Provably Secure and Lightweight Patient Monitoring Protocol for Wireless Body Area Network in IoHT

Abstract

As one of the important applications of Internet of Health Things (IoHT) technology in the field of healthcare, wireless body area network (WBAN) has been widely used in medical therapy, and it can not only monitor and record physiological information but also transmit the data collected by sensor devices to the server in time. However, due to the unreliability and vulnerability of wireless network communication, as well as the limited storage and computing resources of sensor nodes in WBAN, a lot of authentication protocols for WBAN have been devised. In 2021, Alzahrani et al. designed an anonymous medical monitoring protocol, which uses lightweight cryptographic primitives for WBAN. However, we find that their protocol is defenseless to off-line identity guessing attacks, known-key attacks, and stolen-verifier attacks and has no perfect forward secrecy. Therefore, a patient monitoring protocol for WBAN in IoHT is proposed. We use security proof under the random oracle model (ROM) and automatic verification tool ProVerif to demonstrate that our protocol is secure. According to comparisons with related protocols, our protocol can achieve both high computational efficiency and security.

Fine-Auth: A Fine-Grained User Authentication and Key Agreement Protocol Based on Physical Unclonable Functions for Wireless Body Area Networks

“…Given the DY adversary's capabilities, via formal security analysis, we can demonstrate that the adversary does not have a significant and strong advantage with respect to breaking the semantic security of the session key in our protocol. Then, via heuristic analysis, one can observe that the proposed protocol not only fulfills the desired attributes but also demonstrates resilience against a multitude of known attacks [20,21].…”

A Rivest–Shamir–Adleman-Based Robust and Effective Three-Factor User Authentication Protocol for Healthcare Use in Wireless Body Area Networks

“…However, a deficiency was shown in that there was no mutual authentication among the three entities (access point, hub node, and sensor node); this creates obstacles when encountering real-world applications. Then, Xie et al of [31] analyzed that the protocol [30] cannot resist a stolen-verifier attack and has no perfect forward secrecy. Then, a robust patient monitoring authentication scheme based on elliptic curve cryptography (ECC) [32] was proposed, and the formal security proof demonstrates the security of their scheme.…”

“…However, a difference appears in the remaining four attributes. Specifically, scheme [31] does not involve the "password" as an authentication factor and so there is no comparison to be made (denoted by '-'). However, the scheme presented by [28] shows weakness in E 3 , with no secret user or sensor node constituting the session key.…”

“…For the five security attributes, the sensor node capture attack threatens the session key's security, which indicates that [28,31,34] cannot meet C 4 . In the scheme of [28], the user's password security and the session key's forward secrecy cannot be guaranteed, since the adversary can easily initiate an effective password guessing attack and compromise the GWN.…”

“…This implies that the scheme presented in [28] cannot meet C 2 , C 3 , or C 5 . For the schemes presented in [31,34], the GWN can grasp the identities of communication entities, which makes it easy for the attacker to obtain identity values by corrupting the GWN. Accordingly, the works presented in [31,34] do not meet C 1 .…”