# An IoT System for Remote Monitoring of Patients at Home
## 6 Buddy-ACK Authentication Scheme  
Because the biomedical data obtained by a PHD may be very sensitive in terms of a patient's privacy, the data need to be handled in a manner that prevents its exposure to unauthorized persons. In this study, two security schemes are proposed. First, a patient's biomedical data obtained by a PHD are not stored as a single unit, but are stored in parts in the IoT server. The data are partitioned into  
Figure 12: An example of the process described in Figure 11.  
several parts (two parts in this study) and stored separately in the IoT server. Bytes of the data are stored alternatively into two different locations. Furthermore, the separation information including the locations of the parts is not stored in the IoT server, but in the IoT authentication server. This means that anyone who wants to access the data will need to access both the IoT server and the IoT authentication server simultaneously. Second, an authentication scheme called the Buddy-ACK authorization scheme is proposed in this study. In a normal authorization scheme, only a user needs to be authorized [32]. However, in the Buddy-ACK authorization scheme, specific biomedical data can be accessed only after both a patient and the related medical staff are authorized. We call the patient and the related medical staff \"buddies\". Biomedical data can be accessed only after the acknowledgement (or consent) of the related buddy is obtained. In this way, the Buddy-ACK authorization scheme is stricter than normal authorization processes. As far as message authentication is concerned, existing encryption/digital signature schemes can be used [32]; this is not an issue we will discuss further. The security schemes proposed in this study has the following properties:  
* The separation storage of biomedical data: A patient's biomedical data obtained by a PHD are not stored as a single unit, but are stored in parts on the IoT server. The data are partitioned into two parts, each having alternate bytes, and stored separately into the IoT server. The separation information including the locations of the parts is not stored in the IoT server but in the IoT authentication server. Because the IoT authentication server does not have data itself, an attacker would need to successfully breach both servers simultaneously. Even a system administrator of the IoT server cannot obtain the data because the IoT server does not have the separation information that describes where the data parts are located. When data are requested, the IoT server has to request the IoT authentication server for the locations of all the data parts to assemble all of the data parts for complete data. * The buddy-ACK authentication scheme: For the sake of patient privacy, the buddy-ACK authentication scheme is proposed in this study. A patient and the medical staff responsible for the patient are considered to be \"buddies\". When a medical staff requests a patient's data, acknowledgement (or consent) of the patient is needed. The IoT authentication server sends the separation information of the data only after the server receives the acknowledgement of the patient. Similarly, even when a patient requests his own data, acknowledgement of the related medical staff must be obtained. The acknowledgement is realized as encrypted IMEI (International Mobile Equipment of Identity) in this study. The encryption key is obtained when a patient (or a medical staff) registers at the IoT authentication server. Thus, the key is shared only by a patient (or a medical staff) and the IoT authentication server. In this way, an attacker may experience significant difficulties in accessing a patient's data because the attacker must know the encryption keys of both the patient and the related medical staff to be successful. Alarm signals that report the abnormal condition of the patient are exempt from the Buddy-ACK authorization process because the signals should be delivered to the related medical staff immediately. Push operations are used for the signals in the system.