Internet of Things for Healthcare Using Wireless Communications or Mobile ComputingView this Special Issue
Research Article | Open Access
Secure Lightweight IoT Integrated RFID Mobile Healthcare System
Patient safety is a global public health concern nowadays, especially in elderly people who need physiological health monitoring systems integrated with a technology which will help to oversee and manage the medical needs. In this direction, we propose a lightweight effective healthcare monitoring system designed by using the Internet of Things (IoT) and Radio Frequency Identification (RFID) tags. In this technique, we use dual-band RFID protocols which are the one working at a high frequency of 13.56 MHz and useful to figure out the individuals, and 2.45 GHz microwave bands are used to monitor corporal information. Sensors are used to monitor and collect patient physiological data; RFID tag is used to recognize the patient. This IoT-based RFID healthcare monitoring system provides acquisition of physiological information of elderly people and patients in hospital. Further, it is aiming to secure patient’s health recordings using hyper elliptic curve- (HEC-) based signcryption algorithm while allowing the doctor to access patient health information. Privacy is provided to variable length patient medical records using different genus curves, and the evaluation shows that the proposed algorithm is optimal with respect to healthcare.
Mobile healthcare (M-health) system is a system intended to preserve patient health records remotely, allowing doctors to access them from their location to give medical guidance according to need. This arrangement improves accessibility and efficiency, because both patients and doctors need not meet each other. Therefore, patients from their residence can acquire the medical diagnostic suggestions from doctors directly. In this process, RFID technology plays a vital role in patient personal information identification and medical record access ([16, 17]). RFID tag, reader, and middleware are the components present in the RFID system. Tag is used to store a unique identification number, reader is used to read the number present on tag, and middleware is responsible to store and process the data from readers. The technological advancements in this field, in particular development of chip, are very fast, have low activation power (μW), and even able to integrate diverse sensing capabilities. This development opens a challenge of investigating sophisticated applications in IOT paradigm. RFID seems to be the next disruptive modernization in healthcare, which offered several openings for improved safety, functioning effectiveness and economical savings. Even though it promises several benefits in healthcare, the adoption of this technology in healthcare has not been as striking as anticipated and still lags behind compared to other applications due to apprehensions related to security and privacy, radio frequency interference, and inadequacy of industry benchmarks. Hence, security is the major concern in RFID-based healthcare systems. In order to ensure a secured communication, authentication check should happen in tag and reader, encrypting their identification and the patient data to attain confidentiality. Many cryptographic algorithms  were suggested to provide security and privacy to message in communication, encryption, and decryption. Table 1 shows the comparative analysis of various cryptographic algorithms which includes Rivest–Shamir–Adleman (RSA), Diffie Hellman Algorithm (DHA), elliptic curve (EC) ([3, 8–10]), and hyper elliptic curve (HEC) key ([11–13]); from it, we can observe that in HEC, group operations are fast over finite field than EC. For genus, curves ([14, 15]) can perform operations at a superior level, which made the study of HECC a need of the hour.
The contributions of the proposed work include the following: (i)Patient registration (RFID tag) and health reading acquisition through sensors(ii)Transmission of health recordings along with patient RFID tag using a mobile to patient information database through the Wireless Public Network (WPN).(iii)Secured transmission of patient health records between RPS and authorized entities (doctors and ambulance service) using HEC algorithm(iv)Comprehensive implementation and security analysis of proposed protocol for genus 2 curve
Section 2 covers literature and mathematical background. The proposed architecture and security algorithms are in Section 3. Section 4 discusses about security analysis. Comparative analysis with existing methods is in Section 5. Finally, summary is in Section 6.
2. Background Work
Patient medical data privacy, maintenance, and security are essential considerations in healthcare. Even though RFID technology guaranteed security and the privacy up to some extent, still it is the most challenging issue ([5–7, 23–25, 27]). The privacy-related challenges mainly arise from counterfeiting the original data in RFID tags, unauthorized data accessing information in transmission . In legal perspective, according to the Health Insurance Portability and Accountability Act (HIPAA) of 1996 in USA, allegedly access of patient data stored in RFID tag is a violation of government regulations. As most of the RFID tags rely on wireless interface, a health monitoring system may also be subject to physical attacks. Eavesdropping is the concern, when patient data is in transmission to the hospital, so authentication is required between them. Research has been going on addressing these issues; [18, 19, 21, 22] have proposed frameworks, which preserve the patients privacy and data security while trying to access the health records. Another study on data secrecy concerns ([28–33]) in healthcare suggests abidance of data captured through RFID, the awareness on existing security policy to medical staffs, and usage of RFID in hospitals . The IoT-based integrated healthcare service structure model  that can quickly receive information on patients’ conditions using in-hospital IoT equipment that uses wireless personal area networks such as RFID and Wireless Sensor Networks (WSN) among those low power wireless protocols that are provided by different healthcare service systems to provide healthcare services (e.g., diagnosis and treatment) to patients. An effective healthcare monitoring system used IoT and RFID tags without considering the security perspective . Hu et al.  have proposed an intelligent and secure health monitoring scheme using an IoT sensor based on cloud computing and cryptography.
2.1. Mathematical Background of Hyper Elliptic Curves
A HEC of genus is defined over a field as where is a nonsingular curve, is a polynomial with degree , and is also a polynomial having degree . If and is 0, then should be a square-free polynomial. In most situations, no and in algebraic closure of , which satisfies HEC and the two partial derivatives, i.e., and .
A divisor is a formal sum of points with and for all but finitely many .
The degree and order of is and , respectively.
A semireduced divisor of , where each and all theare finite points.
The Principal Divisor (Jacobian)  of the curve is expressed as
Let . We have the following equivalence relation on : or equivalently:
Each element of Jacobian is uniquely represented by , where and is asymmetric of .
Let a semireduced divisor, which can be characterized by two polynomials as follows: (1), a monic polynomial having root, which has the same -coordinate points in the support of the divisor. The multiplicities of the roots are equal to order of the corresponding on it(2)At this juncture, there are two scenarios as follows:(i)If all are distinct, , the unique polynomial such that and (ii)If all are equal, we need to compute , the unique polynomial with that fulfills the following condition along with the condition and if multiplicity of such that ; for , i.e., there exists a unique such that
3. Proposed Architecture
The arrangement of the RFID technology-based health monitoring system is aimed at monitoring the medical conditions of the patient by collecting the readings from the sensors attached to the patient and subsequently updated in the back-end database through mobile and the WPN connection subject to patient location. For any minor health hazards, which does not require immediate medical attention, the doctor may be logged into the database using RFID tag and observe the patient current situation for the future reference. Even the doctors or other care providers can access the patient database directly from remote and can communicate directly with the patient through video conference through the internet. In fact, this arrangement facilitates the doctor to diagnose the patient from remote based on the physiological data extracted from the patient database, which is hosted by the middleware. Sometimes, the patient may be suggested to visit the doctor if necessary. Also, the doctor is allowed to write the diagnosis information, medical treatment, and prescription information onto the patient’s information database using the patient’s RFID tag, which will improve the patient quality by eliminating the human errors and the ambiguity in patient-doctor and doctor-doctor interaction while giving the treatment to the patient.
3.1. Global Parameters and Key Generation (Setup)
The signature production/verification and encryption/decryption require global parameters, which are available publicly used in the rest of the phases. HECC is used in the proposed work because solving 80-bit HEC is difficult than 160-bit elliptic curve. This makes us to finalize HEC is more appropriate for the applications using RFID. Global parameters (param) chosen for over , having a unique reduced divisor , a large random number , and a large prime divisor of . is represented in the Mumford form as . After finalization of the param, the user (tag/reader) chooses a random number which is treated as the private key () and calculates the public key () using private key as ; Figure 1 shows the steps in this phase.
3.2. Public Parameters
The parameters publicly available to the doctor and server are as follows: (i)Select , find (ii)Select HEC over finite field be and let the Jacobian of be .(iii)Pick an element as a reduced divisor(iv)
3.3. Signature Generation
This phase uses param, doctor ID as nonce () as the input generate the signature pair . Afterwards, the signature pair is attached to an encrypted message and then transmitted onto the other side; Figure 2 shows the signature generation algorithm. A random number () is to be generated, used in computation. The D-Quark Hash algorithm is used in a hash value on a given message. Although DSS states the importance of Secure Hash Algorithm (SHA-1), we have used D-Quark asSHA algorithm which is computationally intensive in hash value calculation compared to D-Quark; also, it consumes less power and storage. Figure 2 shows the comparative analysis of different Quark algorithms; it presents three families U, D, and S Quark algorithms; and the comparative analysis is carried based on parameters no of rounds, digest length, rate, and capacity.
D-Quark was designed to provide 160-bit preimage resistance and at least bit security against all other attacks and to admit a parallelization degree of 8. Taken ; ; and .
Initialize with first b1/2 input bits, to last b1/2 input bits, and to all 1s, i.e., where is the internal state. (i)Function : D-Quark uses an 88-bit register and returns (ii)Function : it uses (88-bit) register and returns (iii)Function : for a given registers , , and (10bit), returns
3.4. Signature Verification
After receiving the signature pair (, , ), the receiver will calculate the parameters , , , , and ; the user is valid when is equal to . The procedure followed in signature verification is shown below. In value calculation, the receiver (server) has to decrypt the cipher text received from the sender (doctor) to extract A’s identity; the hash value is computed on the received ID. The signature generation and verification can be done by both the doctor and the server to establish mutual authentication before the commencement of communication.
3.5. Encryption Algorithm
In signature generation process, individual doctor/server ID is encrypted and then transferred to the other end. The encryption process is shown below. Once the message willing to be communicated is finalized, then the sender (doctor/server) computes the by multiplying the sender’s private key with the receiver’s public key that is added to the message in order to produce the cipher text. This algorithm is intended to secure either their ID or message intended to communicate to the other end.
3.6. Decryption Algorithm
After the receiver receives the cipher text, the doctor/server ID is extracted by subtracting , which is the product of the receiver’s private key and the senders public key; the detailed decryption algorithm is given below.
4. Security Analysis
The proposed protocol can be able to provide the security services like confidentiality, unforgeability, authentication, forward secrecy, and availability.
To facilitate confidentiality, information should be only intangible to unauthorized access to an eavesdropper or interceptor. If an adversary is interested in session key acquisition, he/she needs to estimate from and from and which is corresponding to solving HCDLP.
Integrity check insures no alteration in data in transmission and is the same as the one sent by the sender. Due to the property of the random oracle model, “it is not practicable that two different messages have identical digest/hash value.” In our scheme, the doctor/server verifies the signature based on hash of the patient message to check the integrity.
The property is aiming to confirm from where the message came and checks the ownership of user on the issued message called authenticity. In our proposed scheme, authenticity is based on signature generation and verification.
It means it is infeasible for an intruder to construct valid signature without a secret key. The proposed technique is unforgeable as it is based on unforgeable hyper elliptic curve digital signature algorithm (HECDSA).
Nonrepudiation restricts server from denying the signcrypted text it sent. Unforgeability insures nonrepudiation. If the server denies, the doctor sends signcrypted text to middleware; by using a verification technique, middleware can decide that the message is sent by the server.
4.6. Forward Secrecy
It infers that session key used in communication would not be compromised although a long-term private key revealed. In the proposed system, if an adversary obtains for computing session key, “” needs “.” Computing “𝑟” is equivalent to solving a computational hard problem Hyper Elliptic Curve Discrete Logarithm Problem (HECDLP).
5. Experimentation and Results
The proposed HECC algorithm on different genus values was developed using a SAGE software package designed for working out in algebraic geometry and combinatorics on intel® core™ i5-6500 CPU@3.20 GHz,4 GB RAM with a 64 bit windows 10 operating system. Table 2 shows the hyper elliptic curves over GF (p).
After the discussion of the proposed algorithm, the basic operations recognized in this are point addition, doubling, and scalar multiplication; the time required for completing these operations with respect to various field lengths is shown in Table 3. In the experimentation, firstly, the comparative analysis was done for different time estimations on different genus for operations of Jacobian, divisor recognition, key and signature generation, verification, and message encryption/decryption by varying field length such as , , , and . Further, the proposed protocol is compared with respect to HEC over a finite field by changing sizes.
Table 4 described the hash code value computation on the given tag using D-Quack algorithm discussed in Section 3. The computation time for Jacobian, divisor, key, signature generation/verification, and encryption/decryption is shown in Figures 3–9, respectively. From the figures, it is observed that as accumulative of genus along with field sizes, the time is increasing. Since HEC with an operand size is only a fractional amount, the proposed protocol is suitable for devices which require less storage requirements. The RFID reader has good computational capacity since it is connected to the server directly. But RFID tag is having less computational capacity, so it has less computational amount of time. The proposed method is compared with existing methods shown in Table 5; we can observe that better performance is achieved through Moosavi et al.  and the proposed protocol than [1, 3, 4] and  protocols.
Ev: eavesdropping; Im: impersonation; Ra: replay attack; Fs: forward security; Ma: mutual authentication; Pe: performance; Lo: less; Be: better.
In this paper, we proposed an architecture, which is suitable for several hospitals or to elder people and is responsible to monitor the health condition continuously and store patient medical records in the back-end database through middleware. Further, we proposed a hyper elliptic curve-based secure lightweight IoT integrated RFID mobile health care system to ensure security and privacy to the health records which are shared between the server/doctor. Security services mutual authentication and confidentiality are attained. Experimentation shows that the proposed protocol has better efficiency than other existing methods.
The Experimental information used to help the discoveries of this investigation are accessible from the corresponding author upon request, with this perusers can get to the information supporting the concluding remarks. Author’s contributions: The principal inventor Dr. V.S. Naresh thought about the introduced thought and built up the hypothesis and played out the calculations. The subsequent author confirmed the scientific strategies and security investigation. The principal creator Dr. V. S. Naresh urged the third creator to execute and managed the discoveries of this work. All creators examined the outcomes and added to the last composition.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
I would like to dedicate this work to my great father V. Bala Surya Narayana and thank my family members and the management of Sri Vasavi Engineering College, Tadepalligudem, who encouraged and supported me to do this work.
- L. Batina, J. Guajardo, T. Kerins, N. Mentens, P. Tuyls, and I. Verbauwhede, “Public-key cryptography for RFID-tags,” in Fifth Annual IEEE International Conference on Pervasive Computing and Communications Workshops (PerComW'07), pp. 217–222, White Plains, NY, USA, 2007.
- Y. K. Lee, L. Batina, D. Singelee, B. Preneel, and I. Verbauwhede, “Anti-counterfeiting, untraceability and other security challenges for RFID systems: public-key-based protocols and hardware,” in Towards Hardware-Intrinsic Security, A.-R. Sadeghi and D. Naccache, Eds., Information Security and Cryptography, pp. 237–257, Springer, Berlin, Heidelberg, 2010.
- X. Zhang, J. Li, Y. Wu, and Q. Zhang, “An ECDLP-based randomized key RFID authentication protocol,” in 2011 International Conference on Network Computing and Information Security, vol. 2, pp. 146–149, Guilin, China, 2011.
- Y. K. Lee, L. Batina, D. Singelée, and I. Verbauwhede, “Wide–weak privacy–preserving RFID authentication protocols,” in Mobile Lightweight Wireless Systems, P. Chatzimisios, C. Verikoukis, I. Santamaría, M. Laddomada, and O. Hoffmann, Eds., vol. 45 of Mobilight 2010. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, pp. 254–267, Springer, Berlin, Heidelberg, 2010.
- A. Mitrokotsa, M. R. Rieback, and A. S. Tanenbaum, “Classification of RFID attacks,” in Proceedings of the 2nd International Workshop on RFID Technology - Concepts, Applications, Challenges - Volume 1: IWRT, pp. 73–86, Porto, Portugal, 2008.
- “Radio frequency identification,” April 2017, https://en.wikipedia.org/wiki/Radio-frequency_identification.
- K. Finkenzeller, RFID Handbook, John Wiley & Sons, 1999.
- M. T. Wankhede Barsgade and S. A. Meshram, “Comparative study of elliptic and hyper elliptic curve cryptography in discrete logarithmic problem,” IOSR Journal of Mathematics, vol. 10, no. 2, pp. 61–63, 2014.
- S. R. Moosavi, E. Nigussie, S. Virtanen, and J. Isoaho, “An elliptic curve-based mutual authentication scheme for RFID implant systems,” Procedia Computer Science, vol. 32, pp. 198–206, 2014.
- J.-S. Chou, “An efficient mutual authentication RFID scheme based on elliptic curve cryptography,” The Journal of Supercomputing, vol. 70, no. 1, pp. 75–94, 2014.
- Nizamuddin, S. Ashraf Ch, and N. Amin, “Signcryption schemes with forward secrecy based on hyperelliptic curve cryptosystem,” in 8th International Conference on High-capacity Optical Networks and Emerging Technologies, Riyadh, Saudi Arabia, 2011.
- N. Koblitz, “Hyperelliptic cryptosystems,” Journal of Cryptology, vol. 1, no. 3, pp. 139–150, 1989.
- O. Diao and M. Joye, “Unified addition formulæ for hyperelliptic curve cryptosystems,” in Proceedings of the 3rd Workshop on Mathematical Cryptology (WMC 2012) and 3rd International Conference on Symbolic Computation and Cryptography (SCC 2012), pp. 45–50, Castro Urdiales, Spain, 2012.
- H. Hisil and C. Costello, “Jacobian coordinates on genus 2 curves,” in Advances in Cryptology – ASIACRYPT 2014. ASIACRYPT 2014, P. Sarkar and T. Iwata, Eds., vol. 8874 of Lecture Notes in Computer Science, pp. 338–357, Springer, Berlin, Heidelberg, 2014.
- J. W. Bos, C. Costello, H. Hisil, and K. Lauter, “Fast cryptography in genus 2,” in Advances in Cryptology – EUROCRYPT 2013. EUROCRYPT 2013, T. Johansson and P. Q. Nguyen, Eds., vol. 7881 of Lecture Notes in Computer Science, pp. 194–210, Springer, Berlin, Heidelberg, 2013.
- A.-R. Sadeghi, I. Visconti, and C. Wachsmann, “User privacy in transport systems based on RFID e-tickets,” in Proceedings of the 1st International Workshop on Privacy in Location-Based Applications, pp. 102–122, Malaga, Spain, October 2008.
- Y.-C. Yen, N.-W. Lo, and T.-C. Wu, “Two RFID-based solutions for secure inpatient medication administration,” Journal of Medical Systems, vol. 36, no. 5, pp. 2769–2778, 2012.
- F. Rahman, M. Z. A. Bhuiyan, and S. I. Ahamed, “A privacy preserving framework for RFID based healthcare systems10.1016/j.future.2016.06.001,” Future Generation Computer Systems, vol. 72, pp. 339–352, 2017.
- J. T. Kim, “Privacy and security issues for healthcare system with embedded rfid system on internet of things,” Advanced Science and Technology Letters, vol. 72, pp. 109–112, 2014.
- T. G. Winston, S. Paul, and L. Iyer, “A study of privacy and security concerns on doctors' and nurses' behavioral intentions to use RFID in hospitals,” in 2016 49th Hawaii International Conference on System Sciences (HICSS), Koloa, HI, USA, 2016.
- F. Rahman, D. Williams, S. I. Ahamed, J.-J. Yang, and Q. Wang, “PriDaC: Privacy preserving data collection in sensor enabled RFID based healthcare services,” in 2014 IEEE 15th International Symposium on High-Assurance Systems Engineering, Miami Beach, FL, USA, 2014.
- A. Aguilar, W. Van Der Putten, and F. Kirrane, “Positive patient identification using RFID and wireless networks,” in HISI 11th Annual Conference and Scientific Symposium, Dublin, Ireland, 2006.
- L. Hu, D. M. Ong, X. Zhu, Q. Liu, and E. Song, “Enabling RFID technology for healthcare: application, architecture, and challenges,” Telecommunication Systems, vol. 58, no. 3, pp. 259–271, 2015.
- A. Coustasse, B. Cunningham, S. Deslich, E. Wilson, and P. Meadows, Management of RFID systems in hospital transfusion services, 2015.
- M. Martínez Pérez, G. Vázquez González, and C. Dafonte, “Evaluation of a tracking system for patients and mixed intravenous medication based on rfid technology,” Sensors, vol. 16, no. 12, p. 2031, 2016.
- W. Yao, C.-H. Chu, and Z. Li, “The adoption and implementation of RFID technologies in healthcare: a literature review,” Journal of Medical Systems, vol. 36, no. 6, pp. 3507–3525, 2012.
- B. P. Rosenbaum, “Radio frequency identification (RFID) in health care: privacy and security concerns limiting adoption,” Journal of Medical Systems, vol. 38, no. 3, p. 19, 2014.
- B. Lee and H. Kim, “Privacy management for medical service application using mobile phone collaborated with RFID reader,” in 2007 Third International IEEE Conference on Signal-Image Technologies and Internet-Based System, pp. 1053–1057, Shanghai, China, 2007.
- D. S. Kim, T.-H. Shin, and J. S. Park, “A security framework in RFID multi-domain system,” in The Second International Conference on Availability, Reliability and Security (ARES'07), Vienna, Austria, 2007.
- A. Grover and H. Berghel, “A survey of RFID deployment and security issues,” Journal of Information Processing Systems, vol. 7, no. 4, pp. 561–580, 2011.
- Y.-S. Jeong and S.-S. Shin, “An efficient healthcare service model using IoT device and RFID technique in the hospital environment,” Journal of Advanced Research in Dynamical and Control systems, vol. 10, 2017.
- S. Khan, “Health care monitoring system in internet of things (IoT) by using RFID,” in 2017 6th International Conference on Industrial Technology and Management (ICITM), Cambridge, UK, 2017.
- J.-X. Hu, C.-L. Chen, C.-L. Fan, and K.-h. Wang, “An intelligent and secure health monitoring scheme using IoT sensor based on cloud computing,” Journal of Sensors, vol. 2017, Article ID 3734764, 11 pages, 2017.
Copyright © 2020 Vankamamidi S. Naresh et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.