# Body Area Networks in Healthcare: A Brief State of the Art
## 6 Cross-Layer Properties  
### Privacy and Security  
In the majority of cases, BAN applications manage sensitive information. This information must be protected from unauthorized access or modification. With the aim of protecting sensitive data, basic requirements must be satisfied in a system:  
* The information generated by the solution needs to be accurate and without alterations.
* Sensitive data can only be accessed by authorized entities.
* The system must know the identities of all entities that access it.
* Entities only have access to the necessary information.
* The information generated by the application needs to be available when required.  
A possible violation of security is a threat. An attack is when a threat is executed by entities called attackers. Threats can be grouped into three categories:  
1. When the attacker is observing the communication of the system with another authorized entity and intercepts the transmitted data without interfering. This attack is called eavesdropping.
2. An attack made by an entity that has a valid part of the system by modifying, deleting or adding information is called spoofing.
3. Denial of service attack is when an attacker inhibits the availability of the system. This attack can be done by blocking the communication channel or by physical damage to the hardware.  
The IEEE 802.15.6 standard proposes three different levels of security:  
1. Unsecure: At this level, none of the basic security requirements are satisfied. This is an unsecured communication.
2. Authentication: A system using this level of security uses authentication but not encryption for transmitting information.
3. Authentication and encryption: This level uses authentication and encryption for communication. This is the most secure level.  
In medical applications, the security of patient records should be considered in all development phases. Medical records are sensitive in nature and must be protected from unauthorized access. Unapproved access to patient records can lead to many problems, such as:  
* Incorrect diagnosis due to an alteration of medical records,
* False alarms,
* Elimination of real alarms,
* Patients can suffer economic and social discrimination.  
On the one hand, BAN applications are continuously gathering and storing sensitive information, and this aspect can lead to security breaches. Developers must ensure that the information generated by BAN systems is secured. Adding security causes an increase in complexity, which could make the system difficult to develop and debug; difficult to use for caregivers and patients; expensive, and also computationally. However, a good design in the development process can solve or mitigate many of the issues previously mentioned.  
In this regard, a lightweight anomaly detection framework for BAN applications has been described [58]. The framework is based on four algorithms: discrete Haar Wavelet transform, non-seasonal Holt-Winters, Hampel filter, and Boxplot. Through these algorithms, the framework is capable of detecting faulty or malicious injected measurements in healthcare solutions. The framework was designed to be used in devices with low computational complexity and storage requirements. Another example is a design in healthcare monitoring systems for a proactive reliable data transmission mechanism with resilience requirements in a many-to-one stream model [59].