Sensor with digital signature of data relating to sensor

Sensor with digital signature of data related to sensor.

Background of the invention

The present invention relates to sensors that They have a memory. It will be described in particular with respect to sensors pulse oximeter, but can also be applied to other types of sensors.

Pulse oximetry

Pulse oximetry is typically used to measure various blood flow characteristics that include, but are not limited to, blood oxygen saturation of the hemoglobin in arterial blood, corresponding to the speed of the pulsations of blood at a patient's heart rate. The Measurement of these characteristics has been carried out using a non-invasive sensor that makes light pass through a part of the tissue of the patient where blood perfuses the tissue, and detects Photoelectrically the absorption of light in such tissue. A monitor, connected to the sensor, determines the amount of light absorbed and calculate the amount of blood constituent that is being measuring, for example, arterial oxygen saturation.

The light that passes through the tissue is selected to be of one or more wavelengths that are absorbed by the blood in a representative amount of the amount of blood constituent present in the blood. The amount of light transmitted or reflected passing through the tissue will vary from according to the changing amount of blood constituent in the tissue and related light absorption. To measure the level of blood oxygen, such sensors have been provided with sources of light and photodetectors that are adapted to work in two different wavelengths, according to known techniques to measure blood oxygen saturation.

Several have been proposed in the past procedures for encoding information in sensors, which include pulse oximeter sensors, to transport useful information to a monitor For example, a coding mechanism is shown in U.S. Patent Nellcor No. 4,700,708. East mechanism refers to an optical oximeter probe that uses a pair of light emitting diodes (LEDs) to direct the light through the predefined blood tissue, with a detector that detects the light that It has not been absorbed by the tissue. The accuracy of the calculation of the oxygen saturation depends on the knowledge of the lengths of LED wave. Since the wavelengths of the LEDs may vary, a coding resistor is placed in the probe with the resistance value that indicates to the monitor the oxygen saturation calculation coefficients of the oximeter appropriate for the current wavelengths of at least one of the LEDs or the combination of LED wavelengths for the sensor. When the oximeter instrument is turned on, apply in first a current to the coding resistance and measures the voltage to determine the resistance value and thus saturation calculation coefficients appropriate to use for the wavelengths of the LEDs on the probe.

Other mechanisms of codification in United States Patents No. 5,259,381; 4,942,877; 4,446,715; 3,790,910; 4,303,984; 4,621,643; 5,246,003; 3,720,177; 4,684. 245; 5,645,059; 5,058,588; 4,858,615; and 4,942,877. Patent 4,942,877 describes in particular the storage of a diversity of data in a sensor memory pulse oximetry, which includes coefficients for an equation of saturation for oximetry.

A problem with the coding techniques of prior art sensors is that the coding of Information can sometimes be inaccurate and / or not authentic. Is all As a result, the monitor may not be able to obtain adequate readings from a patient, or worse, make inaccurate calculations, such that in the extreme examples the inaccurate codes and resulting inappropriate readings could significantly impair patient safety and contribute to bad patient results. Inaccurate codes can be Give in a variety of circumstances. For example, errors are they can produce during a manufacturing process or during the sensor transport. More common, however, is that they are used somewhat expresses inaccurate codes by third-party manufacturers of low quality and cheaper sensors that are not licensed or authorized by the corresponding manufacturer of monitors to provide high quality compatible sensors. These third parties often invest minimum amounts in research and just don't understand what the codes are for since they don't understand how monitors use codes. Market Stall that are not licensed by the monitor manufacturer, this information cannot usually be obtained through the monitor manufacturer Too often, these third parties choose not invest time or money in learning by engineering techniques reverse or original science the way monitors work and the way codes are used to ensure security of the patient. Instead, there are several cases in which such third parties simply examine a range of code values used in the market for each coded data characteristics, and they take a medium code value for all their sensors to This mode will be "compatible" with a particular monitor. Though In many cases, the use of a medium code value will give simply as a result the readings that are outside of specification but not particularly dangerous, the value of medium code may be incorrect enough to enter significant errors in the calculation algorithms used by the monitor and to cause significant security problems for the patient. In addition, any inaccurate third party codes contribute to a poor patient outcome, the patient injured, or their heirs, may try to hold the Monitor manufacturer, along with caregivers. If the caregivers have not been left with the low-quality third-party sensor used, and have not made use of it, which happens, it would be difficult for him monitor manufacturer establish that the problem was caused by using the third-party low quality sensor with its by the Opposite high quality monitor.

Another reason for which there is a need for Authentication of digital data stored together with sensors doctors is the small but real possibility that the data remains invalidated between factory recording time and time reading by the instrument that is monitoring the condition of a patient. A frequently mentioned example of a mechanism that can cause such invalidation is the change of a value recorded in a digital memory due to the incidence of an energy cosmic network. A more common source of invalidation is to damage a cell of memory caused by electrostatic discharge.

Therefore, there is a need in the technique to find a way to communicate complex codes accurate and authentic from a sensor to a monitor to ensure precise calculations and accurate patient monitoring by part of the monitor.

Summary of the invention

Consequently, an object of the invention is provide a sensor that has useful codes for a monitor that It can be accurately authenticated. The invention is defined in the attached claims.

This and other objects are achieved through a sensor that produces a signal that corresponds to a characteristic physiological measure of a patient and that provides codes with the which can be guaranteed to be authentic and accurate when they are used by a monitor A memory associated with the sensor stores the codes and other data related to the sensor; containing memory also a digital signature. The digital signature authenticates the quality of codes and data guaranteeing that it was generated by a entity that has default quality controls and guarantees That the codes are accurate.

In one embodiment, the digital signature is produced during the sensor manufacturing process using a key private or a pair of private key and public key, being able to then verify the signature with the public key integrated in the processors in an external sensor reader (for example, the display). The signature can be separated from the data. Or instead of the signature attached to the data, the signature itself may contain all or at minus some of the data and thus provides a level of data masking

According to an embodiment of the invention, any one of the various procedures can be used known private / public key signature. These include Diffie-Hellman (and its variants, such as the Standard of Digital Signature of the National Institute of Standards and Techology, El Gamal and elliptic curve studies), RSA (developed at the Massachusetts Institute of Technology), and Rabin-Williams.

In another embodiment of the invention, it is included a summary of a part of the data to be signed in the signature for Verify that no errors have occurred in the data. Each piece of data is preferably organized to include an ID field, which indicates the type of data to follow, followed by a data length element, followed by the data piece. He also provides a mandatory bit that indicates whether knowledge of how to use the piece of data by the monitor is mandatory for the Sensor operation with the monitor. In this way, one more monitor old that does not recognize a noncritical piece of data can just do not take it into account, since presumably does not perform this advanced feature that corresponds to the piece of data. However, if the piece of data is necessary for an operation appropriate of a sensor, the mandatory bit will be set, and the sensor reader / monitor will indicate that you cannot use the sensor particular that has been connected.

In yet another embodiment, the signed data stored with the sensor would include at least a coefficient of sensor-dependent saturation calibration curve used to Calculate oxygen saturation by a monitor. In addition, the data may include sensor OFF thresholds and thermistor calibration coefficients appropriate for sensors that include a termisotr. Some of such data can be include within the signature, and this or other data could be included outside the firm Data outside the signature could be encrypted (or mask), if desired, with a cryptographic key algorithm symmetric, for example The Data Encryption Standard (DES) of NIST, and the symmetric key could be included in the signature. Alternatively, the symmetric key could be derived from the summary, which is contained in the signature.

For an additional understanding of nature and of the advantages of the invention, reference should be made to the following description taken together with the attached drawings.

Brief description of the drawings

Figure 1 is a block diagram of a sensor system and sensor reader that incorporates the invention.

Figure 2 is a block diagram of the contents of a sensor memory shown in figure 1.

Figure 3 is a block diagram illustrating a system to sign data during the manufacture of a sensor.

Figure 4 is a diagram illustrating the signing mechanism by the system of figure 3.

Figure 5 is a data flow diagram that illustrates the data generated in the procedure of figure 4.

Figure 6 is a diagram of an embodiment of a sensor or monitor reader, which illustrates different modules of software.

Figure 7 is a flow chart illustrating the reading of a sensor according to the invention.

Figure 8 is a diagram illustrating the flow of data read in the process of the invention.

Figure 9 is a diagram of different fields in the data.

Figure 10 is a block diagram of a sensor system that uses an adapter with a digital signature on the adapter.

Description of specific embodiments

Definitions

The Signed Data is the data that has been included in the calculation of a summary (using a check function random), this summary being, in turn, included in the calculation of a digital signature, so that any subsequent alteration of the data could be detected by a verification failure of the digital signature. The data that has been signed may eventually reside well inside or outside the digital signature. In the process known as "digital signature with message retrieval", the data resides entirely within the digital signature. Until I know verify the signature, the data is in encrypted form, so that a causal observer cannot understand them. The procedure mathematician who verifies the signature deciphers, or "recovers" the data. In the procedure known as "mathematical signature with partial recovery ", which is preferred for the described invention In the present specification, a part of the data signed within the signature, and additional data resides outside the firm The data part within the signature is darkened until the signature is verified, but the outside still easy to read, unless a procedure is used masking to darken them.

Masked Data, how the term is used in the present specification, they are data that have been encrypted to thus be retrieved with a password of unmasking that is included within the signature. During the signature verification, the key is retrieved from exposure. This unmasking key can be used then to decrypt the masked data. In a preferred embodiment, the masked data is encrypted with a symmetric key, which means that encryption keys and decryption (i.e. masking and unmasking) are identical. In a preferred embodiment, the message summary that is incorporated into the digital signature is used as a symmetric key to mask and unmask data outside of the firm.

Sensor Reader / Monitor

Figure 1 is a block diagram of a preferred embodiment of the invention. Figure 1 shows a pulse oximeter 17 (or sensor reader) that is connected to a non-invasive sensor 15 fixed to a tissue 18 of a patient. The light of the LEDs 14 of the sensors passes into the tissue 18 of the patient, and after being transmitted through or reflected from the fabric 19, the light is received by the photosensor 16. Can be used two or more LEDs depending on the realization of the present invention. The photosensor 16 converts the received energy into a electrical signal, which is then supplied to the amplifier 20 entry.

You can use light sources other than LEDs For example, lasers can be used, or a source can be used white light with appropriate wavelength filters, either in the transmission or reception ends.

The Time Processing Unit (TPU) 48 sends control signals to the LED unit 32, to activate the LEDs, typically alternately. Again, depending on the embodiment, the unit can control two or any number additional desired LEDs.

The signal received from the input amplifier 20 passes through three different channels as shown in the embodiment of figure 3 for three different wavelengths. Alternatively, two channels could be used for two lengths of wave, or N channels for N wavelengths. Each channel includes a analog switch 40, a low pass filter 42 and a converter analog to digital (A / D) 38. The TPU 48 control lines select the appropriate channel at the time the LED 14 corresponding is being activated in synchronization. A module serial queued (QSM) 48 receives the digital data from each of the channels through the data lines of the A / D converters. The CPU 50 transfers the data from the QSM 46 to the RAM 53 since the QSM 46 is filled periodically. In one embodiment, QSM 46, the TPU 48, and CPU 50 and RAM 52 are part of a circuit integrated, such as a microcontroller.

Sensor memory

The sensor 15, which includes the photosensor 16 and the LEDs 14, has a sensor memory 12 associated therewith. The memory 12 is connected to CPU 50 in the sensor reader or monitor 17. Memory 12 could be integrated into a body of the sensor 15 or in an electrical outlet connected to the sensor. Alternatively, memory 12 could be integrated in a housing that can be attached to an external surface of the monitor, or memory 12 could be located anywhere in a signal path between the sensor body and the monitor. Specifically, according to some preferred embodiments, a content of sensor memory 12 could be constant for all sensors associated with a particular sensor model. In this case, instead of putting an individual memory 12 on each sensor associated with this model, memory 12 could instead of be included in a reusable extension cable associated with sensor model. If the sensor model is a disposable sensor, in this case a single memory 12 could be incorporated into a reusable extension cable. The reusable cable could be then use with multiple disposable sensors.

Figure 2 is a diagram of the contents of memory 12 of Figure 1 according to a preferred embodiment. A Digital signature 60 occupies a first part of memory, including preferably signing data related to the sensor. A second Part 62 contains data that is signed and masked. A third part 64 includes data that are signed but remain empty (that is, they are not masked). Finally, reserve one part 66 to write in sensor memory using the reader sensor. Part 66 is not signed or masked. Although this preferred embodiment is shown illustratively, it you should understand that memory 12 can contain many blocks different data outside the digital signature, each of the which can be signed and / or masked according to the requirements of a particular realization These different blocks of data can be arranged in any desired order, for example, multiple signed and unsigned blocks may be interspersed, and multiple masked and unmasked blocks can be interspersed It should also be understood that the data written in memory 12 by the sensor reader is a feature optional, and that such data can be optionally masked.

Write the Signature in Factory

Figure 3 is a block diagram of a realization of a system used in a factory to write a signature in sensor memory 12. Figure 3 shows a personal computer 70 and an associated cryptographic coprocessor 72 that contains and uses a private key of a key pair private / public The private key is contained within a memory within coprocessor 72. This key preferably It cannot be read by anyone to preserve security. The key corresponding public can be known both by computer 70 personnel as per coprocessor 72, or it may be produced by the coprocessor 72.

The data that is signed by coprocessor 72 They can come from more than one source. A tester 76 is shown for test the sensor to determine the value of some components 78 of sensor, such as the wavelength of the LEDs, the thermistor resistance, etc. These data values ​​are provided below to the personal 70 computer throughout of line 80. Additional information 82 can be entered using a keyboard or from another database throughout lines 84, This data may include, for example, a number of series for the sensor, a date of manufacture, a batch number, a summary of the part of the data to be signed, or other information.

The data to be signed and other data that must be included in memory 12 pass from the personal computer to coprocessor 72 crypto. The coprocessor 72 performs a summary based on signed data and signs, with the private key summary and other data whose signature is desired. The signature and the data contained may include a symmetric key for other data that is masked, or information from which can derive a symmetric key. The coprocessor returns to transmit the signature to the personal computer 70. The computer 70 staff will preferably frame some of the data that is not included in the signature, and combines the masked data, the signature, and the empty data and transits all this to memory 12 on the lines 88.

Figure 4 is a diagram illustrating the operation of the system of figure 3. Figure 5 illustrates the data flow according to the procedure in figure 4.

First, the sensor is tested and measured the parameters 88 of the sensor, to thereby provide the wavelength of the LEDs. Then you enter any other data 89. The data below are classified (step 90). This classification results in first data 91 to be sign, second data 92 to be masked, and third data 93, which will be empty, that is, neither masked nor signed. For verify that no errors occur in any of the data 91, 92, 93 during manufacturing or during a subsequent stage of reading / decryption when using the sensor a summary is created 95 (step 94) from data 91, 92, 93 during the manufacturing and is included within the firm. The summary is produced as an output information of a check function randomized applied to data 91, 92, 93. the summary can be Compare with a complicated CRC. When the data and the summary is read later using a monitor after the description, if one or more error bits produced in any of the data 91, 92, 93, the monitor will create a second summary from the data read that do not correspond to the summary extracted from memory, thus indicating one or more errors that have occurred in any time in the writing verification procedures or firm. An example of an appropriate random check function is SHA-1, described in FIPS Federal Information Processing Standard, PUB 180-1, <i>Secure hash Standard,</i> National Institute of Standards &amp; Technology, 1995. Summary 95 and data 91 are signed together with the data from formatting 99 added in step 100 to produce a signature 101 in step 96. Formatting data is added in step 100, by example according to the International Standard ISO / IEC 9796-2, a standard for digital signatures. The data 92 are masked in step 103. This signature 101, the data masked 103 and empty data 93 are combined below by coprocessor 72 and personal computer 70 and it stored in sensor memory 12.

The private key is used to sign the data 91 it is preferably a digital signature algorithm Rabin-Williams, an example of which is described in ISO 9796-2.

In one embodiment, the original data block to be signed, block 91, is 73 bytes or less plus a 20 byte summary plus 3 bytes of 99 formatting data. This produces a signed 96-byte message They can also be used longer signatures, for example, signatures that have 128 bytes, 106 bytes can be received as useful data 91. The length of the signature depends on the degree of security desired and the amount of the decryption capability of the monitor.

Reading of the Signature by Reader / Monitor in the field

Figure 6 illustrates a part of a reader of sensor or monitor 17 to verify digital signature and retrieve data from a sensor when used on a patient. The data is first recovered from the sensor memory and it stored in a memory 110 by means of a CPU 50. The reader of sensor has a public key in a memory 12, which is loaded typically at the time of manufacturing the monitor or it provides as a monitor modernization. A program of signature verification and data recovery is stored in a part of memory 114.

Figure 7 illustrates the operation of the signature verification and data recovery program part of memory 114 of figure 6. Figure 8 is a diagram which illustrates the movement of the data according to the flow chart of Figure 7. First, the data is retrieved from the sensor memory in step 106. The recovered data 102 is show in figure 8 as consistent in signature 101, the data masked 107 and empty data 93. Public key 112 is then recover from the monitor memory (stage 108).

The signature and public key are provided then as inputs to a cryptographic transform to get signature data 91 and summary summary 95 (step 109).

The memory summary is used to determine the symmetric key of the masked data, and this key is used then to decrypt the masked data 107 to obtain the original 92 data that was masked (step 116).

In order to verify the accuracy of all data 91, 92, 93, a second summary is then created using the monitor from the signed 91 decrypted data, the data 92 unmasked, and empty data 93 using a function of random check 118 (step 120). This will create a new summary 122 that can then be compared to the original summary 95 (read from memory) in a step 124. If the summaries are the same, the signature is verified and the message (combined data 91, 92, 93) (step 126). The monitor uses Then the messages in its operation. If on the other hand, the summaries are not equal, it is determined that the message is invalid and the monitor will indicate a faulty sensor signal to the user of the monitor and will not use the message (128).

As can be seen, the invention applies only digital signatures to the sensors and in particular to pulse oximeter sensors. The only application to a sensor allows the sensor / monitor reader to verify the accuracy, authenticity of the messages (data) with regard to the source and sensor quality, and protects sensitive information of the sensor specification against easy discovery and a misuse of the part of the sensor manufacturers not Innovative

Signature Fields

Figure 9 illustrates in more detail a realization of signature data 91, summary 95, and data 99 Formatting In particular, signature data 91 is broken down in an arbitrary number of fields 132, followed by a CRC 134. Each field 132 includes a 1-byte field identifier 136, which Identify the type of data presented in this field. Single bit 138 indicates whether this field is mandatory or not. Then there are 7 bits in a block 140 that identify the length of the field. Finally, the field data is provided in a block 142 of bytes

In operation, if a monitor or reader of existing sensor cannot handle or does not recognize the identifier 136 of particular field, the length 140 of field and decipher how much data you have to skip to Get to the next field. However, first check the bit 138 mandatory to determine if this data is mandatory for sensor operation. If mandatory, the monitor or the sensor reader will produce an error message that indicates no You can read the fixed sensor correctly. If it is not mandatory, the monitor or sensor reader will simply ignore this field of data.

This field format thus provides flexibility in saving data within the signature data block, and also the ability to improve and accounting with readers of existing sensors and future generations of sensors and monitors

In one embodiment, a field identifier of a selected value is designated as a "character of escape ", which indicates that the next character is the identifier of an extended set. This allows the ability to add, delete, move, compress or stretch the fields that are included in a message without having to resort to fixed addresses.

Type of data

The following are examples of types of data that they could be included in memory 12 in one embodiment.

The current coefficients or data to be apply to the equations for the saturation calculation for a Pulse oximeter could be stored. These coefficients can be store instead of storing a value that corresponds to the Measured wavelength of LED. The result is flexibility much greater in sensor design, since the curves of calibration is not limited to a small set of curves that have been provided in the instruments.

Alternatively to the coefficients or in addition to the same, the wavelengths of the LEDs could simply be stored Likewise, features could be stored Secondary emission wavelength, and other parameters of LED:

Some sensors may have used thermistors to measure the local temperature for purposes such as compensation of calibration curves for sensor temperature or for prevent burns in patients. The coefficients of Thermistor calibration could be stored.

Other data that could be included in the memory 12 could include, for example, a batch code that will allow sensor traceability, an incorrect sensor flag, a manufacturing data, a manufacturing test information, the version of the signature software used for the signature, features LED front V / I, LED optical power characteristics; a characteristic of sensor efficiency, an LED power of maximum security, a review level of the data set of sensor (indicating the features included in the sensor), a sensor model identifier, a question flag adult / newborn (to activate an alarm limit interval desired depending on whether a newborn or an adult is monitored, with different levels of normal oxygen saturation for oximetry of pulse), a single write / or multiple write flag a Page dimension, a number of pages, and a maximum number of recycled events

Alternatively, any of the types of data mentioned above or described in the references mentioned from the prior art could be used and stored well in the masked data 92, in the signature data 91 or in the 93 empty data.

Figure 10 is a block diagram of a sensor system that incorporates an adapter that has a signature digital on the adapter. Figure 10 shows a sensor 202 connected to an adapter 204 which in turn is connected to a monitor 206. The adapter includes circuitry 208 a signal conditioning, a memory with a digital signature 210, and an internal monitor 212. A use of such an adapter would be for a class of sensors intended to connect to such adapter without a digital signature. The adapter itself could provide the digital signature to external monitor 206. Thus, for example, instead of each sensor being certified, you can use a different procedure to determine that the sensors are certified, with the adapter that provides the external monitor certification.

In the embodiment shown in Figure 10, the Adapter also includes an internal monitor 212. This monitor internal can be used to provide output display or other signals that are different from, or variations of, the outputs and visualizations provided by external monitors 206 in the countryside. To ensure that any output or display by the two monitors is consistent, block 208 of signal conditioning can modify the sensor signals of so that, in its modified form, the signal output on the line 214 to external monitor 206 will cause external monitor 206 to create a output signal corresponding to that produced by monitor 212 internal. For example, a patient signal can be obtained at from sensor 202 which corresponds to an oximetry value of pulse. An estimate of the heart rate and of saturation in internal monitor 212, with block 208 that generates a synthetic AC signal that sends to the external monitor 206. The construction of a synthetic signal would serve to ensure that the external monitor calculates a heart rate and similar saturation to internal monitor 212.

The digital signature can be a signature of any data that includes unfiltered patient data, patient data filtered, a patient's physiological synthetic signal or any other data

As will be understood by those skilled in the art, the present invention can be carried out in other specific ways without departing from the essential characteristics of the invention. By consequently, it is understood that the foregoing illustrates, but does not limit, the scope of the invention set forth in the following claims.