Using e-coins to ensure fair sharing of donor funds amongst HIV healthcare facilities

Transcription

1 Research Artice SACJ, No. 47., Juy Using e-coins to ensure fair sharing of donor funds amongst HIV heathcare faciities Martin S Oivier, JHP Eoff, Hein S Venter and Mariëtte E Botes University of Pretoria, Pretoria, South Africa martin@mo.co.za, eoff@cs.up.ac.za, hventer@cs.up.ac.za, mariette@mo.co.za ABSTRACT Donor funds are avaiabe for treatment of many diseases such as HIV. However, privacy constraints make it hard for donor organisations to verify that they have not sponsored the same patient twice or sponsored a patient whose treatment was aso sponsored by another donor. This paper presents a protoco based on digita cash that enabes donor organisations to obtain a proof (in the form of an e-coin) from heathcare providers for patients such a provider caims to have treated. These coins are distributed to patients at the beginning of a funding cyce. The major chaenge is to issue a unique coin to a patient even if the coin is reissued. This is achieved without giving anyone access to a nationa database of identities; a databases contain effectivey conceaed information. Reissued coins wi be identica to previous coins with a probabiity that can be decided beforehand. CATEGORIES AND SUBJECT DESCRIPTORS: KEYWORDS: Medica appication security, privacy, digita cash 1 INTRODUCTION For goba pandemics, such as HIV, donor funds are often made avaiabe by various bodies. In the case of HIV funds have been made avaiabe by the Word Heath Organisation (WHO), the US president (PEPFAR, President s Emergency Pan for AIDS Reief), various nationa governments, private foundations and other bodies. Usuay heathcare providers who treat patients have to justify their share of such donor funds by reporting on the number of patients that they have treated with funds aocated to them. Such reporting is not simpe: HIV is the paradigm case for privacy, and providing donors with the identities of patients treated is not acceptabe. In fact, if one uses identity as the basis of such reporting it wi be necessary to provide each donor with identities of patients treated with funds from other donors as we; this woud enabe them to verify that a heathcare provider has not caimed for treatment of the same patient from mutipe donors. This impies that the HIV status of patients have to be discosed to donors with whom they have no reation at a. In earier work [1] we proposed an architecture that used a trusted third party to address the atter probem. However, the trusted third party now had access to a database of identities and the HIV status of each. It is we known that such arge databases with sensitive information form a prime target for attack. In this case the database may have vaue for unscrupuous empoyers, ife insurers, and other parties who may gain from misusing the information. This paper considers an aternative strategy to enabe heathcare providers to caim

2 48 Research Artice SACJ, No. 47., Juy 2011 donor funds that obviates the need for a arge nationa database and does not discose the identities of patients to donors. Yet, it ensures that donors wi ony pay for patients actuay treated. Seen more abstracty, the paper proposes a protoco that wi partition a set of peope in a way that neither the eements of the origina set, nor the eements of any given partition can be determined. However, the sizes of each of the partitions can be determined. The strategy proposed in this paper is based on the use of eectronic cash (or digita cash). We wi refer to the tokens to be used as eectronic coins (e-coins). At the point where a doctor determines that a patient quaifies for treatment under a sponsored program, an e-coin wi be issued to the patient. This e-coin wi then be presented to the heathcare provider (typicay a hospita or cinic) in exchange for treatment. New coins may be required (and issued) on a periodic basis (eg annuay) to ensure that the coins of patients who are no onger treated cannot be used ad infinitum. The heathcare providers then tender the coins to donors for payment (or justification of earier payment). The coins used in this appication are simiar to coins used for e-commerce in some respects. One obvious requirement is that coins cannot be spent twice one heathcare provider shoud, for exampe, not be abe to caim for the same patient s treatment twice. Neither shoud two heathcare providers be abe to caim for the same patient. Note that HIV is treated as a chronic disease, and the number of doctor visits cannot necessariy be predetermined for a given period. The intention of a coin is not to pay per visit, but to cover treatment for the entire sponsored period (incuding the reevant drugs). In other respects the coins envisaged in this appication are quite different from coins used esewhere. In the case of e-commerce a customer may request as many coins as he or she wishes; the vaue of each coin is simpy deducted from his or her bank account when requested. In the current appication one cannot have an account for each patient, since such an account wi impy that the identities of patients who quaify for treatment are stored in some database contrary to the premises of this paper. Besides our earier work on this topic [1] we are not aware of any other research that has addressed this probem. The remainder of the paper is structured as foows. Section 2 considers the threat and trust issues that we assume for the purposes of this paper. Section 3 then reviews the we known operation of e-coins and considers the modifications that need to be made to effectivey use the coins in the new environment. The significant change that has to be made to a standard e-coin protoco is the requirement that subsequent coins shoud be identica to coins issued earier because funds can ony be caimed once from a donor for any given patient. Section 4 considers the suitabiity of the proposed protoco given the threats that were identified earier. Section 5 revisits the need to identify patients anonymousy. It is found that a suitabe identification scheme depends on the soution of a statistica optimisation probem. Section 6 concudes the paper. 2 THREATS AND TRUST E-coins in this appication are worth (donor) money. Hence it has to be ensured that such coins cannot be fasified, coned successfuy or spent twice. Since privacy is at stake, it shoud not be possibe to infer the identity of the patient from the coin. It wi be argued beow that it shoud aso not be possibe to identify the identity of the certifying doctor from the coin. In a typica e-coin appication three parties are invoved: The customer requests the coin from the bank and sends it to the merchant. The merchant then exchanges it for cash at the bank again. In the medica environment five parties wi be invoved. The doctor (D) wi request the coin from the bank and hand it to the patient (P). The patient wi then exchange it at the heathcare provider (H) for treatment. The heathcare provider wi then send it to the donor organisation (O) who wi fund (or has funded) the patient s treatment. The donor

3 Research Artice SACJ, No. 47., Juy wi present the coin to the bank to indicate that it has been spent. We assume mutipe instances of D, P, H and O, but ony one bank B. 1 Of prime importance is the privacy requirement. It is assumed that the doctor knows the patient s identity and medica information. (It wi be simpe to modify the presented scheme for anonymous diagnosis and treatment, but we do not consider it in this paper primariy due to medica compications that may resut from such an approach.) It is assumed that the heathcare provider cannot infer the patient s detais from the coin. Typicay the financia staff at the heathcare provider dea with caims supported by coins, and they do not need access to cinica information. (In practice it may be assumed that many heathcare providers wi know the identities of their patients, but this does not make a significant difference to the proposed scheme.) It is an absoute requirement that neither the bank nor the donor organisation shoud be abe to determine the identity of the patient. The primary monetary concern in the process is the dishonest heathcare provider who wants to obtain more coins than patients treated to exchange for donor funds because the heathcare provider is the ony party who can directy gain financiay from rea money in this process. (The doctor, patient and bank are not in a position to caim donor funds according to the current assumptions.) This impies that the heathcare provider shoud not be in a position to generate coins. Once this has been met, four financia threat scenarios remain: 1. Where the heathcare provider coudes with the doctor; 2. Where the heathcare provider coudes with the bank; 3. Where the heathcare provider coudes with a patient; and 4. Where stoen coins are used by the heathcare provider. 1 In principe the donor may act as bank, but this woud require the doctor to choose the donor for every patient; a singe centra bank enabes the doctor to obtain coins that may then be used to treat the patient using whatever donor funds are avaiabe. The first option (cousion with the doctor) wi not be treated as a significant threat in the current paper. This assumption is based on the professiona status of the doctor. To address the issue of dishonest doctors, it is assumed that it shoud be possibe to audit the doctor s actions to ensure that no fase coins were authorised by the doctor. This is in ine with society s trust in doctors to prescribe medicine that may be sod on the back market at high prices; if this trust is vioated it has dire consequences for the doctor, and cases of such vioations are reativey scarce. The second option (cousion with the bank) aso wi be deat with by trust. Note that the bank wi not be entrusted with private information. Therefore the bank simpy has to be trusted not to issue coins other than on a doctor s request. If suspicion exists that a bank has issued fase coins, the bank has to show that the number of coins it has issued corresponds with the number of (signed) requests it has received from doctors. The number of coins may be determined by pooing the used coins from a service providers. 2 A bank may aso cheat by informing a donor that a coin has not yet been spent, after it has, in fact, been spent, causing the donor to pay a second time for a patient that has aready been sponsored. This wi, however, be easy to detect as wi be described beow. The degree of trust paced in a bank therefore compares to the degree of trust currenty paced in a chartered accounting (or certified professiona accounting) firm. The bank is not entrusted with medica information. The third option (couding with a patient) wi ony occur if a patient is abe to obtain more than one different coin. The chaenge is therefore to ensure that the same coin wi aways be issued to the same patient, irrespective of which doctor requests it. (This wi aso dea with the issue of ost coins.) The fina probem to be considered is that of stoen coins. Ony two financia incentives exist for steaing coins and using them. The first is again in cousion with a heathcare 2 In genera the bank shoud have more signed doctor requests than this because some coins may not have been used after a.

4 50 Research Artice SACJ, No. 47., Juy 2011 provider who is abe to turn them into rea money. The second is to get access to treatment for a patient who does not quaify for his or her own coin (such as an iega immigrant who may not be accommodated in a country s medica system). The former is ony a rea threat if enough coins are stoen. Since a stoen coin can be identified when it is presented by a heathcare organisation, it is possibe to identify heathcare organisations who present many stoen coins. Hence this is not considered as a rea threat. Secondy, if eigibiity for treatment is checked at the point of treatment, stoen coins are not worth much to iega patients, and this threat wi not be considered in detai. 3 ISSUING COINS Normay digita cash is used to spend money anonymousy an idea originay introduced by Chaum [2, 3] more than two decades ago. This section wi briefy expain the origina notion as introduced by Chaum. Then it wi be adapted for the purposes of this paper to be pseudonomonous, rather than anonymous. The intention is to have a coin inked to a person s pseudonym in a way that the pseudonym cannot be transated to the person s rea identity. However, under very specia circumstances the person s rea identity can be transated to the pseudonym. In this section we wi denote encrypting a message m with the pubic key of some party X as e X (m). Decrypting the message m with the private key of X wi be denoted as d X (m ). Encrypting m with X s private key is equivaent to decrypting; hence this wi aso be indicated as d X (m). In the (simpe) usua case an e-coin is issued as foows [2, 3]: The customer (C) chooses a random number r. (r wi typicay be constrained in some way to have a recognisabe form.) C now chooses a commuting function g and its inverse g 1, such that g 1 (d X (g(x))) = g 1 (g(d X (x))) = d X (x) for any party X and any vaue x. A ack of space precudes a detaied discussion of commuting functions here; suffice it to note that such a function typicay uses a random number known ony to C and hence g is ony known to C. (For exampes see the paper by Chaum [3] again.) The customer then forms a message that incudes g(r) and requests the bank to deduct money from C s account and to sign the incuded number. The bank encrypts the vaue with its private key, which yieds d B (g(r)). This vaue is returned to C. C now cacuates g 1 (d B (g(r))). This is equa to g 1 (g(e C (r))), which is equa to d B (r). C now knows r, d B (r), which is a signed version of r. C can now send r, d B (r) to the merchant, who can easiy verify that it has indeed been signed by B. When the merchant presents this vaue to B, the bank verifies that r has not yet been presented for payment and then credits the merchant. The vaues sent between the various parties are aso encrypted to ensure confidentiaity. For the sake of simpicity this has not been shown above. Simiary messages in some cases need to be signed to ensure non-repudiation. This has aso not been shown expicity above. For more detais see the book by Wayner [4] or the paper by Panurach [5]. Whereas the protoco described above works where a bank customer is entited to withdraw as many coins as he or she can afford, it has been argued earier that each coin withdrawn for a patient in the medica system has to be simiar to a others withdrawn for that patient. An initia version of the protoco wi therefore not get a random vaue, r, signed, but some identifying vaue i. This i may, for exampe, be the nationa identity number or socia security number of the patient. However, in the protoco above, r was exposed to the merchant and bank ater in the transaction; as aready argued, the identity of the patient shoud not be exposed to the donor, bank, or (perhaps even) the heathcare provider in the medica system. A simpe variation of this protoco uses h(i) in the pace of r where h is a suitabe one-way hashing function. This, however, eads to the foowing probem (amongst others): If someone knows a the vaues h(i) that exist, and wants to know whether some individua i is in that ist, it is simpe to compute h(i ) and determine whether this individua is on this ist.

5 Research Artice SACJ, No. 47., Juy This is so because, given the number of parties who has to know h(), it is not reaistic to assume that h is secret. Note that, for h to be suitabe for the intended it has to yied hashes that are recognisabe as a being in a specia format. To do this, the simpest soution (foowing Chaum s [3] exampe) is to et h repeat a hash. That is, if h is a function that has typica good hashing properties, et h(i) = h (i) h (i) where the vertica bars indicate concatenation. Without this property it may be too easy to find just any random number that happens to ook ike a signed random number [2]. We therefore need some vaue i to use here that is unique and constant for a given individua, but that is hard to obtain without a significant amount of information about the individua. By unique we mean that the vaue is guaranteed to be different for different individuas; by constant it is meant that the information shoud not change from one moment to the next; by hard to obtain it is meant that the information shoud indeed be easy to obtain from a cooperating patient, but that it shoud not be generay known about the patient, and shoud not be easy to determine without the cooperation of the patient. One viabe option is to use a compound vaue consisting of severa subparts. The first subpart may indeed be the nationa identity number or socia security number. On its own this wi aready ensure the uniqueness of the compound number. To iustrate the quaities of other vaues that might be appended to this vaue, consider bood type. Individuas bood is grouped into A, B, AB or O groups and further cassified based on whether the Rhesus factor is present (+) or not (-). This provides eight possibe vaues, resuting in three bits that may be added to the compound vaue. Some of the good points of using such a vaue is the fact that it is easiy obtainabe by a doctor, whie it is not generay known to others. This vaue aso remains constant over time. Drawbacks incude the foowing. With ony eight combinations it is easy for a nosy party to try a brute force attack where other parts of the identifying number is known. Moreover, the we-known frequency distribution of ABO bood groups (in most environments O predominate), and the fact that the vast majority of peope are Rhesus positive, imit the search space. A further compication is brought about by the fact that bood types are not absoutey constant. A person with A bood may receive O bood during a transfusion and a test shorty after that wi determine that his or her bood is of type O. At worst this means that such an individua may be abe to obtain two coins. However, the incidence of cases where a singe bood type is not dominant is so ow that this has itte potentia for fraud remember that, as discussed above, such an individua needs to coude with a heathcare provider to derive economic benefit. The need is therefore not absoute uniqueness, but uniqueness with a high degree of probabiity. The primary probem of using bood type is the size of the search space and the fact that its frequency distribution is skewed. We propose that a combination of biometric vaues be used to address this. The biometric data is coected from the patient at the point of where the coin is to be issued. For each biometric the feature vector is extracted. The identity number with the various feature vectors added forms the identifying string. Suitabe biometrics need to be considered. Note that not ony technica restrictions appy. Fingerprints may, for exampe, be an inappropriate biometric to use given the fact that the disease considered is aready stigmatised. Since the various components of i are merey used to identify the individua and are of no concern to the various parties who pay a roe in the protoco, it is hashed and h(i) is used as the identifying vaue. Therefore no party (with the possibe exception of the doctor) wi be abe to derive these vaues. We are now ready to consider the fu protoco, which consists of a simpe appication of the digita coin protoco described earier. It is assumed that whenever a party X sends any message m to a party Y, X wi encrypt the message with Y s pubic key. Formay this may be denoted as X e Y (m) However, in this paper we wi assume that Y

6 52 Research Artice SACJ, No. 47., Juy 2011 such encryption is impied and we wi ony write X m Y We wi aso write s X (m) to denote a message m that is signed by X; therefore s X (m) = m, d X (m) In what foows we wi not indicate signed messages, except where the signing is an essentia part of the protoco. Signing most messages wi be usefu for non-repudiation purposes during auditing. However, indicating beow that each message is aso signed wi add unnecessary compexity to what foows. The protoco proceeds as foows: 1. The doctor, D, determines i for the patient, P. 2. D cacuates h(i) 3. D sends this vaue to the bank for signing; D signs the vaue to guarantee its authenticity: D s D(g(h(i))) B 4. B signs the vaue s D (g(h(i))) and returns it: B d B(g(h(i))) D Let the coin, c, now be c = h(i), d B (h(i)) = s B (h(i)) 6. D hands this signed coin to P: D c P 7. P exchanges this coin for treatment at a heathcare provider, H: P c H 8. H presents the coin to a donor organisation, O, for funding: H c O 9. O verifies with B that the coin has not yet been spent: O c B 10. B now marks the coin as spent and sends a confirmation to B s B(c, confirm) If the coin was not avaiabe it communicates this with O: B s B(c, deny) 11. If avaiabiity of the coin is confirmed, O accepts responsibiity for treating the patient: O s O(c, confirm) H Ese O s B(c, deny) 12. If approved, H commences treatment of P. As aready noted the atter part of this protoco is a straightforward extension of a standard payment protoco and it wi not be discussed in detai here. Reevant portions wi be anaysed in the next section. The protoco above has been presented such that donor funds are requested per patient to be treated. In the rea word, donor funds are often aocated and verification of patients ony occur during a ater reporting (or auditing) phase. The protoco is simpe to modify to 5. D cacuates g 1 (d B (g(h(i)))) = g 1 (g(d B (h(i)))) = d B (h(i)) submit coins to the donor on a periodic basis irrespective of when treatment commenced. It might mean that some coins wi be found be invaid if submitted after the treatment has aready commenced. If this occurs infrequenty enough it wi sti be sufficient for auditing purposes. It is expected that such cases wi be spread proportionay over different heathcare providers, and hence wi not affect the overa distribution of funds. In many cases the heathcare providers do not communicate directy with the donor organisations, but via some nationa administrative fund administrators. Again the protoco is simpe to adapt to incude such a sixth party in the fina part of the protoco. 4 ANALYSIS The primary concern raised in Section 2 was that of privacy. None of the parties besides D O H O

7 Research Artice SACJ, No. 47., Juy shoud be abe to infer the identity of P. Since h(i) forms an inherent part of c, a parties are abe to determine h(i). However, due to the one-way nature of h() nobody can compute i from h(i). Due to the compex composition of i, it is aso unfeasibe for an attacker to compute h(i) from some i and match it against the known vaues of h(i) to determine whether i is being treated (and from that infer the diagnosis of i). The secondary concern was monetary. Since ony H can access funds, either H has to forge the coin or coude with someone who can as argued in Section 2. H cannot sign coins and therefore cannot forge them. Suppose H coudes with D. It has aready been argued that professiona trust is paced in D we now have to show that a forensic audit wi indeed be abe to expose D. If suspicion arises about D, a the requests signed by D may be recovered from B. D now has to be abe to show the patient fie and demonstrate how the request for each patient was derived. Patient fies are detaied documents consisting of doctor notes, medica test resuts and, possiby, nursing notes (if the patient was treated in hospita). Moreover, specimen test resuts are inked to physica specimen resuts; bood tested for HIV is typicay stored for years by the testing aboratory. Finay, participating in fraud wi have severe consequences for D such as being barred from further medica practice. Hence cousion between H and D is addressed in the manner professiona trust is usuay deat with in society, rather than by a mathematica construct. It is based on trust that, when breached, is reativey simpe to uncover with a forensic audit. Whereas a norma bank wi not issue fake coins (because it has to convert such coins to cash ater), the bank B in this protoco may be enticed to issue such coins. We have to show as argued in Section 2 that (norma) auditing wi expose B, if B engages in frauduent activities. We assume that the number of coins cashed by donor organisations wi be a matter of pubic record (since donor organisations typicay report what has been accompished with the funds donated by it). Hence it is easy to correate the number of coins cashed with the number of signed requests received from doctors. Even if coins cashed are not a matter of pubic record, the bank can keep record of who cashed which coins. Its record of cashed coins then has to match the number of requests it had received from doctors. And it is easy to compare its record of cashed coins with any (random) donor s record of cashed coins. It is therefore possibe to subject this to annua audit (and ony to forensic audit if something is found to be amiss). Cousion between H and P has aready been dismissed in Section 2, uness enough patients are abe to obtain mutipe coins. This issue wi be considered in the next section. Note that there wi typicay be a practica imit on the number of doctors a given patient can approach for coins, because poicies typicay imit patients to visit government faciities in their own region (or private doctors where they wi have to pay for the visit and for the test). 5 ON THE CONSTRUCTION OF I In Section 3 above, three necessary properties of the identity string i were identified, namey that it shoud be unique, constant and hard to obtain. Let i consist of m components k j. In other words i = k 1 k 2 k 3... k m The uniqueness of i was ensured by choosing k 1 as the nationa identity number of the person. This section considers the other two properties in more detai. In order to be hard to obtain, mutipe components, k j (with j 2) shoud be used to construct i. Ideay these components shoud be independent so that the vaue of one cannot be derived (or, ideay, not even estimated) from another. Preferaby they shoud be chosen from a variety of domains, such as medicine, physica traits, behavioura traits and other characteristics. If ony, say, medica characteristics are used, someone with access to medica data such as a medica ordery may be abe to construct i from its components. Secondy, enough viabe vaues shoud exist for the components (in combination) that someone in a given domain is unikey to know

8 54 Research Artice SACJ, No. 47., Juy 2011 many of them. Suppose any given person knows (or is abe to guess) some components so that ony a few components remain unknown, and those components cannot assume many vaues. Then, as has aready been noted earier, it is easy for this person to use a brute force attack to try to find a match in the database of h(i) vaues. Hence i shoud have a arge domain and, ideay, each k j shoud have a arge domain. We wi refer to the size of a component s domain as the component s resoution. A component with a high resoution is one that can assume many discrete vaues. The requirement that i shoud be constant stems from the fact that variance in i aows a patient to obtain more than one coin. If this happens often enough, a market in excess coins may deveop where such coins are suppied to a heathcare provider to exchange for donor funds. In order for i to be constant, each of the components needs to be constant. We wi refer to this property as the component s stabiity. As noted, k 1 is chosen as the patient s nationa identity number, which is assumed to remain constant. Simiar numbers may be used as other components. Exampes incude the patient s driver icence number, cheque account number, passport number, etc. These exampes, however, suffer from a few probems. Not a patients may have a these numbers. In some cases, numbers may be dependent; the driver icence may, for exampe, use the patient s nationa identity number as its number. And some numbers, such as a cheque account number, are easy to change and a given person is hardy ever restricted to ony one such number. In other words, other numbers may be usefu, but shoud ony be used after carefu consideration. The other exampe used when i was introduced was that of bood type. This exampe is an idea one: Repeated tests yied the same (discrete) vaue. Bood types hardy ever change and the few cases where it does, are statisticay insignificant because there simpy are not enough cases to form a source of surpus coins. Two concerns regarding this exampe shoud be raised. The first was aready raised in Section 3. Using the terminoogy introduced in the current section, this component has a ow resoution. However, that is easiy deat with using enough other components. The second concern is the fact that this type of biometric is considered invasive. Given the appication context we argue that, athough invasive, it is appropriate to use in a medica environment where such tests are standard. Unfortunatey not many exampes exist that work as we as bood types. Many characteristics are measured on a continuous scae and the probabiity that one measurement wi be identica to the next is extremey sma. Consider a person s ength. Assume, for the moment, that a person s ength remains constant during the vaidity period of the coins and that the person therefore has a precise ength. However, if the person s ength is measured in miimetres (or some even smaer unit) sma differences are ikey to occur if the ength is measured a second time. If arger units are used (or some arger interva is used), measurements are bound to categorise a person into the correct category more often. If, for exampe, we ony determine a person s ength to the nearest ten centimeters, reativey few categorisation errors wi occur. Those peope who are on the boundary of a category may sti often be cassified in the wrong category. However, if the categories are arge enough, few cases wi occur near the boundaries. Ceary, for such cases a tradeoff exists between resoution and stabiity. As has aready been argued, a sma number of (potentiay) doube coins issued to the same individua is not a significant issue. Most patients wi ony request a singe coin. Most of those who get a doube coin wi not reaise it. It ony becomes a significant issue once patients have a reasonabe chance of obtaining a second coin that cousion between a sufficient number of patients and a heathcare provider becomes a significant threat. In order to formaise this, assume that a potentia fraction d of a patients may possiby receive a second (ie a different coin). This impies that at east p = 1 d patient s data identities shoud be determined correcty in the cat-

9 Research Artice SACJ, No. 47., Juy egories where they shoud be paced. For each k j there is an expected proportion p j of measurements that wi be correcty cassified. For k 1 (the nationa identity number) p 1 = 1. Simiary for bood type the corresponding vaue wi be 1. For other measurements, p j depends on the tradeoff made between resoution and stabiity. This wi be expored formay beow. If the various components k j are statisticay independent (the idea case, as has aready been expained) then v φ v (x) u p = p 1 p 2 p 3 p m If independence does not hod, the reationship is significanty more compex and is not considered in the current paper. From this discussion it is cear that the probem wi in practice be one of optimisation. The foowing constraints wi typicay appy: The number, m, of components that can reaisticay be incorporated; The empiricay observed standard deviation, σ kj, for measurements of component k j ; note that we wi simpy write σ beow when k j is impied; The minimum resoution of i (which wi be the product of the resoutions of its components k j ), and Possiby minimum resoutions of combinations of some components that excude information that come from the same fied (such as medicine). The chaenge then is to determine the sizes of categories to be used for each of the components such that the potentia fraction d of a patients who may possiby receive a second coin is minimised (or at east ensured to be beow some acceptabe threshod). This optimisation probem is not considered in the current paper. However, to concude, we do expore the reationship between the vaue of e kj and the size of categories to be used for component k j. Since k j is impied in what foows, it is not expicity written. 5.1 Baancing stabiity with resoution Assume measurements of the physica trait under consideration are distributed according to some function φ with standard deviation Figure 1: The distribution of expected measurements given an actua vaue v. σ. Consider any category that ranges from (ower bound) to u (upper bound). Further assume that a trait is to be measured that has a true vaue v, with v < u. Then the actua measurements wi be distributed around v. We wi indicate the specific probabiity distribution function for measurements of v as φ v. This is depicted in figure 1 (where, for purposes of iustration, it has been assumed that measurements are distributed normay around the actua vaue). For such an actua vaue v the probabiity of pacing the measurement in the correct category is given by c,u (v) = u φ v (x) dx Now suppose that the interva [, u) is subdivided into a number of discrete measurement units. Assume that there are n such discrete units in this interva. Further assume that the occurrence of these discrete vaues are distributed eveny over the interva. Then the expected proportion of vaues that wi be correcty paced in this category is given by p n,,u = 1 n n 1 i=0 c,u ( + i δ) with δ = (u )/n the distance between the subunits. Where no discrete intervas exist ie where measurements are taken on a continuous scae this expected vaue is equa to p,u = im n p n,,u = u c,u (v) dv

10 56 Research Artice SACJ, No. 47., Juy 2011 Assume now that the observed measurements of some true vaue v are indeed distributed normay with mean µ = v and standard deviation σ. Then, from the we-known norma distribution function, it foows that Therefore p,u = = = φ v (x) = 1 σ 2π e 1 u u u u u c,u (v) dv φ v (x) dx dv 1 σ 2π e 2( x v σ ) 1 2( x v σ ) dx dv Note that the integrand does not depend on the vaues of x and v, but on the difference between them. Hence, if the integration areas over x and v are both moved by and we et = u, then p = σ 2π e 1 2( x v σ ) dx dv This is the reationship between p and the size of the categories that wi serve as input to the optimisation probem identified earier in the paper. In order to derive this reationship a number of assumptions had to be made. We contend that those assumptions are reasonabe, without considering each of them in detai here. 6 CONCLUSION This paper considered a protoco based on digita cash to ensure equitabe distribution of donor funds to heathcare providers for patient treatment. The probem was soved by using a fairy straightforward appication of e-coins. However, to sove this probem, it was necessary to anonymousy identify a patient in a manner that is unique, constant and hard to obtain. The soution ensures uniqueness by incorporating a known unique vaue; it ensures that the identifier is (statisticay) constant and ensures that it is hard to obtain by composing it of enough vaues from various domains. The fina soution is shown to be dependent on an optimisation probem the detais of which are eft for future research. Further work needs to be done to identify suitabe biometrics to use in the construction of i. It is necessary to determine the vaue of σ for these biometrics empiricay. It is then necessary to confirm that i can achieve a sufficient resoution by using (ony) a reasonabe number of components. The soution presented here shows some simiarities with the notion of mutibiometrics [6]; the actua probem is indeed significanty different. However, one issue highighted [6] as a probem for mutibiometric systems is the fact that underying measurements are not necessariy exposed to an appication by current biometric hardware. This needs to be investigated in the context of the current paper as we. Practica issues regarding communicating the protoco messages between the patient and other parties aso needs further attention. It seems that smartcards might be usefu. Another potentia avenue for future research is to consider the impact that trust modes may have on the work presented in this paper. This might hep to reduce the degree of trust currenty vested in the doctor. It aso seems worth to investigate the use of reated cryptographic protocos for this appication, such as eectronic voting and anonymous credentias. In fact, some modes in the atter category aready make use of biometrics [7]. However, it seems that appication of such protocos here wi aso not be straightforward, given the requirement to partition an anonymous set of individuas. REFERENCES [1] H. S. Venter, M. S. Oivier, J. H. P. Eoff and M. E. Botes. Baancing Patient Privacy and Treatment Faciity Accountabiity using a Centraised Pseudonymous HIV/AIDS Database. In S. M. Furne, P. S. Dowand and G. Kormentzas (editors), Proceedings of the Fifth Internationa Network Conference (INC2005), pp Samos, Greece, Juy 2005.

11 Research Artice SACJ, No. 47., Juy [2] D. Chaum. Bind signatures for untraceabe payments. In Advances in Cryptoogy Crypto 82, pp Springer-Verag, [3] D. Chaum. Security without identification: transaction systems to make big brother obsoete. Commun. ACM, vo. 28, no. 10, pp , ISSN doi: [4] P. Wayner. Digita Cash: Commerce on the Net. Morgan Kaufmann, 2nd edn., [5] P. Panurach. Money in eectronic commerce: digita cash, eectronic fund transfer, and Ecash. Commun. ACM, vo. 39, no. 6, pp , ISSN doi: [6] A. K. Jain and A. Ross. Mutibiometric systems. Commun. ACM, vo. 47, no. 1, pp , ISSN doi: [7] R. Impagiazzo and S. Miner More. Anonymous credentias with biometricay-enforced non-transferabiity. In WPES 03: Proceedings of the 2003 ACM workshop on Privacy in the eectronic society, pp ACM Press, New York, NY, USA, ISBN doi: