Secure Online Medicine Delivery System

Health-care delivery applications need a robust and secure medicine providing system [1, 2]. Telecare medicine information systems being a very important part of this digital era. Numerous low-cost telecommunication systems and monitoring equipment are present for the patients. Implementing the pharmacy application and integrated it with data getting from the existing systems, could help to increase the accuracy and ease of the creation of medical needs and stock management. Besides, it will decrease the number of medical supply stock-outs [3]. By using these systems the benefits of telehealth are made available to the patients at their homes. In these systems, the number of users is connected with numerous types of wired or wireless networks which makes this system prone to attacks by hackers. To avoid this, confirmation at both ends has become essential. The server at the host side needs verification to safeguard the records of the patient from an unlicensed person to protect the confidentiality of the patient, while on the other side, the patient (client) has to be authenticated by the host server so he/she cannot be impersonated by the hacker. A confirmation plan can keep unapproved clients from getting to medication data frameworks. The new advancement in the area of services and computing offers to deliver hosted services over the worldwide using public or private online cloud services [4, 5]. The idea of cloud computing can be established in many levels of implementation based on the type of problem. The use of new technologies like cloud computing and soft computing in analyzing the data of any system can help to understand the behavior of current and future data [6, 7]. In 1981, Lamport [8] introduced the primary verification conspire to utilize the secret key table and hash chain. As a secret key can be carefully chosen uninhibitedly by the client, secret word validation plans are broadly utilized in different applications [9-11]. A secret phrase can be undermined in certain situations. For instance, recorded by a government operative programming, shoulder surfing through a remote camera, reacting to a phishing email, taken secret word table from the hacked server, and so forth. When the secret word is uncovered, the validation plot utilizing the secret key alone is broken. Pertinent client confirmations plans are by and large used to take care of this sort of issue in TMIS because these conventions are viewed as the essential protects in organize electronic applications. Validation plans can guarantee that the framework's assets are not gotten deceitfully by illicit clients. Secret key based client confirmation plot is one of the least difficult and most helpful validation systems in focusing on insecure systems. It gives just the legitimate patients to use the benefits of remote frameworks. Many Internet applications are dependent on a secret key based verification plans, for instance, remote login, private companies, database the executive’s frameworks, educational systems, etc. Most likely it is reasonable for the TMIS. In any case, the present Internet condition is defenseless against different assaults, for example, replay assaults, on-line and disconnected secret phrase speculating assaults, adjustment assaults, and taken verifier assaults. Henceforth, a solid confirmation plot is required among clients and servers [12].

In another method, the proposed client validation system utilizes three sorts of cryptographic, scientific strategies and hypotheses, to be specific hash work, symmetric cryptography, discrete algorithm issue, flexible length, and the hash function being of a fixed length [12, 13]. In symmetric cryptography, session key assumes a significant job in the symmetric cryptography that in the way of symmetric cryptography, both communication parts, a customer and a server, share a session key. While correspondence is executed and the sending party utilizes a different way to encode messages transmitted over the web. The discrete logarithm is major to various open key calculations, including Diffie-Hellman key trades, computerized signature calculations, etc. the secret phrase-based client validation plot is proposed for the telecare prescription data framework. Secure Privacy-Preserving Biometric Authentication Scheme for Telecare Medicine Information Systems [14] considers the new security issues: personality namelessness and secure transmission in biometric verification conspire for TMIS.

1.1 Use of biometrics for identification

Using a biometric feature as key in a cryptographic process adds additional security to the system. It ensures the physical presence of authenticated users as it uses unique traits and is secure because of its universality. One such method was proposed using a fuzzy commitment scheme [15].

The use of fingerprints has been for security purposes for many years. A fingerprint is unique and this uniqueness depends on the various minutia points. For using the fingerprint data for security purposes the minutia from the fingerprint images must be obtained. However, the quality of the fingerprint image obtained from the fingerprint scanner depends on various external factors like variations in skin, moisture, etc. hence before the extraction of minutia, the images have to be enhanced to obtain more dependable minutia locations [16].

A fingerprint is mainly composed of furrows and ridges. These furrows and ridges present a significant amount to the similarity in a small local window. However, the fingerprints cannot be differentiated by the ridges and furrows but by minutia points which a point on the ridges. Instead, the set of two different types of points are considered while extraction of minutia points. These include ridges endings and bifurcations.

Ridge ends are the points where the ridge curve terminates and where ridge separates to two different paths at a Y junction is a bifurcation. Figure 1 illustrates an example of a ridge ending and a bifurcation.

1.png

Figure 1. Ridges and valleys of fingerprint

In the following example above, the black pixels are the ridges, and the white pixels are the valleys.

3.1 Advanced encryption standard

Advanced encryption standards (AES) [17, 18] is one of the most commonly used cryptographic methods for securing sensitive information. It uses a block cipher algorithm to ensure that data can be stored securely.

In the proposed method, Jorg and Buchholz's cipher is utilized and being used for the implementation of AES.

1. It makes use of a password as the plain text. The password is 16 bytes transformed for the encryption and decryption algorithm.
2. The key is generated using the minutia points obtained from the biometric fingerprint. The key is also of 16-byte length. The AES initialization function is shown in Figure 5 [19].
3. The AES_init module has several sub-components like s_box and inverse s_box generation. RCON generation function is used for the key extension.
4. In the (10 x 4) matrix generated, the first column contains an 8-bit binary presentation of the power of 2.
5. The key expansion function takes the key generated from the fingerprint and uses the previously obtained matrix in the RCON function and s_box to develop a key schedule which is 176 bytes long.
6. The row-wise arrangement of a circulate matrix can be achieved using the function by calling a sub-function ‘cycle’. The cycle performs a right-shift to the previous row of a (4 × 4) matrix.
7. The ciphering function takes expanded key, s_box, o, and polymath function from aes_init function and plaintext as input.

Some of the key steps involved are:

• Add round key: It is the XOR between the round key and state matrix.
• Sub-bytes: Performs Exchange using the S_box.
• Shift-rows: All the rows of state matrix is transformed into the left cyclically.
• Mix-columns: The New state matrix is calculated by multiplying the polynomial matrix P and the state matrix S.

S'=S.

5.png

Figure 5. AES_init

• The client provides a fingerprint and a password.
• The fingerprint is converted to in the specific key and the password is the plain text. These are given in the aes_init function to obtain the cipher.
• The cipher obtained is matched with that stored in the client database.
• The match is found the client is verified and the medicine is delivered, else any access is denied.

The expanded accessibility of lower-cost broadcast communications frameworks and modified patients checking gadgets makes it conceivable to make the benefits of telemedicine straightforwardly into the home of the patient. These telecare medicine information systems allow healthcare delivery services. A protected verification plan will be required to accomplish the objectives of protecting the patient’s privacy as well as making sure that he/she gets the correct medical services according to the need. Our research argument thus sums up a better and enhanced way of security features by taking the client’s demographic and biometric details and then processing these via certain encryption methods and finally storing them in a relational database. Hence in this way, our proposed algorithm can conclude a secure online based medicine delivery system. A lot of research is to be done in this respect to make the entire system more secure and reliable.