Context-Aware Adaptive Authentication for the IoT in eHealth
MetadataVis full innførsel
The Internet of Things (IoT) presents a concept of smart world around us, where things are trying to assist and benefit people. Patient monitoring outside the hospital environment is one case for the IoT in healthcare. The healthcare system can get many benefits from the IoT such as patient monitoring with chronic disease, monitoring of elderly people, and monitoring of athletes fitness. The IoT in eHealth aims to assist the existing healthcare system by monitoring the vital signs of patient’s health data. The IoT in eHealth can be established though the integration of wireless body area network, communication infrastructure, and the healthcare enterprises. The dynamic and heterogeneous environment of the IoT may facilitate the patient with advanced mobility options. However, security-related problems may obstruct the development of such a comprehensive patient monitoring system. This interface allows them to have a virtual existence which transcends their real existence. The IoT may offer highly connected digital world where patients will be fenced by tiny smart things. In such an environment, the actions taken by things to comfort a patient may have ethical implications as well. While standards and technologies are continuously developed for the IoT, the ethical aspects of these developments must be addressed and it could be incorporated in the system development life cycle. We concluded that he claimed benefits of the IoT may not be realised, unless ethical implications of such claims on people, society, and environment are justified. Further, there is a strong need to formulate solutions to potential ethical issues in the IoT before it is irreversibly adapted by society. While the IoT is a dynamic network of interconnected things, concepts for adaptive security can be applied to this dynamic environment. However, the question is whether adaptive security mechanisms do meet the specific security requirements for the IoT based platform. We found that adaptive security mechanisms can be a better choice to secure dynamic and heterogeneous computing systems in the IoT. We concluded that the characteristics, capabilities, and requirements of the IoT create a dynamic resource constrain environment that need adaptive features for functionalities and security. The existing IoT models do not focus on structuring adaptive features in layers. Moreover, these reference models address the security at each layer independently and do not depend on the other layers that can be dealt with a cross layer design approach. While assessing the security of a patient monitoring system, it is necessary to realise that it may not be enough to only look into the security related aspects of the body area network. Instead, the overall patient monitoring system should be treated as a connected and integrated eHealth system. The important security issues that can put the eHealth system at risk are analysed, identifying specific security goals, requirements, and vulnerabilities for the IoT in eHealth. We highlight important assets, vulnerabilities, and threats that can harm assets and disrupt eHealth systems. We describe adaptive security and introduce a concept of adaptive security countermeasures for the smart IoT in eHealth. While making a security decision, the security mechanisms should incorporate security requirements, threats, and attacks based on the patient’s location and environmental context. While remote patient monitoring may improve healthcare, patient authentication is a challenge in this scenario. We propose a novel authentication framework based on biometric modalities and wireless device radio fingerprinting. The framework is capable of verifying that the monitored data belongs to the actual patient during the entire session, it also ensures the integrity and trust of the received data. We analyse our framework in view of some issues for the IoT in eHealth such as context and location awareness, resource constraints, and dynamic environment. The framework is resource and energy efficient requiring no extra processing for authentication purpose except the initial pre-processing of biometric and radio fingerprinting templates. While suffering from an extraordinary medical condition during the remote monitoring session, the patient’s location can be determined using smartphone radio fingerprints. Mechanisms that are not context-aware can be inadequate for the IoT due to its dynamic and heterogeneous environment. The context information can be used to reconfigure security mechanisms and adjust security parameters. The contextual information can be integrated into various security mechanisms such as authentication, access control, encryption, etc. The context-aware security is the dynamic adjustment of security policy based on the context. We present the context-awareness techniques for authentication and access control mechanisms. We discuss the concepts of context, contextawareness, and context based security and highlight contextual attributes that can be used to support and enhance authentication and access control mechanisms for the IoT. This thesis focus towards the context-aware adaptive authentication for the IoT in eHealth and provides several opportunities for further development on it as future work. The authentication framework for the IoT in eHealth that combines biometric modalities and smartphone radio fingerprinting is in its early stage of development, so we present several aspects that serve as a basis for further amplification.