Privacy-Preserving Self-Helped Medical Diagnosis Scheme Based on Secure Two-Party Computation in Wireless Sensor Networks

Abstract

With the continuing growth of wireless sensor networks in pervasive medical care, people pay more and more attention to privacy in medical monitoring, diagnosis, treatment, and patient care. On one hand, we expect the public health institutions to provide us with better service. On the other hand, we would not like to leak our personal health information to them. In order to balance this contradiction, in this paper we design a privacy-preserving self-helped medical diagnosis scheme based on secure two-party computation in wireless sensor networks so that patients can privately diagnose themselves by inputting a health card into a self-helped medical diagnosis ATM to obtain a diagnostic report just like drawing money from a bank ATM without revealing patients’ health information and doctors’ diagnostic skill. It makes secure self-helped disease diagnosis feasible and greatly benefits patients as well as relieving the heavy pressure of public health institutions.

1. Introduction

With the rapid development of science, more and more advanced technologies such as the internet of things and cloud computing are utilized in the area of modern medicine and this trend further pushes healthcare into the digital era [1–3]. Currently, numerous healthcare devices such as heart rate monitor, blood pressure monitor, and electrocardiogram are already popular in people’s normal life. It makes it convenient for people to be aware of their health situation by viewing the reports of these devices. Especially, by the growing use of sensor technology in telecare, the new field known as wireless body area networks (WBAN) [1, 4] has designed various sensor devices that can be used to supervise critical body parameters and activities anytime and anywhere. People can easily and conveniently get the health data by these advanced sensor devices [5] such as temperature measurement, respiration monitor, heart rate monitor, pulse oximeter SpO2, blood pressure monitor, pH monitor, glucose sensor, cardiac arrhythmia monitor/recorder, brain liquid pressure sensor, and endoscope capsule. What is more, these devices are becoming more functional and portable. More and more mobile medical monitors have already been used to serve us [2].

Therefore, people no longer worry about how to obtain the health data but are concerned about how to securely deal with these sensitive data to have disease diagnosis with a medical institution. Traditionally, the issue of privacy of medical data has been dealt with primarily as a policy problem [6, 7]. Many related laws have been issued to protect the privacy of patients. However, it is still far away from satisfactory and people still fear the leakage of their private data. Hence, the most efficient solution to this problem is to protect patients’ privacy in technology rather than in policy alone. In this aspect, most of previous literatures have introduced homomorphic encryption (HE) [8–10] to protect patients’ privacy in some privacy-preserving medical applications [11]. However, HE will inevitably introduce tremendous cost and is not applicable to practical large-scale applications. Therefore, in this paper, we focus on building a secure and practical privacy-preserving medical diagnosis system that can serve us in our daily life. Starting from the aspiration of the patient, the most secure and plausible diagnostic method is to apply the processed data rather than the original data to interact with the hospital which owns a disease database to diagnose the health status privately. Moreover, it requires that after diagnosis, the hospital gets nothing about the patient’s health data and the patient has no idea of the hospital’s disease database.

Inspired by daily used bank automated teller machine (ATM), we introduce the privacy-preserving self-helped medical diagnosis ATM (MD-ATM) so that after obtaining a healthcare card that stores some information about the health data which is collected by various sensor medical devices, patients can privately diagnose himself by inserting the health card into the MD-ATM to obtain diagnostic report just like drawing money from a bank ATM without revealing patient’s health information and the disease database or doctors’ diagnostic skill. When needing local computing, storing, or inputting some information, the patient uses his own portable device, called portable medical diagnostic device (PMDD).

In this paper, we will show how to realize this modern diagnosis system without HE. The main idea and technology we used in this scheme are secure two-party computation (STC) and oblivious transfer (OT). Firstly, we assume that patients themselves collect related data by various wireless sensor medical devices and further process and store them in their own health cards using PMDD. When diagnosing, the patient firstly transforms the original data locally and then inserts the card into the MD-ATM of the hospital to check up his health. Operating following the instructions of the MD-ATM, the patient will finally obtain a diagnostic report through OT and the patient then completes the self-helped diagnosis. In brief, our main contributions can be summarized as follows.

Our Contributions.(i)We build a new “patient-centered” medical diagnosis model in wireless sensor networks where patients themselves collect health data by various sensor medical devices while the hospital provides a disease database to help patients to complete disease diagnosis by themselves. Compared with traditional “doctor-centered” medical diagnosis model where patients have to depend on the doctor, our system is more appropriate especially when people pay more and more attention to privacy in wireless sensor networks.(ii)We firstly propose the privacy-preserving self-helped MD-ATM to construct a secure medical diagnosis scheme following the idea of STC. It makes secure self-helped medical diagnosis feasible and convenient just like drawing money from a bank ATM. It will greatly benefit patients as well as relieving the heavy pressure of public health institutions.(iii)We construct the self-helped medical diagnosis system based on OT without expensive HE. It provides us with another perspective to consider the problem of secure medical diagnosis for patients.

The rest of this paper is organized as follows. In Section 2, we briefly give an overview of secure two-party computation and oblivious transfer, and then we present our medical diagnosis system model in Section 3. In Section 4, we propose our privacy-preserving self-helped medical diagnosis scheme in detail and give a strict proof based on real-ideal simulation paradigm in Section 5. Finally, we summarize our work of this paper in the last section.

2. Preliminaries

2.1. Secure Two-Party Computation

Secure multiparty computation (SMC) is dedicated to deal with the problem of secure computation among distrustful participants. It was first introduced by Yao in 1982 [12] and then was extended by Goldreich et al. [13] and many other researchers [14–19]. Generally speaking, SMC is a method to implement cooperative computation with participants’ private data, ensuring the correctness of the computation as well as not disclosing additional information except the necessary results. It has become a research focus in the international cryptographic community due to its wide applications in various areas and a mass of research results have been published one after another. Secure two-party computation (STC) [20] is a special case in SMC where there are only two participants. The well-known millionaires’ problem [12] put forward by Yao is the representative problem of STC. In our discussing, we will consider the two-party case.

Generally speaking, STC is dedicated to computing a certain function between two mutually distrusted participants on their private inputs without revealing their private information. Informally, assuming that there are 2 participants, 𝑃₁, 𝑃₂, each of them has a private number, 𝑥₁, 𝑥₂, respectively. They want to cooperate to compute the function 𝑦=𝑓(𝑥₁,𝑥₂). A STC protocol is dubbed secure if no participant can learn more from the description of the public function and the result of the global calculation than what he can learn from his own information.

Formally, we usually analyze the security of a STC protocol using the real-ideal paradigm in the semihonest model where both of the two parties act semihonestly, following the protocol but making effort to gain more information about other parties’ inputs, intermediate results, or overall outputs by the transcripts of the protocol [15]. We can overview the real-ideal paradigm as follows.

Firstly, in the ideal world, we assume that the computation of the functionality 𝐹 on users private inputs is conducted by an additional trusted party, who receives 𝑥_𝑖 from user 𝑃_𝑖,𝑖=1,2, and returns the result 𝑓(𝑥₁,𝑥₂) to 𝑃_𝑖,𝑖=1,2. However, there is no trusted party in the real world and so the two parties have to run a protocol Π to get the desired result. During executing protocol Π, both parties act semihonestly. Herein, the view of the 𝑖th party during an execution of Π on 𝑥₁,𝑥₂ is denoted as VIEW^Π_𝑖(𝑥₁,𝑥₂), which contains 𝑃_𝑖’s input, random tape, and the messages received from the other party. For a deterministic private function 𝑓, we say that Π privately computes 𝑓 if there exist probabilistic polynomial-time algorithms 𝑆₁,𝑆₂, such that the simulated distribution {𝑆_𝑖(𝑥_𝑖;𝑓(𝑥₁,𝑥₂))} is indistinguishable to {VIEW^Π_𝑖(𝑥₁,𝑥₂)}, 𝑖=1,2. That is, 𝑆₁𝑥₁;𝑓𝑥₁,𝑥₂≅VIEW^Π₁𝑥₁,𝑥₂,𝑆₂𝑥₂;𝑓𝑥₁,𝑥₂≅VIEW^Π₁𝑥₁,𝑥₂. (1)

2.2. Oblivious Transfer

In cryptography, OT is a type of protocol in which a sender transfers one of potentially many pieces of information to a receiver but remains oblivious as to which piece has been transferred. It was firstly introduced by Rabin [21] in 1981. Therein, the sender sends a message to the receiver with probability 1/2, while the sender remains oblivious as to whether or not the receiver received the message. Rabin’s oblivious transfer scheme is based on the RSA cryptosystem. In 1985, Even et al. [22] proposed a more useful OT called 1-out-of-2 OT (OT²₁) to build protocols for secure multiparty computation.

Afterwards, it has been generalized to 1-out-of-𝑚 OT (OT^𝑚₁) [23] where the receiver gets exactly one message without the sender getting to know which message was queried and the receiver getting to know anything about the other messages that were not retrieved. OT^𝑚₁ has become a fundamental tool in cryptography and is usually used as a black-box when constructing protocols.

Formally, we can describe an OT^𝑚₁ protocol as follows. There are 2 participants called the sender 𝑆 and the receiver 𝑅. Specifically, 𝑆 has 𝑚 messages, and 𝑅 has an index 𝑧. 𝑅 wishes to receive the 𝑧th message of the sender’s 𝑚 messages without leaking 𝑧 to 𝑆, while knowing nothing about the rest 𝑚−1 messages. A simplified OT^𝑚₁ protocol can be presented as in Algorithm 1.

OT𝑚1 Inputs:      𝑆 inputs a set of 𝑚 messages: (𝑟1,𝑟2,…,𝑟𝑚);      𝑅 inputs an index: 𝑧; Outputs:      𝑆 obtains 𝜆, which means 𝑁𝑢𝑙𝑙.      𝑅 obtains 𝑟𝑧.

Algorithm 1 

3. System Model

In this section, we present the system model including the goals we aim to achieve in detail.

In this paper, we consider the privacy-preserving medical diagnosis system with two participants: the patient and the hospital. We assume that each patient can collect his own health data such as heart beat and blood pressure, in the form of a vector, called query vector, easily by various advanced medical devices. Herein, we call the heart beat, blood pressure, and so forth, as parameter items and the health data corresponding to heart beat, blood pressure, and so forth, as parameter values. For example, 𝑞_𝑃=(𝑞_𝑃1,…,𝑞_𝑃𝑛) is the query vector of the patient 𝑃, where all {𝑞_𝑃𝑤}_{𝑤=1,…,𝑛} are the necessary parameters the hospital needs for diagnosis, and 𝑞_𝑃𝑤 is the parameter value of the parameter item heart beat. Each patient has a health card to store related data and a portable device PMDD to read the data stored in the card and to do some related computations after inserting the card. The hospital has a disease database DB={𝑑_𝑖}_{𝑖=1,…,𝑚}, which in fact is the standard to determine which disease the patient has got. Each record of the disease database is presented as a triple 𝑑_𝑖=(𝑖,𝑡_𝑖,𝑟_𝑖),𝑖=1,…,𝑚, where 𝑚 is the capacity of the disease database; 𝑖 is the index of a disease; 𝑡_𝑖, called the trait vector of the disease 𝑑_𝑖, is a vector that covers all necessary parameters the hospital needs for diagnosis; and 𝑟_𝑖 is the disease diagnostic report including the disease name, doctors’ advices, and prescriptions corresponding to the 𝑖th disease 𝑑_𝑖. Concerning these parameters, we have some illustrations as follows.(i)𝑞_𝑃: it includes all necessary parameter items the hospital needs for diagnosis such as heart beat and blood pressure. The query vectors of the same patient 𝑃 are different if 𝑃 goes to different hospitals since their medical levels are different. The query vectors of the same patient 𝑃 may be also different if 𝑃 goes to the same hospital at different time since the medical level of the hospital has been always keeping improving. The dimension 𝑛 and every parameter item {𝑞_𝑃𝑤}_{𝑤=1,…,𝑛} of the query vector are determined by the trait vector 𝑡_𝑖 of the hospital. After registering to the hospital, patient can know what parameter items are needed in this diagnosis by reading the health card.(ii)DB={𝑑_𝑖}_{𝑖=1,…,𝑚}: it concludes all diseases a hospital can diagnose. Different hospitals have different disease databases and the same hospital has different disease databases at different time since its medical level has been keeping improving. The dimension 𝑚 is determined by the hospital’s medical level.(iii)𝑡_𝑖: it includes all necessary parameter items the hospital needs for diagnosis such as heart beat and blood pressure. Different hospitals have different trait vectors and the trait vectors of the same hospital at different time may be different since the medical level of the hospital has been always keeping improving. The dimension 𝑛 and every parameter item {𝑡_𝑖𝑗}_{𝑗=1,…,𝑛} of the trait vector are determined by the hospital’s medical level. In order to improve the precision of our diagnosis system, the hospital can consider as many factors as possible such as adding more personal feelings, symptoms, and previous medical features from the patient as parameter items. Although we only can diagnose some simple diseases currently, it is believed that it will be feasible for more complicated diseases in the future by extending the dimension 𝑛 of the parameter items.(iv)𝑟_𝑖: it includes the disease name, doctors’ advices, and prescriptions corresponding to the 𝑖th disease 𝑑_𝑖. Each report may conclude many doctors' advices and prescriptions. Herein, we assume that every report obtained from the MD-ATM following the self-helped medical diagnosis is authorized by the hospital and all advices and prescriptions of a report are signed by corresponding doctors. After receiving the diagnostic report, patient can choose one doctor’s advice and prescription to treat himself.

In this paper, the system makes medical diagnosis according to the Euclidean distances of two vectors. Specifically, taking the query vector of the patient and a trait vector of the database as an example, given a patient’s query vector 𝑞_𝑃=(𝑞_𝑃1,…,𝑞_𝑃𝑛) and a disease trait vector 𝑡_𝑖=(𝑡_𝑖1,…,𝑡_𝑖𝑛),𝑖∈{1,…,𝑚}, their Euclidean distance [3] denoted by dist_{𝑞𝑃↔𝑡𝑖} is dist_{𝑞𝑃↔𝑡𝑖}=^𝑛_𝑤=1𝑞_𝑃𝑤−𝑡_𝑖𝑤². (2)

Herein, we compare the squares of the Euclidean distances, dist²_{𝑞𝑃↔𝑡𝑖}−dist²_{𝑞𝑃↔𝑡𝑗}=^𝑛_𝑤=1𝑞_𝑃𝑤−𝑡_𝑖𝑤²−^𝑛_𝑤=1𝑞_𝑃𝑤−𝑡_𝑗𝑤². (3)

It is obvious that we can figure out which one has smaller distance with patient’s query vector just by checking the sign of (3) without exact result of dist_{𝑞𝑃↔𝑡𝑖} or dist_{𝑞𝑃↔𝑡𝑗}. Assuming that the report 𝑟_𝑧 corresponding to the trait vector 𝑡_𝑧,𝑧∈{1,…,𝑚}, is the diagnosed disease report, we have the following result, for all 𝑗=1,…,𝑚,𝑗≠𝑧: dist²_{𝑞𝑃↔𝑡𝑧}−dist²_{𝑞𝑃↔𝑡𝑗}<0. (4)

In our scheme, we will compare the squares of the Euclidean distances of the query vector and the trait vectors to find the diagnostic report that satisfies (4).

In real application, the hospital provides a MD-ATM, which is connected with the disease database and can read the data of the card, to direct patients to complete self-helped disease diagnosis. Specifically, we assume that each patient registers to the hospital for the first time and gets a health card. The hospital provides a self-helped MD-ATM in public just like a bank ATM. Whenever 𝑃 wants to have a diagnosis, inserting his health card into the MD-ATM and following the instructions, 𝑃 can complete the self-helped diagnosis by himself. The basic model can be illustrated in Figure 1.

Figure 1 

Self-helped medical diagnosis model of our scheme.

Apart from the above, to enable a privacy-preserving medical diagnosis system, our scheme should simultaneously fulfill the following two security goals.(i)Confidentiality of disease database should be protected during the self-helped diagnosis process.(ii)Confidentiality of patient’s private health data should be protected during the self-helped diagnosis process.

4. Our Scheme

In this section, we propose our privacy-preserving self-helped medical diagnosis scheme (PP-SH-MDS) in detail to show how a patient can diagnose by himself using his PMDD and the self-helped MD-ATM. The core of our construction can be summarized in Figure 2.

Figure 2 

PP-SH-MDS.

Specifically, the patient 𝑃 executes as follows to make a self-helped diagnosis using his PMDD and the MD-ATM.

In the setup phase, 𝑃 registers to a hospital as traditional medical diagnosis and gets a health card.

In the diagnosis phase, there are three subphases.

(1) Local Preprocessing. Whenever 𝑃 wants to have a diagnosis, he firstly conducts the following two transformations on PMDD locally.(i)Vector-to-Vector.(a)𝑃 firstly extends his original health data from an 𝑛-vector 𝑞_𝑃=(𝑞_𝑃1,…,𝑞_𝑃𝑛) to an (𝑛+2)-vector 𝑄_𝑃=(𝑞_𝑃1,…,𝑞_𝑃𝑛,𝑞_𝑃,𝑛+1,𝑞_𝑃,𝑛+2), where 𝑞_𝑃,𝑛+1=−(1/2)∑^𝑛_𝑤=1𝑞²_𝑃𝑤 and 𝑞_𝑃,𝑛+2=1.(ii)Vector-to-Matrix.(a)𝑃 randomly chooses a password 𝑠_𝑃=(𝑠_𝑃1,…,𝑠_𝑃𝑘) and then generates a 𝑘×(𝑛+2) matrix 𝐵_𝑃=𝑏₁₁⋯𝑏_1,𝑛+2𝑏⋮⋮_𝑘1⋯𝑏_𝑘,𝑛+2, (5) where ∑^𝑘_𝑢=1𝑠_𝑃𝑢⋅𝑏_𝑢𝑤=1,𝑤=1,…,𝑛+2.(b)By blinding 𝑄_𝑃 using the matrix 𝐵_𝑃, 𝑃 further extends 𝑄_𝑃 to a matrix 𝑀_𝑃=𝑏₁₁⋅𝑞_𝑃1⋯𝑏_1,𝑛+2⋅𝑞_𝑃,𝑛+2𝑏⋮⋮_𝑘1⋅𝑞_𝑃1⋯𝑏_𝑘,𝑛+2⋅𝑞_𝑃,𝑛+2. (6)

After completing the above steps, 𝑃 stores the matrix 𝑀_𝑃 in the health card.

(2) Diagnosis.(i)After local preprocessing, 𝑃 inserts his health card into the MD-ATM and then the MD-ATM reads the card to get the matrix 𝑀_𝑃 and randomly chooses two trait vectors 𝑡_𝑖=(𝑡_𝑖1,…,𝑡_𝑖𝑛) and 𝑡_𝑗=(𝑡_𝑗1,…,𝑡_𝑗𝑛) and, respectively, extends them to (𝑛+2)-vectors 𝑇_𝑖=(𝑡_𝑖1,…,𝑡_𝑖𝑛,𝑡_𝑖,𝑛+1,𝑡_𝑖,𝑛+2) and 𝑇_𝑗=(𝑡_𝑗1,…,𝑡_𝑗𝑛,𝑡_𝑗,𝑛+1,𝑡_𝑗,𝑛+2), where 𝑡_𝑖,𝑛+1=1,𝑡_𝑖,𝑛+2=−(1/2)∑^𝑛_𝑤=1𝑡²_𝑖𝑤 and 𝑡_𝑗,𝑛+1=1,𝑡_𝑗,𝑛+2=−(1/2)∑^𝑛_𝑤=1𝑡²_𝑗𝑤. Then the MD-ATM computes Δ^′_𝑖𝑗=𝑀_𝑃⋅(𝑇_𝑖−𝑇_𝑗)^𝑇,𝑖,𝑗=1,…,𝑚,𝑖≠𝑗, and writes (Δ^′_𝑖𝑗,𝑖,𝑗) in the card and indicates the patient to get back his card.(ii)Following the instructions of the MD-ATM, the patient gets the card back and inserts it into PMDD. After inputting his password, PMDD begins to compute Δ_𝑖𝑗=𝑠_𝑃⋅Δ^′_𝑖𝑗,𝑖,𝑗=1,…,𝑚,𝑖≠𝑗, and finds the index 𝑧 so that for all 𝑗=1,…,𝑚,𝑗≠𝑧,Δ_𝑖𝑗>0. 𝑧 is the input of the following OT^𝑚₁ protocol.

(3) 1-out-of-m OT Protocol.(i)𝑃 inserts his card into the MD-ATM and invokes an OT^𝑚₁ protocol, where 𝑃’s input is the index 𝑧 and the MD-ATM’s input is the diagnostic report set (𝑟₁,𝑟₂,…,𝑟_𝑚) of the database.

After executing the OT^𝑚₁ protocol, 𝑃 gets the diagnostic report 𝑟_𝑧 corresponding to the disease 𝑑_𝑧 according to the index 𝑧, while the MD-ATM gets 𝑁𝑢𝑙𝑙, denoted by 𝜆.

5. Analysis

In this section, we analyze our scheme in detail. We firstly have a look at the correctness and then give a strict security proof following the real-ideal simulation paradigm of STC in the scenarios of semihonest adversaries.

5.1. Correctness

In this aspect, we follow the steps of our scheme and make sure that the patient indeed finds out the most possible disease from the disease database of the hospital using his health data by comparing Euclidean distances.

Following the scheme, we can see that the patient transforms the health data in two steps. Firstly, he extends his original health data from an 𝑛-vector 𝑞_𝑃=(𝑞_𝑃1,…,𝑞_𝑃𝑛) to an (𝑛+2)-vector 𝑄_𝑃=(𝑞_𝑃1,…,𝑞_𝑃𝑛,𝑞_𝑃,𝑛+1,𝑞_𝑃,𝑛+2), where 𝑞_𝑃,𝑛+1=−(1/2)∑^𝑛_𝑤=1𝑞²_𝑃𝑤 and 𝑞_𝑃,𝑛+2=1 and then blinds and extends 𝑄_𝑃 using the matrix 𝐵_𝑃 to a matrix𝑀_𝑃=𝑏₁₁⋅𝑞_𝑃1⋯𝑏_1,𝑛+2⋅𝑞_𝑃,𝑛+2𝑏⋮⋮_𝑘1⋅𝑞_𝑃1⋯𝑏_𝑘,𝑛+2⋅𝑞_𝑃,𝑛+2. (7) On the other hand, the MD-ATM randomly selects two trait vectors 𝑡_𝑖=(𝑡_𝑖1,…,𝑡_𝑖𝑛) and 𝑡_𝑗=(𝑡_𝑗1,…,𝑡_𝑗𝑛) and, respectively, extends them to (𝑛+2)-vectors 𝑇_𝑖=(𝑡_𝑖1,…,𝑡_𝑖𝑛,𝑡_𝑖,𝑛+1,𝑡_𝑖,𝑛+2) and 𝑇_𝑗=(𝑡_𝑗1,…,𝑡_𝑗𝑛,𝑡_𝑗,𝑛+1,𝑡_𝑗,𝑛+2), where 𝑡_𝑖,𝑛+1=1,𝑡_𝑖,𝑛+2=−(1/2)∑^𝑛_𝑤=1𝑡²_𝑖𝑤 and 𝑡_𝑗,𝑛+1=1,𝑡_𝑗,𝑛+2=−(1/2)∑^𝑛_𝑤=1𝑡²_𝑗𝑤. After receiving 𝑀_𝑃, for 𝑖,𝑗=1,…,𝑚,𝑖≠𝑗, the MD-ATM computes Δ^′_𝑖𝑗=𝑀_𝑃⋅𝑇_𝑖−𝑇_𝑗^𝑇=𝑏₁₁⋅𝑞_𝑃1⋯𝑏_1,𝑛+2⋅𝑞_𝑃,𝑛+2𝑏⋮⋮_𝑘1⋅𝑞_𝑃1⋯𝑏_𝑘,𝑛+2⋅𝑞_𝑃,𝑛+2⋅𝑡_𝑖1−𝑡_𝑗1⋮𝑡_𝑖,𝑛+2−𝑡_𝑗,𝑛+2. (8)

After receiving the returned message Δ^′_𝑖𝑗, for 𝑖,𝑗=1,…,𝑚,𝑖≠𝑗, 𝑃 uses PMDD to compute Δ_𝑖𝑗=𝑠_𝑃⋅Δ^′_𝑖𝑗=𝑠_𝑃⋅𝑀_𝑃⋅𝑇_𝑖−𝑇_𝑗^𝑇=𝑠_𝑃1,…,𝑠_𝑃𝑘⋅𝑏₁₁⋅𝑞_𝑃1⋯𝑏_1,𝑛+2⋅𝑞_𝑃,𝑛+2𝑏⋮⋮_𝑘1⋅𝑞_𝑃1⋯𝑏_𝑘,𝑛+2⋅𝑞_𝑃,𝑛+2⋅𝑡_𝑖1−𝑡_𝑗1⋮𝑡_𝑖,𝑛+2−𝑡_𝑗,𝑛+2=^𝑘_𝑢=1𝑠_𝑃𝑢⋅𝑏_𝑢1⋅𝑞_𝑃1⋅𝑡_𝑖1−𝑡_𝑗1++⋯_𝑘𝑢=1𝑠_𝑃𝑢⋅𝑏_𝑢,𝑛+2⋅𝑞_𝑃,𝑛+2⋅𝑡_𝑖,𝑛+2−𝑡_𝑗,𝑛+2=^𝑛+2_𝑤=1𝑞_𝑃𝑤⋅𝑡_𝑖𝑤−𝑡_𝑗𝑤. (9) Thus, we have Δ_𝑖𝑗=^𝑛+2_𝑤=1𝑞_𝑃𝑤⋅𝑡_𝑖𝑤−^𝑛+2_𝑤=1𝑞_𝑃𝑤⋅𝑡_𝑗𝑤=^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡_𝑖𝑤+𝑞_𝑃,𝑛+1⋅𝑡_𝑖,𝑛+1+𝑞_𝑃,𝑛+2⋅𝑡_𝑖,𝑛+2−^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡_𝑗𝑤+𝑞_𝑃,𝑛+1⋅𝑡_𝑗,𝑛+1+𝑞_𝑃,𝑛+2⋅𝑡_𝑗,𝑛+2=^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡_𝑖𝑤+𝑞_𝑃,𝑛+1+𝑡_𝑖,𝑛+2−^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡_𝑗𝑤+𝑞_𝑃,𝑛+1+𝑡_𝑗,𝑛+2=^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡_𝑖𝑤−12^𝑛_𝑤=1𝑞²_𝑃𝑤−12^𝑛_𝑤=1𝑡²_𝑖𝑤−^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡_𝑗𝑤−12^𝑛_𝑤=1𝑞²_𝑃𝑤−12^𝑛_𝑤=1𝑡²_𝑗𝑤=12^𝑛_𝑤=1𝑞_𝑃𝑤−𝑡_𝑗𝑤²−^𝑛_𝑤=1𝑞_𝑃𝑤−𝑡_𝑖𝑤²=12dist²_{𝑞𝑃↔𝑡𝑗}−dist²_{𝑞𝑃↔𝑡𝑖}. (10)

Obviously, if for all 𝑗=1,…,𝑚,𝑗≠𝑧, Δ_𝑧𝑗=(1/2)(dist²_{𝑞𝑃↔𝑡𝑗}−dist²_{𝑞𝑃↔𝑡𝑧})>0, then 𝑡_𝑧,𝑧∈{1,…,𝑚}, is the trait vector of the diagnosed disease. The report 𝑟_𝑧 corresponding to the trait vector 𝑡_𝑧 is the diagnosed report. Taking the index 𝑧 as the input of the following OT^𝑚₁ protocol, the patient can finally get the disease report 𝑟_𝑧 from the set (𝑟₁,𝑟₂,…,𝑟_𝑚) of the database.

Therefore, our scheme is correct.

5.2. Security

In this subsection, we strictly prove the security of our scheme. From the whole process, we can specify that the two parties in our system are the patient 𝑃 and the hospital. They cooperate to compute the function 𝑓(𝑞_𝑃,(𝑑₁,𝑑₂,…,𝑑_𝑚))=𝑟_𝑧, where 𝑟_𝑧 is the disease diagnostic report corresponding to the disease 𝑑_𝑧 and the distance dist_{𝑞𝑝↔𝑡𝑧} satisfies the condition dist²_{𝑞𝑝↔𝑡𝑧}=min{dist²_{𝑞𝑝↔𝑡𝑗}}_{𝑗=1,…,𝑚}. As mentioned in Section 3, we should achieve two security goals, that is, keeping both parties’ inputs private. We apply the real-ideal simulation paradigm to prove that our scheme has achieved the two goals in the scenarios of semihonest adversaries assuming the OT^𝑚₁ protocol we used is secure.

Theory 1. Our privacy-preserving self-helped medical diagnosis scheme is secure against semihonest adversaries if the OT^𝑚₁ protocol is secure.

Proof. Notice that the view of 𝑃_𝑖, {VIEW_𝑖(𝑞_𝑝,{𝑑₁,…,𝑑_𝑚})}_𝑖=1,2, in the real execution consists of three parts, the private input, random tape, and the messages received from the other party including the output. Therefore, we can get the views of 𝑃₁ and 𝑃₂, respectively, in the real execution as follows: VIEW₁𝑞_𝑝,𝑑_{𝑖𝑖=1,…,𝑚}=𝑞_𝑃,𝑠_𝑃,𝐵_𝑃,Δ^′_{𝑖𝑗𝑖,𝑗=1,…,𝑚,𝑖≠𝑗},VIEW^OT𝑚1₁𝑧,𝑟_{𝑖𝑖=1,…,𝑚},𝑟_𝑧;VIEW₂𝑞_𝑝,𝑑_{𝑖𝑖=1,…,𝑚}=𝑑_{𝑖𝑖=1,…,𝑚},𝑀_𝑃,VIEW^OT𝑚1₂𝑧,𝑟_{𝑖𝑖=1,…,𝑚},𝜆, (11)(12) where {VIEW^OT𝑚1₁(𝑧,{𝑟_𝑖}_{𝑖=1,…,𝑚})} and {VIEW^OT𝑚1₂(𝑧,{𝑟_𝑖}_{𝑖=1,…,𝑚})} are the views produced in the execution of OT^𝑚₁ protocol.
From the definition of security, we need to construct the probabilistic polynomial-time algorithm 𝑆₁/𝑆₂ so that given the input and output of the patient 𝑃₁/the hospital 𝑃₂, (𝑞_𝑃;𝑟_𝑧)/({𝑑_𝑖}_{𝑖=1,…,𝑚};𝜆), it can output a simulated view {𝑆₁(𝑞_𝑃;𝑟_𝑧)}/{𝑆₂({𝑑_𝑖}_{𝑖=1,…,𝑚};𝜆)}, which is indistinguishable to the view {VIEW₁(𝑞_𝑝,{𝑑_𝑖}_{𝑖=1,…,𝑚})}/{VIEW₂(𝑞_𝑝,{𝑑_𝑖}_{𝑖=1,…,𝑚})} in the real execution of the scheme; that is, 𝑆₁𝑞_𝑃;𝑟_𝑧≅VIEW₁𝑞_𝑝,𝑑_{𝑖𝑖=1,…,𝑚},𝑆₂𝑑_{𝑖𝑖=1,…,𝑚};𝜆≅VIEW₂𝑞_𝑝,𝑑_{𝑖𝑖=1,…,𝑚}. (13)
In the following discussion, we follow the real-ideal simulation paradigm to construct such probabilistic polynomial-time algorithms 𝑆₁,𝑆₂. We separately prove the case when 𝑃₂ is semihonest and when 𝑃₁ is semihonest.
Case 1 (𝑃₂ is semihonest). In this case, we only need to construct a simulator 𝑆₂ so that, given 𝑃₂’s input {𝑑_𝑖}_{𝑖=1,…,𝑚} and output 𝜆, 𝑆₂ can simulate 𝑃₂’s view in the real execution presented above as (12).
Firstly, since we assume that the OT^𝑚₁ protocol used in our scheme is secure and can be taken as a black-box, there exists an algorithm 𝑆^OT𝑚1₂: given the input {𝑟_𝑖}_{𝑖=1,…,𝑚} and the output 𝜆, it can simulate 𝑃₂’s view of the OT^𝑚₁ execution and output {𝑆^OT𝑚1₂({𝑟_𝑖}_{𝑖=1,…,𝑚};𝜆)} so that 𝑆^OT𝑚1₂𝑟_{𝑖𝑖=1,…,𝑚};𝜆≅VIEW^OT𝑚1₂𝑧,𝑟_{𝑖𝑖=1,…,𝑚}. (14)
Next, notice that 𝑆₂ is given ({𝑑_𝑖}_{𝑖=1,…,𝑚};𝜆); it can easily simulate the remaining parts of (12) by randomly choosing a 𝑘×(𝑛+2) matrix 𝑀 which is indistinguishable to the blinded matrix 𝑀_𝑃. Then, 𝑆₂ outputs the simulated view, 𝑆₂𝑑_{𝑖𝑖=1,…,𝑚}=𝑑;𝜆_{𝑖𝑖=1,…,𝑚},𝑀,𝑆^OT𝑚1₂𝑟_{𝑖𝑖=1,…,𝑚};𝜆,𝜆. (15)
Obviously, we can conclude that 𝑆₂𝑑_{𝑖𝑖=1,…,𝑚};𝜆≅VIEW₂𝑞_𝑝,𝑑_{𝑖𝑖=1,…,𝑚}. (16)
Case 2 (𝑃₁ is semihonest). Similar to Case 1, we only need to construct a simulator 𝑆₁ so that given 𝑃₁’s input 𝑞_𝑃 and output 𝑟_𝑧, 𝑆₁ can simulate 𝑃₁’s view in the real execution presented above as (11).
As discussed above, since the OT^𝑚₁ protocol is secure, there exists an algorithm 𝑆^OT𝑚1₁: given the input 𝑧 and the output 𝑟_𝑧, it can simulate 𝑃₁’s view of the OT^𝑚₁ execution and output {𝑆^OT𝑚1₁(𝑧;𝑟_𝑧)} so that 𝑆^OT𝑚1₁𝑧;𝑟_𝑧≅VIEW^OT𝑚1₁𝑧,𝑟_{𝑖𝑖=1,…,𝑚}. (17)
Next, given (𝑞_𝑃;𝑟_𝑧), 𝑆₁ then simulates the remaining parts of 𝑃₁’s view in the real execution as follows.
Firstly, as in the real execution, 𝑆₁ extends the original health data from an 𝑛-vector 𝑞_𝑃=(𝑞_𝑃1,…,𝑞_𝑃𝑛) to an (𝑛+2)-vector 𝑄_𝑃=(𝑞_𝑃1,…,𝑞_𝑃𝑛,𝑞_𝑃,𝑛+1,𝑞_𝑃,𝑛+2), where 𝑞_𝑃,𝑛+1=−(1/2)∑^𝑛_𝑤=1𝑞²_𝑃𝑤 and 𝑞_𝑃,𝑛+2=1. Then, 𝑆₁ randomly chooses a password 𝑠^′_𝑃=(𝑠^′_𝑃1,…,𝑠^′_𝑃𝑘) and then generates a 𝑘×(𝑛+2) matrix 𝐵^′_𝑃=𝑏^′₁₁⋯𝑏^′_1,𝑛+2𝑏⋮⋮_′𝑘1⋯𝑏^′_𝑘,𝑛+2, (18) where ∑^𝑘_𝑢=1𝑠^′_𝑃𝑢⋅𝑏^′_𝑢𝑤=1,𝑤=1,…,𝑛+2. By blinding 𝑄_𝑃 using the matrix 𝐵^′_𝑃, 𝑆₁ further extends 𝑄_𝑃 to a matrix 𝑀^′_𝑃=𝑏^′₁₁⋅𝑞_𝑃1⋯𝑏^′_1,𝑛+2⋅𝑞_𝑃,𝑛+2𝑏⋮⋮_′𝑘1⋅𝑞_𝑃1⋯𝑏^′_𝑘,𝑛+2⋅𝑞_𝑃,𝑛+2. (19)
Then 𝑆₁ randomly selects 𝑚 vectors, 𝑇^′_𝑗=(𝑡^′_𝑗1,…,𝑡^′_𝑗𝑛,𝑡^′_𝑗,𝑛+1,𝑡^′_𝑗,𝑛+2), 𝑡^′_𝑗,𝑛+1=1,𝑡^′_𝑗,𝑛+2=−(1/2)∑^𝑛_𝑤=1𝑡^′2_𝑗𝑤,𝑗=1,…,𝑚, and for all 𝑗=1,…,𝑚,𝑗≠𝑧,∑^𝑛_𝑤=1(𝑞_𝑃𝑤−𝑡^′_𝑧𝑤)²<∑^𝑛_𝑤=1(𝑞_𝑃𝑤−𝑡^′_𝑗𝑤)²; otherwise, 𝑆₁ reselects 𝑇^′_𝑗,𝑗=1,…,𝑚. Afterwards, 𝑆₁ computes Λ^′_𝑖𝑗=𝑀^′_𝑃⋅(𝑇^′_𝑖−𝑇^′_𝑗)^𝑇,𝑖,𝑗=1,…,𝑚,𝑖≠𝑗. Thus, for 𝑖,𝑗=1,…,𝑚,𝑖≠𝑗,Λ_𝑖𝑗=𝑠^′_𝑃⋅Λ^′_𝑖𝑗=∑^𝑛+2_𝑤=1𝑞_𝑃𝑤⋅(𝑡^′_𝑖𝑤−𝑡^′_𝑗𝑤).
Therefore, we have Λ_𝑖𝑗=^𝑛+2_𝑤=1𝑞_𝑃𝑤⋅𝑡^′_𝑖𝑤−^𝑛+2_𝑤=1𝑞_𝑃𝑤⋅𝑡^′_𝑗𝑤=^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡^′_𝑖𝑤+𝑞_𝑃,𝑛+1⋅𝑡^′_𝑖,𝑛+1+𝑞_𝑃,𝑛+2⋅𝑡^′_𝑖,𝑛+2−^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡^′_𝑗𝑤+𝑞_𝑃,𝑛+1⋅𝑡^′_𝑗,𝑛+1+𝑞_𝑃,𝑛+2⋅𝑡^′_𝑗,𝑛+2=^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡^′_𝑖𝑤+𝑞_𝑃,𝑛+1+𝑡^′_𝑖,𝑛+2−^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡^′_𝑗𝑤+𝑞_𝑃,𝑛+1+𝑡^′_𝑗,𝑛+2=^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡^′_𝑖𝑤−12^𝑛_𝑤=1𝑞²_𝑃𝑤−12^𝑛_𝑤=1𝑡^′2_𝑖𝑤−^𝑛_𝑤=1𝑞_𝑃𝑤⋅𝑡^′_𝑗𝑤−12^𝑛_𝑤=1𝑞²_𝑃𝑤−12^𝑛_𝑤=1𝑡^′2_𝑗𝑤=12^𝑛_𝑤=1𝑞_𝑃𝑤−𝑡^′_𝑗𝑤²−^𝑛_𝑤=1𝑞_𝑃𝑤−𝑡^′_𝑖𝑤²=12dist²_{𝑞𝑃↔𝑡′𝑗}−dist²_{𝑞𝑃↔𝑡′𝑖}. (20)
Since for all 𝑗=1,…,𝑚,𝑗≠𝑧, we have ∑^𝑛_𝑤=1(𝑞_𝑃𝑤−𝑡^′_𝑧𝑤)²<∑^𝑛_𝑤=1(𝑞_𝑃𝑤−𝑡^′_𝑗𝑤)². Obviously, for all 𝑗=1,…,𝑚,𝑗≠𝑧, Λ_𝑧𝑗=(1/2)(dist²_{𝑞𝑃↔𝑡′𝑗}−dist²_{𝑞𝑃↔𝑡′𝑧})>0 and 𝑡_𝑧,𝑧∈{1,…,𝑚}, is the trait vector of the diagnosed disease. The report 𝑟_𝑧 corresponding to the trait vector 𝑡_𝑧 is the diagnosed report, which matches the relationship in the real execution.
Now, 𝑆₁ can output the simulated view, 𝑆₁𝑞_𝑃;𝑟_𝑧=𝑞_𝑃,𝑠^′_𝑃,𝐵^′_𝑃,Λ^′_{𝑖𝑗𝑖,𝑗=1,…,𝑚,𝑖≠𝑗},𝑆^OT𝑚1₁𝑧;𝑟_𝑧,𝑟_𝑧. (21)
Since 𝑠^′_𝑃 and 𝐵^′_𝑃 are randomly chosen and ∑^𝑘_𝑢=1𝑠^′_𝑃𝑢⋅𝑏^′_𝑢𝑤=1,𝑤=1,…,𝑛+2, as 𝑠_𝑃 and 𝐵_𝑃 in the real view {VIEW₁(𝑞_𝑝,{𝑑_𝑖}_{𝑖=1,…,𝑚})}. Due to the randomness and relationship, it is easy to find that (𝑠^′_𝑃,𝐵^′_𝑃) is indistinguishable to (𝑠_𝑃,𝐵_𝑃). From the construction process of {Λ^′_𝑖𝑗}_{𝑖,𝑗=1,…,𝑚,𝑖≠𝑗}, it is obvious to conclude that {Λ^′_𝑖𝑗}_{𝑖,𝑗=1,…,𝑚,𝑖≠𝑗} is indistinguishable to the set {Δ^′_𝑖𝑗}_{𝑖,𝑗=1,…,𝑚,𝑖≠𝑗}. Combined with (17), we have 𝑆₁𝑞_𝑃;𝑟_𝑧≅VIEW₁𝑞_𝑝,𝑑_{𝑖𝑖=1,…,𝑚}. (22)

6. Conclusions

In this paper, we consider the problem of how to securely make diagnosis without leaking patient’s health data, diagnosed result, and hospital’s disease database in wireless sensor networks. By applying the idea of secure two-party computation and the technology of oblivious transfer, we propose a privacy-preserving self-helped medical diagnosis scheme so that patients can privately diagnose themselves by inserting a health card into a self-helped MD-ATM to obtain the diagnostic report just like drawing money from a bank ATM. We also have a detailed analysis about the correctness and further strictly prove the security following the real-idea simulation paradigm. We expect to provide people another perspective on future medical care.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

Acknowledgments

This work is supported by NSFC (Grant nos. 61300181, 61272057, 61202434, 61170270, 61100203, and 61121061) and the Fundamental Research Funds for the Central Universities (Grant nos. 2012RC0612 and 2011YB01).