# Homomorphic Encryption Based Privacy-Preservation for IoMT
## 3 Proposed Scheme
### Overview of the Proposed Scheme  
The proposed scheme consists of several elements participating in secure encryption, data management, and privacy-preserving computation processes:  
* IoMT devices identify as the data owners (DO) responsible for generating data using embedded sensors in each patient. These machines include medical devices embedded in beds, machines deployed for scanning a patient's vitals, and other smart sensors surrounded in the hospital. * Virtual edge nodes (VEN) collect encrypted data shared by IoMT devices and use them to process and transmit output results to the healthcare application. * The intelligent healthcare application, behaving as the data user (DU), monitors the data shared by IoMT devices. The DU manages the homomorphic decryption process and the number of shares generated during the homomorphic secret sharing computation process. As shown in Figure 1, the proposed scheme is based on the following processes:  
1. Several varying IoMT devices present in the hospital collect data from patients and transmit it to the DU that manages the intelligent healthcare application. * 1. The DU forwards the data to the base station, which encrypts the plaintext data (\(x\)) to produce an encrypted ciphertext (\(c\)) using homomorphic encryption. Here, \(c=Enc(x)\) represents data being encrypted. * 1. The edge-based base station provides several VENs around hospital zones for various computation services assigned by the DU for different tasks. A cluster is designed that provides support to IoMT devices that behave as cluster members along with VENs. * 1. A cluster head (CH) behaves as the centroid of each cluster, and the one closest to the physical set of IoMT devices is selected. CH enables a line of sight with cluster node members based on distance proximity, providing better connectivity. In our paper, the base station maintains the geographical coordinates of each device and assigns a selected VEN as the CH closest to the set of devices using k-nearest neighbors. * 1. Data transmission from the IoMT device is sent to the base station using unsecured channels, which exposes them to replay and delay attacks. Timestamp and nonce value-based scheme alerts the device to an attacker present in the communication channel. * 1. Time clocks on devices are subject to being reset by attackers, and a time resynchronization scheme on the VENs and the cluster head VEN securely resets the time clock. * 1. Data is encrypted from plaintext to ciphertext using a homomorphic encryption scheme at the base station and prevents cyber attackers from accessing the encrypted data. * 1. Homomorphic secret sharing schemes rely on the number of computational operation queries requested by the DU to generate an \(n\) number of shares (\(Sh_{1},\ Sh_{1},\ldots\ldots Sh_{n}\)) distributed to each cluster head VEN. Data received at each node is previously encrypted using the homomorphic encryption algorithm. * 1. Each cluster head VEN evaluates and computes data using cloud service resources allocated by the base station. Allocation of resources is equally distributed to each VEN, preventing an untrusted cloud service from learning the computation operations. * 1. The DU receives the output data from the various cluster member VENs via the base station and performs the final decryption process of converting the results from the VENs ciphertext to plaintext. IoMT devices include sensors with low-powered battery and computational resources, such as Bluetooth Low Energy and Low Power Wide Area Network devices that continually transmit data to the DU. Data is encrypted at the base station using homomorphic encryption, which supports addition and multiplicative operations. DU sends queries to the base station to perform computational tasks on the encrypted data. Heavy operational tasks are difficult for a single edge node to function due to limited computational power.