人體區域網路(WBAN)在行動醫療照護之中扮演一個很重要的角色，我們可以
將WBAN想像成圍繞在人體周圍的一個小型區域網路。在WBAN之中存在著三個主要
的角色：感測器、閘道器、醫療中心。然而，感測器與閘道器的通訊距離僅有1-2公
尺，如果閘道器遺失或是離開了由感測器所組成的WBAN之範圍，我們必須額外提供
一個備用閘道器來持續地匯整與轉送感測資料。除此之外，由於預設閘道器擁有與醫
療中心共享的對稱式金鑰，所以預設閘道器能夠與醫療中心建立安全通訊，但未來將
作為備用閘道器的使用者裝置並不具有該把對稱式金鑰。為了解決備用閘道器沒有對
稱式金鑰的問題，我們為WBAN此環境提出一個金鑰重建協定，在此協定中，預設閘
道器具有賦予備用閘道器重建暫時性權杖(token)的能力，並且備用閘道器能夠透過該
暫時性權杖與醫療中心建立安全通訊。

Wireless body area network (WBAN) plays an important part in mobile healthcare.
WBAN can be imagined as a small wireless local area network around our body. In WBAN,
there exist three roles: sensors, gateway, and healthcare center. However, the communication
distance between sensors and gateway is only 1-2 meters. If the default gateway is lost or
leaves the range of WBAN consisting of the sensors, we have to provide a backup gateway
to aggregate and forward the sensed data continuously. Furthermore, the default gateway can
establish a secure channel with the healthcare center because it holds the long-term key shared
with the healthcare center, but the user’s devices which may serve as the backup gateway do
not hold the long-term key. In order to deal with the problems, we propose a key reconstruction
protocol for WBAN. In the proposed protocol, the default gateway enables the backup gateway
to reconstruct a temporary token, and the backup gateway will use the temporary token
to establish a secure channel with the healthcare center without using the long-term key of the
default gateway.

論文審定書i
Acknowledgments v
摘要vi
Abstract vii
List of Figures xi
List of Tables xii
Chapter 1 Introduction 1
1.1 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Chapter 2 Preliminaries 5
2.1 Wireless Body Area Network (WBAN) . . . . . . . . . . . . . . . . . . . . . . . 5
2.1.1 Architectures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.1.2 Protocol Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.3 Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2 Secret Sharing Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.3 Homomorphic Secret Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.4 Security Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 3 Related Works 15
3.1 Jang et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
viii
3.1.1 Registration Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.1.2 Authentication Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.1.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.2 Drira et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.2.1 Diffie-Hellman Assumptions . . . . . . . . . . . . . . . . . . . . . . . . 20
3.2.2 Authentication and Key Establishment Scheme . . . . . . . . . . . . . . 21
3.2.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.3 Liu et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.3.1 Intractable Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3.3.2 Liu’s Certificateless Signature Scheme . . . . . . . . . . . . . . . . . . . 26
3.3.3 Preliminary Anonymous Authentication Protocol . . . . . . . . . . . . . 27
3.3.4 Security-enhanced Anonymous Authentication Protocol . . . . . . . . . 29
3.3.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.4 Yeh et al.’s Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.4.1 Initialization Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.4.2 Registration Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.4.3 Authentication Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
3.4.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Chapter 4 The Proposed Protocol 34
4.1 Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4.2 The Proposed Protocol for WBAN . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.2.1 Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.2.2 Registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.2.2.1 Extra-body Registration . . . . . . . . . . . . . . . . . . . . . 36
4.2.2.2 Intra-body Registration . . . . . . . . . . . . . . . . . . . . . . 37
4.2.3 Authentication Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
4.2.4 Gateway-changing Protocol . . . . . . . . . . . . . . . . . . . . . . . . . 39
4.2.4.1 Intra-body Phase . . . . . . . . . . . . . . . . . . . . . . . . . 39
4.2.4.2 Extra-body Phase . . . . . . . . . . . . . . . . . . . . . . . . . 41
ix
Chapter 5 Security Analysis and Proof 42
5.1 Security and Properties Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
5.2 Security Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Chapter 6 Comparison 55
6.1 Performance Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
6.1.1 Our Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
6.1.2 Jang et al.’s Scheme [20] . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
6.1.3 Drira et al.’s Scheme [14] . . . . . . . . . . . . . . . . . . . . . . . . . . 58
6.1.4 Liu et al.’s Scheme [25] . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
6.1.5 Yeh et al.’s Scheme [33] . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
6.2 Properties Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Chapter 7 Conclusion 62
Bibliography 63

[1] 3GPP TS 21.133: Security Threats and Requirements. http://www.etsi.org/
deliver/etsi_ts/121100_121199/121133/04.01.00_60/ts_121133v040100p.
pdf.
[2] B. Archer and E. W. Weisstein. Lagrange interpolating polynomial. From
MathWorld–A Wolfram Web Resource. http://mathworld.wolfram.com/
LagrangeInterpolatingPolynomial.html.
[3] IEEE Standards Association et al. 802.15.6-2012 IEEE standards for local and metropolitan
area networks–part 15.6: Wireless body area networks.
[4] D. M. Barakah and M. Ammad-uddin. A survey of challenges and applications of wireless
body area network (wban) and role of a virtual doctor server in existing architecture. In
2012 Third International Conference on Intelligent Systems Modelling and Simulation
(ISMS), pages 214–219. IEEE, 2012.
[5] M. Bellare and P. Rogaway. Entity authentication and key distribution. In Advances in
Cryptology – CRYPTO ’93, volume 773, pages 232–249. Springer, 1993.
[6] J. C. Benaloh. Secret sharing homomorphisms: Keeping shares of a secret sharing. In
CRYPTO, volume 263, pages 251–260. Springer, 1986.
[7] G. R. Blakley. Safeguarding cryptographic keys. In Proceedings of the 1979 AFIPS
National Computer Conference, pages 313–317. AFIPS Press, 1979.
[8] D. Boneh and M.K. Franklin. Identity-based encryption from the weil pairing. In
CRYPTO, volume 2139, pages 213–229. Springer, 2001.
[9] J. Bryson and P. Gallagher. Secure hash standard (shs). Federal Information Processing
Standards, FIPS PUB (180-4), 2012.
[10] H. Cao, V. Leung, C. Chow, and H. Chan. Enabling technologies for wireless body area
networks: A survey and outlook. IEEE Communications Magazine, 47(12):84–93, 2009.
[11] M. Chen, S. González-Valenzuela, A. Vasilakos, H. Cao, and V. Leung. Body area networks:
A survey. Mobile Networks and Applications, 16(2):171–193, 2011.
[12] R. Cramer and V. Shoup. A practical public key cryptosystem provably secure against
adaptive chosen ciphertext attack. In CRYPTO, volume 1462, pages 13–25. Springer,
1998.
[13] R. Cramer and V. Shoup. Design and analysis of practical public-key encryption schemes
secure against adaptive chosen ciphertext attack. SIAM J. Comput., 33(1):167–226, 2003.
[14] W. Drira, E. Renault, and D. Zeghlache. A hybrid authentication and key establishment
scheme for wban. In TrustCom, pages 78–83. IEEE Computer Society, 2012.
[15] T. ElGamal. A public key cryptosystem and a signature scheme based on discrete logarithms.
IEEE Transactions on Information Theory, 31(4):469–472, 1985.
[16] S. C. Ergen. ZigBee/IEEE 802.15. 4 summary. http://pages.cs.wisc.edu/~suman/
courses/707/papers/zigbee.pdf.
[17] L. Filipe, F. Fdez-Riverola, N. Costa, and A. Pereira. Wireless body area networks for
healthcare applications: Protocol stack review. International Journal of Distributed Sensor
Networks, 2015, 2015.
[18] Y. Gil, W. Wu, and J. Lee. A synchronous mmulti-body sensor platform in a wireless
body sensor network: Design and implementation. Sensors, 12(8):10381–10394, 2012.
[19] F. Hess. Efficient identity based signature schemes based on pairings. In Selected areas
in cryptography, pages 310–324. Springer, 2003.
[20] C. S. Jang, D. G. Lee, J. Han, and J. H. Park. Hybrid security protocol for wireless body
area networks. Wireless Communications and Mobile Computing, 11(2):277–288, 2011.
[21] V. M. Jones, R. G. A. Bults, D. Konstantas, and P. A. M. Vierhout. Body area networks
for healthcare. Wireless World Research Forum meeting. http://eprints.eemcs.
utwente.nl/8706/01/WG1_Val_Jones_Richard_Bults.pdf, 2001.
[22] N. Koblitz, A. Menezes, and S. Vanstone. The state of elliptic curve cryptography. Des.
Codes Cryptography, 19(2/3):173–193, 2000.
[23] B. Latré, B. Braem, I. Moerman, C. Blondia, and P. Demeester. A survey on wireless
body area networks. Wireless Networks, 17(1):1–18, 2011.
[24] K. Lauter. The advantages of elliptic curve cryptography for wireless security. IEEE
Wireless communications, 11(1):62–67, 2004.
[25] J. Liu, Z. Zhang, X. Chen, and K. S. Kwak. Certificateless remote anonymous authentication
schemes for wirelessbody area networks. IEEE Transactions on Parallel and
Distributed Systems, 25(2):332–342, 2014.
[26] T. O’Donovan, J. O’Donoghue, C. Sreenan, P. O’Reilly, D. Sammon, and K. O’Connor.
A context aware wireless body area network (ban). In 3rd International Conference on
Pervasive Computing Technologies for Healthcare, pages 1–8. IEEE, 2009.
[27] C. Otto, A. Milenkovic, C. Sanders, and E. Jovanov. System architecture of a wireless
body area sensor network for ubiquitous health monitoring. Journal of Mobile Multimedia,
1(4):307–326, 2006.
[28] R. Schmidt, T. Norgall, J. Mörsdorf, J. Bernhard, and T. von der Grün. Body area network
ban–a key infrastructure element for patient-centered medical applications. Biomedizinische
Technik/Biomedical Engineering, 47(s1a):365–368, 2002.
[29] M. Scott, N. Costigan, and W. Abdulwahab. Implementing cryptographic pairings on
smartcards. In Cryptographic Hardware and Embedded Systems-CHES 2006, pages 134–
147. Springer, 2006.
[30] A. Shamir. How to share a secret. Communications of the ACM, 22(11):612–613, 1979.
[31] M. Toorani. On vulnerabilities of the security association in the IEEE 802.15.6 standard.
In Financial Cryptography and Data Security, pages 245–260. Springer, 2015.
[32] S. Ullah, M. Mohaisen, and M. A. Alnuem. A review of ieee 802.15. 6 mac, phy, and
security specifications. International Journal of Distributed Sensor Networks, 2013, 2013.
[33] C. K. Yeh, H. M. Chen, and J. W. Lo. An authentication protocol for ubiquitous health
monitoring systems. Journal of Medical and Biological Engineering, 33(4):415–419,
2013.
[34] M. R. Yuce. Implementation of wireless body area networks for healthcare systems.
Sensors and Actuators: A: Physical, 162(1):116–129, 2010.
[35] T. G. Zimmerman. Personal area networks: Near-field intrabody communication. IBM
systems Journal, 35(3/4):609–617, 1996.