System architecture

System overview

The purpose the Corsano System is to provide a secure and reliable platform for vitals parameters continuous monitoring. The system is intended to gather, store, process and utilize data collected by the medical Corsano Bracelet and third-party medical devices. The Corsano System includes a Cloud platform architecture and developed using Amazon Web Services (AWS) assets and functionalities. AWS supports security standards and compliance certifications necessary to implement secure and private medical cloud solutions (https://aws.amazon.com/compliance/).

Corsano CardioWatch 287-2 System overview

The Corsano Bracelet and third-party medical devices collect various vitals sign and physiological data such as Pulse Rate, SpO2, Respiration Rate, Temperature, Blood Pressure, Spirometry and Weight. The sensor data is first sent to the mobile phones and gateways via Bluetooth Low Energy (BLE) communication, and then delivered to the cloud through REST APIs over HTTPs. Recorded data in the Corsano Bracelet is analyzed with algorithms to calculate the Vital Parameters that are reported by the system.

Corsano Cloud Storage process

The Corsano Cloud is designed and deployed with AWS serverless architectures. Serverless architecture is an approach to software design that allows developers to build and run services without having to manage the underlying infrastructure. Cloud applications can be deployed and AWS services configured to manage the storage and scalability of the system. Corsano uses serverless technologies provided by AWS and Atlas MongoDB such as EC2, S3, Elasticache, CloudWatch, IAM, KMS, etc.
– Data ingestion and storage: Atlas MongoDB, Corsano proprietary APIs.
– Data access: S3 archived files, Atlas MongoDB.
Daily backups of S3 instance and Atlas MongoDB databases are performed.

Security and Data Privacy

Security best practices

Security and Data Privacy is ensured at different level of the Corsano CardioWatch 287-2 System. AWS takes care of the physical, infrastructure and system level securities, by providing highly secured features and HIPAA compliant instances. The Corsano System is also responsible for Security and Data Privacy. Role based data access with least privilege approach is managed with AWS Identity Access Management (IAM) and reduces the risks of intrusion. Corsano Cloud REST APIs are based on strong authentication technology and segregates Personal Information and Medical Information, to limit the risk of Data Privacy breach. Data encryption is activated at all levels of communication, in transit and at rest. REST APIs use a high level of encryption (TLS1.2+). Data storage uses the industry standard AES-256 encryption.

The encryption keys are managed by AWS KMS, which is a fully centralized key management service that creates and manages cryptographic keys and control their use across a wide range of AWS services. The data from sensor devices is sent to mobile devices via encrypted Secure BLE, using proprietary protocols, and then from mobile devices to cloud via SSL encrypted HTTP protocol. The data is stored locally in sensor devices, mobile, and cloud with various form of encryption following the policy of data encryption at rest. In the BLE transmission, the proprietary and private protocol adds an extra layer of encryption. Data packets are deciphered by the Corsano App to retrieve the vital parameters. In the HTTPs transmission, JSON is the used format to enable efficient operability.

The Corsano Bracelet continuously measures Pulse Rate, SpO2, Respiration Rate and Skin Temperature. Data can only be accessed by BLE commands with Corsano private protocol.

All BLE communications are encrypted with unique keys unique. Thus, data from Corsano
Bracelet can only be retrieved by Corsano App.

The External Devices can perform spot measurements of vital parameters and continuous measurement of axillary temperature. Compatible devices are FDA Cleared or FDA Listed and have a high level of security, ensured by secure Bluetooth Low Energy and private encrypted protocols.

Bluetooth data transmission is ensured by the application encrypted private protocol. The Bluetooth layer provides the Security Management (SM) Security, which can recognize BLE data encryption and decryption through key distribution. The underlying Bluetooth protocol uses AES 128-bit symmetric encryption algorithm. The 128-bit key length can provide sufficient security. During Bluetooth pairing, key negotiation and key establishment are completed. In the first phase of pairing, pairs exchange pairing features. In the second stage, the key is generated. In the third phase, the Key is distributed. During the Key distribution, the Short Term Key (STK) or Long Term Key (LTK) generated in the second phase is used to encrypt links, preventing the Key from being directly intercepted. After the pairing binding is completed, the paired dual-transmission communication links encrypt and decrypt packets according to the negotiated key. Even if the data packet is intercepted in the air, it is encrypted data.

Need more details? Please check out these documents regarding security and certification.

Cloud architecture

The Corsano System includes a Cloud platform architecture developed using Amazon Web Services (AWS) assets and functionalities. AWS supports security standards and compliance certifications necessary to implement secure and private medical cloud solutions. See AWS Compliance site for more details.

Corsano Cloud overview

In the cloud, AWS Virtual Private Cloud (VPC), private subnet, security group and IAM are used to ensure network and system level security of the Corsano System. Data is stored encrypted in the private subnet that is only accessible through preconfigured channels and designated entry points. For external access, bastion servers, firewalls and multifactor authentication ensure the security of communications. Comprehensive API security measures which include robust authentication, encryption, input validation, rate limiting, logging, and token management form part of testing. In addition, an API gateway for centralized control and routine security testing is to be conducted following changes to the APIs. Furthermore, CORS configuration, ensured data integrity through validation and encoding, and maintaining up-to-date dependencies are also part of this scope. Developer education, establishment of an incident response plan, and commitment to continuous improvement for sustained resilience against emerging threats is considered as the key focus.