# An Investigation into Healthcare-Data Patterns
## 2 Background Research
### Structure  
Healthcare organisations have sensitive data spread across several devices. Mobile devices, such as laptops or tablets, are all used for inputting medical data. Specialised devices, such as Draeger patient monitoring systems, require network connectivity. In result, healthcare network security challenges can be summarised into four categories: system structure, mobile device, medical equipment and user-based challenges. \"System structure\" refers to the vulnerabilities in the physical system layout; mobile device challenges relate to issues surrounding on-demand network access; medical equipment challenges concern low security in medical and biomedical devices. Finally, user-based challenges refer to the general staff-awareness of existing cyber-threats or good cyber-security practices. For example, a hospital staff member may unsuspectingly click on a link in an email, which contains a Trojan virus and creates a back door into the hospital network. Healthcare organisations differ from other enterprise networks through their use of medical cyber-physical systems (MCPSs). MCPSs are inexpensive personal monitoring devices that can record and transmit multiple physiological signals [14]. Encryption of this data is required for secure storage, secure transmission, and secure computation. MCPSs are comprised of four layers, which need to be considered and secured. (1) The data acquisition layer has a body area network (BAN), which are wearable sensors which facilitate the collection of patient medical information. (2) The data concentration/aggregation layer, consisting of transmitting the gathered information to a gateway server through short range wireless, such as Bluetooth, due to the low computational power of sensors with a BAN. (3) The cloud processing and storage layer consist of the long-term secure storage, processing and analytics of medical information. (4) The action layer involves either active of passive use of the data. Active usage employs an actuator using the data and the algorithms used to perform data analytics to be directly influenced by the data, such as through the use of a robotic arm in robot-assisted surgery. Passive action visualises the data to provide decision support to medical professionals [14]. Figure 1 presents a 3-layer network topology overview of how the Liverpool-based hospital network is configured. The diagram demonstrates the principle of how the network is configured; as in reality it is replicated several times over and therefore too substantial to fit on a single diagram. The diagram shows the network layers involved between the server layer and the access layer, and demonstrates that they are duplicated throughout in order to provide network resilience. The servers connect to the server switch, providing the server access layer of the network topology (aka the application layer). This then connects to the distribution layer, also known the transport layer. The transport layer connects to the core layer or the Internet layer, providing access to routing,wireless and the firewall. This then again connects to another distribution/transport layer, which finally connects to the network access layer where networked devices connect to the network. Figure 2 presents an overview of the Liverpool-based network infrastructure for enabling remote access within the hospital. The layout enables staff the ability to work together and provide on-call services remotely. The blueprint demonstrates the locations of the LANs and VLANs within a typical hospital network. In addition, the firewall placements, in relation to the Internet, are depicted. Figure 2 also displays the relationship between a hospital's typical 'community of interest network' (CoIN)/WAN and the N3 (a WAN used to connect many sites across the UK National Health Service). The system layout leaves a vulnerability to attackers being able to eavesdrop on traffic between the network controller and the supervisor in particular.