Ravi Patel, Customer Admin

NP-200 system security design review

NimbusPump NP-200 Program · candidate AREV-0004 vs effective baseline DRB-0007

PRJ-2026-0042-DRV-0001Threat review

Architecture explorer

Normalized candidate model AREV-0004; activating a node opens its threats.

Elements

15

7 safety-relevant

Data flows

12

1 unauthenticated

Trust zones

3

device, hospital, cloud

Boundaries

3

1 unauthenticated

Data-flow view

Safety-relevant elements carry a red border; DF-000077 is highlighted as unauthenticated.

NP-200 candidate data-flow diagram (AREV-0004)Three trust zones: hospital clinical network, NP-200 device zone and Meridian cloud services. Twelve directed data flows connect fifteen elements; the dashed vertical line marks trust boundaries TB-001 and TB-003 at the device perimeter, and the dashed horizontal line marks TB-002 hospital-to-cloud egress. Flow DF-000077, the remote dosing command, crosses TB-003 and is highlighted because it is unauthenticated in the candidate design.DF-000071 BLE clinician session, BLE 5.0 GATTDF-000072 Local dosing confirmation, Internal IPCDF-000073 Dosing actuation, Internal bus (interlocked)DF-000074 Drug library read, Internal store accessDF-000075 Audit event write, Internal store accessDF-000077 Remote dosing command, HTTPS / NP command API v1.4 (unauthenticated)DF-000079 Drug library push, TLS 1.2 proprietary syncDF-000081 Telemetry upload, MQTT over TLS 1.3DF-000082 Firmware package delivery, HTTPS staged downloadDF-000083 EHR order context, HL7v2 / FHIR R4 over TLSDF-000084 Maintenance diagnostic session, Serial console / SSH (service mode)DF-000085 Fleet status sync, HTTPS RESTClinician mobile appAE-000052EHR integration adapterAE-000053Pharmacy library workstationAE-000054 · safety-relevantField service laptopAE-000055NimbusLink Gateway edgeAE-000051 · safety-relevantBLE interface controllerAE-000046Dosing command processorAE-000042 · safety-relevantPump motor controllerAE-000041 · safety-relevantDrug library storeAE-000043 · safety-relevantAudit log storeAE-000044Firmware update agentAE-000045 · safety-relevantMaintenance diagnosticsAE-000047Provisioning serviceAE-000048Cloud telemetry ingestionAE-000061Fleet update distributionAE-000062 · safety-relevant

Trust assumption

  • Infusion dosing command processorAE-000042
    ProcessAdjacent networkImportedSafety-relevant4 threats
  • Pump motor controllerAE-000041
    Safety functionInternalImportedSafety-relevant1 threat
  • Drug library storeAE-000043
    Data storeInternalImportedSafety-relevant1 threat
  • Pump audit log storeAE-000044
    Data storeInternalImported2 threats
  • Firmware update agentAE-000045
    ProcessAdjacent networkImportedSafety-relevant1 threat
  • BLE interface controllerAE-000046
    InterfaceAdjacent networkImported1 threat
  • Maintenance diagnostic serviceAE-000047
    ProcessPhysicalImported3 threats
  • Device provisioning serviceAE-000048
    ProcessAdjacent networkImportednone active