COMPUTER IMPLEMENTED METHOD AND SYSTEM FOR PROTECTING PATIENT-CRITICAL FIRMWARE FUNCTIONS IN IMPLANTABLE MEDICAL DEVICES - Patent application
Patent Information
- Application Number
- JP2024506703
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2021-11-19
- Filing Date
- 2022-11-10
- Publication Date
- 2025-10-22
AI Technical Summary
Existing implantable medical devices lack sufficient distinction and additional security measures to protect patient-critical firmware functions from unintended execution due to internal errors or cyber-attacks, with current checksums failing to differentiate between normal and critical functions.
Implementing a method and system that verifies user authorization, reads and compares multiple checksums before executing patient-critical firmware functions, and ensures correct checksums are overwritten immediately before execution, using non-interruptible commands and secure authentication methods.
Provides robust protection against unintended execution of critical firmware functions by ensuring only authorized users can execute them, preventing unauthorized changes or cyber-attacks, and logging unauthorized attempts for monitoring.
Smart Images
Figure 00000000_0000_ABST
Abstract
Description
[Technical field]
[0001] The present invention relates to a computer-implemented method for protecting patient-critical firmware functions of implantable medical devices, particularly pacemakers, defibrillators and / or neurostimulators, against unintended execution.
[0002] Furthermore, the present invention relates to a system for protecting patient-critical firmware functions of implantable medical devices, in particular pacemakers, defibrillators and / or neurostimulators, against unintended execution. [Background technology]
[0003] Patient-critical firmware functions, such as Brady_OFF_Mode, Therapy_OFF_State, etc., of an implant, e.g., an ICD, S-ICD, IPG, iLP, or similar active implant, must be protected against unintended execution due to internal firmware errors and / or misuse via a Cyber-attack.
[0004] EP 3791925 A1 discloses a lead-free pacemaker comprising at least one fixation element for fixing the lead-free pacemaker to cardiac tissue, a communication unit electrically connected to the fixation element such that the fixation element is configured to act as a communication antenna for transmitting signals generated by the communication unit to an external device and / or receiving signals from an external device, and a treatment unit for generating electrical signals for electrically stimulating the cardiac tissue, the fixation element being configured to act as an electrode for electrically stimulating the cardiac tissue and / or sensing the electrical signals of the cardiac tissue.
[0005] Currently, in such implants, some firmware functions are protected with appropriate checksums to check for potential code modifications, e.g., by bit flips before execution, thereby preventing their execution, but no distinction is made between normal firmware functions and the above-mentioned patient-critical firmware functions, which should be protected by an additional layer of security. [Prior art documents] [Patent documents]
[0006] [Patent Document 1] European Patent Application Publication No. 3791925A1 Summary of the Invention [Problem to be solved by the invention]
[0007] It is therefore an object of the present invention to provide an improved method for protecting patient-critical firmware functions of an implantable medical device against unintended execution.
[0008] The object is solved by a computer implemented method for protecting patient-critical firmware functions of an implantable medical device having the features of claim 1.
[0009] The object is further solved by a system for protecting patient-critical firmware functions of an implantable medical device having the features of claim 10.
[0010] Furthermore, the object is solved by a computer program according to claim 11 and by a computer-readable data carrier according to claim 12. Further developments and advantageous embodiments are defined in the dependent claims. [Means for solving the problem]
[0011] The present invention provides a computer-implemented method for protecting patient-critical firmware functions of implantable medical devices, particularly pacemakers, defibrillators and / or neurostimulators, against unintended execution.
[0012] The method includes receiving a request for execution of a patient-critical firmware function of an implantable medical device and verifying that a user associated with the request is authorized to execute the patient-critical firmware function.
[0013] The method further includes reading a first checksum from a first memory area of the implantable medical device or providing the first checksum as part of a code area of a patient-critical firmware function of the implantable medical device if the user associated with the request is verified as authorized, where the first checksum does not match a correct checksum associated with the patient-critical firmware function of the implantable medical device.
[0014] The method further includes reading a second checksum from a second memory area of the implantable medical device, where the second checksum corresponds to a correct checksum associated with a patient-critical firmware function of the implantable medical device, and writing the second checksum to a third memory area of the implantable medical device from which the checksum is read prior to execution of the patient-critical firmware function of the implantable medical device.
[0015] Additionally, the method includes calculating a correct checksum associated with a patient-critical firmware function of the implantable medical device, comparing the correct checksum to a second checksum, and executing the patient-critical firmware function of the implantable medical device if the second checksum and the correct checksum match.
[0016] Additionally, the present invention provides a system for protecting patient-critical firmware functions of implantable medical devices, particularly pacemakers, defibrillators and / or neurostimulators, against unintended execution.
[0017] The system includes an implantable medical device and a programmer, wherein the implantable medical device is configured to receive a request by the programmer to execute a patient-critical firmware function of the implantable medical device, the implantable medical device is configured to verify that a user associated with the request is authorized to execute the patient-critical firmware function, and the implantable medical device is configured to read a first checksum from a first memory area of the implantable medical device or provide the first checksum as part of a code area of the patient-critical firmware function of the implantable medical device, and when the first checksum does not match a correct checksum associated with the patient-critical firmware function of the implantable medical device.
[0018] The implantable medical device is configured to read the second checksum from a second memory area of the implantable medical device, where the second checksum matches a correct checksum associated with a patient-critical firmware function of the implantable medical device, and the implantable medical device is further configured to write the second checksum to a third memory area of the implantable medical device from which the checksum is read prior to execution of the patient-critical firmware function of the implantable medical device.
[0019] The implantable medical device is configured to calculate a correct checksum associated with a patient-critical firmware function of the implantable medical device and compare the correct checksum to a second checksum, and the implantable medical device is configured to execute the patient-critical firmware function of the implantable medical device if the second checksum and the correct checksum match.
[0020] Moreover, the invention provides a computer-readable data carrier containing a program code of a computer program for performing the method according to the invention, when the computer program is run on a computer.
[0021] The idea of the present invention is to provide extremely secure checksums for patient-critical firmware functions, which are always inaccurate by default.
[0022] This ensures that due to an internal error or a cyber attack the implant firmware cannot accidentally or intentionally initiate programming of critical firmware functions, e.g. OFF mode for IPGs, Therapy_OFF state for ICDs, either by the programmer or remotely via the CardioMessenger, an external BIOTRONIK device which forwards messages and / or data sent by the implant via mobile radio to the Home Monitoring Service Center (HMSC).
[0023] For example, programming the IPG's OFF_mode, the ICD's Therapy_OFF state, etc., therefore requires that a checksum check always precedes the execution of these functions.
[0024] It is ensured in the code that this checksum is always checked by the firmware just before a critical function is executed. If this is incorrect, the function is not executed and an illegal execution attempt is reported in an internal firmware log book, which can be sent to BIOTRONIK, for example, during a follow-up or by sending in a technical HMSC message. Thus, for example, an attempted cyber-attack can be captured by said monitoring.
[0025] With appropriate strong authorization, e.g., password entry into the programmer by a physician or authorized user, an incorrect checksum will always be replaced only by a correct checksum immediately before the function is used, thereby making execution of the critical function possible and permissible.
[0026] According to one aspect of the invention, the reading of the first checksum from a first memory area of the implantable medical device or the providing of the first checksum as part of a code area of a patient-critical firmware function of the implantable medical device, the reading of the second checksum from a second memory area of the implantable medical device, the writing of the second checksum to a third memory area of the implantable medical device from which the checksum is read prior to execution of the patient-critical firmware function of the implantable medical device, the calculation of a correct checksum associated with the patient-critical firmware function of the implantable medical device, the comparison of the correct checksum with the second checksum, and the execution of the patient-critical firmware function of the implantable medical device are performed by an uninterruptible compound command. In this manner, the method steps are uninterruptible, resulting in an additional layer of security.
[0027] According to a further aspect of the invention, during execution of a compound command of a patient-critical firmware function of an implantable medical device, a second checksum is overwritten by a first checksum, said first checksum being read from a memory buffer or from a code area of the patient-critical firmware function of the implantable medical device. By overwriting the second checksum by the first checksum, execution of the patient-critical firmware function is no longer enabled.
[0028] According to a further aspect of the invention, after overwriting the second checksum with the first checksum, a composite command of a patient-critical firmware function of an implantable medical device is terminated. Execution of the composite command generally only involves sending a predefined command to enable or disable a specified function of the implantable medical device, and therefore has a short execution time. As soon as the predefined command is executed, the second checksum is thereby overwritten with the first checksum, thereby effectively terminating the composite command.
[0029] According to a further aspect of the invention, the second checksum is read from a hardware read-only register of the implantable medical device, the checksum being a cyclic redundancy check, an XOR, a modulus or a cryptographic hash, in particular MD5, SHA-1 or SHA-2, which advantageously provides an effective protection of patient-critical firmware functions.
[0030] According to a further aspect of the invention, the patient-critical firmware functions of the implantable medical device are executed by accessing a graphical user interface of a programmer or an app running on a mobile device, in particular a smartphone or tablet device, said programmer or mobile device being configured to communicate wirelessly with the implantable medical device, thus allowing access to the implantable medical device in multiple ways.
[0031] According to a further aspect of the invention, the user authentication procedure includes a password entry or includes two-factor authentication including a password entry and an additional security feature for the programmer or a web interface configured to control the programmer, and the user session includes a session ID and a timestamp, which ensures access to the implantable medical device by only authorized users.
[0032] According to a further aspect of the invention, a correct checksum associated with a patient-critical firmware function of the implantable medical device is calculated and compared to a second checksum within a predefined time span, in particular up to 500 ms, prior to execution of the patient-critical firmware function of the implantable medical device. By limiting the time span for performing the checksum calculation, an additional layer of security is provided.
[0033] According to a further aspect of the invention, the second checksum is written at factory initialization of the implantable device into a predefined memory cell accessible by executing a predefined register code, the predefined register code being not part of the code for executing the patient-critical firmware function, thereby effectively preventing accidental execution of the patient-critical firmware function.
[0034] Features described herein of a computer-implemented method for protecting patient-critical firmware functions in an implantable medical device also disclose a system for protecting patient-critical firmware functions in an implantable medical device, and vice versa.
[0035] For a more complete understanding of the invention and its advantages, reference should now be made to the following description taken in conjunction with the accompanying drawings, in which: The invention will now be explained in more detail using exemplary embodiments specified in the schematic diagrams of the drawings, in which: [Brief description of the drawings]
[0036] [Figure 1] FIG. 1 illustrates a flowchart of a computer-implemented method for protecting patient-critical firmware functions in an implantable medical device, according to a preferred embodiment of the present invention. [Diagram 2] FIG. 1 shows a schematic diagram of a system for protecting patient-critical firmware functions of an implantable medical device, in accordance with a preferred embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
[0037] The computer-implemented method of FIG. 1 serves to protect patient-critical firmware functions 10 of an implantable medical device 12, particularly a pacemaker, defibrillator, and / or neurostimulator, against unintended execution.
[0038] The method includes receiving S1 a request 14 for execution of a patient-critical firmware function 10 in an implantable medical device 12 and verifying S2 that a user associated with the request 14 is authorized to execute the patient-critical firmware function 10.
[0039] If it is determined that the user is authorized, a composite command 24 is initiated in step B. If the user is not authorized, use of the patient-critical firmware function 10 is denied. Additionally or optionally, an entry can be made in the cyber logbook in step 11, which in turn cancels the (command) request 14 in step 13.
[0040] The method further includes, if the user associated with the request 14 is verified as authorized, reading S3a the first checksum CRC_A from the first memory area 16 of the implantable medical device 12 or providing S3b the first checksum CRC_A as part of the code area 18 of the patient critical firmware function 10 of the implantable medical device 12. The first checksum CRC_A does not match the correct checksum CRC_OK associated with the patient critical firmware function 10 of the implantable medical device 12.
[0041] The method further includes reading S4 a second checksum CRC_B from the second memory area 20 of the implantable medical device 12, where the second checksum CRC_B matches the correct checksum CRC_OK associated with the patient-critical firmware function 10 of the implantable medical device 12.
[0042] Moreover, the method includes writing S5 the second checksum CRC_B to a third memory area 22 of the implantable medical device 12, from which the checksum is read prior to execution of the patient-critical firmware function 10 of the implantable medical device 12. Thereafter, in step C, the patient-critical firmware function 10 is started.
[0043] The method further includes calculating a correct checksum CRC_OK associated with the patient-critical firmware function 10 of the implantable medical device 12 and comparing the correct checksum CRC_OK with a second checksum CRC_B S6. If the second checksum CRC_B and the correct checksum CRC_OK match, executing the patient-critical firmware function 10 of the implantable medical device 12 S7.
[0044] If the second checksum CRC_B does not match the correct checksum CRC_OK, the use of the patient-critical firmware function is denied and an entry is made in the error log in step 15. Furthermore, the compound command is cancelled in step 17.
[0045] The steps S3a, S3b, S4, S5, S6 and S7 of reading the patient-critical firmware functions 10 of the implantable medical device 12 are performed by a non-interruptible composite command 24.
[0046] During execution of the composite command 24 of the patient critical firmware function 10 of the implantable medical device 12, in step 19 the second checksum CRC_B is overwritten by the first checksum CRC_A, which is read from the memory buffer 26a or from a further code area 26b of the patient critical firmware function 10 of the implantable medical device 12.
[0047] After overwriting the second checksum CRC_B with the first checksum CRC_A in step 19, the compound command 24 of the patient-critical firmware function 10 of the implantable medical device 12 is terminated in step 21.
[0048] The second checksum CRC_B is read from a hardware read-only register of the implantable medical device 12, and the second checksum CRC_B is a cyclic redundancy check, an XOR, a modulus or a cryptographic hash, in particular MD5, SHA-1 or SHA-2.
[0049] The patient-critical firmware functions 10 of the implantable medical device 12 are executed by accessing a graphical user interface of a programmer 30 or an app running on a mobile device 32, in particular a smartphone or tablet device, which programmer 30 or mobile device 32 is configured to communicate wirelessly with the implantable medical device 12.
[0050] The user authentication procedure includes password entry or includes two-factor authentication including password entry and an additional security feature for the programmer 30 or a web interface configured to control the programmer 30, and the user session includes a session ID and a timestamp.
[0051] A correct checksum CRC_OK associated with the patient-critical firmware function 10 of the implantable medical device 12 is calculated within a predefined time span, in particular up to 500 ms, prior to execution of the patient-critical firmware function 10 of the implantable medical device 12 and compared with a second checksum CRC_B.
[0052] The second checksum CRC_B is written into a predefined memory cell at the factory initial setting of the implantable medical device 12, said memory cell being accessible by operating a predefined register code.
[0053] FIG. 2 shows a schematic diagram of a system for protecting patient-critical firmware functions in an implantable medical device according to a preferred embodiment of the present invention.
[0054] The system 1 comprises an implantable medical device 12 and a programmer 30. Alternatively, the implantable medical device 12 may be controlled by a mobile device 32 configured to communicate wirelessly with the implantable medical device 12.
[0055] The implantable medical device 12 is configured to receive a request 14 by a programmer 30 to execute a patient-critical firmware function 10 of the implantable medical device 12, and the implantable medical device 12 is configured to verify that a user associated with the request 14 is authorized to execute the patient-critical firmware function 10.
[0056] The implantable medical device 12 is configured to read a first checksum CRC_A from a first memory area 16 of the implantable medical device 12 or provide the first checksum CRC_A as part of a code area 18 of a patient-critical firmware function 10 of the implantable medical device 12, and the first checksum CRC_A does not match the correct checksum CRC_OK associated with the patient-critical firmware function 10 of the implantable medical device 12.
[0057] Further, the implantable medical device 12 is configured to read a second checksum CRC_B from a second memory area 20 of the implantable medical device 12, where the second checksum CRC_B matches the correct checksum CRC_OK associated with the patient-critical firmware function 10 of the implantable medical device 12.
[0058] Furthermore, the implantable medical device 12 is configured to write a second checksum CRC_B to a third memory area 22 of the implantable medical device 12, from which the checksum is read prior to execution of the patient-critical firmware function 10 of the implantable medical device 12.
[0059] The implantable medical device 12 is further configured to calculate a correct checksum CRC_OK associated with the patient-critical firmware function 10 of the implantable medical device 12 and compare the correct checksum CRC_OK with a second checksum CRC_B. The implantable medical device 12 is configured to execute the patient-critical firmware function 10 of the implantable medical device 12 if the second checksum CRC_B and the correct checksum CRC_OK match. [Explanation of symbols]
[0060] Reference sign 1 System 10 PATIENT CRITICAL FIRMWARE FUNCTIONS 11 Method Steps 12 Implantable medical devices 13 Method Steps 14 requests 15 Method Steps 16 First Memory Area 17 Method Steps 18 Code Area 19 Method Steps 20 Second Memory Area 21 Method Steps 22 Third Memory Area 24 Compound Commands 26a Memory Buffer 26b Further Code Area 30. Programmer 32 Mobile Devices B. Method Steps C Method Steps CRC_A First checksum CRC_B Second checksum CRC_OK Correct checksum S1~S7 Method steps
Claims
1. A computer-implemented method for protecting patient-critical firmware functions (10) of an implantable medical device (12), particularly a pacemaker, defibrillator, and / or neurostimulator, against unintended execution, the method comprising: receiving a request (14) for execution of a patient-critical firmware function (10) of the implantable medical device (12); verifying (S2) that the user associated with the request (14) is authorized to execute the patient-critical firmware function (10); If the user associated with the request (14) is verified as authorized, reading (S3a) a first checksum (CRC_A) from a first memory area (16) of the implantable medical device (12) or providing (S3b) a first checksum (CRC_A) as part of a code area (18) of the patient-critical firmware function (10) of the implantable medical device (12), where the first checksum (CRC_A) does not match a correct checksum (CRC_OK) associated with the patient-critical firmware function (10) of the implantable medical device (12); reading (S4) a second checksum (CRC_B) from a second memory area (20) of the implantable medical device (12), wherein the second checksum (CRC_B) matches the correct checksum (CRC_OK) associated with the patient-critical firmware function (10) of the implantable medical device (12); writing (S5) the second checksum (CRC_B) to a third memory area (22) of the implantable medical device (12), from which the checksum is read before execution of the patient-critical firmware function (10) of the implantable medical device (12); calculating (S6) the correct checksum (CRC_OK) associated with the patient-critical firmware function (10) of the implantable medical device (12) and comparing the correct checksum (CRC_OK) with the second checksum (CRC_B); If the second checksum (CRC_B) matches the correct checksum (CRC_OK), executing (S7) the patient-critical firmware function (10) of the implantable medical device (12); 11. A computer-implemented method comprising:
2. The method includes: reading (S3a) the first checksum (CRC_A) from the first memory area (16) of the implantable medical device (12) or providing (S3b) the first checksum (CRC_A) as part of the code area (18) of the patient-critical firmware function (10) of the implantable medical device (12); and reading (S4) the second checksum (CRC_B) from the second memory area (20) of the implantable medical device (12), the checksum being read therefrom prior to execution of the patient-critical firmware function (10) of the implantable medical device (12).
2. The computer-implemented method of claim 1, wherein the writing (S5) of the second checksum (CRC_B) to the third memory area (22) of the implantable medical device (12), the calculation (S6) of the correct checksum (CRC_OK) associated with the patient-critical firmware function (10) of the implantable medical device (12), the comparison of the correct checksum (CRC_OK) with the second checksum (CRC_B), and the execution (S7) of the patient-critical firmware function (10) of the implantable medical device (12) are performed by a non-interruptible compound command (24).
3. 3. The computer-implemented method of claim 2, wherein during execution of the composite command of the patient-critical firmware function of the implantable medical device, the second checksum is overwritten by the first checksum, and the first checksum is read from a memory buffer or from a further code area of the patient-critical firmware function of the implantable medical device.
4. 4. The computer-implemented method of claim 3, wherein the composite command (24) of the patient-critical firmware function (10) of the implantable medical device (12) is terminated after overwriting the second checksum (CRC_B) with the first checksum (CRC_A).
5. 5. The computer-implemented method of claim 1, wherein the second checksum (CRC_B) is read from a hardware read-only register of the implantable medical device (12), and the second checksum (CRC_B) is a cyclic redundancy check, an XOR, a modulus or a cryptographic hash, in particular MD5, SHA-1 or SHA-2.
6. 5. The computer-implemented method of claim 1, wherein the patient-critical firmware functions of the implantable medical device are executed by accessing a graphical user interface of a programmer or an app running on a mobile device, in particular a smartphone or tablet device, the programmer or the mobile device being configured to communicate wirelessly with the implantable medical device.
7. 7. The computer-implemented method of claim 6, wherein the user authentication procedure includes a password entry or includes two-factor authentication including a password entry and an additional security feature for the programmer (30) or a web interface configured to control the programmer (30), and the user session includes a session ID and a timestamp.
8. 5. The computer-implemented method of claim 1, wherein the correct checksum (CRC_OK) associated with the patient-critical firmware function (10) of the implantable medical device (12) is calculated and compared with the second checksum (CRC_B) within a predefined time span, in particular within a maximum of 500 ms, prior to execution of the patient-critical firmware function (10) of the implantable medical device (12).
9. 5. The computer-implemented method of claim 1, wherein the second checksum (CRC_B) is written into a predefined memory cell at factory initialization of the implantable medical device (12), the memory cell being accessible by executing a predefined register code.
10. A system (1) for protecting patient-critical firmware functions (10) of an implantable medical device (12), in particular a pacemaker, defibrillator and / or neurostimulator, against unintended execution, said system comprising: an implantable medical device (12) and a programmer (30), the implantable medical device (12) configured to receive a request (14) for execution of a patient-critical firmware function (10) of the implantable medical device (12) by the programmer (30); the implantable medical device (12) is configured to verify that a user associated with the request (14) is authorized to execute the patient-critical firmware function (10); the implantable medical device (12) is configured to read a first checksum (CRC_A) from a first memory area (16) of the implantable medical device (12) or to provide a first checksum (CRC_A) as part of a code area (18) of the patient-critical firmware function (10) of the implantable medical device (12); the first checksum (CRC_A) does not match the correct checksum (CRC_OK) associated with the patient-critical firmware function (10) of the implantable medical device (12); the implantable medical device (12) is configured to read a second checksum (CRC_B) from a second memory area (20) of the implantable medical device (12); the second checksum (CRC_B) matches the correct checksum (CRC_OK) associated with the patient-critical firmware function (10) of the implantable medical device (12); the implantable medical device (12) is configured to write the second checksum (CRC_B) to a third memory area (22) of the implantable medical device (12) from which the checksum is read prior to execution of the patient-critical firmware function (10) of the implantable medical device (12); The system is configured such that the implantable medical device (12) calculates the correct checksum (CRC_OK) associated with the patient-critical firmware function (10) of the implantable medical device (12) and compares the correct checksum (CRC_OK) with the second checksum (CRC_B), and the implantable medical device (12) executes the patient-critical firmware function (10) of the implantable medical device (12) if the second checksum (CRC_B) and the correct checksum (CRC_OK) match.
11. 10. A computer program having a program code for performing the method according to claim 1 when the computer program runs on a computer.
12. A computer readable data carrier containing program code for a computer program for performing the method of claim 1 when said computer program is run on a computer.