Utilize Common Criteria Methodology for Secure Ubiquitous Healthcare Environment

Abstract

RFID technology is widely used in healthcare environments to ensure patient safety. Therefore, the testing of RFID tags, such as performance tests and security evaluations, is necessary to ensure inter-operational functional compatibility with standards. A survey of the literature shows that while standards that are around RFID performance tests have been addressed, but the same is not true for security evaluations. Therefore, in this paper, we introduce the Common Criteria security evaluation methodology, also known as ISO/IEC 15408, for the security evaluation of RFID tags and propose a framework as a minimal requirement for RFID tags to improve security assurance.

Proposal and Validation of a Standard Protection Profile for Homologation of Commercial Videoconferencing Equipment

“…The previous research works proposing CC-based information security [27,28,29,37,38,49,51,53,35,56,57,58] report reaching EAL 3, just as we did. Our research brings one more CC application to the set of desktop computer certification [27] applications: Radio Frequency Identification (RFID) technology [28], biometric system [29], smart meters [49,51], integrated voice, data, and video communications [37,38], boots, sealing, and IT channels [57], Point-of-Sale (POS) systems, wind turbine park systems, and a secure workflow [56], personal computer [58], electronic voting system [55], SDN switches and controllers [59]. Only [51,57] report having reached EAL 4 or 5.…”

“…The research efforts of Hou and Yu [28] and Fernandez-Saavedra et al [29] are also close to the work carried out here since they used Common Criteria to evaluate information systems security. Hou and You [28] evaluated the use of Radio Frequency Identification (RFID) technology in a medicalhospital environment. Simultaneously, [29] assessed a biometric system, and both used literature review and best market practices for gathering the assessment criteria.…”

“…That is, it can be used in several IT products; -It enables comparison of independent security assessment results as it presents standard requirements related to the security aspect of IT products (hardware, software, or firmware). As presented in our literature analysis, CC has also been widely used for information security in companies and academia [27,28,29,49,51,53,35,56,57,58]. Institutions in the United States and Europe [36] already consider this critical assessment of security requirements in their products, especially in systems regarded as essential infrastructure (e. g. data communication links in aviation systems, satellite communication).…”