## 2 Related Works  
Authentication is a manner of verifying the legitimacy of a user or system before granting access to the required service [27]. The authentication process is an integral part of information security. Remote user authentication is necessary for IoT-based systems when the public network is vulnerable. In IoT-based remote patient healthcare monitoring systems, the sensitive data of the patients are collected through different sensors and accessed by healthcare professionals through the Internet. Multiple security services have been proposed in the existing research for healthcare and are discussed in this section. In [28], [PERSON] et al. proposed an ECC-based user authentication that is heavy with respect to computation and communication [29; 30]. Moreover, [PERSON] et al. [31] found that the scheme [28] does not provide security against impersonate attacks. [PERSON] et al. [32] introduced an authentication scheme for IoT-based cloud architectures. However, the scheme is vulnerable to privileged insider attacks, MITM attacks, replay attacks, and impersonation attacks [33]. Moreover, this scheme adopted a complicated mathematical procedure that increases the computation and communication costs. [PERSON] et al. [34] proposed a user authentication and key management protocol for IoT-based WSNs. However, [PERSON] et al. [35] found numerous drawbacks of this protocol and diagnosed vulnerability against user impersonation and offline password-guessing attacks. In addition, this scheme adopted a complicated mathematical procedure that increases the computation and communication costs. [PERSON] et al. [36] introduced a user authentication scheme for IoT-based cloud healthcare systems. However, the researchers in [37] proved that the scheme does not offer security services against insider attacks. In addition, the scheme exchanges a significant size of messages during authentication. [PERSON] et al. [38] proposed a device authentication scheme and key management protocol for IoT-based edge computing. However, this scheme increases computation and communication costs. So, this scheme is not suitable for resource-constrained devices. [PERSON] et al. [39] proposed an anonymity-preserving user authentication scheme for IoT-based healthcare. This scheme adopted a complicated and lengthy procedure for user authentication. Therefore, the scheme increases computation and communication costs. [PERSON] et al. [40] extended their work presented in [41] and proposed an upgraded scheme by ensuring secure communication over the public channel. The authors claimed that their proposed secure communication system is most suitable for IoT infrastructure. But the scheme exchanges a significant amount of messages. So, the scheme increases communication costs. [PERSON] et al. [42] found that the scheme presented in [43] is vulnerable to various attacks such as offline password guessing, impersonation, privileged insider, and known session-specific temporary information attacks. Therefore, the authors proposed a novel authentication scheme that resolved the security problems found in [43]. The scheme uses only hash and exclusive-OR operations to be applicable in IoT environments. [PERSON] et al. [44] proposed a physical unclonable function (PUF) based on the multi-factor authentication technique for IoT-based healthcare. The scheme adopts a complicated and lengthy procedure for user authentication and exchanges a significant amount of messages. Therefore, the scheme increases computation and communication costs. So, this scheme is not suitable for smart devices. [PERSON] et al. [45] analyzed and observed that the scheme presented in [39] cannot effectively resist against privileged internal attacks, sensor node capture attacks, and stolen authentication attacks. The scheme does not have perfect forward security. Therefore, the authors proposed a new lightweight and robust user authentication scheme for IoT-based healthcare and resolved the security vulnerabilities that existed in [39].