Security and Privacy Protection Protocol for Shared Medical Records

建立病患之電子醫療病歷不僅可以傳送高品質的醫療服務，而且可以節省醫療之浪費。近來，無線射頻 (radio frequency identification 簡稱RFID) 被廣泛的應用於各個領域，例如: 供應鏈管理、存貨倉儲管理、以及藥品辨識之控制等等。然而，假如RFID系統沒有提供存取控制以及安全之驗證機制，將會遭遇一些安全上的問題。因為利用RFID系統之電子標籤能夠讀取回應的機制，使得非法使用者能取得電子標籤內之重要的訊息，甚至能追蹤使用者之位置或行為。為了保護病患的醫療記錄資訊以及隱私權，我們將提出一個適用於RFID系統之安全驗證機制以方便醫護人員於訪視病房時能迅速地借由RFID系統取得病患之電子醫療病歷，無須攜帶厚重的紙本病歷，並且能保護患者的醫療行為不被得知。
Establishing electronic patient care records is essential not only for delivering quality medical care services but also in saving medical expenses. Currently, radio frequency identification (RFID) is being deployed for a wide variety of applications, including supply chain management, inventory, storage, etc. However, RFID systems can have security problems if the tag offers no access control and certificated mechanisms. By utilizing responses from a tag, an adversary may try to obtain the information of the product and trace the user. The protection of patients’ health information is a very important concern in the information age. It must have secure mutual authentication mechanisms to protect electronic archives. In order to obtain appropriate medical information, physicians must efficiently get electronic patient records from a database (medical information system) to hospital wards. In this paper, we present a new idea to apply the radio frequency identification (RFID) system such that the physician can efficiently retrieve the electronic patient records for medial care when they visit patient wards without taking heavy paper records. In addition, the proposed scheme provides anonymous property and guards against patient tracing.