Privacy-preserving self-helped medical diagnosis scheme based on secure two-party computation in wireless sensor networks.

With the continuing growth of wireless sensor networks in pervasive medical care, people pay more and more attention to privacy in medical monitoring, diagnosis, treatment, and patient care. On one hand, we expect the public health institutions to provide us with better service. On the other hand, we would not like to leak our personal health information to them. In order to balance this contradiction, in this paper we design a privacy-preserving self-helped medical diagnosis scheme based on secure two-party computation in wireless sensor networks so that patients can privately diagnose themselves by inputting a health card into a self-helped medical diagnosis ATM to obtain a diagnostic report just like drawing money from a bank ATM without revealing patients' health information and doctors' diagnostic skill. It makes secure self-helped disease diagnosis feasible and greatly benefits patients as well as relieving the heavy pressure of public health institutions.

1. Introduction

With the rapid development of science, more and more advanced technologies such as the internet of things and cloud computing are utilized in the area of modern medicine and this trend further pushes healthcare into the digital era [1-3]. Currently, numerous healthcare devices such as heart rate monitor, blood pressure monitor, and electrocardiogram are already popular in people's normal life. It makes it convenient for people to be aware of their health situation by viewing the reports of these devices. Especially, by the growing use of sensor technology in telecare, the new field known as wireless body area networks (WBAN) [1, 4] has designed various sensor devices that can be used to supervise critical body parameters and activities anytime and anywhere. People can easily and conveniently get the health data by these advanced sensor devices [5] such as temperature measurement, respiration monitor, heart rate monitor, pulse oximeter SpO2, blood pressure monitor, pH monitor, glucose sensor, cardiac arrhythmia monitor/recorder, brain liquid pressure sensor, and endoscope capsule. What is more, these devices are becoming more functional and portable. More and more mobile medical monitors have already been used to serve us [2].

Therefore, people no longer worry about how to obtain the health data but are concerned about how to securely deal with these sensitive data to have disease diagnosis with a medical institution. Traditionally, the issue of privacy of medical data has been dealt with primarily as a policy problem [6, 7]. Many related laws have been issued to protect the privacy of patients. However, it is still far away from satisfactory and people still fear the leakage of their private data. Hence, the most efficient solution to this problem is to protect patients' privacy in technology rather than in policy alone. In this aspect, most of previous literatures have introduced homomorphic encryption (HE) [8-10] to protect patients' privacy in some privacy-preserving medical applications [11]. However, HE will inevitably introduce tremendous cost and is not applicable to practical large-scale applications. Therefore, in this paper, we focus on building a secure and practical privacy-preserving medical diagnosis system that can serve us in our daily life. Starting from the aspiration of the patient, the most secure and plausible diagnostic method is to apply the processed data rather than the original data to interact with the hospital which owns a disease database to diagnose the health status privately. Moreover, it requires that after diagnosis, the hospital gets nothing about the patient's health data and the patient has no idea of the hospital's disease database.

Inspired by daily used bank automated teller machine (ATM), we introduce the privacy-preserving self-helped medical diagnosis ATM (MD-ATM) so that after obtaining a healthcare card that stores some information about the health data which is collected by various sensor medical devices, patients can privately diagnose himself by inserting the health card into the MD-ATM to obtain diagnostic report just like drawing money from a bank ATM without revealing patient's health information and the disease database or doctors' diagnostic skill. When needing local computing, storing, or inputting some information, the patient uses his own portable device, called portable medical diagnostic device (PMDD).

In this paper, we will show how to realize this modern diagnosis system without HE. The main idea and technology we used in this scheme are secure two-party computation (STC) and oblivious transfer (OT). Firstly, we assume that patients themselves collect related data by various wireless sensor medical devices and further process and store them in their own health cards using PMDD. When diagnosing, the patient firstly transforms the original data locally and then inserts the card into the MD-ATM of the hospital to check up his health. Operating following the instructions of the MD-ATM, the patient will finally obtain a diagnostic report through OT and the patient then completes the self-helped diagnosis. In brief, our main contributions can be summarized as follows.

Our Contributions.

We build a new “patient-centered” medical diagnosis model in wireless sensor networks where patients themselves collect health data by various sensor medical devices while the hospital provides a disease database to help patients to complete disease diagnosis by themselves. Compared with traditional “doctor-centered” medical diagnosis model where patients have to depend on the doctor, our system is more appropriate especially when people pay more and more attention to privacy in wireless sensor networks.

We firstly propose the privacy-preserving self-helped MD-ATM to construct a secure medical diagnosis scheme following the idea of STC. It makes secure self-helped medical diagnosis feasible and convenient just like drawing money from a bank ATM. It will greatly benefit patients as well as relieving the heavy pressure of public health institutions.

We construct the self-helped medical diagnosis system based on OT without expensive HE. It provides us with another perspective to consider the problem of secure medical diagnosis for patients.

The rest of this paper is organized as follows. In Section 2, we briefly give an overview of secure two-party computation and oblivious transfer, and then we present our medical diagnosis system model in Section 3. In Section 4, we propose our privacy-preserving self-helped medical diagnosis scheme in detail and give a strict proof based on real-ideal simulation paradigm in Section 5. Finally, we summarize our work of this paper in the last section.

2. Preliminaries

2.1. Secure Two-Party Computation

Secure multiparty computation (SMC) is dedicated to deal with the problem of secure computation among distrustful participants. It was first introduced by Yao in 1982 [12] and then was extended by Goldreich et al. [13] and many other researchers [14-19]. Generally speaking, SMC is a method to implement cooperative computation with participants' private data, ensuring the correctness of the computation as well as not disclosing additional information except the necessary results. It has become a research focus in the international cryptographic community due to its wide applications in various areas and a mass of research results have been published one after another. Secure two-party computation (STC) [20] is a special case in SMC where there are only two participants. The well-known millionaires' problem [12] put forward by Yao is the representative problem of STC. In our discussing, we will consider the two-party case.

Generally speaking, STC is dedicated to computing a certain function between two mutually distrusted participants on their private inputs without revealing their private information. Informally, assuming that there are 2 participants, P 1, P 2, each of them has a private number, x 1, x 2, respectively. They want to cooperate to compute the function y = f(x 1, x 2). A STC protocol is dubbed secure if no participant can learn more from the description of the public function and the result of the global calculation than what he can learn from his own information.

Formally, we usually analyze the security of a STC protocol using the real-ideal paradigm in the semihonest model where both of the two parties act semihonestly, following the protocol but making effort to gain more information about other parties' inputs, intermediate results, or overall outputs by the transcripts of the protocol [15]. We can overview the real-ideal paradigm as follows.

Firstly, in the ideal world, we assume that the computation of the functionality F on users private inputs is conducted by an additional trusted party, who receives x from user P , i = 1,2, and returns the result f(x 1, x 2) to P , i = 1,2. However, there is no trusted party in the real world and so the two parties have to run a protocol Π to get the desired result. During executing protocol Π, both parties act semihonestly. Herein, the view of the ith party during an execution of Π on x 1, x 2 is denoted as VIEW Π(x 1, x 2), which contains P 's input, random tape, and the messages received from the other party. For a deterministic private function f, we say that Π privately computes f if there exist probabilistic polynomial-time algorithms S 1, S 2, such that the simulated distribution {S (x ; f(x 1, x 2))} is indistinguishable to {VIEW Π(x 1, x 2)}, i = 1,2. That is,

2.2. Oblivious Transfer

In cryptography, OT is a type of protocol in which a sender transfers one of potentially many pieces of information to a receiver but remains oblivious as to which piece has been transferred. It was firstly introduced by Rabin [21] in 1981. Therein, the sender sends a message to the receiver with probability 1/2, while the sender remains oblivious as to whether or not the receiver received the message. Rabin's oblivious transfer scheme is based on the RSA cryptosystem. In 1985, Even et al. [22] proposed a more useful OT called 1-out-of-2 OT (OT1 2) to build protocols for secure multiparty computation.

Afterwards, it has been generalized to 1-out-of-m OT (OT1 ) [23] where the receiver gets exactly one message without the sender getting to know which message was queried and the receiver getting to know anything about the other messages that were not retrieved. OT1 has become a fundamental tool in cryptography and is usually used as a black-box when constructing protocols.

Formally, we can describe an OT1 protocol as follows. There are 2 participants called the sender S and the receiver R. Specifically, S has m messages, and R has an index z. R wishes to receive the zth message of the sender's m messages without leaking z to S, while knowing nothing about the rest m − 1 messages. A simplified OT1 protocol can be presented as in Algorithm 1.

Algorithm 1

3. System Model

In this section, we present the system model including the goals we aim to achieve in detail.

In this paper, we consider the privacy-preserving medical diagnosis system with two participants: the patient and the hospital. We assume that each patient can collect his own health data such as heart beat and blood pressure, in the form of a vector, called query vector, easily by various advanced medical devices. Herein, we call the heart beat, blood pressure, and so forth, as parameter items and the health data corresponding to heart beat, blood pressure, and so forth, as parameter values. For example, q = (q ,…, q ) is the query vector of the patient P, where all {q } are the necessary parameters the hospital needs for diagnosis, and q is the parameter value of the parameter item heart beat. Each patient has a health card to store related data and a portable device PMDD to read the data stored in the card and to do some related computations after inserting the card. The hospital has a disease database DB = {d }, which in fact is the standard to determine which disease the patient has got. Each record of the disease database is presented as a triple d = (i, t , r ), i = 1,…, m, where m is the capacity of the disease database; i is the index of a disease; t , called the trait vector of the disease d , is a vector that covers all necessary parameters the hospital needs for diagnosis; and r is the disease diagnostic report including the disease name, doctors' advices, and prescriptions corresponding to the ith disease d . Concerning these parameters, we have some illustrations as follows.

q : it includes all necessary parameter items the hospital needs for diagnosis such as heart beat and blood pressure. The query vectors of the same patient P are different if P goes to different hospitals since their medical levels are different. The query vectors of the same patient P may be also different if P goes to the same hospital at different time since the medical level of the hospital has been always keeping improving. The dimension n and every parameter item {q } of the query vector are determined by the trait vector t of the hospital. After registering to the hospital, patient can know what parameter items are needed in this diagnosis by reading the health card.

DB = {d }: it concludes all diseases a hospital can diagnose. Different hospitals have different disease databases and the same hospital has different disease databases at different time since its medical level has been keeping improving. The dimension m is determined by the hospital's medical level.

t : it includes all necessary parameter items the hospital needs for diagnosis such as heart beat and blood pressure. Different hospitals have different trait vectors and the trait vectors of the same hospital at different time may be different since the medical level of the hospital has been always keeping improving. The dimension n and every parameter item {t } of the trait vector are determined by the hospital's medical level. In order to improve the precision of our diagnosis system, the hospital can consider as many factors as possible such as adding more personal feelings, symptoms, and previous medical features from the patient as parameter items. Although we only can diagnose some simple diseases currently, it is believed that it will be feasible for more complicated diseases in the future by extending the dimension n of the parameter items.

r : it includes the disease name, doctors' advices, and prescriptions corresponding to the ith disease d . Each report may conclude many doctors' advices and prescriptions. Herein, we assume that every report obtained from the MD-ATM following the self-helped medical diagnosis is authorized by the hospital and all advices and prescriptions of a report are signed by corresponding doctors. After receiving the diagnostic report, patient can choose one doctor's advice and prescription to treat himself.

In this paper, the system makes medical diagnosis according to the Euclidean distances of two vectors. Specifically, taking the query vector of the patient and a trait vector of the database as an example, given a patient's query vector q = (q ,…, q ) and a disease trait vector t = (t ,…, t ), i ∈ {1,…, m}, their Euclidean distance [3] denoted by dist⁡ is

Herein, we compare the squares of the Euclidean distances,

It is obvious that we can figure out which one has smaller distance with patient's query vector just by checking the sign of (3) without exact result of dist⁡ or dist⁡. Assuming that the report r corresponding to the trait vector t , z ∈ {1,…, m}, is the diagnosed disease report, we have the following result, for all j = 1,…, m, j ≠ z:

In our scheme, we will compare the squares of the Euclidean distances of the query vector and the trait vectors to find the diagnostic report that satisfies (4).

In real application, the hospital provides a MD-ATM, which is connected with the disease database and can read the data of the card, to direct patients to complete self-helped disease diagnosis. Specifically, we assume that each patient registers to the hospital for the first time and gets a health card. The hospital provides a self-helped MD-ATM in public just like a bank ATM. Whenever P wants to have a diagnosis, inserting his health card into the MD-ATM and following the instructions, P can complete the self-helped diagnosis by himself. The basic model can be illustrated in Figure 1.

Figure 1

Self-helped medical diagnosis model of our scheme.

Apart from the above, to enable a privacy-preserving medical diagnosis system, our scheme should simultaneously fulfill the following two security goals.

Confidentiality of disease database should be protected during the self-helped diagnosis process.

Confidentiality of patient's private health data should be protected during the self-helped diagnosis process.

4. Our Scheme

In this section, we propose our privacy-preserving self-helped medical diagnosis scheme (PP-SH-MDS) in detail to show how a patient can diagnose by himself using his PMDD and the self-helped MD-ATM. The core of our construction can be summarized in Figure 2.

Figure 2

PP-SH-MDS.

Specifically, the patient P executes as follows to make a self-helped diagnosis using his PMDD and the MD-ATM.

In the setup phase, P registers to a hospital as traditional medical diagnosis and gets a health card.

In the diagnosis phase, there are three subphases.

(1) Local Preprocessing. Whenever P wants to have a diagnosis, he firstly conducts the following two transformations on PMDD locally.

Vector-to-Vector.

P firstly extends his original health data from an n-vector q = (q ,…, q ) to an (n + 2)-vector Q = (q ,…, q , q , q ), where q = −(1/2)∑ q 2 and q = 1.

Vector-to-Matrix.

P randomly chooses a password s = (s ,…, s ) and then generates a k × (n + 2) matrix

where ∑ s · b = 1, w = 1,…, n + 2.

By blinding Q using the matrix B , P further extends Q to a matrix

After completing the above steps, P stores the matrix M in the health card.

(2) Diagnosis.

After local preprocessing, P inserts his health card into the MD-ATM and then the MD-ATM reads the card to get the matrix M and randomly chooses two trait vectors t = (t ,…, t ) and t = (t ,…, t ) and, respectively, extends them to (n + 2)-vectors T = (t ,…, t , t , t ) and T = (t ,…, t , t , t ), where t = 1, t = −(1/2)∑ t 2 and t = 1, t = −(1/2)∑ t 2. Then the MD-ATM computes Δ′ = M · (T −T ), i, j = 1,…, m, i ≠ j, and writes (Δ′, i, j) in the card and indicates the patient to get back his card.

Following the instructions of the MD-ATM, the patient gets the card back and inserts it into PMDD. After inputting his password, PMDD begins to compute Δ = s · Δ′, i, j = 1,…, m, i ≠ j, and finds the index z so that for all j = 1,…, m, j ≠ z,   Δ > 0. z is the input of the following OT1 protocol.

(3) 1-out-of-m OT Protocol.

P inserts his card into the MD-ATM and invokes an OT1 protocol, where P's input is the index z and the MD-ATM's input is the diagnostic report set (r 1, r 2,…, r ) of the database.

After executing the OT1 protocol, P gets the diagnostic report r corresponding to the disease d according to the index z, while the MD-ATM gets Null, denoted by λ.

5. Analysis

In this section, we analyze our scheme in detail. We firstly have a look at the correctness and then give a strict security proof following the real-ideal simulation paradigm of STC in the scenarios of semihonest adversaries.

5.1. Correctness

In this aspect, we follow the steps of our scheme and make sure that the patient indeed finds out the most possible disease from the disease database of the hospital using his health data by comparing Euclidean distances.

Following the scheme, we can see that the patient transforms the health data in two steps. Firstly, he extends his original health data from an n-vector q = (q ,…, q ) to an (n + 2)-vector Q = (q ,…, q , q , q ), where q = −(1/2)∑ q 2 and q = 1 and then blinds and extends Q using the matrix B to a matrix On the other hand, the MD-ATM randomly selects two trait vectors t = (t ,…, t ) and t = (t ,…, t ) and, respectively, extends them to (n + 2)-vectors T = (t ,…, t , t , t ) and T = (t ,…, t , t , t ), where t = 1, t = −(1/2)∑ t 2 and t = 1, t = −(1/2)∑ t 2. After receiving M , for i, j = 1,…, m, i ≠ j, the MD-ATM computes

After receiving the returned message Δ′, for i, j = 1,…, m, i ≠ j, P uses PMDD to compute Thus, we have

Obviously, if for all j = 1,…, m, j ≠ z, Δ = (1/2)(dist⁡ 2 − dist⁡ 2) > 0, then t , z ∈ {1,…, m}, is the trait vector of the diagnosed disease. The report r corresponding to the trait vector t is the diagnosed report. Taking the index z as the input of the following OT1 protocol, the patient can finally get the disease report r from the set (r 1, r 2,…, r ) of the database.

Therefore, our scheme is correct.

5.2. Security

In this subsection, we strictly prove the security of our scheme. From the whole process, we can specify that the two parties in our system are the patient P and the hospital. They cooperate to compute the function f(q , (d 1, d 2,…, d )) = r , where r is the disease diagnostic report corresponding to the disease d and the distance dist⁡ satisfies the condition dist⁡ 2 = min⁡{dist⁡ 2}. As mentioned in Section 3, we should achieve two security goals, that is, keeping both parties' inputs private. We apply the real-ideal simulation paradigm to prove that our scheme has achieved the two goals in the scenarios of semihonest adversaries assuming the OT1 protocol we used is secure.

Theory 1. Our privacy-preserving self-helped medical diagnosis scheme is secure against semihonest adversaries if the OT1 protocol is secure.

Proof

Notice that the view of P , {VIEW(q , {d 1,…, d })}, in the real execution consists of three parts, the private input, random tape, and the messages received from the other party including the output. Therefore, we can get the views of P 1 and P 2, respectively, in the real execution as follows: where {VIEW1 OT(z, {r })} and {VIEW2 OT(z, {r })} are the views produced in the execution of OT1 protocol.

From the definition of security, we need to construct the probabilistic polynomial-time algorithm S 1/S 2 so that given the input and output of the patient P 1/the hospital P 2, (q ; r )/({d }; λ), it can output a simulated view {S 1(q ; r )}/{S 2({d }; λ)}, which is indistinguishable to the view {VIEW1(q , {d })}/{VIEW2(q , {d })} in the real execution of the scheme; that is,

In the following discussion, we follow the real-ideal simulation paradigm to construct such probabilistic polynomial-time algorithms S 1, S 2. We separately prove the case when P 2 is semihonest and when P 1 is semihonest.

Case 1 (P 2 is semihonest). In this case, we only need to construct a simulator S 2 so that, given P 2's input {d } and output λ, S 2 can simulate P 2's view in the real execution presented above as (12).

Firstly, since we assume that the OT1 protocol used in our scheme is secure and can be taken as a black-box, there exists an algorithm S 2 OT: given the input {r } and the output λ, it can simulate P 2's view of the OT1 execution and output {S 2 OT({r }; λ)} so that

Next, notice that S 2 is given ({d }; λ); it can easily simulate the remaining parts of (12) by randomly choosing a k × (n + 2) matrix M which is indistinguishable to the blinded matrix M . Then, S 2 outputs the simulated view,

Obviously, we can conclude that

Case 2 (P 1 is semihonest). Similar to Case 1, we only need to construct a simulator S 1 so that given P 1's input q and output r , S 1 can simulate P 1's view in the real execution presented above as (11).

As discussed above, since the OT1 protocol is secure, there exists an algorithm S 1 OT: given the input z and the output r , it can simulate P 1's view of the OT1 execution and output {S 1 OT(z; r )} so that

Next, given (q ; r ), S 1 then simulates the remaining parts of P 1's view in the real execution as follows.

Firstly, as in the real execution, S 1 extends the original health data from an n-vector q = (q ,…, q ) to an (n + 2)-vector Q = (q ,…, q , q , q ), where q = −(1/2)∑ q 2 and q = 1. Then, S 1 randomly chooses a password s ′ = (s ′,…, s ′) and then generates a k × (n + 2) matrix where ∑ s ′ · b ′ = 1, w = 1,…, n + 2. By blinding Q using the matrix B ′, S 1 further extends Q to a matrix

Then S 1 randomly selects m vectors, T ′ = (t ′,…, t ′, t ′, t ′), t ′ = 1, t ′ = −(1/2)∑ t ′2, j = 1,…, m, and for all j = 1,…, m, j ≠ z, ∑ (q − t ′)2 < ∑ (q − t ′)2; otherwise, S 1 reselects T ′, j = 1,…, m. Afterwards, S 1 computes Λ′ = M ′ · (T ′ − T ′), i, j = 1,…, m, i ≠ j. Thus, for i, j = 1,…, m, i ≠ j,   Λ = s ′ · Λ′ = ∑ q · (t ′ − t ′).

Therefore, we have

Since for all j = 1,…, m, j ≠ z, we have ∑ (q − t ′)2 < ∑ (q − t ′)2. Obviously, for all j = 1,…, m, j ≠ z, Λ = (1/2)(dist⁡ 2 − dist⁡ 2) > 0 and t , z ∈ {1,…, m}, is the trait vector of the diagnosed disease. The report r corresponding to the trait vector t is the diagnosed report, which matches the relationship in the real execution.

Now, S 1 can output the simulated view,

Since s ′ and B ′ are randomly chosen and ∑ s ′ · b ′ = 1, w = 1,…, n + 2, as s and B in the real view {VIEW1(q , {d })}. Due to the randomness and relationship, it is easy to find that (s ′, B ′) is indistinguishable to (s , B ). From the construction process of {Λ′}, it is obvious to conclude that {Λ′} is indistinguishable to the set {Δ′}. Combined with (17), we have

6. Conclusions

In this paper, we consider the problem of how to securely make diagnosis without leaking patient's health data, diagnosed result, and hospital's disease database in wireless sensor networks. By applying the idea of secure two-party computation and the technology of oblivious transfer, we propose a privacy-preserving self-helped medical diagnosis scheme so that patients can privately diagnose themselves by inserting a health card into a self-helped MD-ATM to obtain the diagnostic report just like drawing money from a bank ATM. We also have a detailed analysis about the correctness and further strictly prove the security following the real-idea simulation paradigm. We expect to provide people another perspective on future medical care.