## 1 Introduction  
In our society, an increasing percentage of the population are aging people who have chronic illnesses such as diabetes and heart disease. In addition, more children are suffering from long-term conditions such as asthma and obesity. If these people's health could be monitored continuously over a long period of time, physicians could detect serious health problems sooner as well as provide more accurate diagnoses and better treatment. For instance, previous studies have shown that monitoring patient data can help with early detection of conditions like heart disease [1, 2]. Moreover, medical professionals could react to situations such as strokes and asthma attacks more quickly. Current monitoring solutions, however, are not suitable for long-term purpose, as patients are typically attached to a bedside device that limits their mobility and comfort. Several research groups (e.g., [3, 4, 5, 6, 7]) have recently integrated medical sensors with wireless _motes_ for health monitoring, such as the Harvard wireless pulse oximeter [4]. A more is low-power computing device with a wireless radio; it is typically the size of a match box or even smaller. Using the motes, these medical sensors wirelessly transmit data to base stations, where it can be accessed by physicians and nurses. This frees patients from the confinement of traditional wired sensors, allowing medical professionals to monitor their health remotely over long periods. Such _medical sensor networks_ can be deployed in hospitals, long-term care facilities, and homes. Pharmaceutical companies could also use the network to monitor patients in clinical trials in order to develop better drugs. Moreover, the system can be extended to monitor the vital signs of people working in hazardous conditions, such as firefighters in a burning building, relief workers in a disaster area, and soldiers on a battlefield. Although medical sensor networks are extremely useful and versatile, the medical data they collect is sensitive, and the privacy of such data is legally protected (e.g., the Health Insurance Portability and Accountability Act of 1996 (HIPAA) [8]). A patient's physiological data may reveal what disease the patient has (which might be useful to parties such as insurance companies). As such, an attacker may profit financially by selling data obtained through eavesdropping. Moreover, the attacker could even cause physical harm to a patient by misreporting or spoofing the patient's data, resulting in improper diagnosis and/or treatment. Therefore, it would be irresponsible to design and deploy a medical sensor network without adequate security mechanisms. Moreover, patients will not make use of this system if they are not convinced that their data will be kept confidential, regardless of how good the system's performance is. To this end, our work aims to design a secure medical sensor network for health monitoring. We believe that security mechanisms must be designed into the architecture from day one rather than after the other issues are addressed, as security requires careful thoughts on where functionality should be placed and how the system components interact with one another. Similar security issues may exist in some traditional wireless ad hoc networks and other types of sensor networks. However, a medical sensor network monitors _humans_, unlike most existing sensor networks that monitor the _physical environment_. A _human-centered_ sensor network has distinct features such as the sensitive nature of the data, the mobility of sensors, and the proximity to potential attackers, all of which makes it difficult to address security. The contribution of our work is the following. First, we identify the security requirements and challenges in a medical sensor network.