Access Control for Medical Devices: Tweaking LCap for Health Informatics

Smart hospitals differ from other IoT environments like smart factories or smart homes, as their devices are particularly heterogeneous regarding their power budget, computational power, and security requirements: Devices range from wall-powered, computationally capable smart TVs all the way down to implanted, battery-powered medical screening devices. Thus, access control in Health Informatics needs be highly efficient and scalable, while remaining flexible enough to adequately address the heterogeneous security requirements. Among the most promising work on access control is CBAC. However, all prior work employed asymmetric cryptography to sign capability tokens, which prevents its use on the most constrained devices. Previously we proposed the Lightweight Capability Based Access Control (LCap) [1] that overcomes this restriction by using symmetric cryptography. In this paper, we discuss the limitations of LCap and propose modifications to overcome them. Our evaluation of the enhanced LCap shows, that its impact on response time is insignificant and its computational overhead is moderate. This allows the deployment of LCap even for the most constrained devices in Health Informatics.