ECG-Cryptography and Authentication in Body Area Networks

ECG-Cryptography and Authentication in BodyArea NetworksZhaoyang Zhang,Honggang Wang,Athanasios V.Vasilakos,and Hua FangAbstract—Wireless body area networks(BANs)have drawn much attention from research community and industry in recent years.Multimedia healthcare services provided by BANs can be available to anyone,anywhere,and anytime seamlessly.A critical issue in BANs is how to preserve the integrity and privacy of a person’s medical data over wireless environments in a resource ef-ficient manner.This paper presents a novel key agreement scheme that allows neighboring nodes in BANs to share a common key gen-erated by electrocardiogram(ECG)signals.The improved Jules Sudan(IJS)algorithm is proposed to set up the key agreement for the message authentication.The proposed ECG-IJS key agree-ment can secure data commnications over BANs in a plug-n-play manner without any key distribution overheads.Both the simu-lation and experimental results are presented,which demonstrate that the proposed ECG-IJS scheme can achieve better security performance in terms of serval performance metrics such as false acceptance rate(FAR)and false rejection rate(FRR)than other existing approaches.In addition,the power consumption analysis also shows that the proposed ECG-IJS scheme can achieve energy efficiency for BANs.Index Terms—Eletrocardiogram(ECG),energy consumption, fuzzy vault,monic polynomial,wireless body area networks (BANs).I.I NTRODUCTIONW IRELESS body area networks(BANs)can be deployed on a person’s body for pervasive and real-time health-care monitoring in the form of multimedia such as text,au-dio,image,and video.The nonintrusive and ambulatory health monitoring of patients’vital signs over BANs provides an eco-nomical solution to the current healthcare system,in which the healthcare information can be distributed to users anytime through handheld devices and internet.A BANs consists of a set of mobile and small size intercommunicating sensors, which are either wearable or can be implanted into the human body for monitoring vital signs(e.g.,heart rate,brain activ-ity,blood pressure,and oxygen saturation)and/or environmen-tal parameters(e.g.,location,temperature,humidity,and light) and movements.However,there are several research challengesManuscript received January30,2011;revised April9,2012;accepted June 18,2012.Date of publication June26,2012;date of current version November 16,2012.Z.Zhang and H.Wang are with the Department of Electrical and Computer Engineering,University of Massachusetts,Dartmouth,MA02747-2300USA (e-mail:zzhang1@;hwang1@).A.V.Vasilakos is with the Department of Computer and Telecommunications Engineering,University of Western Macedonia,Kozani50100,Greece(e-mail: vasilako@ath.forthnet.gr).H.Fang is with the Department of Quantitative Health Science,Univer-sity of Massachusetts Medical School,Worcester,MA01655USA(e-mail: Hua.Fang@).Color versions of one or more of thefigures in this paper are available online at .Digital Object Identifier10.1109/TITB.2012.2206115before BANs can be widely deployed.First,the sensors have limited resources in terms of energy,bandwidth,memory,and computational capability,a lightweight communication solution should be pursued in BANs.Second,since the performance of BANs is closely related to people’s health,it is important to have safe sensor networks in which the requirements of medical data privacy,confidentiality,authentication,and integrity should be satisfied.The lack of security in the operation and communica-tion of resource-constrained medical sensor nodes in BANs has been an obstacle to move the technology forward.A.Cryptography and Authentication for Secure Multimedia Healthcare ServicesCryptography and authentication methods are utilized in BANs to offer secure multimedia healthcare services via wire-less communications.In BANs,sensors usually rely on the cryp-tographic keys to secure multimedia data communications.Nu-merous key management and distribution schemes have been developed to offer the security in general wireless sensor net-works.However,they cannot be directly applied for the BANs due to the scale of biomedical sensors.However,designing an efficient key management and agreement scheme in BANs is still challenging.The key distribution methods,such as probabilis-tic key distribution[1],SPINS[2],LEAP[3],and asymmetric cryptosystems[4],have been developed to distribute security keys in BANs.But these methods are not easily implemented in body sensors due to limited sensor resources,or requiring predeployment of the secret keys that are hard to be replaced and are vulnerable to offline crack.In addition,the overheads of the key management and distributions in these methods are huge when large number of sensor nodes are deployed[5],[6]. In this paper,we present a new key agreement scheme called ECG-improved Jules Sudan(IJS),which utilizes physiologi-cal signal such as ECG signals for generating cryptographic ing ECG-IJS scheme,the secure intersensor commu-nication could be implemented in a“plug and play”manner, which means that no previous key distribution is needed.The secret keys used in the communication are generated based on the ECG signals,which meets the the requirements of long, random,time variant keys proposed in[7].The proposed key is generated from a universally measurable physiological stimuli (ECG)that is unique and distinctive for each person.Addition-ally,the ECG-IJS scheme only needs a small time period to generate keys with low computational requirements.The ECG-IJS scheme can also achieve better performance in term of false acceptance rate(FAR)and false reject ratio(FRR)than the existing research work in[8].In addition,it is an energy efficient scheme because it does not require the chaff points(communi-cation overheads)used in[8].A power consumption analysis1089-7771/$31.00©2012IEEEFig.1.Body sensor networks.is given to demonstrate the energy efficiency of the proposed ECG-IJS scheme.B.Major ContributionsWe summarized our major contributions in this paper.First, we innovated a new biometric-based approach to authenticate the message through a lightweight manner in BANs,which is a piratical solution and can be simply implemented in the resource constrained biomedical sensors;second,a novel key-agreement scheme is developed to allow communication parties to share the same key without much overheads;finally,a framework for the security and energy efficiency analysis of BANs is given to evaluate the efficiency of the proposed approach.Our research opens a new vista of securing medical data transmission over BANs.II.R ELATED W ORKSA typical topology of BANs shown in Fig.1includes mul-tiple types of medical sensors that can be wirelessly connected to other medical sensors or to the control nodes(e.g.,Smart-phones),which could interface with other types of networks such as WiMAX or WiFI to further deliver the collected medi-cal information to the information center.Much great effort has been devoted to developing secure communication schemes be-tween the internet and control nodes.Thus,our studies focus on the securing intersensor communication over the body area in-stead.A comprehensive survey on wireless body area networks is given in[9].Besides the transitional key distribution schemes,there are several on-going research works that implement the key distribu-tion using biometric features.The research in[7]and[10]–[12] utilizes the physiological signals for securing intersensor com-munication over BANs.The authors in[10]and[11]proposed the use of the frequency coefficients of the ECG or photoplethys-mogram(PPG)signals to generate cryptographic keys.In[7] and[12],the interpulse interval derived from ECG/PPG signals is proposed to generate cryptographic keys.The fuzzy vault method proposed by Jules and Sudan in[13] has been used in the message authentication withbiometric Fig.2.Processes of QPSK using fuzzy vault.information as shown in[14]–[16].In[8],the authorsfirstly proposed to use the fuzzy vault method called physiological-signal-based key agreement(PSKA)to secure intersensor com-munications.Then,some modified fuzzy vault scheme[17], [18]were proposed to use the ECG signals to improve security performance.The authors in[19]give an improved Jules and Sudan scheme,which has been proved with high performance in the applications of thefingerprint-based key generation[20]. The PSKA scheme proposed in[8]uses fuzzy vault to lock the randomly generated key in the vault at the sender,and unlock the vault to regenerate the key by the similar features available at the receiver.However,the security of the vault depend on its size,so extra chaff points are needed to ensure the security of the vault, which brings the extra communication overheads.The authors of paper[21]suggest the use of ECG signals as a biometric feature to authenticate users and messages.The approach requires the creation of an ECG template and then comparing their current ECG signals with this template to verify the identity.However, it is not efficient to achieve good security performance due to using the static template.In our proposed ECG-IJS,we extract the time-variant features from the ECG signals and use them as keys to encrypt/authenticate messages.III.S YSTEM M ODELSA.Fuzzy Vault SchemeA fuzzy vault scheme was proposed by Juels and Sudan[13]. The fuzzy vault scheme is designed to lock(hide)a secret S in a construct called a vault using a set of values A.The procedure of construct a Vault is as follows:1)generating a v th-order polynomial p over the variable x that encodes the secret S;2)computing the value of the polynomial at different values of x from set A and creating a set R={a i,p(a i)}and3)adding randomly generated set of points C=c i,c j called chaff to R. Once the vault has been constructed,only the values B similar to set A could unlock the vault and discover the secret S.The unlock procedure is an inverse process:1)finding points(x i,y i) from R according to the element in B;2)reconstructing the v th-order polynomial by the acquired points above;3)decoding the coefficients of the polynomial using a Reed–Solomon decoder. If thefinal decoding operation is successful,then the output secret k should be equal to k if the set B is close to the original set A.Otherwise,the reconstruction process of the secret key fails.The PSKA method[8]uses the fuzzy vault in BANs as a key agreement protocol.The key agreement process of PSKA using fuzzy vault scheme is shown in Fig.2,which contains both vault construction and reconstruction processes.B.Improved Fuzzy Vault SchemeBased on Juels and Sudan’s work,Y .Dodis et al.proposed an improved fuzzy vault algorithm called IJS [19].In IJS algorithm,the sender can construct a unique monic polynomial using the F as the roots and send parts of the coefficients to the receiver.Without knowing most of the roots,it is impossible for the receiver to reconstruct the monic polynomial to discover K .When the receiver receives the coefficients sent by the sender,it can reconstruct the polynomial by F it has.The receiver could successfully reconstruct the monic polynomial only when F and F share most common pared with the original fuzzy vault algorithm,the IJS algorithm does not using chaff points to hide the secret (Key).Thus,the communication overheads between the sender and the receiver is significantly reduced.We introduce the process of the IJS algorithm that could tolerate t set difference features briefly in the following.1)Let f (x )be the unique monic polynomial of degree s such that p (x )=0for all x ∈w .2)Output t coefficients of p (x )from degree s −1down to s −t ,i.e.,if w =x 1,...,x s ,then ouputix i , i =jx i x j ,...S ⊆[s ],|S |=ti ∈Sx i .(1)Here,t coefficients are sent to the receiver without the en-cryption.The eavesdroppers may get these coefficients,but it isimpossible for them to recover the w .Once the receiver get the t coefficients from the sender,it can reconstruct the monic polyno-mial f (x )with the w ,which should share at least s −t common elements with w .The process of recover the w using the received t coefficients and w is as follows,where w =a 1,a 2,...,a S .1)Create a new polynomial f h using coefficient 1and the received t coefficients.Then,f h shares the top t +1coefficients with that of f ,which is described asf h (x )def =x s + s −1i =s −t a i x i.2)Evaluate f h on all points in u i ∈w to obtain s pairs (u i ,v i ),in which v i =f h (u i ).3)Use [s,s −t,t +1]Reed–Solomon decoding [22]to search for a polynomial f l of degree s −t −1such that f l (u i )=v i for at least s −t/2of the u i values.4)If the searching process has completed successfully,then output the list of zeros (roots)of the polynomial f h −f l .Otherwise,output “fail.”The algorithm can tolerate t difference errors dis (w,w )≤t ,which is required by our designed scheme due to the dynamic nature of ECG features.Let f (x )be f (x )=w i ∈w (x −w ).The polynomial f (x )is monic x s .We can divide the re-maining coefficients into two groups:the high coefficients denoted a s −t ,...,a s −1,and the low coefficients denoted by b 1,...,b s −t −1:f (x )=x s+s −1 i =s −ta i x if h (x )+s −t −1i =0b i x iq (x )(2)f (x )can be written as f h (x )+q (x ),where q (x )has degrees −t −1.The recovery algorithm will have the coefficients of f h as the input.For any point x in w ,0=f (x )=f h (x )+q (x )Fig.3.Process of ECG-IJS algorithm.is satisfied.Thus,f h (x )and −q (x )agree at all points in w .Sinceset w intersects w in at least s −t/2points,the polynomial −q (x )satisfies the conditions.In addition,the polynomial is unique,since no two distinct polynomials of degree s −t −1can have the correct b i on more than s −t/2a i .Thus,the recovered polynomial f l (x )should be −q (x ).Then,f h (x )−f l (x )=f (x )is satisfied.Consider the following example that illustrates the process of the IJS.Suppose s =5and t =2,let the sender and the receiver have the set w ={1,2,3,4,5}and w ={1,3,5,7,9},respec-tively.The elements in w and w could be in any order.Then,the sender will generate a monic polynomial f (x )=(x −w i )=x 5−15x 4+85x 3−225x 2+274−120,and then it send two coefficients {−15,85}to the receiver.After re-ceiving the four coefficients,the receiver constructs a poly-nomial f h =x 5−15x 4+85x 3,and then evaluates all the elements in the set u i ∈w by v i =f h (u i )to form a set of pairs {(1,71),(3,1323),(5,4375),(7,9947),(9,22599)}.Reed–Solomon decoding is used to search a polynomial f l with degree 2such that v i =p l (u i )for at least 4of u i values.After the searching process,the receiver gets f l (x )=225x 2−274+120.Thus,the receiver reconstructs the f (x )=f h (x )−f l (x ).And then,it could recover w by solving the roots of the monic polynomial f (x ).Compared with the original fuzzy vault scheme,the IJS al-gorithm does not use the chaff points to secure the information.Thus,it reduces the transmission overheads,saves the transmis-sion energy and prolongs the lifetime of the battery.Most of nodes in BANs are battery supported,the availability and reli-ability of the networks increases if less energy is consumed.In this paper,a scheme called ECG-IJS key agreement that uses the ECG signals and IJS scheme is proposed to implement the key agreement protocol in BANs.C.Proposed ECG-IJS SchemeBased on the IJS algorithm described earlier,we propose an ECG-IJS key agreement to secure data communication in BANs.Especially,our approach focuses on the intercommunication and authentication between the sensor nodes in the BANs.The proposed ECG-IJS scheme is shown in Fig.3.In the scheme,we assume that both the sender and the receiver have the capability to sample the ECG signals from the human body.Thus,the same feature extraction algorithm can be utilized to generate features form the collected ECG signals.The processes of extracting features from the ECG signals are shown in Section IV.The features F and F are used as keys to encrypt and decryptFig.4.ECG-IJS authentication scheme.the message to achieve secure communication in BANs.The process of the ECG-IJS scheme is described as follows.ECG-IJS key hiding:1)extracting the feature F from the ECG signal and formingthe secret K;2)using the ECG feature F as the root to build a unique ECGmonic polynomial with degree s;3)calculate the coefficients of the ECG monic polynomialand then output the ECG vault coefficients from the degree s−1to s−t.t denotes the number of coefficients.the number t is trans-mitted without the encryption to the receiver with a subset of coefficients together.t affects the performance of the proposed ECG-IJS scheme as shown in Fig.8and9.In addition,the value of t could be predefined/predeployed in the sensor nodes within the same body area network according to the authentication per-formance requirements(i.e.,FAR or FRR).When the receiver receives the subset of the monic polynomial coefficients,it can reconstruct the ECG monic polynomial based on the ECG signal it samples from the same human body as the sender.ECG-IJS key recovering:1)extracting the feature F from the ECG signal;2)constructing a new ECG feature polynomial p high withdegree s using the coefficients it receives;3)evaluating the above polynomial on all points in F to geta set of pairs;4)using Reed–Solomon decoding to search for a polynomialwith degree s−t−1to meet most of the pairs.5)reconstruct the ECG vault secret K by searching resultsand coefficients received from the sender.D.System DesignA typical proposed design for the message authentication is described in Fig.4.The example applications shown in the figure are using BANs for diabetes monitoring in which the glucose sensors deployed or implanted in the skin continuously monitor and wirelessly transmit the blood glucose levels to the microchip-based control devices for an accurate,timely,and efficient insulin release.In such a system,the integrity and con-fidentiality of sensitive medical data among sensor nodes must be protected against modification or other malicious attacks,be-cause malicious or fraudulent(i.e.,alteration of drug dosages or treatment procedures)can be extremely hazardous[23].Other similar attacks include the deliberation of health data leading to wrong diagnosis and treatment,and the falsification of alarms or the suppression of real alarms in emergency.Because of the limited resources in body sensors in terms of power and computation capability,and transmission capabil-ity,an energy-efficient solution is required to secure the data transmission.In the proposed ECG-IJS scheme,at the sender, features F are extracted from the ECG signals to form a secret k,which is used to encrypt the glucose data or general message, and then it sends the encrypted message,IJS coefficients and the HASH-based message authentication code(MAC)to the receiver.After the receiver gets the packet,it could recover the secret k using the ECG signal measured at the receiver’s site and then decrypt the encrypted message using the key k.When the message are received at the receiver,the MAC is recalculated from it using the same algorithm.The results will be compared with the received MAC to complete the authentication precess.A monic polynomial with a degree s is generated at the sender based on the ECG features.Then,t coefficients are sent to the receiver with a hash value.After receiving the t coefficients, the receiver begins to recover the other s−t coefficients based on the t received coefficients and the ECG feature the receiver measures.If the ECG features at the receiver are similar with the ones at the sender,the receiver will be able to recover the other s−t coefficients of the monic polynomial.If the recal-culated hash value matches with the received hash value,then the receiver has successfully recovered the s−t coefficients set and the authentication process is completed.In the proposed ECG-IJS scheme,we assume that both the sender and the re-ceiver have the capability of sampling the ECG signals from the human body.This assumption could be realized by attaching an ECG sensor to a body sensor node such as a glucose sensor. However,the ECG measurements on the different areas of the body could still be different.We use the fast Fourier transform (FFT)peak index as a feature to characterize and tolerate the dif-ferences on the same body while they are significantly different on different bodies.The whole process is described as follows. Step1(Key Hiding):The sender measures the ECG signals and glucose data,and the glucose data will be sent to the re-ceiver.The receiver have statistically similar ECG signals when two sensors measure the ECG from the same body.Both the sender and the receiver use the same future extraction algorithm to generate feature set called IJS coefficients.The feature ex-traction algorithm is presented in details in Section IV.Once the features are generated,the sender uses it as a key to en-crypt the glucose data,and then send the following packet to the receiver:{ID s,ID r,E,S,N1,MAC(k,S|M|N1|ID s)},where the ID s and ID r are the IDs of the sender and receiver,respec-tively.M is the original message.E is the encrypted message. N1is a nonce used for the signature.S is the subset of t monic polynomial coefficients.MAC is a message authentication code using the Hash functions(e.g.,SHA-1or SHA-2),and the k is generated from the ECG features at the receiver site.Step2(Key recovering):After receiving the package from the sender,the receiver uses the feature extracting from the ECG andthe receiver data set S to recover the secret k by the proposedECG-IJS algorithm.The secret k is further used to decrypt theencrypted message E to obtain the original glucose data M.Step3(Authentication):The receiver uses the same authen-tication algorithm with the sender to recalculate the MAC.Ifthe MAC value calculated by the receiver is equal to the MACvalue received from the sender,the authentication succeeds.Otherwise,the authentication fails and the received packet willbe discarded.Step4(Acknowledgement):If the authentication process suc-cesses,the receiver sends an acknowledgement back to thesender in the format of{ID r,ID s,N1,MAC(k,N1|ID s|ID r)}, where N1is a nonce,the other symbols have the same meaningsas described earlier.IV.E XPERIMENTAL R ESULTSIn this section,we validate the proposed ECG-IJS scheme.The validation begins with the feature extraction from the ECGsignals,followed by the FAR and FRR analysis.After that,thesecurity analysis of the proposed ECG-IJS scheme is discussed.A.Feature ExtractionWhen two sensors in a BANs want to securely communicateeach other by using ECG signal measured separately from thesame body,the ECG featuresfirst need to be extracted from thesampled ECG signals.In our proposed scheme,we perform afrequency-domain analysis of ECG signals for generating thefeatures.This is because that the frequency components of phys-iological signals,at any given time,have statistically similarvalues as long as they are measured on the body.A time-domainanalysis shows that the values of the ECG signals measured atdifferent parts of the body(from different leads)have similartrend but diverse values.In this validation process of the pro-posed ECG-IJS scheme,the ECG signals are downloaded fromMIT-BIH Arrhythmia database[24].The MIT-BIH Arrhythmia Database contains48half-hour excerpts of two-channel ambu-latory ECG recordings.The recordings were digitized at360 samples per second per channel with11-bit resolution over a 10-mV range[25].The Feature extraction process is shown as follows.1)Get the ECG data for afixed time duration of4s.Thereason for choosing a4s duration is that we want it to include at least one heart beat.2)Resample the ECG data at120Hz.3)Conduct512points FFT of the ECG data;extract thefirst256coefficients because the coefficients are symmetric.4)Detect the local peaks on the extracted FFT coefficients;each of the peak location index is used as a feature.The ECG signals measured on the different areas of the body have statistically similar values within a time period.There are two reasons for selecting the FFT peak location index as a fea-ture.First,the feature changes dynamically but can easily be de-tected with low computational complexity.Second,the body’s physiological behaviors will be characterized by the peak loca-tion index features in the Fourier transform domain.Therefore,TABLE IFAR AND FRR P ERFORMANCEFig.5.FAR versus FRR.the peak location index is a good candidate that can be used to differentiate measurements(collected by a sensor)of one patient from those of different patients.The feature provides an efficient representation of ECG signals for the data authentication and secret key agreement.However,our proposed authentication framework does not limit to using the peak location index.Po-tential features such as the P-R interval could also be applied as long as they can meet the required authentication performance (i.e.,FAR and FRR).B.Performance AnalysisIn our experiment,we consider securing the communication between any two nodes within the same WBAN.We assume that the sensor nodes have the capability of measuring the ECG signals with an attached ECG sensor.In addition,we set the path loss exponent to3and7for the line of sight(LOS)channel and non-LOS(NLOS)channel same as in[26],respectively. In this part,FAR and FRR are used to evaluate the perfor-mance of the proposed ECG-IJS scheme.The half total error rate(HTER),computed by HTER=(FAR+FRR)/2,is also obtained.Ten person’s ECG data were randomly selected from MIT-BIH Arrhythmia Database[24].The FAR,FRR,and HTER performance evaluated by the ten person’s ECG data versus to the difference tolerance t(polynomial degree s is8)are shown in Table I.The performance of FAR versus the FRR is given in Fig.5.As shown in Fig.5,the FAR decrease as the FRR increase. From Table I,it is observed that when the difference tolerance t increases,the FAR also increases.This is because if the system could tolerate more different features between the sender and the receiver,the possibility of matching two feature sets that do not belong to the same person increase and thus the FAR increase. In contrast to the FAR,the FRR decreases when t increases, this is because when t increases,these two feature sets comingFig.6.FARcomparison.Fig.7.FRR comparison.from the same person are more likely to be matched.Thus,the probability of recovering one set using the other sets also increases.Fig.6and 7show the FAR and FRR performance when the degree of the monic polynomial s changes (the difference tol-erance t is set to 2).The degree of the polynomial s should satisfy s >=4in order not to compromise the security [17].It is shown in Fig.6that the FAR decrease when s increase.When t is fixed,the bigger s means that more shared features in the feature set is needed to successfully recover the secret k .Thus,the probability of mismatching the feature sets de-creases.In Fig.7,the FRR increases when s increases.This is due to the fact that if more common elements of the feature are needed,it is more likely for the system to reject the two feature sets that coming from the same person.The comparison between the PSKA [8]and the proposed ECG-IJS scheme in term of the FAR and FRR performance also shown in Fig.6and 7.Though the FAR performance of the proposed ECG-IJS is a little worse than that of PSKA,the FRR performance of the proposed ECG-IJS scheme is much better than that of PSKA.Also,as shown in Table II,the HTER performance of the ECG-IJS is better than that of PSKA on all polynomial degree s .We will also further demonstrate the energy saving advantages of the proposed approach in Section V.Fig.8and 9show the FAR performance and the FRR perfor-mance,respectively,for different polynomial degree s and dif-ferent tolerance t .It demonstrates that choosing certain degreesTABLE II C OMPARISON OFHTERFig.8.FAR versus polynomial degrees.Fig.9.FRR versus polynomial degree s.and tolerance levels can achieve required security performance.However,the complexity of the computation is increased when higher s is chosen.C.Energy Efficiency AnalysisThe wireless channel condition in BANs is different from that of free space [27].In this section,first,we describe the wireless channels over the human body in BANs.Second,we introduce an energy consumption model which is used to evaluate the energy efficiency of the proposed ECG-IJS scheme.At last,the energy efficiency of the ECG-IJS scheme is compared with the PSKA.1)Path Loss Near Human Body:The path loss models for BANs either using narrowband radio signals or ultra wideband (UWB)are investigated in [28]and [29].It is reported that the radio signals experience great losses and the value of the path loss exponent αvaries greatly in BANs.The path loss exponent for propagation in free space is equal to 2.But the path loss。