REVIEW 3 major objections 6 minor 35 references
A Reliable IoT-Based Embedded Health Care System for Diabetic Patients
T0 review · 3 major / 6 minor · reviewed 2026-08-14 · deepseek-v4-flash
Pith's one-line read A cloud-connected insulin pump with SHA-256 and SSH is claimed to give secure remote control and about 99.3 percent steady-state availability.
desk verdict The 99.3% availability claim doesn't survive contact with the paper's own Markov equations—the reported state probabilities are orders of magnitude off from what the balance equations demand. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the signed record pipeline: each health record or control command is hashed with SHA-256, the digest is appended to the data, the combination is sent over an SSH-encrypted channel, and the receiver rehashes and compares to accept or reject the message. SHA-256 is a 256-bit cryptographic hash standard, and SSH is a network protocol that encrypts and authenticates the connection. The availability claim is carried separately by a 12-state Markov model whose transition rates are failure rates ($\lambda$) and recovery rates ($\mu$) taken from published sources and solved for steady state.
What would settle it
Measure the actual failure and recovery intervals of this exact pump-plus-board-plus-cloud configuration, plug the measured rates into the Markov model's differential equations, and check whether the steady-state probability of the normal state stays near 0.993; if the measured rates differ substantially from Table III, the availability claim will move accordingly.
Extended reading notes
Core claim
The central discovery is that an off-the-shelf Alaris 8100 infusion pump, an LPC-1768 Cortex-M3 board, and an IoT-cloud backend can be assembled into a closed control loop where every data record and every control command carries an appended SHA-256 digest and travels over an SSH connection. At the destination, the digest is recomputed and compared with the appended value; any mismatch causes the record or command to be discarded. Solving the system of differential equations for the 12-state Markov model yields a steady-state probability for the normal state of $P_1 \approx 0.9926$, which the paper reports as 99.3 percent availability. In addition, a run over 70 diabetic sample records produced a mean processing time of $5.8\times10^{-4}$ seconds, offered as evidence that the scheme is fast enough for routine use.
Load-bearing premise
The availability result collapses if the failure and recovery rates in Table III, which are taken from published references rather than measured on this particular pump, board, and cloud connection, do not match the real system; the model also assumes constant rates and an authority-failure state it never defines quantitatively.
Editorial extensions
If this is right
- If a health record is changed by even one value, the receiver's SHA-256 digest will differ and the record will be rejected.
- A physician holding an authorized SSH key can send a new insulin schedule to the pump, and the microcontroller will pass it to the pump only after the digest check succeeds.
- Under the assumed failure and recovery rates, the system spends about 99.3 percent of its steady-state time in normal operation.
- Patient records stored in the cloud remain accessible to authorized caregivers, including when the local physician is off duty.
- An average processing time of $5.8\times10^{-4}$ seconds over 70 records suggests the verification step is not a bottleneck for routine monitoring.
Reading between the lines
- The 99.3 percent figure is a property of the assumed transition rates, not a measured availability of the deployed hardware; a real installation would need its own failure and recovery data before relying on the number.
- The same append-hash-and-verify pattern could transfer to other home infusion or monitoring devices, as long as each device has a microcontroller capable of computing SHA-256.
- An attacker who compromises the SSH key store or the serial link between the board and the pump would bypass the digest checks, a threat the paper does not model.
- For time-critical insulin delivery, the reported latency spread (standard deviation $4.4\times10^{-4}$ seconds) matters more than the mean, so a worst-case latency bound would be needed.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes an IoT-based embedded health care system for diabetic patients, integrating an Alaris 8100 infusion pump, a Keil LPC-1768 board, a cloud backend, SSH-based secure channels, and SHA-256 integrity checks. The authors describe the hardware setup, three control/storage/monitoring algorithms, and an experimental SHA-256 demonstration. The central quantitative claim is a 99.3% availability probability obtained from a 12-state Markov model whose input failure and recovery rates are listed in Table III. The conclusion asserts that the five reliability characteristics (availability, confidentiality, integrity, authentication, authorization) are accomplished.
Significance. If the security and availability claims were sound, a remotely controllable insulin pump with an explicit availability guarantee would be a practically relevant contribution to IoT health care. The paper deserves credit for constructing a working hardware integration and for demonstrating SHA-256 avalanche behavior on sample health records. However, the central availability result is not valid: the reported steady-state probabilities do not satisfy the paper's own Markov balance equations, and the input rates are assumed rather than measured. Consequently, the 99.3% figure is neither an empirical measurement nor a correct consequence of the presented model. The security claims are also asserted rather than demonstrated through a threat model or experiments. The significance of the paper is therefore not established at the level claimed.
major comments (3)
- [Section IV-C, Eq. (5), Table III, Section V-A] The reported steady-state probabilities are not a solution of the paper's own Kolmogorov equations with the stated rates. For state 4, Eq. (5) at steady state gives mu4,1 * P4 = lambda1,4 * P1. With Table III's mu4,1 = 0.9876 and lambda1,4 = 3.331e-7, and since P1 <= 1, any valid steady-state value must satisfy P4 <= 3.331e-7 / 0.9876 = 3.37e-7. The paper reports P4 = 2.998966e-3, which is four orders of magnitude larger. Because state 4 has exactly one incoming transition and one outgoing transition, no transient solution can produce a limiting probability above this bound. The same inconsistency appears for state 8: the incoming rate from state 2 is lambda2,8 * P2 = 2.50e-7 * 2.091e-4 = 5.2e-11, while the outgoing rate is (lambda8,11 + mu8,2) * P8 = (2.00e-4 + 4.20e-4) * 1.9989e-3 = 1.24e-6; these are unequal, so P8 is not a steady-state solution either. The headline 99.3% availability therefore does not follow from the model as presented, even if all input rates were accepted.
- [Section IV-C, Table III] The failure and recovery rates in Table III are stated to be collected from references, not measured on the proposed hardware or cloud configuration. Since the availability probability is a deterministic function of these rates, the resulting 99.3% value is an artifact of the assumed inputs rather than a validated property of the system. Additionally, the model includes an 'authority failure' state that is never given a quantitative definition, so the semantics of that state and its transition rates are unclear.
- [Section V-C through V-E] The claims that confidentiality, authentication, and authorization are 'accomplished' are not supported by any threat model, attack experiments, or formal verification. The integrity experiment in Section V-C merely shows that SHA-256 produces a different digest when one field of a sample record is changed; this demonstrates a hash function property, not that the proposed system detects tampering under realistic adversarial conditions. No end-to-end test shows that an adversary cannot alter a record or command without detection, and no analysis addresses attacks on the SSH channel, the serial link, or the cloud storage.
minor comments (6)
- [Abstract and Section II-B] The board name is inconsistently spelled 'Kiel' in the abstract and 'Keil' elsewhere; 'Keil' is the correct spelling. Also, 'Islambad' in the author affiliation should be 'Islamabad.'
- [Section IV] The text alternates between 'Secure Socket Shell' and 'SSL/TLS.' The standard name of the protocol is 'Secure Shell' (SSH); please use one consistent terminology and clarify whether SSL/TLS or SSH is actually used for which connection.
- [Figures 2 and 5] Figure 2 and Figure 5 have identical captions ('General architecture of the proposed scheme') and appear to show the same diagram; one of the figures should be removed or the captions and content differentiated.
- [Table III] The time units of the failure and recovery rates are not specified. Without units (e.g., per hour, per year), the numerical values cannot be interpreted or compared with published failure data.
- [Section IV-C] The initial condition is written as 'P1(t) = 1, Pi(t) = 0,' which is dimensionally incorrect; it should be P1(0) = 1 and Pi(0) = 0 for i = 2, ..., 12.
- [Section V-A] The text says 'The availability function is represented by the probability value of P1(t),' but the reported numbers are steady-state probabilities, not a time-dependent function. Additionally, the conclusion states 99.3% availability while Section V-A reports P1 = 0.9925712 (99.26%); the discrepancy should be reconciled.
Circularity Check
No significant circularity: the Markov availability figure is a model output from exogenous literature rates, not a fitted or self-referential prediction.
full rationale
The paper's central reliability claim is the steady-state probability P1 obtained from a 12-state Markov model whose failure and recovery rates are taken from cited external references (Section IV-C, Table III). Those rates are not fitted to the reported availability, and the reported P1 is not used to define any input parameter; the claim '99.3% availability' is simply the model's computed P1 rounded, which is a direct but non-circular consequence of the stated assumptions. The self-citation in reference [1] is used only as a general citation for IoT physical devices and is not load-bearing. No uniqueness theorem, ansatz, or fitted parameter is imported from the authors' prior work. The paper does contain a serious internal-consistency defect: the reported steady-state probabilities do not satisfy the paper's own Kolmogorov balance equations with the Table III rates (for instance, Eq. (5) and Table III bound P4 by lambda1,4/mu4,1 = 3.37e-7, while Section V-A reports P4 = 2.998966e-3). That is a correctness or arithmetic problem, not circularity, because the reported numbers are not derived from, or equivalent to, their inputs by construction. Thus no circular step can be exhibited, and the circularity score is 0.
Assumptions & free parameters
free parameters (1)
- Markov model failure/recovery rates (Table III) =
24 rate parameters, e.g., λ1,2=1.857E-9, λ3,6=7.5E-3, μ2,1=0.9957, μ12,1=1.857E-8
assumptions (3)
- domain assumption Markov chain time-homogeneity with constant failure and recovery rates
- domain assumption Independence of component failures
- standard math Kolmogorov differential equations as the correct availability model
invented entities (1)
-
Authority failure state
Cite this review
Pith. "Pith review of A Reliable IoT-Based Embedded Health Care System for Diabetic Patients." pith.science (2026). https://pith.science/paper/XKXUAJJ2
@misc{pith2026190806086,
author = {Pith},
title = {Pith review of: A Reliable IoT-Based Embedded Health Care System for Diabetic Patients},
year = {2026},
howpublished = {\url{https://pith.science/paper/XKXUAJJ2}},
note = {Machine review of arXiv:1908.06086}
}
read the original abstract
This paper introduces a reliable health care system for diabetic patients based on the Internet of Things technology. A diabetic health care system with a hardware implementation is presented. The proposed work employs Alaris 8100 infusion pump, Keil LPC-1768 board, and IoT-cloud to monitor the diabetic patients. The security of diabetic data over the cloud and the communication channel between health care system components are considered as part of the main contributions of this work. Moreover, an easy way to control and monitor the diabetic insulin pump is implemented. The \mbox{patient\textquotesingle s} records are stored in the cloud using the Keil board that is connected to the infusion pump. The reliability of the proposed scheme is accomplished by testing the system for five performance characteristics (availability, confidentiality, integrity, authentication, and authorization). The Kiel board is embedded with Ethernet port and Cortex-M3 micro-controller that controls the insulin infusion pump. The secure hash algorithm and secure socket shell are employed to achieve the reliability components of the proposed scheme. The results show that the proposed design is reliable, secure and authentic according to different test experiments and a case study of the Markov model. Moreover, a 99.3\% availability probability has been achieved after analyzing the case study.
Figures
Figures from the paper (6 more)
Reference graph
Works this paper leans on
-
[1]
Iot-based secure embedded scheme for insulin pump data acquisition and monitoring,
Z. A. Al-Odat, S. K. Srinivasan, E. Al-qtiemat, L. D. Mohana Asha, and S. Shuja, “Iot-based secure embedded scheme for insulin pump data acquisition and monitoring,” in The Third International Conference on Cyber-Technologies and Cyber-Systems . IARIA, 2018, pp. 90–93
work page 2018
-
[2]
J. Lin, W. Yu, N. Zhang, X. Yang, H. Zhang, and W. Zhao, “A survey on internet of things: Architecture, enabling technologies, security and privacy, and applications,”IEEE Internet of Things Journal, vol. 4, no. 5, pp. 1125–1142, 2017. TABLE III. FAILURE AND RECOVERY RATES PARAMETERS Failure (λ) Value Recovery ( µ) Value λ1,2 1.857E-09 µ2,1 99.57E-2 λ1,3 ...
work page 2017
-
[3]
Internet of things: A survey on enabling technologies, protocols, and applications,
A. Al-Fuqaha, M. Guizani, M. Mohammadi, M. Aledhari, and M. Ayyash, “Internet of things: A survey on enabling technologies, protocols, and applications,”IEEE Communications Surveys & Tutorials, vol. 17, no. 4, pp. 2347–2376, 2015
work page 2015
-
[4]
The internet of things: A survey,
L. Atzori, A. Iera, and G. Morabito, “The internet of things: A survey,” Computer networks, vol. 54, no. 15, pp. 2787–2805, 2010
2010
-
[5]
R. Kazi and G. Tiwari, “Iot based interactive industrial home wireless system, energy management system and embedded data acquisition system to display on web page using gprs, sms & e-mail alert,” in Energy Systems and Applications, 2015 International Conference on . IEEE, 2015, pp. 290–295
work page 2015
-
[6]
An iot architecture for things from industrial environment,
I. Ungurean, N.-C. Gaitan, and V . G. Gaitan, “An iot architecture for things from industrial environment,” in Communications (COMM), 2014 10th International Conference on . IEEE, 2014, pp. 1–4
work page 2014
-
[7]
Mobile to mobile data transfer through human area network,
D. Hinge and S. Sawarkar, “Mobile to mobile data transfer through human area network,” IJRCCT, vol. 2, no. 11, pp. 1181–1184, 2013
work page 2013
-
[8]
Internet of things security and forensics: Challenges and opportunities,
M. Conti, A. Dehghantanha, K. Franke, and S. Watson, “Internet of things security and forensics: Challenges and opportunities,” Future Generation Computer Systems , vol. 78, pp. 544–546, 2018
work page 2018
Show all 35 references
-
[9]
An iot-aware architecture for smart healthcare systems,
L. Catarinucci et al. , “An iot-aware architecture for smart healthcare systems,” IEEE Internet of Things Journal , vol. 2, no. 6, pp. 515–526, 2015
2015
-
[10]
Enabling cloud storage auditing with ver- ifiable outsourcing of key updates,
J. Yu, K. Ren, and C. Wang, “Enabling cloud storage auditing with ver- ifiable outsourcing of key updates,” IEEE Transactions on Information Forensics and Security, vol. 11, no. 6, pp. 1362–1375, 2016
2016
-
[11]
Electronic health record error prevention approach using ontology in big data,
K. Gai, M. Qiu, L.-C. Chen, and M. Liu, “Electronic health record error prevention approach using ontology in big data,” in High Performance Computing and Communications (HPCC), 2015 IEEE 7th International Symposium on Cyberspace Safety and Security (CSS), 2015 IEEE 12th Inter...
2015
-
[12]
New algorithms for secure outsourcing of large-scale systems of linear equations,
X. Chen, X. Huang, J. Li, J. Ma, W. Lou, and D. S. Wong, “New algorithms for secure outsourcing of large-scale systems of linear equations,” IEEE transactions on information forensics and security , vol. 10, no. 1, pp. 69–78, 2015
2015
-
[13]
Design and implementation of online patient monitoring system,
G. Harsha, “Design and implementation of online patient monitoring system,” International Journal of Advances in Engineering & Technol- ogy, vol. 7, no. 3, p. 1075, 2014
2014
-
[14]
Changes in federal information processing standard (fips) 180-4, secure hash standard,
Q. Dang, “Changes in federal information processing standard (fips) 180-4, secure hash standard,” Cryptologia, vol. 37, no. 1, pp. 69–73, 2013
2013
-
[15]
Secure hash standard (shs),
F. PUB, “Secure hash standard (shs),” FIPS PUB 180 , vol. 4, pp. 1–27, 2012
2012
-
[16]
Efficient secure outsourcing of large-scale sparse linear systems of equations,
S. Salinas, C. Luo, X. Chen, W. Liao, and P. Li, “Efficient secure outsourcing of large-scale sparse linear systems of equations,” IEEE Transactions on Big Data , vol. 4, no. 1, pp. 26–39, 2018
2018
-
[17]
Data acquisition and controlling system using cortex m3 core,
L. P. Boppudi and R. Krishnaiah, “Data acquisition and controlling system using cortex m3 core,” International Journal of Innovative Research and Development , vol. 3, no. 1, pp. 29–33, 2014
2014
-
[18]
A review of the security of insulin pump infusion systems,
N. Paul, T. Kohno, and D. C. Klonoff, “A review of the security of insulin pump infusion systems,” Journal of diabetes science and technology , vol. 5, no. 6, pp. 1557–1562, 2011
2011
-
[19]
Smart e-health gateway: Bringing intelligence to internet-of-things based ubiquitous healthcare systems,
A.-M. Rahmani et al. , “Smart e-health gateway: Bringing intelligence to internet-of-things based ubiquitous healthcare systems,” in Consumer Communications and Networking Conference (CCNC), 2015 12th An- nual IEEE. IEEE, 2015, pp. 826–834
2015
-
[20]
Next generation well- ness: A technology model for personalizing healthcare,
P.-Y . S. Hsueh, H. Chang, and S. Ramakrishnan, “Next generation well- ness: A technology model for personalizing healthcare,” in Healthcare Information Management Systems . Springer, 2016, pp. 355–374
2016
-
[21]
Secure sharing of personal health records in cloud computing: ciphertext-policy attribute-based signcryp- tion,
J. Liu, X. Huang, and J. K. Liu, “Secure sharing of personal health records in cloud computing: ciphertext-policy attribute-based signcryp- tion,” Future Generation Computer Systems , vol. 52, pp. 67–76, 2015
2015
-
[22]
Cloud storage for electronic health records based on secret sharing with verifiable reconstruction outsourcing,
H. Zhang, J. Yu, C. Tian, P. Zhao, G. Xu, and J. Lin, “Cloud storage for electronic health records based on secret sharing with verifiable reconstruction outsourcing,” IEEE Access , vol. 6, pp. 40 713–40 722, 2018
2018
-
[23]
Internet of medical things (iomt): applications, benefits and future challenges in healthcare domain,
G. J. Joyia, R. M. Liaqat, A. Farooq, and S. Rehman, “Internet of medical things (iomt): applications, benefits and future challenges in healthcare domain,” J Commun, pp. 240–247, 2017
2017
-
[24]
A dependability evaluation for internet of things incorporating redundancy aspects,
D. Macedo, L. A. Guedes, and I. Silva, “A dependability evaluation for internet of things incorporating redundancy aspects,” in Networking, Sensing and Control (ICNSC), 2014 IEEE 11th International Conference on. IEEE, 2014, pp. 417–422
2014
-
[25]
A markov model of healthcare internet of things system considering failures of components,
S. Anastasiia, K. Vyacheslav, and U. Dmytro, “A markov model of healthcare internet of things system considering failures of components,” in 4th International Workshop on Theory of Reliability and Markov Modelling for Information Technologies . CEUR-WS, 2018, pp. 530– 543
2018
-
[26]
Infusion pump assembly,
K. L. Grant and B. D. Tracey, “Infusion pump assembly,” Sep. 16 2014, uS Patent 8,834,429
2014
-
[27]
Newhope on arm cortex- m,
E. Alkim, P. Jakubeit, and P. Schwabe, “Newhope on arm cortex- m,” in International Conference on Security, Privacy, and Applied Cryptography Engineering. Springer, 2016, pp. 332–349
2016
-
[28]
A critical analysis on the security concerns of internet of things (iot),
M. U. Farooq, M. Waseem, A. Khairi, and S. Mazhar, “A critical analysis on the security concerns of internet of things (iot),”International Journal of Computer Applications , vol. 111, no. 7, 2015
2015
-
[29]
Idea: A system for efficient failure management in smart iot environments,
P. A. Kodeswaran, R. Kokku, S. Sen, and M. Srivatsa, “Idea: A system for efficient failure management in smart iot environments,” in Proceedings of the 14th Annual International Conference on Mobile Systems, Applications, and Services . ACM, 2016, pp. 43–56
2016
-
[30]
Monitoring internet of things application ecosystems for failure,
E. Solaiman, R. Ranjan, P. P. Jayaraman, and K. Mitra, “Monitoring internet of things application ecosystems for failure,” IT Professional, vol. 18, no. 5, pp. 8–11, 2016
2016
-
[31]
Health monitoring and management using internet-of-things (iot) sensing with cloud-based processing: Opportuni- ties and challenges,
M. Hassanalieragh et al. , “Health monitoring and management using internet-of-things (iot) sensing with cloud-based processing: Opportuni- ties and challenges,” in 2015 IEEE International Conference on Services Computing. IEEE, 2015, pp. 285–292
2015
-
[32]
Federated internet of things and cloud computing pervasive patient health monitoring system,
J. H. Abawajy and M. M. Hassan, “Federated internet of things and cloud computing pervasive patient health monitoring system,” IEEE Communications Magazine, vol. 55, no. 1, pp. 48–53, 2017
2017
-
[33]
Insulin pump failures: has there been an improve- ment? update of a prospective observational study,
A. Guenego et al., “Insulin pump failures: has there been an improve- ment? update of a prospective observational study,” Diabetes technology & therapeutics, vol. 18, no. 12, pp. 820–824, 2016
2016
-
[34]
Sample Medical Record: Monica Latte | Agency for Healthcare Research & Quality,
“Sample Medical Record: Monica Latte | Agency for Healthcare Research & Quality,” Oct 2018, [accessed 1. Oct. 2018]. [Online]. Available: https://www.ahrq.gov/professionals/prevention-chronic-care/ improve/system/pfhandbook/mod8appbmonicalatte.html
2018
-
[35]
UCI Machine Learning Repository: Diabetes Data Set,
“UCI Machine Learning Repository: Diabetes Data Set,” Feb 2019, [accessed 3. Feb. 2019]. [Online]. Available: https://archive.ics.uci.edu/ ml/datasets/diabetes
2019
Reviewed August 14, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.