As novel healthcare paradiagm, smart healthcare can provide more efficient and high quality medical services for patients. However, smart healthcare needs patients to share their physiological information for online diagnoses, if the data sharing system of smart healthcare lacks effective security mechanisms, these sensitive information might be abused by illegal or malicious users. Moreover, smart healthcare needs to confront some brand-new challenges, such as resource-constrained IoT things, identity theft attacks and insider attacks. To tackle these problems, we propose a SDN-based security enforcement framework for data sharing systems of smart healthcare. In our framework, each patient has a dedicated virtual machine in data sharing system, each virtual machine provides a group data services which can be released to those authorized service consumers or IoT things. In additon, virtual machine is protected by the SDN-based gateway which provides a firewall mechanism and guarantees only authorized things can access patient’s virtual machine. Since each thing has a unique MAC address, thus our framework can effectively authenticate resource-constrained IoT things and tackle the problems caused by identity theft. To validate the effectiveness and feasibility of our framework, we implement an experimental system using POX controller and Mininet emulator. The experimental results illustrate our framework is effective under different test scenarios. As increasing the scale of information flow model, the framework can still work well and its performance can be still acceptable.

中文翻译：

---

基于SDN的智慧医疗数据共享系统安全执行框架

智慧医疗作为新型医疗保健范式，可以为患者提供更高效、更优质的医疗服务。然而，智慧医疗需要患者共享生理信息进行在线诊断，如果智慧医疗的数据共享系统缺乏有效的安全机制，这些敏感信息可能会被非法或恶意用户滥用。此外，智慧医疗还需要面对一些全新的挑战，例如资源受限的物联网事物、身份盗用攻击和内部攻击。为了解决这些问题，我们为智能医疗的数据共享系统提出了一个基于 SDN 的安全实施框架。在我们的框架中，每个患者在数据共享系统中都有一个专用的虚拟机，每个虚拟机提供一组数据服务，这些服务可以发布给那些授权的服务消费者或物联网事物。此外，虚拟机受到基于SDN的网关的保护，该网关提供防火墙机制并保证只有授权的东西才能访问患者的虚拟机。由于每个事物都有唯一的 MAC 地址，因此我们的框架可以有效地验证资源受限的物联网事物并解决身份盗用问题。为了验证我们框架的有效性和可行性，我们使用 POX 控制器和 Mininet 模拟器实现了一个实验系统。实验结果说明我们的框架在不同的测试场景下是有效的。随着信息流模型规模的增加，该框架仍然可以很好地工作，其性能仍然可以接受。