanning device 10. The server device 111 may be controlled by the intraoral scanning device manufacturer.

[0096] The intraoral scanning device 10 can be connected to the client device 110 via a communication link 113, such as a two-way communication link and / or a wireless communication link. The wireless communication link can be carried on a short-range communication system, such as Bluetooth, Bluetooth low power and / or WIFI. The intraoral scanning device 10 can be connected to the client device 110 over a network.

[0097] The intraoral scanning device 10 may be connected to a server device 111 via a wireless communication link 114 or a bidirectional wireless communication link 114 over a network 114a, such as a bidirectional wireless communication link and / or a wireless communication link over a network.

[0098] Client device 110 may be connected to server device 111 via communication link 112 over network 112a, such as a two-way wireless communication link and / or a wireless communication link over the network. In one embodiment, network 112a may be the Internet.

[0099] Figure 2 An exemplary intraoral scanning device 10 is schematically shown. The exemplary intraoral scanning device 10 comprises a processing unit 202 configured to process intraoral scan data of a patient and to provide 2D image data and / or 3D image data.

[0100] The exemplary intra-oral scanning device 10 includes a memory unit 203 and a wireless interface 204 connected to a processing unit 202, respectively. Figure 2203 is illustrated in the form of a memory unit 203 external to the processing unit 202. In other exemplary intraoral scanning devices, the memory may be at least partially embedded in the processing unit 202 and / or the memory unit 203. The processing unit 202 is configured to receive a session request for a session via the wireless interface 204. Therefore, the processing unit 202 includes a receiving / sending unit 205, which is configured to send and / or receive via the wireless interface 204. The receiving / sending unit 205 is configured to send and receive to / from an external device, such as a server device, a client device, a customized device, an accessory, a relay device, a tablet computer, via the wireless interface 204. The processing unit 202 is configured to obtain and store a session key. Therefore, the processing unit 202 may include an obtainer 206, which is configured to obtain and / or generate a session key and store the session key in, for example, the memory unit 203. Obtaining the session key may include generating a random number or a pseudo-random number using a number generator 210 included in the intraoral scanning device 101. Processing unit 202 may include a random number generator 210. The session key obtained may be a 128-bit random number or pseudo-random number, a 192-bit random number or pseudo-random number, a 256-bit random number or pseudo-random number, or any other bit size random number or pseudo-random number. The session key may be obtained to comply with an encryption standard such as the Advanced Encryption Standard, AES, RSA encryption system, Triple Data Encryption Algorithm, TDEA, Elliptic Curve Cryptography System, or any other encryption system. The session key may be generated uniquely for each session using, for example, the digital generator 210. This provides robustness against, for example, replay attacks.

[0101] When the intra-oral scanning device key can be stored in a permanent memory of the intra-oral scanning device, the processing unit 202 is configured to sign the session key by the intra-oral scanning device key. The processing unit 202 is configured to send a session response including the signed session key, for example, by using the receiving / sending unit 205 and the wireless interface 204. The processing unit 202 is configured to receive session data in the session via the wireless interface 204, for example, by using the receiving / sending unit 205 and the wireless interface 204. The processing unit 202 receives the session data in the session from an external device, such as the client device 110 and / or the server device 111.

[0102] The processing unit 202 is configured to encrypt the session key based on the intra-oral scanning device key. Therefore, the processing unit 202 may include an encryption / decryption unit 207. The processing unit 202 is configured to send a session response including an encrypted session key, which may be signed by the intra-oral scanning device key, for example by using the receiving / transmitting unit 205 and the wireless interface 204. The processing unit 202 is configured to receive session data in the session via the wireless interface 204, for example by using the receiving / transmitting unit 205 and the wireless interface 204. The processing unit 202 receives the session data in the session from an external device, such as the client device 110 and / or the server device 111.

[0103] The intraoral scanning device includes a light projector 220 and an image sensor 230. The light projector contains at least one or more light emitting diodes and / or one or more infrared light sources for emitting light patterns to a three-dimensional dental object 290 of a patient or a wax model 290 as a replica of a patient's dental object. The image sensor 230 receives reflected light from the dental object 290, and the image sensor 230 converts the reflected light into intraoral scan data. The processing unit 202 is then configured to process the intraoral scan data into 2D image data and / or 3D image data. The image data is then forwarded to the wireless interface 204, which transmits the data to an external device.

[0104] In one or more exemplary intraoral scanning devices, the processing unit 202 is configured to verify the integrity of the session data. Therefore, the processing unit 202 may include a verifier 208. For example, the processing unit 202 is configured to determine whether the integrity of the session data is compromised, that is, whether the session data is tampered with or modified by an unauthorized party. The processing unit 202 detects insertions, deletions, and / or replacements of data, such as by an unauthorized party (such as by any party other than the sender).

[0105] In one or more exemplary intraoral scanning devices, the processing unit 202 is configured to terminate the session if the integrity of the session data is compromised. Therefore, the processing unit 202 may include a terminator 209. For example, when the processing unit 202 or the validator 208 determines that the session data has been tampered with or modified (e.g., by insertion, deletion, and / or replacement) by an unauthorized party, the processing unit 202 rejects the received session data, and the terminator 209 or the processing unit 202 terminates the session with, for example, an external device. Terminating the session includes deleting the session key from, for example, the memory unit 203. Deleting the session key protects the intraoral scanner device 10 from any replay attack or any attack based on any communications captured by the attacker.

[0106] In one or more exemplary intraoral scanning devices, the session data includes a message authentication code, and the processing unit 202 that verifies the integrity of the session data is configured to verify the message authentication code with a stored session key. Therefore, the verifier 208 is configured to verify the message authentication code with a stored session key. Based on the session data and the decrypted session key, a message authentication code MAC is generated by a sender such as an external device. Upon receiving the session data including the MAC, the intraoral scanning device holding the stored session key can recalculate the MAC based on the received session data and the MAC generation function, and compare the recalculated MAC with the received MAC. If the recalculated MAC does not match the received MAC, the intraoral scanning device determines that the session data is corrupted. The intraoral scanning device ignores the session data and terminates the session. For example, the processing unit 202 ignores the session data and terminates the session using the terminator 208.

[0107] In one or more exemplary intraoral scanning devices, the session data includes a digital signature. The processing unit 202 that verifies the integrity of the session data is configured to verify the digital signature. For example, the verifier 208 is configured to verify the digital signature. The processing unit 202 verifies the digital signature using a signature verification function and the sender's public key, which has generated the digital signature and attached it to the session data. If the processing unit 202 determines that the digital signature is not successfully verified using the sender's so-called public key, the processing unit 202 ignores the session data and terminates the session. This can provide the advantage that the intraoral scanning device 10 rejects session data that has been tampered with or received from an unauthenticated party, and is therefore robust to counterfeiting and masquerade attacks.

[0108] In one or more exemplary intra-oral scanning devices, the processing unit 202 is configured to decrypt the session data with the session key and store at least part of the decrypted session data in the memory unit 203. The client device 110 or the server device 111 can send the encrypted session data to the intra-oral scanning device 10. The processing unit 202 receives the encrypted session data via the receiving / transmitting unit 205 and the wireless interface 204. The processing unit 202 retrieves the session key from, for example, the memory unit 203, and decrypts the session data using the retrieved session key and the decryption function. The processing unit 202 stores the decrypted session data in the memory unit 203. The processing unit 202 is configured to terminate the session if the decryption of the session data fails. If the session data is encrypted with a key different from the session key stored in the intra-oral scanning device 10, the decryption of the session data may fail. This can provide the advantage that the intra-oral scanning device 10 rejects session data received by parties that do not hold the session key, and is therefore robust to attacks based on such illegal data.

[0109] In one or more exemplary intraoral scanning devices, the session data includes customization data, intraoral scanning device operating parameters and / or firmware data. Firmware may refer to a computer program provided by the manufacturer of the intraoral scanning device and to be installed on the intraoral scanning device to control the intraoral scanning device. For example, the firmware is to be installed to upgrade the operation and capabilities of the intraoral scanning device. The customization data may include, for example, the settings of the color image sensor of the intraoral scanning device. The intraoral scanning device may include a color image sensor, such as an RGB image sensor, wherein the customization data may include information about different color areas to be deactivated and / or activated during at least one scanning session. Therefore, the customization data may involve which color areas of the RBG image sensor should be activated or deactivated during the scanning session. The intraoral scanning device may include a monochrome image sensor and a color light emitting diode, and in this example, the customization data may include information about which of the different color light emitting diodes should be deactivated and / or activated during the scanning session. Therefore, the customization data may include information about which color light emitting diodes should be activated or deactivated during the scanning session. The color light emitting diode may be configured to emit light having colors such as blue, red, green, etc. In another example, the intraoral scanning device may include one or more near infrared light emitting diodes, which may also be configured to be activated and / or deactivated during a scanning session via customization data. The customization data may include settings data, such as power management settings, configuration of a user interface of the intraoral scanning device, and / or settings of an optical unit of the intraoral scanning device.

[0110] The optical unit may include one or more light projectors, one or more optical components, and one or more image sensors.

[0111] In one or more exemplary intraoral scanning devices, the processing unit 202 is configured to process the intraoral scan data of the patient and provide 2D image data and / or 3D image data according to the received session data. The processing unit 202 can perform processing of the intraoral scan data of the patient and provide 2D image data and / or 3D image data based on the customized data.

[0112] In one or more exemplary intra-oral scanning devices, the session key comprises a symmetric key. The symmetric key may be generated uniquely for each session using, for example, a digital generator 210. The symmetric key may comprise an AES-128 bit key. Using a symmetric key as a session key may reduce processing power requirements and allow the intra-oral scanning device 10 to decrypt session data using a light encryption algorithm.

[0113] In one or more exemplary intra-oral scanning devices, the intra-oral scanning device key is a symmetric key or a public key of a private key-public key pair. The intra-oral scanning device key may include an AES-128 bit key as a symmetric key. Using a symmetric key as the intra-oral scanning device key provides the advantage of being able to use a hardware accelerator. The intra-oral scanning device key may include a public key of a private key-public key pair, such as a public key of a private key-public key pair of an authorized publisher of a session key (such as server 111).

[0114] In one or more exemplary intraoral scanning devices, the processing unit 202 is configured to send an intraoral scanning device identifier in a session response. The intraoral scanning device identifier may refer to a unique device identifier. The intraoral scanning device identifier may include a hardware number, a serial number, a MAC address. The session response may include an encrypted session key and the intraoral scanning device identifier. The processing unit 202 is configured to send the intraoral scanning device identifier to an external device (such as a client device 110 or a server device 111) in a session response. During the manufacture of the intraoral scanning device 10, the intraoral scanning device key may be stored in a permanent memory, such as a memory unit 203 of the intraoral scanning device 10.

[0115] Figure 3An exemplary sequence diagram 300 between the intra-oral scanning device 10 and the client device 110 is shown. The intra-oral scanning device 10 receives a session request 301 for a session from the client device 110 via the wireless interface 204. The intra-oral scanning device 10 obtains and stores a session key. The intra-oral scanning device 10 encrypts the session key based on the intra-oral scanning device key. The intra-oral scanning device 10 sends a session response 302 including the encrypted session key to the client device 110. The intra-oral scanning device 10 may alternatively send a session response 302 encrypted with the intra-oral scanning device key to the client device 110, the session response 302 including the session key. The client device 110 receiving the session response 302 may request 304 the server device 111 to decrypt the encrypted session key included in the session response 302, or to decrypt the encrypted session response 302. Based on the request 304, the server device 111 may send the decrypted session key to the client device 110 in a response 305. This may be when the intra-oral scanning device key used at the intra-oral scanning device 10 is the public key of the private key-public key pair of the server 101. When the intra-oral scanning device key is a symmetric key, the server device 111 may send the decrypted session key to the client device 110 in the response 305, or send the intra-oral scanning device key to the client device 110 in the response 305, which client device 110 is able to subsequently decrypt the session key or the session response 302. The response 305 may include the decrypted session key or intra-oral scanning device key. The communication link 112 between the client device 110 and the server device 111 is secure, i.e., authenticated, encrypted, and / or integrity protected using a security protocol (e.g., a transport layer security protocol). The intra-oral scanning device 10 receives session data 303 from the client device 110 in the session via the wireless interface 204. The session data 303 may then be encrypted and / or integrity protected at the client device 110, for example, by using the session key. In one or more exemplary intra-oral scanning devices, the processing unit 202 is configured to verify the integrity of the session data, as described above in conjunction with Figure 2 As described. The session data 303 may include a message authentication code. Based on the session data and the decrypted session key, a message authentication code MAC is generated by the sender (such as a client device / server device). Upon receiving the session data including the MAC, the intra-oral scanning device holding the stored session key is able to recalculate the MAC based on the received session data and the MAC generation function, and compare the recalculated MAC with the received MAC. If the recalculated MAC does not match the received MAC, the intra-oral scanning device determines that the session data is corrupted. The intra-oral scanning device ignores the session data and terminates the session. For example, the processing unit 202 ignores the session data and terminates the session using the terminator 208.

[0116] Figure 4An exemplary sequence diagram 300' between the intra-oral scanning device 10, the client device 110 and the server device 111 is shown. The intra-oral scanning device 10 receives a session request 311 for a session from the server device 111 via the wireless interface 204. The intra-oral scanning device 10 obtains and stores a session key. The intra-oral scanning device 10 encrypts the session key based on the intra-oral scanning device key. The intra-oral scanning device 10 sends a session response 312 including the encrypted session key to the server device 111. Alternatively, the intra-oral scanning device 10 may send a session response 312 encrypted with the intra-oral scanning device key to the server device 111, the session response 312 including the session key. The server device 111 may decrypt the encrypted session key included in the session response 312, or decrypt the encrypted session response 312. The communication link 112 between the intra-oral scanning device 10 and the server device 111 may be through the client device 110 and / or through a network. The communication link 112 between the intra-oral scanning device 10 and the server device 111 may be secure or may be unsecure (i.e., authenticated, encrypted, and / or integrity protected using a secure protocol). The intra-oral scanning device 10 receives session data 313 from the server device 111 in the session via the wireless interface 204. The session data 313 may then be encrypted and / or integrity protected at the server device 111.

[0117] Figure 5 A flowchart 400 of an exemplary method according to the present disclosure is schematically shown. The method 400 is proposed for communication of an intra-oral scanning device 10 including a processing unit 202, a memory unit 203 and a wireless interface 204, such as for protecting the communication of the intra-oral scanning device with, for example, an external device (a client device and / or a server device and / or an accessory device). The method 400 is executed in the intra-oral scanning device 10. The method 400 includes receiving S1 a session request for a session via the wireless interface 204. Receiving S1 may include receiving the session request from an external device, such as a client device 110 and / or a server device 111.

[0118] The method 400 includes obtaining and storing an S2 session key, such as in the memory unit 203. Obtaining and storing the S2 session key, such as in the memory unit 203, may include generating a random number or pseudo-random number with a number generator 210 included in the intra-oral scanning device 10. Obtaining and storing the S2 session key may include generating a 128-bit random number or pseudo-random number, a 192-bit random number or pseudo-random number, a 256-bit random number or pseudo-random number, or any other bit size random number or pseudo-random number.

[0119] Method 400 includes encrypting S3 a session key based on the intra-oral scanning device key. Encrypting and / or signing S3 the session key based on the intra-oral scanning device key. Encryption may include using an encryption standard such as the Advanced Encryption Standard, AES, RSA encryption system, Triple Data Encryption Algorithm, TDEA, Elliptic Curve Cryptography System, or any other encryption system.

[0120] Method 400 includes sending S4 a session response including an encrypted and / or signed session key, and receiving S5 session data in the session via a wireless interface. Sending S4 a session response including an encrypted and / or signed session key may include sending the session response to client device 110 and / or server device 111. Receiving S5 session data in the session via wireless interface 204 may include receiving session data from client device 110 and / or server device 111.

[0121] In one or more exemplary methods, method 400 includes verifying the integrity of S6 session data. Verifying the integrity of the S6 session data may include determining whether the integrity of the session data has been compromised, i.e., determining whether the session data has been tampered with or modified by an unauthorized party. Verifying the integrity of the S6 session data may include detecting, for example, data insertion, deletion, and / or replacement by an unauthorized party (such as by any party other than a legitimate sender). Verifying the S6 integrity of the session data may include verifying a message authentication code attached to the session data (e.g., using a stored session key) and / or a digital signature attached to the session data. When it is determined that the integrity of the session data has not been compromised, the intraoral scanning device 10 may grant the external device permission to read and / or write to the storage area. For example, the session data or intraoral scanning device data derived from the session data may be written to the memory unit 203.

[0122] The method 400 includes terminating the S7 session if the integrity of the session data is compromised. For example, if it is determined that the session data has been tampered with or modified (e.g., by insertion, deletion, and / or replacement) by an unauthorized party, terminating S7 includes rejecting the received session data and terminating the session with, for example, an external device. Terminating S7 may include deleting a session key from, for example, the memory unit 203.

[0123] In one or more exemplary methods, the method 400 comprises decrypting S8 the session data with the session key and storing S9 at least a portion of the decrypted session data in a memory unit. Decrypting S8 the session data with the session key may comprise retrieving the session key from, for example, the memory unit 203 and decrypting the session data using the retrieved session key and a decryption function.

[0124] Client devices for secure communication with intraoral scanning devices:

[0125] Figure 6 An exemplary architecture 100 according to the present disclosure is shown. The architecture 100 includes an intraoral scanning device 10, a client device 110, and a session key device 111. The client device 110 may include a computing device, a customized device, a handheld device, a repeater, a tablet computer, a personal computer, a mobile phone, and / or a USB dongle plugged into a personal computer that acts as a client. The session key device 111 may include a computing device configured to act as a server, i.e., to serve requests from the client device 110 and / or from the intraoral scanning device 10. The server device 111 may be controlled by the intraoral scanning device manufacturer.

[0126] The intraoral scanning device 101 can be connected to the client device 110 via a communication link 113, such as a wireless communication link or a two-way wireless communication link. The wireless communication link can be carried over a short-range communication system, such as Bluetooth, Bluetooth low energy, IEEE 802.11, Zigbee, WIFI. The intraoral scanning device 101 can be connected to the client device 110 over a network.

[0127] The intra-oral scanning device 101 may be connected to the session key device 111 via a wireless communication link 114 or a bidirectional wireless communication link 114 over a network 114a, such as a wireless communication link over a network and / or a bidirectional wireless communication link.

[0128] Client device 110 may be connected to session key device 111 via communication link 112 over network 112a, such as a wireless communication link and / or a bidirectional wireless communication link over the network. In an embodiment, network 112a may be the Internet.

[0129] Fig. 7A An exemplary intraoral scanning device 10 is shown. The exemplary intraoral scanning device 101 comprises a processing unit 202 configured to process intraoral scan data of a patient 290 and provide 2D image data and / or 3D image data. The exemplary intraoral scanning device 101 comprises a memory and a wireless interface 204. Fig. 7A The memory is illustrated in the form of a memory unit 203 that is external to the processing unit 202. In other exemplary intra-oral scanning devices, the memory may be at least partially embedded in the processing unit 202 and / or the memory unit 203.

[0130] The processing unit 202 is configured to receive a mode request via the wireless interface 204. Therefore, the processing unit 202 includes a receiving / transmitting unit 205, which is configured to send and / or receive via the wireless interface 204. The receiving / transmitting unit 205 is configured to send and receive to / from an external device (such as a server device, a client device, a customized device, an accessory, a relay device, a smart phone) via the wireless interface 204. The processing unit 202 is configured to authenticate the mode request. Therefore, the processing unit 202 may include an authenticator 206 configured to authenticate the mode request. The processing unit 202 is configured to place the intraoral scanning device in a requested mode, such as a service mode, a customized mode, an upgrade mode, or a debug mode, if the authentication of the mode request is successful. Therefore, the processing unit 202 includes a mode controller 207, which is configured to place the intraoral scanning device 101 in the requested mode, for example based on an output from the authenticator 206. In Fig. 7A In the intraoral scanning device of the present invention, the processing unit 202 is configured to, if the authentication of the mode request fails, place the intraoral scanning device in a default mode, the default mode including starting the intraoral scanning device and operating the intraoral scanning device according to the operating parameters set during startup. In one embodiment, the operating parameters set during startup may be stored in a non-volatile portion of the memory unit 203. In one embodiment, the operating parameters set during startup may include default settings that enable the intraoral scanning device to operate according to the default settings programmed during the production of the intraoral scanning device.

[0131] The intraoral scanning device includes a light projector 220 and an image sensor 230. The light projector contains at least one or more light emitting diodes and / or one or more infrared light sources for emitting light patterns to a three-dimensional dental object 290 of a patient or a wax model 290 as a replica of a patient's dental object. The image sensor 230 receives reflected light from the dental object 290, and the image sensor 230 converts the reflected light into intraoral scan data. The processing unit 202 is then configured to process the intraoral scan data into 2D image data and / or 3D image data. The image data is then forwarded to the wireless interface 204, which transmits the data to an external device.

[0132] Figure 7BAn exemplary client device 110 is schematically shown. The exemplary client device 110 includes a processing unit 202 configured to communicate with an intra-oral scanning device 101. The exemplary client device 110 includes a memory unit 203 and a wireless interface 204, respectively connected to the processing unit 202. The processing unit 202 is configured to send a session request for a session to the intra-oral scanning device via the wireless interface. The session request may include an intra-oral scanning device identifier or an identifier derived therefrom. The processing unit 202 is configured to receive a session response via the wireless interface, for example, from the intra-oral scanning device 101 and / or the session key device 111. Therefore, the processing unit 202 includes, for example, a receiving / sending unit 205, which is configured to send and / or receive via the wireless interface 204. The processing unit 202 is configured to obtain a session key based on, for example, the session response, such as extracting the session key from the session response. Therefore, the processing unit 202 includes an obtainer 206. The processing unit 202 may retrieve the session key from a key store stored in the memory unit 203, for example.

[0133] Obtaining the session key may include verifying the intra-oral scanning device identifier based on the client device key and deriving the session key based on the intra-oral scanning device identifier.

[0134] Alternatively, obtaining the session key may include establishing a connection to the session key device 111 via the wireless interface 204, i.e., the processing unit 202 may be configured to establish a connection to the session key device via the wireless interface. The processing unit 202 may send a session key request to the session key device via the wireless interface 204, e.g., including the intra-oral scanning device identifier. The processing unit 202 may receive a session key response from the session key device 111 via the wireless interface 204, the session key response optionally including the intra-oral scanning device key. The processing unit 202 may determine the session key based on the session key response, e.g., by decrypting the encrypted session key with the intra-oral scanning device key from the session key device.

[0135] The session response may include an intra-oral scanning device identifier. The intra-oral scanning device identifier may include a hardware number of the intra-oral scanning device and / or a serial number of the intra-oral scanning device. The client device 110 may retrieve the session key from the session key device 111 by providing the intra-oral scanning identifier to the session key device 111 and requesting the session key from the session key device 111 and / or requesting the session key device 111 to decrypt the session response and / or the session key.

[0136] In one or more exemplary client devices, obtaining a session may include: establishing a connection to a session key device via a wireless interface; sending a session key request to the session key device via the wireless interface; receiving a session key response from the session key device via the wireless interface; and determining a session key based on the session key response. The connection establishment may be, for example, a secure connection establishment using a secure protocol to a server acting as a session key device.

[0137] The processing unit 202 is configured to determine intraoral scanning device data. Therefore, the processing includes, for example, a determiner. The intraoral scanning device data includes, for example, firmware, customization data and / or intraoral scanning device operating parameters. Therefore, the client device 110 can be a customized computer or a dentist computer. The customization data can, for example, be data generated by a customized computer used by a dentist. The customization data can include setting data for the intraoral scanning device, such as power management settings, configuration settings, configuration of the user interface of the intraoral scanning device, and / or settings of the optical unit of the intraoral scanning device. The intraoral scanning device operating parameters may include modes and / or program control parameters. Firmware may refer to a computer program provided by the manufacturer of the intraoral scanning device and to be installed on the intraoral scanning device to control the intraoral scanning device. For example, firmware is to be installed to upgrade the operation and capabilities of the intraoral scanning device.

[0138] The client device may be in the form of a desktop computer, laptop computer, or tablet computer that includes software configured to provide the functionality of a customized computer.

[0139] The session response may include an encrypted session key. Processing unit 202 may be configured to determine the session key by retrieving the session key from the session key response.

[0140] In one or more exemplary client devices, determining the session key includes retrieving the intra-oral scanning device key from the session key response and decrypting the encrypted session key based on the intra-oral scanning device key. Alternatively, determining the session key may include decrypting the encrypted session key with a global key. For example, the global key is a key common to a group of client devices. The processing unit 202 is configured to, for example, retrieve the intra-oral scanning device key from the session key response and decrypt the encrypted session key based on the intra-oral scanning device key. The processing unit may include a decryption / encryption unit. For example, the intra-oral scanning device key may be a symmetric key or a public key of a private key-public key pair. The intra-oral scanning device key may include an AES-128 bit key as a symmetric key. Using a symmetric key as an intra-oral scanning device key provides the advantage of being able to use a hardware accelerator. The intra-oral scanning device key may include a public key of a private key-public key pair, such as a public key of a private key-public key pair of an authorized publisher of the session key (such as the client device 110 or the session key device 111).

[0141] In one or more exemplary client devices, determining the session key includes decrypting the encrypted session key with a global key. The global key can be, for example, a symmetric key or a public key of a private key-public key pair. The session key can conform to or be encrypted with an encryption standard, such as an Advanced Encryption Standard, AES, RSA encryption system, or a triple data encryption algorithm.

[0142] The processing unit 202 is configured to generate session data, for example, based on a session key and intraoral scanning device data. Therefore, the processing includes, for example, a generator 208. The processing unit 202 can generate a message authentication code based on the session key and the intraoral scanning device data. The client device 110 generates a message authentication code MAC based on the session data and the session key. Upon receiving session data including a MAC, the intraoral scanning device holding the stored session key can recalculate the MAC based on the received session data and the MAC generation function, and compare the recalculated MAC with the received MAC. If the recalculated MAC does not match the received MAC, the intraoral scanning device determines that the session data is destroyed. The processing unit 202 that generates session data can be configured to encrypt intraoral scanning device data with a session using, for example, an encryption scheme. The encryption scheme may include a symmetric encryption scheme and / or an asymmetric encryption scheme. The session key may include a symmetric key. The symmetric key may be uniquely generated for each session by the intraoral scanning device and / or the session key device. The symmetric key may include an AES-128 bit key. Using a symmetric key as the session key can reduce processing power requirements and allow the intra-oral scanning device 10 to decrypt the session data using a lightweight encryption algorithm.

[0143] The processing unit 202 can be configured to digitally sign the intraoral scanning device data, such as using a private key of a client device and / or a group of client devices to digitally sign the intraoral scanning device data. The processing unit 202 generates a digital signature using a signature generation function and the private key of the client device 110, and attaches it to the session data. The intraoral scanning device 101 can then verify the digital signature when receiving the session data. If the digital signature is not successfully verified using the so-called public key of the client device 110, the intraoral scanning device 101 can ignore the session data and terminate the session. This can provide the advantage that the client device 110 supports the intraoral scanning device 101 to reject session data that has been tampered with or received from an unauthenticated party, and the communication with the intraoral scanning device can therefore be robust against impersonation and spoofing attacks.

[0144] The processing unit 202 is configured to send the session data to the intra-oral scanning device via the wireless interface, for example using the receiving / transmitting unit 205. The session data may include intra-oral scanning device data encrypted with the session key. To encrypt the session data with the session key, the client device 110 may utilize any of the above encryption standards.

[0145] Figure 8 An exemplary sequence diagram 300 involving a session key device 111 is shown. The client device 110 sends a session request 301 to, for example, an intra-oral scanning device 101 via the wireless interface 204. The client device 110 receives a session response 302 from, for example, the intra-oral scanning device 101. The session response 302 may include an encrypted session key. The client device 110 obtains the session key. For example, obtaining the session key includes verifying the intra-oral scanning device identifier based on the client device key and deriving the session key based on the intra-oral scanning device identifier. Alternatively, to obtain the session key, the client device 110 may send a session key request 304 to the session key device 111, whereupon the session key device decrypts the encrypted session key included in the session response 302. Based on the session key request 304, the session key device 111 may send the decrypted session key or intra-oral scanning device key to the client device 110 in a session key response 305, so that the client device can decrypt the encrypted session key. The session key response 305 from the session key device 111 may include the decrypted session key. The communication link 112 between the client device 110 and the session key device 111 is secure. For example, the session key device 111 can be physically attached to the client device 111 as a USB dongle. Alternatively, the session key device 111 can be connected to the client device via a network. The communication link 112 between the client device 110 and the session key device 111 can be secure, that is, authenticated, encrypted and / or integrity protected using a security protocol (e.g., a transport layer security protocol). The client device 110 determines the intra-oral scanning device data and generates session data 303 based on the session key and the intra-oral scanning device data. For example, the client device 110 encrypts the intra-oral scanning device data with the session key. The session data 303 can be integrity protected by the client device 110. The client device 110 sends the session data 303 in the session via the wireless interface 204.

[0146] Fig. 9 An exemplary flow chart of a method for intra-oral scanning device communication performed in a client device 110 is shown. The client device 110 includes a processing unit 202, a memory unit 203, and a wireless interface 204. The method includes sending A1 a session request for a session to the intra-oral scanning device 101 (e.g., to the intra-oral scanning device 101 and / or the session key device 111) via the wireless interface 204. The method includes receiving A2 a session response from the intra-oral scanning device 101 and / or the session key device 111 via the wireless interface 204.

[0147] The method includes obtaining an A3 session key based on the session response, such as extracting the session key from the session response. Obtaining the A3 session key may include establishing an A31 connection to session key device 111, sending an A32 session key request to session key device 111, receiving an A33 session key response from session key device 111, and determining an A34 session key based on the session key response. Client device 110 may retrieve the session key from session key device 111 by providing an intra-oral scanning device identifier to session key device 111 and requesting the session key from session key device 111 and / or requesting session key device 111 to decrypt the session response and / or the session key.

[0148] In one or more methods, receiving the A2 session response may include receiving the A21 encrypted session key. Determining the A33 session key may include retrieving the A33a session key from the session key response. Determining the A33 session key may include retrieving the A33b intra-oral scan device key from the session key response and decrypting the A33c encrypted session key based on the intra-oral scan device key.

[0149] In one or more approaches, receiving A2 the session response may include receiving A21 the encrypted session key. Obtaining A3 the session key based on the session response may include decrypting 35 the encrypted session key with a global key. The global key may be stored in the client device 110, such as in the memory 203.

[0150] The method includes determining A4 intra-oral scanning device data. The method includes generating A5 session data based on a session key and the intra-oral scanning device data. The method includes sending A6 session data to the intra-oral scanning device via a wireless interface.

[0151] Although some embodiments have been described and shown in detail, the present disclosure is not limited to such details, but may also be implemented in other ways within the scope of the subject matter defined in the appended claims. In particular, it should be understood that other embodiments may be utilized and structural and functional modifications may be made without departing from the scope of the present invention.

[0152] Benefits, other advantages, and solutions to problems have been described herein with respect to specific embodiments. However, benefits, advantages, solutions to problems, and any (one or more) parts / (one or more) units that may cause any benefit, advantage, or solution to appear or become more significant should not be construed as key, essential, or necessary features or parts / elements of any or all claims or the present invention. Therefore, the scope of the present invention is limited only by the appended claims, wherein unless expressly stated, references to singular parts / units / elements are not intended to mean "one and only one", but "one or more". A claim may refer to any of the preceding claims, and "any" is understood to mean "any one or more" in the preceding claims.

[0153] Structural features of the apparatus described above in the detailed description and / or in the claims may be combined with steps of the method when appropriately replaced by corresponding processes.

[0154] As used, the singular forms "a", "an", and "the" are intended to include the plural forms as well (i.e., have the meaning of "at least one"), unless expressly stated otherwise. It will also be understood that the terms "includes", "comprises", "including", and / or "comprising", when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or parts, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, parts, and / or combinations thereof. It will also be understood that, unless expressly stated otherwise, when an element is referred to as being "connected" or "coupled" to another element, the element may be directly connected or coupled to the other element, but there may also be intermediate elements. In addition, "connected" or "coupled" as used herein may include wireless connections or couplings. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items. Unless expressly stated otherwise, the steps of any disclosed method are not limited to the exact order described herein.

[0155] It should be understood that throughout this specification, references to "one embodiment" or "embodiment" or "aspect" or features included as "possible" mean that the specific features, structures or characteristics described in conjunction with this embodiment are included in at least one embodiment of the present disclosure. In addition, in one or more embodiments of the present disclosure, specific features, structures or characteristics may be appropriately combined. The previous description is provided to enable those skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be apparent to those skilled in the art and the general principles defined herein may be applied to other aspects.

[0156] The claims are not intended to be limited to the aspects shown herein, but are to be accorded the full scope consistent with the claim language, wherein, unless otherwise specifically stated, elements referred to in the singular are not intended to mean "one and only one," but rather "one or more." Unless expressly stated otherwise, the term "some" refers to one or more.

[0157] Project List:

[0158] 1. A client device (110) for communicating with an intraoral scanning device, the client device (110) comprising

[0159] a wireless interface (204) configured to receive 2D image data and / or 3D image data from an intraoral scanning device,

[0160] A memory unit (203);

[0161] a processing unit (202) configured to process received 2D image data and / or 3D image data; and

[0162] The processing unit (202) is further configured to:

[0163] Sending a session request (301) for a session to the intra-oral scanning device via the wireless interface (204);

[0164] receiving a session response (302) from the intra-oral scanning device via the wireless interface (204), the session response (302) including an intra-oral scanning device identifier;

[0165] obtaining a session key based on the session response (302),

[0166] Determine intraoral scanning device data;

[0167] generating session data based on the session key and the intra-oral scanning device data (303); and

[0168] The session data (303) is sent to the intra-oral scanning device via the wireless interface (204).

[0169] 2. A client device according to item 1, wherein obtaining the session key comprises: establishing a connection to the session key device (111) via the wireless interface (204); sending a session key request (304) to the session key device (111) via the wireless interface (204), the session key request (304) including the intra-oral scanning device identifier; receiving a session key response (305) from the session key device (111) via the wireless interface (204); and determining the session key based on the session key response (305).

[0170] 3. The client device of item 1, wherein obtaining the session key comprises verifying the intra-oral scanning device identifier based on the client device key and deriving the session key based on the intra-oral scanning device identifier.

[0171] 4. The client device according to item 2, wherein the connection to the session key device (111) is a secure connection over a network.

[0172] 5. A client device according to any one of items 2 to 4, wherein the session key device (111) is a customized accessory device; wherein the customized accessory includes a storage device containing a list configured to provide session keys and / or session key responses (305) based on a session key request (304).

[0173] 6. A client device according to any one of items 2 to 5, wherein the session key device (111) is a computer server; wherein the computer server includes a storage device containing a list configured to provide session keys and / or session key responses (305) based on a session key request (304).

[0174] 7. A client device according to any one of items 2 to 6, and wherein the session response (302) includes an encrypted session key, and wherein determining the session key includes retrieving the session key from the session key response (305).

[0175] 8. A client device according to item 7, wherein determining the session key includes retrieving an intra-oral scanning device key from the session key response (305) and decrypting the encrypted session key based on the intra-oral scanning device key; or wherein determining the session key includes decrypting the encrypted session key with a global key.

[0176] 9. A client device according to any of the preceding items, wherein generating session data (303) based on the session key and the intra-oral scanning device data includes generating a message authentication code based on the session key and the intra-oral scanning device data.

[0177] 10. The client device of any of the preceding items, wherein generating session data based on the session key and the intra-oral scanning device data comprises digitally signing the intra-oral scanning device data.

[0178] 11. A client device according to any of the preceding items, wherein the intraoral scanning device data includes firmware, customization data and / or intraoral scanning device operating parameters.

[0179] 12. A method for intra-oral scanning device communication performed in a client device (110), the client device (110) comprising a processing unit (202), a memory unit (203) and a wireless interface (204), the wireless interface being configured to receive 2D image data and / or 3D image data from the intra-oral scanning device, the method comprising:

[0180] Sending a session request (301) for a session to the intra-oral scanning device via the wireless interface (204);

[0181] · receiving a session response (302) via the wireless interface (204);

[0182] Obtaining a session key based on the session response;

[0183] Determine the intraoral scanning device data;

[0184] Generate session data based on the session key and the intra-oral scanning device data (303); and

[0185] • Sending the session data (303) to the intra-oral scanning device via the wireless interface (204).

[0186] 13. A method according to item 12, wherein obtaining a session key includes establishing a connection to a session key device (111), sending a session key request (304) to the session key device (111), receiving a session key response (305) from the session key device (111), and determining the session key based on the session key response (305).

[0187] 14. A method according to any one of items 12 and 13, and wherein receiving a session response (302) includes receiving an encrypted session key, and wherein determining the session key includes retrieving the session key from the session key response (302).

[0188] 15. A method according to any one of items 12 to 14, wherein determining the session key includes retrieving an intraoral scanning device key from the session key response (305) and decrypting the encrypted session key based on the intraoral scanning device key.

[0189] 16. A method according to any one of items 12 to 15, wherein receiving a session response (302) includes receiving an encrypted session key, and obtaining the session key based on the session response (302) includes decrypting the encrypted session key with a global key.

Claims

1. A handheld intraoral scanning device (10) configured to acquire intraoral scan data from a three-dimensional dental object during a scanning session, the handheld intraoral scanning device comprising: A processing unit (2) configured to process the intraoral scan data of the patient and provide 3D image data; a wireless interface (4) configured to transmit said 3D image data; and Memory (3); Characterized in that the processing unit (202) is configured to: Receiving a session request (301) for a session via the wireless interface (204), wherein the session request (301) comprises a digital signature; Authenticating the digital signature used to initiate the session; Obtain and store session keys; Signing the session key with an intra-oral scanning device key, wherein the intra-oral scanning device key is stored in a permanent memory of the intra-oral scanning device (101); Sending a session response (302) including the signed session key; and ·Receiving session data (303) in the session via the wireless interface (204), and wherein the session data (303) corresponds to customization data for the handheld intraoral scanning device, handheld intraoral scanning device operating parameters and / or firmware data for the handheld intraoral scanning device.

2. The handheld intraoral scanning device according to claim 1, wherein: The session key is encrypted based on the intra-oral scanning device key, and wherein the session response includes the encrypted session key.

3. A handheld intraoral scanning device according to any one of the preceding claims, wherein: The processing unit (202) is configured to receive a client-signed session key via the wireless interface (204) and decrypt the received session data (303) in the session.

4. A handheld intraoral scanning device according to any one of the preceding claims, wherein: The processing unit (202) is configured to verify the integrity of the session data (303).

5. A handheld intraoral scanning device according to any one of the preceding claims, wherein: The processing unit (202) is configured to terminate the session if the integrity of the session data (303) is violated.

6. A handheld intraoral scanning device according to any one of the preceding claims, wherein: The session data (303) includes a message authentication code, and wherein verifying the integrity of the session data (303) includes verifying the message authentication code with the stored session key.

7. A handheld intraoral scanning device according to any one of the preceding claims, wherein: The session data (303) includes a digital signature, and wherein verifying the integrity of the session data (303) includes verifying the digital signature.

8. The handheld intraoral scanning device according to any one of claims 2 to 7, wherein: The processing unit (202) is configured to: decrypting the session data using the session key (303); and At least a portion of the decrypted session data is stored in the memory unit (203).

9. The handheld intraoral scanning device according to claim 8, wherein: The processing unit (202) is configured to terminate the session if decryption of the session data (303) fails.

10. A handheld intraoral scanning device according to any one of the preceding claims, wherein: The session data (303) includes customization data, intraoral scanning device operating parameters and / or firmware data.

11. A handheld intraoral scanning device according to any one of the preceding claims, wherein: The processing unit (202) is configured to process intraoral scan data of a patient and provide 2D image data and / or 3D image data according to received session data (303).

12. A handheld intraoral scanning device according to any one of the preceding claims, wherein: The session key is a symmetric key.

13. A handheld intraoral scanning device according to any one of the preceding claims, wherein: Obtaining the session key includes generating a random number or a pseudo-random number using a number generator included in the intra-oral scanning device.

14. A handheld intraoral scanning device according to any one of the preceding claims, wherein: The intra-oral scanning device key is a symmetric key or a public key of a private key-public key pair.

15. A handheld intraoral scanning device according to any one of the preceding claims, wherein: The processing unit (202) is configured to send an intra-oral scanning device identifier in the session response (302).

16. A method for communicating with a handheld intraoral scanning device (101) for acquiring intraoral scan data from a three-dimensional dental object during a scanning session, the handheld intraoral scanning device comprising: A processing unit (202), a memory unit (203) and a wireless interface (204), wherein the processing unit (202) is configured to process intra-oral scan data of a patient and provide 2D image data and / or 3D image data, the method comprising: Receiving a session request (301) for a session via the wireless interface (204), wherein the session request (301) comprises a digital signature; · Authenticating the digital signature used to initiate the session; Obtain and store session keys; Signing the session key with an intra-oral scanning device key, wherein the intra-oral scanning device key is stored in a permanent memory of the intra-oral scanning device; Sending a session response (302) including the signed session key; and ·Receiving session data (303) in the session via the wireless interface (204), wherein the session data (303) corresponds to customization data for the handheld intraoral scanning device, handheld intraoral scanning device operating parameters and / or firmware data for the handheld intraoral scanning device.

17. The method according to claim 16, comprising verifying the integrity of the session data (303).

18. The method according to claim 17, comprising terminating the session if the integrity of the session data (303) is breached.

19. The method according to any one of claims 16 to 18, comprising: Decrypting the session data using the session key (303); as well as • Storing at least a portion of the decrypted session data in said memory unit (203).

20. The method according to any one of claims 16 to 20, comprising verifying the integrity of the session data (303).

Images