A STUDY OF PRIVACY-PRESERVING MECHANISMS FOR WIRELESS MULTIMEDIA SENSOR NETWORKS IN HEALTHCARE

Although the importance of privacy is well-acknowledged for sensitive data, a significant
research effort is still needed to develop robust privacy protection solutions for Wireless
Sensor Networks (WSNs) used in the context of healthcare. The focus of this doctoral
research is to investigate privacy-preserving mechanisms for Wireless Multimedia Sensor
Networks (WMSNs) for use in healthcare, to ensure privacy-aware transmission (from
sensors to the base station) of multimedia data captured for healthcare.
Towards achieving the goal stated above, the following research questions are addressed in
this thesis: (i) What are the significant privacy threats in a WMSN used in the healthcare
domain? (ii) What countermeasures can be deployed to stop privacy attacks that realize
these threats? (iii) What is the impact, on the WMSN, of the deployment of the privacy
countermeasures, with regards to the enhancement of privacy and to the associated
computation, communication and storage overheads?
A threat analysis, conducted in the research reported herein, revealed that linkability,
identifiability and location disclosure are significant privacy threats for WMSNs in healthcare.
Consequently, privacy countermeasures and the corresponding mechanisms to achieve
unlinkability, anonymity / pseudonymity and location privacy are required in a privacy-aware
WMSN for healthcare. The AntSensNet routing protocol (Cobo et al., 2010) for WMSNs was
adapted in the work reported in this thesis, by adding to it privacy-preserving mechanisms,
towards achieving unlinkability, anonymity / pseudonymity and location privacy. The
standard AntSensNet routing protocol is vulnerable to privacy threats. Consequently, the
following countermeasures were investigated in this thesis: (i) size correlation and
encryption of scalar and multimedia data transmitted through a WMSN, and size correlation
and encryption of ants, to achieve unlinkability and location privacy; (ii) fake traffic injection,
to achieve anonymity, source location and base station location privacy, as well as
unlinkability; (iii) pseudonyms, to achieve unlinkability.
To assess the impact of the introduction of the above privacy countermeasures, a
quantitative performance analysis was conducted (using the NS2 simulator and a theoretical
analysis) to gauge the computation overhead (number of extra operations), communication
overhead (number of extra network messages) and storage overhead (number of extra
encryption keys) of the privacy countermeasures which were added to the AntSensNet
protocol deployed within a WMSN. The performance analysis results show that the
messages and memory overheads due to the added privacy countermeasures increase
mostly linearly with the number of scalar and multimedia sensors, and the resulting traffic,
increases in the network.
iii
Furthermore, a WMSN (with sensors having specifications similar to healthcare sensors, but
not deploying the privacy-aware AntSensNet protocol) was simulated using the NS2
simulator, to study the effect of the introduction of fake traffic, towards achieving unlinkability,
anonymity and location privacy. Entropy and anonymity set size were adopted to quantify
the change in the level of privacy (anonymity, unlinkability and location privacy) as the
number of fake sources and the volume of fake traffic increase. The results show that the
level of privacy enhancement increases with the number of fake sources and volume of fake
traffic, but at the expense of an increased delay in the data delivery and an increased level
of multimedia jitter (as a result of the consumption of the available bandwidth by fake traffic).
This delay and jitter might not be acceptable in critical situations where rapid medical action
is required, such as for a patient who has suffered a stroke or a patient (remotely monitored
by cameras) who has fallen and broken a bone.
The novel contributions to knowledge which have arisen from this doctoral research are: (i)
the elicitation of privacy threats, through a threat analysis methodology named LINDDUN
(Wuyts et al., 2014) ─ applied to WMSNs for healthcare ─ to identify significant threats and
hence the privacy enhancement mechanisms required by a privacy-aware WMSN; (ii) the
enhancement of the AntSensNet routing protocol for WMSNs, to make it privacy-aware; (iii)
the findings from the assessment of the privacy-awareness resulting from the deployed
privacy-enhancing countermeasures and findings from the assessment of their associated
computation, communication and storage overheads.