## 3 Security and Privacy Issues
### Security Threats  
As we have seen in the above healthcare scenarios, WMSNs certainly improve patient's quality-of-care without disturbing their comfort. The medical sensor senses patient _sensitive_ body data and transmits it over the wireless channels which are more susceptible than wired networks. Thus, patient sensitive physiological variables must remain secure and private from security threats, so this sub-section discusses the possible security threats that would be harmful for the wireless healthcare success, as follows:  
Monitoring and Eavesdropping on Patient Vital Signs  
This is the most common threat to the patient privacy. By patient vital sign snooping, an adversary can easily discover the patient information from communication channels. Moreover, if the adversary has a powerful receiver antenna, then he/she can easily pick up the messages from the network. The captured message may contain the physical location of the patient, allowing an attacker to locate the patient's position and physically harm him/her. In addition, an adversary can also detect the message contents including message-ID, timestamps, source address, destination address and other relevant information. Thus, monitoring and eavesdropping can pose a serious threat to patient privacy [8; 16]. Threats to Information When in Transit  
As we know, wireless communication ranges are not confined, and are easily vulnerable. In wireless healthcare applications, medical sensors sense the patient and environmental data, and send it either to the physician or the hospital server. While sending the sensor's data (_i.e._, in transit), it may be attacked. For example, an adversary can capture the physiological data from the wireless channels, and can alter the physiological data. Later, he/she may pass the attacked data (_i.e._, altered data) to the physician or remote server, which could endanger the patient. There are various types of in transit attacks: (i) _Interception:_ Suppose, a WMSN has been compromised by a smart adversary. Then he/she can illegally access the sensor node data (e.g., cryptographic keys, sensor ID's, type _etc._). (ii) _Message modification:_ In the message modification attack, the attacker can capture the patient wireless channels and extract the patient medical data; and later he/she may tamper with the patient data, which can mislead the involved users (e.g., doctor, nurse, family member, _etc._). For example, suppose a cardiograph sensor transmits normal data to the medical staff, if an attacker able to modify the patient data during the communication and send the modified data to medical staff, it may cause an overdose of medicine being administered to the patient. Further, this modified data can trigger a false alarm or can hide the true patient conditions, if abnormal. Message modification threatens the message integrity of medical sensor nodes. Routing Threats in WSNs  
For the experimental scenario, consider the CodeBlue [7] and MEDiSN [54] and [57] architectures, which need a multi-hop environment (_i.e._, one node to another node) from body sensors to a remote server. A malevolent user could thus attack the network layer. He/she may steal or modify the packets, and forward the altered packets to the remote center (_i.e._, back-end) that may cause a false alarm. Morespecifically in the CodeBlue [7] application, body sensors send their data using an ADMR routing protocol to the remote location (_i.e._, hospital). An attacker might alter the address fields of captured packets before forwarding them to the next hop, and consequently, misguide the route or even generate an endless routing loop [49]. The routing attacks in a multi-hop environment are the following:  
1. Selective forwarding: In multi-hop environment [7, 54, 56, 57], sensor packets (_i.e._, health data or environmental data) are expected to be forwarded to the base station or remote server via multi-hop routing.