METHOD AND APPARATUS FOR SECURE PASSIVE WIRELESS COMMUNICATION WITH BLUETOOTH VITALS DEVICES

Abstract

A system for transmitting and receiving medical vital signs from a “smart” vital sign apparatus over multi-protocol communication channels to and from a remote electronic health record database that may include a plurality of vital sign sources that communicate over a plurality of standard communication channels including: Bluetooth, LoRa, WiFi, cellular, Ethernet or other direct IP paths. The system reduces the volume of data transferred and extends BLE security.

Claims

1. A gateway comprising: (a) a Bluetooth Low Energy (BLE) controller adapted to communicate with a plurality of BLE vital sign measuring devices (BVSMDs), the BLE controller adapted to receive, via a Bluetooth Low Energy connection, vital sign data (VSD) from a BVSMD that has been formerly provisioned, defining a known BVSMD, with the gateway, the gateway defining a first gateway, each BVSMD being capable of advertising its presence; (b) a transceiver adapted to: (i) transmit VSD received by the BLE controller to a remote VSD data store; (ii) transmit, for receipt by a second gateway, provisioning data for the known BVSMDs; (iii) receive provisioning data from the second gateway for BVSMDs known by the second gateway; (iv) with respect to a BVSMD that has not been formerly provisioned by either the first or second gateway (unknown BVSMD), obtain BVSMD provisioning data from a remote cloud service; (c) processing circuitry and memory having program code for: (i) provisioning the BVSMDs by: a. detecting each BVSMD advertising its presence; b. for unknown BVSMDs, obtaining BVSMD provisioning data from the second gateway, if available, and from the remote cloud service if not available from the second gateway; c. mapping a MAC address of each detected BVSMD to a randomly generated access address (RGAA); d. pairing each detected BVSMD to the BLE controller; e. employing the RGAA for communications between each detected BVSMD and the BLE controller; f. generating a bonding key for each detected BVSMD; and g. bonding the detected BVSMD to the BLE controller with the bonding key via the RGAA; (ii) causing the transceiver to transmit the VSD to the remote VSD server; and, (iii) periodically changing the RGAA.

2. The gateway according to claim 1 wherein the program code further comprises code for securely storing in the memory the bonding key generated for each detected BVSMD and securely sharing the bonding key stored in the first gateway with other gateways, including the second gateway.

3. The gateway according to claim 1 wherein the first gateway is a trusted gateway and the program code further comprises code for configuring the first gateway as a node in a mesh network of a plurality of trusted gateways such that the first gateway and at least one of the other trusted gateways may form a BLE mesh network, wherein the first gateway and at least one of the other trusted gateways are capable of communicating data with each other via BLE communications including bonding keys.

4. The gateway according to claim 3 further comprising program code for configuring the first gateway to have a same identity as the other trusted gateways from the perspective of each detected BVSMD.

5. The gateway according to claim 1 wherein the BVSMDs are non-audio devices that do not stream audio.

6. The gateway according to claim 1 wherein the BVSMDs do not store provisioning data or bonding keys.

7. The gateway according to claim 1 wherein the memory has stored therein a library containing provisioning information for BVSMDs.

8. The gateway according to claim 1 wherein the transceiver is configured to transmit and receive data over a wide area network (WAN) via one or more of multiple communication protocols, including one or more of LoRa, WiFi, cellular, ethernet, or direct IP protocol.

9. The gateway according to claim 1 wherein the transceiver is configured to transmit and receive data over a wide area network (WAN) via one or more publicly offered communication channels.

10. The gateway according to claim 1 wherein the first gateway is a trusted gateway adapted to communicate with other trusted gateways, including the second gateway, further comprising program code for configuring the first gateway so as to maintain a consistent over the air profile with respect to the other trusted gateways from the perspective of each detected BVSMD.

11. The gateway according to claim 10 further comprising program code for configuring the first gateway to have a same identity as the other trusted gateways from the perspective of each detected BVSMD.

12. The gateway according to claim 1 wherein the gateway lacks a hardware user input on the gateway for pairing BVSMDs.

13. The gateway according to claim 1 further comprising program code for determining a relative location of each detected BVSMD.

14. The gateway according to claim 1 wherein the BLE controller is configured to enable automatic and simultaneous connections with the plurality of BVSMDs.

15. The gateway of claim 1 wherein the first gateway is a trusted gateway adapted to communicate with other trusted gateways, including the second gateway, and the BVSMD provisioning data comprises pairing and bonding data for use by the other trusted gateways in provisioning BVSMDs.

16. The gateway according to claim 1 wherein the VSD is transmitted to the remote VSD server via a wide area network (WAN), further comprising program code for removing non-essential data contained in the VSD transmitted from each detected BVSMD to the gateway, including at least layered packet transport protocol overhead data, before transmitting the VSD via the WAN.

17. A method of communicating vital sign data (VSD) from a plurality of non-audio streaming Bluetooth Low Energy vital sign measuring devices (BVSMDs) located within a facility to a health data store that is remote from the facility via at least one of a plurality of gateways located within the environment, wherein each gateway in the plurality of gateways comprises a transceiver, the method comprising, at the gateway: i) detecting BVSMDs advertising their presence; ii) correlating identification information sent by each detected BVSMD with BVSMDs known to the gateway; iii) mapping a MAC address of each detected BVSMD to a randomly generated access address (RGAA), unless previously mapped thereto; iv) automatically pairing each detected BVSMD to the gateway; v) employing the RGAA for communications between each detected BVSMD and the gateway; vi) generating a bonding key for each detected BVSMD; vii) bonding the detected BVSMD to the controller via the RGAA; viii) forming simultaneous connections between a plurality of detected BVSMDs and the gateway; ix) securely sharing the bonding key among the plurality of gateways such that a BVSMD bonded to the gateway is also bonded with all gateways among the plurality of gateways in the environment; x) for BVSMDs unknown to any gateway among the plurality of gateways, obtaining BVSMD provisioning information from a remote cloud service via one or more communication protocols; xi) periodically changing the RGAA; and, xii) sharing the changed RGAA with all gateways among the plurality of gateways in the environment via one or more of the communication protocols.

18. The method according to claim 17 wherein the VSD is transmitted to the remote VSD server via a wide area network (WAN) further comprising receiving VSD from the detected BVSMD, and removing non-essential data contained in VSD transmitted from the detected BVSMD to the gateway, including at least layered packet transport protocol overhead data, before transmitting VSD over the WAN.

19. The method according to claim 17 further comprising configuring the first gateway as a node in a mesh network of the plurality of gateways such that the first gateway and at least one of the other gateways may form a BLE mesh network, wherein the first gateway and at least one of the other gateways communicate data with each other via BLE communications including bonding keys.

20. The method according to claim 17 wherein BVSMDs are paired without using a hardware user input on the gateway.

21. The method according to claim 17 further comprising determining a relative location of each detected BVSMD.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings, illustrate exemplary embodiments of the invention, and together with all of the parts of this application, serve to explain the features of the invention.

[0024] FIG. 1 illustrates the functional components of an embodiment of a wireless communication system.

[0025] FIG. 2 illustrates the internal components of a device gateway according to a preferred embodiment of the present invention.

[0026] FIG. 3 illustrates a perspective view of a wireless gateway device according to an embodiment of the present invention.

[0027] FIG. 4 is a block diagram illustrating the flows of data during management operations according to an embodiment of the present invention.

[0028] FIG. 5 is a block diagram illustrating the event listening state machine according to an embodiment of the present invention.

[0029] FIG. 6 is a block diagram illustrating the process of converting commonly well-understood human readable code to a machine executable code in accordance with a proscribed embodiment of the present invention.

[0030] FIG. 7 illustrates a possible human interface enabled by an embodiment of the present invention.

[0031] FIG. 8 illustrates the initialization process flow at start-up.

[0032] FIG. 9 illustrates the salient highlights of the protocol exchange that takes place in establishing a connection with a newly discovered BLE device being introduced and incorporated into a secure connection BLE environment.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

[0033] Many smart devices are now readily available in consumer markets. For example: body weight scales, blood-pressure monitors, glucometers, thermometers, pulse oximeters and fitness trackers are a subset of the myriad of medical monitoring devices available to consumers and healthcare professionals. Manufacturers consistently focus on providing a more ideal user experience involving the user's phone and either a single medical smart vitals device or a number of medical smart vitals devices. Communication standards, so far, have been a low priority, and in many cases, manufacturers have undertaken efforts specifically aimed at limiting interoperability. From a healthcare perspective, this has limited the utility of what is clearly a preferred digital generated healthcare data format, since the smart home devices already have the capability to transmit data wirelessly. The various embodiments set forth herein create a form of wireless wide area network (WWAN) that is capable of communicating with this plethora of smart devices using an extension of the BLE standard.

[0034] As an example, an individual may own various smart home devices in their home, such as a body-weight scale or a blood pressure monitor, as well as use several more portable devices, such as a glucometer and a pulse oximeter. All of these smart home devices, while having a need to navigate a diverse set of higher level protocols, would make use of the underlying BLE protocol. Although these devices are all designed to make use of a personal area network (PAN), a preferred embodiment using a wireless system set forth herein allows them to work as though BLE is a wide area network (WAN) protocol.

[0035] By installing one or many of the device gateways 110 to communicate with a vitals device 130, the data flow system in FIG. 1 is enabled. Vitals devices 130 may be any one of the devices described above, including scales to measure weight, glucose monitors to measure blood sugar levels, blood pressure measuring devices, pulse oximeters, or other monitoring and data producing devices. The measurements generated by these vital monitoring devices 130 are “scraped-off” to reduce the necessary data transfer volume, thus enabling them to be monitored by users of the system, including patients and physicians, patient care managers and other interested parties. The process of “scraping” involves eliminating ancillary data contained in a vitals device measurement data set not essential to the transfer of core data, such as contained in the layered packet transport protocol overhead. Gateways 110 are set up to form a mesh network in order to cover the entire facility housing the vitals devices 130. A particular gateway 110 determines which vitals devices it will monitor in view of which gateway receives the strongest signal from the particular vitals device 130. These measurements may be sent by the gateways 110 via transmission means 140 over the Internet 150 for further processing, storage and dissemination. The gateways 110 that form a mesh network to cover the entire facility 105 may vary in their contained components as is necessary to most efficiently form a system that ties into transmission means 140. For example, selected gateways 110 may contain some or combinations of the radios and communication nodes used to transmit the data to Internet 150 as more fully described in the ensuing detailed description. The transmission means 140 may include transmissions via LoRaWAN referred to as “LoRa”, radio networks 141, cellular radio networks 142, WiFi networks 143 and/or direct IP networks 144 that may include a cable modem or any components (not shown), such as an ethernet connection, enabling direct Internet Protocol (IP) transmissions. The transmission means that 140 may in turn distribute the vitals measurements over the Internet for further distribution. One embodiment incorporates the ability to incorporate wearable devices, mobile phones, PDAs and/or other devices, which are generally designated as devices 135. In yet a further embodiment, devices 135 may be utilized to identify the particular user or patient utilizing a vitals devices 130. Prior to a gateway device connection being formed, devices broadcast amongst themselves identifying data in an attempt to solicit incoming connections. All gateways in proximity are able to receive these identification packets and correlate the ID's with known devices. The occurrences of the witness events can then be transmitted to a web service along with the associated received signal strength indicator of said packets. The service can use this information to coarsely constrain the relative location of identified devices at various moments in time. If a vitals measurement is then taken, the relative position of all devices in the environment can be further queried for that instant. This data may be useful to ascertain the identity of the person that is using the vitals measurement device, or more specifically, used to differentiate between a small number of people that may have used the measuring device, such as the residents of a home.

[0036] Internet 150 may be used to distribute vitals information to any number of users of the system, data management services 170, or electronic health records (EHR) 160 that may in turn be transmitted or accessed by, for example, physicians 161 and/or patients 162. The vitals information or data may be distributed via Internet 150 to, for example, care management 180, patients 185, and/or personalized data services 190.

[0037] Internet 150 may also distribute such vitals information and/or data to data management services 170 capable of long term storage for both archival and analytical purposes.

[0038] Data may then be processed by the remote data management service 170 in such a way as to allow for direct insertion into an EHR 160. It may also be analyzed for anomalies or critical situations where manual intervention may be necessary to ensure integrity of such data and information. FIG. 7 illustrates a type of user interface that may be enabled by the present invention, with specific regard to displaying long term vitals measurement data and historical trends.

[0039] With reference to FIG. 1 and a more general wireless communication system 100, the gateway devices 110 may be installed into a mesh network in facility 105 as needed to ensure communication between the monitoring equipment such as vital devices 130 and at least one gateway device 110. The vital devices 130 are generally Bluetooth devices, more particularly BLE devices. Depending on the number and location of the vitals devices 130, gateway devices 110 can be installed and positioned in the user's facility 105 to maximize communication with vitals devices 130 to enable the secure communication of data and information to the gateway devices 110. The gateway devices 110 may be equipped with various radios and communication components necessary to ensure communication over every supported communication network described in FIG. 1.

[0040] As seen in FIG. 2, a device gateway 110 may contain a BLE module 220 including or coupled to a real-time processor; in a preferred embodiment the BLE module 220 may be a Bluetooth radio controller. The BLE module 220 also may include a Bluetooth antenna 227, or a connection to a 2.4 Ghz antenna 227. Module 250 may be a single board computer that may contain integrated flash memory, dynamic random access memory (DRAM) and microprocessor (MPU). In a preferred embodiment, module 250 may be a more powerful single board computer and include a WiFi transceiver with a connection to a 2.4 Ghz antenna 257. The BLE module 220 is responsible for maintaining the consistent over-the-air profile of the gateway device from the perspective of a smart home device 130. This is achieved by using low-level packet send/receive functions without making use of functions that may be capable of introducing random amounts of buffering and/or the reordering of packets. BLE module 220 also facilitates key exchanges between gateways 110 and vitals devices 130, establishing the mesh network of multiple gateways 110, scanning various vitals devices 130 to determine events such as new readings and/or measurements obtained from the vitals devices 130, enabling communication with vitals devices by supplying the correct and/or updated drivers for such devices 130, and creating secure connections to transfer such readings and measurements from devices 130 and the software running on the BLE Module 220. The BLE Module 220 can also communicate with devices that can function as a personal assistant hub including, but not limited to, devices that can run Google Home and Amazon Alexa; physical embodiments of device may be offered on Alexa, Google Home, Apple TV or third party system offering a wireless radio capability; these functions are more fully described hereinafter. All elements described in this paragraph are contained on circuit card assembly 201.

[0041] The gateway 110 may also contain a LoRa module 235 which may have a LoRa compatible transceiver and associated protocol stack running on either an included processing unit or another processor embedded into the gateway. LoRa module 235 may include a connection to a 915 MHz antenna 237. In a preferred embodiment, module 250 is programmed to control LoRa module 235 as well as to control any link between the BLE module 220 and the LoRa module 235.

[0042] The gateway 110 may contain a cellular radio 245 as well as a higher performance CPU in the form of a embedded computer 250 to manage this high bandwidth connection. This higher performance computer 250 is capable of running a standard operating system such as Linux, while simultaneously maintaining a secure channel to a remote server using a virtual private network (VPN) or other encrypted transport channel; remote updates to the software for all processors are possible over such a link. By a preferred embodiment utilizing a mini PCIE card 240 for the cellular radio 245, further in combination with computer 250, may allow for economies of scale to be achieved while providing a high performance computer 250 capable of being programmed as necessary to achieve various functionalities. In a preferred embodiment, a subscriber identity module (SIM) card 246, which is attached via a mini PCIE card 240, to enable authorized access to cellular networks. In a preferred embodiment a MicroSD 251 or Embedded MultiMediaCard (eMMC) 251 is attached to this higher performance computer 250 in order to provide bulk storage for software as well as long term logs of measurements taken and other logs useful for debugging.

[0043] A preferred embodiment for gateway 110 includes a BLE module that incorporates BLE module 220, a LoRa radio 235, a cellular radio incorporated into PCIE card 245 that further includes both primary antenna 247 and a diversity antenna 249, and a computer module 250. The foregoing components are connected via a serial connection 261, and Universal Serial Bus (USB) 260 and may be powered by a power supply unit (PSU) 210, which may be plugged into a 110V/220V wall outlet and constructed to convert alternating current to direct current that supplies 5 volts of power to gateway unit 110 and its components. Gateway 110 may solely utilize the BLE module 220 or combinations of the above identified components and radios. Gateway 110 must provide at least one link between bluetooth and connection methods 140. Since nearby Gateways 110 may provide such a connection, a given gateway may need only contain BLE module 220, omitting the LoRa Radio 235, MPU module 250 and cellular module 245, so long as it is known that at least one gateway within the mesh can provide a service 140. Relatedly, an installed Gateway 110 meant to provide a service 140, may need only contain BLE module 220 along with LoRa module 235, if LoRa is the chosen transport. MPU module 250 can be included to give WiFi support, along with a cellular module 245 for cellular access.

[0044] With reference to FIG. 3, an embodiment is shown regarding the structure of gateway 110, showing that PSU 210 slidably and removably engages into slot connectors to make electrical contact with gateway connector contacts, preferably using a standard USB connector 320 permanently affixed to mating assembly 310. This design enables the replacement of PSU 210 should it fail or should different requirements be demanded by the components and/or radios of gateway 110. PSU 210 may be purchased or designed to be in accordance with various electrical and safety codes as well as serve as a power limiting device to ensure the safety of other components within gateway 110. Housing 315 is used to enclose the sensitive electronics from the environment.

[0045] FIG. 8 illustrates the initialization process that occurs within a gateway 110 when a gateway is first powered-on. The process begins with the introduction of power as shown in FIG. 8 as the initialization element labelled “Start” 800. Once all the power-on ramps-up and the down-converting power sequencing has completed the gateway proceeds to identify and establish all available communication channels. The gateway's processor first establishes a communication path using the Bluetooth channel per 810 and 811 resulting in 812. The gateway systematically queries all other available communication pathways by checking for the availability of a LoRa, a WiFi, a cellular, and a direct channel using direct IP connectivity. The gateway determines the availability of all potentially available pathways 820 using the logical inferences contained in 821, 822, 823 and 824. Based on this query stage, 824, may invoke additional computational resources as determined by 825 by invoking 826 as needed. Once all the additional channels are established using 827, the gateway enters a quiescent mode following 828 wherein the gateway 110 monitors all identified channels for maintaining connectivity on every possible communication path using 830. In the event that a channel has been detected as not available to the system monitoring subsystem 830 begins the process of re-identifying and re-establishing available paths by reverting to stage 800. The gateway hardware is typically pre-built to contain sufficient resources to contain the processing power necessary to maintain a maximal multi-protocol communication system.

[0046] At system initialization time, the gateway 110 performs a process of identifying all possible available communication channels; this flow is illustrated in FIG. 8. This process entails establishing a BLE channel first, and from there seeking any and all possible additional offered communication channels, be they offered via LoRa, WiFi, cellular, or Ethernet or other protocols allowing connectivity such as direct IP connectivity. In the event that multiple channels are available the gateway will make a determination if more computational devices are required to best match with the requisite requirements. Resources may be predetermined at build time to minimize customer concerns.

[0047] The three affordances of the implementation of security in BLE devices are: authentication, confidentiality and authorization. Many BLE slave devices may refuse to transmit vitals data if the link encryption protocol is not enabled. Additionally, most devices require some sort of mechanical user input, such as pushing a specific button in order to enable encryption with a new peer. FIG. 4, describes a showing how the keys generated/exchanged during the bonding process may be sent to the management services (“MS”) 470 in encrypted form using a secret key known only by gateway 110 and MS 470. If, at a later time, a different gateway 110 in environment 105 makes a connection to vitals device 130 for which it does not know the bonding keys in use, gateway 110 may then request a copy of the keys from MS 470, by using the shared secret known only to the particular instance of gateway 110.

[0048] With reference to FIG. 4, either a user 410 or their health care provider 420 may elect to provision a new vitals device 130. During this process, a request to provision the device is made via inputting information including, for example, the User ID and the identification of the vitals device over internet 450 in communication with management services (“MS”) 470. MS 470 may access information from, for example, a database server 471; this database may be updated from time to time and, for example, when a new device is provisioned, the software for which then attempts to transfer the new data to the relevant gateways on a best efforts basis, via links to gateways 490—these provisioning packets contain the driver code and device keys, if relevant, to “scrape” the configured target vitals device for storage and use by network 100. Alternatively, MS 470 may access information from a cloud service 430 or otherwise. This request can be initiated by any software or website 460 with sufficient privileges to make the request. Website 460 is home to an EHR database and may be the front end that monitors the vitals or enables initiating provisioning for a new vitals device as is more fully described hereinafter and shown in FIG. 7. The database (DB) 471 may contain the MAC addresses for the vitals devices 130 and gateways 110, relevant links and code to extract vitals data. DB 471 may also contain a unique encrypted patient ID, where the vitals devices 130 and gateways 110 are housed together with owners of these devices and case managers for these devices. DB 471 may additional contain physician or other interested user information and link this information to the users of the vitals devices.

[0049] Once the provisioning request is extended, an attempt is made to locate the corresponding gateways in proximity to the specific user, then the provision is stored in the database. Upon location of corresponding gateways 110, MS 470 forwards the requisite information to the correct gateway via links 490.

[0050] The real-time processor associated with the BLE module 220 is responsible for executing smart device specific drivers during every connection. These drivers may be distributed in a binary device-agnostic form and in a preferred embodiment, a reformatted variant of the WebAssembly binary format. These drivers are relatively small and can be transferred even over low-bandwidth links such as LoRa. Multiple drivers can be simultaneously loaded on BLE module 220 of gateway 110 in unique combinations specific to the gateway 110, in particular by making use of knowledge of which devices 130, 135 are expected to be in range.

[0051] FIG. 6 illustrates how the software that executes on the gateway 110 is first reformatted by a series of pre and post processors. The source code is first run through a compiler 601 to output a readily understood object format. The object code is then processed by a shared libraries printer 602 that optimizes the object code for execution on a stack-oriented virtual machine (VM) architecture. In order to reduce the bandwidth required for transport over certain networks, the reformatter 603 optimizes the executable image into a more, size and load time, efficient format; this format is inter-operable among the supported devices.

[0052] FIG. 5 illustrates the steps used in the gateway's connection and provisioning process. Element 509 shows the first step wherein the gateway terminal server waits for events, when an event is detected element 510 determines if the recognized event corresponds to a provisioning request or to a connection request. Element 511 determines if the event is associated with a new provisioning request passing this information to element 512 which determines for how many gateways a provisioning requests is required; for each gateway in a new provisioning request the flow returns back to element 509 where the previously described flow continues until all provisioning requests first detected are exhausted. Once element 513 is completed, it will determine if a connection already exists, if not, then element 514 saves the provisioning request(s) to a queue of pending updates; if determined that an positive affirmation response such as a “yes”, is expected, then element 515 sends an update notification payload to the requesting gateway and then returns to element 513 until all request are exhausted after which the procedure returns to element 509 to await receipt of new events. In the case that element 510 had determined that a connection request was detected element 520 will confirm that the connection request is valid and element 521 will check for pending payload packets to be sent by invoking element 515 until the entire series of requests are transmitted to the requesting gateway. Upon completion the process returns to element 509 to await new provisioning and connection requests.

[0053] Below is the description of the events that occur in a typical Bluetooth Low-Energy connection flow. Further details can be found in the Bluetooth Core Specification version 4.0 and later. Specific details of the physical layer such as modulation, whitening and the various polynomials used are omitted for brevity. The specific meaning of bits, the frequencies used and the timing of the events in the channel is also left to the reader. Special attention must be paid to the padding of fields during concatenation of the cryptographic primitives. All messages can lead to a variety of error notification and subsequent handling conditions, none of which are covered here.

[0054] FIG. 9 showcases the events comprising the typical connection between a bluetooth low-energy vitals device 910 and a master device such as a gateway 920. The vitals device initially advertises by sending a Adv Channel PDU message 901 on logical channel 37, 38 or 39. Once the gateway receives an ADV_IND message, it checks to see if the vitals device is provisioned. If additional mformation needed to information is determine provisioning, the gateway 920 sends a SCAN_REQ message 902 to which the vitals device 910 responds by sending SCAN_RSP message 903. If the gateway 920 acknowledges this as a valid request, it will respond with a CONNECTION IND response message. At this point, a new Access Address is randomly generated by the gateway 920. Access Address is a connection unique identifier generated according to specified rules.

[0055] The MAC address is critical to the identification of peers while establishing and securing the link. A mapping between device MAC address and a randomly generated Access Address is created when a connection is initiated. The features of the security extensions offered in the claimed invention improve limitations contained in the standard BLE security protocol. Since the BLE protocol exposes the MAC addresses of both the master and slave during a connection process, provisions to the protocol were made in which devices could remain anonymous. This is implemented by creating MAC addresses, which are periodically updated.

[0056] The device gateway 110 makes use of an address in the random private resolvable space in the BLE specification. This is used in bonded devices and requires the Identity Resolving Key (IRK) to be shared during Phase Three of the pairing procedure as defined in the Bluetooth Core Specification version 4.1. In usual practice, such addresses are made to change periodically based on a timer or other method whereas, in the present invention, such addresses may remain static. Each gateway 110 in environment 105, uses a different such address, all generated from this same IRK, where IRK is any suitable 128-bit key material. This allows the bonding keys to be transparently copied between trusted device gateways 110 in a manner that will be more fully described hereinafter. This implies there exists a multitude of MAC addresses that a peer will associate with correct link keys. The resulting scheme easily allows inter-gateway connections to be created for the purpose of creating a mesh network.