White Paper: Trusted Origin – Medical device, Disposable/Single use Accessory Authentication – Counterfeit Protection through “Trusted Origin”

Background

    1.1Purpose

    Medical devices are often paired with specialized disposable/single-use accessories through which a function of the broader medical system is performed. Examples include vials/cartridges, cartridge holders, syringes, etc. These accessories are commonly classified as medical devices themselves; they are essential to the operation of the medical device, and they can often be tied to the commercial success of the overall system. Therefore, to ensure patient safety, efficacy of medical function, and protection of business interests, it is vital to prevent counterfeit and unauthorized accessories from entering the market. This goal can be achieved through the implementation of a “Trusted Origin” strategy. This document outlines the framework for authenticating disposable/single-use accessories and provides guidance on implementing a counterfeit protection strategy.

    1.2 Background

    To accomplish the goal of counterfeit protection, the “Trusted Origin” strategy is implemented. This strategy is based on the use of Public-key cryptography to authenticate the origin of the accessory. The accessory is tagged with a unique identifier signature that is generated at a trusted manufacturing facility.

Discussion

1. Asymmetric Encryption

Asymmetric encryption is a type of encryption that uses a public key and a private key. The public key can be used to encrypt a message and the private key can be used to decrypt. At the same time the private key can sign a message and the public key can be used to verify it. The main advantage of asymmetric encryption for this application is that even if the public key is compromised, the encryption/signature scheme is still considered safe as long as the private key is kept secret. In the “Trusted Origin” strategy, the private key is used to sign, in a safe environment, and the public key is used to verify in the context of the medical device.

2. Implementation

In the case of the “Trusted Origin” strategy, the private key is used to sign the data we want to mark as “authentic,” and the public key is used to verify the origin. The public key is saved in the medical device while the private key is kept in a remote server. Generally, the public key is “safe“to leak, as a signature can only be generated with the private key and in that case a third party would only be able to verify the authenticity of an original accessory and would not be able to generate a new one. The private key must be kept secret. To prevent exposure of the private key via cybersecurity attacks on individuals in the organization, it is kept in a remote server, specifically in a “key vault”. In simple terms, a “key vault“ is a piece of software that manages keys without allowing users to leak them. The server receives requests to sign and responds with the generated ciphertext. This way, the private key is never exposed.

    2.1 “Trusted Origin” ciphertext creation

    The inputs to the “Trusted Origin” ciphertext generation process are a unique identifier of the accessory and custom data that would be passed alongside the disposable, such as type, expiration date, lot number, etc, and optionally padding of random data. A HASH calculation is performed on the input verification block and the result is appended to the disposable data plaintext. The resulting data block is signed by the private key, which generates a ciphertext that is tied to the unique identifier of the accessory. 

It is important to note that the signature algorithm, such as ECDSA or RSA, will impact the size of the input data block that can be handled and the size of the output ciphertext, and the computation time required to verify a signature. Additional constraints arise from the choice of medium to store the ciphertext, such as an RFID tag or a ROM. These parameters are all taken into consideration so that the most suitable custom solution can be reached.

    2.2 “Trusted Origin” authentication

    For the medical device to verify the authenticity of the accessory, the ciphertext and UID of the accessory must be supplied. The medical device will verify the signature via the public key and will construct a verification block. The authentication of “Trusted Origin” is successful when:  the HASH calculation on the verification block matches the HASH value form the plaintext. The accessory is authenticated and can be used. Otherwise, the accessory is not authenticated and should be rejected by the medical device.

3. Solutions

    3.1 RFID tag

    An RFID tag can serve as the medium to store and transfer the ciphertext to the medical device, where the “Trusted Origin” verification is implemented. RFID tags are compact and can be attached to an accessory or the packaging of an accessory. RFID tags are also inexpensive, widely available, and feature rich often supporting password protected memory, read only memory, or tag kill features. Most importantly, they often come with a unique identification number scheme guaranteed by manufacturers, which is a critical aspect in the “verification block” creation in this application. Thus, by utilizing an established RFID standard, a “Trusted Origin” verification process can be established in a medical device system.

    3.2 Wired connection custom data storage PCB

    The “Trusted Origin” ciphertext can be embedded on a custom PCB that will be part of the disposable accessory assembly. The custom PCB can be designed to store the ciphertext in a memory IC accessible by the medical device over a wired interface. This approach allows for additional components to be designed into the subsystem, such as sensors, LEDs, or buttons that cover the needs of a novel solution.

Conclusion

1. Summary

In conclusion, the implementation of a “Trusted Origin” strategy for authenticating disposable/single-use accessories in medical devices is crucial for ensuring patient safety and maintaining the integrity of medical systems. By leveraging asymmetric encryption and a secure key management approach, this strategy effectively mitigates the risks associated with counterfeit and unauthorized accessories. The use of unique identifier signatures and robust verification processes not only enhances the reliability of medical devices but also protects business interests in a competitive market.

2. Conclusion

The proposed solutions, including RFID tags and custom PCB designs, offer practical means to integrate the “Trusted Origin” framework into existing medical device systems. As the healthcare landscape continues to evolve, adopting such innovative authentication methods will be essential in safeguarding patient health and fostering trust in medical technologies. Future research and development should focus on refining these strategies and exploring new technologies to further enhance the security and efficacy of medical device accessories.

Author Biography

This White Paper written by:

Varouzan Knouni

BE

Varouzan Knouni is an electrical engineering graduate of The Cooper Union, specializing in embedded software. At Vantage Medtech, he has been involved in design and development of advanced medical systems, with a focus on embedded and real-time operating systems. Varouzan has also implemented robust cybersecurity solutions tailored for medical technologies, ensuring compliance with industry standards and patient safety.

This White Paper reviewed and edited by:

Anthony Caivano

Cybersecurity Engineer III

Keith Handler

Director of Software and Cybersecurity Engineering

About Vantage MedTech

Vantage MedTech provides comprehensive design and manufacturing services, supporting the advancement of medical technologies from concept through to product realization.

Partnering with the world’s most innovative MedTech start-ups and largest medical device companies, we offer feasibility support, product development and prototyping, strategic planning for new product implementation, clinical and commercial manufacturing, and after-market services to support every phase of the product life cycle.

Our clients can leverage our proprietary Advantage Platforms®, accelerating product development timelines. Our manufacturing approach is structured to serve the changing needs of our clients, supporting small-quantity clinical or First-in-Human builds and can scale to accommodate full launch quantities.

Copyright

This White Paper contains a variety of copyright material. Some of this is the intellectual property of the author, some is owned by Vantage MedTech. Some material is owned by others which is shown through attribution and referencing. Some material is in the public domain. Except for material, which is unambiguously and unarguably in the public domain, only material owned by Vantage MedTech and Vantage MedTech, and so indicated, may be copied, provided that textual and graphical content are not altered and the source is acknowledged. Vantage MedTech reserves the right to revoke that permission at any time. Permission is not given for any commercial use or sale of the material.

Disclaimer

Whilst Vantage MedTech has attempted to ensure the information in this White Paper is as accurate as possible, the information is for personal and educational use only and is provided in good faith without any express or implied warranty. There is no guarantee given to the accuracy or currency of information contained in this White Paper. Vantage MedTech does not accept responsibility for any loss or damage occasioned by use of the information contained in this White Paper.