WO2008120156A2

WO2008120156A2 - System and method for pill communication and control

Info

Publication number: WO2008120156A2
Application number: PCT/IB2008/051170
Authority: WO
Inventors: Karen I. Trovato; Pim T. Tuyls; Helen F. Routh; Jeff Shimizu; Johan F. Dijksman; Anke Pierik; Judith M. Rensen; Hans Zou
Original assignee: Koninklijke Philips Electronics N.V.
Priority date: 2007-03-30
Filing date: 2008-03-28
Publication date: 2008-10-09
Also published as: WO2008120128A3; WO2008120156A3; WO2008120128A2

Abstract

A pill (10), associated parts; and method of operating the same, includes an ingestible shell (12), a medicine reservoir (14) or other treatment, sampling or sensing mechanism in the shell, a real-time clock for facilitating timed events, and a processor (26) in the shell. The processor is communication with a controller (16) for releasing medicine from the medicine reservoir or for performing other active functions for the pill. A pill memory is included for storing information about medicine released by the medicine reservoir such as dosage profile and timing profile, or other functions performed by the pill. A communicator (20) is also in the shell for receiving control signals for controlling the release controller and for transmitting the stored information from the pill memory. A tamper resistant bitstring contains identification information for uniquely identifying the pill and secret information for encrypting, decrypting, and authenticating communication via the communicator.

Description

System and Method for Pill Communication and Control

FIELD OF THE INVENTION

The present invention relates in general to the field of health and medicine, and in particular to systems and methods for pill communication and control.

BACKGROUND OF THE INVENTION

Pills or capsules that are made up of, or contain selected dosages of medication to be taken orally by a subject, are common. In some cases, the medication is packaged or treated in such a way that is released into the subject's system in a time-released manner. There has hitherto been little positive control over the release of medication to a subject after a pill has been ingested.

Additionally, there is no known mechanism for obtaining precise information about the release of medication, such as actual dosage released and the time at which the dosage is released. Determining whether a patient has truly complied with a medication regimen is difficult and typically depends on patient feedback. There is a need for an objective and accurate means for determining compliance with a medication regimen, particularly with children and the elderly, who typically find more difficulty in complying with a medication regimen. Such compliance information would also be useful in a situation where a patient is unconscious or otherwise disabled in a manner that he cannot convey compliance information personally. One of the inventors of the present disclosure (Trovato) is also the sole inventor or a co-inventor of a number of co-pending patent applications that disclose various pills. These applications are not conceded to be prior art to the present invention, but rather are mentioned for their disclosure of various exemplary structures and functions that can be utilized in a pill. See, for example, the following patent applications that are all incorporated herein by reference:

U.S. Patent Application Serial No. 11/814,176, entitled "Electronically Controlled Ingestible Capsule For Sampling Fluids In Alimentary Tract" filed January 16, 2006 by Karen Trovato and Judy Naamat. U.S. Patent Application Serial No. 11/814,248, entitled "Electronically Controlled Capsule" filed January 18, 2005 by Karen Trovato and Judy Naamat.

U.S. Patent Application Serial No. 11/814,223, entitled

"Electronically Controlled Capsule For Releasing Radiation" filed January 18, 2005 by Karen Trovato.

U.S. Patent Application Serial No. 11/814,185, entitled "System and Method for Controlling Traversal of an Ingested Capsule" filed January 18, 2005 by Karen Trovato, Martin Ouwerkerk, Daniel Herzka and Judy Naamat.

U.S. Patent Application Serial No. 11/574,544, entitled "Electronically Controlled Pill And System For Delivering At Least One Medicament" filed September 1, 2004 by Karen Trovato.

U.S. Patent Application Serial No. 11/574,200, entitled "Electronically And Remotely Controlled Pill And System For Delivering At Least One Medicament" filed August 27, 2004 by Karen Trovato and G. Spekowius. U.S. Patent Application Serial No. 60/748,304, entitled "Electronic

Gastrointestinal Screening" filed December 7, 2005 by Jeff Shimizu and Karen Trovato.

U.S. Patent Application Serial No. 60/787,454, entitled "Expandable Digestive Pill and Method of Use Thereof filed March 30, 2006 by Karen Trovato.

The present disclosure is also related to U.S. Patent Application Serial No. 60/909,139, entitled "Personal Accessory For Use with A Pill" which has been filed on March 30, 2007 by Karen Trovato, Pirn Tuyls and Anne Barschall; and

U.S. Patent Application Serial No. 60/805,645, entitled "Medicament Delivery System and Process" filed on June 23, 2006 by Karen Trovato and Jeff Shimizu, both of which are also incorporated here by reference. A pill-like and ingestible camera is disclosed in U.S. Patent 7,009,634 entitled

"Device for In- Vivo Imaging" issued May 7, 2006 and in other patents assigned to Given Imaging LTD of Yoqneam, Israel.

The need for security is known for various media such as credit cards and smart cards. Encryption algorithms are one commonly used technique for providing such security, and MAC (Message Authentication Code) algorithms are known for authenticating messages. These algorithms depend on secret keys. The algorithms are generally public and only the keys are considered to be secret. The security of cryptographic algorithms depends, therefore, on the secrecy of the keys. Physical Uncloneable Functions or PUFs have been proposed as a cost- effective way to produce uncloneable tokens for identification. PUFs for creating tamper resistant bitstrings is disclosed in international patent application WO 2004/105125 A2, published December 2, 2004, and entitled "Semiconductor Device, Method of Authenticating and System" which designates the U.S. and is incorporated herein by reference.

SUMMARY OF THE INVENTION

A system is disclosed herein which includes a remote device capable of sending commands to a pill to perform one or more desired functions. The desired function, which will be referred to hereinafter as an active function, includes, but is not limited to:

I) releasing selected amounts of treatment media such as for example a medication, radiation for radiation treatment or other purpose, or other treatment media, whether currently known or to be discovered, 2) taking of a fluid or tissue sample from the subject,

3) controlling movement and/or orientation of the pill,

4) the taking of images of or other data from the subject's alimentary tract or other location where the pill has been inserted into the subject,

5) reading of information, such as dosage profile (i.e., dosage information about the medicine to be released) and/or timing profile (i.e., timing information about when the medicine is to be released such as a specific time or time period, etc) that has been stored in the pill,

6) monitoring and/or storing actual dosage released or timing information of dosage released,

7) comparing actual dosage released or timing information of dosage released to dosage profile or timing profile respectively, 8) reporting or transmitting compliance information such as actual dosage released, timing information of dosage released, or comparison data and results,

9) monitoring and/or storing data about properties of a patient's body (e.g., temperature, pH, body location, etc) via for example, a sensor platform for measuring biological parameters of a human body, 10) monitoring and/or storing data about the pill (e.g., orientation of the pill), and

I I) transmitting stored information (including compliance information as described above).

The active function is of course not limited to these examples and includes essentially any function that can be performed in a subject's body, whether it is currently known or unknown, including all types of monitoring, diagnosis, analysis, and treatment. Reporting or transmitting compliance information such as actual dosage released, timing information of dosage released, or comparison data and results allows an authorized health practitioner to receive and review such compliance information to verify that the subject has complied or is compliance with his or her medication regimen and has indeed taken his prescribed medicine. Verifying that a medication has been taken is especially useful in an emergency (e.g., when a patient arrives unconscious or is unable to speak) and solves a compliance problem that is sometimes experienced with the elderly and with children.

Also disclosed is a memory for storing information, such as for example, the above-identified information (dosage profile, timing profile, actual dosage of medicine released, timing information of actual dosage released, comparison data thereof, information on a patient's body, information about the pill, etc).

Also disclosed is a unique identification for a pill to ensure that the correct pill performs an active function and a cryptographic safety feature for a pill for authenticating, encrypting, or decrypting.

For example, the pill is capable of creating a random, tamper resistant bitstring. For the purpose of this disclosure, the term "bitstring" is defined as a set of bits that include information. A bitstring can be created from a PUF (Physical Uncloneable Function) in a CMOS for example, or in programmable memory such as EPROM or EEPROM. The word "uncloneable" indicates that the PUF cannot be copied or altered.

According to one embodiment, the created random, tamper resistant bitstring is split arbitrarily into two parts. The first part is a unique identification (pill ID), and the second part is secret information, for example a private key. The pill ID uniquely identifies the pill. The secret information is used to encrypt, or decrypt communication between the pill and other devices as well as to authenticate other devices. If more bits are required than the number available from the response of a single PUF, then more than one PUF can be used. The unique identification ensures that messages intended for one pill are not accidentally read and followed by another pill that for example happens to be in the same area. The secret information ensures that only authorized parties, e.g. the subject's doctor or an ER (Emergency Room) attendant, can control the pill or can read information from the pill. That is, the requirement of this secret information prevents pill communication from being open to the public and in particular, unauthorized parties. Hence, the requirement of secret information prevents the pill from being controlled by any unauthorized party for any unauthorized purpose. The secret information further protects patient privacy and safety by ensuring that non-approved communication equipment cannot inquire about medications taken by a particular patient, and provides an additional layer of protection against intentional or accidental control by an unauthorized communication source.

According to another embodiment, PUF is advantageously implemented using a standard CMOS (Complementary Metal Oxide Semiconductor) and requires only two more layers (what do you mean here?), for example, on any of the already present ICs (Integrated Circuits) used in the pill.

Also disclosed is a method to check whether the pill is authentic; i.e. whether it has been counterfeit or not. The various features of novelty which characterize the invention are pointed out with particularity in the claims annexed to and forming a part of this disclosure. For a better understanding of the invention, its operating advantages and specific objects attained by its uses, reference is made to the accompanying drawings and descriptive matter in which preferred embodiments of the invention are illustrated.

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings:

Fig. IA is a schematic illustration of a system in which an exemplary pill transmits information to a first remote device; Fig. IB is a schematic illustration of a system in which an exemplary pill transmits information to a relay means for relaying the information to a first remote device;

Fig. 1C is a schematic illustration of a system in which an exemplary pill transmits information to a second remote device;

Fig. 2 is a schematic illustration of an exemplary pill having means for dispensing medicine;

Fig. 3 is a schematic illustration of an exemplary pill having means for secure communication and usable in the embodiments shown in Figs. 1 A-2;

Fig. 4 is a schematic sectional view of CMOS (Complementary Metal Oxide Semiconductor) layers that implement PUF to form or create a tamper resistant bitstring that is useable with the exemplary pill according to Figs. 1A-3; and

Fig. 5 is a schematic illustration of the tamper resistant bitstring formed by the CMOS layers of Fig. 4.

DETAILED DESCRIPTION OF EMBODIMENTS Referring now to the drawings, in which like reference numerals are used to refer to the same or similar elements, FIG. IA illustrates a system for facilitating transmission of information from a pill 10 to a remote device 62. Pill 10 includes a communicator 20 for at least one of transmitting or receiving (or both) and a controller 16 for controlling an active function of the pill 10. In the instant embodiment, the active function constitutes at least transmission of information. Thus, the controller 16 controls transmission of information by instructing the communicator 20 to transmit information. The active function may constitute other functions like medicine release, as described in more detail in Fig. 2. Pill 10 can have multiple active functions as well, such as for example dispensing some dosage of medication, recording dosage dispensed, and transmitting a compliance report of dosage dispensed. An antenna 30 located on or in the pill 10, is connected to the communicator 20 for facilitating communication. A battery powers the pill 10 and its components.

Transmission of information can occur in a variety of ways and two examples are provided as follows. The present application is not limited to the following examples as other examples may be evident from what is already known in the field of communication or may be covered by the spirit of the application.

In a first example, pill 10 is preprogrammed to transmit information at a particular time, or in response to certain events, or under certain circumstances. When the requirement for pill 10 to transmit information is triggered, controller 16 instructs the communicator 20 to transmit information to the remote device 62. Controller 16 may obtain the information from memory and provide the information directly to communicator 20 for transmission to remote device 62.

In a second example, the remote device 62 sends a control signal (e.g., via a message containing the command 'transmit information to remote device 62') to the pill 10 requesting transmission of information to the remote device 62. Communicator 20 receives the control signal from remote device 62. Communicator 20 sends the control signal to the controller 16. Controller 16 reads the control signal and instructs the communicator 20 to transmit information to the remote device 62, which is accessible by a doctor, pharmacist, clinical researcher (or trial manager), home care management client, or home services management agency, or other caregiver, etc. As a part of this process, controller 16 may obtain data from memory and provide the information directly to the communicator 20.

Communicator 20 is programmed to initiate communication with other devices, either intermittently or constantly, to verify whether the other device is available and ready to receive information from the pill 10. By intermittently communicating, the pill 10 is able to substantially conserve energy and power since the pill is not constantly "on" and looking for devices to communicate with, which is especially useful if the other devices are not available, either temporarily or for a long period of time. This is also especially useful for such a small pill. Accordingly, the communicator 20 initiates communication with the remote device 62, either intermittently or constantly, to verify whether the remote device 62 is available and ready to receive information. If the remote device 62 responds and verifies that it is available and ready to receive information, the information is transmitted from the pill 10 (via communicator 20) to the remote device 62. Information that is transmitted from the pill 10 to the remote device 62 includes any information about an active function, such as for example, the information about medicine released by the medicine reservoir 14 (see Fig. 2) (type of medicine released, time of release, and amount and dosage of medicine released, etc), information about radiation released (type of radiation, time of release, duration of exposure, amount of exposure, etc), information about fluid or tissue sample taken (amount taken, time taken, duration of time taken, etc), information about the pill (e.g., orientation), information about images taken by a camera (the images, the time the images were taken, the location that the images were taken, etc), information about the patient from sensors (e.g., core body temperature, pH, or the location or position inside the body). The pill 10 includes a processor 26 capable of comparing actual active function information (e.g., the time of pill ingestion, the dosage of a particular medicine actually released by controller 16) with desired active function information (the required medicine dosage to be taken) to generate a compliance report for transmission to the remote device 62. Comparison of actual data versus prescription to create a compliance report may also occur at the remote device 62. The information can be made available to for example, a doctor, pharmacist, clinical researcher (or trial manager), home care management client, home services management agency, or other caregiver, etc, by way of the transmission to the remote device 62.

Fig. IB shows an alternative embodiment to Fig. IA where the active function is transmission of information and the system further includes relay means in the form of for example, a remote unit 65 for relaying information from the pill 10 to the remote device 62. Since the pill 10 may have a limited communication range from inside the body due to bodily interference, the remote unit 65 is optionally wearable by the patient or is otherwise located or positioned near the patient so that the communication range from the pill 10 to the remote unit 65 is adequate. The remote unit 65 is less constrained to having certain power or frequency requirements. Thus it may communicate with remote device 62 using a different frequency band and protocol as compared to the communication established to the pill 10. The remote unit 65 further contains memory for storing information.

Two examples are provided below for transmitting information in the system shown in Fig. IB.

As in the first example in Fig. IA, pill 10 is preprogrammed to transmit information at a particular time, or in response to certain events, or under certain circumstances. However, when the requirement for pill 10 to transmit information is triggered, controller 16 instructs the communicator 20 to transmit information to the remote unit 65, which relays the information to remote device 62, in a manner described in more detail below.

In a second example, the remote device 62 transmits a control signal (e.g., via a message containing the command 'transmit information to the remote unit 65 for relay to the remote device 62') to the pill 10 requesting transmission of information (e.g., the time at which the pill was ingested, results of measurements, dispensing actions taken, compliance information, core body temperature, pH, etc). The remote device 62 transmits this control signal to the pill 10 through the remote unit 65, or alternatively, directly to the pill 10. Like in the embodiment of Fig IA, communicator 20 receives the control signal from remote device 62. Communicator 20 sends the control signal to the controller 16. Controller 16 reads the control signal and instructs the communicator 20 to transmit information to the remote unit 65 for relay to the remote device 62. The transmission of information from communicator 20 to remote device 62 through remote unit 65 is described in more detail below.

Communicator 20 is programmed to initiate communication with remote unit 65, either intermittently or constantly, to verify whether the remote unit 65 is available and ready to receive information from the pill 10. If remote unit 65 confirms it is available and ready, the communicator 20 transmits the information to remote unit 65. If remote unit 65 is not available, the pill 10 will store data internally. The amount of data storage on the pill 10 is typically limited owing to the size constraints of the pill. Thus the pill 10 will continue to query for the remote unit 65 intermittently or continuously. When communication can be established with remote unit 65, the communicator 20 transmits the stored information. The memory on the pill may then be freed for subsequent data. The transmitted information is stored on remote unit 65 that has a larger memory capacity than the pill 10. Likewise, the remote unit 65 will intermittently or continuously initiate communication with remote device 62. When communication is established the information stored on remote unit 65 will be sent to remote device 62, which is accessible to for example, a doctor, pharmacist, clinical researcher (or trial manager), home care management client, home services management agency, or other caregiver, etc. The remote unit 65 will have enough memory to store data from the pill covering an extended period. It may then only need to establish communication with remote device 62 infrequently. For example the remote device may be placed in a charging and docking station at the end of the day. The docking station might then serve as the communication port between the remote unit 65 and the remote device 62.

In Fig. IB, intermittent verification saves energy and power since the remote unit 65 is not constantly looking for the remote device 62. This is particularly useful if the remote device 62 is not available, either temporarily or for a long period of time. This is also particularly useful in view of the small size of the remote unit 65.

Remote unit 65 can have varying degrees of intelligence. For example, one form of remote unit 65 may act as a repeater without decrypting the data, but may relay the information on a slightly shifted frequency, exactly as it hears it from the local environment. This is possible with an RF repeater (receiving RF and transmitting RF), such as is performed by Amateur Radio systems. If bits can be accurately received and recognized in bytes, data received by RF can be re-transmitted (relayed) via TCP/IP (i.e. the net), to remote device 62 located on the network which is identified as a receiver of such relays. In another example, another form of remote unit 65 can contain a PUF, and therefore be capable of decrypting or encrypting messages as an authorized device (see below for explanation for enrolment; Fig. 3). Thus, the remote unit 65 can decrypt messages and take the burden of decrypting messages from the remote unit 62. As a result, a plurality of remote units 65, functioning at low power, can be used to perform potentially numerous decryptions. Each remote unit 65 can consolidate a plurality of received messages by decrypting and storing all of the received messages, and consolidating all of the stored messages via encryption into one encrypted pattern which is then relayed by RF, network (as described above for example) or other means. This consolidation of messages can simplify the processing at the remote device 62 or other remote device. For example, 1000 messages from pills may be received by ten remote units 65 (100 messages per remote unit), and each remote unit 65 can then decrypt its share of 100 received messages, and then consolidate all 100 received messages into a single encrypted pattern, which can then be relayed to remote device 62 for example. Information that is relayed by the remote unit 65 to the remote device 62 includes any information about an active function such as described above in connection with the system in Fig. IA. Messages relayed through the remote unit 65 and forwarded to either the pill, or another relay system or a remote device 62 preferably contain 'envelope information' in addition to the message. For example: 'message forwarded from pill number X. Message says that it dispensed Y ccs of medication in the past hour'. Otherwise the source of the information is lost as it is forwarded.

Fig. 1C shows an alternative embodiment to Fig. IA which further includes a report terminal 67 for receiving information from a pill 10. In one example under this embodiment, pill 10 is preprogrammed to transmit information at a particular time, or in response to certain events, or under certain circumstances. When the requirement for pill 10 to transmit information is triggered, controller 16 instructs the communicator 20 to transmit information to the report terminal 67.

In another example, remote device 62 transmits a control signal (e.g., via a message containing the command 'transmit information to the report terminal 67') to the pill 10 requesting transmission of information to the report terminal 67, which is accessible by a doctor, pharmacist, clinical researcher (or trial manager), home care management client, or home services management agency, or other caregiver, etc. Communicator 20 receives the control signal from remote device 62.

Communicator 20 transmits the control signal to the controller 16. Controller 16 reads the control signal and instructs the communicator 20 to transmit information to the report terminal 67. Communicator 20 initiates communication with the report terminal 67, either intermittently or constantly, to verify whether the report terminal 67 is available and ready to receive information. If the report terminal 67 responds and verifies that it is available and ready to receive information, the information is transmitted from the pill 10 (via communicator 20) to the report terminal 67. Notably, a remote unit 65 may serve as a relay between the pill 10 and the report terminal 67 as described in conjunction with the embodiment shown in Fig. IB. Information that is transmitted to the report terminal 67 includes any information about an active function, such as described above in connection with the system in Fig. IA.

Still another embodiment is where the remote device 62 is connected to a network, such that it receives messages via RF, decrypts the messages, and then securely transmits them to another computer on a network, such as by TCP/IP. In the reverse direction, messages are received via network connection, and then transmitted to the pill (or other devices) via RF. Network connections can be wired or wireless. If they are wireless, then presumably the frequency and protocol is sufficiently different from the PUF pill or PUF device so messages do not collide. As electronics are further miniaturized, a Pill or PUF device may also communicate using the same protocols as wireless LAN systems.

Fig. 2 shows an exemplary embodiment of a pill 10, having an ingestible shell 12, a medicine reservoir 14 in the shell and a processor 26 in the shell. The processor 26 has, or is in connection or communication with, a controller 16 for controlling an active function of the arrangement. According to this non- limiting exemplary embodiment, the active function includes releasing medicine from the medicine reservoir 14 to the outside of the shell 12, which is controlled by controller 16. The controller 16 communicates with a gate 28 and a pressure mechanism 32, which is structurally much like the plunger of a syringe. The controller 16 opens the gate 28 and causes the pressure mechanism 32 to release a selected amount of medicine outside of the shell 12.

The pill 10 further includes a memory 18 for storing information, such as for example, dosage profile, timing profile, actual dosage of medicine released by the medicine reservoir 14, timing information of actual dosage released, comparison data thereof, information on a patient's body, or about other active functions performed by the pill 10. The pill 10 optionally includes timing circuitry 24 that is part of, or separate from, the processor 26, for controlling the timing of the opening of the gate 28 (e.g., at a selected time and/or for a selected period) for releasing a selected amount of medicine from reservoir 14 by the action of the syringe or pressure mechanism 32 at a selected time and/or for a selected period. That is, the timing circuitry 24 can be a real-time clock, either integrated with the processor, or provided separately, configured for facilitating timed events such as for example, releasing medicine at a pre-scheduled time or for a pre-scheduled period, recording information at a certain time, etc.

A communicator 20 such as a transceiver is also included in the shell 12 for at least receiving control signals for controlling the active function (e.g. to release medicine via controller 16), which cause controller 16 to control gate 28 and pressure mechanism 32 to facilitate release of medicine from the medicine reservoir 14 to the outside of the shell 12. An antenna 30 located on or in the pill 10, is connected to the communicator 20 for facilitating such communication. A battery is connected to the circuitry in pill 10 to power the pill components and active function.

While a pill that is ingestible or insertable into the alimentary tract (e.g. orally or rectally), is disclosed according to this embodiment, the pill may be of the type that is surgically inserted or implanted at a selected location in the subject, e.g. subcutaneously or otherwise.

Other alternatives to this embodiment shown in Fig. 2 may include a mechanism similar to the ejector of an ink jet printer head in place of the illustrated syringe- like pressure mechanism 32 and a valve (for controlling the amount and/or rate of release) in place of the gate 28. Although these alternative features are not shown, one skilled in the relevant art would understand how to implement these alternatives since they are well known features.

Fig. 2 shows one example of an active function for a pill 10. However, there are many other types of active functions. Thus, an active function includes, but is not limited to:

1) releasing selected amounts of a treatment media such as a medication, radiation, or other treatment media (achievable as shown in Fig. 2 for example)

2) taking of a sample, e.g. a fluid sample from a subject's alimentary tract (achievable by opening a port to an empty chamber, drawing fluid into a reservoir by mechanical displacement)

3) controlling the movement or orientation of a pill such as stopping the movement of the pill along the subject's alimentary tract (achievable by expansion of a balloon of the pill 10)

4) taking images of various parts of the subject's alimentary tract (achievable by means of a camera), such as disclosed in U.S. Patent 7,009,634, 5) reading of information, such as dosage profile (i.e., dosage information about the medicine to be released) and/or timing profile (i.e., timing information about when the medicine is to be released such as a specific time or time period, etc) that has been stored in the pill,

7) comparing actual dosage released or timing information of dosage released to dosage profile or timing profile respectively,

8) reporting or transmitting compliance information such as actual dosage released, timing information of dosage released, or comparison data or results,

9) monitoring and/or storing data about properties of a patient's body (e.g., temperature, pH, body location, etc) by means of for example, measuring or sensing the core body temperature (achievable by temperature sensors), measuring or sensing pH in the body or specifically intestinal pH (achievable by pH sensors), measuring or sensing light (achievable by a photodetector for detecting fluorescence for example, or other light sensor),

10) monitoring, determining, and/or storing data about the pill (e.g., position or orientation of the pill) achievable by for example an inclinometer, and

11) transmitting stored information (including compliance information as described above).

Other currently known or to be discovered active functions can be implemented with the pill 10. The active function can also include other functions that pills are capable of executing, e.g. as disclosed in others of the co-pending patent applications identified above and incorporated herein by reference. The only requirement is that some externally controllable treatment, sampling, sensing or other function be performed that occurs inside the subject.

Also disclosed is a unique identification for a pill to ensure that the correct pill performs the active function and a cryptographic safety feature for authenticating, encrypting or decrypting communication. Figs. 3-5 illustrate a preferably tamper resistant bitstring 22, formed or stored in a component 23 having a PUF for example, and accessible by the processor 26. The tamper resistant bitstring 22 contains a large number of bits 40 (FIG. 5) that includes unique identification information 22a for uniquely identifying the pill, and secret information 22b for authenticating, encrypting, or decrypting communication via the communicator 20. That is, the secret information 22b is not communicated to other devices but is used by the pill to encrypt messages to other devices or decrypt messages from other devices. Also, the communicator 20 is capable of using the secret information 22b of the bitstring to authenticate messages (with commands) as authorized messages from other devices or to authenticate the other devices as authorized devices before an active function is performed by the pill. If a message is not properly authenticated, the command contained in the message will not be carried out. The secret information 22b is preferably large enough so that the time required for transmitting "test" transmissions, such as those that might be used to try to break the 'secret', is much greater than the lifetime of the pill.

Fig. 3 further illustrates an enrolment processor 60 that is outside the shell, for reading the bitstring 22 and for storing the unique identification information 22a in a secure electronic master database that associates the identification information with a specific pill and its secret information 22b for future identification and secure control of the pill.

The bitstring may be formed, created, or read from a programmable, nonvolatile memory, such as an EEPROM or EPROM, or from a CMOS or other component having a random but unalterable PUF. However, EEPROM is not as tamper resistant as a component having a PUF. Part of the programmable memory may be used to identify the pill or store information used for nominal actions. The manufacturer or product name together with a PUF-derived value can then also form a unique identification for the pill. Nominal actions are those that the pill would carry out without external control, such as releasing medicine at a particular dosage and timing based on dosage and timing profiles stored in the programmable memory. Similar additional information can also be part of the programmable bitstring for pills having other or additional treatment, sensing, sampling or other active functions. The identification, whether programmable, random-unalterable or a combination, is stored in the master database.

The remote device 62, which for example may be in the emergency room of a hospital, in a doctor's office or in another health care establishment, is empowered to generate an encrypted message with the secret information 22b and to transmit the encrypted message to the pill, as well as to decrypt messages with the secret information 22b. Basic commands to be transmitted to the pill include for example 'activate', 'activate upon entering stomach', 'activate within 1 week', or 'pilll activate pill2 with secret S when pilll finishes'. Some transmissions may request the pill to read or transmit status information that is stored in the pill's memory. The remote device 62 either contains or has access to a master database, or a subset of useful ID-Secret codes. A subset may be used when known medications are delivered in a relatively constrained patient population, such as in a nursing home, hospital or intended charitable region (such as a third world country). In this last group, on-site activation can assure that the medication is delivered to the intended recipients. Thus, the contents of various databases may vary depending on the expected use. In an emergency, a clearinghouse of all ID-Secret combinations must be accessible and based on a secure authorization level. The secure authorization for communicating with various databases may include the use of public key encryption techniques, IP addresses and/or PUF technology to ensure that the remote device is authentic. The following are example cases that illustrate secure communication between a remote device 62 having properly authorized access to a database or subset and a pill: Case 1 : The remote device 62 knows the identity of the pill within the person, such as if the pill was dispensed from packaging that also displayed the ID number, possibly by barcode to minimize transcription error. The ID is then entered by keypad for example, or barcode is read, into the remote device 62. The remote device 62 must acquire the secret information corresponding to the ID from the master database. The master database may be stored within the remote device 62 or be accessed remotely. Remote communication with the master database is for example, a secure client-server system, where the master database is stored either on-site (such as at a hospital) or remotely at a central repository (i.e., the remote device 62 is an authorized device with authorized access to the master database). If the remote device 62 is an unauthorized device, it will not have access to the master database and will not learn anything more than the random number of the ID, and will not be able to communicate any actions to the pill 10. Once the secret information is acquired, it is used by the remote device 62 to encrypt messages containing a command to be sent to the pill 10. This ensures that only the identified pill will be able to decrypt the message and carry out the command. In the situation where there are multiple pills within communication range, possibly delivering similar medicine or belonging to more than one person, safe, uniquely directed control is provided. Further, 'eavesdropping' of unintended communication devices is prevented.

Case 2: The remote device 62 does not know the identity of the pill, such as if a patient arrives in an emergency room. In this case, the remote device 62, located in the emergency room, must send an un-encrypted message such as 'Request for Pills to identify'. In response, the pill transmits its ID un-encrypted to the remote device 62. Using the unencrypted ID, the remote device 62 requests secret information from the master database corresponding to the ID so that remote device 62 can securely communicate with the pill (e.g., authentication, encryption, and decryption).

As in Case 1 above, the remote device 62 is an authorized device. For example, the remote device 62 is a computer which receives a subset of the master database using current protocols between computers for secure communication, and may be updated through a network, by receiving a file for example from terminal 67. The computer can receive the database because it is preset with a password, and standard encryption techniques to transfer the data.

The communicator will continue to receive messages with appropriate start- stop indicators and attempt to decrypt the messages using the secret information found in the pill. If a message successfully decrypts, it will have the proper syntax of one of several functions understood by the pill. For example, an encrypted message might decrypt to a command such as 'report medication release pattern', instructing the controller 16 of a pill 10 to cause communicator 20 to transmit information to a designated location as described above in conjunction with Figs. IA- 1C. Ideally, the pill will first respond to the remote device 62 with a message encrypted using the pill's secret information that is the equivalent of 'message acknowledged', or ACK. The requested information is then read from memory, encrypted with the pill's secret information and also transmitted to the remote device 62. Once the remote device 62 receives the data, it can send an 'ACK' back to the pill (again, using the pill's secret information). If there is an error, it may either resend the command or send a 're-transmit' command. The remote device 62 may transmit a command such as 'set medication release to 5 milligrams per hour for 2 hours, then 3 milligrams per hour for 5 hours'. The pill would then adapt its previously stored release pattern to reflect the new setting. Since this is a more critical action, the pill may respond with a more sophisticated form of ACK, such as 'ACK-2STEPS-5-2+3-5END'. As an alternative, the pill may store the proposed settings in a temporary location in memory, and send the sophisticated ACK, but then wait for a further 'GO' command before actually storing the new release pattern.

Case 3: Pill initiated (unsolicited) communication occurs if the pill would like to report either a malfunction or a warning. An example warning may be that it is running out of capacity, such as medication, power, etc. The pill in this case will periodically (e.g. every 30 seconds) transmit its unencrypted ID, preferably along with a 'warning' message which is also unencrypted. Example: 'warning 1357986420'. A remote device 62 will receive this message. An authorized remote device then uses this number to look up the secret, and encrypt a message similar to 'Report your Warning'. The pill will decrypt this, and act to report the warning. The warning, which might look like: 'Medication level 10%, requiring new pill within 15 minutes', will be encrypted using its own secret. The remote device 62 might in turn activate a signal at the nurse station to assure timely delivery of medication to the patient.

Case 4: Pill Coordination. A remote device may mediate coordination of pills. In Case 3 above, the pill reports that it is time for the next pill. Once the second pill is taken, and sends a 'ready to release' message encrypted with it's secret, the remote device 62 then sends an 'activate' message to this second pill and after proper acknowledgment, sends a 'shutdown' message to the first pill. Alternatively, a set of pills may be programmed to accept and decrypt the messages of the other pills in the set. In this way, all pills can hand off release to one another without an intermediary remote device 62. Case 5: Pill authenticates remote device. For increased security, the pill may wish to authenticate the remote device. In this case, the pill sends an encrypted request using the pill's secret: 'remote device please authenticate'. The remote device may then provide a second secret from the master database or rely only on the one secret that the pill already carries for responding that it is an authorized device (using a Message Authentication Code (MAC) or a Digital Signature). The second secret, if used, may be computed by the master database such as a function of time, or may be a fixed value stored for further authenticating the pill.

Turning to one example of a component for forming or creating a preferred tamper resistant bitstring 22, Fig. 4 shows a plurality of CMOS layers including a first active layer having particles 46 randomly dispersed in a particle coating 48, a passivation layer 44 covering metal sensors 42 (e.g., a comb structure), a lower metal layer 50, and a bulk layer 52 (e.g., a layer of other ICs in a pill).

The coating 48 may be of aluminophosphate, for example, which is doped with random dielectric particles 46 (e.g. TiO₂, SrTiO₃, BaTiO₃). The random dielectric particles 46 are of random size and shape with a relative dielectric constant differing from the dielectric constant of the coating layer 48. Sufficient randomness for the particles 46 is only obtained if the dielectric particles are smaller than the distance between the sensor parts. The PUF is embodied in the combination of the coating with the dielectric material. Challenging the CMOS results in a specific output that is partly and uniquely based on the PUF. In the instant embodiment, a challenge is an input of voltage of a certain frequency and amplitude applied to the sensors 42 at a certain point of the sensor array. The sensors 42 behave as a capacitor and therefore have a particular capacitance value when the voltage is applied, wherein the capacitance value is used to create the bitstring. That is, when the capacitance values of all sensors 42 are measured they are first quantized in a noise robust way (making use of a first set of helper data). That leads to a bitstring which can still contain some noise. In order to remove the noise, a discrete helper data algorithm or fuzzy extractor is used to derive a secure key.

The random capacitance value of the sensors 42 is based in part on the random sizes and shapes of the particles and the respective dielectric properties of the particles and coating material. If an input of voltage is applied with the exact same frequency and amplitude on a different CMOS, the random sizes and particles and the respective dielectric properties of the particles and coating are different. Hence, a different CMOS challenged in the same fashion will result in a different output due to the random characteristics of the combination of the coating with the dielectric material (i.e., the PUF). The PUF is inextricably tied to the original CMOS in such a way that the original CMOS device cannot be copied. Therefore, the appropriate bitstring can only be generated on the original CMOS device. The bitstring created or extracted from the original CMOS cannot be hacked or copied. After a pill has been manufactured, the enrolment process involves first communicating with the pill using the enrolment processor 60 and communicator 20, to read the unique identification information 22a of the bitstring 22 and store it in the master database to identify the pill. At this point any other information about the pill that is desirable is also stored as part of, or is associated from another database with, the unique identification, such as (but not limited to) the type and amount of the medicine in the reservoir if the pill is of this type, or the radiation dosage in the pill, or other parameters of the active function of the pill, as well as dosage and timing information (profiles) that have been stored in the memory of the pill or programmed into the pill's controller and timing circuits, if present. This additional information can be compared later with the actual dosage and timing used by the pill to check for compliance by the subject or for proper functioning of the pill.

Other ID information for the pill may include time limits with respect to when the pill must be used for a subject and/or geographic information with respect to where the pill may be used or activated. This will help ensure that the pill is used within the time and geographic limitations set by the manufacturer for use of that pill.

The forgoing identification step can take place without reading secret information 22b of the bitstring 22. At some point, however, the communicator 20 transmits this secret information 22b of the bitstring 22 to the enrolment processor which then correlates it to the unique identification information 22a in the master database as discussed above.

Having thus been registered in a secure manner in the master database, the pill can be used for a subject and can thereafter be positively identified and correctly controlled, or its information correctly accessed, only by an authorized remote device 62 with authorized access to the master database.

Technical solutions are provided for technical problems that may assist a physician in reaching a diagnosis or treating a patient.

The invention is not limited to the disclosed embodiments. Also, the word "comprising" does not here exclude other elements or steps, and use of the words "a" or "an" does not exclude a plurality. Further, a single processor or other unit may fulfill the functions of several elements recited in the claims, and features recited in separate dependent claims may be advantageously combined. Also, a PLA (programmable logic array) or static memory with processor is capable of performing the logic within the pill. Reference signs in the claims should not be construed as limiting the scope. While specific embodiments of the invention have been shown and described in detail to illustrate the application of the principles of the invention, it will be understood that the invention may be embodied otherwise without departing from such principles.

Claims

CLAIMS:

1. A pill arrangement comprising: a shell (12); a processor (26) in the shell, the processor having a controller (16) for controlling an active function of the arrangement; a communicator (20) at least for receiving control signals for controlling the active function; and a bitstring (22) containing unique identification information (22a) for uniquely identifying the pill.

2. A pill arrangement according to claim 1, including an enrolment processor (60) outside the shell, for reading the bitstring and for storing the unique identification information in a pill database that associates the identification information with a specific pill.

3. A pill arrangement according to claim 1, wherein the bitstring (22) also contains secret information (22b) for encrypting communication via the communicator, the arrangement including a remote device (62) for reading the secret information for decrypting the encrypted communication .

4. A pill arrangement according to claim 1, wherein the bitstring is derived from a tamper resistant physical uncloneable function.

5. A pill arrangement according to claim 1, wherein the bitstring is derived from a tamper resistant physical uncloneable function embodied in at least one complementary metal oxide semiconductor layer.

6. A pill arrangement according to claim 1, including a medicine reservoir (14) in the shell, the controller (16) functioning to release medicine from the reservoir at selected dosage and timing profiles, the bitstring (22) also containing secret information (22b) for encrypting communication via the communicator.

7. A pill arrangement according to claim 1, including a medicine reservoir (14) in the shell for releasing medicine as at least part of the active function, the controller (16) functioning to release medicine from the reservoir at selected dosage and timing profiles, the pill arrangement including a pill memory (18) for storing information including the profile.

8. A pill arrangement according to claim 1, wherein the communicator (20) is a transceiver for both receiving control signals for controlling the active function and for transmitting information, the arrangement including a medicine reservoir (14) in the shell for releasing medicine as at least part of the active function, the controller (16) functioning to release medicine from the reservoir at selected dosage and timing profiles, the bitstring (22) also containing secret information (22b) for encrypting communication via the communicator, the arrangement including a pill memory (18) for storing information selected from the group consisting of core body temperature, pH, dosage profile, timing profile, and compliance information which includes actual dosage of medicine released, timing information of actual dosage released, or a comparison of dosage profile to actual dosage of medicine released or a comparison of timing profile to actual time of medicine released, and the active function also including transmitting the information to a remote device after authentication via the secret information.

9. A method of performing an active function in a subject, comprising: providing a pill having an ingestible shell (12), a processor (26) in the shell, the processor being in communication with a controller (16) for controlling an active function, a pill memory (18) for storing information about the active function of the arrangement, a communicator (20) for receiving control signals for controlling the active function and for transmitting, and a tamper resistant bitstring (22) containing unique identification information (22a) for uniquely identifying the pill and secret information (22b) for encrypting communication via the communicator; identifying the pill from outside the subject by reading the identification information via the communicator; authenticating permission to operate the controller to perform the active function from outside the subject using the secret information via the communicator; issuing at least one command to the controller to perform the active function from outside the subject and via the communicator; and performing the active function as a result of the authenticating step and the issuing step.

11. A system for reporting pill activity comprising: a pill inside of a patient having a means (16) for executing an active function inside of said patient and a communicator (20) for wirelessly sending information about the execution of the active function to a remote device (62) located outside of a patient; a remote device (62) for requesting the pill to wirelessly send said information to said remote device (62); and relay means (65) for receiving and relaying said information from said communicator to said remote device.

11. A system according to claim 10, wherein said information is compliance information selected from the group consisting of dosage profile for medicine to be released, timing profile for medicine to be released, a dosage of medicine released by said pill, a time at which the medicine was released, and a comparison report comparing a dosage of medicine required to be taken to an amount or dosage of medicine actually released, and comparison data comparing a time at which the medicine is required to be released to a time at which the medicine was released.

12. A system according to claim 10, wherein said pill further comprises a bitstring (22) containing unique identification information (22a) for uniquely identifying the pill.

13. A system according to claim 12, wherein the bitstring (22) also contains secret information (22b) for encrypting communication with the pill via the communicator (20), the arrangement including a remote device (62) for reading the secret information for decoding communication with the pill via the communicator (20).