# Secure Lightweight IoT Integrated RFID Mobile Healthcare System

Authors: Vankamamidi S. Naresh; Sivaranjani Reddi; Nistala V. E. S. Murthy
Journal: Wireless Communications and Mobile Computing
 (2020)

---

## Abstract

Patient safety is a global public health concern nowadays, especially in elderly people who need physiological health monitoring systems integrated with a technology which will help to oversee and manage the medical needs. In this direction, we propose a lightweight effective healthcare monitoring system designed by using the Internet of Things (IoT) and Radio Frequency Identification (RFID) tags. In this technique, we use dual-band RFID protocols which are the one working at a high frequency of 13.56 MHz and useful to figure out the individuals, and 2.45 GHz microwave bands are used to monitor corporal information. Sensors are used to monitor and collect patient physiological data; RFID tag is used to recognize the patient. This IoT-based RFID healthcare monitoring system provides acquisition of physiological information of elderly people and patients in hospital. Further, it is aiming to secure patient’s health recordings using hyper elliptic curve- (HEC-) based signcryption algorithm while allowing the doctor to access patient health information. Privacy is provided to variable length patient medical records using different genus curves, and the evaluation shows that the proposed algorithm is optimal with respect to healthcare.


---

## Body

## 1. Introduction

Mobile healthcare (M-health) system is a system intended to preserve patient health records remotely, allowing doctors to access them from their location to give medical guidance according to need. This arrangement improves accessibility and efficiency, because both patients and doctors need not meet each other. Therefore, patients from their residence can acquire the medical diagnostic suggestions from doctors directly. In this process, RFID technology plays a vital role in patient personal information identification and medical record access ([16, 17]). RFID tag, reader, and middleware are the components present in the RFID system. Tag is used to store a unique identification number, reader is used to read the number present on tag, and middleware is responsible to store and process the data from readers. The technological advancements in this field, in particular development of chip, are very fast, have low activation power (μW), and even able to integrate diverse sensing capabilities. This development opens a challenge of investigating sophisticated applications in IOT paradigm. RFID seems to be the next disruptive modernization in healthcare, which offered several openings for improved safety, functioning effectiveness and economical savings. Even though it promises several benefits in healthcare, the adoption of this technology in healthcare has not been as striking as anticipated and still lags behind compared to other applications due to apprehensions related to security and privacy, radio frequency interference, and inadequacy of industry benchmarks. Hence, security is the major concern in RFID-based healthcare systems. In order to ensure a secured communication, authentication check should happen in tag and reader, encrypting their identification and the patient data to attain confidentiality. Many cryptographic algorithms [2] were suggested to provide security and privacy to message in communication, encryption, and decryption. Table 1 shows the comparative analysis of various cryptographic algorithms which includes Rivest–Shamir–Adleman (RSA), Diffie Hellman Algorithm (DHA), elliptic curve (EC) ([3, 8–10]), and hyper elliptic curve (HEC) key ([11–13]); from it, we can observe that in HEC, group operations are fast over finite field than EC. For genus, g≥2 curves ([14, 15]) can perform operations at a superior level, which made the study of HECC a need of the hour.Table 1
Comparison of key sizes (bits).
Field
RSA and DH
EC
HEC
F(280)
1024
160
50-80
F(2112)
2048
224
112
F(2128)
3072
256
128
F(2192)
7680
384
192
F(2256)
15360
512
256


### 1.1. Contributions

The contributions of the proposed work include the following:(i)
Patient registration (RFID tag) and health reading acquisition through sensors
(ii)
Transmission of health recordings along with patient RFID tag using a mobile to patient information database through the Wireless Public Network (WPN).
(iii)
Secured transmission of patient health records between RPS and authorized entities (doctors and ambulance service) using HEC algorithm
(iv)
Comprehensive implementation and security analysis of proposed protocol for genus 2 curveSection2 covers literature and mathematical background. The proposed architecture and security algorithms are in Section 3. Section 4 discusses about security analysis. Comparative analysis with existing methods is in Section 5. Finally, summary is in Section 6.


## 1.1. Contributions

The contributions of the proposed work include the following:(i)
Patient registration (RFID tag) and health reading acquisition through sensors
(ii)
Transmission of health recordings along with patient RFID tag using a mobile to patient information database through the Wireless Public Network (WPN).
(iii)
Secured transmission of patient health records between RPS and authorized entities (doctors and ambulance service) using HEC algorithm
(iv)
Comprehensive implementation and security analysis of proposed protocol for genus 2 curveSection2 covers literature and mathematical background. The proposed architecture and security algorithms are in Section 3. Section 4 discusses about security analysis. Comparative analysis with existing methods is in Section 5. Finally, summary is in Section 6.


## 2. Background Work

Patient medical data privacy, maintenance, and security are essential considerations in healthcare. Even though RFID technology guaranteed security and the privacy up to some extent, still it is the most challenging issue ([5–7, 23–25, 27]). The privacy-related challenges mainly arise from counterfeiting the original data in RFID tags, unauthorized data accessing information in transmission [26]. In legal perspective, according to the Health Insurance Portability and Accountability Act (HIPAA) of 1996 in USA, allegedly access of patient data stored in RFID tag is a violation of government regulations. As most of the RFID tags rely on wireless interface, a health monitoring system may also be subject to physical attacks. Eavesdropping is the concern, when patient data is in transmission to the hospital, so authentication is required between them. Research has been going on addressing these issues; [18, 19, 21, 22] have proposed frameworks, which preserve the patients privacy and data security while trying to access the health records. Another study on data secrecy concerns ([28–33]) in healthcare suggests abidance of data captured through RFID, the awareness on existing security policy to medical staffs, and usage of RFID in hospitals [20]. The IoT-based integrated healthcare service structure model [31] that can quickly receive information on patients’ conditions using in-hospital IoT equipment that uses wireless personal area networks such as RFID and Wireless Sensor Networks (WSN) among those low power wireless protocols that are provided by different healthcare service systems to provide healthcare services (e.g., diagnosis and treatment) to patients. An effective healthcare monitoring system used IoT and RFID tags without considering the security perspective [32]. Hu et al. [33] have proposed an intelligent and secure health monitoring scheme using an IoT sensor based on cloud computing and cryptography.


### 2.1. Mathematical Background of Hyper Elliptic Curves

A HEC"ℂ" of genus g is defined over a field GFp as
(1)y2+hx·y=fx,where ℂ is a nonsingular curve, hx is a polynomial with degree hx≤g, and fx is also a polynomial having degree fx−1=2. If p>2 and hx is 0, then fx should be a square-free polynomial. In most situations, no x and y in algebraic closure of Fq, which satisfies HEC"ℂ" and the two partial derivatives, i.e., 2y+hx=0 and h′xy−f′x=0.Adivisor D is a formal sum of points P∈C:D=∑P∈ℂmPP with mp∈Z and for all but finitely many mP=0.Thedegree and order of D is ∑P∈ℂmP and mP, respectively.Asemireduced divisor of D=∑imiPi−∑imi∞, where eachmi≥0 and all thePi′sare finite points.ThePrincipal Divisor (Jacobian) [1] of the curve ℂ is expressed as
(2)J=Jℂ=Div0CP.LetD1,D2∈Divℂ. We have the following equivalence relation on Divℂ:
(3)D1∼D2⟺D1−D2∈Por equivalently: D1∼D2⟹∃R∈KC:D1=D2+DivR.Each element of JacobianJacℂ is uniquely represented by D=P1+P2+⋯+Pr–r·∞, where r≤g and Pi is asymmetric of Pj.LetD=∑imiPi−∑imi∞ a semireduced divisor, which can be characterized by two polynomials as follows:
(1)
Ux=∏x−ximi, a monic polynomial having root, which has the same x-coordinate points in the support of the divisor. The multiplicities of the roots are equal to order of the corresponding P on it
(2)
At this juncture, there are two scenarios as follows:
(i)
If allPi’s are distinct, Vx=∑iyi∏j≠ix−xj/∏j≠ixi−xj, the unique polynomial such that degV≤degU–1 and Vxi=yiforallxi
(ii)
If allPi’s are equal, we need to compute Vx, the unique polynomial with degree≤∑imi−1 that fulfills the following condition along with the Vxi=yi condition and if multiplicity of Pi=mi such that d/dxjVx+Vxhx−fxx=xi=0; for 0≤j≤mi−1, i.e., there exists a unique Vx such that x−ximiVx2+Vxhx−fx


## 2.1. Mathematical Background of Hyper Elliptic Curves

A HEC"ℂ" of genus g is defined over a field GFp as
(1)y2+hx·y=fx,where ℂ is a nonsingular curve, hx is a polynomial with degree hx≤g, and fx is also a polynomial having degree fx−1=2. If p>2 and hx is 0, then fx should be a square-free polynomial. In most situations, no x and y in algebraic closure of Fq, which satisfies HEC"ℂ" and the two partial derivatives, i.e., 2y+hx=0 and h′xy−f′x=0.Adivisor D is a formal sum of points P∈C:D=∑P∈ℂmPP with mp∈Z and for all but finitely many mP=0.Thedegree and order of D is ∑P∈ℂmP and mP, respectively.Asemireduced divisor of D=∑imiPi−∑imi∞, where eachmi≥0 and all thePi′sare finite points.ThePrincipal Divisor (Jacobian) [1] of the curve ℂ is expressed as
(2)J=Jℂ=Div0CP.LetD1,D2∈Divℂ. We have the following equivalence relation on Divℂ:
(3)D1∼D2⟺D1−D2∈Por equivalently: D1∼D2⟹∃R∈KC:D1=D2+DivR.Each element of JacobianJacℂ is uniquely represented by D=P1+P2+⋯+Pr–r·∞, where r≤g and Pi is asymmetric of Pj.LetD=∑imiPi−∑imi∞ a semireduced divisor, which can be characterized by two polynomials as follows:
(1)
Ux=∏x−ximi, a monic polynomial having root, which has the same x-coordinate points in the support of the divisor. The multiplicities of the roots are equal to order of the corresponding P on it
(2)
At this juncture, there are two scenarios as follows:
(i)
If allPi’s are distinct, Vx=∑iyi∏j≠ix−xj/∏j≠ixi−xj, the unique polynomial such that degV≤degU–1 and Vxi=yiforallxi
(ii)
If allPi’s are equal, we need to compute Vx, the unique polynomial with degree≤∑imi−1 that fulfills the following condition along with the Vxi=yi condition and if multiplicity of Pi=mi such that d/dxjVx+Vxhx−fxx=xi=0; for 0≤j≤mi−1, i.e., there exists a unique Vx such that x−ximiVx2+Vxhx−fx


## 3. Proposed Architecture

The arrangement of the RFID technology-based health monitoring system is aimed at monitoring the medical conditions of the patient by collecting the readings from the sensors attached to the patient and subsequently updated in the back-end database through mobile and the WPN connection subject to patient location. For any minor health hazards, which does not require immediate medical attention, the doctor may be logged into the database using RFID tag and observe the patient current situation for the future reference. Even the doctors or other care providers can access the patient database directly from remote and can communicate directly with the patient through video conference through the internet. In fact, this arrangement facilitates the doctor to diagnose the patient from remote based on the physiological data extracted from the patient database, which is hosted by the middleware. Sometimes, the patient may be suggested to visit the doctor if necessary. Also, the doctor is allowed to write the diagnosis information, medical treatment, and prescription information onto the patient’s information database using the patient’s RFID tag, which will improve the patient quality by eliminating the human errors and the ambiguity in patient-doctor and doctor-doctor interaction while giving the treatment to the patient.Figure1 shows the architecture of the proposed arrangement of the healthcare system using RFID technology. This architecture employs the existing wireless communication infrastructure to increase its effectiveness by relying on the following components: RFID tag, Wireless Body Area Network (WBAN) Sensors, and patient information server.
(1)
RFID tag. This is a unique identification given to the patient at the time of registration, which will be used in the future by doctors to access patient physiological data. It is the gateway to permit the grant to access the corresponding facilities needed. At first time of admission into the hospital, the patient’s personal details along with the mobile number is transformed onto the patient information server in the back-end along with the RFID tag assigned. It is also used for patient location finding. A mobile RFID reader is a mobile device having a reader embedded in it, developed in Korea and tested on various application services for service confirmation. A mobile RFID phone present in the architecture requests patient identification information by reading the tag attached to the patient through a mobile reader, then transmits this patient’s unique identification number to the back-end information server via middleware.
(2)
WBAN sensors. Wearable sensor devices on patient body allow monitoring closely the changes in them and in the environment and provide the feedback in order to maintain the finest and instantaneous status. To monitor patient health condition periodically, various sensors like electrocardiogram (ECG), blood pressure sensor, and electroencephalogram (EEG) are placed around the patient body, along with other sensors which can be used to measure the distance, temperature, movement, etc. WBAN is a network that offers continuous monitoring over or inside the human body for a long period and can send real-time traffic such as data, voice, video of patient organism functionalities through the mobile. The mobile used is responsible to transmit the RFID tag onto the back-end patient information server. As WBAN is a short range wireless network, there are different types of wireless protocols such as Bluetooth, ZigBee, WiFi, and IEEE 802.15.6 for communication.
(3)
Patient information server. It is used to return the requested patient physiological data to the doctor and raise an alarming message to the family members and ambulance service when there is a need. As the communication among the end users and patient information server is in open environment, privacy in the RFID health system is the concern, which permits only authorized users to access the data available on the server. This paper is aimed at providing the privacy protection by adapting the HECC in RPS in the RFID health service network. As and when the patient is connected to the server through the mobile terminal, the patient’s privacy policy can be set up and stored in RPS. Initially, patient RFID tag authentication is inquired by checking the patient tag against the database present; the received patient physiological data update will take place only when there is successful tag verification. While updating the patient’s medical records, it is responsible to check the abnormalities in current readings by comparing them against the clinically approved and established ones. An alert message will be initiated to the doctor and the family members; based on the severity, an alert message may be sent to ambulance. Notice that in order to define the severity of alert message, we would take the corresponding inputs from the concerned medical experts and use them in RPS. Now, the doctor logs in to the patient’s account which is facilitated by an authentication, after successful verification of the doctors’ authentication. Mutual authentication is achieved via signature generation/verification between the intended parties in the communication. This is achieved by encryption and decryption operations by both the doctor and the server. In our signcryption approach, three phases were present including the following:
(i)
Setup: in this phase, system/global parameters is finalized, generating the public/private keys of both doctor and server
(ii)
Mutual authentication of the doctor and the server: this phase is aimed at the identification of authorized doctor by checking the mutual authentication between them. In this process, the doctor will generate the signature and send to the sever; after checking the signature validity, the server concludes the correctness of the doctor’s identity
(iii)
Encryption/decryptionFigure 1
RFID mobile healthcare system architecture.


### 3.1. Global Parameters and Key Generation (Setup)

The signature production/verification and encryption/decryption require global parameters, which are available publicly used in the rest of the phases. HECC is used in the proposed work because solving 80-bit HEC is difficult than 160-bit elliptic curve. This makes us to finalize HEC is more appropriate for the applications using RFID. Global parameters (param) chosen forℂ over Fp, having a unique reduced divisor D, a large random number p, and a large prime divisor n of p−1. D is represented in the Mumford form as <u,v>. After finalization of the param, the user (tag/reader) chooses a random number a<n which is treated as the private key (PRa) and calculates the public key (PUa) using private key as PUa=PRa∗D; Figure 1 shows the steps in this phase.


### 3.2. Public Parameters

The parameters publicly available to the doctor and server are as follows:(i)
Selectp, find n
(ii)
Select HEC over finite fieldFp be GFp and let the Jacobian of GFp be JCFp.
(iii)
Pick an elementD∈JCFp as a reduced divisor
(iv)
param=p,Fp,GFp,D,nAlgorithm 1: Algorithm to generate public and private keys.
Public and private key generation algorithm
Input: public parameters param
Output: public key (PUa) and private key (PRa)
1. Choosea∈1,n−1, assign toPRa
2. ComputePUa=a∗D


### 3.3. Signature Generation

This phase uses param, doctor ID as nonce (m) as the input generate the signature pair r,s. Afterwards, the signature pair is attached to an encrypted message and then transmitted onto the other side; Figure 2 shows the signature generation algorithm. A random number (k) is to be generated, used in r computation. The D-Quark Hash algorithm is used in a hash value on a given message. Although DSS states the importance of Secure Hash Algorithm (SHA-1), we have used D-Quark asSHA algorithm which is computationally intensive in hash value calculation compared to D-Quark; also, it consumes less power and storage. Figure 2 shows the comparative analysis of different Quark algorithms; it presents three families U, D, and S Quark algorithms; and the comparative analysis is carried based on parameters no of rounds, digest length, rate, and capacity.Figure 2
Comparison of Quark algorithms.Algorithm 2
Signature generation algorithm
Input:param,m
Output: signature pair(C, r, s)
1. Choosek∈1,n−1 and calculate r=k D
2. The functionθ:JFp→Fp∋θr=r′, i.e., map r to r′ using Mumford’s representation of the points of JFq, θ is defined by
θr=u1,u1,ifD=x2+u1x+u0,vx,u0,ifD=x+u0,vx,0,ifD=1,0
3. Calculater′=θrmodn, C=Em
4. Calculates=k−1Hm+PRar′modn
5. Send user public key and the signature pairC,r,s onto other side user B.D-Quark was designed to provide 160-bit preimage resistance and at least bit security against all other attacks and to admit a parallelization degree of 8. Takenr1=16; c1=160; b1 and n1=176.InitializeX with first b1/2 input bits, Y to last b1/2 input bits, and L to all 1s, i.e., X=s0,s1,−−−,sb1/2−1 where s is the internal state.
(4)Y==sb1/2,−−−,sb1−1,L=1,1,⋯..,1.
(i)
Functionf11: D-Quark f uses an 88-bit register X and returns X0+X11+X18+X27+X36+X42+X47+X58+X64+X67+X71X+X71X79+X42X47+X11X19+X58X67X71+X27X36X42+X11X36X58X79+X42X47X67X71+X19X27X71X79+X47X58X67X71X79+X11X19X27X36X42+X27X36X42X47X58X67
(ii)
Functiong11: it uses Y (88-bit) register and returns Y0+Y9+Y20+Y25+Y38+Y44+Y47+Y54+Y63+Y67+Y69+Y69Y78+Y44Y47+Y9Y19+Y54Y67Y69+Y25Y38Y44+Y9Y38Y54Y78+Y44Y47Y67Y69+Y19Y25Y69Y78+Y47Y54Y67Y69Y78+Y9Y19Y25Y38Y44+Y25Y38Y44Y47Y54Y67
(iii)
Functionh1: for a given registers X, Y, and L (10bit), returns L0+X1+Y2+X5+Y12+Y24+X35+X40+X48+Y55+Y61+X72+Y79+Y4X68+X57X68+X68Y79+Y4X35X57+Y4X57X68+Y4X57Y79+L0X35X57Y79+L0X35Algorithm 3
D-Quark algorithm
Input:r1, c1, b1, f11, g11, and h1, where r1: rate; c1: capacity; b1: width; n1: digest length; and f11, g1, and h1: functions
Output: message digest ofn1 length
1. Initialization: message is padding by a1 followed by 0 bits to make message length equal to multiples of r
2. Absorption: XORr bit length of message block with state
3. Squeezing: once all blocks of the message are processed by the absorbing phase, extractr bits from the bitrate part of the internal state and then forward to permutation phase
4. Permutation: the permutationP is applied onto it to generate a fixed n1 bit hash valueAlgorithm 4
Cantor algorithm (composition)
Input: HEC:y2+hx·y=fx, P=up,vp,Q=uq,vq
Output: semireduced divisorD=P+Q==ur,vr
1. Calculated1=GCDup,uq=e1u1+e2u2
2. Calculated=GCDd1,vp+vq+h=f1d1+f2vp+vq+h,
whered=s1up+s2uq+s3vp+vq+h; s1=f1e1, s2=f1e2;s3=f2
3. Calculateur=upuq/d2; vr=s1upvq+s2uqvp+s3vpvq+f/d mod ur


### 3.4. Signature Verification

After receiving the signature pair (m′, r′′, s′), the receiver will calculate the parameters R, w, u1, u2, and V; the user is valid when V is equal to r′′. The procedure followed in signature verification is shown below. In u1 value calculation, the receiver (server) has to decrypt the cipher text C′ received from the sender (doctor) to extract A’s identity; the hash value is computed on the received ID. The signature generation and verification can be done by both the doctor and the server to establish mutual authentication before the commencement of communication.Algorithm 5
Signature verification algorithm
Input: param,r′′, s′, C′
Output: signature valid or invalid
1. User B computesR=θr′′modn
2. Calculatew=s′−1modn
3.u1=HDC′modn and u2=Rmodn
4. CalculateV=w∗u1∗D+u2∗PUa
5. IfV==r′′, then signature is valid; otherwise, invalid


### 3.5. Encryption Algorithm

In signature generation process, individual doctor/server ID is encrypted and then transferred to the other end. The encryption process is shown below. Once the message willing to be communicated is finalized, then the sender (doctor/server) computes theY by multiplying the sender’s private key with the receiver’s public key that is added to the message in order to produce the cipher text. This algorithm is intended to secure either their ID or message intended to communicate to the other end.Algorithm 6
HEC RFID encryption algorithm
Input: param,PRa, m,PUb
Output:C
1: computeY=PRa.PUb
2: returnC=m+Y


### 3.6. Decryption Algorithm

After the receiver receives the cipher text, the doctor/server ID is extracted by subtractingX, which is the product of the receiver’s private key and the senders public key; the detailed decryption algorithm is given below.Algorithm 7
HEC RFID decryption algorithm
Input: param,PUa, PRb, C
Output:m
1: computeX=PRb∗PUa
2: returnm=C−X


## 3.1. Global Parameters and Key Generation (Setup)

The signature production/verification and encryption/decryption require global parameters, which are available publicly used in the rest of the phases. HECC is used in the proposed work because solving 80-bit HEC is difficult than 160-bit elliptic curve. This makes us to finalize HEC is more appropriate for the applications using RFID. Global parameters (param) chosen forℂ over Fp, having a unique reduced divisor D, a large random number p, and a large prime divisor n of p−1. D is represented in the Mumford form as <u,v>. After finalization of the param, the user (tag/reader) chooses a random number a<n which is treated as the private key (PRa) and calculates the public key (PUa) using private key as PUa=PRa∗D; Figure 1 shows the steps in this phase.


## 3.2. Public Parameters

The parameters publicly available to the doctor and server are as follows:(i)
Selectp, find n
(ii)
Select HEC over finite fieldFp be GFp and let the Jacobian of GFp be JCFp.
(iii)
Pick an elementD∈JCFp as a reduced divisor
(iv)
param=p,Fp,GFp,D,nAlgorithm 1: Algorithm to generate public and private keys.
Public and private key generation algorithm
Input: public parameters param
Output: public key (PUa) and private key (PRa)
1. Choosea∈1,n−1, assign toPRa
2. ComputePUa=a∗D


## 3.3. Signature Generation

This phase uses param, doctor ID as nonce (m) as the input generate the signature pair r,s. Afterwards, the signature pair is attached to an encrypted message and then transmitted onto the other side; Figure 2 shows the signature generation algorithm. A random number (k) is to be generated, used in r computation. The D-Quark Hash algorithm is used in a hash value on a given message. Although DSS states the importance of Secure Hash Algorithm (SHA-1), we have used D-Quark asSHA algorithm which is computationally intensive in hash value calculation compared to D-Quark; also, it consumes less power and storage. Figure 2 shows the comparative analysis of different Quark algorithms; it presents three families U, D, and S Quark algorithms; and the comparative analysis is carried based on parameters no of rounds, digest length, rate, and capacity.Figure 2
Comparison of Quark algorithms.Algorithm 2
Signature generation algorithm
Input:param,m
Output: signature pair(C, r, s)
1. Choosek∈1,n−1 and calculate r=k D
2. The functionθ:JFp→Fp∋θr=r′, i.e., map r to r′ using Mumford’s representation of the points of JFq, θ is defined by
θr=u1,u1,ifD=x2+u1x+u0,vx,u0,ifD=x+u0,vx,0,ifD=1,0
3. Calculater′=θrmodn, C=Em
4. Calculates=k−1Hm+PRar′modn
5. Send user public key and the signature pairC,r,s onto other side user B.D-Quark was designed to provide 160-bit preimage resistance and at least bit security against all other attacks and to admit a parallelization degree of 8. Takenr1=16; c1=160; b1 and n1=176.InitializeX with first b1/2 input bits, Y to last b1/2 input bits, and L to all 1s, i.e., X=s0,s1,−−−,sb1/2−1 where s is the internal state.
(4)Y==sb1/2,−−−,sb1−1,L=1,1,⋯..,1.
(i)
Functionf11: D-Quark f uses an 88-bit register X and returns X0+X11+X18+X27+X36+X42+X47+X58+X64+X67+X71X+X71X79+X42X47+X11X19+X58X67X71+X27X36X42+X11X36X58X79+X42X47X67X71+X19X27X71X79+X47X58X67X71X79+X11X19X27X36X42+X27X36X42X47X58X67
(ii)
Functiong11: it uses Y (88-bit) register and returns Y0+Y9+Y20+Y25+Y38+Y44+Y47+Y54+Y63+Y67+Y69+Y69Y78+Y44Y47+Y9Y19+Y54Y67Y69+Y25Y38Y44+Y9Y38Y54Y78+Y44Y47Y67Y69+Y19Y25Y69Y78+Y47Y54Y67Y69Y78+Y9Y19Y25Y38Y44+Y25Y38Y44Y47Y54Y67
(iii)
Functionh1: for a given registers X, Y, and L (10bit), returns L0+X1+Y2+X5+Y12+Y24+X35+X40+X48+Y55+Y61+X72+Y79+Y4X68+X57X68+X68Y79+Y4X35X57+Y4X57X68+Y4X57Y79+L0X35X57Y79+L0X35Algorithm 3
D-Quark algorithm
Input:r1, c1, b1, f11, g11, and h1, where r1: rate; c1: capacity; b1: width; n1: digest length; and f11, g1, and h1: functions
Output: message digest ofn1 length
1. Initialization: message is padding by a1 followed by 0 bits to make message length equal to multiples of r
2. Absorption: XORr bit length of message block with state
3. Squeezing: once all blocks of the message are processed by the absorbing phase, extractr bits from the bitrate part of the internal state and then forward to permutation phase
4. Permutation: the permutationP is applied onto it to generate a fixed n1 bit hash valueAlgorithm 4
Cantor algorithm (composition)
Input: HEC:y2+hx·y=fx, P=up,vp,Q=uq,vq
Output: semireduced divisorD=P+Q==ur,vr
1. Calculated1=GCDup,uq=e1u1+e2u2
2. Calculated=GCDd1,vp+vq+h=f1d1+f2vp+vq+h,
whered=s1up+s2uq+s3vp+vq+h; s1=f1e1, s2=f1e2;s3=f2
3. Calculateur=upuq/d2; vr=s1upvq+s2uqvp+s3vpvq+f/d mod ur


## 3.4. Signature Verification

After receiving the signature pair (m′, r′′, s′), the receiver will calculate the parameters R, w, u1, u2, and V; the user is valid when V is equal to r′′. The procedure followed in signature verification is shown below. In u1 value calculation, the receiver (server) has to decrypt the cipher text C′ received from the sender (doctor) to extract A’s identity; the hash value is computed on the received ID. The signature generation and verification can be done by both the doctor and the server to establish mutual authentication before the commencement of communication.Algorithm 5
Signature verification algorithm
Input: param,r′′, s′, C′
Output: signature valid or invalid
1. User B computesR=θr′′modn
2. Calculatew=s′−1modn
3.u1=HDC′modn and u2=Rmodn
4. CalculateV=w∗u1∗D+u2∗PUa
5. IfV==r′′, then signature is valid; otherwise, invalid


## 3.5. Encryption Algorithm

In signature generation process, individual doctor/server ID is encrypted and then transferred to the other end. The encryption process is shown below. Once the message willing to be communicated is finalized, then the sender (doctor/server) computes theY by multiplying the sender’s private key with the receiver’s public key that is added to the message in order to produce the cipher text. This algorithm is intended to secure either their ID or message intended to communicate to the other end.Algorithm 6
HEC RFID encryption algorithm
Input: param,PRa, m,PUb
Output:C
1: computeY=PRa.PUb
2: returnC=m+Y


## 3.6. Decryption Algorithm

After the receiver receives the cipher text, the doctor/server ID is extracted by subtractingX, which is the product of the receiver’s private key and the senders public key; the detailed decryption algorithm is given below.Algorithm 7
HEC RFID decryption algorithm
Input: param,PUa, PRb, C
Output:m
1: computeX=PRb∗PUa
2: returnm=C−X


## 4. Security Analysis

The proposed protocol can be able to provide the security services like confidentiality, unforgeability, authentication, forward secrecy, and availability.


### 4.1. Confidentiality

To facilitate confidentiality, information should be only intangible to unauthorized access to an eavesdropper or interceptor. If an adversary is interested in session keyk acquisition, he/she needs to estimate b from Y and k from X=aD and r=k which is corresponding to solving HCDLP.


### 4.2. Integrity

Integrity check insures no alteration in data in transmission and is the same as the one sent by the sender. Due to the property of the random oracle model, “it is not practicable that two different messages have identical digest/hash value.” In our scheme, the doctor/server verifies the signature based on hash of the patient message to check the integrity.


### 4.3. Authenticity

The property is aiming to confirm from where the message came and checks the ownership of user on the issued message called authenticity. In our proposed scheme, authenticity is based on signature generation and verification.


### 4.4. Unforgeability

It means it is infeasible for an intruder to construct valid signature without a secret key. The proposed technique is unforgeable as it is based on unforgeable hyper elliptic curve digital signature algorithm (HECDSA).


### 4.5. Nonrepudiation

Nonrepudiation restricts server from denying the signcrypted text it sent. Unforgeability insures nonrepudiation. If the server denies, the doctor sends signcrypted text to middleware; by using a verification technique, middleware can decide that the message is sent by the server.


### 4.6. Forward Secrecy

It infers that session key used in communication would not be compromised although a long-term private key revealed. In the proposed system, if an adversary obtainsda for computing session key, “k” needs “r.” Computing “𝑟” is equivalent to solving a computational hard problem Hyper Elliptic Curve Discrete Logarithm Problem (HECDLP).


## 4.1. Confidentiality

To facilitate confidentiality, information should be only intangible to unauthorized access to an eavesdropper or interceptor. If an adversary is interested in session keyk acquisition, he/she needs to estimate b from Y and k from X=aD and r=k which is corresponding to solving HCDLP.


## 4.2. Integrity

Integrity check insures no alteration in data in transmission and is the same as the one sent by the sender. Due to the property of the random oracle model, “it is not practicable that two different messages have identical digest/hash value.” In our scheme, the doctor/server verifies the signature based on hash of the patient message to check the integrity.


## 4.3. Authenticity

The property is aiming to confirm from where the message came and checks the ownership of user on the issued message called authenticity. In our proposed scheme, authenticity is based on signature generation and verification.


## 4.4. Unforgeability

It means it is infeasible for an intruder to construct valid signature without a secret key. The proposed technique is unforgeable as it is based on unforgeable hyper elliptic curve digital signature algorithm (HECDSA).


## 4.5. Nonrepudiation

Nonrepudiation restricts server from denying the signcrypted text it sent. Unforgeability insures nonrepudiation. If the server denies, the doctor sends signcrypted text to middleware; by using a verification technique, middleware can decide that the message is sent by the server.


## 4.6. Forward Secrecy

It infers that session key used in communication would not be compromised although a long-term private key revealed. In the proposed system, if an adversary obtainsda for computing session key, “k” needs “r.” Computing “𝑟” is equivalent to solving a computational hard problem Hyper Elliptic Curve Discrete Logarithm Problem (HECDLP).


## 5. Experimentation and Results

The proposed HECC algorithm on different genus values was developed using a SAGE software package designed for working out in algebraic geometry and combinatorics on intel® core™ i5-6500 CPU@3.20 GHz,4 GB RAM with a 64 bit windows 10 operating system. Table2 shows the hyper elliptic curves over GF (p).
(5)f11=132513617209345000075125059444256167021;f10=172713717209345335965125059444256197781;f9=34744234758245218589390329770734256149;f8=132513617203425000075125059447776167028;f7=17271371720934533596519967444256197781;f6=34744567758245218589390329770704207149;f5=13271367589345335075125059444256188021;f4=172713717276878635965125059444256197781;f3=132713617209345335075125059444256188021;f2=172713717209345335965125059444256188021;f1=909076559017000006083734360528442376758;f0=666798662217372833782356085717342356916.Table 2
HECs over the finite fieldGF (p).
Genus
f(x)
2
x5+f3x3+f2x2+f1x+f0
3
x7+f5x5+f4x4+f3x3+f2x2+f1x+f0
4
x9+f7x7+f6x6+f5x5+f4x4+f3x3+f2x2+f1x+f0
5
x11+f9x9+f8x8+f7x7+f6x6+f5x5+f4x4+f3x3+f2x2+f1x+f0
6
x13+f11x11+f10x10+f9x9+f8x8+f7x7+f6x6+f5x5+f4x4+f3x3+f2x2+f1x+f0After the discussion of the proposed algorithm, the basic operations recognized in this are point addition, doubling, and scalar multiplication; the time required for completing these operations with respect to various field lengths is shown in Table3. In the experimentation, firstly, the comparative analysis was done for different time estimations on different genus for operations of Jacobian, divisor recognition, key and signature generation, verification, and message encryption/decryption by varying field length p such as 210, 2128, 2256, and 2512. Further, the proposed protocol is compared with respect to HEC over a finite field by changing sizes.Table 3
Computation time of group operations.
Genus
Group order
Point addition
Point doubling
Scalar multiplication
1
2191
3.92
1.55
8.87
2
2190
815
877
3.54
2185
538
633
2.9 ms
2175
783
730
3.54
2161
752
671
3.38
2150
559
613
3.42
3
2189
579
518
2.35 ms
2184
563
508
3.67 ms
2174
738
672
3.11
2160
767
698
3.24Table4 described the hash code value computation on the given tag using D-Quack algorithm discussed in Section 3. The computation time for Jacobian, divisor, key, signature generation/verification, and encryption/decryption is shown in Figures 3–9, respectively. From the figures, it is observed that as accumulative of genus along with field sizes, the time is increasing. Since HEC with an operand size is only a fractional amount, the proposed protocol is suitable for devices which require less storage requirements. The RFID reader has good computational capacity since it is connected to the server directly. But RFID tag is having less computational capacity, so it has less computational amount of time. The proposed method is compared with existing methods shown in Table 5; we can observe that better performance is achieved through Moosavi et al. [9] and the proposed protocol than [1, 3, 4] and [33] protocols.Table 4
Generation of RFID tag hash code using D-Quark algorithm.
Tag number
0100000000000000853d0444657f0000010000000000
D-Quark parameters
c1=20, r1=2, b1=22, n1=22
Initialization
cc6c4ab7d11fa9bdf6eede03d87b68f91baa706c20e9
Permutation
d013143e679faec7a2b6eb458498fed5dc498145f380
Hashcode
82c7f380e231578e2ff4c2a402e18bf37aea8477298dFigure 3
Jacobian computation time.Figure 4
Divisor computation time.Figure 5
Key agreement time.Figure 6
Signature generation time.Figure 7
Signature verification time.Figure 8
Encryption time.Figure 9
Decryption time.Table 5
Comparison of existing mechanisms.
Parameter→
Ev
Im
Ra
Fs
Ma
Pe
Method↓
Batina et al. [1]
√
×
√
×
×
Lo
Zhang et al. [3]
√
√
√
√
×
Lo
Lee et al. [4]
√
√
√
√
√
Lo
Hu et al. [33]
√
√
√
√
√
Lo
Moosavi et al. [9]
√
√
√
√
√
Be
Proposed
√
√
√
√
√
Be
Ev: eavesdropping; Im: impersonation; Ra: replay attack; Fs: forward security; Ma: mutual authentication; Pe: performance; Lo: less; Be: better.


## 6. Conclusion

In this paper, we proposed an architecture, which is suitable for several hospitals or to elder people and is responsible to monitor the health condition continuously and store patient medical records in the back-end database through middleware. Further, we proposed a hyper elliptic curve-based secure lightweight IoT integrated RFID mobile health care system to ensure security and privacy to the health records which are shared between the server/doctor. Security services mutual authentication and confidentiality are attained. Experimentation shows that the proposed protocol has better efficiency than other existing methods.



---

*Source: 1468281-2020-03-03.xml*