Privacy Management for Medical Service Application using Mobile Phone collaborated with RFID Reader

Transcription

1 Privacy Management for Medical Service Application using Mobile Phone collaborated with RFID Reader Byunggil Lee and Howon Kim Electronics and Telecommunications Research Institute Abstract The RFID and sensor network based ubiquitous computing has great potential in medical and healthcare services. Most of medical accidents around patients are depended on misidentification of patient or medical articles. The accidents can be reduced, if information about the patient is managed automatically. In this aspect, the mobile device with RFID reader is useful device as a medical assistant. However, the security and privacy problem related RFID application has become a serious issue in real service environment. In this paper, we propose a customized policy based privacy management architecture for medical and healthcare application. The proposed mechanism is a useful solution for user centric privacy management in medical environment. 1. Introduction The RFID based ubiquitous technology has a great deal of prospect in recent years. The ubiquitous computing technology is seamlessly integrated into the human s medical environment and it provides useful and effective medical services to human lives [1]-[3]. However, unless these medical applications are properly designed in privacy aspect, they can cause social privacy problem. Today, people should be convinced that using RFID-tags will not jeopardize their privacy in medical application. Otherwise, they will not accept and use them. Privacy is different from security, in aspect of Right to control over personal information by himself. Previous privacy-protecting schemes for basic tags have focused on cryptograph approach and rewriting approach such as, killing tag approach, renaming approach, minimalist cryptography approach, re-encryption approach, proxying approach and blocking approach[5]-[8]. In hospital, most of medical accidents around patients are depended on misidentification of patient or medical articles. The accidents can be reduced, if information about the patient is managed automatically [2][3]. In the medical environment, fixed RFID reader is used for equipment management or emergency room s In-Out management. And mobile RFID reader, reader embedded mobile phone is developed in Korea; various application service is tested for service verification. In this paper, we propose a policy based RFID privacy management architecture for medical application. Many applications in the ubiquitous computing environment should be customized based on user s context. Moreover, it has different user policy between patient tag(human tag) for medical application and product tag(object tag) for EPCglobal s enterprise application[4]. In view of this ubiquitous sharing system of medical information, a serious problem for RFID service is a threat to privacy. Here, the RFID privacy issues in medical application involve the risk of exposing the personal medical information, such as trace of personal location, information of personal health and clinical history. In standard such as HL7, customizing and detailed privacy mechanism is not yet provided. Therefore, we will define the privacy architecture and system for medical service environment. For these privacy issues, we cannot solve all the problems with existing crypto-technology, such as encryption and decryption. Nowadays, there has been significant research on the security and privacy issues that RFID bring to the table[6][7]. A lot of work has been done at RSA Labs by Ari Juel and etc. But, it was security protocol between tag and network by using hash or encryption. There is no mention of the privacy management mechanism and system. In order to ensure personal privacy protection service, a mechanism that encrypts and decrypts the outgoing data from tag and server has been proposed. However, these mechanisms may create limitations in the applicability of the ubiquitous service. In addition, if decryption of tag code is successful, all information can be exposed [8]. For this reason, we propose a mechanism that manages user centric privacy policy in the ubiquitous medical service. It is more flexible and secure mechanism, if it is integrated with cryptographic Copyright SITIS

2 algorithm for mitigating the aforementioned problems. The remainder of this paper is organized as follows. Section 2 describes proposed privacy managed service architecture for medical application. In section 3, we present a proposed scenarios and system architecture of privacy management. In section 4, we delineate a hospital application of the RFID using a customizing privacy policy. Finally, conclusions and a discussion of potential areas for future research are presented in Section 5. shall be applied to the information collection process through the use of the RFID reader. RPS:RFID Privacy Mgmt. System 2. Design of privacy managed service architecture In hospital, we can also use the object-tag for asset management for location finding. Patient-tag system is effective solution to reduce the medical accidents. However, unless these patient-tag systems or tagged-medical card systems are properly designed and constructed in privacy aspect, they can cause massive collateral damage to related user privacy. A hospital s 1 st aid patient labeled with unprotected tags may be monitored by unauthorized readers in hospital and street or subway. In the mobile environment, security and privacy is more important than fixed business environment. So, we define 3 step based privacy aware service architecture for RFID based medical application service. 1. First step : Access control of patient information by default privacy policy 2. Second step : User controllable profile based Privacy protection 3. Third step : Auditable Privacy management In the meantime, we introduce new RFID based service model and the application in the mobile environment. The architecture of mobile phone collaborated with RFID Reader is shown in figure 1 and we called it as mobile RFID. In the application, the mobile phone with RFID reader is applicable to B2C service model against B2B enterprise fixed style RFID system. In mobile RFID model, mobile RFID phone requests information by capturing the tag attached to the patient and the mobile RFID reader transmits this information to the back-end information server via middleware. The information server subsequently returns the requested information to the reader and displays it to end user(doctor, nurse, family, others). The mechanism of personal privacy in mobile RFID services is to allow individuals to control their personal information related to RFID services. In other words, unauthorized distribution of personal information carried on the patient tag shall be prevented and a privacy protection mechanism Figure 1. The architecture of mobile RFID network based medical service This paper aims to provide privacy protection services by adopting a privacy protection system (RPS) in the mobile RFID service network. For privacy management, we propose a profile based privacy management architecture for medical application. A privacy bit in tag is simple and costeffective mechanism for privacy control. The privacy bit is only reference for privacy service. The medical RFID information server check the privacy guaranteed service or not from the privacy policy. To illustrate how the privacy policy works in information server, let us consider it use in application and contents information system of service provider, as shown in Figure 2. Figure 2. The architecture of information system for privacy ensure service The privacy protection level is stored in the RPS. The RFID code format for application is defined in the "Mobile RFID Application Data Format" as a Korea standard. The privacy protection level has TYPE, LENGTH, and VALUE in the TLV structure. The maximum privacy level depends on the application services and the privacy level is defined from 1 to 9. The default privacy level follows the

3 privacy-applied standard of each application service; and if there is no standard, the privacy level is determined based on the privacy impact assessment result. Definition 1. Privacy level consist of a 10-tuple of information, where T={T 1, T 2,,T 10 } by default privacy policy. It also protected by user secure tag area and privacy server. We also define the privacy weight for medical information, as shown in table 1. Table 1. Examples of a default privacy weight for RFID based medical information. Privacy related people Privacy Policy Privacy Info. Doctor in charge of the patient T 4 T 9 Medical History Treatment Info. Nurse in charge of the patient T 4 T 9 Medical History Treatment Info. General doctor in hospital T 3 T 7 Medical treatment General nurse in hospital T 3 T 7 Medical treatment Family T 2 T 6 Medical tracking Info. Emergency Agency T 2 T 5 Medical Tracking Info, 1 st aid Info. Others T 1 All cut off the default privacy policy of the corresponding service or the privacy protection policy set by the user. Figure 3. The scenario for registration to the RPS 3. Scenarios and system architecture for privacy managed medical service The RFID and wireless sensor network related privacy problem is depending on application service. The threat of privacy infringement from RFID medical application is twofold. First, the presence of a unique serial number in an RFID tag opens up the possibility of clandestine physical route tracking on tagged patient for example A hospital at 3:20 am. to B hospital at 5:00 pm.. A second threat arises from the presence of patient information in RFID tag. This information in principle permits clandestine scanning of patient. We focus here on challenge involved in protecting the RFID privacy of users of medical application. So, this is a counter measure of the research trying to support various problems that arise during the privacy processing of the medical information through user s privacy policy bases. Therefore there is a need for the privacy management system(we called it RPS ) to notify a privacy policy to application server. The scenario of this privacy service shows in Figure 3. and Figure 4. When patient connect the RPS by mobile terminal initially, the patient s privacy policy can be set up and store in RPS. The Figure 3 shows the procedure for registering to RPS. To use the privacy protection service, the user shall register to RPS and define his/her privacy protection policy. In the same way, the service providers that intend to provide privacy-secured services shall also register to RPS and comply with Figure 4. The scenario for privacy management service In the first service stage, the inquire procedure is provided by result of registration of each policy as shown in Figure 4. And, figure 5 shows the system architecture of privacy management system. Figure 5. The architecture of privacy management system of medical service

4 The RPS that protects personal privacy in RFID services sets policies to gain users trust and provides a mechanism for users to check privacy protection. The major function of privacy management system is listed. - Real-time notification - Profile and policy management - Registration and authentication - Obligation management - Audit Management In code classification, we setup tag code by mobile RFID code(mcode) structure standard for application in Korea. There are four code classifications and privacy information for medical application in tag code. Medical Service Domain : Domain ID for medical service Hospital ID : Hospital identification code Medical ID : Medical object identification in hospital Serial Number : Patient serial number Privacy Info. : Code for privacy information The ubiquitous medical system utilizes existing information systems that had been developed during the medical information process. And it has adopted RFID for diagnosing and operation effectively shown Figure 6. to patient as a agent in medical discovery gateway and Hospital IS(Information Server). Various kinds of applicable method for privacy are being researched to design effective systems within the ubiquitous environment. The research aimed to provide smooth mutual intercommunication among mobile networked RFID and existing RFID systems by adaptation module. We focused on easy privacy aware service adaptation by common profile based privacy policy and user controllable modification. The basic model of the research was; each privacy sensitive data is classified by the default privacy weight initially. And it is modified by the end user s detailed policy for privacy service in medical applications. And these services mutually interlocked in tag and RPS server platform. The user controllable privacy policy in this research is considered as a basis of RFID privacy management service. The compatibility and scalability in medical application may cause problems during migration. But the mechanism is suitable for user s policy based privacy service within the ubiquitous environment. By applying suggested privacy management mechanism to actual medical ER(emergency room) system, networked medical Kiosk, RFID networked Emergency rescue system and medical examination service as shown in Figure 7. Tag Reader Figure 6. Using of RFID based medication information system 4. System Evaluation of Privacy Controlled Medical Service In this chapter, we show some practical result of privacy aware medical service in hospital. The hospital generates initial PCD(Privacy Controlled Data), which contains the patient code, medical ID and related information. And the default privacy level is used for patient cannot control by himself. In order to provide authentication and privacy interface Figure 7. Medical Application of the proposed prototype System There is some approach applying the RFID to medicine and hospital. From above, proposed privacy scheme has advantages in custom centric approach aspect for constructing a privacy aware ubiquitous medical system. 5. Conclusion In this paper, we considered an RFID based ubiquitous medical application with privacy aware service. The proposed hospital application was

5 presented in terms of privacy policy whereas we introduced a privacy protection scheme using owner configured privacy preference policy. In the proposed hospital mechanism, the owner configures the level of the personal clinical information that will be accessible to the public and the access control. By doing so, customized privacy protection can be realized. In this regard, the suggested mechanism is an effective solution for privacy protection in a ubiquitous system. 6. Acknowledgements This work was supported by the IT R&D program of MIC/IITA. [2005-S088-03, Development of Security technology for Secure RFID/USN Service]. References [1] Siio, I., Hayasaka, T., Putting information to things : RFID tags and their application, IPSJ Magazine, Vol. 40, No.8, pp , Aug [2] Shang-Wei Wang, et al., RFID Application in Hospitals: A Case Study on a Demonstration RFID Project in a Taiwan Hospital, HICSS2006, Vol. 8, Jan [4] EPCglobal. The EPCglobal Network:Overview of Design, Benefits and Security, Sep [5] A. Juels and S.A Weis, Authenticating Pervasive Devices with Human Protocols. In Proc. Of CRYPTO 05, LNCS 3621, pp , Springer- Verlag [6] G. Avoine and Ph. Oechslin, A scalable and provable secure hash based RFID protocol, International Workshop on Pervasive Computing and Comunications Security, PerSec 2005, pp IEEE, [7] Sanjay E. Sarma, et al., RFID Systems and Security and Privacy Implications, CHES 2002, Lecture Notes in Computer Science 2523, pp [8] Inseop Kim, Byunggil Lee, Howon Kim, Privacy- Friendly Mobile RFID Reader Protocol Design on trusted Agent and PKI, Proceedings of the IEEE Tenth ISCE 06, Vol 1, June, [3] Yu, W.D., Ramni, A., Design and implementation of a personal mobile medical assistant, HEALTHCOM2005, 23-25, June