GB2492056A

GB2492056A - A secure home telemetry system

Info

Publication number: GB2492056A
Application number: GB1109921.5A
Authority: GB
Inventors: Alistair Bruce Kelman
Original assignee: Individual
Current assignee: Individual
Priority date: 2011-06-14
Filing date: 2011-06-14
Publication date: 2012-12-26
Also published as: GB2491946A; GB2491946B; GB2491946A8; GB201109921D0; GB201210044D0

Abstract

A secure home telemetry apparatus comprises a measuring device arranged to send wireless telemetry monitor signals to a monitor device 50 which are encoded using Vernam cipher encryption. The monitor device may form part of a personal video recorder (PVR) 30 includes a backhaul communication channel for supplying the telemetry data to a central recording station. The measuring device 62 may be a pacemaker or heart monitor incorporating a flash drive 76. The heart monitor sends signals to the PVR which are encrypted using Vernam cipher encryption. Alternatively the measuring device may be a domestic electricity or gas meter. The meter may control the supply of power to a domestic appliance or the battery of a car depending on the time of day and hourly cost of the electricity.

Description

A secure home telemetry system

BACKGROUND OF THE INVENTION

1. Technical Field

This invention relates to home telemetry systems, that is, systems in which a remote source is monitored and data are automatically transmitted to a central position.

Description of the Related Art

It is known for human-implantable medical devices, such as heart pacemakers, to be overseen by home-installed monitors. The implanted device is in intermittent wireless communication with the home-installed monitor, which itself intermittently sends update reports to a central medical station. Issues relating to the privacy of such intermittent communications, even when encrypted, are outlined in "Privacy of Home Telemedicine: Encryption is Not Enough", by Salajegheh et al, Design of Medical Devices conference, Minneapolis, MN, USA, April 2009. While the communication from the home installed monitor to the central medical station can, if required, be encrypted even to military standards, the powerful semiconductor chips necessary to run such encoding generate heat and may burn out, and also use considerable energy. Such generation of heat is not acceptable within a human-implantable device, and replacement of batteries is a non-trivial medical operation which adds to the risk for the patient.

It is also known to monitor domestic energy consumption, for example by use of a so-called Smart gas meter or a Smart electricity meter. Such meters record, for example, consumption over the last day or hour or five minutes, and give a comparison with previous consumption rates to encourage home owners to switch off currently unused energy-consuming devices and thereby save money.

In a another field, many homes contain a Personal Video Recorder (PVR) which is purchased by a viewer to convert digital broadcast audio and television (TV) signals for supply to the viewer's television set or visual display unit.

As shown in Figure 1, a known PVR 10 contains a computer-type hard disc 12 and twin signal decoders/tuners 14. The PVR 10 is controlled by a remote control 16, such as an Infra Red control, and supplies signals to the viewer's viewing station such as a TV set or visual display unit 18. The PVR receives broadcast digital television and audio signals from an aerial 20 which may be a satellite dish. The remote control 16 allows the viewer to navigate through the received digital and audio broadcast.

The known PVR 10 also has a two-way backchannel connection BC, provided either by the Internet 24 or a modem 26, or by broadband service or by WiFi.

This permits the viewer to communicate with the broadcaster and others, for example to notify what programme is being or has been viewed, and which programmes are stored in the hard disc 12 for later viewing. Both the digital television signals and the backchannel carry very accurate time signals which can be used to synchronise the start or stop of the recording of programmes.

Summary ot the invention

A secure home telemetry apparatus as claimed in claim 1.

A Personal Video Recorder for use in a secure home telemetry apparatus as claimed in claim 12.

An implantable medical device as claimed in claim 14.

A method of secure home telemetry as claimed in claim 17.

The invention comprises use of the encryption technique known as a One-Time Pad in which a text is encrypted by a key known to both sender and receiver, the key being used only once. In a particular format invented by Gilbert Vernam and patented as US 1,310,719 dated 22 July 1921, where the text and the key each have the same number of characters, it was proved by Claude Shannon in 1949 that the resulting encrypted signal cannot be broken (see Shannon, Claude (1949). "Communication Theory of Secrecy Systems". Bell System Technical Journal 28 (4): 656-715). The Vernam technique also comprises an element in logic processing in silicon chips. It is referred to as XOR or exclusive disjunction, and means "one or the other but not both." Put differently, exclusive disjunction is a logical operation on two Iogica veiues, typically the values of two proposifions, that produces a value of true only in cases where the truth vaue of the operands differ. This logic can expressed in the form of a truth table.

XOR Truth Table

HlnputHH:H: Output

AB 00! 0

0 1 1 1 1 0 1 ::1 1 0 It is believed that the Vernam technique has not previously been applied either in the field of FVRs or in the field of home telemetry.

Brief Description of the drawings

The invention will be described by way of example with reference to the accompanying Figures in which:-Figure 2 illustrates a secure home medical telemetry apparatus incorporating a PVF{; and Figure 3 illustrates a secure home electricity telemetry apparatus..

Detailed description of the preferred embodiment

Figure 2 shows an enhanced PVR 30 containing a computer-style hard disc 32, and twin decoders 34. The PVF{ 30 supplies television and audio signals to a TV set 40 and is controlled by a remote control 42 such as an IR control. The PVR is connected to an aerial 46 and to the two-way communication back-channel BC which may be provided by the internet 44 or by a mobile telephone 47. The FVR includes a home-installed programmable medical monitor 50 and an encryption part 52 of the hard disc 32 is allocated to encryption processes.

The hard disc 32 also contains an XOR element 33.

The enhanced PVR 30 is connected to the backchannel BC, and as shown the backchannel BC is connected to a medical server 54 in the headquarters of a pacemaker monitoring service via the Internet option.

Figure 2 also shows a person 60 having an implanted pacemaker 62. The pacemaker 62, shown enlarged, has a pair of electrodes 64 positioned in the persons heart 66; the electrodes are connected by a wire 68 to a control circuit in the pacemaker 62, as is conventional. The control circuit senses the heart beat and, if a beat is not sensed within the expected time, the control circuit 70 supplies tiny electrical pulses to the pair of electrodes 64 so that the beating of the heart 66 is regulated. The wireless communication device 72 can receive messages from the programmable medical monitor 50 within the FVR 30, and the device 72 intermittently sends a signal to the medical monitor, as indicated by the broken line 73. The signal is sent either to indicate satisfactory operation or to indicate a potential problem. The monitor 50 sends such signals to the medical server 54 in the monitoring headquarters. This is conventional with pacemakers.

The pacemaker also contains a wireless communication device 72, a battery 74, an XOR chip 75, and an EEFROM (Electrically Erasable Programmable Read-Only Memory), commonly referred to as a "flash memory" 76. A flash memory uses very little power and is very fast in operation The flash memory 76 has stored within it 10,000 pseudo-random numbers at known addresses and the encryption part 52 of the hard disc also has stored within it the same pseudo-random numbers at the same addresses. The pseudo-random numbers are each 1024 bits in length.

When the device 72 sends a signal to the monitor 50 the signal is arranged to be 1024 bits in length and is encrypted by the device 72 as follows: Step 1: select from the flash drive 76 a first 1024-bit pseudo-random number and note the address (such as "page 22 line 16'); Step 2: add the first pseudo-random number to the 1024-bit signal to create a 1024-bit package;

S

Step 3: select from the flash drive a second 1024-bit pseudo-random number and note the address; Step 4: use the second pseudo-random number to encrypt the 1024-bit package by the known technique of the Vernam cipher; Step 5: transmit to the medical monitor 50 a message comprising the encrypted package and the addresses of the first and second pseudo-random numbers.

When the home installed medical monitor 50 receives a message from the device 72, it decodes the message as follows: Step 6: visit the address of the second pseudo-random number, and retrieve the 1024-bit number; Step 7: use the second pseudo-random number to decrypt the 1024-bit package by the Vernam cipher technique; Step 8: visit the address of the first pseudo-random number and subtract the 1024-bit first number from the 1024-bit package, which results in the 1024-bit signal in clear text.

In steps 1 and 3, the pseudo-random numbers are be selected in the order in which they are stored. The device 72 is arranged so that each selected pseudo-random number is used only once, ie the encryption uses the well-known One Time Fad arrangement.

Since this use of a Vernam cipher encryption results in an unbreakable coded transmission, it is not possible to hack into the signal as it passes from the pacemaker 62 to the monitor 50. Since there is no limitation on power consumption or heat generation in the monitor 50, the signal can be encrypted by any technique, even the application of military encryption grades, for onward transmission to the medical server 54 through the back channel BC.

The application of the Vernam cipher encryption in the wireless communication device 72 in the pacemaker 62 in Step 4, and the decryption in the home installed medical monitor 50 in the FVR 30 in Step 7 is in each case implemented by the XOR elements 33 and 75, located in the respective devices.

The process for generating the pseudo-random numbers and storing them may take place before or during initial setting up of the programmable medical monitor. In one version the patient with the pacemaker 62 sits near to the PVR and a cable (not shown) is temporarily connected between a battery powered repeater (not shown) placed on the chest of the patient. The repeater communicates with the pacemaker 62 using a short range wireless communications system (such as Bluetooth®). The repeater thereby enables the pacemaker 62 to communicate with the FVR 30. In another version the pacemaker 62 and the FVR 30 communicate by WiFi. Using the remote control 42 of the PVR 30 a special set-up menu is selected which is displayed on the television 40; the communication channel is indicated by the broken line 43. The encryption part 52 of the hard disc 50 in the FVR 30 is instructed by the pressing of keys on the remote control 42 and the following of instructions displayed on the television 40 to generate 10,000 pseudo-random numbers all 1024 bits in length by any known technique and to store them at known addresses. The PVR 30 transmits the numbers and the addresses to the pacemaker 62 which stores them in the flash drive 76; even when using WiFi this transmission need not be encrypted because the risk of hacking occurring at exactly the time that the flash drive 76 is being loaded is extremely small.

The invention has been described with reference to a heart pace maker, but it is applicable to any medical home telemetry system in which a physiological value of a human being is monitored. For example an external heart monitor or a device to measure blood pressure could be sensed, and the information supplied to a central monitor station.

The invention has been described with reference to storage of 10,000 pseudo-random numbers, but more or fewer numbers may be stored, so long as the implanted device 62 has sufficient stored numbers to last during its predicted life for a predicted number of signals to be sent to the monitor 50. The stored numbers and the signals may be a length different from 1024 bits, provided both the signal and the stored numbers are the same length.

The pseudo-random numbers may be generated by any know technique, for example by the use of a Linear Congruential Generator (LCG) or by the use of a linear feedback shift register (LFSR) Alternatively, the pseudo-random numbers may be generated by the known phenomenon of Clock Drift to generate a pseudo random number: the timer tick of the operating system of the PVR is compared with that of the microprocessor conventionally present in the FVR; since the clock speeds are conventionally different by a factor of 10,000, and since the microprocessor is affected by interrupts and the like, one tick of the operating system could equal eg 9,995 or 9,998 ticks of the microprocessor, and a random number can be generated from a sequence of such slight differences from 10,000. The PVR 30 can be arranged to create a pseudo-random number file by using Clock Drift to generate the series of 1 0,000 1024 bit pseudo-random numbers. Although this process would take some time, it can be arranged to run as a background process whilst other parts of the system are being set up.

The FVR 10 can, if required, be set up to communicate via the backchannel connection BC using sophisticated encryption systems such as AES-128 (i.e. the 128 bit Advance Encryption Standard). The use of such encryption systems can adequately protect the confidentiality and security of data passing between the FVR 10 and the medical server 54 over the backchannel connection BC.

Figure 3 illustrates a home telemetry monitor for a domestic electricity supply.

The FVR 30 includes the hard disc 32 with an encryption portion 52 and the XOF{ element 33 as in the previous embodiment, but now includes an electricity usage monitor 80. The usage monitor 80 communicates with a "smart" electricity meter 90 which is supplied by a power cable 92. The smart meter contains a wireless communication device 94, and data processing means 96 incorporating an XOR chip 98.

The smart meter 90 controls the electricity supply via a cable 100 to a socket 102 into which the battery 104 of an electric car 106 is plugged. Associated with the supply cable 100 is a communication cable 108. Information about the storage level of the battery 104 is supplied over the communication cable 108 to the smart meter 90.

In operation, communications between the usage monitor 80 and the smart meter 90, indicated at 82, utilise Vernam cipher encryption, applied by the XOR elements 33 and 98 respectively. The hourly charge for electricity conventionally varies throughout the day, being lower at night, and these charges are published at a web address by the electricity supplier as a look-up table. This table is stored in either the smart meter or the monitor 80. The usage monitor 80 signals to the smart meter 90 and instructs when electricity should be supplied to the socket 102 so that the battery 104 is fully charged by the next time the car 106 is needed, and the cost of the electricity is minimised by selection of charging hours.

Figure 3 also shows a freezer 120 connected to a power socket 122 controlled by the smart meter 90. The freezer comprises a wireless communication device 124, and data processing means 126 incorporating an XOR chip 128. The freezer also includes a door open sensor 130.

In operation, the freezer communicates with the usage monitor 80, as indicated by the dotted line 132, to indicate when the freezer door is opened. The usage monitor 80 retains a record of the times of day at which the freezer is opened.

If, for example, the freezer is usually opened during the afternoon, the usage monitor 80 signals to the smart meter 90 to supply power to the socket 122 early in the morning, so that the freezer draws power to reach its lowest required temperature during hours when power is cheap, so that running cost is minimised.

In the examples given, the programmable telemetry system is under the control of the householder who can control what personal or domestic information is sensed and recorded by the telemetry system. Any communication of information outside the home can be encrypted to a predetermined level.

Claims

Claims 1. A secure home telemetry apparatus comprising a telemetry monitor and at least one measuring device, in which each measuring device is arranged to send to the telemetry monitor signals which are encoded by use of Vernam cipher encryption.
2. A secure home telemetry apparatus according to claim 1 in which the telemetry monitor and each measuring device comprise processing means which includes an exclusive disjunction element.
3. A secure home telemetry apparatus according to claim 2 in which each exclusive disjunction element is an XOR semiconductor chip.
4. A secure home telemetry apparatus according to any preceding claim in which the telemetry monitor forms part of a Personal Video Recorder (PVR).
5. A secure telemetry apparatus according to claim 4 in which the PVR comprises back-channel connection means for supply of telemetry data to a central recording station.
6. A secure telemetry apparatus according to any preceding claim in which the measuring device is a medical device.
7. A secure telemetry apparatus according to claim 6 in which the medical device is a heart pacemaker.
8. A secure telemetry apparatus according to claim 7 in which the heart pacemaker includes a flash drive.
9. A secure telemetry apparatus according to any one of claims 1 to 4 in which the measuring device is a smart domestic gas or electricity meter.
10. A secure electricity telemetry apparatus according to claim 9 comprising a smart domestic electricity meter which controls the supply of power to the battery of an electric car.
11. A secure electricity telemetry apparatus according to claim 9 comprising a smart domestic electricity meter which controls the supply of power to a domestic device.
12. A Personal Video Recorder (PVR) for use in a secure home telemetry apparatus according to any preceding claim comprising:-input connection means for connection to a source of broadcast television signals; output means for connection of television signals to a television set; back-channel connection means for supply of data to a central store; data processing means; and telemetry means for wireless communication with a measuring device.
13. A PVR according to claim 12 in which the data processing means includes an exclusive disjunction element.
14. An implantable medical device comprising: a power source; a control circuit; wireless communication means to communicate with a programmable medical telemetry means; and a flash memory.
15. An implantable medical device according to claim 14 in which the flash memory is arranged to store a large number of pseudo-random numbers of known length, and the control circuit is arranged to generate signals for communication to the programmable medical telemetry means of said known length.
16. An implantable medical device according to claim 14 or claim 15 arranged to encrypt said signals for communication to the programmable medical telemetry means by use of Vernam cipher encryption.
17. A method of secure home telemetry comprising the steps of:-making a measurement on a measurement device; encoding the measurement by use of the Vernam cipher; sending the encoded message by wireless transmission to a home-located telemetry apparatus; and decoding the encoded message by use of the Vernam cipher to retrieve the measurement.