Patent Application
20090241184
The present application is a National Phase entry of PCT Application No. PCT/EP2007/006403, filed Jun. 19, 2007, which claims priority from German Application Number 102006034536.3, filed Jul. 26, 2006, the disclosures of which are hereby incorporated by reference herein in their entirety.
The invention relates to a method for generating access data for a medical device, which contains a secured memory for medical or patient data.
The access to patient data, which are recorded or stored in medical devices, is subject to strict legal requirements. The minimum requirement is always the identification and authorization of the device user, who is authorized to access said data. However, the loss of said access authorization is a practical relevant complication (e.g., forgotten password, previous user leaves clinic/office without correct information transfer).
In principle, the data which authorize access (usually user code/password) can be kept in a secure location (sealed envelope in a safe). Even though the regular changes of passwords are one of the basic safety measures, it is difficult to ensure, in practical terms, that the stored password is the most current one. This method also requires the cooperation of the (previous) user, which may not necessarily be a given.
A usual method involves hidden access without authorization (e.g., secret key combination, service user code with unchangeable password—“secret masterkey”), known only to a limited number of people (e.g., service personnel), which provides direct access to the data or allows for the reset of the lost access to a known or definable value. Said method cannot ensure an effective and traceable protection of patient data because it depends on the fact that only trustworthy persons are provided with the knowledge regarding the secret masterkey. In practical terms, this is not feasible and, particularly, the confidentiality involved is difficult to trace.
The use of a physically protected key (e.g., a dongle at the USB or parallel port) prevents the uncontrolled disclosure of access information (as with the secret masterkey) and facilitates the proof of manipulations carried out with the help of the physically protected key (reset of lost access). However, it requires the physical presence of an authorized person (e.g., authorized service employee), which requires time and money.
Furthermore, access protection is compromised for all devices, once a physically protected key has been misappropriated or duplicated.
The task, solved by the invention, consists of the controlled release of a lost access authorization without physical manipulation of the data-storing device.
In this context, controlled release means that the method cannot be misused in order to gain access to a device other than the one identified, and that said access method becomes ineffective immediately after its use, therefore not constituting a “masterkey” even for said identified device.
Said task is solved through a method for generating an access code for a medical device or system, said access code being valid only once, which includes the following steps:
a) Device-internal generating of a query key from at least one device-internal identification;
b) Transmission of the query key to an authorization entity;
c) Generation of a release key from the query key through the authorization entity;
d) Transmission of the release key to the device;
e) Release of access through the device; and
f) Device-internal random change of the at least one device-internal identification.
Thereby, it is advantageous if the random change of at least one device-internal identification is achieved by generating the identification by means of a random number generator.
Alternatively, the random change of at least one device-internal identification can be achieved with the random selection from a predefined list of identifications. Thereby, the transmission of the query key and/or the transmission of the release key can be achieved via data carrier or online data transfer.
In one embodiment, the authorization entity is a computer or other data processing unit, which is accessible to the device manufacturer or an entity authorized by said manufacturer, and which is capable of verifying in known fashion the authorization for the access code request, e.g, through verification of the proper purchase of the device and/or the existence of a service or maintenance agreement and/or if the person, who is authorized to access the data on said device, has requested the access code.
In the following, the invention is explained by means of a particular embodiment.
Referring to
The same encryption method and the same (secret) masterkey are implemented in the software of the data-storing device, therefore, the release key SF,i=D(SA, SM) can be calculated internally and not visible for the user. If the comparison of the release key, entered by the user and calculated by the authorization entity results in the parity SF,e=SF,I the access code of the device is reset and the internal identification Ki is selectively, but not predictably, changed. Resetting of the access code can be achieved through various methods, e.g., a previously agreed upon password can be determined, a new valid password is displayed to the user, or temporarily password-free access can be granted, which immediately enforces the definition of a new password.
The repetition of said process on the same/a different device would generate a different query key due to the changed or different internal identification. As a result, the previously used release key is useless, and can therefore not be misused.
The suggested method offers access to protected data independent from the preventive measures of the user, and, in addition, avoids the known disadvantages of a masterkey. Furthermore, the process of authorization (external calculation of the release key) is separated from the operation of the device software, therefore, the presence of a service employee at the device is not required and the number of authorized persons (i.e., the authorized persons for the operation of the external program for generating the release key on the part of the authorization entity) can be drastically reduced when compared to the number of persons, which would require access to a masterkey.
The suggested solution can be expanded in several directions, e.g., through electronic storage and/or transmission of the query key and the release key directly from the device software (e.g., as email or export/import to/from a file).
Furthermore, an automatic change of the internal identification, which is independent from the entry of a valid release key, can be available for certain greater intervals (e.g., once a month). This way, unused release keys would be automatically invalidated after the expired time period and, therefore, pose no risk for unauthorized use.
The method for determining the internal identification Ki can be varied greatly. Feasible examples include:
Furthermore, the method can be modified or extended for generation and/or comparisons of the release keys. A signature check instead of a parity test is feasible, e.g., through the use of an asymmetrical encryption method, such as RSA, whereby the transmitted query key is encoded in the release key together with the “public” key, and the release key is decoded in the data-storing device by means of the “private” key, and the decoding result is compared to the query key. The terms “public” and “private” keys herein refer to the terminology common in cryptography: In the above case, both keys were to be kept secret.
| Number | Date | Country | Kind |
|---|---|---|---|
| 102006034536.3 | Jul 2006 | DE | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/EP07/06403 | 7/19/2007 | WO | 00 | 1/23/2009 |
