Methods and systems for providing secure and auditable transfer of encrypted data between remote locations
Inventors
Rosenberg, Michael • BENITZ, MALCOLM • BALLARD, CHASE • SUTTLES, JASON • WOODLIEF, CHRIS
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-10257174-B2
Publication Date
2019-04-09
Expiration Date
Abstract
Methods and systems for directly and securely transferring encrypted medical data between two remote locations, such as an imaging site and a diagnostic site, without storing the medical data on an intermediary server, and only storing audit information on the intermediary server, thereby allowing a direct transfer of medical data between the two remote sites, and without relying on the intermediary server for storage of the medical data.
Core Innovation
The invention describes a secure and auditable direct transfer of encrypted medical data between a medical provider site and a diagnostic site without storing an encrypted data package on an intermediary server. A web socket server supplies remote device network addresses and performs discovery and directory functions while storing audit information in an audit information repository, and encryption key exchange occurs between endpoints so that encrypted payloads can be transferred while access to audit trail information is controlled such that neither the web socket server nor the endpoints can access audit data without an end-user encryption key.
The system establishes secure communication by selecting which endpoint to connect based on endpoint characteristics. A web socket server compares a first endpoint characteristic and a second endpoint characteristic, and initiates a communication channel to the endpoint that provides lower latency or higher throughput based on the comparison. The web socket server further manages channel continuity by periodically closing and subsequently opening the communication channel, where the communication channel does not need to be re-initiated after being closed.
In medical imaging implementations, mirrored PACS characteristics are used and a communication channel is initiated between a medical provider device and a selected PACS to transfer an encrypted data package. The first PACS and second PACS include mirrored data and are configured to encrypt the data package using encryption keys and to decrypt the encrypted data package using the encryption keys, while the web socket server stores first audit data related to a first endpoint and second audit data related to a second endpoint and requires a third encryption key for access to the stored audit data.
Claims Coverage
The identified independent claims are clm-00001, clm-00008, and clm-00014. Across these independent claims, the main inventive features include endpoint characteristic comparison and selective channel initiation, periodic close and reopen of a communication channel without re-initiation, endpoint encryption key exchange with endpoint-side encryption/decryption, and storing audit data in a way that prevents access without a third encryption key.
Endpoint characteristic comparison and selective channel initiation
A web socket server compares a first endpoint characteristic and a second endpoint characteristic, and based on the comparison initiates a communication channel between the computing device or medical provider device and the selected endpoint device or PACS device to transfer the data or encrypted data package.
Periodic close and reopen of a communication channel without re-initiation
The web socket server periodically closes and subsequently opens the communication channel, and the communication channel does not need to be re-initiated after being closed.
Endpoint encryption key exchange and endpoint-side encryption/decryption
The first endpoint device transmits a first encryption key to the second device, the second endpoint device transmits a second encryption key to the first device after receiving the first encryption key, and the first endpoint device encrypts the data after receiving the second encryption key; in the PACS-oriented claim, the first PACS generates and transmits encryption keys, and the second PACS decrypts the encrypted data package using the first encryption key and the second encryption key.
Audit data stored with third-encryption-key access control
The web socket server stores first audit data related to the first endpoint device or first PACS and second audit data related to the second endpoint device or second PACS, and neither the endpoints nor the web socket server can access the audit data without a third encryption key.
Secure direct transfer of medical data between remote PACS locations
A system securely transmits medical data directly between two remote locations, with a medical provider device requesting a data package, first and second PACS devices transmitting corresponding PACS characteristics to the web socket server, mirrored data in the first and second PACS, and initiation of a communication channel with the selected PACS to transfer the data package based on a comparison of PACS characteristics.
Payload constrained to encrypted medical data packages for PACS transfer
An encrypted data package is transferred, and the transfer is based on comparisons of latency and throughput characteristics.
Across clm-00001, clm-00008, and clm-00014, the claim coverage centers on a web socket server that compares endpoint characteristics to select an endpoint, maintains a communication channel by periodic close and reopen without re-initiation, uses encryption key exchange between endpoints so that encrypted payload transfer depends on endpoint-side encryption and decryption, and stores audit data with access restricted such that neither endpoints nor the web socket server can access the audit data without a third encryption key.
Stated Advantages
Not explicitly described in patent.
Documented Applications
Not explicitly described in patent.
Interested in licensing this patent?