EP3032845B1

EP3032845B1 - Hearing device configured to authenticate a mode request and related method

Info

Publication number: EP3032845B1
Application number: EP14197819.7A
Authority: EP
Inventors: Brian Dam Pedersen; Allan Munk VENDELBO
Original assignee: GN Hearing AS
Current assignee: GN Hearing AS
Priority date: 2014-12-12
Filing date: 2014-12-12
Publication date: 2020-02-05
Anticipated expiration: 2034-12-12
Also published as: EP3668120A1; DK3032845T3; EP3668120B1; EP3032845A1; EP4440158A2

Description

The present disclosure relates to a hearing device and in particular to hearing device and related method for configuration or operation of a hearing device.

BACKGROUND

The functionality of a hearing device becomes increasingly advanced. Wireless communication between a hearing device and external devices, such as hearing device fitting apparatus, remote controllers, tablets and smart phones, has evolved. Typically, a wireless communication interface of a hearing device uses open standard-based interface. However, this poses many challenges in terms of security. A hearing device may assume any incoming data as legitimate, and may allow memory to be written or changed by an unauthorized party. Any such attacks may result in a malfunction of the hearing aid, or a battery exhaustion attack.
US 2005/0069161 relates to a method and apparatus for improving interference suppression processing and control in hearing aids communicating with a mobile station over a short-range wireless network. The hearing aid includes an acoustic echo canceller to suppress acoustic echo from the input audio signals. The mobile station also includes an echo canceller, and may include one or more switching circuits to bypass the echo canceller when the mobile station communicates with the hearing aid via the short-range wireless network.
US 2008/0165994 relates to a hearing aid device enabled with a Bluetooth transceiver, allowing the user to communicate with linked, Bluetooth enabled mobile radio or telephone. Mobile phone receives a communication, encodes it in accordance with the Bluetooth protocol and links with the transceiver, which is housed with the hearing aid.
US 2014/0211972 relates to a method of fitting a hearing aid connected to a mobile terminal. The method may include acquiring location information of a location of the mobile terminal, transmitting the location information to a server, receiving, from the server, information about at least one recommended fitting parameter model adapted to hearing conditions of the location and hearing characteristics of a user of the hearing aid, and displaying the information about the at least one recommended fitting parameter model. The method may also include receiving a fitting parameter model selected by the user from among the at least one recommended fitting parameter model, and controlling the hearing aid to function according to the received fitting parameter model.
US2007/0230711 shows a system of a fitting device and several hearing aids which can be fitted by the fitting device. An identification procedure which is executed before a wireless link is established between the fitting device and the hearing aids makes sure that only a desired hearing aid is fitted.

SUMMARY

There is a need for a hearing device with reduced risk of a third party accessing any part of the hearing device. In particular there is a need for a hearing device that is protected against unauthorized modification of the hearing device and operation thereof.
Disclosed is a hearing device comprising a processing unit configured to compensate for hearing loss of a user of the hearing device, a memory, and an interface. The processing unit/hearing device may be configured to receive a mode request via the interface; authenticate the mode request; and place the hearing device into the requested mode if authentication of the mode request succeeds.
Also disclosed is a method for configuration of a hearing device comprising a processing unit configured to compensate for hearing loss of a user of the hearing device, a memory, and an interface. The method may comprise receiving a mode request via the interface; authenticating the mode request; and placing the hearing device into the requested mode if authentication of the mode request succeeds.
The method and hearing device as disclosed provide secure configuration of the hearing device, such as secure access to the memory of the hearing device. It is an advantage of the present disclosure that the hearing device can only be configured or updated by authorized parties. The disclosed hearing device thus has the advantage of detecting and preventing any modification by unauthorized parties. The hearing device disclosed herein is advantageously protected against attacks such as spoofing attacks, man-in-the-middle attacks, and/or replay-attacks.
The method and apparatus as disclosed provides a secure configuration and/or update of a hearing device.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other features and advantages will become readily apparent to those skilled in the art by the following detailed description of exemplary embodiments thereof with reference to the attached drawings, in which:

Fig. 1: schematically illustrates an exemplary architecture according to this disclosure,
Fig. 2: schematically illustrates an exemplary hearing device,
Fig. 3: schematically illustrates an exemplary signalling diagram,
Fig. 4: schematically illustrates an exemplary signalling diagram, and
Fig. 5: schematically illustrates a flowchart of an exemplary method

DETAILED DESCRIPTION

Various embodiments are described hereinafter with reference to the figures. Like reference numerals refer to like elements throughout. Like elements will, thus, not be described in detail with respect to the description of each figure. It should also be noted that the figures are only intended to facilitate the description of the embodiments. They are not intended as an exhaustive description of the claimed invention or as a limitation on the scope of the claimed invention. In addition, an illustrated embodiment needs not have all the aspects or advantages shown. An aspect or an advantage described in conjunction with a particular embodiment is not necessarily limited to that embodiment and can be practiced in any other embodiments even if not so illustrated, or if not so explicitly described.
Throughout, the same reference numerals are used for identical or corresponding parts.
It is an object of the present disclosure to provide a hearing device, and a method which seeks to mitigate, alleviate, or eliminate one or more of the above-identified deficiencies in the art and disadvantages singly or in any combination.
The present disclosure provides improved security of a hearing device. Security comprise assessing threats, vulnerabilities and attacks and developing appropriate safeguards and countermeasures to protect against threats and attacks.
The hearing device comprises a processing unit. The processing unit is configured to compensate for hearing loss or other hearing disability of a user of the hearing device.
The hearing device may be operated in one or more modes. The one or more modes may include a first mode and/or a second mode. The one or more modes may include a third mode and/or a fourth mode. The one or more modes may include a default mode.
The first mode may be a service mode. A service mode may be characterized in that a firmware part of the memory can be written in the service mode. The firmware part of the memory may be write-protected in at least one other mode of the hearing device.
The second mode may be a fitting mode. A fitting mode may be characterized in that a fitting part of the memory can be read and/or written in the fitting mode. A fitting mode may be characterized in that a firmware part of the memory is write-protected. The fitting part of the memory may comprise fitting data, such as hearing loss parameters, compressor parameters, filter coefficients, and/or gain coefficients.
The third mode may be a debug mode. A debug mode may be characterized in that a debug part of the memory can be read and/or written in the fitting mode. A debug mode may be characterized in that a fitting part of the memory can be read and/or written in the debug mode. A debug mode may be characterized in that a firmware part of the memory can be read and/or written in the debug mode. The debug part of the memory may be read-protected and/or write-protected in at least one other mode of the hearing device, such as in the default mode and/or the fitting mode.
The default mode may be a boot mode. A boot mode may be characterized in that the hearing device is operated according to operating parameters set during booting and/or in response to user input, e.g. program selection, volume up/down, etc. The default mode may be characterized in that the firmware part (or at least a part thereof) and/or the fitting part of the memory (or at least a part thereof) is write-protected and/or read-protected in the default mode. The default mode may be characterized in that the debug part of the memory (or at least a part thereof) is read-protected and/or write-protected in the default mode.
The hearing device comprises a memory. The memory may be embedded in the processing unit and/or be employed in a memory unit connected to the processing unit. The memory may comprise a first memory part. The first memory part may be a firmware part of the memory. The firmware part of the memory may be configured to be accessed in the service mode e.g. to be written to and/or read from in the service mode. The firmware part of the memory may additionally be configured to be accessed in the debug mode. The memory may comprise a second memory part. The second memory part may be a fitting part of the memory. The fitting part of the memory may be configured to be accessed in the fitting mode e.g. to be written to and/or read from in the fitting mode. The fitting part of the memory may additionally be configured to be accessed in the service mode and/or the debug mode. The memory may comprise a third memory part. The third memory part may be a debug part of the memory. The debug part of the memory may be configured to be accessed in the debug mode e.g. to be written to or read from in the debug mode.
The hearing device may comprise an interface configured for enabling communication between the hearing device and another device. The interface may comprise a wireless transceiver, e.g. configured for wireless communication at frequencies in the range from 2.4 to 2.5 GHz. The wireless transceiver may be a Bluetooth Low Energy transceiver. The interface may comprise a connector for forming a wired connection to the hearing device. The interface may form a connection to one or more other devices such as a tablet and/or a smart phone and/or a fitting device.
The processing unit/hearing device is configured to receive a mode request via the interface. The mode request may comprise a mode identifier indicative of the requested mode. The mode request may be a service mode request, e.g. the mode identifier is indicative of a first/service mode. The mode request may be a fitting mode request, e.g. the mode identifier is indicative of a second/fitting mode. The mode request may be a debug mode request, e.g. the mode identifier is indicative of a third/debug mode. Accordingly, the mode request may be one of a service mode request, a fitting mode request, and a debug mode request.
The mode request may comprise a sender identifier indicative of the mode request sender. The mode request may comprise a certificate, such as a digital signature, for certifying the mode request sender. This allows for direct authentication of the mode request. The mode request may comprise a session identifier, e.g. an encrypted session identifier.
The hearing device may be paired with a sender of the mode request prior to receipt of the mode request. In the pairing, the hearing device and the sending/client device device may have exchanged one or more of hearing device identifier, sender identifier, session identifier, etc.
The processing unit/hearing device is configured to authenticate the mode request and to place the hearing device into the requested mode if authentication of the mode request succeeds. The processing unit may be configured to place the hearing device into a mode different from the requested mode, such as the default mode, if authentication of the mode request fails.
The hearing device disclosed herein has the advantage of verifying integrity of received mode requests and/or senders thereof, detecting any alteration and disregard altered mode requested. The hearing device disclosed herein may advantageously allow access to specific parts of the memory only with authenticated parties, such as an authenticated fitting device, an authenticated accessory device, an authenticated external device and/or an authenticated server.
The processing unit may be configured to authenticate the mode request by authenticating the sender of the mode request.
The processing unit/hearing device may be configured to authenticate the mode request by verifying integrity of a digital signature of the mode request.
The processing unit may be configured to authenticate the mode request by verifying integrity of the mode request. The mode request may comprise a message authentication code. To verify integrity of the mode request may comprise to verify the message authentication code, e.g. with a session identifier stored in the hearing device. The mode request may comprise a digital signature or certificate. To verify integrity of the mode request may comprise verifying the digital signature or certificate.
The processing unit/hearing device may be configured to send a mode response. For example, to place the hearing device into the requested mode if authentication of the mode request succeeds may comprise sending a mode response. The processing unit/hearing device may be configured to generate and/or send a mode response in response to the mode request. The processing unit may be configured to obtain and/or store a session identifier (may also be denoted session key) and include the session identifier and/or an encrypted version thereof in the mode response. To obtain the session identifier may comprise to generate the session identifier, e.g. as a random or pseudo-random number. Thus the hearing device and/or the processing unit may comprise a number generator, e.g. configured to generate a random or pseudo-random number as a session identifier. By using a unique session identifier or session identifier from a large number of available session identifiers, the processing power requirements in the hearing device may be reduced. Further, simple encryption is facilitated and replay-attacks are prevented.
The processing unit may be configured to encrypt the session identifier, optionally based on a hearing device key. The session identitier may be a session key in the form of a symmetric key. A symmetric session key may provide a lightweight processing of the security algorithms on the processing unit, such as lightweight encryption, lightweight decryption, lightweight integrity protection, etc. The hearing device key may be a symmetric key or a public key of a private-public key pair. The hearing device key may be stored in a permanent memory of the hearing device, e.g. during manufacture or during a fitting session.
The mode response may comprise the encrypted session key. The session response may comprise a hearing device identifier and/or the session key. Thus, the processing unit may be configured to send a hearing device identifier and/or the session key in the mode response. A mode response comprising a hearing device identifier may enable the sender of the mode request to obtain the hearing device key, either from a database or by requesting the hearing device key from the manufacturer, which in turn enables the sender of the mode request to decrypt an encrypted session identifier/key and use the session identifier when sending data to the hearing device.
The mode request may be received in a session. The processing unit/hearing devic may be configured to terminate the session if authentication of the mode request fails.
The mode request may comprise a signature, and to authenticate the mode request may comprise to verify the signature of the mode request.
The processing unit may be configured to obtain, e.g. generate a session identifier, e.g. upon receipt of the mode request or when the hearing device is in a service mode, a fitting mode, or a debug mode. The processing unit may be configured to encrypt the session identifier, e.g. with a hearing device key. The processing unit may be configured to transmit the session identifier or the encrypted session identifier via the interface, e.g. as a part of the mode response or a session setup message. The processing unit may be configured to store the session identifier in the hearing device.
The processing unit may be configured to receive data via the interface, e.g. when the hearing device is in a mode, e.g. the service mode, the fitting mode and/or the debug mode. The processing unit may be configured to authenticate the received data, e.g. when the hearing device is in one or more modes, e.g. the service mode, the fitting mode and/or the debug mode. The processing unit may be configured to store hearing device data in a part of the memory based on the received data if authentication of the data succeeds. For example, when the hearing device is in a service mode, the processing unit may store hearing device data, such as e.g. firmware, based on the received data in the firmware part of the memory. In an exemplary hearing device, the processing unit may, when the hearing device is in a fitting mode, store hearing device data (fitting data) based on the received data in the fitting part of the memory. In an exemplary hearing device, the processing unit may, when the hearing device is in a debug mode, store hearing device data (debug data) based on the received data in the debug part of the memory.
The processing unit may be configured to authenticate the received data by verifying integrity of the received data. Verifying integrity of the received data may be based on the session identifier stored in the hearing device. The received data may comprise a message authentication code. To verify integrity of the received data may comprise to verify the message authentication code, e.g. with the stored session identifier. The received data may comprise a digital signature. To verify integrity of the received data may comprise verifying the digital signature.
The data may comprise a session identifier, and to authenticate the data may comprise to compare the session identifier of received data with the session identifier stored in the hearing device.
The data may be received in a session. The processing unit may be configured to terminate the session if authentication of the received data fails, e.g. the processing unit may be configured to terminate the session if integrity of the received data is corrupted, i.e. verification of the integrity fails. The processing unit may be configured to place the hearing device in another mode, such as the default mode, if authentication of the received data fails,
The hearing device/processing unit may be configured to receive a mode exit request and to place the hearing device in another mode, such as the default mode, e.g. if an authentication of the mode exit request succeeds. For example, a client device may send a mode exit request when fitting or transfer of firmware is done.
The disclosed method provides secure configuration and/or update of a hearing device. The method may comprise placing the hearing device into a default mode if authentication of the mode request fails. The method may comprise determining if operation in default mode fails, and switching to service mode if operating the hearing device in default mode fails,
In the method, authenticating the mode request may comprise authenticating the sender of the mode request.
In the method, the mode request may comprise a digital signature, and authenticating the mode request may comprise verifying the digital signature.
In the method, authenticating the mode request may comprise verifying integrity of the mode request.
The method may comprise receiving data via the interface, e.g. when the hearing device is in one or more modes, e.g. the service mode, the fitting mode and/or the debug mode. The method may comprise authenticating the received data, e.g. when the hearing device is in one or more modes, e.g. the service mode, the fitting mode and/or the debug mode. The method may comprise storing hearing device data in a part of the memory based on the received data if authentication of the data succeeds. For example, when the hearing device is in a service mode, the method may comprise storing hearing device data (firmware) based on the received data in the firmware part of the memory. In an exemplary method, the method may, when the hearing device is in a fitting mode, comprise storing hearing device data (fitting data) based on the received data in the fitting part of the memory. In an exemplary method, the method may, when the hearing device is in a debug mode, comprise storing hearing device data (debug data) based on the received data in the debug part of the memory. The method may comprise placing the hearing device in another mode, such as the default mode, if authenticating the received data fails.
The processing unit may be configured to operate the hearing device in default mode, and switch to service mode if operating the hearing device in default mode fails,
Fig. 1 schematically illustrates an exemplary architecture 100 according to this disclosure. The architecture 100 comprises a hearing device 101, a client device 110, and a server device 111. The client device 110 may comprise a computing device acting as a client, a fitting device, a handheld device, a relay, a tablet, a personal computer, a mobile phone, and/or USB dongle plugged into a personal computer. The server device 111 may comprise a computing device configured to act as a server, i.e. to serve requests from the client device 110 and/or from the hearing device 101. The server device 111 may be controlled by the hearing device manufacturer.
The hearing device 101 may be connected to the client device 110 via a communication link 113, such as a bidirectional communication link and/or a wireless communication link. The wireless communication link may be carried over a short-range communication system, such as Bluetooth, Bluetooth low energy, IEEE 802.11, Zigbee. The hearing device 101 may be connected to the client device 110 over a network.
The hearing device 101 may be connected to the server device 111 via a communication link 114 over a network 114a, such as a bidirectional and/or wireless communication link over a network.
The client device 110 may be connected to the server device 111 via a communication link 112 over a network 112a, such as a bidirectional and/or wireless communication link over a network. In an embodiment, the network 112a may be the Internet.
Fig. 2 schematically illustrates an exemplary hearing device 101. The exemplary hearing device 101 comprises a processing unit 202 configured to compensate for hearing loss of a user of the hearing device 101. The exemplary hearing device 101 comprises a memory and an interface 204. The memory is in Fig. 1 illustrated in the form of a memory unit 203 external to the processing unit 202. The memory may in other exemplary hearing devices be at least partly embedded in the processing unit 202 and/or in the memory unit 203.
The processing unit 202 is configured to receive a mode request via the interface 204. Hence, the processing unit 202 comprises a receive/send unit 205 configured to send and/or receive via the interface 204. The receive/send unit 205 is configured to send and receive via the interface 204 to/from an external device, such as a server device, a client device, a fitting device, an accessory, a relay device, a smart phone. The processing unit 202 is configured to authenticate the mode request. Hence, the processing unit 202 may comprise an authenticator 206 configured to authenticate the mode request. The processing unit 202 is configured to place the hearing device into the requested mode, such as a service mode, a fitting mode or debug mode, if authentication of the mode request succeeds. Hence the processing unit 202 comprises a mode controller configured to place the hearing device into the requested mode, e.g. based on an output from the authenticator 206. In the hearing aid in Fig. 2, the processing unit 202 is configured to place the hearing device into a default mode if authentication of the mode request fails, the default mode comprising booting the hearing device and operating the hearing device according to operating parameters set during booting. In an embodiment, the operating parameters set during booting may be stored in a non-volatile part of the memory unit 203. In an embodiment, the operating parameters set during booting may comprise a default setting enabling the hearing aid to function according to a default setting programmed during production of the hearing device.
The hearing device comprises a microphone 210 for receiving a sound signal and converting it into converted sound signal. The converted sound signal may be an electrical and digital version of the sound signal. The processing unit is configured to receive and process the converted sound signal into a processed sound signal according to a hearing loss of a user of the hearing device. The processed sound signal may be compressed and/or amplified or the like. The hearing device further comprises an output transducer/loudspeaker, known as a receiver 212. The receiver 212 is configured to receive the processed sound signal and convert it to an output sound signal for reception by an eardrum of the user.
Fig. 3 shows an exemplary signalling diagram 300 between a hearing device 101, and a client device 110. In an embodiment, the client device may be in the form of a fitting device. The hearing device 101 receives a fitting mode request 301 via the interface 204 from the client device 110, the mode request comprising a digital signature and a mode identifier. The digital signature may be a signature according to the Digital Signature Standard or other suitable standards, such as RSA. for digital signatures known in the art.. The hearing device 101 authenticates the mode request by verifying the digital signature. In the illustrated signalling diagram 300, the authentication succeeds, and the processing unit places the hearing device in the fitting mode including sending a fitting mode response 302 to the client device via the interface 204. In the fitting mode of hearing device 101, a firmware part of the memory is write-protected and a fitting mode part of the memory is write-enabled.
Upon receipt of the fitting mode response 302, the client device 110 sends data 303 to the hearing device 101 which receives the data and authenticates the received data 303, e.g. by use of digital signature or a session identifier/key as described earlier. If authentication of data 303 succeeds, the processing unit 202 derives hearing device data (fitting data) from the data 303 and stores hearing device data (fitting data) in a fitting part of the memory. If authentication of data 303 fails, the processing unit 202 places the hearing device in default mode.
When the fitting data have been transferred, the client device may send a mode exit request and the hearing device is configured to optionally authenticate the mode exit request and to place the hearing device in the default mode, optionally if authentication of the mode exit request succeeds.
In another embodiment, the client device may be in the form of a smart phone or a tablet and may comprise software configured to provide the functionality of a fitting device.
Fig. 4 shows an exemplary signalling diagram 300' where a client device 110 is used for updating firmware of the hearing device 101, and a client device 110 in the form of a fitting device. The hearing device 101 receives a service mode request 304 via the interface 204 from the client device 110. The hearing device 101 authenticates the service mode request. In the illustrated signalling diagram 300', the authentication succeeds, and the processing unit 202 places the hearing device in the service mode including sending a service mode response 305 to the client device via the interface 204. In the service mode of hearing device 101, the processing unit 202 is allowed to write to a firmware part of the memory.
Upon receipt of the service mode response 305, the client device 110 sends data 306 to the hearing device 101 which receives the data and authenticates the received data 306, e.g. by use of digital signature or a session identifier/key as described earlier. Before sending data to the hearing device, the client device 110 may correspond with a server device 111 as illustrated with dotted arrows 307, 308, e.g. in order to determine the data 306 to be sent to the hearing device. If authentication of data 306 succeeds, the processing unit 202 derives hearing device data (firmware data) from the data 306 and stores hearing device data (firmware data) in a firmware part of the memory. If authentication of data 306 fails, the processing unit 202 may place the hearing device in default mode and/or terminate the session.
When the firmware has been transferred, the client device may send a mode exit request and the hearing device is configured to optionally authenticate the mode exit request and place the hearing device in the default mode, optionally if authentication of the mode exit request succeeds.
Fig. 5 illustrates an exemplary flowchart of a method 400, e.g. for configuration of a hearing device, such as hearing device 101, comprising a processing unit configured to compensate for hearing loss of a user of the hearing device, a memory, and an interface. The method 400 comprises receiving 401 a mode request via the interface and authenticating 402 the mode request. Authenticating 402 the mode request comprises authenticating the sender of the mode request and verifying integrity of the mode request. If authentication of the mode request succeeds 404, the method proceeds to placing 403 the hearing device into the requested mode. If authentication of the mode request fails 404, the method optionally proceeds to placing 405 the hearing device into a default mode. After placing the hearing device in the requested mode, the method optionally proceeds to receiving 408 data via the interface, authenticating 410 the received data; and storing 412 hearing device data in a part of the memory corresponding to the requested mode and based on the received data if authentication of the data succeeds. If authenticating 410 the received data fails, the method may proceed to placing 405 the hearing device in default mode or another mode and/or terminating the session. Upon storing, the method 400 optionally comprises to evaluate 414 whether a mode exit request has been received. If so, the method proceeds to placing 405 the hearing device in default mode. If not, the method proceeds to receiving 408 data.
The use of the terms "first", "second", "third" and "fourth", etc. does not imply any particular order, but are included to identify individual elements. Moreover, the use of the terms first, second, etc. does not denote any order or importance, but rather the terms first, second, etc. are used to distinguish one element from another. Note that the words first and second are used here and elsewhere for labelling purposes only and are not intended to denote any specific spatial or temporal ordering. Furthermore, the labelling of a first element does not imply the presence of a second element and vice versa.
Although particular features have been shown and described, it will be understood that they are not intended to limit the claimed invention.

LIST OF REFERENCES

100 architecture
101 hearing device
111 server device
202 processing unit
203 memory unit
204 interface
205 receive/send unit
206 authenticator
207 mode controller
210 microphone
212 receiver
300, 300' signalling diagram
301 fitting mode request
302 fitting mode response
303 data
304 service mode request
305 service mode response
306 data
307 firmware request
308 firmware response
400 method for configuration of a hearing device
401 receiving mode request
402 authenticating mode request
403 placing hearing device in requested mode
404 authentication ok?
405 placing hearing device in default mode
408 receiving data via the interface
410 authenticating the received data
412 storing hearing device data
414 evaluating if mode exit request has been received

Claims

A hearing device (101) comprising
- a processing unit (202) configured to compensate for hearing loss of a user of the hearing device;

- a memory (203); and

- an interface (204),
wherein the processing unit (202) is configured to:
- receive a mode request via the interface, wherein the mode request is one or more of a service mode request for a service mode, a fitting mode request; and a debug mode request, wherein the service mode is characterized in that a firmware part of the memory (203) is writable;

- authenticate the mode request; and

- place the hearing device into the requested mode if authentication of the mode request succeeds.
A hearing device according to claim 1, wherein the processing unit is configured to place the hearing device into a default mode if authentication of the mode request fails.
A hearing device according to claim 2, wherein the default mode comprises booting the hearing device and operating the hearing device according to operating parameters set during booting.
A hearing device according to any of claims 1-3, wherein the processing unit is configured to authenticate the mode request by authenticating the sender of the mode request.
A hearing device according to any of the preceding claims, wherein the processing unit is configured to authenticate the mode request by verifying integrity of the mode request.
A hearing device according to any of the preceding claims, wherein to place the hearing device into the requested mode if authentication of the mode request succeeds comprises sending a mode response.
A hearing device according to any of the preceding claims, wherein the mode request is received in a session and the processing unit is configured to terminate the session if authentication of the mode request fails.
A hearing device according to any of the preceding claims, wherein the mode request comprises a signature, and wherein to authenticate the mode request comprises to verify the signature of the mode request.
A hearing device according to any of the preceding claims, wherein when the hearing device is in a service mode, the processing unit is configured to generate a session identifier, to transmit the session identifier via the interface and to store the session identifier in the hearing device.
A hearing device according to any of the preceding claims, wherein when the hearing device is in a service mode, the processing unit is configured to receive data via the interface, wherein the processing unit is configured to authenticate the received data and store hearing device data in a part of the memory based on the received data if authentication of the data succeeds.
A hearing device according to claim 10 as dependent on claim 9, wherein the data comprises a session identifier, and wherein to authenticate the data comprises to compare the received session identifier with the session identifier stored in the hearing device.
A hearing device according to claim 10, wherein the data is received in a session and the processing unit is configured to terminate the session if authentication of the received data fails.
Method (400) for configuration of a hearing device comprising a processing unit configured to compensate for hearing loss of a user of the hearing device, a memory, and an interface, the method comprising:
receiving (401) a mode request via the interface, wherein the mode request is one or more of a service mode request for updating firmware data, a fitting mode request; and

a debug mode request;
- authenticating (402) the mode request; and

- placing (403) the hearing device into the requested mode if authentication of the mode request succeeds.
Method according to claim 13, the method comprising placing (405) the hearing device into a default mode if authentication of the mode request fails.
Method according to any of claims 13-14, wherein authenticating the mode request comprises authenticating the sender of the mode request.
Method according to any of claims 13-15, wherein authenticating the mode request comprises verifying integrity of the mode request.
Method according to any of claims 13-16, wherein when the hearing device is in a service mode, the method comprises:
- receiving (408) data via the interface,

- authenticating (410) the received data; and

- storing (412) hearing device data in a part of the memory based on the received data if authentication of the data succeeds.