Proximity pairing and security for persistent analyte sensor systems - Patents.com

Abstract

Techniques and protocols are disclosed for facilitating wireless secure communication between a sensor system and one or more other devices. In a particular embodiment, the techniques and protocols include a reduced power secure proximity pairing technique. A method for pairing an analyte sensor system with one or more display devices includes broadcasting a low power general advertisement from the analyte sensor system for an initial connection, the low power general advertisement including an indication that the low power general advertisement is for proximity pairing. The method includes receiving a connection request message from a first display device in response to the low power general advertisement, performing an authentication procedure with the first display device, and pairing and bonding with the first display device based on successful authentication with the first display device.

Description

[Technical field]

[0001] (CROSS REFERENCE TO RELATED APPLICATIONS) This application claims the benefit of and priority to U.S. Provisional Patent Application No. 63 / 269,460, filed March 16, 2022, which is hereby assigned to the assignee hereof and is expressly incorporated by reference in its entirety herein as if fully set forth below and for all applicable purposes.

[0002] FIELD OF THEINVENTION The present application relates generally to medical devices such as analyte sensors, and more particularly to systems, devices, and methods relating to wireless communication between analyte sensors (e.g., continuous glucose monitoring (CGM) devices) and one or more display devices. [Background technology]

[0003] Diabetes is a metabolic disease linked to the body's production or use of insulin, a hormone that allows the body to use glucose for energy or store it as fat.

[0004] Diabetes mellitus is a disease in which the pancreas cannot make enough insulin (type I or insulin-dependent) and / or insulin is ineffective (type 2 or non-insulin-dependent). In the diabetic state, patients suffer from hyperglycemia, which leads to many physiological abnormalities associated with microvascular deterioration (renal failure, skin ulcers, or bleeding into the vitreous humor of the eye). A hypoglycemic reaction (hypoglycemia) can be induced by inadvertent overdosing of insulin or after normal administration of insulin or glucose-lowering agents accompanied by abnormal exercise or inadequate food intake.

[0005] Traditionally, diabetics carry self-monitoring blood glucose (SMBG) monitors, which can require uncomfortable finger-prick techniques. Due to lack of comfort and convenience, diabetics typically only measure their glucose levels two to four times per day. Unfortunately, these time intervals are so far apart that diabetics are likely to be late in receiving alerts about hyperglycemic or hypoglycemic conditions, and may suffer dangerous side effects as a result. In fact, diabetics are unlikely to measure their SMBG values ​​in a timely manner, and furthermore, diabetics are not aware of whether their blood glucose levels are rising (higher) or falling (lower) due to limitations of traditional methods.

[0006] To this end, a variety of non-invasive, transcutaneous (e.g., transdermal), and / or implantable sensors have been developed to continuously detect and / or quantify blood glucose values. Generally, in diabetes management systems, these sensors wirelessly transmit raw or minimally processed data for subsequent display and / or analysis at one or more remote devices, which may include a display device, a server, or any other type of communication device. The remote devices, such as the remote devices, may then utilize a trusted software application (e.g., approved and / or provided by the sensor manufacturer) that retrieves the raw or minimally processed data and provides the user with information regarding the user's blood glucose level. A diabetes management system using such implantable sensors may provide the user with more up-to-date information, thereby reducing the risk that the user will fail to regulate the user's blood glucose level.

[0007] However, using a wireless connection between a transcutaneous analyte sensor and one or more display devices based on certain existing wireless communication protocols may expose the sensor and / or display device to security, integrity, privacy, and availability issues (e.g., the sensor and / or display device may become unavailable as a result of a malicious attack, etc.). As an example, an attacker may use a malicious device masquerading as a sensor to connect to a user's display device and transmit inaccurate data (e.g., inaccurate blood glucose levels) to harm the user. In another example, an attacker may use a malicious device to masquerade as a user's display device or software application and run the software application on the user's display device to access the user's sensor. In such an example, the attacker may receive the user's sensor data (e.g., blood glucose levels), thereby violating the patient's privacy. Also, in such an example, the attacker may transmit data to the sensor that may cause the sensor or sensor electronics to malfunction. For example, a malicious or spoofed display device may inaccurately calibrate the sensor, thereby causing the sensor to provide inaccurate blood glucose measurements. Furthermore, in the same example, the attacker may disrupt a communication session that a user has already established between the user's sensor and the user's own display device running a trusted software application. In some other examples, the user himself may use an unauthorized software application that may be running on the user's own display device to connect with the user's sensor. In such examples, the unauthorized software application may not include the necessary security measures required to ensure the security and safety of the user's data.

[0008] This background is provided to introduce a brief context for the Summary and Detailed Description that follow. This background is not intended to aid in determining the scope of the claimed subject matter, nor is it intended to be construed as limiting the claimed subject matter to implementations that solve any or all of the disadvantages or problems discussed above. Summary of the Invention

[0009] Certain embodiments of the present disclosure provide a method of pairing an analyte sensor system with one or more display devices. The method generally includes broadcasting a low-power general advertisement from the analyte sensor system for initial pairing, the low-power general advertisement including an indication that the general advertisement is for proximity pairing. The method includes receiving a connection request message from a first display device in response to the low-power general advertisement. The method includes performing an authentication procedure with the first display device. The method includes pairing with the first display device based on successful authentication with the first display device.

[0010] Further embodiments include a non-transitory computer-readable storage medium storing instructions that, when executed by a computer system, cause the computer system to perform the above-described method, and an apparatus including at least one processor and a memory configured to perform the above-described method. [Brief description of the drawings]

[0011] [Figure 1A] 1 illustrates an exemplary diabetes management system according to certain embodiments disclosed herein. [Figure 1B] 1B illustrates the example diabetes management system of FIG. 1A in greater detail, according to certain embodiments disclosed herein. [Diagram 2]FIG. 13 is a call flow diagram illustrating the execution of a particular security protocol for establishing secure wireless communication between an analyte sensor system and a first display device in accordance with certain embodiments disclosed herein. [Diagram 3] FIG. 11 is a call flow diagram illustrating the execution of a particular security protocol for establishing secure wireless communication between an analyte sensor system and a second display device according to certain embodiments disclosed herein. [Figure 4] FIG. 13 is a call flow diagram illustrating the execution of a particular security protocol for re-establishing secure wireless communication between the analyte sensor system and the first display device in accordance with certain embodiments disclosed herein. [Diagram 5] FIG. 11 is another call flow diagram illustrating the execution of a particular security protocol for establishing secure wireless communication between the analyte sensor system and a first display device in accordance with certain embodiments disclosed herein. [Figure 6] FIG. 11 is a flow diagram illustrating an example operation for pairing an analyte sensor system with one or more display devices according to an embodiment disclosed herein. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Certain embodiments described herein relate to a number of different security protocols used by display devices, analyte sensor systems, medical devices (e.g., medical delivery devices), and / or server systems to establish secure wireless connections. The embodiments may reduce issues affecting system safety, integrity, privacy, and / or availability associated with wireless communications in diabetes management. Although certain embodiments herein are described with respect to diabetes management, glucose sensor systems, and transmission of glucose measurements between devices, the protocols and techniques described herein are equally applicable to any type of health management system that includes any type of analyte sensor (e.g., lactate sensors, ketone sensors, potassium sensors, etc.).

[0013] As explained above, security is an important issue in wireless communication. When using Bluetooth Low Energy (BLE), when two devices want to communicate securely, Simple Secure Pairing can be used. Simple Secure Pairing establishes a secret link key to properly authenticate the devices. However, in most cases, the pairing process itself takes place over the same exposed wireless medium and is therefore still vulnerable to eavesdropping and attack.

[0014] Furthermore, according to one current pairing protocol between an analyte sensor system (hereinafter "sensor system") and a display device, upon startup of the sensor system, the sensor system begins advertising (e.g., broadcasting advertisement packets) for up to 22 seconds every 5 minutes in order to be identified by and connect with the display device. Typically, the 22 seconds of advertising includes a general advertising period as well as a whitelist advertising period, as further described in more detail herein. General advertising refers to advertisements broadcast by the sensor system to connect with a user's display device for the first time. Whitelist advertising refers to advertisements sent by the sensor system to reconnect with a display device with which the sensor system has already been paired and bonded once.

[0015] During general advertising, when an advertisement is received by the intended display device, the display device issues a connection request to the sensor system, which may then receive the connection request from the display device and grant the connection request to the display device.

[0016] When higher power (e.g., substantially full power) is used by the sensor system to transmit advertisements, even display devices not intended to pair with the sensor system, including an attacker, may detect the advertisements and send connection requests to the sensor system. Thus, an attacker receiving the advertisement may have an opportunity to connect to the analyte sensor system and access the user's data. Furthermore, as described in more detail herein, when high-power advertisements are used by the sensor system, the display device and the sensor system may be configured to perform a specific user-centric authentication protocol between them to ensure that the display device and the sensor system are trusted by the corresponding user, which may result in resource (e.g., computation, battery, time, etc.) inefficiencies.

[0017] In addition, when higher power advertisements are used by the sensor system, unintended display devices may detect the higher power advertisements and send connection requests to the analyte sensor system, causing congestion in the sensor system. Congestion in the sensor system may prevent the sensor system from receiving connection requests from display devices with which the sensor system is attempting to connect, or may at least delay the connection between the intended display devices and the sensor system. It should be noted that congestion in a sensor system refers to a situation in which the sensor system is occupied by exchanging messaging with display devices that are not intended to communicate.

[0018] Another technical deficiency with certain existing pairing protocols is that the true BLE address of the sensor system is used in the general advertisement that the sensor system broadcasts to connect with the intended display device, as well as in the whitelist advertisement that the sensor system sends to periodically reconnect with the display device. However, when the true BLE address of the sensor system is used in the general advertisement, display devices that are already paired and bonded with the sensor system and therefore have stored the true BLE address of the sensor system will attempt to reconnect with the sensor system during the general advertising. However, receiving a connection request from a display device that is already paired and bonded with the sensor system during the general advertising would cause congestion and prevent the sensor system from achieving the goal that the sensor system is configured to accomplish by sending a general advertisement to connect with a new display device (e.g., a display device that is not yet paired and bonded).

[0019] Therefore, what is needed is a method and apparatus for secure pairing and bonding between an analyte sensor system (hereinafter "sensor system") and one or more display devices to provide secure communication between the devices and also to ensure that the correct devices are paired. Although the embodiments described herein below refer to the sensor system communicating with the one or more display devices, it should be noted that it is a transmitter within the sensor system that communicates with the one or more display devices.

[0020] Certain embodiments described herein provide proximity pairing techniques for use between a sensor system and one or more display devices. In some embodiments, certain proximity pairing techniques described herein involve identifying a sensor system to broadcast a low-power general advertisement for proximity pairing. As used herein, a "low-power" advertisement may refer to an advertisement broadcast at a low or minimum power of the sensor system. In some embodiments, the low or minimum power may be approximately -40 dBm (decibels-milliwatts) to a particular device. The low-power general advertisement may further include a flag indicating that the general advertisement is for proximity pairing.

[0021] In some embodiments, the use of low-power general advertisements ensures that only devices in close proximity to the sensor system can detect the sensor system's advertisements, thereby reducing the likelihood of attacks, i.e., malicious devices attempting to connect with a user's sensor system. Additionally, the use of low-power general advertisements reduces the number of display devices that detect the advertisements and send connection requests, thereby reducing congestion in the analyte sensor system.

[0022] The use of proximity pairing may further allow for skipping certain authentication protocols and / or communications typically used between the sensor system and the display device when higher powered general advertisements are used. Skipping certain authentication protocols and / or communications conserves resources and reduces the overall amount of time it takes for the sensor system and the display device to pair and bond.

[0023] For example, if proximity pairing is used, when the display device receives a low-power general advertisement with a proximity pairing flag, the display device may determine to skip an authentication protocol to be used with the sensor system based on the flag indicating proximity pairing. For example, the display device may determine not to perform a user-centric authentication protocol, such as a password authenticated key exchange (PAKE) protocol, based on the flag indicating proximity pairing.

[0024] Typically, when proximity pairing is not used, a user-centric mutual authentication protocol is performed, allowing each of the display device and the analyte sensor system to verify that the other possesses a shared secret and is therefore trusted by the user. For example, performing a user-centric mutual authentication protocol allows each of the display device and the analyte sensor system to generate an authentication key ("K-auth") based on a shared secret (e.g., a pairing code). If both the display device and the analyte sensor system generate the same K-auth as a result of performing the user-centric authentication protocol, which is then verified using a key verification protocol, then the display device and the sensor system can conclude that the other possesses the shared secret and is therefore trusted by the user. As described below, proximity pairing ensures that the display device and the sensor system are in proximity to each other, so that both devices can be assumed to be trusted and have the same user, thereby avoiding the need for a user-centric authentication protocol to be performed, at least in some cases.

[0025] In some embodiments, once the sensor system connects with a display device, the sensor system broadcasts a higher power general advertisement for additional display devices to connect. As used herein, a "higher power" advertisement may refer to an advertisement that is broadcast at a higher power than a lower power advertisement. In some embodiments, the higher power advertisement is broadcast at the full power of the sensor system. In some embodiments, the full power may be about 0 dBm. The higher power general advertisement does not include a flag indicating that the advertisement is for proximity pairing.

[0026] In some embodiments, to reconnect, the sensor system broadcasts a higher power whitelist advertisement. As used herein, a "whitelist" advertisement may refer to an advertisement periodically sent by the sensor system to reconnect with one or more display devices that are already paired and bonded with the sensor system. In certain embodiments, the whitelist advertisement includes a "whitelist" flag. In some embodiments, only devices that have previously connected and been added to the whitelist by the sensor system are allowed to connect to the sensor system during the whitelist advertisement. In certain embodiments, the higher power whitelist advertisement does not include a flag indicating that the advertisement is for proximity pairing.

[0027] In some embodiments, after connecting with one display device or with a threshold number of display devices, the sensor system stops transmitting low-power general advertisements and transmits only higher-power advertisements. In some embodiments, even after connecting with one display device or with a threshold number of display devices, the sensor system continues to transmit low-power general advertisements until the sensor system pairs with a threshold number of display devices or for the life of the sensor system.

[0028] In certain embodiments where the sensor system continues to send general advertisements, it may include a secondary (e.g., “fake”) identifier in the general advertisement sent for pairing and may include a primary (e.g., “true”) identifier in the whitelist advertisement for reconnection. In some embodiments, the sensor system broadcasts a general advertisement using a fake BLE address of the sensor system to pair with one or more display devices. As used herein, a “fake” BLE address is a BLE address of the sensor system that is not a BLE address of the sensor system assigned by the actual manufacturer of the sensor system. In order for the sensor system to reconnect with a display device previously paired with the sensor system, the sensor system includes its true BLE address in its whitelist advertisement. As described further herein, the use of a fake identifier in the general advertisement may prevent display devices already paired with the sensor system from attempting to reconnect every time a general advertisement is sent during the life of the sensor system.

[0029] The pairing and security protocols used by the sensor system and one or more display devices to establish a secure wireless connection are described more fully herein with respect to Figures 1-6 below. The pairing and security protocols described herein may provide power cost savings to the sensor system and one or more display devices while providing secure and efficient pairing between the sensor system and one or more display devices and an improved user experience.

[0030] Exemplary Analyte Sensor Systems 1A illustrates an analyte monitoring system 100 ("system 100"), such as a diabetes management system, that may be used in connection with embodiments of the present disclosure involving collecting, monitoring, and / or providing information regarding analyte values ​​present in a user's body, including, for example, the user's blood glucose levels. Analyte monitoring system 100 illustrates aspects of sensor system 8 (hereinafter "SS8"), which may be communicatively coupled to display devices 110 (e.g., a proprietary receiver display dedicated to the analyte monitoring system), 120 (e.g., a mobile phone), 130 (e.g., a tablet), and 140 (e.g., a smart watch), and / or a server system 134.

[0031] In some embodiments, the SS8 is provided for measuring an analyte in a host or user. By way of overview and example, the SS8 may be implemented as an encapsulated microcontroller that performs sensor measurements, generates analyte data (e.g., by calculating values ​​of continuous glucose monitoring data), and engages in wireless communication (e.g., via Bluetooth and / or other wireless protocols) to transmit such data to a display device, such as display device 110, 120, 130, 140, and / or server system 134. Paragraphs

[0137] -

[0140] and Figures 3A, 3B, and 4 of U.S. Patent Application Publication No. 2019 / 0336053 further describe an on-skin sensor assembly that may be used in connection with the SS8 in certain embodiments. Paragraphs

[0137] -

[0140] and Figures 3A, 3B, and 4 of U.S. Patent Application Publication No. 2019 / 0336053 are incorporated herein by reference.

[0032] In a specific embodiment, the SS8 includes a sensor electronics module 12 and an analyte sensor 10 associated with the sensor electronics module 12. In a specific embodiment, the sensor electronics module 12 includes electronic circuitry associated with measuring and processing the analyte sensor data or information, including algorithms associated with processing and / or calibrating the analyte sensor data / information. The sensor electronics module 12 may be physically / mechanically connected to the analyte sensor 10 and may be integral to the analyte sensor 10 (i.e., non-removably attached) or may be removably attached.

[0033] The sensor electronics module 12 may also be electrically coupled to the analyte sensor 10 (e.g., (a) prior to insertion into the patient's body, or (b) during insertion into the patient's body) such that the components may be electromechanically coupled to one another. The analyte sensor electronics module 12 may include hardware, firmware, and / or software that enables measurement and / or estimation of a level of an analyte in a host / user via the analyte sensor 10 (which may be / include, for example, a glucose sensor). For example, the analyte sensor electronics module 12 may include one or more potentiostats, a power supply for providing an output to the analyte sensor 10, other components useful for signal processing and data storage, and a telemetry module for transmitting data from the sensor electronics module to one or more display devices. The electronics may be mounted on a printed circuit board (PCB) or platform within the SS8, and may take a variety of forms. For example, the electronics may take the form of an integrated circuit (IC), such as an Application-Specific Integrated Circuit (ASIC), a microcontroller, a processor, and / or a state machine.

[0034] Sensor electronics module 12 may include sensor electronics configured to process sensor information, such as sensor data, and generate transformed sensor data and displayable sensor information. Examples of systems and methods for processing sensor analyte data are described in more detail herein and in U.S. Pat. Nos. 7,310,544 and 6,931,327, as well as U.S. Patent Publication Nos. 2005 / 0043598, 2007 / 0032706, 2007 / 0016381, 2008 / 0033254, 2005 / 0203360, 2005 / 0154271, 2005 / 0192557, 2006 / 0222566, 2007 / 0203966, and 2007 / 0208245, all of which are incorporated by reference herein in their entireties.

[0035] The analyte sensor 10 is configured to measure a concentration or level of an analyte in a host. The term analyte is further defined in paragraph

[0117] of U.S. Patent Application No. 2019 / 0336053. U.S. Patent Application No. 2019 / 0336053 is incorporated herein by reference. In some embodiments, the analyte sensor 10 includes a continuous glucose sensor, such as a subcutaneous, transdermal (e.g., transcutaneous), or intravascular device. In some embodiments, the analyte sensor 10 can analyze multiple intermittent blood samples. The analyte sensor 10 can use any glucose measurement method, such as enzymatic, chemical, physical, electrochemical, spectrophotometric, polarimetric, calorimetric, iontophoretic, radiometric, immunochemical, etc. Additional details regarding continuous glucose sensors are provided in paragraphs

[0072] -

[0076] of U.S. Patent Application No. 13 / 827,577. Paragraphs

[0072] to

[0076] of U.S. patent application Ser. No. 13 / 827,577 are incorporated herein by reference.

[0036] It should be noted that, although certain embodiments assume that the SS8 is a glucose sensor system, the SS8 may be operative to monitor one or more additional or alternative analytes. As discussed, the term "analyte" as used herein is a broad term and is to be given its ordinary and customary meaning to one of skill in the art (and is not to be limited to any special or customized meaning) and refers to, but is not limited to, a substance or chemical constituent in the body or a biological sample (e.g., bodily fluids including blood, serum, plasma, interstitial fluid, cerebrospinal fluid, lymphatic fluid, ocular fluid, saliva, oral fluid, urine, feces, or exudates). Analytes may include naturally occurring substances, man-made substances, metabolites, and / or reaction products. In some embodiments, the analytes for measurement by the sensor regions, devices, and methods are albumin, alkaline phosphatase, alanine transaminase, aspartate aminotransferase, bilirubin, blood urea nitrogen, calcium, CO2, chloride, creatinine, glucose, gamma-glutamyl transpeptidase, hematocrit, lactate, lactate dehydrogenase, magnesium, oxygen, pH, phosphorus, potassium, sodium, total protein, uric acid, metabolic markers, and drugs.

[0037] Acetaminophen, dopamine, ephedrine, terbutaline, ascorbate, uric acid, oxygen, d-amino acid oxidase, plasma amine oxidase, xanthine oxidase, NADPH oxidase, alcohol oxidase, alcohol dehydrogenase, pyruvate dehydrogenase, diol, Ros, NO, bilirubin, cholesterol, triglycerides, gentisic acid, ibuprofen, L-dopa, methyldopa, salicylate, tetracycline, tolazamide, tolbutamide, acarboxyprothrombin, acylcarnitine ; adenine phosphoribosyltransferase; adenosine deaminase; albumin; α-fetoprotein; amino acid profile (arginine (Krebs cycle), histidine / urocanic acid, homocysteine, phenylalanine / tyrosine, tryptophan); andrenostenedione; antipyrine; arabinitol enantiomers; arginase; benzoylecgonine (cocaine); biotinidase; biopterin; c-reactive protein; carnitine; carnosinase; CD4; ceruloplasmin; chenodeoxycholic acid; Chloroquine;Cholesterol;Cholinesterase;Conjugated 1-β-hydroxy-cholic acid;Cortisol;Creatine kinase;Creatine kinase MM isoenzyme;Cyclosporin A;d-Penicillamine;Desethylchloroquine;Dehydroepiandrosterone sulfate;DNA (acetylation polymorphism, alcohol dehydrogenase, α1-antitrypsin, cystic fibrosis, Duchenne / Becker muscular dystrophy, glucose-6-phosphate dehydrogenase, hemoglobin A, hemoglobin S, hemoglobin C, hemoglobin D , Hemoglobin E, Hemoglobin F, D-Punjab, beta-thalassemia, Hepatitis B virus, HCMV, HIV-1, HTLV-1, Leber's hereditary optic neuropathy, MCAD, RNA, PKU, Plasmodium vivax, sex differentiation, 21-deoxycortisol); Desbutylhalofantrine; Dihydropteridine reductase; Diphtheria / tetanus antitoxin; Erythrocyte arginase; Erythrocyte protoporphyrin; Esterase D; Fatty acids / acylglycines; Free beta-human chorionic gonadotropin; Free erythrocyte porphyrin; Free thyroxine (FT4);Free triiodothyronine tri-iodothyronine, FT3); fumarylacetoacetase; galactose / gal-1-phosphate; galactose-1-phosphate uridyltransferase; gentamicin; glucose-6-phosphate dehydrogenase; glutathione; glutathione peroxidase; glycocholate; glycosylated hemoglobin; halofantrine; hemoglobin variants; hexosaminidase A; human erythrocyte carbonic anhydrase I; 17-α-hydroxyprogesterone; hypoxanthine phosphoribosyltransferase; immunoreactive trypsin; lactate; lead; lipoproteins ((a), B / A-1, β); lysozyme; mefloquine; netilmicin; phenobarbitone; phenytoin; phytanic acid / pristanic acid; progesterone; prolactin; prolidase; purine nucleoside phosphorylase; quinine; reverse triiodothyronine (reverse tri-iodothyronine, rT3); selenium; serum pancreatic lipase; sisomicin; somatomedin C; specific antibodies (adenovirus, antinuclear antibody, anti-zeta antibody, arbovirus, pseudorabies virus, dengue virus, guinea worm, tapeworm, ameba histolytica, enterovirus, giardiasis, Helicobacter pylori, hepatitis B virus, herpes virus, HIV-1, IgE (atopic disease), influenza virus, Leishmania donovani, Leptospira, measles / mumps / rubella, Mycobacterium leprae, Mycoplasma pneumoniae, myoglobin, Onchocerca volvulus, parainfluenza Viruses, malaria parasites, poliovirus, Pseudomonas aeruginosa, respiratory syncytial virus, Rickettsia (tsutsugamushi disease), Schistosoma mansoni, Toxoplasma gondii, Treponema pallidum, Trypanosoma cruzi / langeri, Vesicular stomatitis virus, Wuchereria bancrofti, Yellow fever virus);Specific antigens (Hepatitis B virus, HIV-1);Succinylacetone;Sulfadoxine;Theophylline;Thyrotropin (TSH);Thyroxine (T4);Thyroxine-binding globulin;Trace elements;Transferrin;UDP-galactose-4-epimerase;Urea;Uroporphyrinogen I synthase;Vitamin A;Leukocytes;Other analytes are contemplated as well, including, but not limited to, zinc protoporphyrin and zinc protoporphyrin. Salts, sugars, proteins, fats, vitamins, and hormones naturally present in blood or interstitial fluid can also constitute analytes in certain embodiments.

[0038] The analyte may be naturally present in a biological fluid, e.g., a metabolite, hormone, antigen, antibody, etc. Alternatively, the analyte may be introduced into the body, e.g., a contrast agent for imaging, a radioisotope, a chemical agent, a fluorocarbon-based synthetic blood, or a drug or pharmaceutical composition, including, but not limited to, insulin; ethanol; cannabis (marijuana, tetrahydrocannabinol, hashish); inhalants (nitrous oxide, amyl nitrite, butyl nitrite, chlorohydrocarbons, hydrocarbons); cocaine (crack cocaine); stimulants (amphetamine, methamphetamine, ritalin, silurt, preludine, didrex, prestate, borane, sandrex, pregin); antidepressants (barbiturates, methaqualone, valium salts, etc.); , Librium, Miltown, Serax, Equuanil, Tranxine and other tranquilizers); hallucinogens (phencyclidine, lysergic acid, mescaline, peyote, psilocybin); narcotics (heroin, codeine, morphine, opium, meperidine, Percocet, Percodan, Tasionex, fentanyl, Darvon, Talwin, Lomotil); synthetic narcotics (fentanyl, meperidine, amphetamine, methamphetamine, and analogs of phencyclidine, e.g., ecstasy); anabolic steroids; and nicotine. Metabolites of drugs and pharmaceutical compositions are also contemplated analytes. Analytes such as neurochemicals and other chemicals produced in the body, such as ascorbic acid, uric acid, dopamine, noradrenaline, 3-methoxytyramine (3MT), 3,4-dihydroxyphenylacetic Acid (DOPAC), homovanillic acid (HVA), 5-hydroxytryptamine (5HT), histamine, Advanced Glycation End Products (AGEs), and 5-hydroxyindoleacetic acid (FHIAA), can also be analyzed.

[0039] 1A , display devices 110, 120, 130, and / or 140 can be configured to display (and / or alert) displayable sensor information (e.g., in customized data packages transmitted to the display devices based on respective preferences) that may be transmitted by sensor electronics module 12. Each of display devices 110, 120, 130, or 140 may include a display, such as touch screen display 112, 122, 132, and / or 142, for displaying sensor information and / or analyte data to a user and / or receiving input from a user. For example, a graphical user interface (GUI) may be presented to the user for such purposes.

[0040] In certain embodiments, the display devices may include other types of user interfaces, such as a voice user interface, instead of or in addition to a touch screen display, for communicating sensor information to a user of the display device and / or receiving user input. In certain embodiments, one, some, or all of the display devices 110, 120, 130, 140 may be configured to display or otherwise communicate sensor information as communicated from the sensor electronics module 12 (e.g., within a data package transmitted to the respective display device) without any additional anticipated processing required for calibration and / or real-time display of the sensor data.

[0041] 1A may include custom or proprietary display devices. Display device 110 may be a proprietary receiver specifically designed to display sensor information associated with a particular type of displayable analyte data (e.g., in certain embodiments, numerical values ​​and / or arrows) received from sensor electronics module 12. In certain embodiments, one of display devices 110, 120, 130, 140 includes a smartphone, for example, based on Android, iOS, or another operating system (OS) configured to display a graphical representation of persistent sensor data (e.g., including current and / or historical data).

[0042] In certain embodiments, the analyte monitoring system 100 further includes a medical delivery device (e.g., an insulin pump or pen). The sensor electronics module 12 may be configured to transmit the sensor information and / or analyte data to the medical delivery device. The medical delivery device (not shown) may be configured to administer a dosage of insulin or another medication to a user based on the sensor information and / or analyte data (which may include, for example, a recommended insulin dosage) received from the sensor electronics module 12.

[0043] Server system 134 may be used to collect analyte data directly or indirectly from SS8 and / or multiple display devices, for example, according to embodiments described herein, perform analyses on the analyte data, generate generic or personalized models of glucose levels and profiles, provide services or feedback including from individuals or systems remotely monitoring the analyte data, perform or assist SS8 and display devices 150 with identifying, authenticating, etc. It should be noted that in certain embodiments, server system 134 may represent multiple systems or multiple computing devices performing the functions of server system 134 (e.g., in a distributed manner).

[0044] FIG. 1B illustrates a more detailed view of system 100 including display device 150 communicatively coupled to SS8. In a particular embodiment, display device 150 may be any one of display devices 110, 120, 130, and 140 of FIG. 1A. A communication path between SS8 and display device 150 is shown as wireless communication path 180. In a particular embodiment, SS8 and display device 150 are configured to wirelessly communicate over wireless communication path 180 using a low-range and / or short-range wireless communication protocol. Examples of low-range and / or short-range wireless communication protocols include Bluetooth and Bluetooth Low Energy (BLE) protocols. In a particular embodiment, other short-range wireless communication may include near field communication (NFC), radio frequency identification (RFID) communication, IR (infrared) communication, optical communication, and the like. In a particular embodiment, wireless communication protocols other than low-range and / or short-range wireless communication protocols, such as WiFi Direct, may be used for wireless communication path 180. The display device 150 is also configured to connect to a network 190 (e.g., a local area network (LAN), a wide area network (WAN), the Internet, etc.). For example, the display device 150 may connect to the network 190 via a wired (e.g., Ethernet) or wireless (e.g., WLAN, wireless WAN, cellular, mesh network, personal area network (PAN), etc.) interface. The display device 150 can communicate with the server system 134 through the network 190. A communication path between the display device 150 and the server system 134 is shown as communication path 181 through the network 190.

[0045] It should be noted that in certain embodiments, SS8 may be able to communicate independently (e.g., wirelessly) with server system 134 through network 190. The independent communication path between SS8 and server system 134 is shown as communication path 182. However, in certain other embodiments, SS8 may not be configured with the hardware / software necessary to establish an independent wireless communication path with server system 134, for example, through network 190. In such embodiments, SS8 may communicate with server system 134 through display device 150. An indirect or pass-through communication path between SS8 and server system 134 is shown as communication path 183.

[0046] In embodiments in which the display device 150 is a proprietary display device, such as the display device 110, specifically designed for communication of analyte data, the display device 150 may not be configured with the necessary hardware / software to independently connect to the network 190. Instead, in one such embodiment, the display device 150 is configured to establish a wired or wireless communication path 184 (e.g., through a Universal System Bus (USB) connection) with the computing device 103, which is configured to communicate with the server system 134 through the network 190. For example, the computing device 103 may connect to the network 190 via a wired (e.g., Ethernet) or wireless (e.g., WLAN, wireless WAN, cellular, etc.) interface. It should be noted that in the embodiments described in connection with FIGS. 2A-8, unless otherwise noted, it is assumed that the display device 150 can independently communicate with the server system 134 through the network 190, independent of the computing device 103.

[0047] System 100 further includes a server system 134 including a server 135 coupled to storage 136 (e.g., one or more computer storage systems, cloud-based storage systems and / or services, etc.). In certain embodiments, server system 134 may be located or execute within a public or private cloud. In certain embodiments, server system 134 may be located or execute on-premise ("on-prem"). As discussed, server system 134 is configured to receive, collect, and / or monitor information including analyte data and related information from SS8 and / or display device 150, as well as encryption / authentication information. Such information may include analyte data or inputs (e.g., a user's glucose readings and other physiological / behavioral information) received in association with an analyte monitoring or sensor application running on SS8 or display device 150. This information may be stored in storage 136 and processed by an analytics engine or the like that may perform analytics on the information. An example of an analyte sensor application that may be executable on display device 150 is analyte sensor application 121, as described further below.

[0048] In certain embodiments, the server system 134 at least partially directs communications between the SS8 and the display device 150, for example to facilitate authentication between them. Such communications include messaging (e.g., advertisements, commands, or other messaging), message delivery, and analyte data. For example, in certain embodiments, the server 134 may process and exchange messages between the SS8 and the display device 150 related to frequency bands, timing of transmissions, security, alarms, etc. In certain embodiments, the server system 134 may also update information stored in the SS8 and / or the display device 150. In certain embodiments, the server system 134 may send / receive information to / from the SS8 and / or the display device 150 in real-time or sporadically. Additionally, in certain embodiments, the server system 134 may implement cloud computing capabilities for the SS8 and / or the display device 150.

[0049] FIG. 1B also illustrates the components of the SS8 in more detail. As shown, in one particular embodiment, the SS8 includes an analyte sensor 10 coupled to a sensor electronics module 12. The analyte sensor electronics module 12 (shown in FIG. 1B and hereafter referred to as sensor electronics module 12) includes a sensor measurement circuit 13 coupled to the analyte sensor 10 for processing and managing sensor data. The sensor measurement circuit 13 may also be coupled to a processor 11. In some embodiments, the processor 11 may perform some or all of the functions of the sensor measurement circuit 13 to obtain and process sensor measurements from the analyte sensor 10. The processor 11 may also be coupled to a storage device 14 and a real time clock (RTC) 17 for storing and tracking sensor data. Additionally, the processor 11 may be further coupled to a connection interface 15 including a wireless unit or transceiver (TRX) 16 for transmitting sensor data and receiving requests and commands from an external device, such as a display device 150. As used herein, the term transceiver generally refers to a device or collection of devices that enables the SS8 to transmit and receive data (e.g., wirelessly). The SS8 may further include storage 14 and a real-time clock (RTC) 17 for storing and tracking sensor data. In some embodiments, it is contemplated that the SMC 13 may perform all of the functions of the processor 11 and vice versa.

[0050] The transceiver 16 may be configured with the necessary hardware and wireless communication protocols to enable wireless communication between the SS8 and other devices, such as the display device 150 and / or the server system 134. For example, as described above, the transceiver 16 may be configured with the necessary hardware and communication protocols to establish a Bluetooth or BLE connection with the display device 150. As one skilled in the art will appreciate, in such examples, the necessary hardware may include a Bluetooth or BLE security manager and / or other Bluetooth or BLE related hardware / software modules configured for the Bluetooth or BLE communication standards. In some embodiments in which the SS8 is configured to establish an independent communication path with the server system 134, the transceiver 16 may be configured with the necessary hardware and communication protocols to establish a wireless connection to the network 190 (e.g., a long-range wireless cellular communication protocol, such as GSM, CDMA, LTE, VoLTE, 3G, 4G, 5G communication protocol, etc.) to connect with the server system 134. As discussed elsewhere, other short-range protocols may also be used for communication between the display device 150 and the SS8, such as NFC, RFID, etc.

[0051] 1B also illustrates components of the display device 150 in more detail. As shown, the display device 150 includes a connection interface 128, a processor 126, a memory 127, a real-time clock (RTC) 163, a display 125 for presenting a graphical user interface (GUI), and a storage device 123. A bus (not shown herein) may be used to interconnect the various elements of the display device 150 and transfer data between these elements. The connection interface 128 includes a transceiver (TRX) 129 used to receive sensor data from the SS8 and to transmit requests, commands, and / or data to the SS8 and the server system 134. The transceiver 129 is coupled to other elements of the display device 150 via the connection interface 128 and / or the bus. The transceiver 129 may include multiple transceiver modules capable of operating on different wireless standards. For example, transceiver 129 may be configured with one or more communication protocols, such as a wireless communication protocol for establishing a wireless communication path with network 190 and / or a low-range wireless communication protocol (e.g., Bluetooth or BLE) for establishing a wireless communication path 180 with SS8. Additionally, connection interface 128 may include additional components for controlling wireless and / or wired connections, in some cases, such as baseband and / or Ethernet modems, audio / video codecs, etc.

[0052] In some embodiments, when a standardized communication protocol is used between the display device 150 and the SS8, commercially available transceiver circuits may be utilized that incorporate processing circuitry for handling low level data communication functions such as managing data encoding, transmission frequency, handshaking protocols, security, and the like. In these embodiments, the processor 126 of the display device 150 and / or the processor 11 of the SS8 may not need to manage these operations, but instead manage high level functions such as providing desired data values ​​for transmission, powering up or down, setting the rate at which messages are transmitted, and the like. Instructions and data values ​​for performing these high level functions may be provided to the transceiver circuitry via a data bus and transfer protocol established by the manufacturers of the transceivers 129 and 16. However, in embodiments where a standardized communication protocol is not used between the transceivers 129 and 16 (e.g., when a non-standardized or modified protocol is used), the processors 126 and 11 may be configured to execute instructions associated with a proprietary communication protocol (e.g., one or more of the communication protocols described herein) to control and manage their respective transceivers. Additionally, if non-standard or modified protocols are used, customized circuitry may be used to provide such protocols.

[0053] The processor 126 may include a processor sub-module, which may include, by way of example, an application processor that interacts with and / or controls other elements of the display device 150 (e.g., the connection interface 128, the analyte sensor application 121 (hereinafter “sensor application 121”), the display 125, the RTC 163, the memory 127, the storage device 123, etc.). In certain embodiments, the processor 126 is configured to perform functions related to device management, such as, for example, managing a list of available or previously paired devices, information regarding network conditions (e.g., link quality, etc.), information regarding the timing, type, and / or structure of messaging exchanged between the SS8 and the display device 150, etc. The processor 126 may be further configured to receive and process user inputs, such as, for example, a user fingerprint (e.g., for authorizing a user's access to data or for use in authorizing / encrypting data, including analyte data), and analyte data.

[0054] The processor 126 may include and / or be coupled to circuits such as logic circuits, memory, battery and power circuits, and other circuit drivers for peripheral and audio components. The processor 126 and any sub-processors thereof may include logic circuits for receiving, processing, and / or storing data received and / or input to the display device 150, as well as data transmitted or delivered by the display device 150. As described above, the processor 126 may be coupled by a bus to the display 125, the connection interface 128, the storage device 123, etc. Thus, the processor 126 may receive and process electrical signals generated by these respective elements, and thus perform various functions. By way of example, the processor 126 may access stored content from the storage device 123 and memory 127 at the direction of the analyte sensor application 121, and process the stored content for display by the display 125. Additionally, the processor 126 may process the stored content for transmission to the SS8 and / or server system 134 via the connection interface 128. Display device 150 may include other peripheral components not shown in detail in FIG. 1B.

[0055] In certain embodiments, memory 127 may include volatile memory, such as random access memory (RAM), for storing data and / or instructions for software programs and applications, such as analyte sensor application 121. Display 125 presents a GUI associated with operating system 162 and / or analyte sensor application 121. In various embodiments, a user may interact with analyte sensor application 121 via a corresponding GUI presented on display 125. By way of example, display 125 may be a touch screen display that accepts touch input. Analyte sensor application 121 may process and / or present analyte related data received by display device 150 and present such data via display 125. Additionally, analyte sensor application 121 may be used to obtain, access, display, control, and / or interface with analyte data and associated messaging and processes associated with SS8 (e.g., and / or any other medical device (e.g., an insulin pump or pen) communicatively coupled to display device 150), as described in further detail herein.

[0056] The storage device 123 may be a non-volatile storage device for storing software programs, instructions, data, and the like. For example, the storage device 123 may store the analyte sensor application 121, which when executed using the processor 126, receives input (e.g., via conventional hard / soft keys or a touch screen, voice detection, or other input mechanisms) and allows a user to interact with the analyte data and associated content via the display 125. In various embodiments, the storage device 123 may also store user input data and / or other data collected by the display device 150 (e.g., input from other users gathered via the analyte sensor application 121). The storage device 123 may further be used to store large amounts of analyte data received from the SS8 (or any other medical data received from other medical devices (e.g., insulin pumps, pens, etc.) for later retrieval and use, for example, to determine trends and trigger alerts.

[0057] As described above, the SS8, in certain embodiments, collects analyte data using the analyte sensor 10 and transmits the same or modified versions of the collected data to the display device 150. Data points regarding the analyte value may be collected and transmitted over the life of the analyte sensor 10 (e.g., ranging from 1 to 30 days or more). New measurements may be transmitted frequently enough to adequately monitor the glucose level. In certain embodiments, rather than having the transmitting and receiving circuitry of each of the SS8 and the display device 150 in continuous communication, the SS8 and the display device 150 may periodically and / or periodically establish a communication channel between each other. Thus, in such an embodiment, the SS8 may communicate with the display device 150 at, for example, a predetermined time interval. The length of the predetermined time interval may be selected to be long enough so that the SS8 does not consume too much power by transmitting data more frequently than necessary, but frequent enough to provide substantially real-time sensor information (e.g., measured glucose values ​​or analyte data) to the display device 150 for output to a user (e.g., via the display 125). The predetermined time interval is every five minutes in some embodiments, although it is understood that this time interval can be modified to be any desired length of time. In other embodiments, transceivers 129 and 16 may communicate persistently. For example, in one particular embodiment, transceivers 129 and 16 may establish a session or connection between them and continue to communicate together until the connection is lost.

[0058] The analyte sensor application 121 may be downloaded, installed, and initialized / setup on the display device 150. For example, the display device 150 may obtain the analyte sensor application 121 from the server system 134 over a network, such as network 190, or from another source, such as an application store. Following installation and setup, the analyte sensor application 121 may be configured to access, process, and / or interface with analyte data (e.g., whether stored on the server system 134, stored locally from storage device 123, or stored by the SS8 or any other medical device). By way of example, the analyte sensor application 121 may present menus including various controls or commands that may be performed in connection with the operation of the SS8, the display device 150, one or more other display devices (e.g., display devices 110, 130, 140, etc.), and / or one or more other partner devices, such as an insulin pump. For example, the analyte sensor application 121 may be used to interact with or control other display devices and / or partner devices, for example, to deliver or make available analyte data to other display devices and / or partner devices, including, for example, by receiving / transmitting analyte data directly to / from other display devices and / or partner devices and / or by transmitting instructions for the SS8 and other connected display devices and / or partner devices.

[0059] In certain embodiments, after downloading the analyte sensor application 121, as one of the first steps, the analyte sensor application 121 may instruct the user to wirelessly connect the display device 150 to the user's SS8, which may already be installed on the user's body. A wireless communication path 180 between the display device 150 and the SS8 allows the SS8 to transmit analyte measurements to the display device 150 and allows the two devices to engage in any of the other interactions described above. However, as discussed, using a wireless communication path between the display device 150 and the SS8 based on some existing wireless communication protocol may expose the display device 150, the SS8, and / or the server system 134 to security, integrity, privacy, and availability issues. Similarly, establishing other communication paths within the sample monitoring system 100 (e.g., communication path 181 between the display device 150 and the server system 134, and communication path 183 between the SS8 and the server system 134) using certain existing communication protocols also exposes the display device 150, the SS8, and / or the server system 134 to security, integrity, privacy, and availability issues.

[0060] Exemplary Proximity Pairing and Secure Connection of an Analyte Sensor System and One or More Display Devices Establishing a secure wireless connection between the SS88 and the display device 150 may involve engaging in identification, authentication, pairing, and / or bonding protocols or methods. The identification protocol may be designed, for example, to allow the display device 150 to effectively identify the SS8, while reducing the likelihood that an attacker can obtain any information during the identification process that may be useful in impersonating the SS8, the display device 150. The authentication protocol may be designed to allow the SS8 and the display device 150 to verify whether the other peer device is trusted by the device's user and / or root certificate authority. The pairing and bonding protocols may be designed to enable the exchange of information between the SS8 and the display device 150 to establish an encrypted connection for communication.

[0061] In certain embodiments, SS8 and display device 150 conform to one or more wireless protocols and standards (e.g., Bluetooth, Bluetooth Low Energy (BLE)). For example, SS8 and display device 150 may be configured with BLE-related hardware and software for communication. Thus, SS8 and display device 150 may engage in identification, authentication, pairing, and / or bonding in accordance with the BLE standard.

[0062] As described above, pairing advertisements broadcast at high power (e.g., full power) may be detected by display devices 150 in a wide vicinity. Display devices that detect the advertisement may include display devices that are not intended to pair with the SS8. Such display devices 150 may request a connection to the SS8. A connection request from a display device that is not intended to pair with the SS8 may cause congestion in the SS8 that may delay the connection of the intended display device. Furthermore, an attacker may detect the advertisement and attempt to connect to the SS8 to access user data.

[0063] Embodiments herein provide for the use of proximity pairing. Proximity pairing may involve transmitting low-power general advertisements that can only be detected by devices in proximity to the SS8. The use of low-power general advertisements may ensure that the intended display device (i.e., the display device that the SS8 user intends the SS8 to connect to) is the only display device that detects the low-power general advertisement and attempts to connect to the SS8. The use of low-power general advertisements helps reduce congestion in the SS8 caused by multiple display devices sending connection requests, and also improves the security of the pairing process by ensuring that devices attempting to connect to the SS8 are devices within the vicinity of the SS8, which are more likely to be trusted devices. In some embodiments, proximity pairing is used for initial pairing with a first display device, and normal pairing (higher power advertisements) is used for reconnecting with the first display device and for connecting with additional display devices that the SS8 has not yet paired and bonded with.

[0064] In some embodiments, SS8 fake BLE addresses are used for general advertisements and SS8 true BLE addresses are used for whitelist advertisements. Using advertisements with fake BLE addresses for initial pairing and true BLE addresses for reconnection and connections with additional display devices allows display devices to filter out advertisements that are not intended for them. The ability of the display devices to filter out advertisements further reduces the overhead consumed by the display devices in sending connection requests to unintended sensor systems, while also reducing congestion in the sensor systems.

[0065] Figure 2 is a call flow diagram 200 illustrating the execution of a security protocol for the establishment of secure wireless communication between an SS8 and a display device 150, according to certain embodiments disclosed herein. It should be noted that some of the steps illustrated in Figure 2 may be performed in a different order than illustrated in Figure 2, or may be performed in parallel or overlapping in time. Thus, the reference numbers assigned to the different steps illustrated in Figure 2 may not be indicative of the order in which they are performed in a particular embodiment.

[0066] Although call flow diagram 200 illustrates the execution of a security protocol for the establishment of a secure wireless communication between SS8 and a display device 150, the steps shown in call flow diagram 200 may be similarly followed when establishing a secure wireless communication between SS8 and one of a variety of other devices (e.g., a router, a hub, or any other computing device). In some embodiments, call flow diagram 200 illustrates a security protocol for an initial connection between SS8 and a first display device 150. That is, in some embodiments, the steps of flow diagram 200 may be performed when SS8 has not yet paired with any display device.

[0067] In the embodiment of Figure 2, before performing authentication, pairing, and bonding, the display device 150 and the SS 8 are first configured to identify each other. Steps 202-208 may be performed as part of an "identification phase."

[0068] In step 202, the display device 150 obtains the device ID from the device ID entered by the user into the display device 150. The device ID may be a sensor system ID (e.g., a seven character identifier of the SS8 sensor electronics module 12) or a serial number (e.g., a twelve character identifier) ​​of the SS8 sensor electronics module 12. The display device 150 may obtain the sensor system ID through other mechanisms, such as by scanning information associated with the sensor system. For example, the user may use the display device 150, which may include an image scanner, to scan a barcode or QR code located on the SS8 itself or its packaging. The barcode or QR code may indicate the device ID.

[0069] Once the display device 150 obtains the device ID in step 203, the display device 150 is configured to begin monitoring advertisements that include the device ID to identify SS8. As part of the monitoring, in a particular embodiment, the display device 150 filters out general advertisements that appear to be sent by devices that are not in proximity to the display device 150. For example, the display device 150 may filter out general advertisements that do not have a flag indicating that the general advertisement is for proximity pairing. In addition, the display device 150 may filter out general advertisements that have a signal strength (e.g., a receive signal strength indicator (RSSI) measurement) above a predetermined threshold. In some embodiments, the display device 150 is configured for filtering (e.g., for filtering based on the proximity flag and / or based on the RSSI). For example, the analytical sensor application 121 may configure the display device 150 for filtering.

[0070] Generally, when the SS8 (or its sensor electronics module 12) is first powered up, the SS8 is configured to broadcast a general advertisement in order to be identified by and paired with one or more display devices. In the embodiment of FIG. 2, the SS8 broadcasts a low-power general advertisement in step 204. The low-power general advertisement packets may be broadcast over multiple frequency channels. The SS8 may broadcast the low-power general advertisement periodically at a defined interval. In some embodiments, the SS8 broadcasts a low-power general advertisement as soon as the SS8 is powered on. In some embodiments, the low-power general advertisement is not broadcast until after sensor validation (which may take, for example, 20 seconds to up to 2 minutes), as described in more detail below with respect to FIG. 5.

[0071] Because the advertisements are low powered, the display device 150 will not detect the low powered general advertisements unless the display device 150 is relatively close (e.g., within a foot or in direct contact) to the SS 8. This proximity-enhanced security adds an additional level of trust that can be used to authenticate the SS 8 and the display device 150. That is, if the SS 8 and the display device 150 are in close proximity, it is assumed that the likelihood that the SS 8 or the display device 150 is mistakenly attempting to connect with an incorrect device or attacker is low.

[0072] The low-power general advertisement packet may include a flag (e.g., in a field of manufacturer flags) indicating that the low-power general advertisement is for proximity pairing. As described in more detail below, the flag indicating that the low-power general advertisement is for proximity pairing may indicate to the display device the type of authentication protocol to be performed. For example, as described in connection with step 210, when the flag indicates that the low-power general advertisement is for proximity pairing, the display device 150 and SS8 may skip the PAKE authentication protocol.

[0073] The low-power general advertisement packet may include the BLE address of the SS8 (e.g., a 48-bit BLE MAC address). The low-power advertisement may include a fake BLE address. Using a fake BLE address in the general advertisement may ensure that a display device already paired with the SS8 does not retry pairing every time the SS8 broadcasts a general advertisement (e.g., because such a display device begins to search for a true BLE address after the initial connection). By refraining from retrying pairing every time a general advertisement is broadcast, congestion in the SS8 is reduced. For example, if a display device that has previously been paired and bonded with the SS8 (e.g., added to a whitelist) detects the general advertisement and sends a connection request to the SS8, the SS8 may be occupied with those connection requests (e.g., processing and rejecting connections), and processing of connection requests from display devices that have not yet paired and bonded with the SS8 may be delayed.

[0074] However, by using a fake BLE address in the general advertisement, a display device that has previously paired and bonded with SS8 only needs to send a connection request in response to an advertisement with the true BLE address, thereby reducing congestion in SS8. Additionally, the fake BLE address may provide additional security since SS8 may not provide its true information until, for example, pairing and bonding has been performed. In some embodiments, the fake BLE address is the least significant bit (LSB) of the BLE address inverted relative to the manufacturer-assigned BLE address.

[0075] As described above, the SS8 may continue to broadcast low-power general advertisements until the whitelist threshold is met or for the life of the SS8 in order for additional display devices to pair and bond with the SS8. Thus, additional devices may request a connection upon detecting subsequent low-power general advertisements to the first device, similar to those shown in FIG. 5. In some embodiments, a fake BLE address is used in all low-power general advertisements. As described above, using a fake BLE address in subsequent low-power general advertisements can prevent devices previously bonded with the SS8 from sending connection requests to the SS8 after bonding with the SS8 in order to search for a true BLE address, thereby reducing congestion in the SS8.

[0076] The low-power general advertisement packet further includes a device ID or a version thereof. As described, the device ID may include a sensor system ID or a version thereof, or a manufacturer-assigned serial number (e.g., a 12-digit serial number) or a version thereof. For example, the low-power general advertisement may include a hash of the serial number assigned by the sensor system manufacturer. In another example, the low-power general advertisement may include an abbreviated hash of the serial number assigned by the sensor system manufacturer (e.g., the last two digits of a hash of the serial number assigned by the sensor system manufacturer).

[0077] In step 206, the display device 150 may then compare the device ID obtained by the display device 150 with the device ID (e.g., the sensor system ID, the serial number, a hash of the serial number, or an abbreviated hash of the serial number) advertised by the SS8 in the low-power general advertisement in step 204. If the obtained device ID and the advertised device ID are the same, the display device 150 identifies that the SS8 is the correct SS to connect to. Figure 3 and paragraphs

[0095] -

[0104] of the '754 application, incorporated by reference above, provide an exemplary identification protocol based on hashing, abbreviation, and / or a combination of both.

[0078] After detecting the low-power general advertisement and identifying that the advertisement packet includes a device ID that matches a device ID maintained by display device 150, display device 150 may send a connection request to SS8, step 208. In response, in some embodiments, SS8 sends a connection response message to display device 150 indicating that the request has been granted.

[0079] After the identification phase, during the authentication phase, the SS8 and the display device 150 may perform mutual authentication. Steps 210-216 may be performed as part of the authentication phase. In some embodiments, during the authentication phase, the SS8 and the display device 150 may use low-power transmissions for message exchange. In some other embodiments, during the authentication phase, the SS8 and the display device 150 may use full-power transmissions for message exchange. As described in more detail below, when the identification phase is performed using proximity pairing, a user-centric authentication protocol such as PAKE may be skipped during the authentication phase, as described further in connection with FIG. 2. On the other hand, when the identification phase is performed without using proximity pairing, both PKI and PAKE are performed during the authentication phase, as described further in connection with FIG. 3.

[0080] Thus, according to a particular embodiment, the authentication protocol performed between SS8 and display device 150 may be based on whether the device engages in proximity pairing during the identification phase, as indicated by a proximity pairing flag in the advertisement. As shown in FIG. 2, in step 210, display device 150 determines to skip PAKE or a similar user-centric authentication protocol based on the flag. Note that the use of a flag is an example, and any other indication may be used within a low-power general advertisement to indicate that SS8 intends to engage in proximity pairing.

[0081] PAKE is a key exchange protocol designed to allow two peer devices (e.g., display device 150 and SS8) to generate or derive a high-entropy authentication key (e.g., K-auth, which may be an advanced encryption standard (AES) key) from a shared, low-entropy secret (e.g., a pairing code associated with SS8). If execution of the PAKE protocol results in both display device 150 and SS8 generating the same K-auth, then SS8 and display device 150 can conclude that the other is in possession of the shared secret and is therefore trusted by the user.

[0082] In certain embodiments, the SS8 and display device 150 may be configured to execute a PAKE protocol at the application layer. Examples of PAKE include Juggling PAKE (J-PAKE), elliptic curve cryptography-J-PAKE (EC-J-PAKE), simple password exponential key exchange (SPEKE), common reference string-J-PAKE (CRS-J-PAKE), Augmented Composable Password Authenticated Connection Establishment (AuCPace), the "B" extension of SPEKE (BSPEKE), zero-knowledge PAKE (zkPAKE), client to client PAKE (C2C-PAKE), and encrypted key exchange (EKE). FIG. 5 and paragraphs

[0128] -

[0138] of the '754 application, incorporated by reference above, provide an exemplary SS8 and display device 150 that implements the PAKE protocol.

[0083] As described above, the PAKE protocol is used to authenticate the SS8 and the display device 150 by ensuring that the user trusts both the display device 150 and the SS8. Similarly, proximity pairing ensures that the display device 150 and the SS8 are in close proximity to each other, considering that the display device 150 will not detect the low-power general advertisement unless the display device 150 is close enough to the SS8, and therefore will not send a connection request to the SS8 if the display device 150 is not close to the SS8. Since the display device 150 and the SS8 are in close proximity to each other, it is assumed that the display device 150 and the SS8 are trusted and have the same user. Therefore, when proximity pairing is performed, PAKE may be skipped.

[0084] In the embodiment of FIG. 2, even though the display device 150 and SS8 skip PAKE, the two devices still perform other types of authentication. For example, the display device and SS8 may run a public key infrastructure (PKI) protocol and generate application-level keys based on running the PKI. PKI refers to a set of roles, policies, hardware, software, and procedures for creating, managing, distributing, using, storing, and revoking certificates, and managing public key encryption. In a typical PKI scheme, each device may generate or be configured with a key pair that includes a public key and a private key. When information is encrypted using a private key, only the corresponding public key can be used to decrypt the information, and vice versa. While the public key of a device may be widely distributed, the private key of the device is typically only known to the device and not shared with other devices. In some embodiments, before engaging in the call flow 200, the display device 150 first obtains authentication data including a public and private key pair from a server system (e.g., server system 134) during a setup process of a sensor application running on the display device 150.

[0085] PKI binds a public key to each identity of a device. The binding is established through a process of certificate registration and issuance at a certificate authority (CA). The CA's primary role is to digitally sign and publish the public key bound to a given device. The CA's own private key is used, since trust in the user key depends on trust in the validity of the CA's key. In one particular embodiment, the server system 134 acts as a root CA (RCA) by issuing and directly or indirectly signing the display device 150 and SS8 certificates. The RCA is the entity that validates all other entities in the system.

[0086] In step 212, the display device 150 and the SS8 may execute the PKI. Figures 4C and 11 and paragraphs

[0212] to

[0223] of the '754 Application, incorporated by reference above, provide an example of the display device 150 and the SS8 executing the PKI protocol. The display device 150 uses its public and private key pair when executing the PKI with the SS8. In some embodiments, the SS8 is configured with its key pair during the manufacturing process of the SS8. An example of the display device 150 obtaining authentication data from a server system is described in Figures 2A and 2B and paragraphs

[0063] to

[0065] of U.S. Patent Application No. 17 / 308,754, entitled "SECURE HEALTH MANAGEMENT SYSTEM," filed May 5, 2021 (hereinafter referred to as the "'754 Application"), which is incorporated by reference in its entirety herein.

[0087] 2, based on executing the PKI, the SS8 and the display device 150 can derive an application level key (e.g., a shared key) at steps 214 and 216, respectively. In some embodiments, the SS8 and the display device 150 can derive the application level key from the private key and the public key obtained during the PKI, for example, by executing an Elliptic Curve Diffie-Hellman (EDCH) key agreement algorithm. It should be noted that the EDCH key agreement algorithm is one exemplary technique for deriving the application level key from the private key and the public key, but other techniques can be used to derive the application level key.

[0088] Although not shown in Figure 2, the SS8 and display device 150 may perform additional authentication protocols. In some embodiments, the SS8 and display device 150 perform a PKI followed by a key verification protocol. In some embodiments, the SS8 and display device 150 perform a PKI followed by a proof-of-possession (POP) authentication protocol. Figures 6A-6C and paragraphs

[0143] -

[0171] of the '754 application, incorporated by reference above, provide exemplary key verification protocols.

[0089] After the authentication phase, the SS8 and display device 150 may perform pairing and bonding. Steps 218-222 may be performed as part of the pairing and bonding phase. In some embodiments, during the pairing and bonding phase, the SS8 and display device 150 may use lower power transmissions for message exchange. In some embodiments, during the pairing and bonding phase, the SS8 and display device 150 may use higher or full power transmissions for message exchange.

[0090] In step 218, the display device 150 may send a pairing request to the SS8, and in step 220, the SS8 may respond with a pairing response. In some examples, according to wireless protocols and standards (e.g., the BLE Secure Mode Pairing and Bonding standard), the pairing process involves an exchange of information, such as information about Input / Output (IO) capabilities, Man-In-The-Middle (MITM) protection, etc. During pairing between the SS8 and the display device 150, the two devices may agree on a temporary key (TK), the value of which may depend on the pairing method used.

[0091] In step 222, the SS8 and display device 150 engage in bonding. During bonding, the devices may store additional information about the other. For example, after exchanging security functions during pairing and encrypting the connection, the devices bond by generating and exchanging a long term key (LTK) and storing the LTK for later use.

[0092] After bonding with display device 150, SS8 may add display device 150 to a whitelist. The whitelist may be a data array or some other data structure maintained in memory by SS8 and may include devices with which SS8 has previously paired and bonded. By adding display device 150 to the whitelist, SS8 and display device 150 may more quickly reconnect for subsequent connections. For example, certain identification, authentication, and pairing and bonding steps may be skipped for reconnection, as described in more detail with respect to FIG.

[0093] After pairing and bonding, the SS8 and display device 150 are ready to exchange data over the secure connection. For example, the SS8 may use the LTK to encrypt data (e.g., at the BLE layer) including analyte measurements associated with the user for transmission to the display device 150 in step 224. The display device 159 may similarly use the LTK to encrypt data for transmission to the SS8.

[0094] Further details regarding the identification, authentication, pairing, and / or bonding described with respect to Figure 2 may be found in various specifications for such technologies (e.g., the Bluetooth specification), which are incorporated herein by reference in their entireties. Specifications may be provided by governing bodies for such technologies.

[0095] As previously mentioned, the SS8 collects analyte data and transmits the same or modified versions of the collected data to the display device 150. Data points regarding analyte values ​​may be collected and transmitted over the life of the SS8 (e.g., ranging from 1 to 30 days or more). New measurements may be transmitted frequently enough to adequately monitor the analyte levels of a user of the SS8. In certain embodiments, for power conservation purposes, rather than having the respective transmit and receive circuitry of the SS8 and the display device 150 in constant communication, the SS8 and the display device 150 may periodically and / or periodically establish a communication channel between each other.

[0096] Thus, in such an embodiment, the SS8 may communicate with the display device 150, for example, at a predetermined time interval (e.g., by periodically switching between a sleep mode and an operating mode). The length of the predetermined time interval may be selected to be long enough so that the SS8 does not consume too much power by transmitting data more frequently than necessary, but frequent enough to provide substantially real-time sensor information (e.g., measured glucose values ​​or analyte data) to the display device for output to the user. This time interval may be modified to be any desired length of time. For example, in one particular embodiment, the SS8 may "wake up" every few minutes (e.g., 5 minutes) to exchange data with the display device 150, but may go into a sleep mode during that time. Each time the SS8 "wakes up," the SS8 and the display device 150 may execute a security protocol to re-establish a secure wireless connection between the two devices. In other embodiments, the SS8 and the display device 150 may communicate persistently. For example, in one particular embodiment, the SS8 and the display device 150 may establish a session or connection between them and continue to communicate together until the connection is lost.

[0097] 2, the SS8 is configured to enter a sleep mode following pairing, bonding, and data exchange with the display device 150. Thus, in step 226, the SS8 and the display device 150 are disconnected.

[0098] As described above, after bonding with the display device 150, the SS8 adds information about the display device 150 (e.g., a generic access profile (GAP) address) to a whitelist for reconnection. In some embodiments, a threshold may be configured for the whitelist. The whitelist threshold may be used by the SS8 to determine whether to continue general advertising after disconnecting with the display device 150 or during subsequent advertising sessions when the SS8 wakes up (e.g., every 5 minutes). For example, the SS8 may have a single whitelist and a corresponding threshold of 1, meaning that the SS8 is configured to only connect with one device at a time. In such an example, if the SS8 is configured to perform general advertising for 2 seconds when it is first activated, upon pairing and bonding with the display device 150, the SS8 may determine to stop broadcasting general advertisements for the remainder of the initial 2-second general advertising session and / or during the next advertising session (e.g., every 5 minutes). In such an example, the SS8 simply performs whitelist advertising during the next advertising session to reconnect with the display device 150, as further described with respect to FIG.

[0099] In some embodiments, SS8 may be configured with multiple whitelists, each with a corresponding configured threshold. In such embodiments, each whitelist may be associated with a different type of device. For example, SS8 may have a first whitelist for commercial display devices (e.g., display device 150 of FIG. 1) and a second whitelist for medical devices such as proprietary receivers (e.g., display device 110 of FIG. 1). In the above example, SS8's first whitelist threshold for commercial display devices may be 1, and the second whitelist threshold for medical devices may also be 1.

[0100] In such an example, assuming that display device 150 is a commercial display device, after pairing and bonding with display device 150, SS8 may determine that SS8's whitelist threshold for commercial display devices has been met. However, in this example, because the threshold for SS8's second whitelist has not yet been met, SS8 may continue to send additional general advertisements for additional devices to pair with SS8, as shown in Figure 3. If SS8 determines that both whitelist thresholds have been met, SS8 will stop broadcasting general advertisements and will only broadcast whitelist advertisements moving forward, as shown in Figure 4.

[0101] In some embodiments, the SS8 has a configured period for sending whitelist advertisements and a configured period for sending general advertisements. For example, during an advertising session in which the SS8 performs both general and whitelist advertising, the SS8 may spend 2 seconds broadcasting general advertisements and 20 seconds broadcasting whitelist advertisements.

[0102] As discussed above, when the SS8 determines that the whitelist threshold is not met, the SS8 may proceed to execute the call flow diagram 300 to pair with one or more additional devices. FIG. 3 is a call flow diagram 300 illustrating the execution of a certain security protocol for establishing secure wireless communication between the SS8 and the second display device 350, according to certain embodiments disclosed herein. As shown in FIG. 3, steps 202, 203, 206, 208, 212, and 218-226 may be executed similarly to those described above with respect to FIG. 2. In step 203, once the second display device 350 obtains the device ID, the second display device 350 is configured to start monitoring advertisements including the device ID to identify the SS8. In some embodiments, proximity pairing is used only to connect to the first display device 150. Thus, the second display device 350 may not filter advertisements by proximity (e.g., unlike the first display device 150 does in step 203).

[0103] In step 304, for additional connecting devices, unlike the initial connection in step 204, the SS8 may broadcast a full power general advertisement instead of a low power general advertisement.

[0104] In addition, the full-output general advertisement may include a flag indicating that the advertisement is not for proximity. Alternatively, the absence of the flag may indicate that the advertisement is not for proximity pairing. Thus, in step 310, the second display device 350 decides to perform PAKE based on detecting that the general advertisement is not for proximity pairing. As shown in FIG. 3, the SS8 and the second display device 350 may engage in a PAKE protocol in step 311 to generate a K-auth. If both the display device 150 and the SS8 generate the same K-auth, the SS8 and the display device 150 each conclude that the other possesses the shared secret and is therefore trusted by the user.

[0105] After the SS8 pairs with the second display device 350 or one or more additional devices, the SS8 may determine that one or more whitelist thresholds have been met. As described above, in some embodiments, once one or more whitelist thresholds have been met, the SS8 may stop sending general advertisements and may only send whitelist advertisements for reconnection with one or more devices with which the SS8 was previously paired. Figure 4 is a call flow diagram 400 illustrating the execution of a particular security protocol for re-establishing secure wireless communication between the SS8 and the first display device 150, in accordance with certain embodiments disclosed herein.

[0106] At 404, the SS8 broadcasts a whitelist advertisement. In some embodiments, the whitelist advertisement is broadcast at full power. In some embodiments, the whitelist advertisement includes a flag indicating that the advertisement is a whitelist advertisement. In some embodiments, the whitelist advertisement includes the true BLE address of the SS8. In some embodiments, the SS8 only accepts connection requests from display devices that were previously added to its one or more whitelists. At step 406, the SS8 rejects connection requests from devices that are not in its one or more whitelists. Thus, when the display device 150 sends a connection request, at step 208, the SS8 allows the connection request because the display device 150 was previously paired with the SS8 and added to the SS8's whitelist. In some embodiments, the authentication and pairing and bonding steps may be skipped because the display device 150 was previously paired with the SS8. Although not shown, in some embodiments, a rekeying procedure may be performed. Figure 8 and paragraphs

[0184] -

[0188] of the '754 application, incorporated by reference above, provide an exemplary rekeying protocol. After connecting, the SS8 and display device 150 may exchange data at 224 and then disconnect at step 226.

[0107] As mentioned above, Figure 5 is a call flow diagram 500 illustrating another embodiment for executing a particular security protocol to establish secure wireless communication between the SS8 and a display device 150. Figure 5 may illustrate an alternative to the embodiment illustrated in the call flow diagram 200 of Figure 2 for establishing an initial connection between the SS8 and a first display device 150. That is, in some embodiments, the steps of the flow diagram 500 may be performed when the SS8 has not yet paired with any display device.

[0108] Steps 202, 203, and 206-226 may be performed as described above with respect to FIG.

[0109] In some embodiments, the SS8 waits until the analyte sensor 10 is verified, as shown in step 502, before broadcasting the low-power advertisement in step 504. In one example, the sensor verification may include a sensor insertion and / or activation process. In such an example, when the analyte sensor 10 is inserted into the user's body, the current or sensor data count may exceed a certain threshold to trigger activation or proper insertion of the analyte sensor 10. The low-power advertisement may include a flag indicating that the advertisement is for proximity pairing. The low-power advertisement may further include a complete device ID (e.g., serial number).

[0110] The low power advertisement may further include a fake BLE address. As explained above, the use of a fake BLE address in the general advertisement ensures that a display device that has previously paired and bonded with SS8 will not respond to advertisements with fake BLE addresses, but will only send connection requests in response to advertisements with true BLE addresses, thereby reducing congestion in SS8.

[0111] As explained above, the SS8 may continue to broadcast low power general advertisements for additional display devices to pair and bond with the SS8 until the whitelist threshold is met or for the life of the SS8. Thus, additional devices may request a connection upon detecting subsequent low power general advertisements to the first device, similar to those shown in Figure 5. In some embodiments, fake BLE addresses are used for all low power general advertisements.

[0112] However, in some other embodiments, the false BLE address is used only in the low-power general advertisement for the initial pairing with the first device, and the true BLE address is used in the subsequent low-power general advertisement. In such an embodiment, a display device that has previously paired and bonded with SS8 may send a connection request to SS8 during the general advertisement, since the subsequent low-power general advertisement includes the true BLE address. Thus, when the subsequent advertisement uses the true BLE address, SS8 may be configured to filter connection requests from whitelisted display devices that have previously paired and bonded with SS8. For example, when SS8 receives a connection request, it may filter such connection requests from whitelisted display devices after sending a low-power general advertisement with a flag indicating that the advertisement is for proximity pairing. In one example, the connection request (from a whitelisted display device) may include one or more flags to indicate the status (e.g., whitelist) of the display device. For reconnection, the SS8 may broadcast a low or full power whitelist advertisement with the true BLE address, and the SS8 may filter connection requests from devices that have not previously paired and bonded with the SS8 (e.g., display devices that have not been added to the whitelist). For example, the SS8 may filter connection requests from devices that have not previously paired and bonded with the SS8 based on advertisements that have a flag indicating that the advertisement is a whitelist advertisement. In some embodiments, a display device 150 that has not previously paired and bonded with the SS8 may filter advertisements based on advertisements that have a flag indicating that the advertisement is a whitelist advertisement. In one example, the advertisement may include a flag indicating whether the SS8 is discoverable or not.

[0113] FIG. 6 is a flow diagram illustrating example operations 600 for pairing a sensor system with one or more display devices, according to certain embodiments disclosed herein.

[0114] In operation 602, the sensor system (e.g., SS8) broadcasts a low-power general advertisement for initial connection that includes an indication that the low-power general advertisement is for proximity pairing. In some embodiments, the low-power general advertisement is broadcast at -40 dBm. Broadcasting a lower-power general advertisement for initial connection is shown and described in more detail with respect to step 204 of FIG. 2.

[0115] In operation 604, the sensor system receives a connection request message from a first display device (e.g., display device 150) in response to the low-power general advertisement. In some embodiments, the connection request message from the first display device is received in response to the first display device detecting a field indicating that the general advertisement is for proximity pairing. The monitoring and receiving of advertisements and sending of connection requests by the display device are shown and described in more detail with respect to steps 203, 204, 206, and 208 of FIG.

[0116] In operation 606, the sensor system performs an authentication procedure with the first display device. In some embodiments, performing the authentication procedure includes skipping performing a user-centric authentication protocol, such as Password Authenticated Key Agreement (PAKE), based on an indication in the low-power general advertisement indicating that the general advertisement is for proximity pairing. Determining the authentication procedure and performing the authentication procedure between the sensor system and the display device is shown and described in more detail with respect to steps 210-216 of FIG.

[0117] In operation 608, the sensor system pairs and bonds with the first display device based on successful authentication with the first display device. In some embodiments, after pairing with the first display device, the sensor system transmits analyte data indicative of the blood glucose level from the sensor system to the first display device. Pairing and bonding is shown and described in more detail with respect to steps 218-222 of FIG.

[0118] In operation 610, the sensor system adds the first display device to a whitelist. The whitelist identifies display devices that have previously bonded with the sensor system.

[0119] In operation 612, the sensor system broadcasts a second general advertisement for connecting with the second display device. In some embodiments, the second general advertisement is a higher power general advertisement that includes a field indicating that the higher power general advertisement is not for proximity pairing. In some embodiments, the higher power general advertisement is a broadcast at full power. Broadcasting a higher power general advertisement for connecting with the second display device is shown and described in more detail with respect to step 304 of FIG. 3. In some embodiments, the second general advertisement is a low power general advertisement that includes a field indicating that the low power general advertisement is for proximity pairing. Broadcasting a low power general advertisement for connecting with the second display device is shown and described in more detail with respect to FIG. 5.

[0120] In operation 614, the sensor system broadcasts a higher power whitelist advertisement to pair with the first display device for reconnection, the whitelist advertisement including a field indicating that the general advertisement is not for proximity. Broadcasting a higher power whitelist advertisement for reconnection is shown and described in more detail with respect to step 404 of FIG.

[0121] In some embodiments, the low-power general advertisement includes a fake address associated with the sensor system and the higher-power whitelist advertisement includes the actual address. The address associated with the sensor system may be a Bluetooth Low Energy (BLE) address and the fake address may be one or more bits inverted relative to the true BLE address. Broadcasting the general advertisement with the fake BLE address is shown and described in more detail with respect to step 504 of FIG. 5.

[0122] In operation 616, the sensor system accepts or rejects one or more connection requests from one or more display devices based on whether the one or more display devices are identified in the whitelist. Rejecting connection requests from non-whitelisted devices is shown and described in more detail with respect to step 406 of FIG.

[0123] Exemplary Aspects Example implementations are described in the following numbered clauses.

[0124] Clause 1: A method for pairing an analyte sensor system with one or more display devices, the method comprising: broadcasting a low-power general advertisement from the analyte sensor system for an initial connection, the low-power general advertisement including an indication that the low-power general advertisement is for proximity pairing; receiving a connection request message in response to the low-power general advertisement from a first display device of the one or more display devices; performing an authentication procedure with the first display device; and pairing and bonding with the first display device based on successful authentication with the first display device.

[0125] Clause 2: The method of clause 1, wherein the low power general advertisement is broadcast at a power level of -40 dBm or less.

[0126] Clause 3: A method according to any combination of clauses 1 to 2, wherein an indication indicating that the low-power general advertisement is for proximity pairing includes a flag in the low-power general advertisement.

[0127] Clause 4: A method according to any combination of clauses 1 to 3, further comprising broadcasting a higher power general advertisement from the analyte sensor system for connecting with a second display device, the higher power general advertisement being broadcast at a higher power than the low power general advertisement, and the higher power general advertisement including an instruction indicating that the higher power general advertisement is not for proximity pairing.

[0128] Clause 5: The method of clause 4, wherein the higher power general advertisement is a broadcast at a maximum power of a transmitter of the analyte sensor system.

[0129] Clause 6: The method of any combination of clauses 1 to 5, further comprising: adding the first display device to a whitelist, the whitelist identifying display devices that have previously bonded with the analyte sensor system; broadcasting a higher power whitelist advertisement from the analyte sensor system for reconnection with the first display device, the higher power whitelist advertisement being broadcast at a higher power than the lower power general advertisement and including a second instruction indicating that the higher power whitelist advertisement is not for proximity pairing; accepting a reconnection request from the first display device after broadcasting the higher power whitelist advertisement for reconnection and in response to determining, based on the whitelist, that the first display device is a whitelist device; and rejecting one or more connection requests from the one or more display devices in response to determining, based on the whitelist, that the one or more display devices are not whitelist devices.

[0130] Clause 7: The method of clause 6, wherein the low-power general advertisement includes a secondary identifier associated with the analyte sensor system.

[0131] Clause 8: The method of clause 7, wherein the secondary identifier associated with the analyte sensor system comprises a Bluetooth Low Energy (BLE) address with one or more bits inverted.

[0132] Clause 9: A method according to any combination of clauses 6 to 8, wherein the higher power whitelist advertisement includes a primary identifier associated with the analyte sensor system.

[0133] Clause 10: The method of clause 9, wherein the primary identifier comprises a manufacturer-assigned Bluetooth Low Energy (BLE) address.

[0134] Clause 11: A method according to any combination of clauses 1 to 10, further comprising broadcasting a second low-power general advertisement from the analyte sensor system for connecting with a second display device, the second low-power general advertisement including a second instruction indicating that the second low-power general advertisement is for proximity pairing.

[0135] Clause 12: The method of clause 11, wherein the second low-power general advertisement includes a secondary identifier associated with the analyte sensor system.

[0136] Clause 13: The method of clause 12, wherein the secondary identifier associated with the analyte sensor system comprises a Bluetooth Low Energy (BLE) address with one or more bits inverted.

[0137] Clause 14: A method according to any combination of clauses 11 to 13, further comprising: after broadcasting the second low-power general advertisement and in response to determining that the second display device is not a previously whitelisted device, accepting a connection request from the second display device; and in response to determining that the one or more display devices are previously whitelisted devices, rejecting one or more connection requests from the one or more display devices.

[0138] Clause 15: The method of clause 14, further comprising determining, based on a whitelist maintained in the analyte sensor system, that the second display device is not a previously whitelisted device and that the one or more display devices are previously whitelisted devices.

[0139] Clause 16: A method according to any combination of clauses 14 to 15, further comprising determining, based on the connection request and the whitelist instructions in the one or more connection requests, that the second display device is not a previously whitelisted device and that the one or more display devices are previously whitelisted devices.

[0140] Clause 17: A method according to any combination of clauses 1 to 16, wherein a connection request message is received from the first display device in response to the first display device determining that the analyte sensor system is within a threshold proximity range of the first display device.

[0141] Clause 18: A method according to any combination of clauses 1 to 17, wherein a connection request message is received from the first display device in response to the first display device detecting an indication that the low-power general advertisement is for proximity pairing.

[0142] Clause 19: A method according to any combination of clauses 1 to 18, wherein performing an authentication procedure with the first display device includes skipping performing a user-centric authentication protocol in response to an indication that the low-power general advertisement is for proximity pairing.

[0143] Clause 20: The method of clause 19, wherein the user-centric authentication protocol includes a Password Authenticated Key Agreement (PAKE) protocol.

[0144] Clause 21: The method of clause 20, wherein performing an authentication procedure with the first display device includes skipping a PAKE protocol and performing a Public Key Infrastructure (PKI) protocol.

[0145] Clause 22: A method according to any combination of clauses 1 to 21, wherein performing an authentication procedure with the first display device includes exchanging authentication messages with the first display device at low power during the authentication procedure.

[0146] Clause 23: A method according to any combination of clauses 1 to 22, further comprising, after pairing and bonding with the first display device, transmitting sample data indicating the blood glucose level from the sample sensor system to the first display device.

[0147] Clause 24: An apparatus comprising a memory containing executable instructions and a processor configured to execute the executable instructions to cause the apparatus to perform a method according to any combination of clauses 1 to 23.

[0148] Clause 25: Apparatus comprising means for carrying out the method according to any combination of clauses 1 to 23.

[0149] Clause 26: A non-transitory computer-readable medium comprising executable instructions that, when executed by a processor of a device, cause the device to perform a method according to any combination of clauses 1 to 23.

[0150] Clause 27: A computer program product embodied on a computer-readable storage medium comprising code for carrying out a method according to any combination of clauses 1 to 23.

[0151] Clause 28: An analyte sensor system configured to perform a method according to any combination of clauses 1 to 23.

[0152] Additional Considerations Each of these non-limiting examples can stand alone or can be combined in various permutations or combinations with one or more of the other examples. The above detailed description includes reference to the accompanying drawings, which form a part of the detailed description. The drawings show, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are also referred to herein as "examples." Such examples may include elements in addition to those shown or described. However, the inventors also contemplate examples in which only those elements shown or described are provided. Furthermore, the inventors also contemplate examples that use any combination or permutation of those elements (or one or more aspects thereof) shown or described with respect to a particular example (or one or more aspects thereof) or with respect to other examples (or one or more aspects thereof) shown or described herein.

[0153] In the event of a conflict of usage between this document and any document incorporated by reference, the usage in this document takes precedence.

[0154] In this document, the terms "a" or "an" are used to include one or more, as is common in patent documents, regardless of other instances or usages of "at least one" or "one or more." In this document, the term "or" is used to refer to a non-exclusive, such that "A or B" includes "A but not B," "B but not A," "A and B," unless otherwise indicated. In this document, the terms "including" and "in which" are used as the plain English equivalents of the respective terms "comprising" and "wherein." Also, in the following claims, the terms "including" and "comprising" are open-ended, i.e., a system, device, article, composition, formulation, or process that includes elements in addition to those recited after such terms in a claim will still be deemed to be within the scope of that claim. Moreover, in the following claims, the terms "first," "second," and "third," etc., are used merely as labels and are not intended to impose numerical requirements on their objects.

[0155] Geometric terms such as "parallel," "perpendicular," "circular," "square," and the like are not intended to require absolute mathematical precision unless the context indicates otherwise. Instead, such geometric terms allow for variations due to manufacturing or equivalent functions. For example, if an element is described as "circular" or "approximately circular," components that are not exactly round (e.g., those that are slightly elliptical or that are multi-sided polygons) are still encompassed by this description.

[0156] Examples of the methods described herein may be at least partially implemented in a machine or computer. Some examples may include a computer-readable medium or machine-readable medium encoded with instructions operable to configure an electronic device to perform the methods described in the above examples. Implementations of such methods may include code, such as microcode, assembly language code, high-level language code, etc. Such code may include computer-readable instructions for performing various methods. This code may form part of a computer program product. Further, in examples, the code may be tangibly stored on one or more volatile, non-transitory, or non-volatile tangible computer-readable media, such as during execution or at other times. Examples of these tangible computer-readable media may include, but are not limited to, hard disks, removable magnetic disks, removable optical disks (e.g., compact disks and digital video disks), magnetic cassettes, memory cards or sticks, random access memory (RAM), read only memory (ROM), etc.

[0157] The above description is intended to be illustrative, not restrictive. For example, the above examples (or one or more aspects thereof) may be used in combination with each other. Other embodiments may be used, such as those by one of ordinary skill in the art upon reviewing the above description. The Abstract is provided to comply with 37 CFR §1.72(b) to enable the reader to quickly grasp the nature of the technical disclosure. It is submitted with the understanding that it will not be used to interpret or limit the scope or spirit of the claims. Also, in the above Detailed Description, various features may be grouped together to streamline the disclosure. This should not be construed as intending that an unclaimed disclosed feature is essential to any claim. Rather, the subject matter of the invention may lie in less than all features of a particular disclosed embodiment. Thus, the following claims are incorporated into the Detailed Description as examples or embodiments, and each claim stands on its own as a separate embodiment, and it is contemplated that such embodiments can be combined with each other in various combinations or permutations. The scope of the invention should be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.

Claims

1. 1. A method for pairing an analyte sensor system with one or more display devices, the method comprising: broadcasting a low-power general advertisement from the analyte sensor system for an initial connection, the low-power general advertisement including an indication that the low-power general advertisement is for proximity pairing; receiving a connection request message from a first display device of the one or more display devices in response to the low-power general advertisement; performing an authentication procedure with the first display device; and based on successful authentication with the first display device, pairing and bonding with the first display device.

2. The method of claim 1 , wherein the low power general advertisement is broadcast at a power level of −40 dBm or less.

3. 2. The method of claim 1, wherein the indication that the low-power general advertisement is for proximity pairing comprises a flag in the low-power general advertisement.

4. 2. The method of claim 1, further comprising broadcasting a higher power general advertisement from the analyte sensor system for connecting with a second display device, the higher power general advertisement being broadcast at a higher power than the low power general advertisement, and the higher power general advertisement including an indication that the higher power general advertisement is not for proximity pairing.

5. 5. The method of claim 4, wherein the higher power general advertisement is a broadcast at a maximum power of a transmitter of the analyte sensor system.

6. adding the first display device to a whitelist, the whitelist identifying display devices that have previously been bonded with the analyte sensor system; broadcasting from the analyte sensor system a higher power whitelist advertisement for reconnection with the first display device, the higher power whitelist advertisement being broadcast at a higher power than the lower power general advertisement and the higher power whitelist advertisement including a second indication indicating that the higher power whitelist advertisement is not for proximity pairing; accepting a reconnection request from the first display device after broadcasting the higher power whitelist advertisement for the reconnection and in response to determining, based on the whitelist, that the first display device is a whitelist device; and 2. The method of claim 1, further comprising: in response to determining, based on the whitelist, that the one or more display devices are not whitelisted devices, rejecting one or more connection requests from the one or more display devices.

7. The method of claim 6 , wherein the low-power general advertisement includes a secondary identifier associated with the analyte sensor system.

8. 8. The method of claim 7, wherein the secondary identifier associated with the analyte sensor system comprises a Bluetooth Low Energy (BLE) address with one or more bits inverted.

9. The method of claim 6 , wherein the higher power whitelist advertisement includes a primary identifier associated with the analyte sensor system.

10. The method of claim 9 , wherein the primary identifier comprises a manufacturer-assigned Bluetooth Low Energy (BLE) address.

11. 10. The method of claim 1, further comprising broadcasting a second low-power general advertisement from the analyte sensor system for connecting with a second display device, the second low-power general advertisement including a second indication indicating that the second low-power general advertisement is for proximity pairing.

12. The method of claim 11 , wherein the second, low-power, general advertisement includes a secondary identifier associated with the analyte sensor system.

13. 13. The method of claim 12, wherein the secondary identifier associated with the analyte sensor system comprises a Bluetooth Low Energy (BLE) address with one or more bits inverted.

14. accepting a connection request from the second display device after broadcasting the second low-power general advertisement and in response to determining that the second display device is not a previously whitelisted device; 12. The method of claim 11, further comprising: in response to determining that the one or more display devices are previously whitelisted devices, rejecting one or more connection requests from the one or more display devices.

15. 15. The method of claim 14, further comprising determining, based on a whitelist maintained in the analyte sensor system, that the second display device is not a previously whitelisted device and that the one or more display devices are previously whitelisted devices.

16. 15. The method of claim 14, further comprising determining, based on the connection request and a whitelist indication in the one or more connection requests, that the second display device is not a previously whitelisted device and that the one or more display devices are previously whitelisted devices.

17. 2. The method of claim 1, wherein the connection request message from the first display device is received in response to the first display device determining that the analyte sensor system is within a threshold proximity range of the first display device.

18. 2. The method of claim 1, wherein the connection request message from the first display device is received in response to the first display device detecting the indication that the low-power general advertisement is for proximity pairing.

19. performing the authentication procedure with the first display device; 2. The method of claim 1, comprising in response to the indication that the low-power general advertisement is for proximity pairing, skipping performing a user-centric authentication protocol.

20. 20. The method of claim 19, wherein the user-centric authentication protocol comprises a Password Authenticated Key Agreement (PAKE) protocol.

21. performing the authentication procedure with the first display device; skipping the PAKE protocol; and and executing a Public Key Infrastructure (PKI) protocol.

22. performing the authentication procedure with the first display device; The method of claim 1 , further comprising exchanging authentication messages with the first display device at the low power during the authentication procedure.

23. 10. The method of claim 1, further comprising, after pairing and bonding with the first display device, transmitting analyte data indicative of a blood glucose level from the analyte sensor system to the first display device.

24. 1. An analyte sensor system and one or more display devices, the analyte sensor system comprising: A transceiver, the transceiver comprising: broadcasting a low-power general advertisement for an initial connection, the low-power general advertisement including an indication that the low-power general advertisement is for proximity pairing; a transceiver configured to receive, from a first display device of the one or more display devices, a connection request message in response to the low-power general advertisement; at least one memory containing executable instructions; at least one processor, the at least one processor being in data communication with the at least one memory; and performing an authentication procedure with the first display device; The analyte sensor system and one or more display devices configured to execute the instructions to pair and bond with the first display device based on successful authentication with the first display device.

25. 25. The analyte sensor system of claim 24, wherein the transceiver is configured to broadcast the low power general advertisement at a power level of -40 dBm or less.

26. 25. The analyte sensor system of claim 24, wherein the indication that the low-power general advertisement is for proximity pairing comprises a flag in the low-power general advertisement.

27. The transceiver, 25. The analyte sensor system of claim 24, configured to broadcast a higher power general advertisement for connecting with a second display device, the higher power general advertisement being broadcast at a higher power than the lower power general advertisement, and the higher power general advertisement including an indication that the higher power general advertisement is not for proximity pairing.

28. 30. The analyte sensor system of claim 27, wherein the transceiver is configured to broadcast the higher power general advertisement at a maximum transmit power of the analyte sensor system.

29. the at least one processor is configured to add the first display device to a whitelist, the whitelist identifying display devices that have previously been bonded with the analyte sensor system; the transceiver is configured to broadcast a higher power whitelist advertisement for reconnection with the first display device, the higher power whitelist advertisement being broadcast at a higher power than the lower power general advertisement and the higher power whitelist advertisement including a second indication indicating that the higher power whitelist advertisement is not for proximity pairing; The at least one processor: accepting a reconnection request from the first display device after broadcasting the higher power whitelist advertisement for the reconnection and in response to determining, based on the whitelist, that the first display device is a whitelist device; 25. The analyte sensor system of claim 24, configured to reject one or more connection requests from the one or more display devices in response to determining that the one or more display devices are not whitelisted devices based on the whitelist.

30. 30. The analyte sensor system of claim 29, wherein the low-power general advertisement includes a secondary identifier associated with the analyte sensor system.

31. 31. The analyte sensor system of claim 30, wherein the secondary identifier associated with the analyte sensor system comprises a Bluetooth Low Energy (BLE) address with one or more bits inverted.

32. 30. The analyte sensor system of claim 29, wherein the higher power whitelist advertisement includes a primary identifier associated with the analyte sensor system.

33. 33. The analyte sensor system of claim 32, wherein the primary identifier comprises a manufacturer-assigned Bluetooth Low Energy (BLE) address.

34. The transceiver, 25. The analyte sensor system of claim 24, configured to broadcast a second low-power general advertisement for connecting with a second display device, the second low-power general advertisement including a second indication indicating that the second low-power general advertisement is for proximity pairing.

35. 35. The analyte sensor system of claim 34, wherein the second low-power general advertisement includes a secondary identifier associated with the analyte sensor system.

36. 36. The analyte sensor system of claim 35, wherein the secondary identifier associated with the analyte sensor system comprises a Bluetooth Low Energy (BLE) address with one or more bits inverted.

37. The at least one processor: accepting a connection request from the second display device after broadcasting the second low-power general advertisement and in response to determining that the second display device is not a whitelisted device; 35. The analyte sensor system of claim 34, wherein the one or more display devices are configured to reject one or more connection requests from the one or more display devices in response to determining that the one or more display devices are whitelisted devices.

38. The at least one processor:

38. The analyte sensor system of claim 37, configured to determine that the second display device is not a previously whitelisted device and that the one or more display devices are previously whitelisted devices based on a whitelist maintained in the analyte sensor system.

39. The at least one processor:

38. The analyte sensor system of claim 37, configured to determine, based on the connection request and a whitelist indication in the one or more connection requests, that the second display device is not a previously whitelisted device and that the one or more display devices are previously whitelisted devices.

40. 25. The analyte sensor system of claim 24, wherein the connection request message from the first display device is received in response to the first display device determining that the analyte sensor system is within a threshold proximity range of the first display device.

41. 25. The analyte sensor system of claim 24, wherein the connection request message is received from the first display device in response to the first display device detecting the indication that the low power general advertisement is for proximity pairing.

42. the at least one processor configured to perform the authentication procedure with the first display device, 25. The analyte sensor system of claim 24, comprising the at least one processor configured to skip performing a user-centric authentication protocol in response to the indication that the low-power general advertisement is for proximity pairing.

43. 43. The analyte sensor system of claim 42, wherein the user-centric authentication protocol comprises a Password Authenticated Key Agreement (PAKE) protocol.

44. the at least one processor configured to perform the authentication procedure with the first display device, skipping the PAKE protocol; 44. The analyte sensor system of claim 43, comprising the at least one processor configured to execute a public key infrastructure (PKI) protocol.

45. the at least one processor configured to perform the authentication procedure with the first display device, 25. The analyte sensor system of claim 24, comprising the at least one processor configured to exchange lower power messages with the first display device during the authentication procedure.

46. The transceiver, 25. The analyte sensor system of claim 24, configured to transmit analyte data indicative of a blood glucose level from the analyte sensor system to the first display device after pairing and bonding with the first display device.

Images