[MED-003] Standard Ebook | Chapter 6 (of 8)

Chapter 6: Phase 3 - Communication Protocols

6.1 Bluetooth LE Protocol

Service UUID: 00001820-0000-1000-8000-00805f9b34fb

Characteristics:

• Device Info (Read)
• Signal Config (Read/Write)
• Data Stream (Notify)
• Control Commands (Write)
• Status (Notify)

6.2 WiFi/TCP Protocol

// TLS Socket Connection
const client = tls.connect(8883, deviceIP, {
  ca: [caCertificate],
  checkServerIdentity: verifyDeviceCertificate
});

client.on('data', (packet) => {
  const data = decodeWIA(packet);
  processVitalSignData(data);
});

6.3 MQTT Protocol

Topic Structure:
wia-med-003/
  ├─ {deviceId}/
  │   ├─ data/ecg
  │   ├─ data/spo2
  │   ├─ alerts
  │   └─ control
  └─ broadcast/discovery

6.4 WebSocket Protocol

const ws = new WebSocket('wss://api.example.com/stream');

ws.onopen = () => {
  ws.send(JSON.stringify({
    command: 'start',
    signalType: 'ECG'
  }));
};

ws.onmessage = (event) => {
  const data = JSON.parse(event.data);
  updateECGChart(data);
};

6.5 Protocol Selection Guide

6.6 Security Requirements

• Encryption: TLS 1.3, AES-256
• Authentication: OAuth 2.0, FIDO2
• Compliance: HIPAA, GDPR

6.7 Federation Across Hosts

Multiple WIA Vital Sign Streaming hosts (a hospital ICU, an ambulance, a remote monitoring service) federate so a patient's signal can follow the patient across care boundaries without re-instrumentation. The roles and handshake state machine are defined in the Phase 3 specification; this chapter walks through how those mechanics surface to integrators.

6.7.1 Roles

• Producer — holds the device-side stream and signs frames.
• Consumer — subscribes to one or more streams (clinician dashboard, EHR bridge, alert routing service).
• Custodian — holds the patient's consent envelope and authorises which consumers may subscribe.
• Auditor — holds the audit log of every subscription and replay request.

6.7.2 Patient Consent Envelope

{
  "wia_vital_sign_streaming_version": "1.0.0",
  "type": "patient_consent",
  "patient_id": "did:wia:patient:01HXY",
  "custodian_id": "did:wia:custodian:hospital-A",
  "scope": ["icu", "remote_monitoring"],
  "valid_from": "2026-04-27T00:00:00Z",
  "valid_until": "2026-05-27T00:00:00Z",
  "consent_artefact_url": "https://omni.example/consent/01HXY/2026-04-27.pdf",
  "signature": { "alg": "Ed25519", "value": "AY3o..." }
}

Producers and consumers MUST refuse subscription requests whose patient identifier lacks an active consent envelope from the custodian, except in declared emergency scope (scope = ["emergency"]) which auto-expires after 24 hours and triggers a mandatory custodian review.

6.8 Replay Defence

Each signed envelope (frame, descriptor, alert, subscribe, replay request) carries a 96-bit nonce and an RFC 3339 timestamp. Receivers MUST reject envelopes with skew > ±300 s, reject envelopes whose (signer, nonce) tuple has been seen within the last 600 s, and maintain the seen-nonce cache for at least 600 s. For high-rate frame streams the cache MAY be a Bloom filter; false positives MUST trigger a replay-segment fetch rather than a silent drop.

6.9 Audience Controls