Efficient Security Mechanisms for mHealth Applications Using Wireless Body Sensor Networks

2.1. Motivations

So far, the security schemes proposed for the WBSNs are mainly at the architectural level and are limited to key establishment and authentication. The main motivations by several researchers for designing security protocols for the WBSNs are to develop light weight security schemes in terms of computation and memory usage so that the network lifetime could be improved. Though the proposed protocols are more or less suitable to be used in wireless body sensor networks, most of them are not feasible in real implementation due to power and memory constraints of the sensors. Most of the previously proposed key distribution protocols are not suitable for the WBSNs due to large memory requirement, key establishment timings and more precisely as the body sensors are not deployed randomly. The symmetric key sharing among the nodes of the network is an important design issue for the security protocols. Though this key sharing approach has the lowest storage costs and power efficient, there are obvious security disadvantages such as the compromise of a single node will reveal the global key.

The sharing of pairwise keys between two nodes is more ideal since the compromise of a node does not reveal any keys. However, in this approach each node requires a unique key and keying relationship needs to be established after the network is deployed. Previously proposed asymmetric key methods such as digital signatures for the authentication are impractical as long signatures incur high communication overhead of 50∼1,000 bytes per packet to create and verify the signature. Another design security issue in WBSNs is to maximize the lifetime of body sensors. Hence, computation and operations of nodes during possible security verifications should be energy efficient and satisfy the hardware constraints. In order to minimize the number of shared keys, in this paper, we propose the light weight data confidentiality and authentication schemes without considering the key distribution or establishment among the nodes. A three tier network architecture along with light weight, low complexity data confidentiality and user authentication schemes are proposed for the WBSNs. The main contributions of our work can be summarized as follows:

• First of all, a three tier network architecture for the wireless body sensor networks (WBSNs) is proposed.

• Security and privacy challenges in WBSN are discussed and respective implementation feasibilities of currently available body sensors are analyzed.

• Based on the hardware constraints such as memory and computation capabilities of body sensors, a light weight security mechanism for the proposed three tiered WBSN network architecture is designed.

• In order to minimize the memory usage of nodes, key sharing with stronger security methods at the data communication level is developed such that the whole network requires only three types of keys and each sensor needs to store only one key.

• Light weight data confidentiality as well as authentication algorithms are designed for the body sensors as privacy of health related data of a patient should be maintained.

• A segmentation based data packet communication scheme is designed, where secret keys are embedded within those segmented packets for necessary verification of authentication and data confidentiality.

First Tier: Wireless Body Sensors (WBS)

In order to form a wireless body sensor network, it is proposed that each user should wear a number of wireless body sensors that are strategically placed on his/her body. The primary functions of these sensor nodes are to unobtrusively sample vital signs and transfer the relevant data to a personal server through wireless personal network implemented using ZigBee (IEEE 802.15.4). The biomedical sensors fitted on the body are supposed to measure blood pressure, heart beats, functioning of lungs, liver etc. Accordingly, various sensors such as ECG, accelerometer, oximeter, blood pressure monitor are fitted on a wearable suit to monitor a person from time to time. The sensor information is collected and transferred wirelessly to a smart sensor (gateway) that analyzes the ECG and other sensor data locally. The smart sensor processes the sensor data and monitors the patient's well-being, and in case of an emergency, it automatically generates alarms and forwards the analyzed data to the nodes present in the second tier through a mini-gateway present in the first tier. Ultimately, the information is passed to the emergency service provider (ESP) via internet as shown in Figure 1.

Second Tier: Network Connectors (NC)

In an indoor environment, the network connector is considered as a sensor with higher computation and processing capacity and is mains powered. The devices of second tier collect data from the body sensors through a mini-gateway fitted in the smart suit as shown in Figure 2. The network connector (NC) transfers physiological data of a patient to the nearest gateway with help of other network connectors in a multi-hop fashion. In the second tier, the network connector (NC) is supposed to perform the following tasks:

• Initialization, configuration, and synchronization of WBSN nodes.

• Control and monitor operation of WBSN nodes.

• Collection of sensor readings from physiological sensors.

• Processing and integration of data from various physiological sensors providing better insight into the users state.

• Providing an audio and graphical user-interface that can be used to relay early warnings or guidance.

• Secure communication with remote healthcare provider via gateway nodes.

Third Tier: Base Station (BS)

The third tier of the WBSN is composed of several base stations. Those base stations are powerful sensors with longer communication range and higher processing and battery power. They are mains powered and are connected to the internet to transmit data to the emergency service provider. It is assumed that a base station may send data to the internet directly or with help of other base stations in a multi-hop fashion. Accordingly, as shown in Figure 1, there are several base stations that are connected to the internet.

It is to be noted that the whole WBSN is composed of nodes from those three different tiers. Though, emergency service provider (ESP), doctors, hospitals are also part of the WBSN, our security mechanisms are limited with the nodes of those three tiers as discussed above. We do not consider the security issues of ESP as it could be a database server with different security mechanism.

4.1. Technical Feasibilities

As we know, sensor nodes have very limited computational and power resources for executing several arithmetic and logical operations. Due to such hardware constraints of the sensor nodes, the public key certificates in asymmetric cryptographic algorithms like RSA [33] and Diff e–Hellman [34] are not suitable for WBSNs as the working memory of a sensor node is insufficient even to hold the variables. The symmetric algorithms, like AES and integrity/authentication algorithms like HMACs [35] incur high computational energy costs and are designed for the powerful workstations. Hence, the core asymmetric, symmetric and authentication algorithms in their current form are not suitable for the WBSNs as the computational cost is an overhead to the power consumption.

Based on different hardware constraints and the applications of WBSNs, we have classified the sensor nodes into three categories such as the generic wireless body sensors, special-purpose network connectors and the high-bandwidth base stations. The hardware specifications of these nodes are given in Tables 1, 2 and 3, respectively. As given in Table 1, Telos-B Mote [36] TPR2420 is developed by Crossbow and is an open-source platform. TPR2420 combines all essentials for lab studies into a single platform including USB programming capability, an IEEE 802.15.4 radio with integrated antenna, a low-power MCU with extended memory and an optional sensor suite. Besides, it includes several other features like IEEE 802.15.4 compliant RF transceiver, a globally compatible ISM band 2.4 to 2.4835 GHz, 250 kbps data rate, integrated onboard antenna, 8 MHz TI MSP430 microcontroller with 10 kB RAM, low current consumption, 1 MB external flash for data logging, programming and data collection via USB and runs TinyOS 1.1.11 or higher. More technical specification [36] of this generic sensor is given in Table 1.

The Rockwell WINS Hidra nodes consist of 2 × 2 boards in a 3.5 × 3.5 × 3 enclosure. There are various sensors such as seismic (geophone), acoustic, magnetometer, accelerometer, temperature, pressure and uses RF communications. Technical specification [37] of this sensor is given in Table 2.

The Stargate NetBridge [38] is an embedded sensor network gateway device, which can act as a base station to send and receive data with other base stations. It can connect to other sensor nodes to an existing Ethernet network. It is based on the Intel IXP420 XScale processor running at 266 MHz. It features one wired Ethernet and two USB 2.0 ports. The device is further equipped with 8 MB of program FLASH, 32 MB of RAM and a 2 GB USB 2.0 system disk. Stargate NetBridge also contains a built-in Web server and sensor network management tool. The network management tool can automatically identify what types of sensor boards are plugged into the nodes of the wireless sensor network and will instruct Mote Explorer to display the data accordingly. It is truly plug-and-play with minimal overhead for configuration and administration. Technical specification [38] of this node is given in Table 3.

As shown in Figure 3, we propose to use the generic TelosB Mote-TPR2420 as the body sensors, RSC Wins-Hidra nodes as the special purpose network connectors and Stargate NetBridge as the base station, which is connected to the internet. In Figure 3, though the wireless body sensor network is represented by a single node, several nodes are present in the network in a realtime application environment. Classifications of nodes based on the proposed network architecture is described in the following subsection.

4.2. Classification of Nodes

In order to design a lightweight security mechanism for the WBSN, we classify the whole wireless body sensor networks into three types of nodes. They are the Sensor nodes (SN), Network Connectors (NC) and Base stations (BS) as shown in Figure 4. The whole network is divided into several clusters based on standard clustering algorithms [39,40], where each cluster has only one cluster head. The body sensors (SNs) and network connectors (NCs) are deployed randomly, whereas multiple base stations are deployed manually depending on the location and communication range of the network connectors. As soon as SNs and NCs are deployed, they organize among themselves and form the cluster based on different criteria such as their location from the sensors, communication range and limitation of the number of sensors to be connected with them. We assume that several protocols [39,40] are already designed to handle efficient clustering methods. In our protocol, each cluster head is assumed to be a network connector (NC) that controls several SNs, which is quite reasonable as per the existing clustering algorithms. The NCs of different clusters exchange their collected data with each other. Besides, the NCs also transmit their data to the nearby base station (BS) and finally to the user or network manager, which is located somewhere far away from the monitoring region that access the sensed data and monitors the network via the base stations (BSs). The nodes of the three tier network architecture can be designed as given below.

• Tier 1 Nodes: The first tier nodes of the network model are the set of generic sensor nodes (SN) like Telos-B Motes [36], which are put in a wearable smart suit. Their functions are simple, specific and are usually operated independently. They sense the medium, collect the raw data and forward it to the next hop neighbor nodes, which are ultimately forwarded to the nodes of the second tier. The hardware specifications of such nodes are shown in Table 1.

• Tier 2 Nodes: Some special purpose sensor nodes like RSC Wins-Hidra Nodes [37], limited number of which are deployed over the monitoring region. In each cluster, there exists only one network connector (NC), which is cluster head of that cluster, and receives data from the SNs of its own cluster and forwards them to the NCs of other clusters. These nodes are assumed to be more powerful in terms of computation with longer battery life and larger memory than the SNs. The technical specification of these nodes is presented in Table 2. Each NC of the network has a unique ID, which may be assigned based on its cluster ID. NCs can track events or targets using the sensors of its own cluster and prepare the final report using data fusion and aggregation techniques to forward the final data to the nodes of the third tier. It is to be noted that each logical cluster can be considered as one home of a patient, where wearable wireless body sensors are used.

• Tier 3 Nodes: The high-bandwidth sensing and communicating nodes like Stargate gateways [38] form the third tier of the network and are known as the BS of the WBSNs. As per our proposed network architecture, we consider multiple base stations, whose operating characteristics are given in Table 3. These base stations are low-Power, small-Size, 400 MHz, Linux single board computer with enhanced communications and sensor signal processing capabilities. These Stargate gateways use Intel's latest generation 400 MHz X-Scale processor. In addition to traditional single board computer applications, the Stargate directly supports applications designed around Intel's Open-Source Robotics initiative as well as TinyOS-based Wireless Sensor Networks. These nodes have relatively powerful processing, memory, and transmission capacity and have long battery life, and they could be mains powered so that there is no power constraint. It is assumed that these base stations (BSs) are connected wirelessly to the user or network manager via internet and satellite.

5.1. Key Arrangements

It is assumed that communication among SNs in each clusters (e.g., nodes of the first tier) is only broadcasting and routing of packets among NCs and NCs to BSs (e.g., communication among nodes of second tier and second with third tier) is only unicasting by nature. We propose three different types of keys for the whole network, which is summarized below and hierarchical key sharing architecture is shown in Figure 5.

• Sensor Key: Each sensor of the network has a unique secret key, which is common for all the sensors of the network irrespective of its location in any cluster. This common secret key is denoted as E_SN. We assume that the SNs of each clusters are fixed with respect to their cluster head (NC).

• Network Connector Key: Each cluster head that is otherwise known as NC has a unique secret key, which is denoted as E_NC. The network connector key E_NC of a NC (cluster head) is same for all the NCs of the network. It is to be noted that the network connector key E_NC is distinct from the sensor key E_SN. In order to make necessary security verification with the sensors, it stores E_SN and also stores its own key E_NC for making necessary security verifications with other NCs of the network.

• Base Station Key: Each BS of the network has a unique secret key, which is common for all BSs and is denoted as E_BS. This key is distinct from the E_SN and E_NC. Each BS stores E_BS and E_NC, in order to make necessary security verifications with other BSs and NCs, respectively.

As shown in Figure 5, the sensors that belong to the first tier of the network have only one secret key E_SN, which is same for all the nodes of the first tier. The NCs that belong to the second tier of the network have only one secret key E_NC, which is same for all the nodes of the second tier. Similarly, the BSs that belong to the third tier of the network have only one secret key E_BS, which is same for all the nodes of the third tier. It is proposed that SNs of each cluster store only one key E_SN for necessary security verifications with SNs of the same or other clusters. Each NC stores E_SN and E_NC for necessary security verifications with SNs of its own cluster and NCs of other cluster, respectively. Similarly, each BS stores E_NC and E_BS for necessary security verifications with NC and other BSs, respectively.

We consider the upstream data flow from the SNs to the NCs, which is reasonable as sensors are meant to probe the environment to detect a target or event and inform it to the base station through gateway nodes. Hence, each NC uses E_SN to maintain the data confidentiality with the sensor nodes it is attached to. Under special circumstances, if a NC issues mission, sends queries and interests, to the SNs of its cluster, it uses its own key E_NC to verify the data confidentiality received from the sensors. It is assumed that the secret keys of SNs, NCs and BSs are assigned at the manufacturing stage as the key assignment at the network formation phase in a hostile medium is not secure. It is to be noted that since each SNs, NCs or BSs has the same secret key, key assignment and management in the post deployment of nodes does not require any computation and key establishment. For example, sensor nodes A, B and C can use their common secret key whether they are in the same or in different clusters after the deployment of the nodes as the common keys of all sensors are same.

5.2. Data Confidentiality

Before we describe the data confidentiality algorithms, we present here some of the useful terms that we have used in the next subsequent steps.

• Let, A and B be two sensors present in the first tier of the network, which transmit x -bits of message M (plain text).

• n is a pre-assigned integer such that 0 < n² < x. It is known to both the sender and the receiver in advance, e.g., during the network construction phase and the value is fixed for all the messages.

• Divide the whole message M into k-numbers of sub-messages M₁, M₂,…, M_k of n²-bits each such that M₁ | M₂ | … | M_k denotes the concatenation of k-numbers of message into M, where $k=\lceil \frac{x}{n^2}\rceil .$

• E_SN is the secret key of n²-bits, which is common for sensor nodes A and B and ⊙ is a user defined binary operation. Both E_SN and ⊙ are known to both sensors a priori. However, ⊙ acts like a session key and types of binary operations can be changed from time to time by the cluster head GN to enhance the security.

• Using the secret key E_SN, let the cipher text {M}_ESN be generated from the plain text M.

Suppose the plain text message M of x-bits is sent by any sensor to another one after encrypting it by the n²-bits secret key E_SN. Then the encrypted message is:

Based on the proposed physical situation based key generation mechanism, let us assume that a time stamp matrix T_i of n²-bits, for ∀i = 1, 2, 3,…, k, is considered. For each message, sent at different instant of time, different time stamp matrices T_i are generated by using the common secret key E_SN. Thus, several new secret keys E_i^SN are generated, which are only known to the sender. The subsequent new secret keys can be generated as follows:

Now break the original message M into k-number of messages M₁, M₂,…, M_k, each of n²-bits. Since $k=\lceil \frac{x}{n^2}\rceil$, it is obvious that for $\frac{x}{n^2}$ is not a whole number, M can be broken into (k − 1) number of messages of n²-bits each, and another one message (M_k) of [x − n² * (k − 1)]-bits, which is less than n²-bits. In this case, the last message M_k will have [x − n² * (k − 1)]-bits of message and rest bits are garbages such as ♡ or anything else. However, if $\frac{x}{n^2}$ is a whole number, M is broken into k-numbers of messages, each having n²-bits. The new cipher message C_i is generated by taking the messages M_i and the new encrypted matrix E_i^SN. Thus the transmitted cipher message at different instants T₁, T₂, T₃,…, T_k are:

Finally, the sender transmits the original message M in form of the cipher messages C_i. The data packet transmitted by the sender contains n²-bits of the cipher message and n²-bits of time-stamp matrix and the whole message M is transmitted for k-times. Upon receiving the data packets, the gateway nodes decrypt each cipher messages using the secret key E_SNand the time-stamp matrix T_i. Since the secret key E_SN and binary operation ⊙ are only known to the sender and the receiver, the data confidentiality cannot be lost even though adversary is able to hack the cipher message. Thus, similar procedures of confidentiality schemes can be applied for establishing the necessary data confidentiality between the SNs and NCs. However, when the NC receives the data packet from any SN, it uses its secret key E_SN instead of E_NC to decrypt the message. But, if any message is sent from one NC to other, it uses E_NC to encrypt it before sending to other NC of the network.

5.3. Authentication

In this subsection, a low complexity authentication scheme is proposed, which is applicable to the nodes of all three tiers of the network. Each cluster head NC assigns a unique ID to each of the sensors present in its cluster. Similarly, each NC has a unique ID such as the ID of the cluster that it belongs to and each BS has also a unique ID too. Each NC stores ID of the sensors that belong to its own cluster and ID of other NCs too. Similarly, each BS stores ID of other BSs and ID of NCs that are connected to it. It is to be noted that the number of NCs and BSs deployed over the network is very small as compared to the number sensors (SNs). Besides, their storage, power and computational capabilities are higher than the SNs. Hence, it is reasonable to assume the maintenance of ID of the SNs by the NC of a particular cluster. The unique ID of the SN, NC or BS is considered as the public key for the authentication purpose, which is described as follows.

Let,

Now the sent message from A to B is:

• A → B: A(y, a, b, m) and the cryptographic function is:

• x² = y (mod n) such that

Ultimately, node B uses the public key cryptographic mechanism to calculate the value of n. If it matches with its preserved value of n with A's value of n, then it authenticate A as a legitimate sender. It is to be noted that y is the ID of the sender and for each sender there will be a unique n that should match with the receiver's n.

5.4. Theoretical Analysis

In this section we analyze the computational and storage cost of our protocol due to the key updating, establishment, encryption and decryption operations during the confidentiality verification. It is to be repeated here that in our protocol, we do not need any key updating mechanism as we assign a single key to all the sensors, another single key to all NCs, and also a single shared key to all the BSs of the network. Hence, in our protocol, there is no computational cost required in establishing the keying relationship among either the SNs or NCs or BSs. Also, our protocols do not impose any computational burden for key updating or in establishing the keying relationship. However, the computational cost in encrypting or decrypting the message can be calculated as follows:

• In case of SNs: Suppose, in a cluster a node has n different neighbors and x_i, i = 1, 2, 3,…, n be the number of neighbors of those n nodes. Hence, total number of required encryptions is: E_T = Σx_i, for i = 1, 2, 3,…, n. Similarly total number of decryption is also D_T = Σx_i, for i = 1, 2, 3,…, n.

  In a cluster, average number of symmetric operations are $=\frac{2\sum x_i}{(n+\sum x_i+1)}$

• In our protocol NCs communicate with other NCs by unicasting the message. Suppose, the whole network has m numbers of NCs. In the worst case, an NC will have at most (m − 1) neighbors. The average number of encryptions and decryptions in case of the NCs is $=\frac{2(m-1)}{m}$

• In case of BSs: Suppose, the whole network contains p number of BSs. As the communication among the BSs is also unicasting, average number of encryptions and decryptions is $=\frac{2(p-1)}{p}.$

In our protocol, p < m < n. Hence, total average number of encryption and decryptions operations $=\frac{2\sum x_i}{(n+\sum x_i+1)}+\frac{2(m-1)}{m}+\frac{2(p-1)}{p}.$. Besides, in our protocol, a node stores only two types of keys, e.g., E_SN and E_NC and keys are same for all the nodes the cluster. Hence, there is no requirement to store the chain of keys for its neighbors. If l₁ is the key length of E_SN and l₂ is the key length of E_NC, then the total key length is required to store in each SN is l = l₁ + l₂. Though memory space is the scarce resource for the sensor nodes, for a reasonable key length of E_SN and E_NC, storage is not an issue in our protocol. It is observed that the storage requirement, encryption and decryption computational costs of our protocol is least, which is evidenced from the simulation results as given in the following section.

6.1. Simulation Setup

Our proposed data confidentiality and authentication schemes are evaluated using ns 2.33. A rectangular monitoring region of size 100 x 100 m² is taken and 1,000 nodes are deployed over it. Based on our proposed scheme, total number of deployed nodes include three different types of nodes such as Sensor nodes (SN), Network Connectors (NC), and Base station (BS). Though SNs and NCs are deployed randomly, BSs are deployed manually. The schemes are evaluated with variable node numbers of 100 through 1,000. In each case, 90% of the total deployed nodes are taken to be SNs, 9% of them are NCs and only 1% are BSs. In our simulation, IEEE 802.15.4 MAC is considered as the medium access mechanism during the communication between sensors and sensors with gateways, whereas unicasting is used for the communication between BSs and BS with NCs. The communication range of each node is fixed at 10 meters. The energy consumption due to transmission of a packet by sensors or gateway nodes is considered to be 0.2 joules. It is to be noted that our schemes consider only upstream communication, i.e., only sensors transmit data to their neighbor sensors or to its cluster head as the gateway.

6.2. Simulation Results

In order to evaluate the performance of proposed security schemes, we simulated the energy consumption, computation time, memory usage and control packets overhead as compared to standard key establishment schemes with our authentication and confidentiality schemes. As per our proposed scheme, each sensor is given only one key (E_SN) as contrary to the standard key establishment protocols. The energy consumption is evaluated as shown in Figures 6, 7 and 8 in terms of different number of nodes, computation time and size of the transmitted packets. In our simulation, energy consumption is defined as the amount of energy consumed in completing a process such as establishing the keys among the deployed sensors or authenticating a node based on our scheme or maintaining confidentiality as per our model. As shown in Figure 6, it is found that energy consumption for establishing the keys among different number of nodes is higher than the confidentiality and authentication. However, in each case energy consumption increases if number of deployed nodes are increased. Energy consumption in authentication is less than the energy consumption due to confidentiality implementation.

As shown in Figure 7, energy consumption of the whole network is evaluated for different values of computation time in establishing the keying relationship among the nodes and in executing the data confidentiality and authentication mechanisms. It is observed that energy consumption is directly proportional to the computation time. Obviously, energy consumption of the network is increased due to longer computation time. Energy consumption of the nodes is also evaluated with size of the packets that are exchanged between the nodes in executing the proposed security mechanisms as shown in Figure 9. It is found that energy consumption is more in case of key establishment as compared to the authentication and data confidentiality. Least amount of energy is consumed in authentication as very few messages are exchanged and each packet is segmented and therefore requires limited energy to transmit them.

The computation time is analyzed for different number of nodes and size of the packets as shown in Figures 9 and 10, respectively. In our simulation, computation time is defined as the time require to authenticate a node by the sensors, network connector or base station and also the time taken to measure the confidentiality of a sent packet. As shown in Figure 9, our data confidentiality and authentication schemes are simulated with different number of nodes. It is found that the computation time is longer in case of key establishment as compared to our proposed security schemes. Though implementation of our confidentiality mechanism requires more computation time, it is visibly shorter than the key establishment scheme. Our authentication scheme takes least computation time. Moreover, with smaller computation time, our scheme can provide better protection to the wireless body sensor networks. As shown in Figure 10, it is observed that confidentiality or authentication requires longer computation time if size of the sent packet is large. As per our scheme, confidentiality requires more computation time as a single packet is segmented into several packets. However, our security schemes in form of authentication and confidentiality outperforms over key establishment.

The memory usage due to authentication and confidentiality is simulated and the result is compared with the key establishment scheme, as shown in Figures 11 and 12. The memory usage is defined as the amount of memory require to store the data such as sensor (E_SN), network connector (E_NC) and base station (E_BS) keys and necessary computation parameters. As shown in Figure 11, memory usage is analyzed with different number of nodes. Since we use very limited parameters to verify authentication and confidentiality, memory usage is smaller as compared to the key establishment scheme. Of course, more memory storage is required if number of nodes are deployed as we consider the average memory usage taking all deployed nodes. As shown in Figure 12, memory usage is analyzed with size of the data packet. It is observed that our schemes require less storage as compared to key establishment protocol.

The packet overhead in establishing the key and communication during our proposed authentication and confidentiality schemes is simulated with number of nodes and the result is shown in Figure 13. Though the key establishment needs less number of control packets for smaller number of nodes, it gradually increases with higher number of nodes. Besides, our authentication and confidentiality schemes use less number of control packets as inferred from Figure 13.