Enhancing security in Wireless Body Area Networks (WBANs) with ECC-based Diffie-Hellman Key Exchange algorithm (ECDH)

Abstract

BACKGROUND:

Wireless Body Area Networks (WBANs) are integral to modern healthcare systems, providing continuous health monitoring and real-time data transmission. The sensitivity of medical data being transmitted makes security a significant concern in WBANs.

OBJECTIVE:

This study explores the application of the Elliptic Curve Cryptography (ECC)-based Diffie-Hellman Key Exchange (ECDH) algorithm to enhance security within WBANs.

METHOD:

The study investigates the suitability of ECC for this context and evaluates the performance and security implications of implementing ECDH in WBANs.

RESULTS:

The findings reveal that ECDH provides a robust and computationally efficient solution for secure key exchange in WBANs, addressing inherent vulnerabilities.

CONCLUSION:

The adoption of ECC-based ECDH is poised to bolster data confidentiality and integrity in WBANs, promoting trust and widespread use of these networks in healthcare applications. This research contributes to the growing body of knowledge regarding security measures in WBANs and opens new avenues for the secure transmission of sensitive medical information.

1. Introduction

Wireless Body Area Networks (WBANs) have emerged as a critical technology in the healthcare sector, facilitating continuous and non-intrusive monitoring of patients’ vital signs and other health-related data. In order to ensure the secure transmission of confidential medical information through Wireless Body Area Networks (WBANs), issues like unauthorized access, misuse of information, and breaches of privacy must be addressed. Robust security measures, including encryption, authentication, and authorization protocols, must be implemented to mitigate these risks. Methods like digital signatures and checksums play a crucial role in ensuring data integrity, while prioritizing physical and device security is essential. Preserving privacy involves anonymization and compliance with data protection regulations. To maintain a secure environment, regular updates, thorough risk assessments, and adherence to industry best practices are necessary. A comprehensive approach is crucial for safeguarding sensitive medical information transmitted via WBANs. The seamless and timely transfer of medical data within WBANs is essential for real-time health monitoring and medical decision-making. However, ensuring the security and confidentiality of this sensitive medical data remains a significant challenge [1, 2]. Data security is a difficult task in Wireless Body Area Networks (WBANs), particularly in health monitoring applications. Strong encryption algorithms like AES are employed, along with Key Derivation Functions (KDFs) and the Elliptic Curve Diffie-Hellman (ECDH) key exchange protocol. Data integrity and authentication are ensured by methods such as ECDSA and HMAC. The Transport Layer Security (TLS) protocol improves communication security, while secure hash functions produce separate identifiers. Biometric authentication improves access control, while physical layer security measures address potential threats. Intrusion Detection and Prevention Systems monitor network behavior, while privacy-preserving techniques such as data masking and anonymization protect individual privacy. Secure code signing ensures the integrity of firmware and software updates. In this context, the utilization of advanced cryptographic techniques becomes paramount.

• 1)Background and Context: In recent years, the use of Elliptic Curve Cryptography (ECC) in securing communication channels has gained substantial attention. ECC is well-regarded for its robust security and efficiency, making it an attractive choice for resource-constrained devices, which are often the case in WBANs. One of the fundamental cryptographic protocols that can be strengthened using ECC is the Diffie-Hellman key exchange (DHE). DHE allows two parties to establish a shared secret key over an insecure communication channel. By introducing ECC into the DHE process, WBANs can enhance their security mechanisms and safeguard sensitive medical data.
• 2)Research Objectives and Problem Statement: The primary objective of this research is to investigate and analyze the application of ECC-based Diffie-Hellman key exchange in the context of WBANs. Diffie-Hellman key exchange (ECDH) based on Elliptic Curve Cryptography (ECC) is a more efficient and secure solution for mutual authentication in Wireless Body Area Networks (WBANs). It reduces computational requirements, improves bandwidth efficiency, reduces power consumption, accelerates key establishment, and improves security with shorter key lengths. ECC also provides scalability for large-scale network deployment, resistance to potential quantum attacks, and compatibility with limited computational resources. Specifically, we aim to assess the security, efficiency, and suitability of this approach for securing the communication within WBANs. Our research seeks to address the following key questions:
  • –
    How does ECC-based Diffie-Hellman key exchange enhance the security of data transmission in WBANs?
  • –
    What is the impact of implementing ECC-based DHE on the performance and resource utilization of WBAN devices?
  • –
    How can ECC-based DHE be integrated into existing WBAN architectures, and what are the practical challenges associated with this integration?
• 3)Overview of the Paper’s Structure: This paper is organized as follows:
  • –
    Section 2 provides a comprehensive review of the related literature, highlighting the current state of security in WBANs and the role of ECC-based cryptography.
  • –
    Section 3 details the methodology and the proposed ECC-based DHE protocol for WBANs.
  • –
    Section 4 presents the results of our empirical analysis and a discussion of the findings.
  • –
    Section 5 addresses the practical implementation and integration challenges.
  • –
    Section 6 offers insights into the broader implications of our research for healthcare applications and future work in this domain.
  • –
    Finally, Section 7 summarizes the key findings, conclusions, and recommendations.

  This paper aims to contribute to the enhancement of data security within WBANs by exploring the potential benefits and challenges associated with ECC-based Diffie-Hellman key exchange. In doing so, it seeks to provide valuable insights for researchers, practitioners, and stakeholders in the field of healthcare and wireless sensor networks.

2. Literature review

Wireless body area networks (WBANs) are a type of wireless sensor network that is worn on or inside the human body. WBANs are used for a variety of applications, including healthcare monitoring, fitness tracking, and entertainment [3]. One of the main challenges in designing WBANs is security and privacy. The sensitive data collected by WBANs must be protected from unauthorized access and modification. Elliptic curve cryptography (ECC) is a public-key cryptography algorithm that is well-suited for use in WBANs due to its small key sizes and high performance [4]. ECC is a public-key cryptography algorithm that is based on the mathematics of elliptic curves. The number of points on an elliptic curve in Elliptic Curve Cryptography (ECC) affects both security and efficiency. More points enhance security against attacks but can result in larger key sizes and slower computations. Balancing these factors is crucial for practical ECC implementation, considering performance, standardization, and resistance to quantum attacks. The choice of elliptic curve parameters is pivotal in achieving a secure and efficient ECC system tailored to specific use cases and resource constraints. Elliptic curves are algebraic curves that have a special point structure [5]. ECC uses this point structure to perform cryptographic operations such as encryption, decryption, and signing.

ECC has several advantages over other public-key cryptography algorithms, such as RSA and DSA. ECC keys are much smaller than RSA and DSA keys, which makes them more efficient to store and transmit. ECC also has a faster performance than RSA and DSA.

WBANs are vulnerable to a variety of security and privacy attacks. Some of the most common attacks include:

• •Eavesdropping: An attacker can listen to the wireless communication between WBAN nodes in order to intercept sensitive data.
• •Man-in-the-middle attacks: An attacker can intercept communication between WBAN nodes and impersonate one of the nodes in order to steal data or inject malicious data.
• •Replay attacks: An attacker can record and replay legitimate WBAN traffic in order to gain unauthorized access or disrupt communication.

ECC can be used to address the security and privacy challenges in WBANs. ECC can be used to encrypt data transmitted between WBAN nodes, authenticate nodes, and sign messages.

ECC is particularly well-suited for use in WBANs due to its small key sizes and high performance. The small key sizes make ECC keys more efficient to store and transmit on WBAN nodes, which are typically resource-constrained devices. The high performance of ECC makes it possible to perform cryptographic operations quickly on WBAN nodes, which is important for real-time applications.

There has been a significant amount of research on the use of ECC in WBANs. Some of the related work includes:

A secure and efficient communication scheme for WBANs using ECC. The proposed scheme uses ECC to encrypt data transmitted between WBAN nodes and to authenticate nodes [6]. To enhance message integrity in WBANs using ECC. The proposed method uses ECC to digitally sign messages transmitted between WBAN nodes [7]. A data communication protocol for WBANs using ECC. The proposed protocol uses ECC to encrypt data transmitted between WBAN nodes and to authenticate nodes [8]. A new lightweight ECC algorithm for WBANs. The proposed algorithm is based on a new elliptic curve that has a lower computational complexity than other elliptic curves used in WBANs. The proposed algorithm is also more resistant to side-channel attacks [9]. A new ECC-based mutual authentication and key agreement protocol for WBANs. The proposed protocol is secure against a variety of attacks, such as man-in-the-middle attacks, replay attacks, and impersonation attacks. The proposed protocol is also efficient and can be implemented on resource-constrained WBAN nodes [10]. A new ECC-based lightweight and secure data aggregation scheme for WBANs. The proposed scheme uses ECC to encrypt data packets and to authenticate data aggregators. The proposed scheme is also lightweight and efficient, making it suitable for use on resource-constrained WBAN nodes [11]. ECC-based secure and efficient data transmission scheme for WBANs. The proposed scheme uses ECC to encrypt data packets and to authenticate data senders and receivers. The proposed scheme is also lightweight and efficient, making it suitable for use on resource-constrained WBAN nodes [12]. New ECC-based secure and efficient authentication and key agreement protocol for WBANs. The proposed protocol is secure against a variety of attacks, such as man-in-the-middle attacks, replay attacks, and impersonation attacks. The proposed protocol is also efficient and can be implemented on resource-constrained WBAN nodes [13, 14].

In security protocols such as wireless body area networks (WBANs), lightweight personal computers (LPCs), and distributed systems (DSs), mutual authentication is critical. It is important for protecting sensitive personal data, allowing several computers, and ensuring the security of medical data transmission. The process of verification, which utilizes techniques like digital certificates, passwords, and biometrics, is essential to maintaining the security of these systems. Unauthorized data access can result in health risks, financial losses, identity theft, and system malfunctions. The implementation of mutual authentication varies depending on the specific system requirements, but the verification process remains a critical component in ensuring overall system security.

ECC-based cryptosystems can significantly improve the security and privacy of WBANs. ECC-based cryptosystems can be used to encrypt data transmitted between WBAN nodes, authenticate nodes, and sign messages. This can help to protect WBANs from a variety of security and privacy attacks, such as eavesdropping, man-in-the-middle attacks, replay attacks, and data tampering [15, 16, 17]. Elliptic Curve Cryptography (ECC) is a better option for protecting Wireless Body Area Networks (WBANs) due to its efficiency and security features. ECC provides comparable security with shorter key lengths, lowering computational complexity and bandwidth requirements. Its resistance to various attacks, including quantum threats, improves security against eavesdropping and man-in-the-middle attacks. Furthermore, the lower energy consumption of ECC is compatible with the limited resources of WBAN devices, making it a practical and future-proof cryptographic solution for these networks. Despite the many advantages of ECC-based cryptosystems for WBANs, there are still some challenges that need to be addressed before they can be widely deployed. One of the main challenges is developing more efficient ECC implementations for WBAN nodes. WBAN nodes are typically resource-constrained devices, so ECC implementations need to be lightweight and efficient in order to be practical.

Another challenge is developing secure and efficient ECC-based authentication and key management protocols for WBANs. Authentication and key management protocols are essential for ensuring the security of WBANs, but they need to be designed carefully to avoid introducing new vulnerabilities.

3. ECC-based Diffie-Hellman key exchange algorithm (ECDH)

Using ECC-based Diffie-Hellman key exchange algorithm (ECDH) for mutual authentication in a Wireless Body Area Network (WBAN) can enhance security and efficiency compared to traditional Diffie-Hellman key exchange. ECDH offers the same key exchange functionality as traditional DiffieHellman but with the added benefits of shorter key lengths and faster computations, making it more suitable for resource-constrained devices like those in WBANs. In healthcare settings, using ECC-based Diffie-Hellman for mutual authentication and key exchange in Wireless Body Area Networks (WBANs) improves network efficiency and patient data security. This method ensures mutual verification of the wearable device and healthcare system, efficiently establishes secure keys with low computational overhead, and uses shorter key lengths for symmetric encryption. The technology ensures data confidentiality, integrity, and resistance to quantum attacks, which helps improve patient privacy and compliance with healthcare regulations.

Table 1.

Notations used in the work

Notation	Description
$E_p(A,B)$	The elliptic curve over the finite field with prime modulus $p$, defined by the equation $y^2\equiv x^3+Ax+B$.
$n$	The total number of points on the elliptic curve $E_p(A,B)$.
$p$	A large prime number, used as the modulus for the finite field in the elliptic curve.
$G$	The base point on the elliptic curve, used in cryptographic operations.
$P$	A random point on the elliptic curve, used in each request or cryptographic operation.
$a,b,c$	Random prime numbers that should be less than the prime $p$, used in the elliptic curve’s equation.
${\text{𝑊𝐵}}_{\text{private}}$	Random prime number, private key for the Wireless Body Area Network (WBAN) component.
${\text{𝐿𝑃𝐶}}_{\text{private}}$	Random prime number, private key for the Local Processing Center (LPC) component.
${\text{DS}}_{\text{private}}$	Random prime number, private key for the Data Server (DS) component.

3.1. Key generation

The mutual authentication process involving WBAN, LPC, and DS using Elliptic Curve Cryptography (ECC) is described in this section.

Figure 1.

ECC mutual authentication protocol.

1) WBAN key generation

WBAN generates its private key, represented as $N_{\text{private}}$, which is a random prime number chosen from the set of integers modulo $n(R_n)$, where $n$ is the total number of points on the elliptic curve $E_p(A,B)$. WBAN also generates a random number $a$, another element in $R_n$. $N_{\text{private}}^{\prime }$ is computed as $N_{\text{private}}^{a}modn$, resulting in a new value for $N_{\text{private}}^{\prime }$, which is also a random prime number. ${\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$ is then obtained by multiplying $N_{\text{private}}^{\prime }$ with the sum of the base point $G$ and the random point $P$ on the elliptic curve: ${\text{𝑊𝐵𝐴𝑁}}_{\text{public}}=N_{\text{private}}^{\prime }\cdot (G+P)$.

2) WBAN sends request to LPC

WBAN sends a request (Rq) to LPC, which contains ${\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$ and the random point $P$. This request initiates the mutual authentication process.

3) LPC key generation

LPC generates its private key, represented as ${\text{𝐿𝑃𝐶}}_{\text{private}}$, which is another random prime number selected from $R_n$. A Local Processing Center (LPC) is a gateway that manages and views BAN applications [18, 19]. A Wireless Body Area Network (WBAN) uses wireless communication to connect nodes such as sensors and actuators on, under, or in a person’s skin [20]. Implanted sensors collect physiological data, which is then transmitted to application providers for further analysis. Additionally, LPC generates a random number $b$, another element in $R_n$. ${\text{𝐿𝑃𝐶}}_{\text{private}}^{\prime }$ is computed as ${\text{𝐿𝑃𝐶}}_{\text{private}}^{b}modn$, resulting in a new random prime number value for ${\text{𝐿𝑃𝐶}}_{\text{private}}^{\prime }$. ${\text{𝑃𝐷𝐴}}_{\text{public}}$ is obtained by multiplying ${\text{𝐿𝑃𝐶}}_{\text{private}}^{\prime }$ with the sum of the base point $G$ and the random point $P$: ${\text{𝑃𝐷𝐴}}_{\text{public}}={\text{𝐿𝑃𝐶}}_{\text{private}}^{\prime }\cdot (G+P)$.

4) LPC sends information to DS

LPC forwards WBAN’s request (Rq) to DS, along with ${\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$ and the random point $P$. LPC also shares ${\text{𝑃𝐷𝐴}}_{\text{public}}$ with DS.

5) WBAN calculates $K_1$

WBAN calculates $K_1$ as the result of multiplying its private key exponentiated to the power of $a$ ($N_{\text{private}}^{\prime }$) with ${\text{𝑃𝐷𝐴}}_{\text{public}}$: $K_1=N_{\text{private}}^{\prime }\cdot {\text{𝑃𝐷𝐴}}_{\text{public}}$.

6) LPC calculates $K_2$

LPC calculates $K_2$ as the result of multiplying its private key exponentiated to the power of $b$ (${\text{𝑃𝐷𝐴}}_{\text{private}}^{\prime }$) with ${\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$: $K_2={\text{𝑃𝐷𝐴}}_{\text{private}}^{\prime }\cdot {\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$.

7) Verification of identity

After calculating $K_1$ and $K_2$, WBAN and LPC can verify each other’s identities by checking whether $K_1$ is equal to $K_2$. If $K_1$ is equal to $K_2$, it means that the calculated shared keys match, and the identity of LPC is verified. Similarly, LPC verifies WBAN’s identity by checking whether $K_1$ is equal to $K_2$. If $K_1$ is equal to $K_2$, it means that the calculated shared keys match, and the identity of WBAN is verified.

If the condition $K_1=K_2$ holds true for both WBAN and LPC, it means that they have successfully authenticated each other, and mutual authentication is achieved. The verification process ensures that both parties possess the correct private keys and have correctly computed the shared keys using their own private keys and the other party’s public key, demonstrating the authenticity and validity of the entities involved [21]. The verification process in secure communication is critical in addressing multiple challenges, particularly in scenarios such as Wireless Body Area Networks (WBANs). It prevents unauthorized access, maintains data integrity during transmission, protects sensitive information, and authenticates devices to thwart malicious entities. Issues related to location privacy, the energy efficiency limitations of WBAN devices, possible network congestion, and the dynamic characteristics of network topology are also considered. For a secure and reliable WBAN communication environment, robust verification measures are required to counter various attacks, ensure compliance with regulatory standards, and implement efficient cryptographic algorithms. Elliptic Curve Cryptography (ECC) is the process of generating public and private keys for secure communication. This entails selecting an elliptic curve, determining the order of the base point, selecting a private key, and calculating the public key by multiplying the base point by the private key. While the public key can be freely shared, the private key must be kept secret. The challenge posed by the elliptic curve discrete logarithm problem supports ECC’s security. Its efficiency and robust security make it a widely used cryptographic approach.

8) DS key generation

DS generates its private key, represented as $D{S}_{\text{private}}$, which is another random prime number chosen from $R_n$. DS selects a random number $c$ from $R_n$. $D{S}_{\text{private}}^{\prime }$ is computed as $D{S}_{\text{private}}^{c}modn$, resulting in a new random prime number value for $D{S}_{\text{private}}^{\prime }$. $D{S}_{\text{public}}$ is obtained by multiplying $D{S}_{\text{private}}^{\prime }$ with the sum of the base point $G$ and the random point $P$: $D{S}_{\text{public}}=D{S}_{\text{private}}^{\prime }\cdot (G+P)$.

9) DS sends public key to LPC and WBAN

DS shares its public key $D{S}_{\text{public}}$ with LPC and WBAN through LPC.

10) WBAN calculates $K_4$ and verifies identity

WBAN calculates $K_4$ as the result of multiplying ${\text{𝑊𝐵𝐴𝑁}}_{\text{private}}^{\prime }$ with $D{S}_{\text{public}}$: $K_4={\text{𝑊𝐵𝐴𝑁}}_{\text{private}}^{\prime }\cdot D{S}_{\text{public}}$. WBAN sends $K_4$ back to DS through LPC. WBAN verifies its identity by checking if $K_4$ is equal to $K_5$, which will be calculated by DS later.

11) LPC calculates $K_3$ and sends to DS

LPC calculates $K_3$ as the result of multiplying ${\text{𝑃𝐷𝐴}}_{\text{private}}^{\prime }$ with $D{S}_{\text{public}}$: $K_3={\text{𝑃𝐷𝐴}}_{\text{private}}^{\prime }\cdot D{S}_{\text{public}}$. LPC sends $K_3$ back to DS.

12) DS calculates $K_5$ and $K_6$

DS calculates $K_5$ as the result of multiplying $D{S}_{\text{private}}^{\prime }$ with ${\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$: $K_5=D{S}_{\text{private}}^{\prime }\cdot {\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$. DS calculates $K_6$ as the result of multiplying $D{S}_{\text{private}}^{\prime }$ with ${\text{𝑃𝐷𝐴}}_{\text{public}}$: $K_6=D{S}_{\text{private}}^{\prime }\cdot {\text{𝑃𝐷𝐴}}_{\text{public}}$.

13) DS sends $K_5$ and $K_6$

DS sends $K_5$ to WBAN through LPC and $K_6$ to LPC.

14) DS verifies identity

After receiving $K_4$ (which was sent by WBAN through LPC) and $K_3$ (which was sent by LPC), DS verifies its own identity by checking two conditions: $K_4=K_5$: DS compares the value of $K_4$ with the independently calculated value of $K_5$. If they are equal, it means that the computed shared key using WBAN’s public key and DS’s private key ($K_4$) matches the computed shared key using DS’s private key and WBAN’s public key ($K_5$). This verification step ensures that WBAN’s identity has been correctly authenticated by DS. $K_3=K_6$: DS compares the value of $K_3$ with the independently calculated value of $K_6$. If they are equal, it means that the computed shared key using PDA’s public key and DS’s private key ($K_3$) matches the computed shared key using DS’s private key and PDA’s public key ($K_6$). This verification step ensures that LPC’s identity has been correctly authenticated by DS. If both conditions hold true, DS has successfully verified the identities of WBAN and LPC. This mutual authentication process ensures that all three entities (WBAN, LPC, and DS) have securely established communication and trust in each other’s identity using the principles of Elliptic Curve Cryptography (ECC).

4. Encryption and decryption

To securely encode, encrypt, and decrypt a plain text message “MD” using elliptic curve cryptography (ECC), the following steps can be followed:

1. Encode the plain text message “MD” as a point on the elliptic curve using a specific encoding scheme like Elliptic Curve Integrated Encryption Scheme (ECIES).

2. Generate the shared secret key “k” using ECC.

3. Encrypt the encoded message “MD” using the shared secret key “k” using the ECIES encryption scheme:

$C=\{{\mathit{\text{PDA\_private}}}^{\prime }G,(MD+{\mathit{\text{PDA\_private}}}^{\prime }\mathit{\text{DS\_public}})\}$ (1)

$(C_i=(C_{i1},C_{i2}))$ (2)

4. To decrypt the ciphertext and retrieve the original message “MD,” use the receiver’s private key “DS_private’.”

$MD=C_{i2}-({\mathit{\text{DS\_private}}}^{\prime }\cdot C_{i1})$ (3)

ECC-based cryptosystems can be used to securely transmit data between WBAN nodes, authenticate nodes, and sign messages. This can help to protect WBANs from a variety of security and privacy attacks, such as eavesdropping, man-in-the-middle attacks, and replay attacks. It is critical to generate strong key pairs, distribute public keys securely with digital signatures, and use encrypted communication channels such as TLS or SSL to ensure secure transmission of public and shared keys among Wireless Body Area Networks (WBANs), Local Processing Centers (LPCs), and Data Servers (DS). To facilitate safe data transfers, create shared symmetric keys, use session keys for short-term communication, and use cryptographic hash functions to ensure data integrity. Maintaining confidentiality, integrity, and authenticity requires regular updates, strong authentication mechanisms, threat detection monitoring, physical security measures, and security audits.

Figure 2.

Points on the curve of ECC when p $=$ 79.

The elliptic curve has 80 points, including the point at infinity. This means that when the value of p is 79, only values up to 80 can be encrypted using the ECC algorithm. In other words, the ECC algorithm can only encrypt values that correspond to points on the elliptic curve. Since there are only 80 points on the curve when p $=$ 79, the algorithm can only encrypt values up to 80. The ECC algorithm uses the elliptic curve to generate a pair of keys, a public key and a private key. The public key is used to encrypt data, and the private key is used to decrypt it. The encryption process works by finding the point on the elliptic curve that corresponds to the encrypted data. This point can then be decrypted using the private key. Since there are only 80 points on the curve when p $=$ 79, the ECC algorithm can only encrypt values that correspond to one of these points. This means that the maximum value that can be encrypted is 80.

The medical data needs to be converted into points on the elliptic curve in order to generate the ciphertext Ci. Each point on the curve represents a value from 1 to 80, so the medical data will be taken as a value from 1 to 80. For example, if the medical data is the patient’s heart rate, which is 75, then the corresponding point on the curve would be (72, 19) as per table given below. This point would then be used to generate the ciphertext Ci. Scalar addition is a key operation in Elliptic Curve Cryptography (ECC) that involves the repeated addition of an elliptic curve point. This process is critical for generating ciphertexts (Ci) in ECC-based encryption. The doctor’s public key is essential in this encryption process, helping to deduce a shared secret. Ciphertext is generated by combining the shared secret with a random scalar. The doctor’s private key is used during decryption to recover the shared secret and decrypt the ciphertext, revealing the original medical data. Scalar addition in ECC, along with the doctor’s public and private keys, ensures medical information security and confidentiality. The ciphertext Ci is then encrypted using the public key of the recipient. The recipient can then use their private key to decrypt the ciphertext and recover the original medical data.

1) Encrypting the message

If the PDA_privateⁱ is 7, the generator point $G$ is (1, 9), the DS_public is (1, 70), and the medical data $MD$ is (72, 19), then the ciphertext $Ci$ can be calculated using Eq. (4).

$Ci=\{7\cdot (1,9),((72,19)+7\cdot (1,70))\}$ (4)

In this case, ECC scalar addition and multiplication should be performed.

$7\cdot (1,9)=(1,70)$ (5)

$7\cdot (1,70)=(1,9)$ (6)

Therefore, $Ci$ can be expressed as follows:

$Ci=\{(1,70),((72,19)+(1,9))\}$ (7)

After performing scalar addition on the points (72, 19) and (1, 9), the result is (52, 35). Therefore, the ciphertext $Ci$ can be expressed as:

$Ci=\{(1,70),(52,35)\}$ (8)

Here, $C{i}_1=(1,70)$ and $C{i}_2=(52,35)$.

The ciphertext $Ci$ will be transferred to the data server for further analysis. The data server will use the doctor’s public key to decrypt the ciphertext and recover the medical data. The medical data will then be analyzed by the data server. Using secure protocols, end-to-end encryption, and robust encryption algorithms are used to efficiently transfer ciphertext to a data server. Key management, data integrity checks, and compression improve security and speed. In addition to parallelization for optimization, implement error handling, resumption features, and security oversight monitoring. Adapting to changing security threats requires routine audits and updates.

The transfer of the ciphertext to the data server should be done securely. The ciphertext should be encrypted using a secure protocol, such as HTTPS. Hypertext Transfer Protocol Secure (HTTPS) uses encryption, data integrity verification, and authentication mechanisms to ensure secure data transmission over the internet. HTTPS encrypts data in transit using SSL/TLS protocols, preventing unauthorized access and eavesdropping. It determines the integrity of transmitted data and detects tampering. The protocol also uses digital certificates for server authentication, establishing trust in the server’s identity. HTTPS protects against man-in-the-middle attacks and secures sensitive data, making it an essential component for preventing data interception and ensuring secure communication between users and websites. The data server should also be protected from unauthorized access.

2) Decrypting the message

To decrypt $Ci$ and obtain the original medical data, you can use Eq. (9) as follows:

$MD=C{i}_2-({\mathit{\text{DS\_private}}}^{\prime }\cdot C{i}_1)$ (9)

Table 2.

Elliptic curve mapping table

0	(0, 0)	(1, 9)	(1, 70)	(2, 22)	(2, 57)	(5, 29)	(5, 50)	(6, 8)	(6, 71)
1	2	3	4	5	6	7	8	9	10
(8, 21)	(8, 58)	(10, 33)	(10, 46)	(12, 9)	(12, 70)	(14, 25)	(14, 54)	(15, 25)	(15, 54)
11	12	13	14	15	16	17	18	19	20
(16, 2)	(16, 77)	(17, 36)	(17, 43)	(18, 2)	(18, 77)	(19, 20)	(19, 59)	(22, 20)	(22, 59)
21	22	23	24	25	26	27	28	29	30
(24, 24)	(24, 55)	(25, 18)	(25, 61)	(26, 8)	(26, 71)	(28, 27)	(28, 52)	(33, 5)	(33, 74)
31	32	33	34	35	36	37	38	39	40
(35, 31)	(35, 48)	(37, 29)	(37, 50)	(38, 20)	(38, 59)	(40, 34)	(40, 45)	(43, 32)	(43, 47)
41	42	43	44	45	46	47	48	49	50
(45, 2)	(45, 77)	(47, 8)	(47, 71)	(48, 35)	(48, 44)	(49, 15)	(49, 64)	(50, 25)	(50, 54)
51	52	53	54	55	56	57	58	59	60
(52, 35)	(52, 44)	(56, 23)	(56, 56)	(58, 35)	(58, 44)	(59, 14)	(59, 65)	(66, 9)	(66, 70)
61	62	63	64	65	66	67	68	69	70
(68, 1)	(68, 78)	(70, 17)	(70, 62)	(72, 19)	(72, 60)	(75, 13)	(75, 66)	(76, 7)	(76, 72)

Given that $C{i}_1=(1,70)$ and $C{i}_2=(52,35)$, you can substitute these points into Eq. (9):

$MD=(52,35)-(31\cdot (1,70))$ (10)

$MD=(52,35)-(1,9)$ (11)

$MD=(52,35)+(1,-9)$ (12)

$MD=(52,35)+(1,70)$ (13)

$MD=(72,19)$ (14)

The point (72, 19) corresponds to the original medical data. In this case, the original medical data can be obtained, and the HR value will be 75. Cryptographic algorithms play a crucial role in securing data during transmission, converting readable information into ciphertext. Key generation plays a vital role in both symmetric and asymmetric encryption. Asymmetric encryption involves the use of a public-private key pair. The security of communication heavily relies on the implementation of key exchange protocols, digital signatures, hash functions, and initialization vectors. These measures collectively ensure data integrity and restrict decryption access exclusively to authorized parties. TLS/SSL protocols establish secure channels, while Perfect Forward Secrecy enhances security by generating unique session keys. Together, these measures create a robust framework for safeguarding data in transit. Here are the sample medical vital data and their corresponding ciphertexts Ci using Elliptic Curve Integrated Encryption Scheme.

Table 3.

Sample medical data and corresponding Ci

Medical values	Cipher text (Ci)
Heart Rate is 75	Ci $=$ {(1, 70), (52, 35)}
Blood Pressure is 120/80	Ci $=$ {(47, 8), (76, 72)}/{(1, 70), (47, 53)}
ECG values: P wave is 80/120	Ci $=$ {(1, 70), (47, 53)}/{(47, 8), (76, 72)}
Fasting blood sugar is 80	Ci $=$ {(9, 70), (45, 35)}

5. Security analysis

5.1. Mutual authentication

Mutual authentication refers to a process where both communicating entities verify each other’s identities to establish trust. In the described technique, both the Wireless Body Area Network (WBAN) and the Local Processing Center (LPC) engage in mutual authentication with each other, and the Data Server (DS) also verifies the identities of WBAN and LPC.

1) WBAN and LPC mutual authentication:

• •WBAN calculates its shared key $K_1$ with LPC’s public key ${\text{𝑃𝐷𝐴}}_{\text{public}}$.
• •LPC calculates its shared key $K_2$ with WBAN’s public key ${\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$.
• •WBAN verifies LPC’s identity by comparing $K_1$ with $K_2$.
• •LPC verifies WBAN’s identity by comparing $K_1$ with $K_2$.

2) DS verification:

• •WBAN calculates its shared key $K_4$ with DS’s public key $D{S}_{\text{public}}$.
• •DS calculates its shared key $K_5$ with WBAN’s public key ${\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$.
• •LPC calculates its shared key $K_3$ with DS’s public key $D{S}_{\text{public}}$.
• •DS calculates its shared key $K_6$ with LPC’s public key ${\text{𝑃𝐷𝐴}}_{\text{public}}$.
• •DS verifies WBAN’s identity by comparing $K_4$ with $K_5$.
• •DS verifies LPC’s identity by comparing $K_3$ with $K_6$.

By performing the verification steps as mentioned above, all entities involved in the authentication process ensure that they are communicating with the correct and genuine counterparts. Mutual authentication prevents impersonation attacks and establishes a trusted and secure communication channel between WBAN, LPC, and DS. DS.Mutual authentication protects against impersonation attacks when used in interactions between the Wireless Body Area Network (WBAN), Local Processing Center (LPC), and Data Server (DS). Each entity verifies the identity of the others in this method, resulting in the establishment of a secure and trusted communication channel. Through the process, the confidentiality and integrity of the shared information are protected from unauthorized access. Mutual authentication basically builds trust between WBAN, LPC, and DS, which improves data security in the network.

5.2. Integrity

Integrity ensures that the transmitted data remains unchanged and unaltered during communication. In the described authentication technique, integrity is maintained through the use of shared keys and their verification. ECC is frequently used to protect privacy and data integrity. It can be used to secure communication between wearable devices, encrypt patient health information, ensure authentication and access control, confirm the accuracy of medical data, and enable safe remote monitoring. Due to its benefits, such as its shorter key lengths, computational efficiency, and ability to work in resource-constrained environments, ECC is an optimal option for improving WBAN security and protecting the privacy of private health information.

1) Shared key calculation:

• •WBAN calculates $K_1$: $K_1={\text{WBAN}}_{\text{private}}\cdot {\text{𝑃𝐷𝐴}}_{\text{public}}$
• •LPC calculates $K_2$: $K_2={\text{𝑃𝐷𝐴}}_{\text{private}}\cdot {\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$
• •LPC calculates $K_3$: $K_3={\text{𝑃𝐷𝐴}}_{\text{private}}\cdot D{S}_{\text{public}}$
• •WBAN calculates $K_4$: $K_4={\text{WBAN}}_{\text{private}}\cdot D{S}_{\text{public}}$
• •DS calculates $K_5$: $K_5=D{S}_{\text{private}}\cdot {\text{𝑊𝐵𝐴𝑁}}_{\text{public}}$
• •DS calculates $K_6$: $K_6=D{S}_{\text{private}}\cdot {\text{𝑃𝐷𝐴}}_{\text{public}}$

2) Verification of shared keys

For mutual authentication between WBAN and LPC:

• •WBAN verifies LPC’s identity: $K_1\stackrel{\mathrm{?}}{=}{K}_2$
• •LPC verifies WBAN’s identity: $K_1\stackrel{\mathrm{?}}{=}{K}_2$

For DS verification:

• •DS verifies WBAN’s identity: $K_4\stackrel{\mathrm{?}}{=}{K}_5$
• •DS verifies LPC’s identity: $K_3\stackrel{\mathrm{?}}{=}{K}_6$

If any of the shared key verification steps fail, it indicates a potential integrity issue or an authentication failure.

5.3. Confidentiality

Confidentiality ensures that sensitive information remains private and is only accessible to authorized parties. In the described technique, confidentiality is achieved through the use of private and public keys and secure communication channels.

1) Key generation

• •WBAN generates its private key (${\text{WBAN}}_{\text{private}}$) and a random number ‘a’.
• •LPC generates its private key (${\text{LPC}}_{\text{private}}$) and a random number ‘b’.
• •DS generates its private key (${\text{DS}}_{\text{private}}$) and a random number ‘c’.

2) Calculation of public keys

• •For WBAN: ${\text{𝑊𝐵𝐴𝑁}}_{\text{public}}={\text{WBAN}}_{\text{private}}\cdot (G+P)$
• •For LPC: ${\text{𝑃𝐷𝐴}}_{\text{public}}={\text{LPC}}_{\text{private}}\cdot (G+P)$
• •For DS: $D{S}_{\text{public}}={\text{DS}}_{\text{private}}\cdot (G+P)$

3) Shared key calculation

Shared keys ($K_1,K_2,K_3,K_4,K_5,K_6$) are computed by each entity using their private keys and the other party’s public keys.

4) Verification of shared keys

The entities verify each other’s identities by comparing the computed shared keys.

5.4. Data freshness

To achieve data freshness, the following measures are implemented:

1) Generation of random numbers

• •During the key generation process, each entity (WBAN, LPC, and DS) generates random numbers (a, b, c).
• •These random numbers are used in various cryptographic calculations and computations during the authentication process.
• •The use of random numbers ensures that each session’s cryptographic operations are unique, making the authentication process non-deterministic and unpredictable.

2) Timestamps

• •Each message exchanged during the mutual authentication process is associated with a timestamp.
• •Timestamps provide information about when the message was generated or received.
• •The use of timestamps allows the receiving entity to validate the freshness of the data by ensuring that messages are considered valid only within a specific time window.
• •This prevents attackers from replaying old or captured messages at a later time to gain unauthorized access.

3) Nonce usage

• •Nonces, which are unique random numbers used only once, play a crucial role in ensuring data freshness.
• •In the authentication process, the random numbers (a, b, c) generated by each entity act as nonces.
• •Nonces are used to ensure that cryptographic operations are unique for each session, further preventing replay attacks.

4) Verification of shared keys

• •During the verification of shared keys, each entity checks whether the computed shared key matches the expected value based on the exchanged data (public keys and random numbers).
• •If the shared keys do not match or if a replayed message is detected (e.g., based on timestamps), the authentication process will fail, indicating a lack of data freshness or potential tampering.

6. Performance analysis

The previous chapter compared existing protocols to S-WBSN and found that S-WBSN was the best. This section will compare ECDH to S-WBSN specifically, since S-WBSN is already known to be better than the other protocols. This section provides the overall performance of ECDH and S-WBSN protocols in terms of different performance metrics like PDR, end-to-end delay, throughput, energy consumption, Storage overhead, Computational cost, Communication Cost, Authentication latency, Encryption time, Decryption time, and Security levels Analysis.

6.1. Simulation setup

The effectiveness of the proposed protocol is evaluated by conducting experiments where its components are executed within a test environment implemented using OMNET$++$. The simulation parameters are given in Tables 5–8.

Table 5.

Running time of mutual authentication

EG_mul	EG_H	EG_add	E_exp	E_h
1.01s	NA	0.01 s	1.05 s	NA

Table 8.

Comparison of communication cost

Number of devices	S-WBSN		ECDH
5	8.	85	6.	85
10	17.	7	13.	7
15	35.	4	27.	4
20	70.	8	54.	8
25	141.	6	109.	6
30	283.	2	219.	2
35	566.	4	438.	4
40	1132.	8	876.	8
45	2265.	6	1753.	6
50	4531.	2	3507.	2

Table 4.

Simulation parameters

Parameters	Values
Number of body area networks	50
Channel type	Wireless channel
Propagation model	Two Ray Ground
MAC layer	IEEE 802.11
Link layer	IEEE 802.11 MAC
Physical type	PhysicalEnvironment compound module
Antenna type	DipoleAntenna (Omnidirectional)
IFQ length	1000
Routing protocol	AODV

Table 6.

Computation of computational cost for 50 devices

Number of devices	S-WBSN	ECDH
5	2.712	1.712
10	5.424	4.424
15	10.848	9.848
20	21.696	18.696
25	43.392	40.392
30	86.784	75.784
35	173.568	150.568
40	347.136	300.136
45	694.272	610.272
50	1388.544	1208.54

Figure 3.

Computation of computational-cost for 50 devices.

6.2. Computation cost

The computation cost of the proposed ECDH technique is examined in this section. Computation cost of the proposed work is also compared to S-WBSN. WBSN has extremely restricted computing and memory capabilities. However, LPC is equipped with a very powerful coprocessor. On the other hand, LPC has enough capability to complete all relevant actions.

6.3. Communication cost

In this subsection, we will discuss the evaluation of communication costs related to the exchange of messages over an insecure channel in the context of an ECDH system.

The ECDH system requires sending eight messages between entity WBSN, LPC, and the DS. The communication costs for each parameter exchange are shown in Table 7.

Table 7.

Cost of each parameter exchange in bits

Message	Length (bits)
Identity and Random Number	64
W_wb	512
W_1	512
W_2	512
W_lpc	512
All other messages	1024

All other messages are straightforward scalar multiplication operations, and they need to be padded to a multiple of 128 bits.

Table 8 provides a comparison of communication costs for different numbers of devices.

6.4. Energy cost

The energy costs of the proposed architecture and other methods are compared in Table 9 and Fig. 5. The proposed design has the best energy performance, as shown in the figure. Because the energy cost is closely associated with the computing cost, results obtained are represented visually, which is similar for both costs.

Table 9.

Comparison of energy-cost

Number of devices	S-WBSN	ECDH
5	60	55
10	70	68
15	84	83
20	178	175
25	365	350
30	523	520
35	658	630
40	708	680
45	808	790
50	848	830

Figure 5.

Energy cost comparison.

Figure 4.

Comparison of communication-cost.

6.5. Experimental results based on data security

In Table 10, the efficiency of the proposed approach is analyzed using encryption time. According to Table 10, the proposed method took a minimum time of 4200 ms for transmitting 10 KB. It is clear from the results that the ECDH framework achieved better results compared to the existing technique S-WBSN. The corresponding graph is given in Fig. 6.

Table 10.

Comparative analysis based on encryption time

Data size (KB)	S-WBSN (ms)	ECDH (ms)
10	4223	4200
20	5531	5450
30	6023	5550
40	7183	6810

Figure 6.

Encryption time comparison.

Comparative analysis based on decryption time by varying file size is given in Table 11. When analyzing Table 11, the proposed method took a minimum decryption time of 5005 ms for transmitting 10 KB data, 6285 ms for transmitting 20 KB data, 7192 ms for transmitting 30 KB data, and 8292 ms for transmitting 40 KB data. As data sizes increase, decryption time also gradually increases. The corresponding figure is given in Fig. 7.

Table 11.

Comparative analysis based on decryption time

Data size (KB)	S-WBSN (ms)	ECDH (ms)
10	5005	4800
20	6285	6105
30	7192	6800
40	8292	8102

Figure 7.

Decryption time comparison.

Security level simulation is based on the total number of packets sent by the source page and the total number of packets successfully received on the target page. No unauthorized user can access the data at the time of transfer. The safety level of the proposed method is measured as given in Table 12. When analyzing Table 12, the ECDH method achieved a maximum security level of 91% for a Brute Force attack, 90% for a known plain text attack, and 86% for a related key attack. After using the attack, the ECDH method has more protection compared to S-WBSN.

Table 12.

Comparison of security levels of existing and proposed algorithms

Security level	S-WBSN (%)	ECDH (%)
Brute Force Attack	90	91
Known Plaintext Attack	88	90
Related Key Attack	85	86

7. Conclusion

ECDH is a more suitable key exchange algorithm for WBANs than the traditional Diffie-Hellman algorithm. It offers advantages such as shorter key lengths and faster computations, making it more suitable for resource-constrained devices. The key generation and mutual authentication processes are performed using elliptic curve operations. The medical data is encoded as points on an elliptic curve using ECIES for encryption and decryption. ECDH and ECIES ensure confidentiality and authenticity in the communication of medical data in WBANs.

Conflict of interest

The authors do not have any conflicts of interest to report.

Data availability statement

No datasets were generated or analyzed during the current study.