Wireless body area networks (WBANs) can enable e-health applications under Internet of Things (IoT) scenarios. However, to use WBAN technologies in practical applications, sensitive data collected by wireless sensors must be protected when transmitted across a network and until accessed by authorized applications or end-users. Specifically, it is necessary to provide confidentiality, integrity, authentication and access control in WBANs. This paper presents a security approach to provide these security services in a layered WBAN system using lightweight cryptography. Layer 1 consists of the communication between the sensor nodes and the base station (data acquisition); Layer 2 involves the communication between the base station and a data repository (data storage); and Layer 3 deals with the communication of end-users to the repository (data access). In the past, security has focused only on Layer 1 and for limited security levels. In this paper, security concerns in the three layers of a WBAN system are studied and addressed. As primary contributions, the design details of a secure WBAN system prototype and the impact of lightweight cryptographic engines on the performance of the primary use cases in the WBAN system are highlighted from data acquisition until data use. We present a novel WBAN system prototype that ensures most of the required security services for standard security levels.