Invacare LiNX REM400, Руководство пользователя, Страница: 96 / 101

60126081-C 95
Loss of configuration data transmitted in programming and diagnostic mode would result in no effect. The existing wheelchair
configuration would be maintained. Errors in the configuration data transmitted would be rejected by built-in safety mechanisms
and/or detected during the subsequent evaluation of the configuration updates through the prescribed user testing.
The programming and diagnostic tools serve no specific medical purpose and do not control the wheelchair's operation.
Complete control of the wheelchair's actions remain with the user at all times.
10.4.2 Safeguards and Redundancy
Safeguards will include warnings in the user manuals around minimum separation distances, the ability to turn off the Bluetooth
connections, inherent encryption of the Bluetooth protocols, and direct indication to a user when a connection is made.
Due to the nature of the functions using the wireless technology, there is no requirement for redundancy.
Security risks are addressed by compliance to recognized standard AAMI-TIR57:2016 - Principles for medical device security - Risk
management (FDA recognition No: 13-83) and the NIST Framework, as appropriate.
The built-in safety features, such as and without limitation, necessity for the LiNX Access Key to be physically present when
configuring the device, the use of standard Bluetooth security protocols, single connection at any point in time, limited range,
limited exposure time and the visual indication of an established connection, minimize the threats and vulnerabilities from malicious
attack.
10.5 Wireless Coexistence
Wireless coexistence testing has been conducted in line with ANSI C63.27 using the radiated anechoic chamber (RAC) test method.
The LiNX Access Key has been tested per ISO 7176-21:2009 Clause 5.2.3 at 20 v/m field strength. During testing the LiNX Access Key
disconnected from its paired device when subjected to a frequency of 2.44 GHz. The function of the wheelchair was not impacted
by the disruption of the LiNX Access Key wireless communication. If the LiNX Access Key becomes disconnected from its paired
device during use, remove the wheelchair from the RF field and wirelessly reconnect the device.
10.6 Cybersecurity
The LiNX product range has been designed with cybersecurity in mind to assure device functionality and safety. The cybersecurity
measures taken address:
l
The embedded software
l
The programming and diagnostic tools' software
l
Bluetooth wireless technology
10.6.1 Cybersecurity Controls
A number of controls are in place to assure the LiNX system software maintains its integrity from the point of origin, to the point at
which a system leaves the control of the manufacturer and during product use.
These are summarized below:
l
Devices leaving the point of origin are equipped with a tamper-evident seal, which allows for the detection that a product's
case has been opened and thus potentially compromised. The Factory Test Interface is not accessible without opening the case
of any given module.
l
Once the system leaves the point of origin, it can only have its software upgraded using the Programming and Diagnostic tools
by a healthcare professional or a service technician with a LiNX Access Key (LAK) connected to the charging port. Access
controls and licensing are provided through the physical LAK.
l
Programming can occur only using either the P&D tools or via the Single Wire Communication interface, both through the
charging port. The embedded system ensures safe envelopes for programmed parameters.
l
The system will run only valid software. Cyclic Redundancy Checks (CRC) are conducted on the software before it is executed.
l
LiNX products use Class 2 Bluetooth wireless technology. This technology has built-in safety features that can maximize the
product's integrity. These features include:
◦
Operating range to 10 m (33 ft)
◦
Use of standard Bluetooth security protocols
◦
Single connection at any point in time
10 Wireless Technology