NFC-based Asset Management for Medical Equipment

Transcription

1 NFC-based Asset Management for Medical Equipment Nikhil Shetty, Hani Ragab-Hassen School of Mathematical and Computer Sciences Heriot-Watt University {ns323, Abstract Asset management is important to all modern organizations. It becomes critical when assets are equipment on which lives depend. The development of communication and wireless technologies, such as the new Near Field Communication (NFC) has opened new doors for efficient asset management. Store managers and keepers can now use mobile lightweight devices for asset management. In this paper, we propose and implement the first NFC-based mobile asset management solution for medical equipment. Our solution provides a unique security feature that allows immediate detection of tampering with any equipment s description. Furthermore, we critically review existing works and compare them to our solution and show its efficiency. Keywords NFC; Asset Management; RFID. I. INTRODUCTION The British Standard Institute defines Asset Management System (AMS) as a systematic and coordinated activity and practices through which an organization optimally manages its assets and their associated performance, risk and expenditures over their lifecycle for the purpose of achieving organization strategic plan [1]. A survey conducted by Katicic et al. reviewed the asset management practices in nine organizations [2]. It revealed that only one out of the nine organizations had embraced asset management systems. It was also noticed that none of the companies had an asset management system in place. They also stated that an asset management system is important to an organization not only for decision making but also to improve the life span of the asset. Asset management can improve the performance of the asset as well as increase the organization s revenue [3]. Traditionally, assets were managed using registers that comprise lists of all the details of a certain asset and the registers were maintained by the finance department. This assists an organization to track the whereabouts of an asset. Modernizing these registers was a tedious task [4], [5]. With the evolution of technology and the increased importance of asset management, several new technologies have been introduced in asset management, including Radio-frequency identification (RFID) and Near field communication (NFC). In this paper, we review the use of RFID and NFC technologies for Asset Management Systems (AMS). Then, we present and discuss the design and implementation of a new NFC-based solution. Our solution allows storekeepers to track and monitor medical equipment using an NFC reader that can communicate with NFC tags placed on the equipment. Our solution also implements a unique security feature, based on asymmetric cryptography, that detects any malicious or accidental tampering with the equipment s tags. We implemented the proposed asset management system as an android application, so users can manage assets using an android smartphone. The application architecture defines three main components: NFC readers, used by system users (store manager, or storekeepers); NFC tags, placed on equipment (and the equipment can be borrowed by employees/custodians); and a database that stores information about equipment, storekeepers, and custodians. The NFC reader we used during the development of our application is an android smart phone. The application implements several operations such as adding a new asset, deleting an asset, looking up an asset s information (by scanning it and looking up its records in the database), checking-out an asset (when borrowed), checkingin an asset (when returned), adding storekeepers, and adding custodians. The application also offers two security features, namely asset integrity check and secure login. Asset integrity check allows a storekeeper to make sure that a tag has not been tampered with. Storekeepers have to login using their username/password before they can start performing any action. This paper is organized as follows: section II reviews important asset management proposals, and we present our system in section III. In section IV, we critically review the existing systems and compare them to our proposal. Section V concludes our work and gives future directions to improve it. II. RELATED WORKS Most of the asset management systems rely on either RFID (sometimes combined with barcodes) or NFC. In this section, we review the basics of RFID and NFC technologies and how they were implemented in asset management proposals. It is important to note that all the proposals, except one, were proposed for non-medical applications, which shows the importance of our work. Radio Frequency identification or RFID enables users to identify objects using radio waves. There are three types of RFID tags: passive, active and semi-passive. Passive tags do not require their own power source, therefore reading of assets /15/$ IEEE 254

2 is limited to short distances. Active tags on the other hand have their own power source, thus increasing the range of reading active tags. These tags also cost more than passive tags [6]. Semi-passive tags combine the features of active and passive tags. NFC was designed by Sony and NXP (Philips Semiconductors) [7]. An NFC device has two communication modes, namely passive mode and active mode. In passive mode, an NFC device generates a magnetic field that powers up an NFC tag or card [8]. The speed at which data are transferred ranges from 106 kilobyte/second to 424 kilobyte/second at a distance of 10cm [9]. In the active mode, both NFC devices have their own power sources to power up the respective NFC modules [8]. An advantage that active mode has over passive mode is that an active NFC device can operate at a distance of 20cm and the speed of data transfer is more than 1 megabyte/second [9]. The introduction of NFC on mobile devices has opened new business opportunities like mobile payment, smart media and transport ticketing and improved end-users experience [10]. In the rest of this section, we review important RFID and NFC-based asset management systems, both theoretical proposals and implemented commercial solutions. Carmel et al. proposed an asset management system that uses Active RFID tags to track assets and 2D barcodes to manage assets [11]. The system was developed to improve patients safety in hospitals. The system used Active RFID tags to monitor the movements of the assets using a web console. The concern with this system is that 2D barcode should be manually tracked using a 2D barcode reader. Liu et al. [12] proposed an asset management system for medical laboratory devices. The system uses Ultra High Frequency (UHF) RFID. UHF RFID readers can read an RFID tag at a distance of 3m. This system focused on managing equipments in laboratories to reduce human errors when tracking equipment. The system uses a Fixed RFID reader and a mobile RFID reader. RiBOMs is an object management system that was proposed by Iraola et al. [13]. The system uses a smart glove to track objects. The smart glove has an RFID reader and a Bluetooth chip which transfers the object identity to an android device. The android device provides the user with information about the object along with its location. When the user wants to add a new asset, they place an R Tag (RFID tag) on the asset and, with the help of the android application, they enter the name, followed by the picture of the asset as well as its location. This information is then assigned an object Identifier and stored in an XML file on a smartphone. The object identifier is passed onto the smart glove which writes it to the R Tag. The XML file can be edited manually if need be. In [14], Crowl proposed a low cost RFID Asset Management System which allows users to track assets using a pocket PC. The system allows users to manage assets, which includes features like adding, retrieving, and searching assets using the Pocket PC. The system stores all the information of the assets in a MySQL database. This implementation was not successful due to technical issues. MiQ is a system that uses RFID and GPS to track assets locations [15]. The system also uses different sensors combined with RFID to inspect the asset condition. MiQ was demonstrated in a food supply outlet that delivers lunch boxes. Each lunch box has a sensor that provides updates related to the lunch box like its temperature and location. The status of the lunch box is retrieved by scanning the RFID tag using a PDA. This allows the end user who receives the lunch box to identify when the food was deemed unfit. Since this system uses active RFIDs the power of the battery tag will be drained as it used by different sensors. Redbeam asset tracking software [16] allows users to track fixed assets using both RFID and barcode with the aid of a desktop PC. Information related to the asset such as the barcode ID, the location of the asset, and the date the asset was purchased are stored in a central database. The assets can be tracked by the user either with the aid of a barcode device connected to a desktop, a Mobile Scanner, or RFID Reader. Redbeam synchronizes the database between the PC and the Mobile Scanner or the RFID Reader. Wasp [17] is an android based asset management system that uses barcode technology. The application allows users to scan barcodes in order to track the assets. It also allows to take pictures of an asset and store it in a in a centralized database. This system is similar to RedBeam. RadiantRFID [18] is an RFID asset management system that uses RFID readers or RFID based stations for tracking assets. The solution can use both active and passive RFID tags. Some of the features supported by the system are asset monitoring and reporting. This system can also be accessed from a smart phone device. Additionally the system can be integrated into an ERP system. RFID4U is a solution provider who proposed an RFID asset management system that uses RFID and barcode for tracking assets [19]. The system allows a user to track multiple RFID tags at once; it notifies the user when an asset is moved. The system can be accessed by a mobile device to monitor the location of an asset. AssetTrack is an asset tracking solution that allows users to track assets in real time [20]. The system makes use of RFID and barcode to track assets. The system integrates Google maps, allowing users to track the location of an asset. Alerts are provided to users through whenever an asset is moved. MapYourTag [21] is a cloud based asset management system that allows users to track and manage assets either by barcode, NFC or QR code. The system uses google maps to identify the location of the asset. The system can also be accessed using a smart phone to provide regular updates of the assets; this is only possible in the presence of Wifi or 3G connection. Alternatively, the user can track an asset by barcode and QR code by simply scanning its sticker using the smartphone camera. Ginstr provides an asset Location manager solution that uses barcode, QR code and NFC for tacking assets [22]. The application allows users to track the whereabouts of the asset and also provides the location of the asset using GPS. The system can be accessed from a smartphone or a desktop PC. The location management system is monitored to detect 255

3 database tampering. Users must be authenticated before being able to use the system. inviu NFC-tracker allows users to track assets using a single smartphone [23]. The user will need to enter their user name and password to access a remote server. The remote server hosts the asset tracking and management software. Users have to register their smartphones with the remote server before they can use them. There are a few NFC-based asset management proposals compared to RFID. This is mainly due to the fact that NFC is a very recent technology. In the next section we present our NFC-based solution. A. Description III. OUR PROPOSAL We propose a new NFC-based asset management system for medical equipment. The system was developed after investigating several asset management systems, both commercial products and theoretical works. Our system implements the following operations: 1) Add/delete/update assets: a storekeeper can perform these operations using their handheld NFC reader. Additions and modifications of assets are automatically replicated to a central database. 2) Lookup an asset s data: gives the storekeeper the possibility to retrieve an asset s data from the database by simply scanning its tag. 3) Checkout/Issue equipment: storekeepers can lend equipment to medical staff (custodians) and record this to the database using their NFC reader. 4) Check-in/Return equipment: a custodian can return an item to a storekeeper. The storekeeper records this to the database. 5) Detect tampering with asset tags: storekeepers can scan NFC tags and detect any modifications of its content. 6) Secure login: storekeepers have to login from the NFC reader (smart phone) before they can perform any of the above operations. In the rest of this section we describe our system. In III.B, we describe the design of the security features of our system. In III.C, we define the different entities in our system and how they interact to carry out the operations described above. We briefly describe some of the important implementation details of our system in III.D. B. Security Tampering with tag data is a major threat to any asset management system. Indeed, modifying the tag data of an expensive piece of equipment (e.g. by substituting its description by a cheaper item s one) would lead to substantial financial losses. In the case of medical equipment, data tampering could have deadly effects as modifying an item s description would lead to misuses that could results in deaths. This is why our system provides a data integrity feature that prevents modifications of tag data. We use digital signatures to detect any modification of tag data. Digital signatures are based on asymmetric cryptographic encryption. Asymmetric encryption uses two mathematically related keys: a private key held by the key pair owner, and a public key shared with everyone the key owner wants to communicate with. When either key is used to encrypt, only the other one can be used to decrypt. In our design, the private key is held by the central database machine, and the public key is installed on each NFC reader. A digital signature of a document is the result of encrypting its hash using the private key of the signer (database). The verification of a signature can be done by anyone who has the public key (NFC reader). Verification consists in decrypting the signature and comparing decrypted hash to a fresh hash computed on the document. We use digital signatures as follows: before storing a new asset s tag data into the database, the data will be signed using the database s private key. Then the signature will be stored in the new asset s record in the database. A copy of this record (including the signature) is stored on the NFC tag. A similar process is triggered each time an asset s data has to be modified. When a storekeeper wants to check the data integrity of a tag, they scan the tag, get the tag s data and the signature on them, and then verify the signature as explained previously. This would detect any data tampering. Another possible threat is swapping NFC tags (e.g. between an expensive and a cheap item). We prevent this threat by adding a picture and a description of the item to its stored data. The picture and description are digitally signed with the rest of the asset s data; modifications of them are easily detected. Our system provides a secure login feature as well. Secure login will described in the next section. C. System Architecture Figure 1 depicts our system architecture. Our system defines several entities and defines their interactions. The entities are: Custodian (Employee): is an individual who wants to borrow an asset (e.g. some medical equipment) from a store. Storekeeper (User): is someone who is authorized by the store manager to perform operations on the assets; this is our system s user. A storekeeper can perform activities like add, view, and lookup asset details. NFC reader: this is the device used by the storekeeper to scan NFC tags and write to them. In our implementation, we used an Android smartphone. Database: Is where the details of assets, storekeepers, and custodians are stored. It also keeps record of custodians who borrowed an asset. Assets: are the resources that are managed by our system. A storekeeper can hand an asset over to a custodian for their use. The asset details are stored in the database. 256

4 Fig. 2. Adding an Asset Fig. 1. Architecture of Our System Tags: are used to identify an asset. These tags are placed on the equipment. An asset has one and only one tag. Now that we have identified the system entities, let s discuss how they interact in order to perform different operations. Our system allows storekeepers to perform the following activities: 1) Adding an Asset: A storekeeper can input a new asset s information into the system. The storekeeper has an interface where they can input the data then save it to the database. The storekeeper adds the details of the assets using the NFC reader as shown in figure 2. The data is saved to the database and a digital signature is associated with the asset as explained in III.B. The digital signature is then stored to the NFC tag. The signature allows the detection of any modification of the tag. 2) Looking up an Asset: A storekeeper can get the information of an equipment by scanning its tag as indicated in figure 3. The storekeeper can lookup an asset by passing their smartphone over the NFC tag. On doing so it will read an asset identifier which is then queried from the database. On successful completion, the storekeeper will be provided with the asset s information such as its description, its picture, when it was purchased, and to whom it was handed over to. 3) Deleting an Asset: Allows a storekeeper to remove an asset from the system. When an asset is deemed nonfunctional, the storekeeper can delete the asset from the system using an interface on their NFC reader. 4) Issuing (Checking out) an Asset: Using this operation, a storekeeper can record that an asset has been borrowed by a particular custodian. As shown in figure 4, the storekeeper scans the tag to get its data. These are automatically sent Fig. 3. Lookhing up an Asset to the database and checked for data integrity, and then the storekeeper inputs the identity of the employee (custodian) who borrows the item, then sends it to the database. 5) Returning (Checking in) an Asset: This operation informs the database that a borrowed asset has been returned. 6) Integrity Check: This is a security feature. It allows a storekeeper to check that an asset s tag has not been tampered with by scanning it. 7) Adding a Storekeeper (User): this operations happens at the back-end database by the database administrator without the intervention of the NFC reader. A new storekeeper is added and their data entered, including a user name and a password they use later whenever they want to connect to the database from an NFC reader. 8) Secure Login: This is a security feature. It allows a storekeeper to securely connect to the database using their user name and password. The login process is shown in figure 5. The storekeeper s user name and a hash of the password are sent encrypted using 257

5 We developed our system using Android Studio with JAVA, XML, and MySQL for the database. We used NTAG213 NFC tags and placed them on the assets. NTAG213 tags are compatible with most smartphones, which widens the range of devices that could be used as NFC readers. Fig. 4. Issuing an Asset the public key of the database so only the database can decrypt the storekeeper s information. A timestamp is sent along with the user name and password to prevent replay attacks. Fig. 5. Storekeeper Login 9) Adding a Custodian (Employee): This allows a storekeeper to enter the details of a custodian on their NFC reader. Custodians can be directly added by the database administrator as well. D. Implementation We implemented our system as an Android mobile native application. A mobile application, aka app, is a piece of software that runs on a mobile device, such as a smartphones [24]. A native app is an applications that works on a specific mobile platform and takes advantage of the built-in resources available on the platform, such as camera, Bluetooth, GPS (Global Positioning System), native application have the ability to run offline. Native apps are developed in Java, Objective-C or C# [25]. Native mobile applications can be acquired from the play store for the Android, Apple store for iphone and windows marketplace for the Windows phone [25]. IV. DISCUSSION After reviewing several asset management systems, we found out that most of them used active RFID to identify assets. The systems we analysed were mostly for large enterprises, and some of them used RFID base stations to track assets. These base stations required additional configuration to coexist with the systems in place. The main concern with RFID systems would be their relatively higher cost. For example, in [14], the authors stated that the cost per one of their RFID readers was $2199. NFC readers on the other hand cost a few hundred dollars. But after reviewing the existing works we realized that very few used NFC despite the fact that NFC readers are being massively produced and shipped inside most of new high-end smartphones. This phenomenon could be justified by the fact that NFC is quite new and also the fact that is has a limited range compared to RFID. We chose to use NFC passive tags as they are considered safer than active ones (and all the other NFC-based solutions we mentioned used NFC passive tags too). We used the NTAG213 model as it is known to be compatible with all smartphone devices [26]. By critically analysing the security of existing systems we realized that the tags they use (both RFID and NFC) can be tampered with using an appropriate device. Furthermore, a few proposals used pictures, which could have prevented tag swapping [13], [16], [17]. But this is not the case as the tag itself is not tamper-proof and if the picture of the asset is stored on the tag, then it can be replaced by another picture and go undetected. If the picture is stored in a central file or database, it might still be possible to modify it if it is not properly protected. In RiBOMs for example [13], not only the tag can be modified, but even the XML file that serves as a database of assets does not have its own protection (which is not the case of our database as it requires administrator information before being able to access and modify its data), and it can be easily modified by a malicious person. In addition to asset, storekeeper, and custodian management, and as far as we are aware of, our system is the only one that provides an advanced integrity check feature that detects modifications of tags and database records. It is also the first NFC-based system for medical equipment management. V. CONCLUSION In this paper, we proposed a new NFC-based asset management system for medical equipment. We implemented the required operations for asset management as well as staff management. We discussed some similar works and showed their security flaws that could allow malicious individuals to modify equipment descriptions, and implemented a unique security feature that would detect such modifications. 258

6 This is the first proposal for using NFC tags for asset management in medical organization, and many things can be done to improve it. Future works can add access control to our system. Access control would request certain privileges from storekeepers before they check-out equipment, e.g. storekeeper of store 1 would not be able to issue an asset that is in store 2. Another possible direction to investigate is the integration of our system into ERP systems used by medical organizations. REFERENCES [1] B. PAS, 55-1: Asset management. part 1: Specification for the optimized management of physical assets, British Standards Institution, [2] L. Katicic and Z. Lovrincevic, Corporate asset management and survey in croatian companies, in Asset Management Conference 2012, IET IAM, Nov 2012, pp [3] M. Shoab, K. Jain, and M. Shashi, Development and implementation of web service for logging and retrieving real time train location information, IJSCE) ISSN, pp , Nov [4] B. Yang and P. Liu, Value added on integrated solution of rfid enhanced asset traceability system, in Service Operations and Logistics and Informatics (SOLI), 2010 IEEE International Conference on, July 2010, pp [5] R. Best, C. A. Langston, and G. De Valence, Workplace strategies and facilities management. Routledge, [6] S. Shekhar and H. Xiong, Encyclopedia of GIS. Springer Science & Business Media, [7] Nfc-world.com, NFC Portal site About NFC, , [Online; accessed 28- Jun- 2015]. [8] T. Igoe, D. Coleman, and B. Jepson, Beginning NFC: Near Field Communication with Arduino, Android, and PhoneGap. O Reilly Media, Inc., [9] H. Kunkat, NFC Development & Consulting, , [Online; accessed 30- Jun-2015]. [10] Nfc is the double-click in the internet of the things, in RFID Systems and Technologies (RFID SysTech), rd European Workshop on, June 2007, pp [11] I. Mun, A. Kantrowitz, P. Carmel, K. Mason, and D. Engels, Active rfid system augmented with 2d barcode for asset management in a hospital setting, in RFID, IEEE International Conference on, March 2007, pp [12] Z. Liu, J. Yi, C. Chen, C. Gu, and T. Fan, Development of a management system of laboratory equipment based on uhf rfid, in Information Science and Engineering (ICISE), nd International Conference on, Dec 2010, pp [13] H. Iraola, J. Schafer, X. Yu, G. Mullett, and A. Ganz, Riboms: Rfid-based object management system for home environments, in Engineering in Medicine and Biology Society, EMBC, 2011 Annual International Conference of the IEEE, Aug 2011, pp [14] S. Crowl, Low cost radio frequency identification asset management, in Engineering Management Conference, 2007 IEEE International, July 2007, pp [15] T. Zhang, Z. Luo, F. Zhou, and X. Yang, Developing a trusted system for tracking asset on the move, in Young Computer Scientists, ICYCS The 9th International Conference for, Nov 2008, pp [16] Asset Tracking Asset Management Software from RedBeam, , [Online; accessed 30-Jun-2015]. [17] Fixed Asset Tracking Software - Asset Management Systems - Wasp Barco, , [Online; accessed 30-Jun-2015]. [18] RFID Solutions - Radiant RFID, , [Online; accessed 30-Jun-2015]. [19] Asset tracking - asset tracking solution rfid pos system, , [Online; accessed 30-Jun-2015]. [20] TrackX RFID Solutions for Asset Tracking and Supply Chain Management, , [Online; accessed 30-Jun-2015]. [21] MapYourTag Asset Tracking Software from your smartphone, , [Online; accessed 30-Jun-2015]. [22] Ginstr Asset Location Manager mobile business app, , [Online; accessed 30-Jun-2015]. [23] inviu NFC-tracker, Dateien/pdf/Datenblatt/nfc-tracker/englisch/inViu NFCtracker data sheet.pdf, 2015, [Online; accessed 30-Jun-2015]. [24] Techopedia, What is a Mobile Application? , [Online; accessed 28- Jun- 2015]. [25] R. Budiu, Mobile: Native Apps, Web Apps, and Hybrid Apps, , [Online; accessed 10- Mar- 2015]. [26] NFC Tags Mifare Classic Compatibility Issue - Nexus 4, Galaxy S4, , [Online; accessed 18- Jun- 2015]. 259