A Key Management Framework to Secure IoMT-enabled Healthcare Systems

The transformation of the healthcare sector through the adoption of the Internet of Medical Things (IoMT) provides major benefits, including the ability to provide efficient and timely medical support based on accurate continuous monitoring data. However, the necessity to collect, store, and process private medical data in order to provide a patient with these healthcare services may clash with regulations such as the General Data Protection Regulation (GDPR). In this article, we introduce a complete key management framework for an IoMT patient monitoring system. The key management framework is composed of a platform key management layer which establishes ad-hoc, point-to-point secure channels between devices in the IoMT system, and of a data key management layer which provisions keys for end-to-end encryption of patient data. The cornerstone of the design is that it empowers the patient to enforce their own privacy rights by making them the legal owner of their own private medical data and that interested parties must be granted consent in order to access this data. To the authors' knowledge, this is the first time that consent granting of GDPR is hardwired into technology.