Securing medical records on smart phones

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2009, Pages 31-39

  Gardner, Ryan W ^a   Garera, Sujata ^a   Pagano, Matthew W ^a   Green, Matthew ^a   Rubin, Aviel D ^a  

^a JOHNS HOPKINS UNIVERSITY   (United States)

Author keywords

Authentication; Medical information; Portable health records; Privacy; Security

Indexed keywords

ACCESS RIGHTS; FLEXIBLE ARCHITECTURES; HEALTH RECORDS; MEDICAL INFORMATION; MEDICAL PERSONNEL; MEDICAL RECORD; OFFLINE; PORTABLE HEALTH RECORDS; SECURE STORAGE; SMART PHONES;

AUTHENTICATION; BIOINFORMATICS; NETWORK SECURITY; TELEPHONE SETS;

COMPUTER PRIVACY;

EID: 74049112611     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1655084.1655090     Document Type: Conference Paper

References (47)

1. AllOne Mobile: AllOne Health. http://www.allonemobile.com/.
2. Classifeye. http://www.classifeye.com/.
3. Google Health. https://www.google.com/health/.
4. Google Mobile: Android. http://www.google.com/mobile/android/.
5. Microsoft HealthVault. http://www.healthvault.com/Personal/index.html.
6. W. A. Arbaugh, D. J. Farber, and J. M. Smith. A secure and reliable bootstrap architecture. In IEEE Symposium on Security and Privacy, 1997.
7. L. Ballard, S. Kamara, F. Monrose, and M. K. Reiter. Towards practical biometric key generation with randomized biometric templates. In CCS '08: ACM Conference on Computer and Communications Security, 2008.
8. L. Ballard, S. Kamara, and M. K. Reiter. The practical subtleties of biometric key generation. In USENIX Security Symposium, 2008.
9. E. Barker, W. Barker, W. Burr, W. Polk, and M. Smid. Recommendation for key management. NIST Special Publication 800-57, 2007.
10. J. Bethencourt, A. Sahai, and B. Waters. Ciphertext-policy attribute-based encryption. In IEEE Symposium on Security and Privacy, 2007.
11. G. Blakley. Safeguarding cryptographic keys. In AFIPS '79: American Federation of Information Processing Societies National Computer Conference, 1979.
12. D. Boneh, C. Gentry, and B. Waters. Collusion resistant broadcast encryption with short ciphertexts and private keys. In CRYPTO '05: Advances in Cryptology, 2005.
13. CapMed. icePHR mobile. https://www.icephr.com/iceMobileHelp.htm.
14. CapMed. Personal healthkey. http: //www.capmed.com/solutions/ applications.asp.
15. Certicom Research. Standards for e cient cryptography, SEC 1: Elliptic curve cryptography, 2000.
16. Y.-J. Chang, W. Zhang, and T. Chen. Biometrics-based cryptographic key generation. In ICME '04: IEEE International Conference on Multimedia and Expo, 2004.
17. B. Chen and V. Chandran. Biometric based cryptographic key generation from faces. In DICTA '07: Biennial Conference of the Australian Pattern Recognition Society on Digital Image Computing Techniques and Applications, 2007.
18. F. Dillema and S. Lupetti. Rendezvous-based access control for medical records in the pre-hospital environment. In HealthNet '07: ACM SIGMOBILE International Workshop on Systems and Networking Support for Healthcare and Assisted Living Environments, 2007.
19. A. Ferreira, R. Cruz-Correia, L. Antunes, P. Farinha, E. Oliveira-Palhares, D. Chadwick, and A. Costa-Pereira. How to break access control in a controlled manner. In CMBS '06: IEEE Symposium on Computer-Based Medical Systems, 2006.
20. W. Ford and B. Kaliski. Server-assisted generation of a strong secret from a password. WETICE '00: Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises, 2000.
21. V. Goyal, A. Jain, O. Pandey, and A. Sahai. Bounded ciphertext policy attribute based encryption. In ICALP '08: International Colloquium on Automata, Languages and Programming, Part II, 2008.
22. V. Goyal, O. Pandey, A. Sahai, and B. Waters. Attribute-based encryption for ne-grained access control of encrypted data. In CCS '06: ACM Conference on Computer and Communications Security, 2006.
23. T. Hinkamp. System providing medical personnel with immediate critical data for emergency treatments. Patent Application Publication 11/510,317, 2007.
24. Joint NEMA/COCIR/JIRA Security and Privacy Committee (SPC). Break-glass { an approach to granting access to healthcare systems. NEMA (National Electrical Manufacturers Association-USA), COCIR (European Coordination Committee of the Radiological and Electromedical Industry), JIRA (Japan Industries Association of Radiological System), 2004.
25. Y. J. Lee, K. R. Park, S. J. Lee, K. Bae, and J. Kim. A new method for generating an invariant iris private key based on the fuzzy vault system. IEEE Transactions on Systems, Man, and Cybernetics, 38(5), October 2008.
26. P. Lukowicz, U. Anliker, J. Ward, G. Troster, E. Hirt, and C. Neufelt. AMON: a wearable medical computer for high risk patients. In ISWC '02: International Symposium on Wearable Computers, 2002.
27. U. Manber. A simple scheme to make passwords based on one-way functions much harder to crack. Computers and Security, 15(2), 1996.
28. MedicAlert. E-healthkey. http://www.healthcentral. com/migraine/reviews- 202629-5.html.
29. C. Myers. Which prescription drugs could create a deadly combination? ABC13 Eyewitness News, May 2007. Available at http://abclocal.go.com/ ktrk/ story?section=news/health&id=5320077.
30. S. Nepal, J. Zic, F. Jaccard, and G. Kraehenbuehl. A tag-based data model for privacy-preserving medical applications. In EDBT '06: Current Trends in Database Technology, 2006.
31. P. Olla and J. Tan. Personal health records systems go mobile: Defining evaluation components. Mobile Health Solutions for Biomedical Applications, 2009.
32. R. Ostrovsky, A. Sahai, and B. Waters. Attribute-based encryption with non-monotonic access structures. In CCS '07: ACM Conference on Computer and Communications Security, 2007.
33. J. H. Park, H. J. Kim, M. Sung, and D. H. Lee. Public key broadcast encryption schemes with shorter transmissions. IEEE Transaction on Broadcasting, 54(3), September 2008.
34. D. Povey. Optimistic security: A new access control paradigm. In NSPW '99: Workshop on New Security Paradigms, 1999.
35. D. Preuveneers and Y. Berbers. Mobile phones assisting with health self-care: A diabetes case study. In MobileHCI '08: Conference on Human Computer Interaction with Mobile Devices and Services, 2008.
36. J. Rokita, A. Krzy-zak, and C. Y. Suen. Cell phones personal authentication systems using multimodal biometrics. In ICIAR '08: International Conference on Image Analysis and Recognition, 2008.
37. L. Romney. Cirque de Soleil settles with gymnast fired over HIV. Los Angeles Times, April 2004.
38. R. Sailer, X. Zhang, T. Jaeger, and L. van Doorn. Design and implementation of a TCG-based integrity measurement architecture. In 13th USENIX Security Symposium, 2004.
39. A. Shamir. How to share a secret. Communications of the ACM, 22(11), 1979.
40. V. Shoup. A proposal for an ISO standard for public key encryption (version 2.1). Available at http://www.shoup.net/papers/iso-2-1.pdf, 2001.
41. P. Tang, J. Ash, D. Bates, J. Overhage, and D. Sands. Personal health records: Definitions, benefits, and strategies for overcoming barriers to adoption. Journal of the American Medical Informatics Association, 13(2), 2006.
42. United States Court of Appeals. Stephen C. Orr vs. Wal-Mart Stores, Inc. Appeal from the United States District Court for the District of Nebraska, (01-2959), July 2002.
43. B. Waters. Ciphertext-policy attribute-based encryption: An expressive, e cient, and provably secure realization. Cryptology ePrint Archive, Report 2008/290, 2008. Available at http://eprint.iacr.org/2008/290/.
44. A. Wright and D. Sittig. Encryption characteristics of two USB-based personal health record devices. Journal of the American Medical Informatics Association, 14(4), 2007.
45. A. Wright and D. Sittig. Security threat posed by USB-based personal health records. Annals of internal medicine, 146(4), 2007.
46. W. Wu, J. Cao, Y. Zheng, and Y. Zheng. WAITER: A wearable personal healthcare and emergency aid system. In PerCom '08: IEEE International Conference on Pervasive Computing and Communications, 2008.
47. X. Wu, N. Qi, K. Wang, and D. Zhang. A novel cryptosystem based on iris key generation. In ICNC '08: International Conference on Natural Computation, 2008.