Abstract
A body area network (BAN) consists of wireless sensors and actuators deployed on a patient's body for real-time health monitoring and personalized medical care. It is essential and challenging to secure wireless communications in a BAN to protect the patient's privacy while also allowing the authorized healthcare practitioners (e.g., emergency room doctors and nurses) to easily communicate with and configure the BAN devices transparent to the patient or even when the patient loses consciousness. With the existing schemes, the devices are based on a pre-installed secret password or a physiological signal feature to authenticate each other and to agree upon a cryptographic key for secure communications. The former requires a patient's input to access and configure the BAN, and the latter is not sufficiently reliable or secure due to signal dynamics. This motivates us to design a new key agreement scheme in this paper, called multi-biometric and physiological signal-based key agreement (MBPSKA), to achieve more secure and reliable authentication and communication session establishment between the BAN devices while providing flexibility to authorized personnel to access, control, and adjust the BAN without patient involvement. The proposed scheme exploits both the reliable biometric traits and the time-variant physiological signal features of a patient along with the efficient fuzzy crypto-algorithms and key distribution protocols. The devices use multiple biometric and physiological features for mutual authentication and cryptographic key protection. We analyze the security characteristics of MBPSKA, including its capabilities against various attacks. Our evaluation results using the real-world datasets demonstrate that MBPSKA outperforms the existing physiological signal-based key agreement schemes in terms of security, authentication reliability, and accuracy.