Provably Secure Three-Factor-Based Mutual Authentication Scheme with PUF for Wireless Medical Sensor Networks

Abstract

Wireless medical sensor networks (WMSNs) are used in remote medical service environments to provide patients with convenient healthcare services. In a WMSN environment, patients wear a device that collects their health information and transmits the information via a gateway. Then, doctors make a diagnosis regarding the patient, utilizing the health information. However, this information can be vulnerable to various security attacks because the information is exchanged via an insecure channel. Therefore, a secure authentication scheme is necessary for WMSNs. In 2021, Masud et al. proposed a lightweight and anonymity-preserving user authentication scheme for healthcare environments. We discover that Masud et al.’s scheme is insecure against offline password guessing, user impersonation, and privileged insider attacks. Furthermore, we find that Masud et al.’s scheme cannot ensure user anonymity. To address the security vulnerabilities of Masud et al.’s scheme, we propose a three-factor-based mutual authentication scheme with a physical unclonable function (PUF). The proposed scheme is secure against various security attacks and provides anonymity, perfect forward secrecy, and mutual authentication utilizing biometrics and PUF. To prove the security features of our scheme, we analyze the scheme using informal analysis, Burrows–Abadi–Needham (BAN) logic, the Real-or-Random (RoR) model, and Automated Verification of Internet Security Protocols and Applications (AVISPA) simulation. Furthermore, we estimate our scheme’s security features, computation costs, communication costs, and energy consumption compared with the other related schemes. Consequently, we demonstrate that our scheme is suitable for WMSNs.

REACH: Robust Efficient Authentication for Crowdsensing-based Healthcare

“…Dharminder et al's scheme includes the followings: (1) Registration phase, (ii) Login and authentication phase, and iii Password change phase. We briefly, describe these phases as follows: Ravanbakhsh & Nazari [33] Utilized ECC a and Fuzzy Extractor Known-session-specific temporary information attacks Perfect forward secrecy [34] Li et al [36] Provides privacy and mutual authentication for TMIS Not provide user anonymity and unlinkability Impersonation attack [37] Giri et al [38] RSA-based authentication for TMIS Off-line password guessing Insider attacks Not provide user anonymity [39] Bin [40] RSA-based authentication for telecare systems Off-line password guessing attack Not provide perfect forward secrecy [41] Lu et al [10] Biometric-based authentication for TMIS, using ECC Off-line identity guessing attack Server impersonation attack Off-line password guessing attack [9] Mishra et al [42] Biometric-based scheme for TMIS Man-in-the-middle attack Not provide perfect forward secrecy [43] Li et al [19] Anonymity preserving authentication for WBAN d Not provide perfect forward secrecy Insider attacks [44] He et al [20] Secure authentication for WBAN Known-session-specific temporary information attack Denial of service attack [44] Sahoo et al [28] Biometric-based authentication using ECC insider attack Not provide anonymity [29] Sahoo et al [26] ECC-based authentication for TMIS replay attack password guessing attack [27] Gupta et al [3] Hash and Biometric-based scheme for WBAN, Known-session-specific temporary information attack Stolen verifier attack Not provide perfect forward secrecy Soni et al [23] Three-factor authentication using ECC Not provide perfect forward secrecy [24], [25] Aghili et al [13] Low computation cost authentication Not provide perfect forward secrecy Server impersonation attack malicios sensor attack [22] Masud et al [30] Low computation cost, hash and Xor-based scheme for WBAN Not provide anonymity insider attack impersonation attack password guessing attack [31],…”

“…In 2021, Masud et al [30] designed a lightweight scheme for authenticating entities in a telecare medical system that only uses hash and XOR functions. But as mentioned in [25] and [31], their scheme was insecure to a series of attacks such as impersonation, insider, and password guessing attacks, and cannot provide anonymity.…”

Tele-care medical information systems security techniques: A critical review of the state of the art techniques

“…To address this problem, a lightweight and privacy-preserving protocol is presented in [105]. However, this approach is vulnerable to user impersonation, offline password guessing and privileged insider attacks [106]. In addition, it cannot offer user anonymity.…”

A Secure Three-Factor Authentication Protocol for E-Governance System Based on Multiserver Environments

“…In multi-server environments, an adversary can insert, delete, or modify messages exchanged through a public channel. If adversary obtains these messages and transmits those to users or servers, the adversary can attempt replay or man-in-the-middle (MITM) attack [5]- [8]. Moreover, a malicious adversary can extract user's sensitive personal parameters stored in the mobile device or smart card utilizing power analysis attack.…”