Telemonitoring in the Internet of Medical Things (IoMT) requires secure and efficient authentication and key agreement protocols to ensure timely access to sensitive resources-such as patients' medical records-by authorized groups of physicians. Recently, Chen and Lee proposed an anonymous, group-oriented, time-bound key agreement protocol based on extended chaotic maps, claiming to achieve a high level of security. In this article, we are the first, to the best of our knowledge, to rigorously examine the actual security of this scheme by revealing critical vulnerabilities affecting seven of the eight stated security objectives in its design. Specifically, we demonstrate that the protocol is susceptible to replay, traceability, information disclosure, and impersonation attacks. As a consequence of the impersonation attack, when group members attempt to access a legitimate service provider, an adversary can successfully redirect them to a counterfeit one. Such an attack could have serious implications for patient care, as physicians might receive incorrect medical records purportedly associated with their patients. We implemented the Chen-Lee's protocol on a Raspberry Pi-based testbed and demonstrated several practical attacks, confirming its weaknesses in real-world scenarios. To mitigate these vulnerabilities, we propose modifications that address the identified flaws while preserving the overall structure of the original protocol. The communications and computation overhead of the proposed protocol is approximately 4% higher than that of the Chen-Lee protocol.
Telemonitoring in the Internet of Medical Things (IoMT) requires secure and efficient authentication and key agreement protocols to ensure timely access to sensitive resources-such as patients' medical records-by authorized groups of physicians. Recently, Chen and Lee proposed an anonymous, group-oriented, time-bound key agreement protocol based on extended chaotic maps, claiming to achieve a high level of security. In this article, we are the first, to the best of our knowledge, to rigorously examine the actual security of this scheme by revealing critical vulnerabilities affecting seven of the eight stated security objectives in its design. Specifically, we demonstrate that the protocol is susceptible to replay, traceability, information disclosure, and impersonation attacks. As a consequence of the impersonation attack, when group members attempt to access a legitimate service provider, an adversary can successfully redirect them to a counterfeit one. Such an attack could have serious implications for patient care, as physicians might receive incorrect medical records purportedly associated with their patients. We implemented the Chen-Lee's protocol on a Raspberry Pi-based testbed and demonstrated several practical attacks, confirming its weaknesses in real-world scenarios. To mitigate these vulnerabilities, we propose modifications that address the identified flaws while preserving the overall structure of the original protocol. The communications and computation overhead of the proposed protocol is approximately 4% higher than that of the Chen-Lee protocol.
The Internet of Medical Things (IoMT) is a network of medical devices, hardware infrastructure, and software that accumulates real-time data through remote monitoring and minimizes doctor-patient interaction, enhancing the quality of remedies. However, the facile availability and accessibility of data over the web have given rise to serious information security and credibility issues in the IoMT. Recently, Chen et al. [1] proposed a provably secure authenticated key agreement protocol for remote patient monitoring in IoMT. However, after revisiting their scheme, we found security flaws such as user impersonation, ephemeral secret leakage attacks, denial-of-service attacks, and session key disclosure attacks. Therefore, this paper presents cryptanalysis as well as an improvement of Chen et al. 's scheme that strives to furnish protocols with robust security in opposition to the mentioned attacks. The security and effectiveness are displayed through informal analysis and evaluation with other existing state-of-the-art metrics like computational and commu-nication cost. At last, the findings project the superiority of the proposed improved scheme.
The Internet of Medical Things (IoMT) is gaining attention for its ability to enhance patient monitoring and decrease medical costs, driving advancements in personalized medicine. However, IoMT suffers from the security issue of data breaches resulting from unauthorized access, this issue hinders IoMT’s broader adoption. The introducing of mutual authentication and key agreement (MAKA) to robustly verify the identities of communicating entities, thus ensuring that access to information is limited to permitted users and blocking unauthorized access. But, to our knowledge, current MAKA schemes expose limitations such as performance complexity, potential security vulnerabilities. This study presents a provably secure user MAKA protocol (PSU-MAKA) for IoMT. The proposed PSU-MAKA allows users to complete the registration process without the need for a secure channel, while also supporting key agreement and password update. Then, the security analysis in this study illustrates the PSU-MAKA’s robustness against the potential security vulnerabilities. Lastly, this study gives the evidence that the PSU-MAKA offers superior performance in relation to other competing solutions regarding communication, computational, and storage overhead.
Abstract In the Internet of Medical Things (IoMT), sensors automatically collect data and transmit it to hospital servers, where doctors provide professional medical advice. The emergence of IoMT has significantly reduced the burden on chronic-disease patients and improved their life security. However, the transmission of patients’ medical data still faces serious confidentiality and integrity risks. This paper proposes a novel healthcare-system architecture that integrates a controlled-authentication semi-quantum key-negotiation (SQKN) protocol, leveraging the unconditional security of quantum cryptography to mitigate potential data attacks. The hospital server acts as a trusted controller that supervises every protocol run and authenticates all participants, which effectively thwarts man-in-the-middle and identity-spoofing attacks. The semi-quantum design further minimizes the quantum-device burden on patients’ side. Experimental simulation under realistic noise (QBER ≈ 0.03 at 0.02/0.04 noise level, 3 000 shots) shows the protocol keeps the quantum-bit error rate below 3 %, while the overall key-generation efficiency reaches 92 %, demonstrating that the scheme resists known attacks and maintains high quantum efficiency for safeguarding IoMT data security.
By utilizing the sensing and perception capabilities of various devices, the Internet of Things (IoT) enables more precise awareness of the real world, thereby enhancing management and resource utilization efficiency. However, due to their open deployment environments and frequent message exchanges, IoT endpoints are highly vulnerable to a wide range of security threats and privacy breaches, including forgery, data theft, and information leakage. Therefore, to address these challenges and ensure device legitimacy verification and secure data exchange among IoT devices, we propose a privacy-preserving and traceable certificateless anonymous mutual authentication scheme (PPT-CLAMA). PPT-CLAMA not only eliminates the need for a secure channel during key generation but also prevents attackers from tracing the real identity of devices through their own identity or public keys while providing pseudonym and anonymous authentication to devices, demonstrating greater practicality. Furthermore, through security proofs and analysis, PPT-CLAMA satisfies various high-level security properties, including mutual authentication, key agreement, nonrepudiation, unlinkability, perfect forward secrecy, known session-specific temporary information security, traceability, anonymity, and privacy preservation. The simulation results indicate that, compared to authentication and key agreement schemes, PPT-CLAMA reduces the average computational overhead and average communication overhead during the authentication process by 6.73% and 3.31%, respectively, demonstrating higher computational and communication efficiency.
With the rapid development of information technology from one side and the experience of the COVID-19 pandemic from the other side, people presently prefer to access healthcare services remotely. Telecare Medical Information System (TMIS) provides more flexible, faster, and more convenient e-healthcare services available to all people, particularly those who lack access to physicians due to their geographical restrictions. However, due to the sensitivity of medical information, preventing unauthorized access to patient data and preserving patient privacy is crucial. In this paper, we propose an authenticated key agreement scheme for TMIS to preserve the privacy of the patient’s identity from all internal (even the health server and the physician) and external entities. Moreover, the physician’s identity is kept secret from all external entities. Formal and informal security analysis of the proposed scheme indicates that it is secure against all attacks in the context.
The rapid integration of the Internet of Medical Things (IoMT) into healthcare systems raises urgent demands for secure communication mechanisms capable of protecting sensitive patient data. Quantum key agreement (QKA), a collaborative approach to key generation based on quantum principles, provides an attractive alternative to traditional quantum key distribution (QKD), as it eliminates dependence on a trusted authority and ensures equal participation from all users. QKA demonstrates particular suitability for IoMT’s decentralized medical networks by eliminating trusted authority dependence while ensuring equitable participation among all participants. This addresses fundamental challenges where centralized trust models introduce vulnerabilities and asymmetric access patterns that compromise egalitarian principles essential for medical data sharing. However, practical QKA applications in IoMT remain limited, particularly for schemes that avoid complex entanglement operations and authenticated classical channels. Among the few QKA protocols employing Grover’s search algorithm (GSA), existing proposals potentially suffer from limitations in fairness and security. In this paper, the author proposes an improved GSA-based QKA protocol that ensures fairness, security, and correctness without requiring an authenticated classical communication channel. The proposed scheme guarantees that each participant’s input equally contributes to the final key, preventing manipulation by any user subgroup. The scheme combines Grover’s algorithm with the decoy photon technique to ensure secure quantum transmission. Security analysis confirms resistance to external attacks, including intercept-resend, entanglement probes, and device-level exploits, as well as insider threats such as parameter manipulation. Fairness is achieved through a symmetric protocol design rooted in quantum mechanical principles. Efficiency evaluation shows a theoretical efficiency of approximately 25%, while eliminating the need for quantum memory. These results position the proposed protocol as a practical and scalable solution for future secure quantum communication systems, particularly within distributed IoMT environments.