1037

Sensors and Materials, Vol. 31, No. 3 (2019) 1037–1063
MYU Tokyo
S & M 1833

An Internet-of-Things-based Sensing Rural Medical Care System
Chin-Ling Chen,1,2,3 Yong-Yuan Deng,3* Chin-Feng Lee,4
Shunzhi Zhu,1** Yi-Jui Chiu,5 and Chih-Ming Wu6
1

School of Computer and Information Engineering, Xiamen University of Technology,
No. 600 Ligong Road, Jimei District, Xiamen, Fujian Province 361024, China
2
School of Information Engineering, Changchun Sci-Tech University,
Donghua Street No. 1699, Shuangyang District, Changchun City, Jilin Province 130600, China
3
Department of Computer Science and Information Engineering, Chaoyang University of Technology,
168, Jifeng E. Rd., Wufeng District, Taichung 41349, Taiwan
4Department of Information Management, Chaoyang University of Technology,
168, Jifeng E. Rd., Wufeng District, Taichung 41349, Taiwan
5School of Mechanical and Automotive Engineering, Xiamen University of Technology,
No. 600 Ligong Road, Jimei District, Xiamen, Fujian Province 361024, China
6
School of Civil Engineering and Architecture, Xiamen University of Technology,
No. 600 Ligong Road, Jimei District, Xiamen, Fujian Province 361024, China(Received November 23, 2018; accepted January 30, 2019)

Keywords: sensing, Internet of Things, rural medical care, nonrepudiation, mutual authentication,
privacy, untraceability

According to a recent World Health Organization report, people living in rural areas often
lack access to medical resources and need to travel long distances to hospitals for medical
treatment — a situation which, until recently, seemed to have no solution. As communicationand hardware technologies have rapidly developed in recent years, however, many services
and applications integrating these technologies into daily life have come to form an Internet ofThings (IoT), and this makes it possible to address the problem of access to medical services inrural areas. In addition, governments formulate policies in order to respond to rural healthcare
requirements and can provide patrolling medical vehicle services to take care of residents inthese remote areas. On the other hand, owing to the rapid development of human physiologicalsensing devices, people with chronic diseases or those who require long-term monitoring ofphysiological conditions can wear these physiological sensing devices, and the sensing data
can be provided to rural medical vehicles, so that doctors can diagnose symptoms. People withcomplicated or severe conditions can go to large hospitals in urban areas for further diagnosis
and treatment. However, a great deal of the information transmitted during these processes
is sensitive data, which must therefore be protected with security protocols. Therefore,
in this study, we propose an IoT-based rural medical monitoring system. The proposed
scheme provides mutual authentication and guarantees data integrity, user untraceability,
nonrepudiation, and forward and backward secrecy, in addition to being resistant to replay
attack.
*Corresponding author: e-mail: allen.nubi@gmail.com
Corresponding author: e-mail: szzhu@xmut.edu.cn
https://doi.org/10.18494/SAM.2019.2227**

ISSN 0914-4935 © MYU K.K.
https://myukk.org/

1038

Sensors and Materials, Vol. 31, No. 3 (2019)1.

Introduction

1.1

BackgroundOwing to the rapid development of network hardware technology, various services andapplications that use wireless connections, such as 4G, 3G, Wi-Fi, Bluetooth, and ZigBee
communication technologies, have become popular in daily life. One of the services is remote
medical monitoring and care. At the same time, governments have formulated new policies inorder to respond to the healthcare requirements of aging populations. Their aim is to build acomprehensive medical network using new wireless technologies, such as sensor networks andcloud computation,(1,2) to drive the medical industry, combined with the Internet of Things (IoT),
to the next phase of application.
In current medical fields, information technology is already used for the secure managementof drugs via a radio frequency identifier (RFID), patient information, and blood information, as
well as the remote medical monitoring of newborns, and many other applications.(3,4) However,as populations continue to age, the need for expanded medical-care-related applications for
elderly people has also grown. Examples of technologies in this field include smart wheelchairs,
rural medical care, GPS location, and mobile health care, signifying very importantdevelopment needs.(5,6) On the other hand, the rapid development of various physiologicalsensing devices has made them smaller in size and greater in energy efficiency, making themsuitable for long-term wear by the elderly. These body sensor devices combined with a personal
mobile reader compose a body area network (BAN). The personal mobile reader collects andintegrates personal physiological data, and then transmits the data to the backend of the network
for related diagnostics and application.(7–10)
This means that when people go to a hospital, the medical staff can obtain relevant medical
data from their body sensor devices using a hospital medical reader. The body sensor devices
will transmit the related sensing data to the personal mobile reader, which will transmit the data
to the hospital medical reader.(11–14) The medical staff can then provide these data to a doctor
for future reference or immediate medical diagnosis. These data can also be sent to the national
medical server to be stored for related statistical big data analysis through cloud technology.(15,16)
In a recent study, Fortino et al.(17) proposed body cloud architecture for body sensor networks(BSNs). Their scheme defined a network communication protocol for the communication
between the body sensors and the cloud server. Later, Fortino et al.(18) proposed another
C-SPINE architecture for BSNs. Their scheme defined a network communication protocol
for the communication between different body sensors. They also performed hardware
implementation for C-SPINE architecture. Gravina et al.(19) proposed a survey for existing
BSN environments, including body cloud and C-SPINE architecture.
However, many people still seek to violate the privacy of others or even harm others. For
example, a malicious attacker could send incorrect sensing data to a hospital medical reader,causing an incorrect diagnosis. This could delay treatment or even result in the death of thepatient.(20,21) In addition, attackers may seek to obtain the sensing data of public figures forblackmail or extortion. Therefore, there must be a complete set of encryption and authentication
mechanisms that make it impossible for attackers to obtain and modify such sensitive

Sensors and Materials, Vol. 31, No. 3 (2019)1039

information in order to protect people’s safety and privacy.(22,23)
Although the development of medical services is widespread today, some residents in rural
areas still find it very difficult to access medical care. According to a recent World HealthOrganization report, people living in rural areas that lack medical resources need to travel long
distances to hospitals for medical treatment.(24) In recent years, the government has provided
patrolling medical vehicle services to take care of residents in these remote areas. Thesepatrolling medical vehicles go to remote areas and provide local residents with simple medical
services. However, because medical vehicles are an interim type of medical service, there is alack of long-term physiological data for the diagnosis of some long-term chronic diseases. In
addition, medical vehicles may lack some high-level medical equipment. For residents withcomplicated or severe conditions, it is necessary to go to large hospitals in urban areas forfurther diagnosis and treatment.
Previously, while researchers proposed schemes based on the IoT environment, theseschemes were either not for healthcare environments(2–4) or lacked the comprehensive security
required for healthcare environments.(1–3) Junior et al.(2) proposed a scheme of session key
establishment between an initiator and a responder for the IoT environment, but they did
not mention how the initiator and responder would authenticate each other’s legality. Ray
et al.(4) proposed an RFID ownership transfer protocol based on the IoT environment with acomprehensive protocol related to the ownership transfer between two RFID tags; although
their protocol achieved mutual authentication between an RFID tag and an RFID reader, theframework differs from the healthcare environment proposed in this study. Moosavi et al.(1)proposed a secure scheme for mobility healthcare based on the IoT environment, but actually,
they only proposed a challenge-response concept for mobile sensors, smart gateway, and enduser; there is no detailed cryptography description in their article. Yang et al.(3) also proposeda framework for healthcare based on the IoT environment, but their protocol only focuses on
the server and user; they did not make a comprehensive protocol for a body sensor device, apersonal mobile reader, a rural medical vehicle, a hospital medical reader, and a medical cloudserver.
Later, Rezaeibagha and Mu(25) proposed a practical and secure telemedicine system
for user mobility, which provided a remote diagnosis architecture. However, their scheme
is not complete; it lacks architecture to include body sensor devices and does not achieve
nonrepudiation. Li et al.(26) proposed another cloud-assisted mutual authentication and privacy
preservation protocol for telecare medical information systems, which provided a generalizedarchitecture. However, their scheme is also not complete, as it does not include a remotediagnosis authentication mechanism.
Therefore, in this study, we propose an IoT-based sensing rural medical care system.
When a patient goes to a rural medical vehicle to seek medical services, doctors will obtain
their physiological sensing data. This can increase the correctness and effectiveness of
their diagnoses. After diagnosis, a doctor will inform the patient of the results. For further
diagnosis or medical treatment, the patient can go to a large hospital to inform the doctors of
the physiological sensing data and the diagnostic report of the rural medical vehicle. This canachieve a higher medical efficiency. The proposed IoT-based sensing rural medical care systemachieves security, privacy, and efficiency.

1040

1.2

Sensors and Materials, Vol. 31, No. 3 (2019)

Security requirements

The security requirements of an IoT-based sensing rural medical care system are listed asfollows.(27–29)
1.2.1 Mutual authentication
In the information transmission process, the message receiver must be able to verify theidentity legitimacy of the sender. Thus, each party must be able to verify the identity legitimacyof the other party in a BAN authentication environment. If the two parties can confirm eachother’s identities, then mutual authentication can be achieved.
1.2.2 Data integrity
Any information transferred in an unencrypted network environment is vulnerable tomalicious attack in the form of modification, where the message delivered to the receiver is
not the original message transmitted by the sender. The integrity of the transmitted data must
therefore be ensured and protected against tampering in transit.
1.2.3 User untraceability
Malicious attacks may also attempt to determine a person’s physical location by tracing theirpersonal mobile reader. Thus, an IoT-based sensing rural medical care system must prevent
such positional tracking.
1.2.4 Resisting replay attacks
Malicious attacks may also intercept the transmitted message between the personal mobile
reader and the hospital medical reader, and then impersonate a legitimate transmitter in order tosend the same message to the intended receiver. This constitutes a serious breach of personal
data security and must be prevented by an IoT-based sensing rural medical care system.
1.2.5 Forward and backward secrecy
If the session key between the personal mobile reader and the hospital medical reader
is compromised at any point by an attacker, the attacker may use the session key for future
malicious communications or obtaining previous messages. An IoT-based sensing rural medicalcare system should thus achieve forward and backward secrecy.
1.2.6 Nonrepudiation
When the receiver receives the message sent by the sender, the sender may deny sending
the message. Therefore, the message sent by the sender must be signed with the secret key ofSensors and Materials, Vol. 31, No. 3 (2019)1041

the sender. The receiver can verify the received message with the public key of the sender andthe sender cannot deny sending the message. An IoT-based sensing rural medical care systemshould thus achieve nonrepudiation.
1.3

Preliminary introduction

Digital network systems are an indispensable technology in daily life, with massive numbersof documents and information being transmitted over networks every day; thus, measures
guaranteeing the security of these messages are very important. Several digital encryption
systems have therefore been proposed to ensure the security of important documents. In 1985,
elliptic curve cryptography(30) was proposed, with a message length smaller than that of the
RSA encryption system. The following is a brief introduction of the elliptic curve group and its
corresponding mathematical hard problems.
Let Fq be a prime finite field, E/Fq an elliptic curve defined over Fq, and P a generator fora cyclic additive group of composite order q. The point on E/Fq and an extra point Θ, called
the point at infinity, form a group G= {( x, y ) : x, y ∈ Fq ;( x, y ) ∈ E / Fq } ∪ {Θ}. G is a cyclic
additive group of composite order q. Scalar multiplication over E/Fq can be computed astP = P + P + ... + P t times.
The following problems exist for the elliptic curve group:
Computational Diffie–Hellman (CDH) Problem: Given aP and bP, where a, b ∈ R, Z * q, and P
are the generator of G, compute abP.
Decisional Diffie–Hellman (DDH) Problem: Given aP, bP, and cP, where a, b, c ∈ R, Z * q,
and P are the generators of G, confirm whether or not cP = abP, which is equal to confirming
whether or not c = ab mod q.

2.

Proposed Scheme

2.1

System architecture

The framework of the rural medical care system proposed in this study is shown in Fig. 1.
There are five parties in the scheme:(1) Body Sensor Device: A small sensing device to measure various physiological data of ahuman body. Only a legal personal mobile reader can obtain the sensing data from the bodysensor device.
(2) Personal Mobile Reader: A personal reading device carried by an individual. It can receive
relevant data from a body sensor device and transmit the data to a rural medical vehicle ora hospital medical reader for analysis. It can also keep the inspection report from the rural
medical vehicle and transmit the record to a hospital medical reader.
(3) Rural Medical Vehicle: A medical vehicle that visits rural areas. Patients go to the rural
medical vehicle and transmit their body sensor device data from the personal mobile reader
to the rural medical vehicle. The rural medical vehicle then makes a basic diagnosis of thepatient.

1042

Sensors and Materials, Vol. 31, No. 3 (2019)

Fig. 1.

System framework of the proposed scheme.

(4) Hospital Medical Reader: A device carried by medical staff in a medical facility or bycaregivers in a care center. It can receive relevant data from a body sensor device orinspection report of the rural medical vehicle from a personal mobile reader for diagnosis bya medical doctor.
(5) Medical Cloud Server: A cloud server belonging to a national medical institution. It
manages all personal mobile readers, rural medical vehicles, and hospital medical readers.
All personal mobile readers, rural medical vehicles, and hospital medical readers must be
registered on the medical cloud server.
1. All personal mobile readers, rural medical vehicles, and hospital medical readers must be
registered with the medical cloud server through a secure channel. The personal mobile
readers, rural medical vehicles, and hospital medical readers send their IDs [e.g., universallyunique identifier (UUID)] to the medical cloud server. The medical cloud server returns
information that includes parameters calculated by elliptic curve group technology.
2. All personal mobile readers and body sensor devices must register with hospital medical
readers through a secure channel. The personal mobile reader and body sensor device send
their IDs (e.g., UUID) to the hospital medical reader. The hospital medical reader returns
information that includes parameters calculated by a lightweight polynomial function.
3. When a personal mobile reader needs to send related health data to a rural medical vehicle or
hospital medical reader, it must first obtain the data from body sensor devices. After mutual
authentication between the personal mobile reader and the body sensor device, the personal
mobile reader receives the encrypted health data.
4. When patients take their personal mobile reader to the rural medical vehicle for healthexamination, the personal mobile reader and rural medical vehicle must authenticate thelegality of each other. After mutual authentication between the personal mobile reader andthe rural medical vehicle, the personal mobile reader transmits the body sensor device data

Sensors and Materials, Vol. 31, No. 3 (2019)1043

to the rural medical vehicle. After a basic diagnosis, the rural medical vehicle transmits theinspection report to the personal mobile reader.
5. The personal mobile reader sends its ID and parameters calculated by elliptic curve group
technology to the hospital medical reader for authentication. After mutual authentication
between the personal mobile reader and the hospital medical reader, the personal mobile
reader sends the encrypted health sensing data and inspection report to the hospital medical
reader. A medical doctor will get these data and report, and will make an advanced
diagnosis.
2.2

Notationsq: k-bit prime
Fq: prime finite field
E/Fq: elliptic curve E over Fq
G: cyclic additive group of composite order q
P: generator for the group G
s: secret key of the system
PK: public key of the system, PK = SP
H i ( ): ith one-way hash function
IDx: x’s identity, like a UUID coderx , a, b, c, d: random number of elliptic curve groupSx: x’s elliptic curve group signature
SEK xy: session key established by x and y
Ex (m): Use a session key x to encrypt the message m
Dx (m): Use a session key x to decrypt the message m
CHK x: x’s verified message
A = B: determines if A is equal to B
data: body sensor’s related sensing information
record: inspection report established by a doctor
ci: session key encrypted sensitive information
Certdoc: doctor’s certificate, issued by government organizations
Sig: signature message signed by a doctor
2.3

System initialization phase

In the system initialization stage, the medical cloud server calculates some parameters andpublishes the public parameters for personal mobile readers, rural medical vehicles, and hospital
medical readers.
Step 1: The medical cloud server chooses a k-bit prime p and determines the tuple of the elliptic
curve group (Fp ,E / Fp , G , P).
Step 2: The medical cloud server then chooses s as a secret key and computes
PK = sP
as a public system key.

1044

Sensors and Materials, Vol. 31, No. 3 (2019)

Step 3: Finally, the medical cloud server chooses the hash function ( H1 (⋅), H 2 (⋅), H 3 (⋅)) and thenpublishes ( Fp , E / Fp , G , P, PK , H1 (⋅), H 2 (⋅), H 3 (⋅)) to all personal mobile readers, rural
medical vehicles, and hospital medical readers.
2.4

Body sensor device registration phase

The body sensor device must register with the hospital medical reader. The body sensor
device registration phase of the proposed scheme is shown in Fig. 2.
Step 1: The body sensor device chooses an identity IDBSD (e.g., UUID) and sends it to thehospital medical reader.
Step 2: The hospital medical reader generates the polynomial f(x, y), calculates
BPBSD = f ( IDBSD , y ) ,e = h( SID) ,and then sends (BPBSD, SID) to the body sensor device.
Step 3: The body sensor device stores (BPBSD, SID) in its memory.
2.5

Personal mobile reader registration phase

The personal mobile reader must register with the hospital medical reader and medical cloudserver. The personal mobile reader registration phase of the proposed scheme is shown in Figs.
3 and 4.
Step 1: The personal mobile reader chooses an identity IDPMR (e.g., UUID) and sends it to thehospital medical reader.

Fig. 2.

Body sensor device registration phase of the proposed scheme.

Sensors and Materials, Vol. 31, No. 3 (2019)

1045

Fig. 3.

Personal mobile reader registration phase of the proposed scheme with hospital medical reader.

Fig. 4.

Personal mobile reader registration phase of the proposed scheme with medical cloud server.

Step 2: The hospital medical reader generates the polynomial f(x, y), calculates
BPPMR = f ( IDPMR , y ) ,e = h( SID) ,and then sends (BPPMR, SID) to the personal mobile reader.
Step 3: The personal mobile reader stores (BPPMR, SID) to its memory.
Step 4: The personal mobile reader chooses an identity IDPMR (e.g., UUID) and sends it to the
medical cloud server.
Step 5: The medical cloud server chooses a random number rPMR, calculates
RPMR = rPMR P ,hPMR = H1 ( IDPMR , RPMR ) ,S PMR= rPMR + hPMR s ,and then sends (R PMR, SPMR) to the personal mobile reader.

1046

Sensors and Materials, Vol. 31, No. 3 (2019)

Step 6: The personal mobile reader verifies
S PMR=
P RPMR + H1 ( IDPMR , RPMR ) PK .
If it passes the verification, the personal mobile reader stores (R PMR, SPMR).
2.6

Rural medical vehicle registration phase

The rural medical vehicle must register with the medical cloud server. The rural medical
vehicle registration phase of the proposed scheme is shown in Fig. 5.
Step 1: The rural medical vehicle chooses an identity IDRMV (e.g., UUID) and sends it to the
medical cloud server.
Step 2: The medical cloud server chooses a random number rRMV, calculates
RRMV = rRMV P ,hRMV = H1 ( IDRMV , RRMV ) ,S RMV= rRMV + hRMV s ,and then sends (R RMV, SRMV) to the rural medical vehicle.
Step 3: The rural medical vehicle verifies
S RMV=
P RRMV + H1 ( IDRMV , RRMV ) PK .
If it passes the verification, the rural medical vehicle stores (R RMV, SRMV).
2.7

Hospital medical reader registration phase

The hospital medical device must register with the medical cloud server. The hospital
medical device registration phase of the proposed scheme is shown in Fig. 6.

Fig. 5.

Rural medical vehicle registration phase of the proposed scheme with medical cloud server.

Sensors and Materials, Vol. 31, No. 3 (2019)

Fig. 6.

1047

Hospital medical reader registration phase of the proposed scheme.

Step 1: The hospital medical reader chooses an identity IDPMR (e.g., UUID) and sends it to the
medical cloud server.
Step 2: The medical cloud server chooses a random number rPMR, calculates
RHMR = rHMR P ,hHMR = H1 ( IDHMR , RHMR ) ,S HMR= rHMR + hHMR s ,and then sends (R HMR, SHMR) to the hospital medical reader.
Step 3: The hospital medical reader verifies
S HMR=
P RHMR + H1 ( IDHMR , RHMR ) PK .
If it passes the verification, the rural medical vehicle stores (R HMR, SHMR).
2.8

Personal mobile reader authentication and communication phase

When the personal mobile reader requires related data from the body sensor device, themobile reader and sensor device must authenticate each other. The personal mobile reader
authentication and communication phase of the proposed scheme is shown in Fig. 7.
Step 1: When the personal mobile reader requires related health data from the body sensor
device, it calculatese = h( SID)
and sends (IDPMR, e) to the body sensor device.
Step 2: The body sensor device verifies
e = h( SID)

1048

Sensors and Materials, Vol. 31, No. 3 (2019)

Fig. 7.

Personal mobile reader authentication and communication phase of the proposed scheme.

to check the legality of the personal mobile reader. If it passes the verification, the bodysensor device calculates
K BP = f ( IDBSD , IDPMR ) ,g = EK BP (data ) ,i = h(data || K BP ) ,and then sends (IDBSD, g, i) to the personal mobile reader.
Step 3: The personal mobile reader calculates
K BP = f ( IDPMR , IDBSD ),data = DK BP ( g ) ,and verifies
i = h(data || K BP )to check the legality of the body sensor device. If it passes the verification, the personal
mobile reader receives the related health data from the body sensor device.
2.9

Rural medical vehicle authentication and communication phase

When patients take their personal mobile reader to the rural medical vehicle for medical
services, the personal mobile reader and rural medical vehicle must authenticate each other.
The personal mobile reader will then transmit the encrypted health sensing data to the rural
medical vehicle and the rural medical vehicle will transmit the encrypted basic inspection reportto the personal mobile reader. The rural medical vehicle authentication and communication
phase of the proposed scheme is shown in Fig. 8.
Step 1: The personal mobile reader chooses a random number a, calculates
TPMR = aP ,and then sends ( IDPMR , RPMR , TPMR ) to the rural medical vehicle.

Sensors and Materials, Vol. 31, No. 3 (2019)

Fig. 8.

Rural medical vehicle authentication and communication phase of the proposed scheme.

Step 2: The rural medical vehicle chooses a random number b, calculates
TRMV = bP ,PK=
RPMR + H1 ( IDPMR , RPMR ) PK ,PMR=
K RP1 S RMV TPMR + bPK PMR ,

1049

1050

Sensors and Materials, Vol. 31, No. 3 (2019)

and the session key

K RP 2 = bTPMR ,SEK RP = H 2 ( K RP1 , K RP 2 ) .
The rural medical vehicle then calculates
CHK PR = H 3 ( SEK RP , TPMR )and sends ( IDRMV , RRMV , TRMV , CHK PR ) to the personal mobile reader.
Step 3: The personal mobile reader calculates
PK=
RRMV + H1 ( IDRMV , RRMV ) PK ,RMV=
K PR1 S PMRTRMV + aPK RMV ,K PR 2 = aTRMV ,and the session key
SEK RP = H 2 ( K PR1 , K PR 2 ) .
The personal mobile reader verifies
CHK PR = H 3 ( SEK RP , TPMR )to check the legality of the rural medical vehicle. If it passes the verification, thepersonal mobile reader calculatescPMR = ESEK RP (data ) ,CHK RP = H 3 ( SEK RP , TRMV ),and sends ( IDPMR , cPMR , CHK RP ) to the rural medical vehicle.
Step 4: The rural medical vehicle verifies
CHK RP = H 3 ( SEK RP , TRMV )to check the legality of the personal mobile reader. If it passes the verification, thesession key SEKRP between the personal mobile reader and the rural medical vehicle isestablished successfully. The rural medical vehicle calculates
data = DSEK RP (cPMR )to obtain the health sensing information of the patient. After the patient’s diagnosis, therural medical vehicle generates the encrypted basic inspection reportcRMV = ESEK RP (record ) ,Sig = S SK doc (record ) ,and sends ( IDRMV , cRMV , Sig , Certdoc ) to the personal mobile reader.
Step 5: The personal mobile reader decrypts the received message
record = DSEK RP (cRMV ),obtains the doctor’s public key PKdx through Certdoc , verifies the signaturerecord = VPK doc ( Sig ) ,and obtains the encrypted basic inspection report from the rural medical vehicle.
2.10 Hospital medical reader authentication and communication phase
After the patients receive the basic inspection report from the rural medical vehicle, they
may go to the hospital for an advanced diagnosis. When the patients take their personal mobile
reader to the hospital for medical services, the personal mobile and hospital medical readersSensors and Materials, Vol. 31, No. 3 (2019)

1051

must authenticate each other. The personal mobile reader then transmits the encrypted healthsensing data and basic inspection report to the hospital medical reader, and the medical doctor
at the hospital makes an advanced diagnosis. The hospital medical reader authentication andcommunication phase of the proposed scheme is shown in Fig. 9.
Step 1: The personal mobile reader chooses a random number c, calculates
TPMR 2 = cP ,and then sends ( IDPMR , RPMR , TPMR 2 ) to the hospital medical reader.
Step 2: The hospital medical reader chooses a random number d, calculates

Fig. 9.

Hospital medical reader authentication and communication phase of the proposed scheme.

1052

Sensors and Materials, Vol. 31, No. 3 (2019)

and the session key

THMR = dP ,PK=
RPMR + H1 ( IDPMR , RPMR ) PK ,PMR=
K HP1 S HMRTPMR 2 + dPK PMR ,K HP 2 = dTPMR 2 ,SEK HP = H 2 ( K HP1 , K HP 2 ).
The hospital medical reader then calculates
CHK PH = H 3 ( SEK HP , TPMR 2 )and sends ( IDHMR , RHMR , THMR , CHK PH ) to the personal mobile reader.
Step 3: The personal mobile reader calculates
PK=
RHMR + H1 ( IDHMR , RHMR ) PK ,HMR=K PH 1 S PMRTHMR + cPK HMR ,K PH 2 = cTHMR ,and the session key
SEK HP = H 2 ( K PH 1 , K PH 2 ) .
The personal mobile reader verifies
CHK PH = H 3 ( SEK HP , TPMR 2 )to check the legality of the hospital medical reader. If it passes the verification, thepersonal mobile reader calculatescPMR 2 = ESEK HP (data || record ),Sig = S SK doc (record ),CHK HP = H 3 ( SEK HP , THMR ) ,and sends ( IDPMR , cPMR 2 , Sig , CHK HP , Certdoc ) to the hospital medical reader.
Step 5: The hospital medical reader verifies
CHK HP = H 3 ( SEK HP , THMR )to check the legality of the personal mobile reader. If it passes the verification, thesession key SEK HP between the personal mobile reader and the hospital medical reader
is established successfully. The hospital medical reader decrypts the received message(data || record ) = DSEK HP (cPMR 2 ),obtains the doctor’s public key through Certdoc, verifies the signaturerecord = VPK doc ( Sig ) ,and obtains the encrypted health sensing information and basic inspection report fromthe personal mobile reader. The medical doctor at the hospital then makes an advanced
diagnosis for the patient.

3.

Security Analysis

3.1

Mutual authentication

In this study, we use BAN logic to prove that the proposed scheme achieves mutual authentication
between different parties in each phase.

Sensors and Materials, Vol. 31, No. 3 (2019)

1053

In the rural medical vehicle authentication and communication phase of the proposed
scheme, the main goal of the scheme is to authenticate the session key establishment between
the personal mobile reader P and the rural medical vehicle R.
SEK RP

G1: P |≡ P ↔ R
SEK RP

G2: P |≡ R |≡ P ↔ R
SEK RP

G3: R |≡ P ↔ R
SEK RP

G4: R |≡ P |≡ P ↔ R
G5: P |≡ IDRMV
G6: P |≡ R |≡ IDRMV
G7: R |≡ IDPMR
G8: R |≡ P |≡ IDPMR
According to the rural medical vehicle authentication and communication phase, BAN logic
is used to produce an idealized form as follows:
M1: (< IDPMR , RPMR , TPMR > PK RMV , < H ( SEK RP , TRMV ) >CHK RP ) ,M2: (< IDRMV , RRMV , TRMV > PK PMR , < H ( SEK RP , TPMR ) >CHK PR ) .
To analyze the proposed scheme, the following assumptions are made:A1: P |≡ #(TPMR ) ,A2: R |≡ #(TPMR ) ,A3: P |≡ #(TRMV ) ,A4: R |≡ #(TRMV ) ,SEK RP

A5: P |≡ R |⇒ P ↔ R ,SEK RP

A6: R |≡ P |⇒ P ↔ R ,A7: P |≡ R |⇒ IDRMV ,A8: R |≡ P |⇒ IDPMR .
According to these assumptions and rules of BAN logic, the main proof of the rural medical
vehicle authentication and communication phase is as follows:a. The rural medical vehicle R authenticates the personal mobile reader P.
By M1 and the seeing rule, deriveR  (< IDPMR , RPMR , TPMR > PK RMV , < H ( SEK RP , TRMV ) >CHK RP ) .

(Statement 1)

By A2 and the freshness rule, derive

R |≡ #(< IDPMR , RPMR , TPMR > PK RMV , < H ( SEK RP , TRMV ) >CHK RP ) . (Statement 2)

By Statement 1, A4, and the message meaning rule, derive

R |≡ P |~ (< IDPMR , RPMR , TPMR > PK RMV , < H ( SEK RP , TRMV ) >CHK RP ) . (Statement 3)

By Statements 2 and 3, and the nonce verification rule, derive

R |≡ P |≡ (< IDPMR , RPMR , TPMR > PK RMV , < H ( SEK RP , TRMV ) >CHK RP ) .(Statement 4)

1054

Sensors and Materials, Vol. 31, No. 3 (2019)

By Statement 4 and the belief rule, derive
SEK RPR |≡ P |≡ P ↔ R .

(Statement 5)

By Statement 5, A6, and the jurisdiction rule, derive
SEK RPR |≡ P ↔ R .

(Statement 6)

By Statement 6 and the belief rule, derive
R |≡ P |≡ IDPMR .
By Statement 7, A8, and the jurisdiction rule, derive
R |≡ IDPMR .

(Statement 7)(Statement 8)

b. The personal mobile reader P authenticates the rural medical vehicle R.
By M2 and the seeing rule, deriveP  (< IDRMV , RRMV , TRMV > PK PMR , < H ( SEK RP , TPMR ) >CHK PR ) . (Statement 9)

By A1 and the freshness rule, derive

P |≡ #(< IDRMV , RRMV , TRMV > PK PMR , < H ( SEK RP , TPMR ) >CHK PR ) . (Statement 10)
By Statement 9, A3, and the message meaning rule, derive
P |≡ R |~ (< IDRMV , RRMV , TRMV > PK PMR , < H ( SEK RP , TPMR ) >CHK PR ) . (Statement 11)

By Statements 10 and 11, and the nonce verification rule, derive

P |≡ R |≡ (< IDRMV , RRMV , TRMV > PK PMR , < H ( SEK RP , TPMR ) >CHK PR ) . (Statement 12)

By Statement 12 and the belief rule, derive

SEK RPP |≡ R |≡ P ↔ R .

(Statement 13)

By Statement 13, A5, and the jurisdiction rule, derive
SEK RPP |≡ P ↔ R .

(Statement 14)

By Statement 14 and the belief rule, derive
P |≡ R |≡ IDRMV .

(Statement 15)

By Statement 15, A7, and the jurisdiction rule, derive
P |≡ IDRMV .

(Statement 16)

By Statements 6, 8, 14, and 16, it can be proved that, in the proposed scheme, the personal
mobile reader P and rural medical vehicle R authenticate each other. Moreover, it can also be
proved that the proposed scheme can establish a session key between the personal mobile reader
P and the rural medical vehicle R.
In the proposed scheme, the rural medical vehicle authenticates the personal mobile reader
by
CHK RP = H 3 ( SEK RP , TRMV ) .
If it passes the verification, the rural medical vehicle authenticates the legality of the personal
mobile reader. The personal mobile reader authenticates the rural medical vehicle bySensors and Materials, Vol. 31, No. 3 (2019)

1055

CHK PR = H 3 ( SEK RP , TPMR ) .
If it passes the verification, the personal mobile reader authenticates the legality of the rural
medical vehicle. The rural medical vehicle authentication and communication phase of the
proposed scheme thus guarantees mutual authentication between the rural medical vehicle andthe personal mobile reader.
In the hospital medical reader authentication and communication phase of the proposed
scheme, the main goal of the scheme is to authenticate the session key establishment between
the personal mobile reader P and the hospital medical reader H.
SEK HP

G9: P |≡ P ↔ H
SEK HP

G10: P |≡ H |≡ P ↔ H
SEK HP

G11: H |≡ P ↔ H
SEK HP

G12: H |≡ P |≡ P ↔ H
G13: P |≡ IDHMR
G14: P |≡ H |≡ IDHMR
G15: H |≡ IDPMR
G16: H |≡ P |≡ IDPMR
According to the hospital medical reader authentication and communication phase, BAN
logic is used to produce an idealized form as follows:
M3: (< IDPMR , RPMR , TPMR 2 > PK HMR , < H ( SEK HP , THMR ) >CHK HP ) ,M4: (< IDHMR , RHMR , THMR > PK , < H ( SEK HP , TPMR 2 ) >CHK ) .
HMRPH
To analyze the proposed scheme, the following assumptions are made:A9: P |≡ #(TPMR 2 ) ,A10: H |≡ #(TPMR 2 ) ,A11: P |≡ #(THMR ) ,A12: H |≡ #(THMR ) ,SEK HP

A13: P |≡ H |⇒ P ↔ H ,SEK HP

A14: H |≡ P |⇒ P ↔ H ,A15: P |≡ H |⇒ IDHMR ,A16: H |≡ P |⇒ IDPMR .
According to these assumptions and the rules of BAN logic, the hospital medical reader
authentication and communication phase is as follows:a. The hospital medical reader H authenticates the personal mobile reader P.
By M3 and the seeing rule, deriveH  (< IDPMR , RPMR , TPMR 2 > PK HMR , < H ( SEK HP , THMR ) >CHK HP ) . (Statement 17)

By A10 and the freshness rule, derive

1056

Sensors and Materials, Vol. 31, No. 3 (2019)H |≡ #(< IDPMR , RPMR , TPMR 2 > PK HMR , < H ( SEK HP , THMR ) >CHK HP ) .

(Statement 18)

By Statement 17, A12, and the message meaning rule, derive

H |≡ P |~ (< IDPMR , RPMR , TPMR 2 > PK HMR , < H ( SEK HP , THMR ) >CHK HP ) . (Statement 19)

By Statements 18, 19, and the nonce verification rule, derive

H |≡ P |≡ (< IDPMR , RPMR , TPMR 2 > PK HMR , < H ( SEK HP , THMR ) >CHK HP ) .(Statement 20)

By Statement 20 and the belief rule, derive

SEK HP

H |≡ P |≡ P ↔ H .

(Statement 21)

By Statement 21, A14, and the jurisdiction rule, derive
SEK HP

H |≡ P ↔ H .

(Statement 22)

By Statement 22 and the belief rule, derive
H |≡ P |≡ IDPMR .
By Statement 23, A16, and the jurisdiction rule, derive
H |≡ IDPMR .

(Statement 23)(Statement 24)

b. The personal mobile reader P authenticates the hospital medical reader H.
By M4 and the seeing rule, deriveP  (< IDHMR , RHMR , THMR > PK HMR , < H ( SEK HP , TPMR 2 ) >CHK PH ) . (Statement 25)

By A9 and the freshness rule, derive

P |≡ #(< IDHMR , RHMR , THMR > PK HMR , < H ( SEK HP , TPMR 2 ) >CHK PH ) .

(Statement 26)

By Statement 25, A11, and the message meaning rule, derive

P |≡ H |~ (< IDHMR , RHMR , THMR > PK HMR , < H ( SEK HP , TPMR 2 ) >CHK PH ) . (Statement 27)

By Statements 26 and 27, and the nonce verification rule, derive

P |≡ H |≡ (< IDHMR , RHMR , THMR > PK HMR , < H ( SEK HP , TPMR 2 ) >CHK PH ) . (Statement 28)

By Statement 28 and the belief rule, derive

SEK HPP |≡ H |≡ P ↔ H .

(Statement 29)

By Statement 29, A13, and the jurisdiction rule, derive
SEK HPP |≡ P ↔ H .

(Statement 30)

By Statement 30 and the belief rule, derive
P |≡ H |≡ IDHMR .

(Statement 31)

By Statement 31, A15, and the jurisdiction rule, derive
P |≡ IDHMR .

(Statement 32)

By Statements 22, 24, 30, and 32, it can be proved that, in the proposed scheme, the personal
mobile reader P and the hospital medical reader H authenticate each other. Moreover, it can also
be proved that the proposed scheme can establish a session key between the personal mobile
reader P and the hospital medical reader H.

Sensors and Materials, Vol. 31, No. 3 (2019)

1057

In the proposed scheme, the hospital medical reader authenticates the personal mobile reader
by

CHK HP = H 3 ( SEK HP , THMR ) .
If it passes the verification, the hospital medical reader authenticates the legality of the personal
mobile reader. The personal mobile reader authenticates the hospital medical reader by
CHK PH = H 3 ( SEK HP , TPMR 2 ) .
If it passes the verification, the personal mobile reader authenticates the legality of the hospital
medical reader. The hospital medical reader authentication and communication phase of the
proposed scheme thus guarantees mutual authentication between the hospital medical reader
and the personal mobile reader.

Scenario: A malicious attacker uses an illegal hospital medical reader to obtain a patient’s
health data from a legal personal mobile reader.
Analysis: The attacker will not succeed because the illegal hospital medical reader has notbeen registered to the medical cloud server and thus cannot calculate the correct session key
SEK HP. Thus, the attack will fail when the legal personal mobile reader attempts to authenticate
the illegal hospital medical reader. In the proposed scheme, the attacker cannot achieve their
purpose using an illegal hospital medical reader. In the same scenario, the proposed scheme canalso defend against a malicious attack using an illegal personal mobile reader to send fake healthdata to a legal hospital medical reader, because the illegal personal mobile reader has not beenregistered to the medical cloud server and thus cannot calculate the correct session key SEK HP.
Thus, the attack will fail when the legal hospital medical reader attempts to authenticate theillegal personal mobile reader.
3.2

Data integrity

To ensure the integrity of the transaction data, in this study, we use elliptic curve
cryptography to calculate the session keys SEKRP and SEK HP, and also to protect the data
integrity. The malicious attacker cannot use the signatures ( K RP1 , K RP 2 ) , ( K PR1 , K PR 2 ),( K HP1 , K HP 2 ), and ( K PH 1 , K PH 2 ) to calculate the correct session keys SEKRP and SEK HP.
Only a legal personal mobile reader or rural medical vehicle can calculate the correct session
key SEKRP. The legal rural medical vehicle calculates the session key
SEK RP = H 2 ( K RP1 , K RP 2 )and the legal personal mobile reader calculates the session key
SEK RP = H 2 ( K PR1 , K PR 2 ) .
=K PR1 S PMRTRMV + aPK RMV= S PMR bP + aS RMV P= bS PMR P + S RMV aP=bPK PMR + S RMV TPMR =
K RP1
K PR
=
= abP
= baP
= bTPMR= K RP 2
2 aTRMV1058

Sensors and Materials, Vol. 31, No. 3 (2019)

Only a legal personal mobile or hospital medical reader can calculate the correct session key
SEK HP. The legal hospital medical reader calculates the session key
SEK HP = H 2 ( K HP1 , K HP 2 )and the legal personal mobile reader calculates the session key
SEK HP = H 2 ( K PH 1 , K PH 2 ) .
=K PH 1 S PMRTHMR + cPK HMR= S PMR dP + cS HMR P= dS PMR P + S HMR cP=
dPK PMR + S HMRTPMR 2 =
K HP1
K PH
=
= cdP
= dcP
= dTPMR=K HP 22 cTHMR
2
Only the correct session key will allow successful communication. Thus, attackers cannot
modify the transmitted message. Therefore, the proposed scheme achieves data integrity.
Scenario: A malicious attacker intercepts the transmitted message from the hospital medical
reader to the personal mobile reader and sends a modified message to the personal mobile
reader.
Analysis: The attacker will not succeed because the legal personal mobile reader will use
CHK PH = H 3 ( SEK HP || TPMR 2 )to check the data integrity. The attacker cannot calculate the correct session key SEK HP. Thus,
the attack will fail when the legal personal mobile reader authenticates the received message.
In the proposed scheme, the attacker cannot achieve his/her purpose by sending a modified
message to the personal mobile reader. For the same reason, the attack will fail when the legal
hospital medical reader uses
CHK HP = H 3 ( SEK HP || THMR )to check data integrity. Therefore, attackers cannot achieve their purpose by sending a modified
message to the hospital medical reader.
3.3

User untraceability

Another form of privacy attack involves attempting to obtain a person’s physical location by
tracing any personal device (in this case, the personal mobile reader). If the personal mobile
reader sends the same message continuously, an attacker can trace its location. In the proposedarchitecture, the session keys SEKRP and SEK HP are changed for every communication roundin order to avoid location tracing. Thus, location privacy is protected and user untraceability isachieved.
3.4

Resisting replay attack

An attacker may also intercept the message transmitted between the sender and the receiver.
They impersonate a legal sender and then send the same message again to the intended receiver.
However, this attack will fail in the proposed scheme, as all messages between the sender andSensors and Materials, Vol. 31, No. 3 (2019)1059

the receiver are protected with the session keys SEKRP and SEK HP, and the attacker cannot
calculate the correct session key. Because the transmitted messages are changed every round,the same message cannot be sent twice. Thus, the replay attack cannot succeed.
3.5

Forward and backward secrecy

Even if the session keys SEK RP and SEK HP between the sender and the receiver arecompromised at any point by an attacker, the system still satisfies forward and backward
secrecy. The attacker may use the session keys SEKRP and SEK HP for future communicationor to obtain previous messages. However, in the proposed scheme, the session keys SEKRPand SEK HP are randomly chosen by the sender and receiver, and may only be used in thecurrent round. The attacker cannot use the same session keys SEKRP and SEKHP for futurecommunication or to obtain previous messages. Thus, the proposed scheme achieves forward
and backward secrecy.
3.6

Nonrepudiation

In the proposed scheme, a digital signature is used to achieve nonrepudiation for theinspection report compiled by a doctor. In the rural medical vehicle authentication andcommunication phase, the doctor uses his/her private key to sign the patient’s inspection report
Sig = S SK doc (record ) and then the signed message is transmitted to the patient. The patientobtains the doctor’s public key through the doctor’s certificate Certdoc and then uses the doctor’s
public key to verify the signed message record = VPK doc ( Sig ). In the hospital medical reader
authentication and communication phase, the patient sends the original signed message anddoctor’s certificate Certdoc to the hospital medical reader. Another doctor obtains the original
doctor’s public key through the doctor’s certificate Certdoc and then uses the doctor’s public
key to verify the received message record = VPK doc ( Sig ). Thus, the proposed scheme achieves
nonrepudiation for the inspection report established by a doctor.
3.7

Computation cost

From Table 1, the proposed scheme’s computation costs for the medical cloud server, hospital
medical reader, rural medical vehicle, personal mobile reader, and body sensor device in eachphase are analyzed. For the highest computation cost in the rural medical vehicle authenticationand communication phase, a rural medical vehicle needs five multiplication operations, fourhash function operations, one comparison operation, two symmetric encryption operations, andone signature operation. A personal mobile reader needs five multiplication operations, fourhash function operations, two comparison operations, two symmetric encryption operations,and one signature operation. The computation cost and complexity are thus acceptable.

1060

Sensors and Materials, Vol. 31, No. 3 (2019)

Table 1
Computation cost of the proposed scheme.
Party

Phase

Medical cloud Hospital medical Rural medical
serverreadervehiclePersonal mobile
readerBody sensor
deviceN/A

1TP + 1TH

N/A

N/A

N/A

Personal mobile reader
registration phase

2TMul + 1TH

1TP + 1TH

N/A

Rural medical vehicle
registration phase

2TMul + 1TH

N/A

Hospital medical reader
registration phase

2TMul + 1TH

Personal mobile reader
authentication andcommunication phase

N/A

Body sensor device
registration phase

Rural medical vehicle
authentication andcommunication phase
Hospital medical reader
authentication andcommunication phase

N/A

2TMul + 1TH+1TCmpN/A

N/A

2TMul + 1TH+1TCmpN/A
N/A+2TCmp + 1TEnc+1TSig+1TCmp

N/A

N/A

N/A

N/A

N/A

1TP + 2TH

1TP + 2TH

+1TCmp + 1TEnc

5TMul + 4TH

5TMul + 4TH+1TCmp + 2TEnc+2TCmp + 2TEnc+1TSig+1TSig

5TMul + 4TH
N/A

2TMul + 1TH+1TCmp + 1TEnc
N/A

5TMul + 4TH
N/A+1TCmp + 1TEnc

N/A+1TSig

TP: Polynomial function operation
TMul: Multiplication operation
TH: Hash function operation
TCmp: Comparison operation
TEnc: Symmetric encryption operation
TSig: Signature operation

3.8

Communication performance

The communication cost of the proposed scheme is shown in Table 2. The communication
efficiency of the proposed scheme during the transaction process of each phase was also
analyzed. It was assumed that a polynomial function operation required 160 bits, an elliptic
curve modular operation required 160 bits, a hash operation required 160 bits, an AES operation
required 256 bits, a signature operation required 1024 bits, and a doctor’s certificate required
512 bits, while other messages, such as id, pid, and random number, required 80 bits. For
example, the rural medical vehicle authentication and communication phase of the proposed
scheme requires four elliptic curve modular messages, two hash messages, two AES messages,
one signature operation message, one doctor’s certificate message, and four other messages.
It thus requires 160*4 + 160*2 + 256*2 + 1024*1 + 512*1 + 80*4 = 3328 bits. In a 3.5 G
environment, the maximum transmission speed is 14 Mbps. In this study, we also consideredSensors and Materials, Vol. 31, No. 3 (2019)

1061

Table 2
Communication cost of the proposed scheme.
Phase
Body sensor device
registration phase
Personal mobile reader
registration phase
Rural medical vehicle
registration phase
Hospital medical reader
registration phase
Personal mobile reader
authentication and communication phase
Rural medical vehicle
authentication and communication phase
Hospital medical reader
authentication and communication phase

Message length

Round

Item
3.5G (14 Mbps)

4G (100 Mbps)

400 bits

20.029 ms

0.004 ms

880 bits

40.063 ms

0.009 ms

480 bits

2

0.034 ms

0.005 ms

480 bits

2

0.034 ms

0.005 ms

736 bits

2

0.053 ms

0.007 ms

3328 bits

4

0.238 ms

0.033 ms

2992 bits

3

0.214 ms

0.030 ms

Table 3Functionality comparison of previous schemes and the proposed scheme.
SchemeFunctionality
Rezaeibagha et al. (2018)(25) Li et al. (2018)(26)
Mutual authentication
Yes
Yes
Data integrity
Yes
Yes
User untraceability
Yes
Yes
Resisting replay attack
Yes
Yes
Forward and backward secrecy
Yes
Yes
NonrepudiationNo
Yes
BAN logic proof
No
No
Offline authenticationNo
No

Our Scheme
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes

the rural medical vehicle authentication and communication phase of the proposed scheme,
which only takes 0.238 ms to transfer all messages. In a 4 G environment, the maximum
transmission speed is 100 Mbps and the transmission time is reduced to 0.033 ms (ITU 2016).
3.9

Functionality comparison
The functionality comparison of previous schemes and the proposed scheme is shown in Table 3.

4.

Conclusions

Recent developments in sensor network and cloud computation technology have givenrise to what is known as the IoT. Many services can be provided through network cloudenvironments, including rural medical care services. The government provides rural medical
vehicles to visit rural areas for medical services. Residents with chronic diseases or those who

1062

Sensors and Materials, Vol. 31, No. 3 (2019)need long-term monitoring of physiological conditions can wear physiological sensing devices,and these sensing data can be provided to rural medical vehicles, so that doctors can diagnose
symptoms. For patients with complicated or severe conditions, it is necessary to go to large
hospitals in urban areas for further diagnosis and treatment. To improve the medical efficiency,
the patient can inform the doctors of the physiological sensing data and the diagnostic report of
the rural medical vehicle. In addition, aging populations mean an increased need for expanded
healthcare, which has resulted in a new technology development trend. Elderly people can
now wear body sensor devices and personal mobile readers to establish a BAN, which canprovide medical care workers and doctors with necessary patient data for diagnoses. However,malicious attackers may seek to obtain sensitive personal data for various reasons. Thus, an
IoT-based sensing rural medical care system that can provide security, privacy, and efficiency isnecessary.
Previously proposed architectures for a healthcare environment lack comprehensive
consideration. Therefore, in this study, we propose an IoT-based sensing rural medical caresystem, which consists of a secure and lightweight BSN based on the IoT for rural medical careenvironments. We use sensor and network technology to propose an intelligent rural medical
healthcare environment. The sensors can monitor physiological condition and transfer thesensing data to a cloud server. To sum up, in this work, we mainly achieved the following threecontributions. First, a comprehensive framework for an IoT-based sensing rural medical caresystem was proposed, including body sensor devices, personal mobile readers, rural medical
vehicles, hospital medical readers, and a medical cloud server. Second, a secure communicationarchitecture for all roles was designed, unlike previous studies that have only mentioned theconcept. Third, the proposed authentication mechanism ensures mutual authentication, data
integrity, user untraceability, nonrepudiation, forward and backward secrecy, and security
against replay attacks.

Acknowledgments
This work is supported by the National Natural Science Foundation of China (No. 61672442)
and the Science and Technology Planning Project of Fujian Province (No. 2016Y0079).

Author Contributions
Chin-Ling Chen and Yong-Yuan Deng designed the protocol and analyzed the security
property. Chin-Feng Lee and Shunzhi Zhu proposed the original idea and design protocol. YiJui Chiu and Chih-Ming Wu surveyed the related works.

Conflicts of Interest
The authors declare no conflict of interest.

Sensors and Materials, Vol. 31, No. 3 (2019)

1063

References
1 S. R. Moosavi, T. N. Gia, E. Nigussie, A. M. Rahmani, S. Virtanen, H. Tenhunen, and J. Isoaho: Future Gener.
Comput. Syst. 64 (2016) 108.
2 M. A. S. Junior, M. V. M. Silva, R. C. A. Alves, and T. K. C. Shibata: Comput. Commun. 98 (2017) 43.
3 Y. Yang, X. Zheng, and C. Tang: J. Netw. Comput. Appl. 89 (2017) 26.
4 B. R. Ray, J. Abawajy, M. Chowdhury, and A. Alelaiwi: Future Gener. Comput. Syst. 78 (2018) 838.
5 M. Simplicio, B. Oliveira, P. Barreto, C. Margi, T. Carvalho, and M. Naslund: Proc. 36th IEEE Conf. Local
Computer Networks (LCN) (2011) 454.
6 I. Chiuchisan and M. Dimian: IEEE Int. Workshop on Computational Intelligence for Multimedia
Understanding (IWCIM) (2015) 1.
7 H. Khemissa and D. Tandjaoui: Int. Conf. Next Generation Mobile Applications, Services and Technologies (2015)90.
8 Y. Yang and M. Ma: IEEE Trans. Inf. Forensics Secur. 11 (2016) 746.
9 J. Lee, K. Kapitanova, and S. Son: Int. J. Comput. Telecommun. Netw. 54 (2010) 2967.
10 A. Abbas and S. Khan: IEEE J. Biomed. Health Inf. 18 (2014) 1431.
11 K. Liang and W. Susilo: IEEE Trans. Inf. Forensics Secur. 10 (2015) 1981.
12 J. Yang, J. Li, and Y. Niu: Future Gener. Comput. Syst. 43–44 (2015) 74.
13 D. He, C. Chen, S. Chan, and J. Bu: IEEE Trans. Ind. Electron. 59 (2012) 4155.
14 J. Han, W. Susilo, and Y. Mu: IEEE Trans. Inf. Forensics Secur. 10 (2015) 665.
15 S. Zhao, A. Aggarwal, R. Frost, and X. Bai: IEEE Commun. Surv. Tutorials 14 (2012) 380.
16 A. Whitmore, A. Agarwal, and L. Da Xu: Inf. Syst. Front. 17 (2015) 261.
17 G. Fortino, D. Parisi, V. Pirrone, and G. D. Fatta: Future Gener. Comput. Syst. 35 (2014) 62.
18 G. Fortino, S. Galzarano, R. Gravina, and W. Li: Inf. Fusion 22 (2015) 50.
19 R. Gravina, P. Alinia, H. Ghasemzadeh, and G. Fortino: Inf. Fusion 35 (2017) 68.
20 Z. Zhou, D. Huang, and Z. Wang: IEEE Trans. Comput. 64 (2015) 126.
21 A. Ali, S. Irum, F. Kausar, and F. Khan: Multimedia Tools Appl. 66 (2013) 201.
22 S. Mollera, T. Newe, and S. Lochmann: Sens. Actuators, A 173 (2012) 55.
23 H. Kim, C. H. Kim, and J. M. Chung: Wireless Commun. Mobile Comput. 12 (2012) 145.
24 A. Papali: Bull. World Health Organ. 94 (2016) 73.
25 F. Rezaeibagha and Y. Mu: IEEE Trans. Inf. Technol. Biomed. 78 (2018) 24.
26 C. T. Li, D. H. Shih, and C. C. Wang: Comput. Methods Programs Biomed. 157 (2018) 191.
27 X. Yao, Z. Chen, and Y. Tian: Future Gener. Comput. Syst. 49 (2015) 104.
28 D. He, C. Chen, S. Chan, J. Bu, and A. Vasilakos: IEEE Trans. Inf. Technol. Biomed. 16 (2012) 1164.
29 D. He, C. Chen, S. Chan, J. Bu, and A. Vasilakos: IEEE Trans. Inf. Technol. Biomed. 16 (2012) 623.
30 W. Han and Z. Zhu: Int. J. Commun. Syst. 27 (2014) 1173.