Keeping memory secure in medical applications

When an embedded application requires the use of a portable memory device, design engineers often look at consumer memory solutions like USB flash drives and SD (Secure Digital) memory cards first. This is hardly surprising, as these devices have become an integral part of daily life. However, before integrating a consumer memory device into an embedded system, engineers must be aware of their potential pitfalls and the benefits that specialist industrial memory offers.  Here, Victoria Barrett, PR and Marketing Director at Nexus GB explains what factors OEMs must consider when looking to keeping memory secure and safe in medical applications.

Integrating specialist industrial memory into embedded applications isn’t a subject covered on the syllabus of most electronic engineering degrees. As a result, many embedded designers who want to work with specialist memory begin the process by just asking, ‘where do I begin?’  The simple answer is to start with a PC based development tool kit, something that all good suppliers can provide, which allows the user to learn how to access and programme specialist memory keys or tokens.

Once you understand the design process, the next step is to choose a key or token. Specialist memory is available with a wide range of capacities, from 1Kbit to 1GByte of data with industry standard interface protocols including Microwire, I2C, SPI and USB. Good quality memory should also be available in versions that have been built to withstand water, mud, dust, shock and vibration – and is often used in medical environments where it is exposed to chemicals, electrostatic discharge, autoclave sterilisation and radiation.

The next thing to ensure when choosing industrial memory for an embedded application is that it is guaranteed to work in the OEM device. While consumer memory may fit physically, it may not work for any one of countless technical reasons. As a result, the design engineer using consumer memory should pre-qualify those products on the market that do work. This eliminates perhaps the most compelling reason to use consumer memory - widespread availability.  

USB and SD card manufacturers focus on consumer OEMs and industrial memory manufacturers on industrial work, so it’s vital that you match your own organisation to the manufacturer correctly.

Another important issue is the longevity of your product life cycle; consumer memory becomes obsolete when the manufacturer ceases production of that particular line. The right industrial memory product is guaranteed to offer substantially greater longevity, because industrial manufacturers understand that your product may need continual maintenance over a long period.

Let’s say you are working on an embedded application in a fluid removal instrument that is going to be available on the market in eighteen months time. You need to build in a memory device to ensure that the machine is used for a limited amount of time, to meet the compliance requirements. After this period, the device needs to be withdrawn from use and re-sterilised.

Sitting at your drawing board, metaphorically speaking, you design in a USB stick, produced by a commercial manufacturer. In eighteen months time, just as the machine is about to be mass produced your colleague in purchasing contacts the USB manufacturer to place an order. He or she receives the unwelcome news that they need to place a final order now, because the USB stick is end of line and they have already stopped making them.

This is a typical scenario. You see, according to Moore’s law, outlined by Intel founder Gordon Moore in 1965, computer chips double their output every eighteen months. This law can be applied, roughly, across most products in the IT world. As a result, in order to maintain their position in the consumer market, memory manufacturers need to increase the capacity of their devices massively on a regular basis.

So, that cheap and nifty 64MB memory-stick you sourced isn’t going to be available when you go to market. Instead, you will be offered the 6GB model, which will cost a small fortune but offer over ninety times the memory you need for your fluid removal machine (and even at 64MB you were over specifying to future proof the instrument).
 
Over specification raises another essential concern; opting for the right amount of memory. If your application only requires 4MB of memory, there is no need to buy a device that provides 32GB. As with all design engineering projects, over specification can be expensive. Especially when one bears in mind that many embedded applications require only a few KBs of memory.

Furthermore, it is important to mention that in medical applications, both the memory device and the mating receptacle may need to be immersion rated or produced for a specific temperature, shock rating or ESD (Electro Static Discharge) rating. Of course, this is dependent on the purpose of the end product.

Another physical factor to consider is that, by design, most industrial products don’t plug into standard PC ports, whilst USBs and memory cards are made for this purpose. It may well be beneficial to your security strategy if lost products can only be accessed with specialist equipment, which means industrial memory is a must. Even if the data on the device can’t be used for any other purpose, you should bear in mind that USB sticks themselves have a habit of making their way back to the home’s of the people who use them!

Another factor to watch out for is changing standards – because USB and SD ‘standards’ can and do change. Indeed, history shows that these standards are driven by the consumer market and modifications can adversely affect embedded designers who adopt the products. For instance SDHC cards use a different addressing method to SD cards, meaning embedded devices using SD can’t also use its successor, even though they fit in the receptacle.

Designers also have to think about the kind of memory needed to meet the objective. Serial EEPROM is ideally suited for low to medium data-logging, parameter/configuration upload and data storage as well as access control including CIK (Crypto Ignition Key) use. Serial Flash or SPI keys and tokens complement Microwire and SPI EEPROM devices. Such keys and tokens are page writable and are ideally suited for high volume data logging and firmware updates.

Finally, for the medical sector, it’s essential that portable memory can survive sterilization with no loss of data. The most common forms of sterilisation are wash down, autoclave and gamma sterilisation. When choosing memory on the basis that it can be sterilised along with the device, one should also check whether you can easily add anti-counterfeit and limit-use capabilities to disposable attachments that are sterilized in the same way.

Of course, all of these considerations are focussed on the memory itself, not its application. When an industrial memory manufacturer supplies a token it arrives as a blank piece of memory, limited only by the designer’s imagination. It is the embedded designer who makes the tokens work. In medical device design applications, the purpose of the product can range from limit use and calibration to data logging and user authentication.

Another sample application would be an encrypted product authentication code to protect against counterfeit disposables. The disposable's model number and associated parameters, along with calibration information, can be written to the device during production; then, in the field, this data can be automatically transferred to the base controller unit, eliminating the chance for human error from incorrect data entry.  

In such an application the industrial memory supplier provides the technical expertise and tools that allow a medical design engineer to incorporate a rugged and adaptable memory token into the plans.

So, in conclusion, while the process of choosing a key, token or plug and a receptacle is simple, it’s only the first step. The crux of the matter is dealing with security and longevity issues, as well as making sure that the device meets ruggedness standard required by the environment. So, my advice would be; conventional memory – forget it. If the device still needs to be on the market in twenty years time, or even five, you need to go down the specialised, rugged route.