SECURE COMMUNICATION BETWEEN A SERVER AND A VENTILATION SYSTEM

Description

[0001] The invention relates to a method for secure communication in a ventilation system during remote adjustment of a ventilator by a server.

[0002] The invention also relates to a ventilation system for carrying out the method.

[0003] EP2392253 discloses A1 a method for updating ventilators in which an operating program stored in the device is at least partially replaced by a new operating program. However, the described update is nonspecific and not validated.

[0004] EP3340095 A1 discloses a method for operating a data processing unit of a ventilator, in which access to therapy data requires the storage of an authorization code. Furthermore, authentication of the devices involved in the connection is described.

[0005] WO2018 / 151778 A1 discloses the securing and encryption of data transmissions of a ventilator as well as the generation of corresponding authentication codes.

[0006] US Patent 9,215,075 B1 describes a procedure and an associated implantable device, as well as the secure and encrypted transmission of therapy data, especially via networks such as the Internet.

[0007] The following technical article describes an autonomous weapon system that can be deactivated remotely: de Boisboissel, Gerard: "Uses of Lethal Autonomous Weapon Systems", International Conference on Military Technologies (ICMT) 2015, University of Defence, May 19, 2015, XP033172708, DOI: 10.1109 / MILTECHS.2015.7153656.

[0008] The following technical article describes the networking of medical devices via the Internet: Pulkkis, Goran et al.: "Secure and Reliable Internet of Things Systems for Healthcare", 2017 IEEE 5th International Conference on Future Internet of Things and Cloud (FICLOUD), IEEE, August 21, 2017, XP033257869, DOI: 10.1109 / FICLOUD.2017.50.

[0009] The object of the present invention is to provide a method which supports simple and safe remote adjustment of the ventilator.

[0010] The task is solved by a method for secure communication in a ventilation system for remote control of a ventilator by a server, encompassing Authentication of the ventilator and server; securing the communication link between the ventilator and server; encryption of the communication between the ventilator and server; verification of the integrity of the transmitted data / settings; marking of the transmitted data / settings with a timestamp and / or a device ID and / or a firmware version; access protection to the server and / or a check of the access rights for the server; unique assignment of a user to a ventilator; provision of a preselection of suitable setting options and corresponding setting parameters for an individual ventilator by the server; verification of the suitability of the settings provided by the server by the ventilator; deactivation of the retrieval of remote settings.

[0011] According to the invention, confidentiality is to be protected during the remote adjustment of a ventilator. The data should not be able to be intercepted or made visible to unauthorized users.

[0012] According to the invention, the integrity (of the data) is to be protected during the remote adjustment of a ventilator. The data should not be able to be accidentally corrupted during communication.

[0013] According to the invention, tamper protection is to be ensured. Unauthorized users should have no way of changing the settings of the ventilator.

[0014] According to the invention, the correct functioning of the ventilator is to be maintained. The selected new settings must be suitable for the device and executable by it.

[0015] According to the invention, transparency should be maintained during remote configuration: The users of the device and server should be informed that a change in the settings has taken place and whether it was carried out successfully.

[0016] The invention is characterized by the claims. The description of the embodiments supplements the claims.

[0017] The invention further relates to a method in which the user of the ventilator checks / confirms the settings provided by the server by confirming the adoption of the settings on or for the ventilator.

[0018] The invention relates alternatively or additionally to a method in which the identity of the user must be verified.

[0019] The invention relates alternatively or additionally to a method in which the user confirms / acknowledges the settings provided by the server.

[0020] The invention relates alternatively or additionally to a method in which the retrieval of remote settings is deactivated.

[0021] The invention relates alternatively or additionally to a method comprising the following steps: Establishing a communication connection between a server and a ventilator; sending the current settings, which include at least the device type and firmware version and / or a device ID; saving the current settings on the server; retrieving the current settings on the server; selecting device-specific setting options from a server database and making the device-specific setting options available; defining an initial setting option; providing the initial setting option to the ventilator; establishing a communication connection between a server and a ventilator; retrieving the new settings; applying the new settings; providing / sending a success or error message; displaying a success or error message.

[0022] The invention relates alternatively or additionally to a method in which, after applying the new settings of the first setting option, at least a second setting option is successively defined, provided and applied.

[0023] The invention relates alternatively or additionally to a method in which the first setting option and at least a second setting option are sent to the ventilator and applied at least partially simultaneously.

[0024] The invention relates alternatively or additionally to a method in which, after the current settings have been sent, the communication link between the ventilator and the server ends.

[0025] The invention relates alternatively or additionally to a method in which, after providing / sending a success or error message, this is displayed on the ventilator and on the server.

[0026] The invention relates alternatively or additionally to a method in which, after the provision / sending of a success or error message, the communication link between the ventilator and the server ends.

[0027] The invention relates alternatively or additionally to a method comprising the steps; Establishment of a communication link between a server and a ventilator. Sending of the current settings, which include at least the device type and firmware version and / or a device ID, from the ventilator to the server. Identification of the device by the server. Selection of device-specific setting options by the server from a server database and provision of the device-specific setting options. Definition of an initial setting option by the server and transmission of the initial setting option by the server. Verification of the initial setting option by the ventilator. Confirmation of the initial setting option by the ventilator. Definition and transmission of the setting parameters of the initial setting option by the server. Verification of the setting parameters of the initial setting option by the ventilator. Confirmation of the setting parameters of the initial setting option by the ventilator.

[0028] The invention relates alternatively or additionally to a method in which the first setting option is checked by the ventilator and, if it is not suitable for the device, an error ID is sent to the server and the error ID is stored together with the device ID (device type and firmware version) of the ventilator.

[0029] The invention relates alternatively or additionally to a method in which, after the definition of a first setting option by the server and the transmission of the first setting option by the server, at least a second setting option is defined and transmitted.

[0030] The invention relates alternatively or additionally to a method in which the first setting option is checked by the ventilator and, if these are not suitable for the device, a confirmation ID is sent to the server together with the adopted values ​​of the first setting option and the confirmation ID is saved together with the device ID (device type and firmware version) of the ventilator.

[0031] The invention relates alternatively or additionally to a method in which a signal of the changed setting is sent to the user of the ventilator on the display of the ventilator and / or a personal communication device of the user.

[0032] The invention relates alternatively or additionally to a method in which the personal communication device is a handheld computer device such as a tablet, a personal digital assistant, a mobile phone, a telephone, a smartphone, a personal digital assistant (PDA), a desktop computer, a laptop computer and the like.

[0033] The invention relates alternatively or additionally to a method in which a supervisor enters a message text for the user on the server and this message text is transmitted from the server to the ventilator and displayed there on the screen or is transmitted from the server to a personal communication device of the user.

[0034] The invention relates alternatively or additionally to a method in which a supervisor receives feedback from the server on the display as to whether and when the new settings have been adopted by the ventilator or whether an error has occurred.

[0035] The invention relates alternatively or additionally to a method in which a supervisor must authenticate himself to the server before sending new settings for the ventilator.

[0036] The invention relates alternatively or additionally to a method in which a user must authenticate himself before receiving new settings for the ventilator.

[0037] The invention relates alternatively or additionally to a method in which a user must confirm the receipt of new settings for the ventilator.

[0038] The invention relates alternatively or additionally to a method in which communication with the server can be deactivated.

[0039] The invention relates alternatively or additionally to a method in which accessory settings, such as a different hose type, for the ventilator are changed and activated by the server.

[0040] The invention also relates to a system set up and configured for carrying out the method according to at least one of the preceding claims.

[0041] The invention also relates to a ventilator set up and configured for carrying out the method according to at least one of the preceding claims.

[0042] The invention also relates to a server set up and configured for carrying out the method according to at least one of the preceding claims.

[0043] When a communication connection is established between a server and the ventilator, the device and server are authenticated.

[0044] Certificates (private / public) can generally also be used for authentication and encryption; these are stored, for example, in the ventilator (because they were already stored in the device's memory during manufacturing or subsequently) and are checked for validity against a database via a separate communication channel during communication between the server and the device.

[0045] Once a communication connection is established, the communication connection is secured.

[0046] According to the invention, it is also provided that communication via the communication link is encrypted.

[0047] During communication, data integrity is also checked. The data should not be able to be (accidentally) corrupted during communication, for example, due to poor data quality.

[0048] Communication also includes identification with a timestamp and / or a device ID and firmware version. This identification can be achieved, for example, by adding at least one timestamp (e.g., for activation and reception) to determine the chronological order of applied settings and identify the latest known setting, even with asynchronous data processing.

[0049] The invention also provides access protection for the server and a verification of access rights for each administrator. Furthermore, the invention provides for the unambiguous assignment of a user to a ventilator.

[0050] According to the invention, the server also provides for a specific preselection of suitable setting options and corresponding parameters for the specific ventilator from a multitude of setting options and parameters. This simplifies the specification of setting options and parameters and prevents the specification of nonsensical combinations. The preselection of suitable setting options and corresponding parameters is achieved by the server identifying the ventilator based on its device ID and / or device type and / or serial number and / or firmware version.

[0051] According to the invention, the suitability of the settings provided by the server can be further checked by the ventilator.

[0052] According to the invention, the user can perform a further check of the settings provided by the server. This check is provided as an additional security measure and requires the user to confirm the acceptance of the settings on or for the ventilator. According to the invention, the suitability of the settings provided by the server can be checked by verifying the user's identity.

[0053] According to the invention, the user can confirm / acknowledge the settings provided by the server. The invention also provides an option to disable the retrieval of remote settings. This, at least when disabled, provides additional protection against remote adjustment of the ventilator.

[0054] The Figure 1 shows a highly schematic representation of a ventilation system according to the invention.

[0055] In the Figure 1 A ventilation system 10 according to the invention is shown, which here comprises a ventilator 1 used as a home ventilator 11 or sleep therapy device. The ventilator 1 can also be configured as a clinical ventilator, CPAP or APAP, cough therapy device, or high-flow device 1. The ventilator can also have at least one mode for (nasal) high-flow therapy or high-flow oxygen therapy, which can be selected and parameterized remotely. The ventilator 1 is suitable and configured for carrying out the method according to the invention.

[0056] The ventilator 1 comprises a ventilation unit 100, which is designed, for example, as a blower unit and / or valve unit 101, for generating an airflow for ventilation. A monitoring unit 21 is provided here for controlling the ventilation unit 100 and for recording therapy data. The ventilator 1 is operated and set via a user interface 61 with control elements 103 and a display unit 11.

[0057] The ventilator 1 has a breathing interface 102 to deliver the airflow to a user for ventilation. The breathing interface 102 shown here is a nasal mask 105. A head covering 106 is provided to secure the nasal mask 105. The breathing interface 102 can also be configured, for example, as a full-face mask, a nasal pillow, an endotracheal tube, or a laryngeal mask.

[0058] A connecting tube 109 is provided to connect the breathing interface 102 to the ventilation device 100. This tube is connected to the ventilation device 100 by means of a coupling device 112. The connecting tube 109 is connected to the breathing interface 102 via a coupling element 107. An exhalation element 108, which includes or is designed as a valve, is arranged between the connecting tube 109 and the coupling element 107. The exhalation element 108 is specifically designed to prevent backbreathing into the ventilator 1 during exhalation by the user.

[0059] The monitoring device 21 is connected here to a sensor device not shown in detail, which has one or more sensors for recording device parameters and / or patient parameters and / or other quantities characteristic of ventilation.

[0060] For example, the monitoring device 21 includes a pressure sensor (not shown in detail here) which detects the pressure conditions with respect to the breathing interface 102. The pressure sensor is connected to the breathing interface 102 via a pressure measuring hose 110. The pressure measuring hose 110 is connected to the monitoring device 21 via an inlet port 111.

[0061] Furthermore, the monitoring device 21 serves to control the ventilation device 100. The monitoring device 21 provides a necessary minimum pressure and compensates for pressure fluctuations caused by the user's breathing. For example, the monitoring device 21 also detects the current pressure in the breathing mask 105 and adjusts the output of the ventilation device 100 accordingly until a desired ventilation pressure is reached.

[0062] The device parameters required for setting up the ventilation unit 100, as well as the device configuration and / or device software, are stored in a storage device 31. The monitoring device 21 can also be configured to record patient parameters. For this purpose, the monitoring device 21 can be equipped with sensors for measuring respiratory excursion, blood oxygen saturation, and / or EEG, EMG, EOG, or ECG activity.

[0063] For example, the monitoring device 21 regulates the device to target parameters, which have previously been individually calculated and defined based on the characteristic breathing of a user.

[0064] It is also possible for the ventilator 100 to be dynamically adjusted, particularly according to the user's breathing phase. For example, the monitoring device 21 can detect a change in breathing phase, allowing a higher or lower pressure to be provided depending on the breathing phase. For example, the ventilator 1 can be configured as a CPAP or APAP device. The ventilator 1 can also be configured as a bilevel device. For example, the ventilator 1 responds to certain breathing events, such as snoring, shallow breathing, and / or obstructive pressure spikes, by adjusting the device parameters accordingly.

[0065] The pressure conditions recorded by the monitoring device 21 are stored in a storage device 31 along with other device parameters. Furthermore, the pressure conditions set by the monitoring device 21, or the pressure adjustments made, are also stored as device parameters in the storage device 31. The recorded patient parameters can also be stored in the storage device 31. In addition, data on compliance and mask tightness can be stored.

[0066] Device parameters can include, for example, a start therapy pressure, a maximum therapy pressure, a minimum therapy pressure, and / or a target volume, and / or other device parameters suitable for setting the ventilator 100. These device parameters are retrieved from the storage unit 31 by the monitoring unit 21 for setting the ventilator 100.

[0067] Furthermore, the pressure conditions and / or other device parameters and / or patient parameters recorded over the therapy period are stored in the storage unit 31 as part of therapy progress reports. Therapy progress reports can include, for example, flow curves, pressure curves, and / or event curves. These therapy progress reports are provided to the storage unit 31 by the monitoring unit 21, which records this data during therapy.

[0068] The device parameters and / or patient parameters and / or therapy progress stored in memory unit 31 are retrieved and evaluated to generate one or more therapy statistics. The therapy statistics are stored in memory unit 31. This process can include determining and saving parameters such as average pressure, therapy duration, and / or leakage.

[0069] In order to subject the therapy data to therapeutic or diagnostic analysis, or to monitor and / or adjust the function of the ventilator 1, the therapy data, settings, or a device ID are transmitted to at least one server 3 via a data processing unit 2. The data processing unit 2 provides the components or software that enable the server 3 to interpret the data from the ventilator 1 and vice versa.

[0070] The ventilation system 10 can also include two or more servers 3, which are connected to one or more ventilators 1.

[0071] The transmission is carried out wirelessly and / or via a transmission device 51. The transmission device 51 can be part of the ventilator or be a separate component assigned to the ventilator. The ventilator can be connected to a modem 12, as the transmission device 51, or can have a modem 12.

[0072] Data transmission can occur via one or more wired interfaces, such as USB, serial, LAN, data bus, etc. Transmission can also occur via one or more wireless interfaces, such as cellular, LPWAN, Bluetooth, infrared, Sigfox, LoRa, etc.

[0073] Server 3 can comprise at least one server 13 and / or at least one personal computer (PC) 23, or it can be configured as a computer cloud. For example, a PC 23 can access a web server 13, which in turn is connected via a network connection to one or more ventilators 1.

[0074] Furthermore, the therapy data can also be stored, at least partially, on a portable storage medium 41. The storage medium 41 is, for example, a memory card, a hard drive, or a USB mass storage device. The storage medium 41 can be removed from the device and read using a reader and, for example, a computer, tablet computer, or smartphone.

[0075] The therapy data or other data can also be displayed via a display located in and / or connected to device 1. 11 or a user interface 61 can be read.

[0076] The same interfaces allow the device 1 to be equipped with new configuration data or new program code, or for functions within the device 1 to be activated. One or more data storage locations 31, 41 in the device 1 are therefore preferably written to and / or read from the outside.

[0077] From server 3, therapy data can be accessed remotely, enabling location-independent analysis. This allows caregivers (doctors, providers, etc.) to access the data in the ventilation system 10. For data protection and security reasons, access is restricted, for example, to the devices 1 used by the user. The patient (user) only has access to their own device 1. Professionals such as providers and doctors (caregivers) have access to the devices 1 of all their patients.

[0078] Figure 2This shows an example of a communication process between the ventilator 1 and the server 3.

[0079] The establishment of a communication connection between a server and the ventilator 69 is initiated, for example, automatically by the ventilator (or the server 3) or manually by a user (operator or caregiver). The connection is established automatically, for example, at a preset or adjustable time interval, such as every 5 or 60 minutes. Once the communication connection is established, the current settings of the ventilator, which include, for example, at least the device type and firmware version and / or a device ID 70, are automatically sent to the server 3. Optionally, after the current settings 70 have been sent, the communication connection between the ventilator and the server 3 can be terminated 71. This process can be initiated automatically or by a user.

[0080] The current settings are automatically saved on server 72.

[0081] The current settings on server 73 are then accessed automatically and / or manually initiated by a user.

[0082] Initiated automatically and / or manually by a user, the device-specific setting options are then selected from a server database and made available. Optionally, these can also be confirmed or changed.

[0083] Automatically and / or manually initiated by a user, a selection of the device-specific setting parameters for setting option 75 then takes place.

[0084] The new setting for the ventilator 76 is then provided automatically and / or manually initiated by a user.

[0085] A communication connection between the server and the ventilator 62 is then established, either automatically or manually initiated by a user.

[0086] The ventilator then automatically retrieves the new settings 63.

[0087] The new settings are then applied automatically, and / or optionally manually initiated by a user (64). A success or error message is then sent automatically (65).

[0088] A success or error message (68) is displayed automatically. This can optionally or additionally be displayed on the ventilator and / or on the server (66, 68).

[0089] The success or error message can also be sent as a notification, for example in the form of an email, SMS, or WhatsApp message, to a communication device of the user and / or supervisor.

[0090] The settings that the server sends to the ventilator can include not only ventilation settings but also a selection of text / speech modules that the ventilator, or at least a connected human-machine interface, is intended to output to its user, particularly messages or questions. These questions primarily relate to the symptoms of the illness, side effects of ventilation therapy, quality of life, health status, or malfunctions of the ventilator. The text / speech modules can be stored in the device and activated remotely, or they can be sent to the ventilator directly via the remote control.

[0091] The settings are typically ventilation settings or any instruction that triggers a status change on the device, such as comfort settings, device settings (display brightness, etc.), alarm settings, data settings, or actions. Setting options then include, for example, ventilation pressures, ventilation rate, volume, inspiratory pressure, expiratory pressure, backup rate, a text message for the device display, rebooting the device, emitting an audible signal, switching ventilation programs, and updating the firmware.

[0092] The corresponding setting parameters 75 are then, for example, the pressure values ​​or specific frequencies or other specific values ​​or freely enterable texts or characters (for communication).

[0093] Settings include not only permanently effective settings such as firmware code, ventilation mode, ventilation pressures, ventilation rate, and comfort parameters, but also actions that are triggered at least once via remote settings on the device, for example. A device restart; sending specific data from the device memory; deleting specific data in the device memory; sending an authentication; performing at least one self-test of the device; performing at least one action to clean the device or accessories; performing at least one ventilation maneuver, for example, starting or ending ventilation, applying a pressure value different from the normally set value for a limited period; displaying specific information graphically, visually, or audibly on the device.

[0094] Another application of remote configuration envisaged by the invention is updating the ventilator with new software or firmware. The server can send such updates to the ventilator automatically or initiated by the operator. Different operators can have different rights to change device settings on the server. According to the invention, a user rights management system on the server is provided for defining / setting user rights. For example, the user of the ventilator could also be an operator on the server and / or only be allowed to make a limited set of settings (e.g., comfort parameters). Or a specific (technical) operator could also only be allowed to change a limited number of settings. This is controlled by the server's user rights management system or can be defined by it.

[0095] The described remote adjustment method can also be used to remotely adjust accessory components connected to the ventilator. These include humidifiers, tubing heaters, sensor modules (SpO2, FiO2, CO2), alarm modules, battery modules, oxygen concentrators, and oxygen / gas mixers. Depending on the selected setting of at least one (main) parameter, the server may dynamically offer or suggest additional secondary settings to the operator. For example, if automatic pressure control (APAP, auto-EPAP, target volume) is selected, a lower and upper pressure limit will be preset or suggested. Similarly, if automatic pressure control is deactivated, a fixed pressure value or lower and upper pressure limits will be preset or suggested. Finally, if a target volume is selected, a lower and upper pressure limit will be preset or suggested.For example, when a frequency is selected, a lower and upper pressure limit are preset or suggested. The corresponding setting logic of the ventilator is mirrored on the server in such a way that these adjustments to the provided secondary parameters are made without the server having to communicate with the ventilator and query the list of secondary parameters after the main setting parameter is selected. Depending on the selected setting of at least one option, the server may dynamically offer or suggest additional, more or less "useful" setting options to the operator. For example, a safety frequency is preset or suggested when the automatic pressure control is deactivated. Similarly, when a frequency is selected, a lower and upper pressure limit are preset or suggested.The associated setting logic of the ventilator is, for example, mirrored on the server in such a way that these adjustments of the provided secondary parameters are made without the server having to communicate with the ventilator after selecting the main setting parameter and query the list of secondary setting parameters from it.

[0096] The procedure optionally or additionally provides that after the provision / sending of a success or error message 65, the communication link between the ventilator and server 3 ends 67. The termination 67 of the communication link can occur automatically, or optionally be initiated manually by a user.

[0097] Figure 3 This shows, by way of example, the security mechanisms that take place during a communication process between the ventilator 1 and the server 3.

[0098] When a communication connection is established between a server and the ventilator 69, authentication of both the device and the server 80 takes place. This authentication can be performed, for example, by verifying the device type and serial number or a device ID. Alternatively or additionally, authentication can be performed by verifying the SIM card number (for example, when using a SIM card in a modem). Alternatively or additionally, authentication can be performed by verifying the server's IP address. Alternatively or additionally, authentication can be performed by mutual verification of public and / or private certificates between the ventilator and the server. Alternatively or additionally, authentication can be performed by verifying a security ID code of the device.Authentication can be achieved alternatively or additionally by restricting communication between the ventilator and a defined access point name (APN). Alternatively or additionally, authentication can be achieved by requiring a specific, defined question-and-answer sequence between the device and the server. Alternatively or additionally, authentication can be achieved by verifying the combination of IDs / serial numbers of multiple hardware components of the device.

[0099] Once a communication connection is established, it is secured. This security can be achieved, for example, by using a specific, defined access point (private APN). Alternatively or additionally, end-to-end encryption between the ventilator and the server can be used. Another alternative or additional security measure is establishing a VPN channel (virtual private and self-contained communication network) from the defined access point (APN) to the server.

[0100] Communication link 81 can alternatively or additionally be established by implementing a firewall. Alternatively or additionally, communication link 81 can be established by blocking unnecessary communication options and ports.

[0101] According to the invention, communication via the communication connection is also encrypted. This encryption can be achieved, for example, by using a TLS or SSL standard or variants thereof. Alternatively or additionally, encryption can be achieved by direct encryption with a key whose length is greater than or equal to 8 bits. Alternatively or additionally, encryption can be achieved by using HTTPS or SFTP or variants thereof.

[0102] During communication, data integrity is also checked. The data should not be able to be (accidentally) corrupted during communication, for example, due to poor data quality.

[0103] Integrity checks (83) can be performed, for example, by adding a checksum to the message. Alternatively or additionally, integrity checks (83) can be performed by using transmission protocols with data validation, such as HTTP, MQTT, TCP / IP, GSM, or Bluetooth. Alternatively or additionally, integrity checks (83) can be performed by adding a hash code to the message, where the hash code is calculated from the message content and a predefined security key. Alternatively or additionally, integrity checks (83) can be performed by adding a hash code to the message, where the code is calculated from the message content, a predefined security key, and a random component.

[0104] During communication, an 84 tag is also used, containing a timestamp and / or a device ID and firmware version. An 84 tag can be created, for example, by adding at least one timestamp (e.g., for activation and reception) to determine the chronological order of applied settings and identify the latest known setting, even with asynchronous data processing. An 84 tag can also be created, for example, by labeling the saved settings with the device type and firmware version, so that when the settings are subsequently changed, the server can only suggest suitable options to the user.

[0105] According to the invention, access protection for server 3 and a check of the access rights for each administrator are also provided 85. The access protection for server 85 can alternatively or additionally be achieved by the fact that Physical protection of the server against unauthorized manipulation exists; an encrypted data connection exists between the browser / frontend and the server for authorized administrators; access to the server is granted only to authorized administrators, depending on their individual user rights; protection against electronic access to the server is provided, for example, by a firewall or a security container, or by data separation; protection against electronic access to the server via the browser / frontend is prevented by measures such as rights escalation, cross-site scripting, or OWASP Top 10 threats; strong authentication of administrators on the server is carried out, for example, with 2-factor authentication or biometric verification (fingerprint, iris scan, etc.).

[0106] According to the invention, a unique assignment 86 of a user to a ventilator is also provided.

[0107] Unique identification (86) is ensured, for example, by assigning a device to a user via its serial number or device ID. Alternatively or additionally, unique identification (86) is ensured through confirmation processes during the assignment, such as sending an identifier between the device and the server or manual confirmation on the device. Alternatively or additionally, unique identification (86) is visualized and thus monitored by displaying the username or ID and the device serial number or device ID throughout the entire configuration process (for the administrator). Alternatively or additionally, unique identification (86) is supported by communication / a request (to the administrator) to verify the device's serial number during each configuration process, even when settings are made using an independent source, such as an ERP system.The unique assignment 86 is ensured alternatively or additionally through communication (a phone call) with the device user during the setup process. This includes a request for confirmation. Alternatively or additionally, the unique assignment 86 is ensured by communicating with the device user by prompting them to manually enter or display a confirmation code (e.g., communicated by phone) on the device to activate the changed settings.

[0108] According to the invention, the server also provides for a specific preselection of suitable setting options 74 and corresponding setting parameters 75 for the specific ventilator from a multitude of setting options and setting parameters 87. This simplifies the specification of the setting options and setting parameters and prevents the specification of nonsensical combinations. The preselection of suitable setting options and corresponding setting parameters 87 is achieved by the server identifying the ventilator based on its device ID and / or device type and / or serial number and / or firmware version. From a database, the server then identifies only those setting options and setting parameters that are compatible with the individual ventilator.The preselection of suitable setting options and corresponding setting parameters 87 is achieved alternatively or additionally by checking, after each setting value (setting options and / or setting parameters) is changed, or at least before confirming the complete new settings, whether all dependencies between the setting values ​​have been maintained or are consistent. For example, a plausibility check is performed between the upper and lower limits of print ranges. Alternatively or additionally, the preselection of suitable setting options and corresponding setting parameters 87 is achieved by automatically adjusting dependent setting values.The preselection of suitable setting options and corresponding setting parameters 87 is achieved alternatively or additionally by the server identifying the ventilator based on its device ID and / or device type and / or serial number and / or firmware version, as well as the user of the device (for example, based on a user / ventilator assignment that is retrievable by the server), and automatically offering or applying only those setting options and / or setting parameters that are suitable for the individual user / ventilator combination based on stored user and ventilator information. This suitability can be stored and retrievable by the server.

[0109] According to the invention, the ventilator can perform a further check of the suitability of the settings provided by the server. This check is provided as an additional safety measure, since changes may have occurred between sending the last settings and retrieving the new settings (for example, the firmware version may have changed or a new ventilator may have been given to the same patient).

[0110] According to the invention, the user can perform a further check of the settings provided by the server. This check is provided as an additional security measure and requires the user to confirm the acceptance of the settings on or for the ventilator. Confirmation of acceptance can be effected by the user pressing a confirmation button on the device or by an audible confirmation. Alternatively, confirmation of acceptance can be effected by the user entering a security code into the device or communicating a code to the caregiver. This code can be permanently stored with the user or communicated anew for each change of settings, for example, in the form of an email, SMS, or WhatsApp message to a communication device of the user and / or the ventilator.According to the invention, the suitability of the settings provided by the server can be verified by requiring the user's identity to be verified. Identity verification can take place at the moment new settings are provided. Identity verification can be carried out by requiring the communication or entry of a password, one-time password, or security code. Identity verification can be carried out by biometric verification (e.g., fingerprint, iris scan, voice verification).

[0111] According to the invention, the user can confirm / acknowledge the settings provided by the server. This user acknowledgment ensures that a notification about planned or implemented changes is received and preferably activates the changes only after such acknowledgment. User acknowledgment can be given by a mouse click, keystroke, gesture, touch input, or voice command.

[0112] According to the invention, a deactivation option for retrieving remote settings 92 can be provided. This provides additional protection against remote adjustment of the ventilator, at least when deactivated. Deactivation 92 can be performed directly on the device as a setting option. Deactivation can include only the transmission of current settings or the transmission / retrieval of settings. Retrieval does not have to occur with every transmission, but only with specific events, for example, through manual or time-controlled triggering.

Claims

1. A method for secure communication in a ventilation system (10) for remotely setting a ventilator (1) by a server (3), wherein the method comprises: - authenticating (80) the ventilator (1) and the server (3); - securing (81) a communication connection between the ventilator (1) and the server (3); - encrypting (82) the communication between the ventilator (1) and the server (3); - checking (83) the integrity (83) of the transmitted data / settings; - labeling (84) the transmitted data / settings with a timestamp and / or a device ID and / or a firmware version; - protecting (85) access to the server and / or a check of the access rights for the server (3); - uniquely assigning (86) a user to a ventilator (1); - providing (87) a preselection of suitable setting options (74) and matching setting parameters (75) for an individual ventilator (1) by the server (3); - checking (88), by the ventilator (1), a suitability of the settings (74, 75) provided by the server (3); wherein the method further comprises: - disabling the retrieval of remote settings.

2. The method according to claim 1, further comprising: - checking / confirming (89), by the user of the ventilator (1), the settings provided by the server (3) in that the user confirms the adoption of the settings at the ventilator (1) or for the ventilator (1); - verifying (90) an identity of the user.

3. The method according to at least one of the preceding claims, further comprising: - establishing a communication connection between a server and a ventilator; - sending (70) the current settings, which comprise at least the device type and the firmware version and / or a device ID; - storing (72) the current settings on the server; - retrieving (73) the current settings on the server; - selecting the device-specific setting options (74) from a database of the server and keeping the device-specific setting options available (74); - defining a first setting option (75); - providing (76) the first setting option for the ventilator; - establishing (62) a communication connection between a server and a ventilator; - retrieving (63) the new settings; - applying (64) the new settings; - providing / sending (65) a success or error message; - displaying (68) a success or error message.

4. The method according to claim 3, wherein the first setting option (75) and at least a second setting option (75') are sent to and applied to the ventilator at least partially simultaneously.

5. The method according to claim 3 or 4, further comprising: terminating (71) the communication connection between the ventilator and the server (3) after sending (70) the current settings.

6. The method according to at least one of claims 3 to 5, further comprising: - displaying (66, 68) the success or error message on the ventilator and on the server after providing / sending (65) the success or error message; - terminating (67) the communication connection between the ventilator and the server (3).

7. The method according to at least one of the preceding claims, further comprising: - establishing a communication connection between a server and a ventilator; - sending the current settings, which comprise at least the device type and the firmware version and / or a device ID, from the ventilator to the server; - identifying the device by the server; - selecting the device-specific setting options by the server, from a database of the server, and keeping the device-specific setting options available; - defining a first setting option by the server, and transmitting the first setting option by the server; - checking the first setting option by the ventilator; - confirming the first setting option by the ventilator; - defining and transmitting the setting parameters of the first setting option by the server; - checking the setting parameters of the first setting option by the ventilator; - confirming the setting parameters of the first setting option by the ventilator.

8. The method according to at least one of claims 3 to 7, further comprising: - checking the first setting option by the ventilator and, if it is not suitable for the device, sending an error ID to the server and storing the error ID together with the device ID (device type and firmware version) of the ventilator; - after defining and transmitting a first setting option by the server: defining and transmitting at least a second setting option.

9. The method according to at least one of claims 3 to 8, further comprising: checking the first setting option by the ventilator and, if it is suitable for the device, sending a confirmation ID to the server together with the adopted values of the first setting option and storing the confirmation ID together with the device ID (device type and firmware version) of the ventilator.

10. The method according to at least one of the preceding claims, further comprising: - displaying, on a display, a response from the server as to whether and when the new settings have been adopted by the ventilator or whether an error has occurred; - obligatorily authenticating a caregiver at the server before sending new settings for the ventilator; - obligatorily authenticating a user before receiving new settings for the ventilator.

11. The method according to at least one of the preceding claims, wherein the disabling comprises only the sending of current settings or the sending / retrieval of settings.

12. The method according to at least one of the preceding claims, wherein the retrieval does not take place for every sending process but rather only for particular processes, for example by manual or time-controlled triggering.

13. The method according to at least one of the preceding claims, further comprising: remotely setting accessory components connected to the ventilator.

14. A ventilation system configured and designed to carry out the method according to at least one of the preceding claims.