SAFE CONTROL OF DIALYSIS MACHINES

Description

[0001] The invention relates to the secure control of medical devices, in particular dialysis machines, from a remote control device.

[0002] Dialysis machines are blood treatment devices in which a patient's fluid is supplied to a fluid treatment component via a fluid line, treated by the fluid treatment component, and returned to the patient via the fluid line, which can be divided into an arterial and a venous branch. Examples of such blood treatment devices include, in particular, hemodialysis machines. One such blood treatment device is the subject of DE 198 49 787 C1, owned by the applicant. Hemodialysis, hemofiltration, and hemodiafiltration procedures are generally performed using automatic hemodialysis machines, such as those marketed by the applicant. A plasmapheresis device is used to perform plasmapheresis, a blood treatment procedure in which the patient's blood is separated into blood plasma and its corpuscular components (cells).The separated blood plasma is purified or replaced with a substitution solution, and the purified blood plasma or substitution solution is returned to the patient. Peritoneal dialysis machines are used to perform peritoneal dialysis, in which a patient's abdominal cavity is filled with a dialysis fluid via a catheter inserted through the abdominal wall. This dialysis fluid has a concentration gradient of blood substances such as electrolytes (e.g., sodium, calcium, and magnesium) compared to the body's own fluids. Toxins present in the body pass from the blood vessels running through the peritoneum into the abdominal cavity through the membrane. After a few hours, the dialysis fluid in the patient's abdominal cavity, now mixed with the toxins excreted from the body, is replaced.Through osmotic processes, water from the patient's blood can pass through the peritoneum into the dialysis fluid, thus dehydrating the patient.

[0003] The dialysis machines mentioned above and currently on the market are generally self-contained, meaning the program flow logic for controlling the machine is located on the machine itself. At least one user interface is provided on the dialysis machine as an input and output unit.

[0004] To increase flexibility, it is desirable that the dialysis machines can also be controlled by remote control devices.

[0005] However, security requirements for medical devices are significantly higher than for other technical devices. Therefore, even with remote control, an appropriate security concept must be implemented to reliably prevent, on the one hand, the misuse of protected data (PHI data, protected health data, such as patient-related data) and, on the other hand, unintentional interference with the control of the medical device (e.g., by connecting to the control line) that could potentially endanger the patient.

[0006] Systems for securely coupling devices are known, e.g., from US 2006 / 143455 A1. This document discloses sending (304) secure information, such as a Bluetooth code, a PIN, or a combination thereof, from a first device (102) via a wired connection (260) and receiving (306) from a second device (104) an acknowledgment of the secure information via a wireless connection (105). Furthermore, the method described in this document comprises communicating via a connection using at least part of the secure information to maintain a secure connection.

[0007] Furthermore, DE 10 2012 111 523 A1 shows a dialysis treatment system (1) with a dialysis machine, which has a communication device (3) which is designed to wirelessly transmit an interrogation signal and wirelessly receive an identification signal, as well as an identification device (4) which can be worn by an operator (100) for identifying the operator (100), wherein the identification device (4) is configured to wirelessly transmit an identification signal to the medical device (2).

[0008] The object of the present invention is therefore to provide an improved safety concept for a medical device or a group of these devices, which on the one hand enables increased flexibility of operation and maintenance and on the other hand can also meet the increased safety requirements through structural construction measures.

[0009] This object is achieved according to the invention by devices, systems and methods according to the attached, mutually independent patent claims.

[0010] In the following, the invention is described with reference to the solution to the problem according to the device, and thus with reference to the control device. Features, advantages or alternative embodiments mentioned are also to be transferred to the other claimed subject matters and vice versa. In other words, the method-based claims can also be developed further with the features that are described and / or claimed in connection with the control device and vice versa. The corresponding functional features of the method are formed by corresponding material modules, in particular by electronic hardware modules or microprocessor modules, of the system or the product and vice versa. For example, the detection of an initialization signal can be carried out by a corresponding signal generator, which can be formed, for example, as a button on a surface.

[0011] According to a first aspect, the invention relates to a control system according to claim 1.

[0012] The control system can comprise a control device for establishing a secure communication connection for controlling at least one remote medical device, in particular a dialysis machine. The control device is thus arranged separately from or outside the medical device and comprises at least one control instance and, as a rule, several control instances, each of which is responsible for controlling at least one medical device. For this purpose, the control device is further configured with: a (control device-side or server-side) communication device for communicating with the medical device; an integrated circuit module configured to implement a security protocol for establishing a secure communication connection for controlling the medical device, and wherein the security protocol exchanges identification messages for uniquely identifying the medical device and for uniquely identifying the respective control instance on the control device.

[0013] According to a preferred embodiment of the invention, the execution of the security protocol on the control device is initiated by detecting an initialization message on the control device. The initialization message is typically sent from the medical device to the control device. Thus, the initiation of the method for establishing a secure communication connection originates from the medical device. The technical reason for this is that, so to speak, sovereignty over the control situation lies with the medical device to be controlled. This can increase security by preventing remotely triggered compromise attempts.

[0014] According to a further preferred embodiment of the invention, the control device comprises a user interface. The user interface serves to acquire control signals for controlling the medical device. Cumulatively or alternatively, the user interface can serve not only for data input (of control commands), but also for data output of status data of the medical device. In particular, a device and / or treatment status can be output. It can, for example, be an interface formed directly on the control device, in particular a graphical interface. Alternatively, it is also possible to form the user interface in a separate device and not on the control device. This increases the flexibility for device coupling to establish a secure communication channel. In this case, the separate user interface or user interface exchanges data with the control device.

[0015] In a further aspect, the object is achieved by a security method according to claim 3.

[0016] It can be provided that the medical device is controlled via a remote control device. The medical device comprises a client-side communication device configured to exchange data with a server-side communication device of the control device. Furthermore, it comprises an integrated circuit module configured to implement a security protocol for establishing a secure communication connection to the control device, and wherein the security protocol exchanges identification messages for the unique identification of the medical device and for the unique identification of a respective control instance on the control device, wherein each control instance is intended for the dedicated control of a specific medical device.

[0017] The control system for establishing a secure communication connection for controlling at least one medical device, in particular a dialysis machine, with a remote control device comprises: The medical device to be controlled; a control device as described above, wherein the participating devices exchange data via at least one network (wireless and / or wired).

[0018] In an advantageous embodiment of the invention, the control system can additionally optionally comprise a user interface, which can be designed either on the control device or externally and separately or separately from it, e.g. on a mobile communication device, such as a mobile radio device or another electronic device or terminal. The separate device with the user interface is in bidirectional data exchange with the control device and / or with the control system. This can increase flexibility. In an advantageous embodiment, it is ensured that the external user interface can only communicate with the control device via the medical device if the external user interface is in the spatial environment or in the vicinity of the medical device. This can be carried out, for example, via position determination, as described in more detail in patent specification EP2925381B1.This makes unauthorized access via wireless networks even more difficult.

[0019] As already mentioned above, the object is achieved by a security method for at least one medical device, in particular for a dialysis machine according to claim 3, and in particular by a security method that is used in a control system. The security method serves to establish a secure communication connection between the medical device and a remotely arranged control device, wherein the control device comprises at least one control instance, each of which is tasked with controlling at least one medical device. The security method can be used in a control system and comprises first sections that are executed on the medical device and second sections that are executed on the control device.Both sections together form a distributed method for executing a security protocol on the control device and the medical device to establish a secure communication connection for (subsequent) control of the medical device. The security protocol exchanges identification messages for the unique identification of the medical device and for the unique identification of the respective control instance on the control device with the medical device.

[0020] In an advantageous embodiment of the invention, the backup method may additionally comprise the method step before executing the backup protocol: Detecting a trigger signal on the medical device to initiate the execution of the security protocol. This ensures that the medical device initiates the pairing process, which can improve security.

[0021] In an advantageous embodiment of the invention, the execution of the backup protocol comprises the following steps: Sending an initialization message with a unique device identification for the medical device from the medical device to the control device and in particular to all control instances on the control device; if multiple control devices are used in the system, the initialization message can also be sent to all control devices. This can preferably be carried out in the form of a broadcast message. Receiving the initialization message on the control device; On the part of the control device: sending a first confirmation message to the medical device with an identification of the assigned control instance in response to the received initialization message; receiving the first confirmation message on the medical device and on the part of the medical device: sending a second confirmation message to the control device in response to the received first confirmation message.

[0022] In an advantageous embodiment of the invention, the control device is configured after receiving the initialization message in response to the received initialization message. The configuration can, for example, comprise determining a specific control instance for the respective medical device and thus its allocation process to the device. The configuration can comprise determining parameters (parameterization for the specific medical device). This is particularly advantageous when the control device is to control multiple medical devices in parallel or when multiple secure communication connections are to be established between the control device and different medical devices. This makes it possible to achieve the technical advantage that multiple medical devices can be operated and controlled in parallel or simultaneously via a corresponding network connection.Consequently, the central and uniform control of a group of devices (e.g. using a preconfigurable control scheme stored in a database) is simplified.

[0023] In other words, multiple control instances (for multiple medical devices) can be implemented on the control device. Preferably, the initialization message will then be a broadcast message to all control instances of the control device. Alternatively or cumulatively, multiple control devices can also be integrated into the same network.

[0024] In another advantageous embodiment of the invention, the initialization message includes an equipment code representing the technical equipment of the medical device. The term "equipment" refers to the technical equipment of the device and can include the following parameters: a version of the device, implemented hardware and / or software, device modules, and / or intended use and / or performance data of the device, and / or other technical parameters. Alternatively or cumulatively, the initialization message can also include calibration data.

[0025] In another advantageous embodiment of the invention, after the security protocol has been executed, a pairing result is displayed on a user interface of the control device and / or the medical device. The pairing result can indicate the success of the security method or the pairing process. The pairing result can be in the form of a message, for example, to signal whether the secured pairing was successful or failed.

[0026] In another advantageous embodiment of the invention, after execution of the security protocol, a connection result is signaled by activating a hardware component. The hardware component can be configured to display at least two states in parallel: a first state of a successful connection and a second state of a faulty or unsuccessful connection. This can be implemented, in particular, in the form of a traffic light signal (e.g., in the form of an electronic traffic light: green for successful connection and establishment of a secure communication channel, and red for failed connection).

[0027] In another advantageous embodiment of the invention, the execution of the security protocol comprises: On the part of the control device: Evaluate whether a second confirmation message was received on the control device within a predefined timeout period in response to a first confirmation message received. If no, output a failed pairing message at least on the control device (and / or on other electronic instances, in particular on the medical device) and / or if yes, output a pairing message (signaling a successful result) on the control device. The secure communication connection can then be established. Once established, the medical device can be remotely controlled securely from the control device.

[0028] The invention further describes a server protection system for a control device that controls a remote medical device, in particular a dialysis machine, via a secure communication connection. The server protection system comprises: A testing unit configured to perform a two-aspect test, namely, to continuously check whether the secure communication connection is maintained and the treatment sequence is correct, so that no patient endangerment exists, and if so (i.e., if the secure communication connection is maintained and the treatment sequence on the dialysis machine is correct), to instruct a release unit with at least one command specified below. Checking whether the treatment sequence is correct is preferably performed using a test algorithm based on the data exchanged via the secure communication connection. The testing monitors the process sequence on the dialysis machine for correctness. A first aspect of the testing thus relates to the correctness of the communication (data integrity), and a second aspect relates to checking the data content itself (e.g., temperature below limit value, etc.).In both cases, an enable signal would be omitted if one of the two tests is failed. In an advantageous embodiment of the invention, the test algorithm can be executed exclusively on the medical device. This can increase safety. The enable unit, which, upon instruction from the test unit, sends an enable signal to the medical device or triggers the transmission of the enable signal by another electronic unit.

[0029] The invention also describes a client protection system for a medical device, in particular a dialysis machine, which is controlled by a control device via a secure communication connection. The client protection system comprises: A monitoring unit that is designed to continuously and automatically monitor whether the at least one release signal has been received within a predefined fault tolerance time. Optionally, a second aspect can also be monitored, namely whether the treatment sequence is correct, and if the monitoring comprising two aspects was unsuccessful in at least one aspect, a transfer logic is instructed with a corresponding command (as described below); The transfer logic, which is designed to automatically transfer the medical device to a safe device state if it has been instructed by the monitoring unit according to the result of the monitoring, e.g. via a lack of a further release signal from the monitoring unit in a good case or via a blocking signal in a bad case of the monitoring (i.e. if at least one of the aspects does not indicate a successful state).

[0030] The transfer logic is an electronic module (hardware and / or software) implemented on the medical device that transfers the device from an operating state to a safe device state and vice versa. In a figurative sense, the transfer logic thus functions as a switch. The transfer logic is controlled by appropriate input signals, in particular a lock signal or another enable signal. The safe device state is characterized by the fact that no measures that endanger patient safety can be triggered. In a special case, the medical device can also be partially or completely deactivated if it is to be transferred to the safe device state. In a preferred embodiment of the invention, it is configurable in advance which functionalities should be operated or executed in the safe device state (e.g., stopping blood flow to the patient).Typically, the arterial and venous clamps to the patient are closed, ensuring that no energy and / or fluid transport between the dialysis machine and the patient is possible. In other cases, the blood pump may be stopped or the dialysis machine shut down (e.g., if internal electrical voltages are too high). There are other cases where blood return is permitted.

[0031] In a preferred embodiment of the invention, the client protection system is provided with the monitoring unit instructing the medical device or another electronic entity on the medical device (e.g., a transmitting unit and / or the client-side communication device) to send status data packets to the server protection system via the secure communication connection if at least one release signal has been received within a predefined fault tolerance time.

[0032] Also described is an operating method for a distributed protection system, comprising a client protection system implemented on a medical device, in particular a dialysis machine, and further comprising a server protection system, which may be implemented on a control device arranged remotely from the medical device, and in which it is continuously checked whether a secure communication connection between the medical device and the control device continues to exist, comprising the following automatically executed steps: On the server protection system: Signal exchange-based checking to determine whether a secure communication connection between the medical device and the control device is maintained and the treatment process is correct or whether there is no patient endangerment condition. If the check was successful (secure communication connection is maintained and treatment process is correct or there is no patient endangerment condition): Cyclic sending of at least one release signal to the medical device; On the client protection system: Fully automatic, computer-implemented monitoring to determine whether at least one release signal was received within a predefined fault tolerance time, and if not, automatic transfer of the medical device to a safe device state.

[0033] In a preferred embodiment of the invention, the signal exchange-based testing can be performed by the medical device cyclically sending status data packets to the protection system, and the protection system analyzing the consecutively correct reception of the status data packets. This has the technical advantage that the data packets that are to be transmitted anyway, such as sensor data or status data, can be used to form the basis of a server-side test.

[0034] In a further advantageous embodiment of the operating method according to the invention, the status data packets can include a timestamp or a sequence number (as a consecutive number). This is particularly helpful if the data packets would otherwise be indistinguishable with regard to their time signal.

[0035] In a further advantageous embodiment of the operating method, the server protection system can be implemented on the control device, preferably in a protected memory area of ​​the control device. Alternatively, the server protection system can also be implemented on a second control device implemented separately in terms of hardware. This can improve security.

[0036] In a further advantageous embodiment of the operating method, the same is carried out completely automatically and computer-implemented, and in particular without user interaction. This makes the operation of the protection system more secure by eliminating the possibility of incorrect user input.

[0037] Also described is a distributed protection system for a medical device, in particular a dialysis machine, which is controlled by a remote control device, and wherein the protection system comprises: A server protection system as described above and a client protection system as also described therein.

[0038] A first section of the operating method can be executed on the control device, and a second section can be executed on the medical device. The second section can also be implemented on a separate instance, in particular a protection system. It is also possible for the protection system to be implemented at least partially on the control device. To ensure safety, it must be ensured that part of the protection system is always implemented in the dialysis machine, at least one component that operates like a "watchdog" or a monitoring unit.

[0039] In a preferred embodiment of the invention, the checking (whether at least one release signal was validly received) can be carried out in the operating method by the medical device sending status data packets to the protection system cyclically and / or event-based (i.e., after predefined events), and the protection system monitoring the consecutively correct reception of the status data packets. "Consecutively correct" in this context means that a sequence of electronic messages, namely the status data packets, is monitored. The sent sequence must correspond to the received sequence. As soon as a difference is detected (e.g., if the sent sequence is 1-3-5-7-..., and the received sequence is 1-5-3-7-), the checking process or test returns an error, even though all status data packets could ultimately be received. This allows, for example,suspect that the network connection was interrupted briefly, particularly during the transmission process of packet 5, and that the sending of data packet 5 was made up for at a later time.

[0040] In a preferred embodiment of the operating method, the status data packets can include a timestamp. This can improve the quality of the check to determine whether an enable signal was present and, in particular, whether the enable signal was valid, by checking not only the sequence of signals but also their timestamps. The timestamps must represent a continuous sequence; for example, with a 1-minute grid, the sequence must be: minute 1, minute 2, minute 3, minute 4, etc. If, for example, it is detected that the timestamp 1 was recorded after 3, this is an indication that the sequence was interrupted and points to a (possibly) temporary interruption of the secure communication channel. This intermediate result can be output on the user interface.

[0041] In a further preferred embodiment of the operating method, the protection system can be implemented on the control device, preferably in a protected memory area. Alternatively, the protection system can be connected to the control device as a separate electronic module (hardware and / or software module) via a corresponding data connection and integrated into the system in addition to the control device.

[0042] Furthermore, a distributed protection system for a medical device, in particular for a dialysis machine, is described. The protection system is controlled by a remote control device, and the protection system is operated according to an operating method described above. The user interface of the control device can be connected as an external (e.g., mobile) instance.

[0043] In principle, and to comply with safety regulations, a dialysis machine only accepts one control instance and one protection system instance at a time. Using the trigger signal ensures that the coupling between the dialysis machine and the control unit—i.e., the establishment of the secure communication connection—is only possible outside of medical treatment (dialysis treatment). The monitoring unit can also be used for this purpose to prevent switching to pairing mode during treatment.

[0044] The first confirmation message that the control instance sends to the medical device is preferably encrypted. This can be done using a "secret" provided by the device manufacturer. For example, the dialysis machine expects a checksum in the first confirmation message, which is determined by the control instance based on the secret and the medical device's associated identification number. This also ensures that the medical device only accepts confirmation messages intended for itself and not those of neighboring devices. This prevents unauthorized entities / hackers from processing confirmation messages.

[0045] However, the secret does not necessarily have to be implemented at the factory; it can also be loaded onto the medical device by a service technician via interaction—i.e., via software download or pluggable hardware—and then imported into the control unit by the service technician or entered manually (keyboard, voice). This allows for greater variety in the secrets. It is also possible for one of several predefined secrets to be stored in the medical device at the factory, but the service technician must configure, configure, or enter it completely or partially on the control unit.

[0046] It can be preconfigured so that a trigger signal can only be triggered by an operation by authorized personnel to further increase security.

[0047] Broadcast messages are preferred during the establishment of the secure communication connection (pairing process). The broadcast messages contain the respective pairing partners, so all network participants know whether or not they have been accepted to establish the secure communication connection and which device is the pairing partner. By displaying the pairing result and the assigned device identification number, authorized personnel (service technicians, for example) can double-check the correctness of the process at the end. This increases security and transparency. Once encryption is active (the other participants detect this from the first confirmation message and can issue a corresponding message), unicast messages are used from then on.

[0048] The device identification number from the initialization message can be displayed to the service technician at the beginning on the user interface of the control device in order to be able to abort an incorrect pairing process at an early stage.

[0049] Preferably, the network is a private, i.e., physically independent, hospital network. In particular, it can be a wired network or a wireless network with limited wireless range.

[0050] In one embodiment of the invention, it is provided that calibration data in the device can also be transmitted from the medical device to the control device, for example, at the end of the coupling process or during the instantiation of the control instance.

[0051] The terms used in the registration are defined in more detail below.

[0052] The control device is an electronic terminal with a processor or microprocessor that executes an application for controlling the medical device. The control device can be configured directly or indirectly with a user interface. "Indirectly" in this context means that the user interface can also be configured on an external device (e.g., a mobile device) that exchanges data with the control device via a corresponding network connection (e.g., WLAN) or interface. The control device can be configured as a server. The control device can, in particular, be configured as a physical and / or virtual server and operated by an operating system. The control device can be configured for the (central) control of a plurality of medical devices. For this purpose, the control device can be configured with at least one control instance. The control instance can, for example,An application designed to control a specific medical device. The assignment between the control instance and the medical device to be controlled is unambiguous. In other words, a medical device is controlled by exactly one control instance. This serves to meet the increased security requirements.

[0053] A secure communication connection must be established between the control unit and the medical device to be controlled. This means that the communication channel is additionally secured. This is achieved by storing a predefined data exchange protocol with messages to be exchanged, and checking whether the data exchange protocol with the sequence of predefined messages (according to the protocol) has been adhered to. Control commands to the medical device and / or status data to the control unit can be transmitted via the secure communication connection between the control unit and the medical device to be controlled. The secure communication connection can therefore preferably be designed for bidirectional data exchange.

[0054] The medical device may be an electronic device that provides medical functions. In particular, it may be a dialysis machine or other blood treatment device.

[0055] In order to enable data exchange between the control device and the medical device, the control device is equipped with a communication device for preferably wired communication with the medical device. The communication device located on the control device is also referred to as a server-side communication device. Correspondingly, each medical device also has a communication device, which can be referred to as a client-side communication device.

[0056] In a further preferred embodiment of the invention, the control system comprises not only the medical device and the control device, but also a third electronic device, which acts as a mobile user interface of a terminal device for the control device. This can further increase the flexibility of operation. However, in order to also guarantee safety, the control device should automatically detect when the third mobile user interface device approaches. Therefore, in a preferred embodiment of the invention, it is provided that the medical device detects a spatial approach of the mobile terminal device (user interface), a communication device or another component of the control device (and additionally reports which device is involved, specifying a unique address). Methods such as those described in EP Patent No.2925381, the disclosure of which is hereby incorporated by reference. This makes it possible, for example, to additionally secure tablets as mobile user interfaces through local positioning. Coupling or pairing, for example, is only possible if the mobile user interface (mobile phone / tablet) is within a preconfigured number of meters of the dialysis machine. This additional security via position detection can also be used in other embodiments of the invention, e.g., as an additional function for pairing with a dialysis machine without the use of a control device.

[0057] The server-side and client-side communication devices are used for data exchange via at least one network (e.g. LAN, WLAN, wireless communication means in the near field, such as Bluetooth, NFC - near field communication, DSRC dedicated short range communication, or wired communication means) and in particular for executing the security protocol.

[0058] The integrated circuit module is designed to implement a security protocol for establishing the secure communication connection for controlling the medical device. The integrated circuit module can be provided as a processor, microprocessor, controller, or other hardware component. For this purpose, it can comprise a server-side and a client-side component. Accordingly, a first section of a computer program for executing the security protocol is implemented on the server-side integrated circuit module of the control device. The corresponding analog unit is found as a client-side integrated circuit module on the medical device, on which a second section of the computer program for executing the security protocol is implemented.

[0059] The security protocol serves to uniquely identify the medical device and the respective control instance on the control device. Correct execution of the security protocol advantageously ensures that the medical device specifies which control device or control instance is controlling it, and conversely, that the control device specifies which medical device is to be controlled. If, for example, control signals from other devices are received on the medical device, these are inadmissible, and it can be immediately ruled out that they may be used for control. The security protocol is fully computer-implemented and executed automatically.

[0060] Optionally, an encryption procedure can be activated after the secure communication connection has been established or after the security protocol has been executed to additionally secure the secure communication connection, effectively double-encrypting it. This makes it possible to reliably prevent the acceptance of "foreign," i.e., unauthorized, control and / or status data packets through encryption. This can further improve security.

[0061] Identification messages are electronic data packets exchanged between the medical device and the control device. In a preferred embodiment of the invention, these include at least one initialization message and / or at least one first confirmation message and / or at least one second confirmation message.

[0062] Alternatively and optionally, the identification messages may also include status information (e.g. sensor data, device status data, version number of hardware and / or software, etc.).

[0063] The initialization message is an electronic message. It serves as the first step in initiating the backup protocol execution. The initialization message is generated locally on the medical device. The initialization message can include a unique device identification for the medical device. Optionally, additional data fields can be included in the initialization message, such as a timestamp, configuration data, etc. The initialization message is sent from the medical device to the control device(s). The backup protocol can only be executed if the initialization message was generated correctly and received without errors on the control device.

[0064] The trigger signal is an electronic signal. It is used to initiate or trigger the security protocol execution and precedes the generation of the initialization message. In a preferred embodiment of the invention, the initialization message is only generated if the trigger signal could be detected. The trigger signal is detected locally on the medical device. It can be preset so that the trigger signal is actively requested (e.g., in the form of an output on the user interface). Furthermore, it can be preset so that, in the event of incorrect input or failure to detect the trigger signal, the same is requested again and / or otherwise a corresponding output is generated (e.g., in the sense of "trigger signal not detected -> secure communication connection cannot be established"). The trigger signal can increase the security of the method by providing a second security level (1st level).Security level: Detecting the trigger signal - 2nd security level: Generating and sending the initialization message) is implemented, which is monitored for compliance. The trigger signal can be generated via the input of a predefined user signal, which is sometimes detected on an initialization module that is implemented locally on the medical device. The initialization module can be designed as a button on a (e.g. graphical) user interface or as a pushbutton and / or switch on the medical device. The initialization message is sent from the medical device to the control device. Furthermore, in an advantageous variant of the invention, it is provided that the trigger signal does not have to be explicitly entered by the user, but can be automatically generated and triggered indirectly from a device state. For example, it canIt should be provided that the trigger signal is generated automatically when the medical device is switched on for the first time and / or as part of a commissioning procedure and / or due to other preconfigured events.

[0065] The control signals recorded on the control device are used for the (remote) control of the medical device. The control signals can be generated automatically. The control signals can also be generated directly from user inputs. Alternatively or cumulatively, the control signals can also be calculated based on the recorded user inputs. The control signals can consist of a single command (e.g., activate / deactivate the medical device) or a sequence of commands (first instruction, second instruction, etc.) that are to be executed and controlled on the medical device.

[0066] The coupling result is an electronic message that is automatically generated. The coupling result can take different forms depending on the embodiment of the invention. In the simplest case, it is a message (secure coupling successful: coupling message and / or secure coupling unsuccessful: failed coupling message). Alternatively, further data fields can be included in the coupling result, such as a timestamp indicating the start of the established secure communication channel. Alternatively, the secure communication channel can be configured with an "expiration date" so that the secure communication channel is automatically deleted or closed after a predefined period of time. The coupling result can also include further metadata. The coupling result can be output using a hardware component designed for this purpose. The hardware component can be, for example,This could be a traffic light system (green signal for successful establishment and red signal for failed establishment). In addition to or alongside the color-based signaling described above, an acoustic signal may be provided. Alternatively or cumulatively, a third (e.g., orange) signal may be provided to indicate that the security protocol for establishing the secure communication connection is currently being executed.

[0067] After the secure communication channel has been established, a further aspect of the invention provides for the continuation of the secure communication connection to be continuously checked. This allows the security of the distributed system to be further increased. It is therefore immediately detected that although a secure communication connection was successfully established, it no longer exists or is interrupted after a certain time (e.g., in the event of a temporary network failure). In the prior art, security could not be guaranteed in such cases because the device was unable to execute the control signals during the interruption period, but executes the sequence of subsequent control signals as planned after the end of the interruption. Thus, the absence of the previous control signals can be difficult or even impossible to detect. This can subsequently lead to incorrect control of the medical device.According to one aspect of this application, this can be reliably excluded by continuously and automatically monitoring or checking the continued existence of the (once) established secure communication connection.

[0068] Testing is performed continuously. Testing can be performed according to a predefined time pattern and / or upon receipt of new telegrams / data packets. For example, a configuration phase can define that testing is triggered automatically after a certain time interval has elapsed. Likewise, and / or cumulatively, testing can be triggered based on events (e.g., after detecting an input signal on the medical device, after detecting and before executing certain (e.g., particularly safety-relevant) control commands, after restarting the medical device and / or the control device, or after other events). Testing is signal-based. In other words, testing is preferably performed automatically and thus without user interaction. This increases the reliability of the operating and control process. However, the test is performed at least within the previously defined fault tolerance time.

[0069] The release signal cannot simply be a simple 1-bit signal sent to the medical device via the secure communication connection. The release signal must be securely coded. "Secure" in this context means that corruption during signal transmission and / or signal processing is highly unlikely to lead to a false-positive interpretation by the dialysis machine. It is conceivable to use a code word consisting of a large number of numbers or, when using a 1-bit signal, the additional use of suitable checksums. This allows the medical device to monitor the receipt of the release signal. For this purpose, a protocol can (also) be defined in advance, which, for example, specifies that the release signal must be received within a specific time interval and / or within a predefined error tolerance time and / or with a predefined quality (e.g.,with correct checksum) was received.

[0070] The security method and the operating method may be provided as a computer program, in particular as a microprocessor program.

[0071] The invention also describes the use of a security method for establishing a secure communication connection, in particular the use of the security method in the control system. A security protocol is executed on the control device and the medical device to establish a secure communication connection for controlling the medical device, wherein the security protocol exchanges identification messages for the unique identification of the medical device and for the unique identification of the respective control instance on the control device with the medical device.

[0072] When using the security method, several control instances can be implemented on the control device or several control devices can be located in a network and the initialization message is a broadcast message to all control instances.

[0073] When using the security method, the initialization message may include an equipment code and / or calibration data representing (each) the technical equipment of the medical device.

[0074] A further solution to the problem thus consists in a computer program product which is loaded or loadable into a memory of a computer or an electronic or medical device with a computer program for carrying out the security method and / or the operating method described in more detail above when the computer program is executed on the computer or the electronic or medical device.

[0075] Another solution to the problem involves a computer program for carrying out all steps of the method described in more detail above, if the computer program is executed on a computer, an electronic device, or a medical device. It is also possible for the computer program to be stored on a medium readable by the computer or the electronic or medical device.

[0076] A further solution to the problem provides a data protocol designed according to the security protocol described above. The data protocol is characterized by the exchange of identification messages, which, according to a preferred embodiment of the invention, comprise an initialization message and a first and second confirmation message.

[0077] In the following detailed description of the figures, non-limiting embodiments with their features and further advantages are discussed with reference to the drawing. Short description of the characters

[0078] Fig. 1 shows a schematic representation of a group of dialysis machines controlled by a control unit according to an advantageous embodiment of the invention. Fig. 2 is an example of a flowchart for a security procedure for setting up a communication connection for secure remote control of a dialysis machine. Fig. 3 is an exemplary interaction diagram with a data exchange of signals and messages between the control device with its control instances and a dialysis machine. Fig. 4shows a representation of electronic modules for establishing a secure communication connection between a control device and a dialysis machine in the form of a block diagram. Fig. 5 shows an exemplary interaction diagram with a data exchange of signals and messages for an operating procedure for a protection system for the continuous monitoring of the continuation of a secure communication channel and Fig. 6 is a block diagram with electronic units of a distributed protection system according to a preferred embodiment of the invention. Detailed description of the characters

[0079] In the following, the invention is described in more detail using exemplary embodiments in conjunction with the figures.

[0080] Fig. 1shows a dialysis machine DG as an example of a medical device that should only be controlled by a control device SG if a secure communication connection has been established between the two devices.

[0081] As in Fig. 1 As shown schematically, a dialysis machine can be operated in a group of several dialysis machines and centrally controlled by a control device, which can be configured, for example, as a control server. For this purpose, several control instances SI are configured on the server acting as the control device SG, each of which is assigned to exactly one dialysis machine DG to be controlled. Fig.1 For example, 1 to n control instances SI are provided for 1 to n dialysis machines DG. The dialysis machines DG can be connected to the control unit SG via different networks, such as a bus system or a wireless network NW for digital data exchange.

[0082] To establish a secure communication connection, the dialysis machine DG comprises a client-side communication device cK, which is designed to communicate with a server-side communication device sK for this purpose. Furthermore, a client-side integrated circuit module cMC, a memory mem, and a user interface GUI, which can be graphical, for example, can be implemented on the dialysis machine DG.

[0083] The control unit SG comprises several control instances SI, with a first control instance SI1 being assigned to the first dialysis machine DG1, a second control instance SI2 being assigned to the second dialysis machine DG2, etc. For communication, the control unit SG comprises the server-side communication device. Furthermore, the server-side integrated circuit module sMC and, optionally, a memory mem, as well as an optional user interface GUI, are implemented on the control unit SG.

[0084] In an alternative embodiment of the invention, the user interface can be implemented cumulatively or alternatively on an external device that is data-linked to the control device SG. This is described in Figure 4 characterized in that the user interface (GUI) can also be provided separately and externally to the control device in dashed form. In this case, additional security methods are preferably used, e.g., via the position tracking of the mobile interface device that is to function as the user interface (GUI).

[0085] The control unit SG can - as in Fig. 1As indicated, they exchange data with a database (DB). There, for example, rules for creating the backup protocol can be created and stored, which can also be modified independently of the dialysis machine (DG) and the control unit (SG). Optionally, the dialysis machine, or selected or all dialysis machines, can be connected to the database (DB) to access configurations and rules, for example.

[0086] The establishment of the secure connection is triggered and / or initiated locally by the dialysis machine DG. For this purpose (optional) - as described in Fig. 2 and Fig. 3 As shown, in a first step S1, a trigger signal t is detected on the dialysis machine DG to trigger the establishment of the secure communication connection and the execution of the security protocol in step S2. Executing the security protocol S2 preferably comprises the following steps: Sending S21 an initialization message BROADC1 with a unique device identification for the medical device DG from the medical device DG to the control device SG; receiving S22 the initialization message BROADC1 on the control device SG; On the part of the control device SG: sending S23 a first confirmation message ACK1 to the medical device DG with an identification of the assigned control instance in response to the initialization message; receiving S24 the first confirmation message ACK1 on the medical device DG and on the part of the medical device DG: sending S25 a second confirmation message ACK2 in response to the received first confirmation message ACK1 to the control device SG.

[0087] Optionally, a configuration of the respective control instance SI can be performed during or before step S22. In particular, however, a configuration based on the data received with the initialization message BROADC1 is performed after step S22. This is sometimes helpful if the initialization message BROADC1 contains configuration data of the medical device DG (e.g., version number, equipment code, and the like). Furthermore, an automation can be implemented that automatically generates or creates new, required server instances SI as needed.

[0088] Fig. 3shows an interaction diagram between the client-side communication device cK on the dialysis machine DG and the server-side communication device sK on the control unit SG. First, the trigger signal t is detected on the dialysis machine DG and then sent to the control unit SG. The trigger signal is required to put the dialysis machine DG into pairing mode in the first place. Without this trigger signal (e.g., a predefined procedure on the dialysis machine DG, e.g., an initial commissioning procedure, can act as a trigger signal), the device DG must prevent the pairing mode from being started. This is a protective function. Above all, it ensures that the pairing mode cannot be activated during treatment. This step can be temporally decoupled from the subsequent steps and is therefore Fig. 3shown in dashed lines. The initialization message BROADC1 is then sent to the control unit SG, which in response sends the first confirmation message ACK1 to the dialysis machine DG, which then responds with the second confirmation message ACK2 (preferably sent as a broadcast message). Only after this predefined handshake protocol is the secure communication connection established between the two entities.

[0089] If multiple control units (SG) attempt to register with the dialysis machine (DG) at the same time to establish a secure communication connection to control the DG, the receipt of the second confirmation message (ACK2) uniquely identifies the control unit (SG) / the server or server instance (SI) designated for control. The other devices / instances that have not received a second confirmation message (ACK2) within a predefined time period, identifying them as an accepted server instance (SI), are not securely coupled and can signal this with a corresponding message. Optionally, the securely coupled control unit (SG) can issue a corresponding message about the coupling result.

[0090] Fig. 4shows a schematic overview of the structural architecture of the inventive solution. The user enters his inputs for controlling the dialysis machine DG on the remote control unit SG. To ensure that the communication channel between the two instances is secure, the security protocol is stored and executed in the two integrated circuit modules cMC and sMC. Only after the security protocol has been correctly executed and the secure communication connection has been established can control commands s be transmitted from the control unit SG to the dialysis machine DG.

[0091] In an alternative advantageous embodiment of the invention, as in Fig. 4The GUI user interface (shown in dashed lines) can also be located outside the control unit (SG), for example, on a user's mobile device connected to the control unit (SG) via a wireless communication link. This allows the control process to be made even more flexible while simultaneously meeting the necessary security requirements. The GUI user interface can be part of additional automations and interactions with the dialysis machine (DG). For example, the approach of a mobile device to the dialysis machine (DG) can be automatically detected (see: EP2925381B1), whereupon the GUI user interface can automatically query the current treatment data and input masks from the control unit (SG) or the dialysis machine (DG) and display them on the GUI user interface. (Radio-based proximity detection / location, e.g., via Bluetooth "Google Eddystone" / "Apple iBeacon").In contrast, however, the communication process is slightly different. After the GUI has received the "beacon," which also contains the dialysis machine identification (DG-ID), the GUI user interface communicates with the control unit (SG) and receives the data from it or sends inputs to the control unit (SG) instead of directly to the dialysis machine (DG). This is also shown schematically in . Fig. 4 shown. In principle, it is also possible for the mobile device (e.g., tablet) to transmit its identification data to the medical device DG, which then forwards this identification data to the control device SG. The control device SG then sends the respective content directly to the mobile device.

[0092] With reference to Fig. 5An operating procedure for a distributed protection system (SchS) is explained in more detail. For this purpose, a secure communication connection is established in advance using one of the previously described procedures (security procedure). The protection system or the operating procedure then serves to continuously check whether the established secure communication connection continues to be reliable.

[0093] The distributed protection system SchS comprises a client protection system C-SchS, which is implemented on the dialysis machine DG, and a server protection system S-SchS, which can be implemented on a remote control device SG, and which continuously checks whether a secure communication connection between the medical device DG and the control device SG is maintained (first aspect of the test) and whether the treatment process is correct (second aspect of the test), for example by comparison with a pre-definable reference process which defines that there is no patient endangerment condition or by monitoring critical parameters, such as blood temperature, conductivity and thus indirectly the composition of the dialysate, freedom from air in the extracorporeal blood circuit.The operating procedure can perform the following automatically executed steps: On the server protection system S-SchS, a signal exchange-based check is performed to determine whether a secure communication connection between the medical device DG and the control unit SG is still maintained. If YES, at least one release signal f is sent cyclically to the medical device DG. If, for example, it is detected between transmission time A and the subsequent transmission time B for the release signal that the medical device DG has transmitted no, incorrect, or insufficient data to the control unit SG, the release signal is not sent at time B.

[0094] The client protection system C-SchS monitors fully automatically whether at least one release signal f has been received within a predefined fault tolerance time (and can therefore be considered a correct release signal). If NO, the medical device DG is automatically transferred to a safe device state that does not endanger patient safety. This has the advantage that errors in the control unit SG and / or a loss or interruption of the data connection between the control unit SG and the dialysis machine DG can be automatically detected in order to initiate the safety-relevant measures automatically. The purpose of the server protection system S-SchS is that the respective protection system instance on the control unit SG (orthe control instance SI) monitors the control signals of the operating system, which is also part of the control device SG, and only sends a further release signal to the dialysis machine DG if the control signals are correct, in order to confirm the previous data from the operating system part of the control device SG / control instance SI.

[0095] In Fig. 6 A block diagram with modules of the distributed protection system SchS according to an embodiment is shown. Since the protection system SchS is implemented distributed across several physical products SG, DG, it is Fig. 6 shown in dashed lines. The server protection system S-SchS comprises the testing unit P and the release unit F, while the client protection system C-SchS comprises the transfer logic T and the monitoring unit UE.

[0096] After the secure communication connection has been established using the security procedure described above, the dialysis machine continuously sends status data packets DP via this connection. These data packets DP can advantageously contain a time stamp, a sequence number, and / or sensor signals. The test unit P then checks on the server protection system S-SchS whether the data packets have been received in the consecutively correct sequence. For this purpose, either a target sequence can be specified or a reference sequence is stored in a central database and used for comparison. If the test is successful (correct reception alone is not sufficient), the release signal f is sent to the client protection system C-SchS. The monitoring unit UE there then continuously monitors whether a release signal f can be detected. A predetermined test scheme can be stored for this purpose (e.g.time-based, approximately every 5 minutes and / or event-based, e.g. after the occurrence of predeterminable events). If so, further data packets DP are sent and operation can be maintained because it is ensured that the secure communication connection is maintained and the treatment sequence is carried out correctly, i.e. without endangering the patient. Otherwise, a blocking signal sp is immediately generated and passed on to the internal transfer logic T in order to transfer the dialysis machine DG to a safe state. Instead of the blocking signal sp, a further release signal can also be provided which is not sent if the blocking signal sp would otherwise be sent. The further release signal is thus sent if the secure communication connection is maintained and the treatment sequence is correct (no patient endangerment state exists).The subsequent release signal will not be sent if a secure communication connection is not maintained or if the treatment sequence is incorrect (or a patient endangerment condition exists). Optionally, an additional output can be provided on a user interface of the dialysis machine DG and / or the control unit SG (e.g., as a warning). The output can be provided on a hardware module, which can be configured as a traffic light with corresponding signaling: RED for "interruption of the secure communication connection + transfer to a secure device state" and GREEN for "continuation of the secure communication connection + continued operation of the dialysis machine in secure remote control mode."

[0097] It is important that the dialysis machine DG is controlled by the control unit SG, more precisely by a control instance SI on the control unit SG or an operating system instance. This sends control signals to the dialysis machine DG (e.g., to control actuators). Before and / or after this, the dialysis machine DG transmits data packets (sensor signals, status information about the dialysis machine DG, etc.) to the control instance SI. All of this occurs within a "slice" / time period. If the control instance SI concludes, based on the review of the data packets and, if applicable, the control signals from the control instance, that there is no patient risk, the control instance SI sends the further release signal to the dialysis machine DG. For example, the control instance SI can evaluate the blood temperature from the data packets from the dialysis machine DG to determine that it is above the permissible value of, for example, 41°C, so that the control instance SI does not send a release signal.Or: The control instance SI detects that an operating system instance is not following its processing sequence, and some control signals are missing or are being transmitted to the device DG in the wrong order, so that no further release signal is sent. In general, it is possible for the protection system, which handles the second part of the test (process sequence correct, e.g., blood temperature below the limit), to remain in the dialysis machine DG, and only the operating system to be implemented in the external control device SG. This ensures a higher level of safety.

[0098] In summary, the present application provides a protection concept with a security method and an operating method and corresponding electronic units to enable secure remote control of a medical device. The security is continuously checked to automatically bring the device to be controlled into a secure state as soon as it is detected that the secure communication connection no longer exists, has been temporarily or completely interrupted, or is faulty. By implementing the security protocol as a handshake protocol, the communication connection is advantageously secured multiple times.

[0099] Finally, it should be noted that the description of the invention and the exemplary embodiments are not to be understood as limiting with regard to a specific physical realization of the invention. All features explained and shown in connection with individual embodiments of the invention can be provided in different combinations in the subject matter according to the invention in order to simultaneously realize their advantageous effects. It is therefore also within the scope of the invention, for example, to provide other interfaces or connections in addition to or instead of the network NW between the dialysis machine DG and the control device SG. It is particularly obvious to a person skilled in the art that the invention is not only applicable to dialysis machines (e.g.for a hemodialysis machine or a peritoneal dialysis machine), but also for other medical devices that must be controlled in a secure manner via a remote control device SG.

[0100] Furthermore, the components of the medical device DG and the control device SG, such as the user interface GUI, etc., can be distributed across several physical products.

[0101] The scope of the present invention is given by the claims and is not limited by the features explained in the description or shown in the figures.

Claims

1. Control system for establishing a secure communication link for controlling at least one medical device (DG), in particular a dialysis machine, with a control device (SG) remote from the medical device (DG), comprising the following units: the at least one medical device (DG), which is controlled via the remote control device (SG), with - a client-side communication device (cK), which is confirmed to exchange data with a server-side communication device (sK) of the control device (SG), and - an integrated circuit module (cMC) which is confirmed to implement a security protocol for establishing a secure communication connection to the control device (SG), and wherein the security protocol exchanges identification messages for uniquely identifying the medical device (DG) and for uniquely identifying a respective control instance (SI) on the control device (SG), wherein a respective control instance (SI) is intended for the dedicated control of a specific medical device (DG); the control device (SG), comprising at least one control instance (SI), each assigned to control at least one medical device (DG), with - a server-side communication device (sK) for communicating with the medical device (DG); and - an integrated circuit module (cMC) which is confirmed to implement a security protocol for establishing a secure communication link for controlling the medical device (DG), and wherein the security protocol exchanges identification messages for uniquely identifying the medical device (DG) and for uniquely identifying the respective control instance (SI) on the control device (SG) between the medical device (DG) and the control device (SG), wherein the control device (SG) has a user interface (GUI) for detecting control signals (s) for controlling the medical device (DG) and / or for outputting status data of the medical device (DG), wherein the user interface (GUI) is formed on a separate device outside the control device (SG), which is in bidirectional data exchange with the control device (SG), wherein the user interface (GUI) can only communicate with the remote control device (SG) - in particular via the medical device - if a position sensor detects that the user interface (GUI) is in a spatial proximity to the medical device; and whereby all of the units exchange data at least one network (NW).

2. Control system according to claim 1, wherein the control device (SG) is activated to execute the security protocol by receiving an initialization message (BROADC1) on the control device (SG).

3. Security method for establishing a secure communication link between at least one medical device (DG), in particular a dialysis machine, and a remote control device (SG) for use in a control system according to claim 1 or 2, wherein the control device (SG) comprises at least one control instance (SI), each of which is assigned to control at least one medical device (DG), comprising the following method steps - execution (S2) of a security protocol on the control device (DG) and the medical device (DG) for establishing a secure communication link for controlling the medical device (DG), wherein the security protocol exchanges identification messages for uniquely identifying the medical device (DG) and for uniquely identifying the respective control instance (SI) on the control device (SG) with the medical device (DG).

4. Securing method according to claim 3, comprising the following step: - Detection (S1) of a trigger signal (t) on the medical device (DG) to initiate the execution of the security protocol.

5. Securing method according to claim 3 or 4, comprising the following steps: - sending (S21) an initialization message (BROADC1) with a unique device identification for the medical device (DG) from the medical device (DG) to the control device (SG); - receiving (S22) the initialization message (BROADC1) on the control device (SG), wherein the initialization message (BROADC1) comprises an equipment code and / or calibration data representing the technical equipment of the medical device (DG) - on the part of the control device (SG): Sending (S23) of a first confirmation message (ACK1) to the medical device (DG) with an identification of the assigned control instance (SI) in response to the initialization message (BROADC1); - receiving (S24) the first acknowledgement message (ACK1) on the medical device (DG); and - on the part of the medical device (DG): Sending (S25) a second confirmation message (ACK2) to the control device (SG) in response to the received first confirmation message (ACK1).

6. Security method according to claim 5, wherein the control device (SG) is configured after receiving the initialization message (BROADC1) in response to the received initialization message (BROADC1).

7. Security method according to claim 5 or 6, wherein several control instances (SI) are formed on the control device (SG) or several control devices (SG) are located in a network and wherein the initialization message (BROADC1) is a broadcast message to all control instances (SI).

8. Security method according to any one of claims 5 to 7, wherein the initialization message (BROADC1) comprises an equipment code and / or calibration data representing the technical equipment of the medical device (DG).

9. Security method according to any one of claims 5 to 8, wherein after execution of the security protocol, a pairing result is displayed on a user interface of the control device (SG) and / or the medical device (DG), or the pairing result is signaled by means of an activation of a hardware component.

10. Security method according to any one of claims 5 to 9, wherein executing the security protocol comprises: - on the part of the control device (SG): evaluating whether a second acknowledgement message (ACK2) was received in response to a received first acknowledgement message (ACK1) on the control device (SG) within a predefined timeout period, and if negative: outputting a miscoupling message on the control device (SG) and / or if affirmative: outputting a coupling message on the control device (SG).