Rapid advancement in Internet of Things(IoT) changes the way people work and live deliberately. Medical IoT (MIoT) is a highly significant application in the world of IoT, allowing the user to communicate with smart medical devices with the help of a hospital gateway node. To establish a private communication channel, a three-party authenticated key agreement (AKA) technique using public-key cryptography is used. Currently, the AKA algorithms used in MIoT are based on classical cryptography such as ElGamal, RSA, ECC, etc. All of these techniques have become obsolete in the post-quantum environment as the Shor algorithm can solve these techniques on quantum computers. To overcome the problem stated above, a scheme called Lattice based Three party authenticated key agreement scheme in Medical IoT is proposed to accomplish security and efficiency in a post-quantum environment. Formal and informal security analysis is given to authenticate the protocol’s security. Also, the security analysis is conducted formally with the help of the Random Oracle Model (ROM) and ProVerif tool. The suggested scheme is compared to existing schemes in terms of security features, computing costs, and communication costs to evaluate the system’s performance. It validates that the suggested scheme exceeds the existing schemes.
Rapid advancement in Internet of Things(IoT) changes the way people work and live deliberately. Medical IoT (MIoT) is a highly significant application in the world of IoT, allowing the user to communicate with smart medical devices with the help of a hospital gateway node. To establish a private communication channel, a three-party authenticated key agreement (AKA) technique using public-key cryptography is used. Currently, the AKA algorithms used in MIoT are based on classical cryptography such as ElGamal, RSA, ECC, etc. All of these techniques have become obsolete in the post-quantum environment as the Shor algorithm can solve these techniques on quantum computers. To overcome the problem stated above, a scheme called Lattice based Three party authenticated key agreement scheme in Medical IoT is proposed to accomplish security and efficiency in a post-quantum environment. Formal and informal security analysis is given to authenticate the protocol’s security. Also, the security analysis is conducted formally with the help of the Random Oracle Model (ROM) and ProVerif tool. The suggested scheme is compared to existing schemes in terms of security features, computing costs, and communication costs to evaluate the system’s performance. It validates that the suggested scheme exceeds the existing schemes.
Cloud-based Internet of Things (IoT)-enabled smart healthcare plays a vital role in modern society, yet security and privacy challenges remain unavoidable. The authenticated key agreement (AKA) process, which serves as the foundation of secure communication, is widely recognized as a key solution to these challenges. However, many existing AKA methods in the literature either involve high communication and computational costs or fail to withstand quantum attacks. Post-quantum cryptography (PQC) introduces a new class of cryptographic algorithms designed to resist future quantum computer threats. In this article, we present a quantum-secure, lattice-based three-party AKA scheme for smart IoT healthcare applications, leveraging the computationally complex Ring-Learning With Errors (Ring-LWE) problem. Our approach integrates secure big-data analytics with blockchain technology by utilizing authentication procedures for secure data aggregation before storing it in the blockchain. A comprehensive security evaluation including formal and informal analysis, demonstrates the scheme's strong resilience against both classical and quantum attacks. Additionally, experimental results confirm that the proposed scheme is well-suited for real-time smart healthcare applications.
The Medical Internet of Things (MIoT) plays a pivotal role in modern healthcare by integrating wireless communication and cloud computing to enhance medical practices. However, this framework presents security vulnerabilities, such as the risk of eavesdroppers exploiting public channels to intercept sensitive patient data or impersonate legitimate devices and services. Consequently, authentication between wearable devices and servers is essential before transmitting confidential information through open channels. While several authentication techniques offer protection against quantum attacks, they often incur high communication and computation costs, underscoring the need for further advancement. This paper introduces a multifactor authentication protocol designed to strengthen the integrity of cloud-assisted MIoT systems by incorporating post-quantum security. The proposed protocol utilizes a post-quantum fuzzy commitment (PQFC) scheme to enhance security and is rigorously analyzed under the random oracle model and ProVerif tool. Its functionality and security are thoroughly assessed, demonstrating adherence to key requirements such as memoryless operation, user anonymity, mutual authentication, and resistance to various threats, including biometric tampering, stolen-verifier attacks, and insider attacks. Additionally, a comprehensive comparison with existing schemes highlights a balanced trade-off between security and efficiency.
In emerging environments such as cloud computing and the Internet of Things (IoT), secure authentication and key negotiation play a crucial role in protecting data transmitted over public networks. However, many existing authentication protocols are still designed based on classical public-key cryptography primitives, and quantum computing may threaten their security. To address this challenge, we propose a post-quantum authentication and key agreement protocol that uses the lattice-based Kyber key encapsulation mechanism (KEM). Our proposed protocol integrates cryptographic authentication, smart card protection, and post-quantum key encapsulation mechanisms, enabling mutual authentication between users and servers and securely establishing session keys. The security of the protocol is formally analyzed in the Real-or-Random (ROR) model under the random oracle assumption and the IND-CCA security of the underlying KEM scheme. Furthermore, through informal security analysis, we have further demonstrated that the protocol possesses important security properties, including anonymity, untraceability, perfect forward confidentiality, and resistance to known attacks. In addition, the computational cost and communication overhead of the proposed scheme are evaluated and compared with several representative authentication protocols. The results show that the proposed protocol can provide strong security while maintaining low computational cost and communication overhead.
Abstract The authenticated key agreement (AKA) method used in the Internet of Things (IoT) provides identity authentication and agreed symmetric keys to encrypt large amounts of communication messages for devices and servers. With the development of the quantum computing techniques and corresponding algroithms, classical authenticated key agreement methods based on public key, such as RSA and ECC become vulnerable. Many scholars have proposed lattice-based authenticated key agreement schemes to achieve post-quantum security and address this issue. However, these scheme's security models (such as BR, CK, and ROR) only can capture limited types of adversary attacks and require many communication rounds. To this end, we propose a lower communication rounds lattice-based anonymous authenticated key agreement (LA-AKA) protocol under the seCK model, which can capture a wider range of adversary attacks. The LA-AKA scheme utilizes an identity-based public key system for key agreement, and this system avoids complex resource consumption caused by certificate verification. During the identity authentication and key agreement phase, the communication entities do not need to transmit static public keys; they only need to engage in two communication rounds to generate the session key. Furthermore, the LA-AKA scheme can resist signal leakage attacks caused by key reuse in the ring learning with errors (RLWE) security assumption. The LA-AKA scheme provides higher security, as security analysis proves. The performance evaluation shows that as the number of devices and servers in the system increases, the computational advantage of the LA-AKA scheme in the broadcast channel becomes more significant.
Abstract The increasing interconnectedness of devices via the Internet of Things (IoT) highlights the growing importance of addressing IoT security issues. Authenticated Key Agreement (AKA) protocols ensure secure communication between IoT devices, users, and central servers. Preserving anonymity in AKA protocols is especially crucial given privacy issues and user preferences. The emergence of Shor's algorithm in 1994 and recent advancements in quantum computing have posed a threat to the security of classical AKA schemes relying on integer factorization, discrete logarithm, and other number theory problems. Consequently, researchers have turned their attention to developing quantum-resistant AKA schemes. In this context, Rana and Mishra introduced a lattice-based key agreement protocol under ring-LWE problem for IoT-enabled smart devices. However, a thorough security assessment uncovered vulnerabilities in their protocol, specifically susceptibility to replay and Key Compromise Impersonation (KCI) attacks. Furthermore, their approach reveals potential weaknesses in user impersonation if the user's identity is compromised.
Abstract In internet of things (IOT) healthcare systems, sensitive patient information is transmitted over the network to medical professionals. Numerous lightweight authentication protocols have been proposed; however, most of them remain vulnerable to various cyberattacks, allowing attackers to eavesdrop on or manipulate transmitted data. We examine several recently proposed lightweight authentication schemes for healthcare systems. Our security analysis demonstrates that these schemes remain vulnerable to malicious gateway attacks, desynchronization attacks, and key screw attacks. .To address these issues and ensure post- quantum security in healthcare IoT, we propose a post-quantum key establishment protocol based on lattice- based cryptography (LWE). the proposed scheme prevents the gateway from accessing both the secret keys and their parameters, thereby eliminating the possibility of malicious gateway attacks. The proposed protocol ensures user anonymity, forward secrecy, and resistance to impersonation, key screw, and desynchronization attacks.. The proposed protocol ensures secure and efficient establishment of three-round key establishment among entities . Our performance evaluation shows that the proposed scheme achieves lower computation and communication overhead compared to recent related works. The security of the protocol is thoroughly analyzed through informal reasoning, Burrows–Abadi–Needham (BAN) logic, and ProVerif, confirming its robustness and suitability for resource-constrained IoT-based healthcare environments.