E-health has risen to popularity with the advancement in technology. Technological innovations have made it feasible for doctors around the world to provide healthcare assistance remotely. Medical practitioners perform sensitive surgeries by sitting at different corners of the world. Healthcare is a very delicate field with human lives at stake at all times. The remote devices that are used to perform surgeries need to function accurately and any mishap can claim a life. Thus, only authentic users, in this case the doctors, should be allowed to have control of the robotic surgery devices. Several authentication protocols are presented in the literature to secure critical remote health applications. One such protocol was proposed by Kamil et al. in 2021 for authentication and key agreement between a remote surgeon and robotic arm in tactile Internet environment via a gateway. In this paper, we analyse Kamil et al's protocol and prove that their protocol is not secure against known session specific temporary information (ephemeral secrets) attack and impersonation attack. We also point out some additional security issues, such as weak authentication and traceability. As a result, Kamil et al.'s protocol is not suitable for critical health applications.
E-health has risen to popularity with the advancement in technology. Technological innovations have made it feasible for doctors around the world to provide healthcare assistance remotely. Medical practitioners perform sensitive surgeries by sitting at different corners of the world. Healthcare is a very delicate field with human lives at stake at all times. The remote devices that are used to perform surgeries need to function accurately and any mishap can claim a life. Thus, only authentic users, in this case the doctors, should be allowed to have control of the robotic surgery devices. Several authentication protocols are presented in the literature to secure critical remote health applications. One such protocol was proposed by Kamil et al. in 2021 for authentication and key agreement between a remote surgeon and robotic arm in tactile Internet environment via a gateway. In this paper, we analyse Kamil et al's protocol and prove that their protocol is not secure against known session specific temporary information (ephemeral secrets) attack and impersonation attack. We also point out some additional security issues, such as weak authentication and traceability. As a result, Kamil et al.'s protocol is not suitable for critical health applications.
The development of the Internet of Things has facilitated the rapid development of various industries. With the improvement in people’s living standards, people’s health requirements are steadily improving. However, owing to the scarcity of medical and health care resources in some areas, the demand for remote surgery has gradually increased. In this paper, we investigate remote surgery in the healthcare environment. Surgeons can operate robotic arms to perform remote surgery for patients, which substantially facilitates successful surgeries and saves lives. Recently, Kamil et al. proposed a secure protocol for surgery in the healthcare environment. However, after cryptanalyzing their protocol, we deduced that their protocols are vulnerable to temporary value disclosure and insider attacks. Therefore, we design an improved authentication and key agreement protocol for remote surgeries in the healthcare environment. Accordingly, we adopt the real or random (ROR) model and an automatic verification tool Proverif to verify the security of our protocol. Via security analysis and performance comparison, it is confirmed that our protocol is a relatively secure protocol.
With the recent advancements in wireless communications, Tactile Internet (TI) has witnessed a major blow. TI is considered the next big evolution that will provide real-time control in industrial setups, particularly in the domain of tele-surgery. However, in remote-surgery ecosystems the transmission of data is prone to different attack vectors. Thus, to realize the true potential of secure tele-surgery under the umbrella of TI, it is required to design a secure authentication and key agreement protocol for tele-surgery. In this paper, we present an effective and secure mutual authentication and session establishment protocol for TI-driven remote surgery setups. The designed protocol enables secure communications between the surgeon, robotic arm, and the trusted authority (TA); where the protocol leverages the advantages of Elliptic Curve Cryptography (ECC) and biometrics. The protocol operates along the following three phases: i) setup phase, ii) registration phase, and iii) mutual authentication and key agreement phase. During the third phase, the surgeon and the robotic arm mutually authenticate each other with the help of the TA. Further, the security features of the designed protocol have been established using formal and informal means. The obtained results indicate the resiliency of the protocol against offline password guessing attacks, replay attacks, impersonation attacks, man-in-the-middle attacks, denial of service attacks, etc.
The Internet of Medical Things (IoMT) is a network of medical devices, hardware infrastructure, and software that accumulates real-time data through remote monitoring and minimizes doctor-patient interaction, enhancing the quality of remedies. However, the facile availability and accessibility of data over the web have given rise to serious information security and credibility issues in the IoMT. Recently, Chen et al. [1] proposed a provably secure authenticated key agreement protocol for remote patient monitoring in IoMT. However, after revisiting their scheme, we found security flaws such as user impersonation, ephemeral secret leakage attacks, denial-of-service attacks, and session key disclosure attacks. Therefore, this paper presents cryptanalysis as well as an improvement of Chen et al. 's scheme that strives to furnish protocols with robust security in opposition to the mentioned attacks. The security and effectiveness are displayed through informal analysis and evaluation with other existing state-of-the-art metrics like computational and commu-nication cost. At last, the findings project the superiority of the proposed improved scheme.
Abstract In internet of things (IOT) healthcare systems, sensitive patient information is transmitted over the network to medical professionals. Numerous lightweight authentication protocols have been proposed; however, most of them remain vulnerable to various cyberattacks, allowing attackers to eavesdrop on or manipulate transmitted data. We examine several recently proposed lightweight authentication schemes for healthcare systems. Our security analysis demonstrates that these schemes remain vulnerable to malicious gateway attacks, desynchronization attacks, and key screw attacks. .To address these issues and ensure post- quantum security in healthcare IoT, we propose a post-quantum key establishment protocol based on lattice- based cryptography (LWE). the proposed scheme prevents the gateway from accessing both the secret keys and their parameters, thereby eliminating the possibility of malicious gateway attacks. The proposed protocol ensures user anonymity, forward secrecy, and resistance to impersonation, key screw, and desynchronization attacks.. The proposed protocol ensures secure and efficient establishment of three-round key establishment among entities . Our performance evaluation shows that the proposed scheme achieves lower computation and communication overhead compared to recent related works. The security of the protocol is thoroughly analyzed through informal reasoning, Burrows–Abadi–Needham (BAN) logic, and ProVerif, confirming its robustness and suitability for resource-constrained IoT-based healthcare environments.
Rapid growth of mobile and networking technologies, resulted in new paradigms of networking like Internet of Things (IoT) etc, which allows user to connect to insecure public communication channel through various devices and can access the services and data provided by remote server. Thus, remote user authentication and key agreement for wireless, wired, IoT communications becoming more challenging task. In this context many researchers have proposed authentication schemes. In 2013, An et al. proposed a dynamic ID-based remote user authentication scheme which is secure, even if the secret values stored in the smart card is revealed. In 2014, Troung et al claimed that An et al scheme is vulnerable to server forgery attack and proposed an improved scheme. In this manuscript, we validate that Troung et al's scheme is vulnerable to known session specific temporary information attack, replay and impersonation attack. Furthermore, we also propose the improved scheme to overcome these limitations without increase in the cost front.