Secure Medical Device Communication via Trusted Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of multiple dedicated medical devices for healthcare management is complex and costly, and personal devices like smartphones, which run multiple applications, are vulnerable to cybersecurity risks due to shared resources with medical applications.
Innovation Solution
A secure communication system that uses a personal device with a trusted environment and a secure element to generate key pairs, establish a secure communication channel with medical devices through digital certificates, and encrypt/decrypt data, minimizing resource usage and protecting against vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If personal devices run multiple applications to control medical devices, then device versatility and ease of operation improve, but cybersecurity vulnerability increases due to shared resources
Solution Approach 1:
The personal device is segmented into a trusted environment and an untrusted environment. The trusted environment is a isolated secure computing space that hosts medical applications and performs cryptographic operations, while the untrusted environment runs other applications. This segmentation prevents malware in the untrusted environment from compromising medical applications in the trusted environment.
Solution Approach 2:
A secure element acts as an intermediary between the trusted environment and external communication channels. It generates and stores cryptographic key pairs, signs authentication requests, and verifies digital certificates, providing a security buffer that protects the trusted environment from direct exposure to potential attacks.
2Reliability
If multiple dedicated devices are used for healthcare management, then cybersecurity reliability improves, but device complexity and management cost increase
Solution Approach 1:
Multiple dedicated medical devices are merged into a single personal device by creating a trusted environment that can host multiple medical applications. Each application controls a different medical device, consolidating what would require multiple separate dedicated devices into one unified platform while maintaining security through environmental isolation.
Solution Approach 2:
The personal device with trusted environment becomes a universal control platform capable of managing multiple types of medical devices through different applications. The trusted environment provides universal security services (key management, digital signing, certificate verification) that protect all medical applications regardless of their specific function.
3Reliability
If a trusted environment is created for medical applications, then cybersecurity protection improves, but device resource usage increases
Solution Approach 1:
Cryptographic operations that consume significant computational resources are extracted from the main application logic and performed by dedicated security mechanisms. The secure element handles key generation and digital signing, while the trusted environment handles certificate verification, distributing the computational burden and optimizing resource usage.
Data Source
AI summary
Methods, systems, and apparatus for providing secure communication. The device includes a secure element for generating application key pairs. The device includes a trusted environment that is physically or logically isolated from an untrusted environment. The trusted environment includes one or more processors configured to perform operations of an application. The operations include generating an application key pair. The application key pair includes a secure element private key and a secure element public key. The operations include sending an application authentication request including one or more device identifiers and the secure element public key to a server. The operations include obtaining a digital certificate that includes the secure element public key and the one or more device identifiers. The operations include providing the digital certificate to a second device and establishing a secure communication channel between the device and the second device using the digital certificate.