The Internet of Medical Things (IoMT) is a network of medical devices, hardware infrastructure, and software that accumulates real-time data through remote monitoring and minimizes doctor-patient interaction, enhancing the quality of remedies. However, the facile availability and accessibility of data over the web have given rise to serious information security and credibility issues in the IoMT. Recently, Chen et al. [1] proposed a provably secure authenticated key agreement protocol for remote patient monitoring in IoMT. However, after revisiting their scheme, we found security flaws such as user impersonation, ephemeral secret leakage attacks, denial-of-service attacks, and session key disclosure attacks. Therefore, this paper presents cryptanalysis as well as an improvement of Chen et al. 's scheme that strives to furnish protocols with robust security in opposition to the mentioned attacks. The security and effectiveness are displayed through informal analysis and evaluation with other existing state-of-the-art metrics like computational and commu-nication cost. At last, the findings project the superiority of the proposed improved scheme.
The Internet of Medical Things (IoMT) is a network of medical devices, hardware infrastructure, and software that accumulates real-time data through remote monitoring and minimizes doctor-patient interaction, enhancing the quality of remedies. However, the facile availability and accessibility of data over the web have given rise to serious information security and credibility issues in the IoMT. Recently, Chen et al. [1] proposed a provably secure authenticated key agreement protocol for remote patient monitoring in IoMT. However, after revisiting their scheme, we found security flaws such as user impersonation, ephemeral secret leakage attacks, denial-of-service attacks, and session key disclosure attacks. Therefore, this paper presents cryptanalysis as well as an improvement of Chen et al. 's scheme that strives to furnish protocols with robust security in opposition to the mentioned attacks. The security and effectiveness are displayed through informal analysis and evaluation with other existing state-of-the-art metrics like computational and commu-nication cost. At last, the findings project the superiority of the proposed improved scheme.
The Internet of Medical Things (IoMT) is gaining attention for its ability to enhance patient monitoring and decrease medical costs, driving advancements in personalized medicine. However, IoMT suffers from the security issue of data breaches resulting from unauthorized access, this issue hinders IoMT’s broader adoption. The introducing of mutual authentication and key agreement (MAKA) to robustly verify the identities of communicating entities, thus ensuring that access to information is limited to permitted users and blocking unauthorized access. But, to our knowledge, current MAKA schemes expose limitations such as performance complexity, potential security vulnerabilities. This study presents a provably secure user MAKA protocol (PSU-MAKA) for IoMT. The proposed PSU-MAKA allows users to complete the registration process without the need for a secure channel, while also supporting key agreement and password update. Then, the security analysis in this study illustrates the PSU-MAKA’s robustness against the potential security vulnerabilities. Lastly, this study gives the evidence that the PSU-MAKA offers superior performance in relation to other competing solutions regarding communication, computational, and storage overhead.
Telemonitoring in the Internet of Medical Things (IoMT) requires secure and efficient authentication and key agreement protocols to ensure timely access to sensitive resources-such as patients' medical records-by authorized groups of physicians. Recently, Chen and Lee proposed an anonymous, group-oriented, time-bound key agreement protocol based on extended chaotic maps, claiming to achieve a high level of security. In this article, we are the first, to the best of our knowledge, to rigorously examine the actual security of this scheme by revealing critical vulnerabilities affecting seven of the eight stated security objectives in its design. Specifically, we demonstrate that the protocol is susceptible to replay, traceability, information disclosure, and impersonation attacks. As a consequence of the impersonation attack, when group members attempt to access a legitimate service provider, an adversary can successfully redirect them to a counterfeit one. Such an attack could have serious implications for patient care, as physicians might receive incorrect medical records purportedly associated with their patients. We implemented the Chen-Lee's protocol on a Raspberry Pi-based testbed and demonstrated several practical attacks, confirming its weaknesses in real-world scenarios. To mitigate these vulnerabilities, we propose modifications that address the identified flaws while preserving the overall structure of the original protocol. The communications and computation overhead of the proposed protocol is approximately 4% higher than that of the Chen-Lee protocol.
The Internet of Medical Things (IoMT) is a compelling networking paradigm integrating wireless communications sensors, connected devices, and embedded computing technologies. The IoMT involves the collection of real-time health data using sophisticated medical sensors. In recent years, the IoMT has become increasingly significant within the broader context of the Internet of Things (IoT). It provides accessibility for health monitoring and poses security obstacles to safeguarding the confidentiality and privacy of patient data. Therefore, this article presents a blockchain-integrated quantum authentication scheme in sensor-assisted IoMT networks. The proposed concept utilizes blockchain technology to achieve efficient patient authentication without the need for third-party entities. In addition, a secure quantum authentication scheme is designed not to require patients to authenticate themselves when communicating with multiple doctors simultaneously. This protocol explicitly addresses how clinicians can misuse their professional roles toward patients in IoMT networks. An evaluation analysis assesses the proposed technique’s efficacy compared to existing authentication schemes. The performance analyses demonstrate that the proposed protocol is resilient against various security attacks. Also, the practical usability of the quantum authentication scheme proved its importance as a significant improvement in communication security for IoMT networks.
Abstract In the Internet of Medical Things (IoMT), sensors automatically collect data and transmit it to hospital servers, where doctors provide professional medical advice. The emergence of IoMT has significantly reduced the burden on chronic-disease patients and improved their life security. However, the transmission of patients’ medical data still faces serious confidentiality and integrity risks. This paper proposes a novel healthcare-system architecture that integrates a controlled-authentication semi-quantum key-negotiation (SQKN) protocol, leveraging the unconditional security of quantum cryptography to mitigate potential data attacks. The hospital server acts as a trusted controller that supervises every protocol run and authenticates all participants, which effectively thwarts man-in-the-middle and identity-spoofing attacks. The semi-quantum design further minimizes the quantum-device burden on patients’ side. Experimental simulation under realistic noise (QBER ≈ 0.03 at 0.02/0.04 noise level, 3 000 shots) shows the protocol keeps the quantum-bit error rate below 3 %, while the overall key-generation efficiency reaches 92 %, demonstrating that the scheme resists known attacks and maintains high quantum efficiency for safeguarding IoMT data security.
Secure communication and authentication in the Internet of Medical Things (IoMT) are critical for patient safety and healthcare data protection, yet existing protocols face significant vulnerabilities that remain undetected by conventional verification approaches. This paper presents the computational security verification of an IoMT authentication protocol incorporating NTRU lattice-based post-quantum cryptography using CryptoVerif, a formal verification tool that provides concrete probability bounds under standard cryptographic assumptions. Through systematic analysis of a multi-entity healthcare protocol, this study identifies two critical security flaws overlooked by previous symbolic verification methods: device registration authentication failure enabling man-in-the-middle device substitution attacks, and forward secrecy violation through static key encryption that exposes historical medical data upon key compromise. To address these vulnerabilities, we provide an enhanced protocol incorporating Strong Unforgeability under Chosen Message Attacks (SUF-CMA) MAC-based device authentication that cryptographically binds device identity to patient identity, and HMAC-based key derivation function (HKDF)-derived ephemeral session keys that achieve forward secrecy through fresh key derivation for each communication session. Our CryptoVerif implementation successfully proves nine security properties including mutual authentication, data confidentiality, device binding, and forward secrecy, with aggregate security bound for 128-bit quantum-resistant security. Unlike symbolic verification tools that assume perfect cryptography, our computational analysis provides concrete security guarantees essential for safety-critical healthcare systems.
The Industrial Internet of Things (IIoT) is the application of the Internet of Things (IoT) in the industrial field. IIoT allows users to remotely access industrial equipment and the data in it, which also brings certain challenges to the security of industrial data. Authentication and key agreement protocols are very effective security technologies in the matter of protecting industrial data. There is a large amount of research work on authentication protocols in IIoT, but most of the protocols have security weaknesses. Recently, Rafique et al. proposed a multi-factor protocol in IIoT that can accomplish authentication and session key establishment through a gateway. Rafique et al. claimed that their protocol is secure, unfortunately, we carefully analyze the protocol of Rafique et al. and find some security flaws, i.e., it is vulnerable to insider attack and known session-specific temporary information (KSSTI) attack, and unable to provide forward security. We explore the factors of insecurity and propose an enhanced multi-factor secure authentication and key agreement protocol in IIoT. The new protocol improves the security of the protocol while using only symmetric cryptography, hash function, and XOR operation. Formal security analysis and informal security discussions demonstrate that the new protocol is resistant to a variety of known attacks. After performance analysis, our protocol has lower computational cost, and increases no significant communication cost, while providing more secure and robust properties.