LAKS-NVT: Provably Secure and Lightweight Authentication and Key Agreement Scheme Without Verification Table in Medical Internet of Things

Abstract

Wireless body area networks (WBANs) and wireless sensor networks (WSNs) are important concepts for the Internet of Things (IoT). They have been applied to various healthcare services to ensure that users can access convenient medical services by exchanging physiological data between user and medical server. User physiological data is collected by sensor nodes and sent to medical service providers, doctors, etc. using public channels. However, these channels are vulnerable to various potential attacks, and hence, it is essential to design provably secure and lightweight mutual authentication (MA) schemes for medical IoT to protect user privacy and achieve secure communication. A lightweight mutual authentication and key agreement (MAKA) scheme was designed in 2019 to guarantee user privacy, but we found that the scheme does not withstand impersonation, stolen senor node and leaking verification table attacks, and it does not also ensure anonymity, untraceability and secure mutual authentication. This paper proposes a provably secure and lightweight MAKA scheme for medical IoT, called LAKS Non-verification table (NVT), that does not require a server verification table. We assess LAKS-NVT's security against various potential attacks and demonstrate that it achieves secure MA between sensor node and server using Burrows-Abadi-Needham logic. We employ the well-known Real-Or-Random which is random oracle model to prove that LAKS-NVT provides a session key security. In addition, the formal security verification using the widely-accepted Automated Validation of Internet Security Protocols and Applications (AVISPA) software tool has been performed and the results show that LAKS-NVT is also secure. We compare LAKS-NVT's performance against contemporary authentication schemes, and verify that it achieves better security and comparable efficiency. The practical perspective of LAKS-NVT is also carried out via the Network Simulator 2 (NS2) simulation study.

Secure Key Agreement and Authentication Protocol for Message Confirmation in Vehicular Cloud Computing

“…In this section, we use the universally-accepted real-or-random (ROR) model [25] in order to prove the security of the session key in our proposed protocol.We provide the similar proof as adopted in [26,27].…”

MedHypChain: A patient-centered interoperability hyperledger-based medical healthcare system: Regulation in COVID-19 pandemic

“…The proposed system ensures mutual authentication and user verification but not resilient to access control and network scalability. Park et al ( Parket al, 2020 ) et al design an efficient and secure mutual authenticated scheme for medical IoT. The system preserves privacy and ensures secure data communication and but did not discuss the sensor's stolen, insider attack, and data masquerading attacks.…”

“… Did not achieve access control and scalability. Park et al ( Parket al, 2020 ) 2020 Design an efficient and secure mutual authenticated scheme for medical IoT Preserve user privacy and secure communication Not provide sensor stolen, privileged insider, and data masquerading attacks Saha et al ( Saha et al, 2020 ) 2020 Proposed a access control mechanism for healthcare system via private blockchain Preserve access control Not provide scalability and forward secrecy. Proposed scheme – Proposed a privacy-preserving data sharing system based on Hyperledger Fabric for the medical health care system Easily resilient to various kind of attacks, achieve PCI solution for COVID-19 like pandemic.…”

Cryptanalysis and Countermeasure of “An Efficient NTRU-based Authentication Protocol in IoT Environment”

“…The session key is easily disclosed, because the random numbers k A and k S are encrypted with same key z S . To prevent this attack, the random number should be encrypted with other data [19], [20] or another method to conceal data [21] VI. CONCLUSIONS User authentication and key agreement are important security requirements for IoT environments.…”

“…Recently, a number of authentication and key agreement schemes have been proposed in IoT environments [11], [12], [19]. In 2017, Li et al [13] proposed a key distribution protocol using ECC in IoT.…”