# A Lightweight Three-Party Mutual Authentication Protocol for Internet of Health Things Systems

Authors: Zhihui Wang; Jianli Zhao; Peng Sun; Jingjing Yang; Rui Wang; Xiao Zhang
Journal: Journal of Healthcare Engineering
 (2023)

---

## Abstract

In Internet of Health Things (IoHT) systems, there is a two-hop network structure between the authentication server TA, Internet of Things Connector (IotC), and wearable sensor (WS). Attackers can use the sensor layer network (the first hop) between the IotC and WS to steal patient’s health-related information and undermine the security of the system and the privacy of sensitive information. To address this threat, this study proposes a lightweight identity authentication and key agreement protocol for third-party authentication servers TA, IotC, and WS. The results of the formal security proof, BAN logic analysis, and AVISPA tool simulation show that the scheme proposed in this study has an ideal security performance and can meet the security requirements of IoHT. In terms of performance, the proposed scheme could dynamically construct a sensor layer network (the first hop) and offline networking according to the diagnostic needs of doctors. Compared with other related protocols, the proposed scheme can significantly reduce the computing resource requirements of IotC and server TA and the resource requirements of database I/O operation of server TA in the application scenario of concurrent access of multiple WS nodes.


---

## Body

## 1. Introduction

The wearable technology market has reached US $116.2 billion in 2020 and is expected to increase to US $265.4 billion by 2026, with an annual compound growth rate of 18.0% [1]. The rapid growth of the market scale of wearable technology is also constantly promoting the integration of wearable or implantable device technology with IoT, cloud computing, and other information technologies into Internet of Health Things (IoHT) systems in the hospital environment [2]. These new technologies can help medical professionals obtain various types of health data information of target patients faster and better [3] and help medical institutions continuously improve the quality of medical services [4].Figure1 describes the general network structure of IoHT systems applied in the medical structure environment [5–8]. Its remarkable feature is the integration of the IoT, cloud computing, wearable, or implantable device technology. As shown in Figure 1, an IoHT system is composed of two interconnected network units: a data service unit and IoT unit. They are connected through a common set of cloud data storage servers.Figure 1
Network structure of the IoHT system.The IoT unit is a two-hop network structure, similar to the IEEE 802.15.6 Wireless Body Area Network (WBAN) standard description [9] and the industrial Internet of Things [10]. Multiple wearable sensors (WSs) and Internet of Things Connectors (IotCs) constitute the first hop of an IoHT system, that is, the sensor layer network. The IotC and local real-time data monitoring terminal (LMT) or cloud data server form the second-hop transport layer network. In terms of function, it emphasizes the ability of real-time, fast, and accurate acquisition and two-way data transmission of Patient Health Information (PHI) [5, 8, 11], such as patient activity, blood pressure, heart rate, electrocardiogram (ECG), temperature, blood glucose, and blood oxygen level [12].


### 1.1. Networking Requirements of Sensor Layer Networks

The main application environment of IoHT systems is the medical institutions that provide public medical and health services. Patients have a strong mobility and various other conditions. Therefore, the IoHT systems must collect the corresponding PHI data according to a patient’s condition such as monitoring of blood glucose levels and blood pressure. Some data require a high real-time performance, such as heart rate data in intensive care or cardiac care environments. These have put forward the following special functional requirements or limitations for the network structure of the sensing layer of the IoHT systems:(i)
WS and IotC are small in size, easy to carry, and have limited computing resources; therefore, they are not suitable for jobs with a high amount of computing [13].(ii)
The correspondence between the patients and IotC was variable. The IotC ownership in IoHT systems is a medical institution that has a corresponding relationship with patients within a certain time range.(iii)
The types and number of WS nodes are large, and the server in the IoHT systems should have strong equipment access capability.(iv)
The WS nodes are rarely used in isolation. In most cases, these groups were included. IotC should be able to concurrently network multiple WSs.(v)
The combination of IotC and WS must be built according to the diagnostic needs of doctors [7].(vi)
To reduce the impact of remote network quality on IoHT system availability, the IotC and WS should have offline networking capabilities.


### 1.2. Requirements of IoHT Systems Lightweight Authentication Strategy

The correctness, timeliness, and credibility of PHIs can support doctors’ decision making and help save or prolong patients’ lives [14]. However, many theft events in PHI data [4] make the security of PHIs a hot issue for healthcare organizations. The Health Insurance, Portability, and Accounting Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) require all healthcare organizations to ensure the safety of health information.Network attacks against IoT terminal devices, such as webcams [15], small routers [16], bluetooth door locks [17], intelligent thermostats [18], and theft of face recognition data [19], have made people gradually realize that IoT devices in IoHT systems may become a tool for attackers to launch network attacks and destroy the stability of IoHT systems or steal user-sensitive information.The mutual Authentication and Key Agreement (AKA) mechanism between IoT access devices is an important link for building a secure health system (SHS) [20]. The VPN, SSL, TLS, and other security mechanisms are based on the Internet peer-to-peer communication mechanism, which can ensure data security on both sides, for example, the establishment of a secure data channel between the IotC and the data server [21]. However, because of the two-hop network structure of the IoT unit of IoHT systems and the networking requirements of the sensor layer network, it is very difficult to use VPN, SSL, TLS, and other protocols to build a mutual AKA in the first-hop network (sensor layer network). Therefore, the IoHT systems require a lightweight, anonymous, and secure mutual AKA protocol, that is, more suitable for network structures [22].


## 1.1. Networking Requirements of Sensor Layer Networks

The main application environment of IoHT systems is the medical institutions that provide public medical and health services. Patients have a strong mobility and various other conditions. Therefore, the IoHT systems must collect the corresponding PHI data according to a patient’s condition such as monitoring of blood glucose levels and blood pressure. Some data require a high real-time performance, such as heart rate data in intensive care or cardiac care environments. These have put forward the following special functional requirements or limitations for the network structure of the sensing layer of the IoHT systems:(i)
WS and IotC are small in size, easy to carry, and have limited computing resources; therefore, they are not suitable for jobs with a high amount of computing [13].(ii)
The correspondence between the patients and IotC was variable. The IotC ownership in IoHT systems is a medical institution that has a corresponding relationship with patients within a certain time range.(iii)
The types and number of WS nodes are large, and the server in the IoHT systems should have strong equipment access capability.(iv)
The WS nodes are rarely used in isolation. In most cases, these groups were included. IotC should be able to concurrently network multiple WSs.(v)
The combination of IotC and WS must be built according to the diagnostic needs of doctors [7].(vi)
To reduce the impact of remote network quality on IoHT system availability, the IotC and WS should have offline networking capabilities.


## 1.2. Requirements of IoHT Systems Lightweight Authentication Strategy

The correctness, timeliness, and credibility of PHIs can support doctors’ decision making and help save or prolong patients’ lives [14]. However, many theft events in PHI data [4] make the security of PHIs a hot issue for healthcare organizations. The Health Insurance, Portability, and Accounting Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH) require all healthcare organizations to ensure the safety of health information.Network attacks against IoT terminal devices, such as webcams [15], small routers [16], bluetooth door locks [17], intelligent thermostats [18], and theft of face recognition data [19], have made people gradually realize that IoT devices in IoHT systems may become a tool for attackers to launch network attacks and destroy the stability of IoHT systems or steal user-sensitive information.The mutual Authentication and Key Agreement (AKA) mechanism between IoT access devices is an important link for building a secure health system (SHS) [20]. The VPN, SSL, TLS, and other security mechanisms are based on the Internet peer-to-peer communication mechanism, which can ensure data security on both sides, for example, the establishment of a secure data channel between the IotC and the data server [21]. However, because of the two-hop network structure of the IoT unit of IoHT systems and the networking requirements of the sensor layer network, it is very difficult to use VPN, SSL, TLS, and other protocols to build a mutual AKA in the first-hop network (sensor layer network). Therefore, the IoHT systems require a lightweight, anonymous, and secure mutual AKA protocol, that is, more suitable for network structures [22].


## 2. Related Work

The special structure and functional requirements of IoHT systems restrict their application in traditional security protocols. To deal with the threat of malicious attacks, improve the security level of IoHT systems, and meet the functional requirements of portable and ultralow power consumption of wearable sensors, various lightweight mutual AKAs have been proposed.In 2015, He and Zeadally proposed a lightweight three-party authentication protocol to improve the identity authentication ability of controllers in ambient-assisted living systems [23]. Subsequently, in 2016, with the help of a third-party authentication server, He et al. realized lightweight identity authentication of users using a data aggregation device in the smart grid [24]. The two protocols are based on the elliptic curve (EC) theory and realize the support of third-party authentication servers; therefore, they have low overall resource consumption and high security, but the individual resource consumption of the controller is still high, and the support for sensing devices is insufficient.In 2017, Li et al. [9] proposed an anonymous lightweight identity authentication and key agreement protocol for two-hop wireless body area networks (WBANs). The protocol is based on a hash function and XOR computing, which significantly reduces the demand for computing resources for wireless sensor devices. A hub node must undertake multiple functions, such as identity authentication, real-time data monitoring, data storage, and remote cloud data forwarding, which are not conducive to the implementation of a security protection strategy, is easier to capture, and has a single point of failure.In 2018, Srinivas et al. [6] proposed a lightweight tripartite authentication scheme for WSs, users, and cloud servers based on cloud computing and big-data technology. The security of the scheme is verified using a formal real or random (ROR) model and the automatic verification tool AVISPA [25]. This scheme has significant advantages in terms of the communication and computing costs.However, Srinivas’ protocol must store the authentication informationHIDi,TCji2 of all possible users in the memory of all the WSs in advance. This causes the wearable sensor of the protocol to have a large demand for storage resources and insufficient ability to resist WS theft attacks [16]. Simultaneously, we found that the construction of the sensor layer network of the protocol requires more manual processing, which is more suitable for networks with stable structures. Under the demand for on-demand construction of an IoHT system sensor layer network, labor and system maintenance costs will increase.To enhance the ability of wearable devices to protect sensitive data and resist WSs theft attacks, Das et al. [5] proposed a lightweight tripartite authentication and session key scheme between WSs and mobile terminals (MT) (i.e., smartphones) carried by the same user. The security of the protocol was verified using a real or random model and AVISPA tool. Compared with the previous scheme, this method has certain advantages in terms of resource consumption. However, Jiang et al. [26] pointed out that the Das scheme does not resist offline password-guessing attacks, and attackers can use desynchronization attacks to destroy the synchronizer of identity update between WS and MT [26] and provided an improved scheme. Jiang’s scheme offers advantages in terms of security and resource consumption. However, we also found that there were still some problems with Jiang’s scheme.(i)
This method is suitable for application in personal health monitoring. In Jiang’s scheme, the user is an MT and the WS is the owner, who lacks the basic function of adjusting the combination relationship of the user, MT, and WSs according to the patient’s condition and the doctor’s diagnostic needs.(ii)
There is a security risk in the denial-of-service (DOS). In Jiang’s protocol, MT lacks the necessary verification for message M1, so attackers can use this to send many wrong M1, thus exhausting the computing, communication, and server database I/O resources of MT and the cloud server (CS) to achieve the purpose of DOS.(iii)
The computing resource requirements for concurrent MT access to multiple WS nodes must be improved. When the MT needs to access multiple WS nodes, the MT and CS have more repeated calculations and higher demand for computing resources.(iv)
The capability of offline networking between MTs and WSs must be improved. In the process of accessing the WS, the server CS must be online and provide corresponding services.(v)
The CS has a high demand for I/O database resources. Each time the MT accesses the WS, at least three queries and one database update operation are required. In an IoHT system environment, this may lead to a shortage of CS database resources, affect the number of WS nodes accessed, and weaken the server’s ability to resist DoS attacks.To enhance the ability of identity authentication between the Internet of Things connector (IotC) and local real-time data terminal, Srinivas et al. proposed a novel temporal credential-based anonymous lightweight user authentication mechanism for the Internet of Drones (IoD) environment [27]. The security of the scheme is proved using a real or random (ROR) model and automated validation of Internet security protocols and applications (AVISPA). However, this scheme does not support the dynamic construction of a sensor layer network. In 2020, Wang et al. [7] proposed a lightweight WSs and WNC mutual authentication protocol based on the elliptic curve cryptography (ECC) algorithm. With the help of a cloud-assisted authentication service, the protocol can realize mutual authentication and key negotiation of a wearable network connector (WNC) access to WSs designated by doctors. However, this scheme has shortcomings in terms of protection against ID. The attacker uses this to track the specified WSs and obtain sensitive data by analyzing the communication frequency and data volume. However, compared to the schemes of Srinivas, DAS, and Jiang, the resource consumption of their sensing terminals remains high.


## 3. Preliminaries

### 3.1. Elliptic Curve (EC)

LetE be an elliptic curve over a finite field Fp defined by the following equation: y2=x3+ax+bmodp, where x,y,a,b∈Fp and 4a3+27b2modp≠0. EFp represents a cyclic group constructed from points on elliptic curve E and infinity ∞.


### 3.2. Scalar Multiplication

WhenP∈EFp, there is a multiplication formula: t⋅P=P+P+…+Pttimes holds.


### 3.3. Elliptic Curve Discrete Logarithm Problem (ECDLP)

WhenP∈EFp and integer t are known, it is easy to calculate =t⋅P,whereQ∈EFp. When Q and P are known, it is very difficult to calculate the value of the integer t.


### 3.4. Elliptic Curve Cryptography (ECC)

A public-key algorithm based on ECDLP security is called elliptic curve cryptography (ECC). Compared with RSA, ECC requires fewer computing and storage resources [28, 29].


### 3.5. Elliptic Curve Diffie–Hellman Discrete Logarithm Problem (ECDHDLP)

Assumingc,d∈Fp and G,c⋅G,d⋅G∈EFp, when the values of c and d⋅G or d and c⋅G are known, it is easy to calculate c⋅d⋅G∈EFp, but when c⋅G and d⋅G are known, it is very difficult to calculate c⋅d⋅G.


### 3.6. Fuzzy Extractor (FE)

This is a highly secure biometric recognition method. It containsδi,τi=GenBioi and δ’i=RepBioi′,τi functions [5], where Bioi,δi,τi∈{0,1}l. When the deviation between Bioi′ and Bioi is less than t, δi=δi′ can be obtained.


### 3.7. Collision-Resistant Hash Function

The hash function can convert any long input string0,1}∗ into a fixed-length value 0,1}L. If the hash values of two different input strings are the same, the two strings form a set of hash collisions. AdvHASHA denotes the advantage of adversary A in identifying hash collisions: when AdvHASHA≤ε, ε is a real number sufficiently small to be ignored. This hash function is called a collision-resistant hash function.


### 3.8. Parameters and Symbols

Table1 lists the names and descriptions of parameters, methods, and symbols required by the proposed protocol. To prevent replay attacks, all participants in the IoHT system network have their own independent timing unit, T, and can maintain synchronization with the system clock of the IoHT systems.Table 1
Parameters, methods, and symbols.
NotationDescriptionNotationDescriptionTACloud authentication serverIotCA wearable Internet of Things connectorsTA,PTAServer key pairPTA=sTA⋅G∆t,∆TEffective timeWSA wearable deviceTiCurrent time of deviceiGSelected elliptic curve base point=?Determine whether they are equalstatusStatus of equipment⊕XOR operation||Concatenation operationSKSession keyPIDTemporary ID of the patient after binding with IotCPTCTemporary identification code of the patient after binding with IotCNIDTemporary network ID authorized by TAAcTemporary authentication code authorized by the servera, c, x, yRandom parametershCollision-resistant hash functionTCiAuthentication code of deviceIPWiManagement key for deviceiBioUser’s biometric informationRep⋅Deterministic reproduction functionGen.Probabilistic generation functionτReproduction parameter fromGen.δBiometric key fromGen.E ()/D ()Encryption/decryption method


## 3.1. Elliptic Curve (EC)

LetE be an elliptic curve over a finite field Fp defined by the following equation: y2=x3+ax+bmodp, where x,y,a,b∈Fp and 4a3+27b2modp≠0. EFp represents a cyclic group constructed from points on elliptic curve E and infinity ∞.


## 3.2. Scalar Multiplication

WhenP∈EFp, there is a multiplication formula: t⋅P=P+P+…+Pttimes holds.


## 3.3. Elliptic Curve Discrete Logarithm Problem (ECDLP)

WhenP∈EFp and integer t are known, it is easy to calculate =t⋅P,whereQ∈EFp. When Q and P are known, it is very difficult to calculate the value of the integer t.


## 3.4. Elliptic Curve Cryptography (ECC)

A public-key algorithm based on ECDLP security is called elliptic curve cryptography (ECC). Compared with RSA, ECC requires fewer computing and storage resources [28, 29].


## 3.5. Elliptic Curve Diffie–Hellman Discrete Logarithm Problem (ECDHDLP)

Assumingc,d∈Fp and G,c⋅G,d⋅G∈EFp, when the values of c and d⋅G or d and c⋅G are known, it is easy to calculate c⋅d⋅G∈EFp, but when c⋅G and d⋅G are known, it is very difficult to calculate c⋅d⋅G.


## 3.6. Fuzzy Extractor (FE)

This is a highly secure biometric recognition method. It containsδi,τi=GenBioi and δ’i=RepBioi′,τi functions [5], where Bioi,δi,τi∈{0,1}l. When the deviation between Bioi′ and Bioi is less than t, δi=δi′ can be obtained.


## 3.7. Collision-Resistant Hash Function

The hash function can convert any long input string0,1}∗ into a fixed-length value 0,1}L. If the hash values of two different input strings are the same, the two strings form a set of hash collisions. AdvHASHA denotes the advantage of adversary A in identifying hash collisions: when AdvHASHA≤ε, ε is a real number sufficiently small to be ignored. This hash function is called a collision-resistant hash function.


## 3.8. Parameters and Symbols

Table1 lists the names and descriptions of parameters, methods, and symbols required by the proposed protocol. To prevent replay attacks, all participants in the IoHT system network have their own independent timing unit, T, and can maintain synchronization with the system clock of the IoHT systems.Table 1
Parameters, methods, and symbols.
NotationDescriptionNotationDescriptionTACloud authentication serverIotCA wearable Internet of Things connectorsTA,PTAServer key pairPTA=sTA⋅G∆t,∆TEffective timeWSA wearable deviceTiCurrent time of deviceiGSelected elliptic curve base point=?Determine whether they are equalstatusStatus of equipment⊕XOR operation||Concatenation operationSKSession keyPIDTemporary ID of the patient after binding with IotCPTCTemporary identification code of the patient after binding with IotCNIDTemporary network ID authorized by TAAcTemporary authentication code authorized by the servera, c, x, yRandom parametershCollision-resistant hash functionTCiAuthentication code of deviceIPWiManagement key for deviceiBioUser’s biometric informationRep⋅Deterministic reproduction functionGen.Probabilistic generation functionτReproduction parameter fromGen.δBiometric key fromGen.E ()/D ()Encryption/decryption method


## 4. The Proposed Scheme

Mutual authentication protocols between devices are typically based on mutually trusting secret information [30]. The combined relationship between patients and IotC and between IotC and WS in IoHT systems often needs to be changed, and the resources of IotC and WS are limited and very different. In this case, the three-party mutual authentication scheme, including the third-party server TA, has clear advantages in terms of communication and storage resources [30]. Therefore, based on the ECDLP and hash function, we propose a lightweight AKA scheme that uses anonymous third-party devices.


### 4.1. Devices Registration

Figure2 describes the registration process of IotC. At this stage, TA records the IotC identity and generates a new authentication code TCi. The numerical numbers of (1), (2), …, (7) in Figure 2 are in the order in which IotC and TA execute the protocol at this stage. To enhance the flexibility of the administrator’s workplace, we have strengthened the security protection of the communication process. For example, the tracking of equipment is prevented by formulas IDi∗=IDi⊕hB‖Ti1 and Di=?IDi∗⊕hBx‖Ts1; TA calculates V=?hIDi‖PWiBTi1, and the identity authentication of IotC and administrator users is realized. The registration process of WS is similar to that described in Figure 2.Figure 2
IotC registration phase.


### 4.2. IotC Binding to a Patient

The corresponding relationship between the patient and the IotC in the IoHT systems is variable. IotC has only a corresponding relationship with the patient within a certain time range. To meet this demand, this study proposed a strategy for bindingIotCi to a patient. During the validity period, IotCi and the server TA (PID, PTC) were used to mark the correspondence between IotCi and the patient. Figure 3 shows the detailed process of binding IotCi receptor binding to a patient. Numerical numbers such as “(1), (2), …, (5)” in Figure 3 are the execution sequences of IotCi and TA in this stage.(1)
IotCi local authentication administrator.(2)
IotCi requests and determines the patient information. In this process, the formula IDi∗=IDi⊕hB‖Ti2 is used to encrypt the ID of IotCi to prevent device tracking.(3)
TA authenticatesIotCi. TA uses the formula B′=STA⋅A to calculate the ID decryption key of IotCi. IotC identity is verified using V1=?hIDi′‖TCiATi2.(4)
TA binds a patient toIotCi. The TA selects a user userID and calculates PID=hIDi′‖userIDcTS2 and PTC=hPID‖TCiTS2B′.(5)
IotCi binds a patient. After receiving message M4, IotCi uses the information to calculate PID and PTC. Subsequently, the key is calculated using the formulas GenBion=δn,τn and UK=hIDi‖δn, and the PID and PTC are encrypted and saved using the formula wn=EUKPID,PTC′.Figure 3
IotC binding patient process.


### 4.3. TA Authorizes IotC

The ability of the sensor layer network to support the patient’s condition and the doctor’s diagnosis requires variable correspondence between a patient and multiple WS nodes. This relationship can be replaced by that betweenIotCi and multiple WS nodes after the patient is bound to IotCi.Therefore, this study proposes a strategy for TA to authorize IotC to access WS nodes and use (NID, AC [1, …,n]) to mark the corresponding relationship between an IotC and multiple WS nodes. Figure 4 describes the process of IotCi obtaining the access authorization of a WS node. When multiple WS nodes require access, the variable Acj is an array.Figure 4
TA authorizesIotCi access to WS node.


### 4.4. IotC Offline Access to WS Node

IoHT systems must meet the needs of offline construction of the sensor layer network in real working scenarios. Therefore, this study proposes a strategy in which TA authorizes once, and IotC can access the specified WS node offline many times within the authorization time range. Figure5 describes the implementation process of the AKA policy of IotCi offline access to WSj.(1)
IotCi authenticates the users locally. IotCi verifies the user’s identity by using the fuzzy extractor function and decrypts and calculates the NID, Acj, and Ts3, which are required to access WSj.(2)
LoginWSj. IotCi calculates the variable values of TID, Y, Ts3, and V5 in turn. Message M7 is combined and broadcast to the sensor layer network.(3)
WSj verifies IotCi. After receiving message M7, WSj uses the formula Tj−Ts3<△T,Tj−Ti4<△t to verify the authorization validity △T and data transmission validity △t, and △T is much greater than △t. Then, WSj uses the formula hTIDj‖UIDAcjTs3Ti4hy to verify the access authorization of IotCi.(4)
Calculate the session key SK. After the identity authentication ofIotCi is successful, WSj uses the formula SKij=hhx‖h′yAcj′Ti4 to calculate the session key SKij between WSj and IotCi. WSj continues to calculate the values of variables X and V6 and returns the message M8 to IotCi.(5)
IotCi authenticates WSj. After receiving the message M8, IotCi uses the formula Tj−Ti4<△t to verify the time validity of the message. If valid, IotCi using TIDj in the current message, select Acj′ corresponding to sending message M7 and calculate SK’ij=hh′x‖hyAcj′Ti4 to obtain SK’ij. Then, calculate IDj,Tj,h′y=DSKV6. If equation h′y=?hy holds, IotCi successfully authenticates WSj identity.Figure 5
IotCi offline access to WSj node.


### 4.5. IotC Online Access WS

In the proposed scheme, when IotC obtains access authorization for the WS, the process of accessing the specified WS for the first time can be regarded as an online access. That is, after IotC completes all the operations described in Figure4 and obtains NID, Acj, and Ts3, it can directly transfer to the number “(2)” in Figure 5, mark the part, and begin to enter the WS node.


### 4.6. IotC Accesses Multiple WS Nodes Concurrently

In a multi-WS access scenario, Figure5 shows that the variable Acj in the authorization process is an array AC [1, …, N]. AC [1, …, N] contains the access verification codes for multiple WS nodes. At this time, IotC generates a corresponding message TID and message M7 for each element in AC [1, …, N], according to the operation described in Figure 5. The messages of multiple M7 structures were then sent continuously.AfterWSj receives the first M7 structure message, WSj starts to execute all operations in the “(3)” mark section in Figure 5. Until V5=?hTIDj‖NIDAcj′Ts3Ti4h′y meets the equality, stop receiving and go to the part marked with “(4).”In the case of multiple WS concurrent access, afterIotCi receives M8, IotCi uses the TID in M8 to select the corresponding AC to improve the concurrent access capability of IotCi.


### 4.7. Replacement and Change of WS Nodes

When the patient’s condition development or other conditions need to adjust the IotC, this can be realized by sequentially executing the process described in Figures4 and 5. When only the WS needs to be adjusted, this can be realized by sequentially executing the process described in Figures 4 and 5.


## 4.1. Devices Registration

Figure2 describes the registration process of IotC. At this stage, TA records the IotC identity and generates a new authentication code TCi. The numerical numbers of (1), (2), …, (7) in Figure 2 are in the order in which IotC and TA execute the protocol at this stage. To enhance the flexibility of the administrator’s workplace, we have strengthened the security protection of the communication process. For example, the tracking of equipment is prevented by formulas IDi∗=IDi⊕hB‖Ti1 and Di=?IDi∗⊕hBx‖Ts1; TA calculates V=?hIDi‖PWiBTi1, and the identity authentication of IotC and administrator users is realized. The registration process of WS is similar to that described in Figure 2.Figure 2
IotC registration phase.


## 4.2. IotC Binding to a Patient

The corresponding relationship between the patient and the IotC in the IoHT systems is variable. IotC has only a corresponding relationship with the patient within a certain time range. To meet this demand, this study proposed a strategy for bindingIotCi to a patient. During the validity period, IotCi and the server TA (PID, PTC) were used to mark the correspondence between IotCi and the patient. Figure 3 shows the detailed process of binding IotCi receptor binding to a patient. Numerical numbers such as “(1), (2), …, (5)” in Figure 3 are the execution sequences of IotCi and TA in this stage.(1)
IotCi local authentication administrator.(2)
IotCi requests and determines the patient information. In this process, the formula IDi∗=IDi⊕hB‖Ti2 is used to encrypt the ID of IotCi to prevent device tracking.(3)
TA authenticatesIotCi. TA uses the formula B′=STA⋅A to calculate the ID decryption key of IotCi. IotC identity is verified using V1=?hIDi′‖TCiATi2.(4)
TA binds a patient toIotCi. The TA selects a user userID and calculates PID=hIDi′‖userIDcTS2 and PTC=hPID‖TCiTS2B′.(5)
IotCi binds a patient. After receiving message M4, IotCi uses the information to calculate PID and PTC. Subsequently, the key is calculated using the formulas GenBion=δn,τn and UK=hIDi‖δn, and the PID and PTC are encrypted and saved using the formula wn=EUKPID,PTC′.Figure 3
IotC binding patient process.


## 4.3. TA Authorizes IotC

The ability of the sensor layer network to support the patient’s condition and the doctor’s diagnosis requires variable correspondence between a patient and multiple WS nodes. This relationship can be replaced by that betweenIotCi and multiple WS nodes after the patient is bound to IotCi.Therefore, this study proposes a strategy for TA to authorize IotC to access WS nodes and use (NID, AC [1, …,n]) to mark the corresponding relationship between an IotC and multiple WS nodes. Figure 4 describes the process of IotCi obtaining the access authorization of a WS node. When multiple WS nodes require access, the variable Acj is an array.Figure 4
TA authorizesIotCi access to WS node.


## 4.4. IotC Offline Access to WS Node

IoHT systems must meet the needs of offline construction of the sensor layer network in real working scenarios. Therefore, this study proposes a strategy in which TA authorizes once, and IotC can access the specified WS node offline many times within the authorization time range. Figure5 describes the implementation process of the AKA policy of IotCi offline access to WSj.(1)
IotCi authenticates the users locally. IotCi verifies the user’s identity by using the fuzzy extractor function and decrypts and calculates the NID, Acj, and Ts3, which are required to access WSj.(2)
LoginWSj. IotCi calculates the variable values of TID, Y, Ts3, and V5 in turn. Message M7 is combined and broadcast to the sensor layer network.(3)
WSj verifies IotCi. After receiving message M7, WSj uses the formula Tj−Ts3<△T,Tj−Ti4<△t to verify the authorization validity △T and data transmission validity △t, and △T is much greater than △t. Then, WSj uses the formula hTIDj‖UIDAcjTs3Ti4hy to verify the access authorization of IotCi.(4)
Calculate the session key SK. After the identity authentication ofIotCi is successful, WSj uses the formula SKij=hhx‖h′yAcj′Ti4 to calculate the session key SKij between WSj and IotCi. WSj continues to calculate the values of variables X and V6 and returns the message M8 to IotCi.(5)
IotCi authenticates WSj. After receiving the message M8, IotCi uses the formula Tj−Ti4<△t to verify the time validity of the message. If valid, IotCi using TIDj in the current message, select Acj′ corresponding to sending message M7 and calculate SK’ij=hh′x‖hyAcj′Ti4 to obtain SK’ij. Then, calculate IDj,Tj,h′y=DSKV6. If equation h′y=?hy holds, IotCi successfully authenticates WSj identity.Figure 5
IotCi offline access to WSj node.


## 4.5. IotC Online Access WS

In the proposed scheme, when IotC obtains access authorization for the WS, the process of accessing the specified WS for the first time can be regarded as an online access. That is, after IotC completes all the operations described in Figure4 and obtains NID, Acj, and Ts3, it can directly transfer to the number “(2)” in Figure 5, mark the part, and begin to enter the WS node.


## 4.6. IotC Accesses Multiple WS Nodes Concurrently

In a multi-WS access scenario, Figure5 shows that the variable Acj in the authorization process is an array AC [1, …, N]. AC [1, …, N] contains the access verification codes for multiple WS nodes. At this time, IotC generates a corresponding message TID and message M7 for each element in AC [1, …, N], according to the operation described in Figure 5. The messages of multiple M7 structures were then sent continuously.AfterWSj receives the first M7 structure message, WSj starts to execute all operations in the “(3)” mark section in Figure 5. Until V5=?hTIDj‖NIDAcj′Ts3Ti4h′y meets the equality, stop receiving and go to the part marked with “(4).”In the case of multiple WS concurrent access, afterIotCi receives M8, IotCi uses the TID in M8 to select the corresponding AC to improve the concurrent access capability of IotCi.


## 4.7. Replacement and Change of WS Nodes

When the patient’s condition development or other conditions need to adjust the IotC, this can be realized by sequentially executing the process described in Figures4 and 5. When only the WS needs to be adjusted, this can be realized by sequentially executing the process described in Figures 4 and 5.


## 5. Security Analysis

This section proves the security performance and antiattack ability of the proposed protocol through formal methods.


### 5.1. Security Model

The scheme proposed in this study belongs to the identity authentication and key agreement (AKA) protocol. Therefore, we provide the corresponding security model and formal proof process based on [31–33]. In this model, P denotes the proposed scheme. I presents the participants in the scheme, which can be TA, IotCi, or WSj. Attacker A can be described by the following random oracles:(i)
ExcuteTA,IotCi,WSj: attacker A intercepts all messages exchanged between any two parties(ii)
SendI,m: attacker A sends forged message M to I and receives feedback form(iii)
RevealI: attacker A obtains the composition information of the session key and launches a known key attack(iv)
CorruptI: attacker A can obtain the long-term key of I to verify the strong forward security performance of the session key SK(i)
CorruptIotC: attacker A can obtain {IDi,TCi,} of IotC(ii)
CorruptWS: attacker A can obtain IDj,TCj of WS(v)
TestI: Attacker A uses a coin toss test to challenge session key {SK}. When ρ=1, the correct session key SK is returned, and when ρ=0, a random string is returned.(vi)
Hashm,hm: Attacker A calculates the hash value of message M.Definitions and assumptions need to be used in the definition and false proof process.


#### 5.1.1. Partnering

If a group of participants in the protocol, the instances ofIotCi and WSj, can pass the mutual identity authentication and negotiate a consistent session key SK, we call them partners.


#### 5.1.2. Fresh

If a session is not disclosed, it is called a fresh session.


#### 5.1.3. Security

When attackerA destroys the security advantage AdvpA≤ε of protocol P, it means that P is secure and satisfies AdvpA=2PrSucc−1, where ε is a real number small enough to be ignored, and PrSucc represents the probability that attacker A successfully destroys the security of P.Assumptions 1.
The basic algorithms used in the proposed scheme, such as the elliptic curve discrete logarithm problem (ECDLP), elliptic curve Diffie–Hellman discrete logarithm problem (ECDHDLP), fuzzy extractor (FE), hash function, and symmetric-key encryption algorithm (Enc), are secure; that is,AdvECDLPA≤ε, AdvECDHDLPA≤ε,AdvFEA≤ε,AdvHASHA≤ε,AdvEncA≤ε.


### 5.2. Security Proof

Theorem 1.
The advantage ofA in P is given by(1)AdvpA≤2qh22l+22qh+qs2l+4qs+2Tm2q+2qsH+2qh422l+2+2AdvEncA+qh22lmaxAdvECDLPA,AdvECDHDLPA.In the above formula,q is the order of elliptic curve finite cyclic group EFp; H represents the length of the dictionary; l is the length of the hash value, qe, qs,and qh, respectively, represent the number of times A executes Excute, Send, and Hash queries, respectively, and Tm represents the calculation times of elliptic curve scalar multiplication.Proof.
This process is similar to those in References [31–33] and takes place over five games G0 to G7. Succi represents that A wins in the game Gi and successfully destroys the security of protocol P.G0: This game simulates that attacker A uses the random oracle model to launch a real attack on P, so we can obtain AdvpA=2PrSucc0−1.G1: This game simulates attacker A launching a passive attack on protocol P. Attacker A intercepts message M3−M8 through ExcuteTA,IotCi,WSj and stores it in the list L. Because the key SK is not transmitted in the above message, passive attacks will not increase the advantage of attacker A. Thus, A can be obtained PrSucc1=PrSucc0.G2: To improve the advantage, attacker A applies the collision principle based on G1 and uses an oracle Hashm,hm and TestI to launch multiple attacks. In this case, attacker A guesses or collides with the key SK, and the success probability is qs/H+qh2/2l+1; destroying the security of the symmetric-key algorithm, and the success probability is AdvEncA. At this point, the advantage of attacker A can be described as PrSucc2−PrSucc1≤qs/H+qh2/2l+1+AdvEncA.G3: Attacker A indirectly attacks SK through Acj based on G2: Attacker A can destroy the security of the symmetric-key algorithm. The methods and success probability of attacker A are as follows:(i)
AttackerA collides with the value of Acj, and the success probability is qh2/2l+1.(ii)
AttackerA intercepts NID and Ts3 in M7, collides with IDj and TCj values, and uses the formula Acj=hNID‖IDjTCjTs3 to calculate Acj, with a success probability of qh4/22l+2.(iii)
AttackerA uses the formula Acj=Ej⊕hQPTCTs3 to calculate the value of Acj, where Q and PTC are unknown variables, and the success probability is maxAdvECDLPA,AdvECDHDLPAqh2/2l+1.At this point, the advantage of attackerA can be described as PrSucc3−PrSucc2≤qh2/2l+1+qh4/22l+2+maxAdvECDLPA,AdvECDHDLPAqh2/2l+1.G4: This game simulates that attacker A uses SendIotCi,M8 query to send a forged message M8 to enhance his advantage. In this case, attacker A evaluates the success according to the message returned by IotCi. The simulator must check whether M8 is in the list L. To verify the formula h′y=?hy, attacker A must test the values of hx, Acj′, and SK’ij. Therefore, attacker A can obtain PrSucc4−PrSucc5≤3qh+qs/2l.G5: This game simulates that attacker A uses SendWSj,M7 query to send a forged message M7 to enhance its advantage. In this case, attacker A passes the formula V5=?hTIDj‖NIDAcj′Ts3Ti4h′y for verification, and the values of hy, Acj′, TCj, and IDj need to be tested. At this point, the advantage of attack A is PrSucc5−PrSucc4≤4qh+qs/2l.G6: This game simulates that attacker A uses SendIotCi,M6 query to send a forged message M6 to enhance his advantage. In this case, attacker A must test the values of Q′, PID, and PTC. At this point, the advantage of attack A is PrSucc5−PrSucc4≤qs+2Tm/2q+2qh+qs/2l.G7: This game simulates that attacker A uses SendTA,M5 queries to send a forged message M5 to enhance its advantage. In this case, attacker A must test the values of B, PID, and PTC. At this point, the advantage of attack A is PrSucc6−PrSucc5≤qs+2Tm/2q+2qh+qs/2l.
Therefore, combining the advantages ofG0–G7 attacker A, we can get Theorem 1.


### 5.3. BAN Logic Proof of the Proposed Protocol

In this chapter, we use the Burrows–Abadi–Needham (BAN) logic [30, 34, 35] to formally prove the security of the device AKA protocol proposed in this study. We assumed that the symbols P and Q represent participation in the communication session, X and Y are messages sent or received by the participants, and K is the session key. Table 2 lists the relevant symbols, descriptions, and logic rules often used in the BAN logic. To save space, only Figure 5 is listed as a formal proof describing the content.Table 2
BAN logic notation and rules.
P∣≡XP believes the message XP⊲XP sees the message XP∣∼XP once said the message XP∣⇒XP has jurisdiction over the message X#XThe messageX is freshP⇌YQOnlyP and Q know XP↔KQP and Q share key KX,YX or Y is a part of message (X, Y)X}KX is encrypted with KXKX is hashed with KR1Message meaning rule:P∣≡P↔KQ,P⊲{X}K/P∣≡Q∣∼X, P∣≡P⇌YQ,P⊲X}Y/P∣≡Q∣∼XR2Nonce verification rule:P≡#X,P≡Q∼X/P≡Q≡XR3Jurisdiction rule:P∣≡Q⇒X,P∣≡Q∣≡X/P∣≡XR4Freshness rule:P∣≡#X/P∣≡#X,Y,R5Belief rule:P∣≡X,P∣≡Y/P∣≡X,Y, P∣≡X,Y/P∣≡X, P∣≡Q∣≡X,Y/P∣≡Q∣≡XAccording to the functional characteristics of the protocol proposed in this study, the security of the AKA process ofIotCi accessing WSj can be decomposed into five security verification objectives under the BAN logic. They are, respectively, G1: WSj trust TA, G2: WSj trust IotCi, G3: WSj trust SKij, G4: IotCi trust SKij, and G5: IotCi trust WSj.


#### 5.3.1. G1:WSj Authenticates TA

In BAN logic, the messageM7:TIDj,NID,Y,Ti4,Ts3,V5 in Figure 5 is converted to TIDj,NID,Ti4,Ts3,{Y,Ti4}ACj,(TIDj,NID,Ts3,Ti4,Y)ACj. After receiving M7, WSj calculates ACj′=NID,ID,Ts3TCj, and the target G1 can be represented by the formula WSj∣≡TA∣∼ACj′. When the equation V5=?hTIDj‖NIDACj′Ts3Ti4Y holds, ACj is not tampered with.WSj gets WSj∣≡TA⟷TCjWSj,WSj∣≡TA∣≡TA⟷TCjWSj, WSj⊲NID,IDj,Ts3TCjUses R1:WSj∣≡TA⇌TCjWSj,WSj⊲NID,ID,TS3TCj/WSj∣≡TA∣∼NID,ID,TS3TCjGets G1:WSj∣≡TA∣∼ACj′


#### 5.3.2. G2:WSj Trust IotCi

In the protocol proposed in this study,IotCi uses NID to mark the identity after binding with patient information and obtaining WS access authorization. Therefore, the target G2 can be represented by the formula WSj∣≡NID.WSj gets WSj∣≡TA⟷TCjWSj, WSj∣≡#Ts3,WSj∣≡TA∣⇒NID,IDj,TS3TCjUses R4:WSj∣≡#Ts3/WSj∣≡#NID,ID,TS3TCjUses R2:WSj∣≡#NID,ID,TS3)TCj,WSj∣≡TA∣∼NID,ID,TS3TCj/WSj∣≡TA∣≡NID,ID,TS3TCjUses R3:WSj∣≡TA∣⇒NID,ID,TS3)TCj,WSj∣≡TA∣≡NID,ID,TS3TCj/WSj∣≡NID,ID,TS3TCjUses R5:WSj∣≡NID,ID,TS3TCj/WSj∣≡NID,WSj∣≡IDj,WSj∣≡TS3Gets G2:WSj∣≡NID


#### 5.3.3. G3:WSj Trusts SKij

SKij is calculated using the formula SKij=hhx‖hy, and its calculation security is based on a collision-resistant hash function. hx is randomly generated by WSj. G3 can be expressed using the formula WSj∣≡hy.WSj gets WSj∣≡#Ti4, WSj⊲{hy,Ti4}ACj, WSj∣≡TA∣⇒{hy,Ti4}ACjUses R1:WSj∣≡WSj⇌ACjTA,WSj⊲{hy,Ti4}ACj/WSj∣≡TA∣∼hy,Ti4Uses R2:WSj∣≡#Ti4,WSj∣≡TA∣∼hy,Ti4/WSj∣≡TA∣≡hy,Ti4Uses R3:WSj∣≡TA∣⇒{hy,Ti4}ACj,WSj∣≡TA∣≡hy,Ti4/WSj∣≡hy,Ti4Uses R5:WSj∣≡hy,Ti4/WSj∣≡hy,WSj∣≡Ti4Gets G3:WSj∣≡hy


#### 5.3.4. G4:IotCi Trusts SKij

In BAN logic, messageM8 is converted to TIDj,{IDj,Y′,Tj}SKij,{X,Tj}ACj,Tj. G4 can be represented using the formula IotCi∣≡SKij.IotCi gets IotCi∣≡Acj,IotCi∣≡IotCi⇌ACjTA,IotCi⊲{hx,TjAcj,IotCi∣≡hyUses R1:IotCi∣≡IotCi⇌ACjTID,IotCi⊲{hx,TjAcj/IotCi∣≡TID∣∼hx,TjUses R4:IotCi∣≡#Tj/IotCi∣≡#hx,TjUses R2:IotCi∣≡#hx,Tj,IotCi∣≡TID∣∼hx,Tj/WSj∣≡NID∣≡hx,TjUses R3:IotCi∣≡TA∣⇒IotCi⇌ACjTA,IotCi∣≡NID∣≡hx,Tj/IotCi∣≡hx,TjUses R5:IotCi∣≡hx,Tj/IotCi∣≡hx,IotCi∣≡hx,IotCi∣≡hy/IotCi∣≡hx,hyGets G4: UsesIotCi∣≡SK’ij


#### 5.3.5. G5:IotCi Trusts WSj

G4 can be represented by the following formulaIotCi∣≡IDj:Uses R1:IotCi∣≡IotCi⇌SKijTID,IotCi⊲{IDj,h′y,TjSKij/IoTCi∣≡TID∣∼IDj,h′y,TjUses R4:IotCi∣≡#Tj/IotCi∣≡#IDj,h′y,TjUses R2:IotCi∣≡#IDj,h′y,Tj,IotCi∣≡TID∣∼IDj,h′y,Tj/IotCi∣≡TID∣≡IDj,h′y,TjUses R3:IotCi∣≡TID∣⇒IotCi⇌SKijTID,IotCi∣≡TID∣≡IDj,h′y,Tj/IotCi∣≡IDj,h′y,TjUses R5:IotCi∣≡IDj,h′y,Tj/IotCi∣≡IDj,IotCi∣≡h′y,IotCi∣≡TjGets G5:IotCi∣≡IDjAt this time, this study successfully uses the BAN logic to formally prove the security of the three-party AKA protocol proposed in this study and achieves all the security indicators.


## 5.1. Security Model

The scheme proposed in this study belongs to the identity authentication and key agreement (AKA) protocol. Therefore, we provide the corresponding security model and formal proof process based on [31–33]. In this model, P denotes the proposed scheme. I presents the participants in the scheme, which can be TA, IotCi, or WSj. Attacker A can be described by the following random oracles:(i)
ExcuteTA,IotCi,WSj: attacker A intercepts all messages exchanged between any two parties(ii)
SendI,m: attacker A sends forged message M to I and receives feedback form(iii)
RevealI: attacker A obtains the composition information of the session key and launches a known key attack(iv)
CorruptI: attacker A can obtain the long-term key of I to verify the strong forward security performance of the session key SK(i)
CorruptIotC: attacker A can obtain {IDi,TCi,} of IotC(ii)
CorruptWS: attacker A can obtain IDj,TCj of WS(v)
TestI: Attacker A uses a coin toss test to challenge session key {SK}. When ρ=1, the correct session key SK is returned, and when ρ=0, a random string is returned.(vi)
Hashm,hm: Attacker A calculates the hash value of message M.Definitions and assumptions need to be used in the definition and false proof process.


### 5.1.1. Partnering

If a group of participants in the protocol, the instances ofIotCi and WSj, can pass the mutual identity authentication and negotiate a consistent session key SK, we call them partners.


### 5.1.2. Fresh

If a session is not disclosed, it is called a fresh session.


### 5.1.3. Security

When attackerA destroys the security advantage AdvpA≤ε of protocol P, it means that P is secure and satisfies AdvpA=2PrSucc−1, where ε is a real number small enough to be ignored, and PrSucc represents the probability that attacker A successfully destroys the security of P.Assumptions 1.
The basic algorithms used in the proposed scheme, such as the elliptic curve discrete logarithm problem (ECDLP), elliptic curve Diffie–Hellman discrete logarithm problem (ECDHDLP), fuzzy extractor (FE), hash function, and symmetric-key encryption algorithm (Enc), are secure; that is,AdvECDLPA≤ε, AdvECDHDLPA≤ε,AdvFEA≤ε,AdvHASHA≤ε,AdvEncA≤ε.


## 5.1.1. Partnering

If a group of participants in the protocol, the instances ofIotCi and WSj, can pass the mutual identity authentication and negotiate a consistent session key SK, we call them partners.


## 5.1.2. Fresh

If a session is not disclosed, it is called a fresh session.


## 5.1.3. Security

When attackerA destroys the security advantage AdvpA≤ε of protocol P, it means that P is secure and satisfies AdvpA=2PrSucc−1, where ε is a real number small enough to be ignored, and PrSucc represents the probability that attacker A successfully destroys the security of P.Assumptions 1.
The basic algorithms used in the proposed scheme, such as the elliptic curve discrete logarithm problem (ECDLP), elliptic curve Diffie–Hellman discrete logarithm problem (ECDHDLP), fuzzy extractor (FE), hash function, and symmetric-key encryption algorithm (Enc), are secure; that is,AdvECDLPA≤ε, AdvECDHDLPA≤ε,AdvFEA≤ε,AdvHASHA≤ε,AdvEncA≤ε.


## 5.2. Security Proof

Theorem 1.
The advantage ofA in P is given by(1)AdvpA≤2qh22l+22qh+qs2l+4qs+2Tm2q+2qsH+2qh422l+2+2AdvEncA+qh22lmaxAdvECDLPA,AdvECDHDLPA.In the above formula,q is the order of elliptic curve finite cyclic group EFp; H represents the length of the dictionary; l is the length of the hash value, qe, qs,and qh, respectively, represent the number of times A executes Excute, Send, and Hash queries, respectively, and Tm represents the calculation times of elliptic curve scalar multiplication.Proof.
This process is similar to those in References [31–33] and takes place over five games G0 to G7. Succi represents that A wins in the game Gi and successfully destroys the security of protocol P.G0: This game simulates that attacker A uses the random oracle model to launch a real attack on P, so we can obtain AdvpA=2PrSucc0−1.G1: This game simulates attacker A launching a passive attack on protocol P. Attacker A intercepts message M3−M8 through ExcuteTA,IotCi,WSj and stores it in the list L. Because the key SK is not transmitted in the above message, passive attacks will not increase the advantage of attacker A. Thus, A can be obtained PrSucc1=PrSucc0.G2: To improve the advantage, attacker A applies the collision principle based on G1 and uses an oracle Hashm,hm and TestI to launch multiple attacks. In this case, attacker A guesses or collides with the key SK, and the success probability is qs/H+qh2/2l+1; destroying the security of the symmetric-key algorithm, and the success probability is AdvEncA. At this point, the advantage of attacker A can be described as PrSucc2−PrSucc1≤qs/H+qh2/2l+1+AdvEncA.G3: Attacker A indirectly attacks SK through Acj based on G2: Attacker A can destroy the security of the symmetric-key algorithm. The methods and success probability of attacker A are as follows:(i)
AttackerA collides with the value of Acj, and the success probability is qh2/2l+1.(ii)
AttackerA intercepts NID and Ts3 in M7, collides with IDj and TCj values, and uses the formula Acj=hNID‖IDjTCjTs3 to calculate Acj, with a success probability of qh4/22l+2.(iii)
AttackerA uses the formula Acj=Ej⊕hQPTCTs3 to calculate the value of Acj, where Q and PTC are unknown variables, and the success probability is maxAdvECDLPA,AdvECDHDLPAqh2/2l+1.At this point, the advantage of attackerA can be described as PrSucc3−PrSucc2≤qh2/2l+1+qh4/22l+2+maxAdvECDLPA,AdvECDHDLPAqh2/2l+1.G4: This game simulates that attacker A uses SendIotCi,M8 query to send a forged message M8 to enhance his advantage. In this case, attacker A evaluates the success according to the message returned by IotCi. The simulator must check whether M8 is in the list L. To verify the formula h′y=?hy, attacker A must test the values of hx, Acj′, and SK’ij. Therefore, attacker A can obtain PrSucc4−PrSucc5≤3qh+qs/2l.G5: This game simulates that attacker A uses SendWSj,M7 query to send a forged message M7 to enhance its advantage. In this case, attacker A passes the formula V5=?hTIDj‖NIDAcj′Ts3Ti4h′y for verification, and the values of hy, Acj′, TCj, and IDj need to be tested. At this point, the advantage of attack A is PrSucc5−PrSucc4≤4qh+qs/2l.G6: This game simulates that attacker A uses SendIotCi,M6 query to send a forged message M6 to enhance his advantage. In this case, attacker A must test the values of Q′, PID, and PTC. At this point, the advantage of attack A is PrSucc5−PrSucc4≤qs+2Tm/2q+2qh+qs/2l.G7: This game simulates that attacker A uses SendTA,M5 queries to send a forged message M5 to enhance its advantage. In this case, attacker A must test the values of B, PID, and PTC. At this point, the advantage of attack A is PrSucc6−PrSucc5≤qs+2Tm/2q+2qh+qs/2l.
Therefore, combining the advantages ofG0–G7 attacker A, we can get Theorem 1.


## 5.3. BAN Logic Proof of the Proposed Protocol

In this chapter, we use the Burrows–Abadi–Needham (BAN) logic [30, 34, 35] to formally prove the security of the device AKA protocol proposed in this study. We assumed that the symbols P and Q represent participation in the communication session, X and Y are messages sent or received by the participants, and K is the session key. Table 2 lists the relevant symbols, descriptions, and logic rules often used in the BAN logic. To save space, only Figure 5 is listed as a formal proof describing the content.Table 2
BAN logic notation and rules.
P∣≡XP believes the message XP⊲XP sees the message XP∣∼XP once said the message XP∣⇒XP has jurisdiction over the message X#XThe messageX is freshP⇌YQOnlyP and Q know XP↔KQP and Q share key KX,YX or Y is a part of message (X, Y)X}KX is encrypted with KXKX is hashed with KR1Message meaning rule:P∣≡P↔KQ,P⊲{X}K/P∣≡Q∣∼X, P∣≡P⇌YQ,P⊲X}Y/P∣≡Q∣∼XR2Nonce verification rule:P≡#X,P≡Q∼X/P≡Q≡XR3Jurisdiction rule:P∣≡Q⇒X,P∣≡Q∣≡X/P∣≡XR4Freshness rule:P∣≡#X/P∣≡#X,Y,R5Belief rule:P∣≡X,P∣≡Y/P∣≡X,Y, P∣≡X,Y/P∣≡X, P∣≡Q∣≡X,Y/P∣≡Q∣≡XAccording to the functional characteristics of the protocol proposed in this study, the security of the AKA process ofIotCi accessing WSj can be decomposed into five security verification objectives under the BAN logic. They are, respectively, G1: WSj trust TA, G2: WSj trust IotCi, G3: WSj trust SKij, G4: IotCi trust SKij, and G5: IotCi trust WSj.


### 5.3.1. G1:WSj Authenticates TA

In BAN logic, the messageM7:TIDj,NID,Y,Ti4,Ts3,V5 in Figure 5 is converted to TIDj,NID,Ti4,Ts3,{Y,Ti4}ACj,(TIDj,NID,Ts3,Ti4,Y)ACj. After receiving M7, WSj calculates ACj′=NID,ID,Ts3TCj, and the target G1 can be represented by the formula WSj∣≡TA∣∼ACj′. When the equation V5=?hTIDj‖NIDACj′Ts3Ti4Y holds, ACj is not tampered with.WSj gets WSj∣≡TA⟷TCjWSj,WSj∣≡TA∣≡TA⟷TCjWSj, WSj⊲NID,IDj,Ts3TCjUses R1:WSj∣≡TA⇌TCjWSj,WSj⊲NID,ID,TS3TCj/WSj∣≡TA∣∼NID,ID,TS3TCjGets G1:WSj∣≡TA∣∼ACj′


### 5.3.2. G2:WSj Trust IotCi

In the protocol proposed in this study,IotCi uses NID to mark the identity after binding with patient information and obtaining WS access authorization. Therefore, the target G2 can be represented by the formula WSj∣≡NID.WSj gets WSj∣≡TA⟷TCjWSj, WSj∣≡#Ts3,WSj∣≡TA∣⇒NID,IDj,TS3TCjUses R4:WSj∣≡#Ts3/WSj∣≡#NID,ID,TS3TCjUses R2:WSj∣≡#NID,ID,TS3)TCj,WSj∣≡TA∣∼NID,ID,TS3TCj/WSj∣≡TA∣≡NID,ID,TS3TCjUses R3:WSj∣≡TA∣⇒NID,ID,TS3)TCj,WSj∣≡TA∣≡NID,ID,TS3TCj/WSj∣≡NID,ID,TS3TCjUses R5:WSj∣≡NID,ID,TS3TCj/WSj∣≡NID,WSj∣≡IDj,WSj∣≡TS3Gets G2:WSj∣≡NID


### 5.3.3. G3:WSj Trusts SKij

SKij is calculated using the formula SKij=hhx‖hy, and its calculation security is based on a collision-resistant hash function. hx is randomly generated by WSj. G3 can be expressed using the formula WSj∣≡hy.WSj gets WSj∣≡#Ti4, WSj⊲{hy,Ti4}ACj, WSj∣≡TA∣⇒{hy,Ti4}ACjUses R1:WSj∣≡WSj⇌ACjTA,WSj⊲{hy,Ti4}ACj/WSj∣≡TA∣∼hy,Ti4Uses R2:WSj∣≡#Ti4,WSj∣≡TA∣∼hy,Ti4/WSj∣≡TA∣≡hy,Ti4Uses R3:WSj∣≡TA∣⇒{hy,Ti4}ACj,WSj∣≡TA∣≡hy,Ti4/WSj∣≡hy,Ti4Uses R5:WSj∣≡hy,Ti4/WSj∣≡hy,WSj∣≡Ti4Gets G3:WSj∣≡hy


### 5.3.4. G4:IotCi Trusts SKij

In BAN logic, messageM8 is converted to TIDj,{IDj,Y′,Tj}SKij,{X,Tj}ACj,Tj. G4 can be represented using the formula IotCi∣≡SKij.IotCi gets IotCi∣≡Acj,IotCi∣≡IotCi⇌ACjTA,IotCi⊲{hx,TjAcj,IotCi∣≡hyUses R1:IotCi∣≡IotCi⇌ACjTID,IotCi⊲{hx,TjAcj/IotCi∣≡TID∣∼hx,TjUses R4:IotCi∣≡#Tj/IotCi∣≡#hx,TjUses R2:IotCi∣≡#hx,Tj,IotCi∣≡TID∣∼hx,Tj/WSj∣≡NID∣≡hx,TjUses R3:IotCi∣≡TA∣⇒IotCi⇌ACjTA,IotCi∣≡NID∣≡hx,Tj/IotCi∣≡hx,TjUses R5:IotCi∣≡hx,Tj/IotCi∣≡hx,IotCi∣≡hx,IotCi∣≡hy/IotCi∣≡hx,hyGets G4: UsesIotCi∣≡SK’ij


### 5.3.5. G5:IotCi Trusts WSj

G4 can be represented by the following formulaIotCi∣≡IDj:Uses R1:IotCi∣≡IotCi⇌SKijTID,IotCi⊲{IDj,h′y,TjSKij/IoTCi∣≡TID∣∼IDj,h′y,TjUses R4:IotCi∣≡#Tj/IotCi∣≡#IDj,h′y,TjUses R2:IotCi∣≡#IDj,h′y,Tj,IotCi∣≡TID∣∼IDj,h′y,Tj/IotCi∣≡TID∣≡IDj,h′y,TjUses R3:IotCi∣≡TID∣⇒IotCi⇌SKijTID,IotCi∣≡TID∣≡IDj,h′y,Tj/IotCi∣≡IDj,h′y,TjUses R5:IotCi∣≡IDj,h′y,Tj/IotCi∣≡IDj,IotCi∣≡h′y,IotCi∣≡TjGets G5:IotCi∣≡IDjAt this time, this study successfully uses the BAN logic to formally prove the security of the three-party AKA protocol proposed in this study and achieves all the security indicators.


## 5.3.1. G1:WSj Authenticates TA

In BAN logic, the messageM7:TIDj,NID,Y,Ti4,Ts3,V5 in Figure 5 is converted to TIDj,NID,Ti4,Ts3,{Y,Ti4}ACj,(TIDj,NID,Ts3,Ti4,Y)ACj. After receiving M7, WSj calculates ACj′=NID,ID,Ts3TCj, and the target G1 can be represented by the formula WSj∣≡TA∣∼ACj′. When the equation V5=?hTIDj‖NIDACj′Ts3Ti4Y holds, ACj is not tampered with.WSj gets WSj∣≡TA⟷TCjWSj,WSj∣≡TA∣≡TA⟷TCjWSj, WSj⊲NID,IDj,Ts3TCjUses R1:WSj∣≡TA⇌TCjWSj,WSj⊲NID,ID,TS3TCj/WSj∣≡TA∣∼NID,ID,TS3TCjGets G1:WSj∣≡TA∣∼ACj′


## 5.3.2. G2:WSj Trust IotCi

In the protocol proposed in this study,IotCi uses NID to mark the identity after binding with patient information and obtaining WS access authorization. Therefore, the target G2 can be represented by the formula WSj∣≡NID.WSj gets WSj∣≡TA⟷TCjWSj, WSj∣≡#Ts3,WSj∣≡TA∣⇒NID,IDj,TS3TCjUses R4:WSj∣≡#Ts3/WSj∣≡#NID,ID,TS3TCjUses R2:WSj∣≡#NID,ID,TS3)TCj,WSj∣≡TA∣∼NID,ID,TS3TCj/WSj∣≡TA∣≡NID,ID,TS3TCjUses R3:WSj∣≡TA∣⇒NID,ID,TS3)TCj,WSj∣≡TA∣≡NID,ID,TS3TCj/WSj∣≡NID,ID,TS3TCjUses R5:WSj∣≡NID,ID,TS3TCj/WSj∣≡NID,WSj∣≡IDj,WSj∣≡TS3Gets G2:WSj∣≡NID


## 5.3.3. G3:WSj Trusts SKij

SKij is calculated using the formula SKij=hhx‖hy, and its calculation security is based on a collision-resistant hash function. hx is randomly generated by WSj. G3 can be expressed using the formula WSj∣≡hy.WSj gets WSj∣≡#Ti4, WSj⊲{hy,Ti4}ACj, WSj∣≡TA∣⇒{hy,Ti4}ACjUses R1:WSj∣≡WSj⇌ACjTA,WSj⊲{hy,Ti4}ACj/WSj∣≡TA∣∼hy,Ti4Uses R2:WSj∣≡#Ti4,WSj∣≡TA∣∼hy,Ti4/WSj∣≡TA∣≡hy,Ti4Uses R3:WSj∣≡TA∣⇒{hy,Ti4}ACj,WSj∣≡TA∣≡hy,Ti4/WSj∣≡hy,Ti4Uses R5:WSj∣≡hy,Ti4/WSj∣≡hy,WSj∣≡Ti4Gets G3:WSj∣≡hy


## 5.3.4. G4:IotCi Trusts SKij

In BAN logic, messageM8 is converted to TIDj,{IDj,Y′,Tj}SKij,{X,Tj}ACj,Tj. G4 can be represented using the formula IotCi∣≡SKij.IotCi gets IotCi∣≡Acj,IotCi∣≡IotCi⇌ACjTA,IotCi⊲{hx,TjAcj,IotCi∣≡hyUses R1:IotCi∣≡IotCi⇌ACjTID,IotCi⊲{hx,TjAcj/IotCi∣≡TID∣∼hx,TjUses R4:IotCi∣≡#Tj/IotCi∣≡#hx,TjUses R2:IotCi∣≡#hx,Tj,IotCi∣≡TID∣∼hx,Tj/WSj∣≡NID∣≡hx,TjUses R3:IotCi∣≡TA∣⇒IotCi⇌ACjTA,IotCi∣≡NID∣≡hx,Tj/IotCi∣≡hx,TjUses R5:IotCi∣≡hx,Tj/IotCi∣≡hx,IotCi∣≡hx,IotCi∣≡hy/IotCi∣≡hx,hyGets G4: UsesIotCi∣≡SK’ij


## 5.3.5. G5:IotCi Trusts WSj

G4 can be represented by the following formulaIotCi∣≡IDj:Uses R1:IotCi∣≡IotCi⇌SKijTID,IotCi⊲{IDj,h′y,TjSKij/IoTCi∣≡TID∣∼IDj,h′y,TjUses R4:IotCi∣≡#Tj/IotCi∣≡#IDj,h′y,TjUses R2:IotCi∣≡#IDj,h′y,Tj,IotCi∣≡TID∣∼IDj,h′y,Tj/IotCi∣≡TID∣≡IDj,h′y,TjUses R3:IotCi∣≡TID∣⇒IotCi⇌SKijTID,IotCi∣≡TID∣≡IDj,h′y,Tj/IotCi∣≡IDj,h′y,TjUses R5:IotCi∣≡IDj,h′y,Tj/IotCi∣≡IDj,IotCi∣≡h′y,IotCi∣≡TjGets G5:IotCi∣≡IDjAt this time, this study successfully uses the BAN logic to formally prove the security of the three-party AKA protocol proposed in this study and achieves all the security indicators.


## 6. Simulation of the Proposed Protocol

AVISPA [25, 36, 37] is an automated network protocol security verification tool. It includes a constraint-logic attacker search (Cl-AtSe) and an on-the-fly model checker (OFMC), which are two types of network attack simulation checkers. The results of AVISPA evaluation showed a certain degree of recognition. In this part, this study uses the AVISPA tool set for Figure 4 authorized access and equipment AKA process described in Figure 5 and conduct simulation security verification.Figure6 shows the HLPSL simulation model of the proposed protocol and the simulation attack process in the AVISPA software. Attacker A was added to the simulation process to verify the ability of the protocol to resist intermediate authentication attacks. Figure 7 evaluates the results of the HLPSL model in AVISPA software using two checkers: OFMC and Cl-AtSe. The results show that the proposed scheme is secure under the two inspector models and meets all specified security objectives.Figure 6
Simulation attack process of the proposed protocol.Figure 7
(a) OFMC report. (b) Cl-AtSe report.
(a)(b)


## 7. Efficiency Evaluation and Comparisons

In this section, the requirements of computing resources and server I/O resources that have a significant impact on system stability are selected, and the lightweight three-party AKA scheme proposed in this study is evaluated. For convenience of description, we select the typical [5–7, 9, 23, 26] lightweight authentication and key agreement protocols in some recent studies for comparison.


### 7.1. Comparison of the Computation Cost

When the encryption algorithm is fixed, the higher the security level, the longer the key length, and more computing resources are required to be consumed [28]. An objective analysis of the resource consumption of the AKA scheme must be conducted at the same security level. Therefore, Table 3 is established by referring to the relevant experimental data and the results in references [6, 9, 23, 38, 39].Table 3
Time requirement of the calculation method.
SignsDescriptionTimes (Th)ThHash function=1TsymSymmetric encryption/decryption≈1TMACMessage authentication code≈1TpaEC point addition≈12.5TcrtChinese remainder theorem (CRT)≈20TmeModular exponentiation≈60TsmEC scalar multiplication≈72.5TsigSignature generation using ECDSA≈92.5TVerSignature verification using ECDSA≈147.5TmapMap-to-point on ECC≈450TpairECC bilinear pairing≈1500TfeFuzzy extractor function—TxorTime required for XOR operationNegligibleTable3 lists the approximate time multiple relationships between the main mathematical calculation in some common security encryption algorithms and the SHA-1 hash calculation, and the unit is Th. For the special Tfe, we have not yet found convincing public data; Txor takes very little time and can be ignored.Table4 compares the selected literature and the proposed AKA scheme in terms of the theoretical consumption of resources. Considering that IotC in the proposed scheme can support offline and concurrent access to multiple WS nodes within the authorization time range, the corresponding computing resource consumption is listed in Table 4.Table 4
Comparison of calculated resource consumption.
ProtocolServerSGW/IoetC/HNSTD/nodeTotalDas et al. [5]—10Th + 1Tfe7Th17Th + 1 TfeSrinivas et al. [6]11Th+1Tctr16Th+1Tme12Th118ThWang et al. [7]377Th75.5Th163.5Th661ThLi et al. [9]—5Th3Th8ThHe and Zeadally [23]77.5Th221.5Th149.5Th448.5ThJiang et al. [26]9Th+1sm8Th+2Tsm+1Tfe4Th239.5Th+1TfeOurs online, 1st node2Tsm + 6 Th≈ 151 Th3Tsm + 13 Th + 3 Tsym≈ 233.5 Th+1Tfe5Th + 1 Tsym≈ 6 Th390.5Th + 1 TfeOurs online, 2nd node1Th5Th + 1 Tsym≈ 6 Th5Th + 1 Tsym≈ 6 Th13ThOurs offline, 1st node08Th + 2 Tsym+1Tfe≈ 10 Th+1Tfe5Th + 1 Tsym≈ 6 Th16Th+1TfeOurs offline, 1st node05Th + 1 Tsym≈ 6 Th5Th + 1 Tsym≈ 6 Th12ThIn the case of online access, the proposed protocols IotC and TA must perform the authorization process described in Figure4. Therefore, when accessing the first WS node, the TA must perform three EC scalar multiplications and six hash calculations, that is, 2Tsm+6Th≈151Th calculation time, IotC requires 1Tfe+ 3 Tsm+13Th+3Tsym≈233.5Th+1Tfe calculation time, and WS requires 5Th+1Tsym≈6Th calculation time. When the IotC offline line accesses the second WS node, the proposed scheme no longer needs to perform the authorization process described in Figure 4. Currently, IotC requires only a calculation time of 5Th+1Tsym≈6Th, whereas WS requires a calculation time of 5Th+1Tsym≈6Th.Figure8 shows a comparison of the schemes in Table 4 when only one WS node needs to be accessed. The x-axis represents the theoretically calculated resource demand quantity, and the unit is Th. The computational performance of Li et al. [9] scheme is the best, and the proposed scheme has certain advantages.Figure 8
WS calculation time.Figure9 shows the proposed scheme and compares the demand for computing resources with the protocol proposed by Jiang et al. [26] for multi-WS node access. The x-axis represents the number of access WS nodes, and the y-axis represents the theoretically calculated resource demand in units of Th. Figure 9(a) describes the changes in the computing resource requirements of IotC. Figure 9(b) represents the change in computing resource demand of server TA. Figure 9(c) describes the change in overall computing resources. The increase in the number of nodes has little impact on IotC and the overall computing resource requirements in the scheme proposed in this study, which is better than Jiang’s scheme.Figure 9
Computing resource requirements when multiple WS nodes are connected.
(a)(b)(c)


### 7.2. Server Database I/O Resources

The number of WS, IotCs, and users in an IoHT system is huge, and the necessary information needs to be stored in the database. When IotC is connected to WS, TA must perform the necessary data reading or writing operations to verify the privileges of users after IotC binding and authorize IotC to access the specified WS. The operation of the database requires server I/O resources. This operation is too frequent, which causes insufficient input-output resources and seriously affects the stability of the system.In Jiang et al.’s scheme [26], privacy protection is realized and device tracking is prevented by synchronizing a set of one-time identity IDs between the WS and server CS. Thus, Ta must perform three queries and one updated data operation during the AKA process. Specifically, an IotC identity query, a temporary ID query of WS, avoids the repeated query of the one-time ID of the newly generated WS at one time and an operation to update the database with a new ID. The proposed scheme requires only one PID query and WS information query. Moreover, when the number of WS nodes increases, the number of queries must be increased to be equal to the number of authorized WS nodes. Figure 10 shows the changes in the I/O operation resource requirements of the server TA database in the case of multi-WS access in the proposed scheme and Jiang et al.’s scheme [26].Figure 10
Comparison of server database I/O operations.


## 7.1. Comparison of the Computation Cost

When the encryption algorithm is fixed, the higher the security level, the longer the key length, and more computing resources are required to be consumed [28]. An objective analysis of the resource consumption of the AKA scheme must be conducted at the same security level. Therefore, Table 3 is established by referring to the relevant experimental data and the results in references [6, 9, 23, 38, 39].Table 3
Time requirement of the calculation method.
SignsDescriptionTimes (Th)ThHash function=1TsymSymmetric encryption/decryption≈1TMACMessage authentication code≈1TpaEC point addition≈12.5TcrtChinese remainder theorem (CRT)≈20TmeModular exponentiation≈60TsmEC scalar multiplication≈72.5TsigSignature generation using ECDSA≈92.5TVerSignature verification using ECDSA≈147.5TmapMap-to-point on ECC≈450TpairECC bilinear pairing≈1500TfeFuzzy extractor function—TxorTime required for XOR operationNegligibleTable3 lists the approximate time multiple relationships between the main mathematical calculation in some common security encryption algorithms and the SHA-1 hash calculation, and the unit is Th. For the special Tfe, we have not yet found convincing public data; Txor takes very little time and can be ignored.Table4 compares the selected literature and the proposed AKA scheme in terms of the theoretical consumption of resources. Considering that IotC in the proposed scheme can support offline and concurrent access to multiple WS nodes within the authorization time range, the corresponding computing resource consumption is listed in Table 4.Table 4
Comparison of calculated resource consumption.
ProtocolServerSGW/IoetC/HNSTD/nodeTotalDas et al. [5]—10Th + 1Tfe7Th17Th + 1 TfeSrinivas et al. [6]11Th+1Tctr16Th+1Tme12Th118ThWang et al. [7]377Th75.5Th163.5Th661ThLi et al. [9]—5Th3Th8ThHe and Zeadally [23]77.5Th221.5Th149.5Th448.5ThJiang et al. [26]9Th+1sm8Th+2Tsm+1Tfe4Th239.5Th+1TfeOurs online, 1st node2Tsm + 6 Th≈ 151 Th3Tsm + 13 Th + 3 Tsym≈ 233.5 Th+1Tfe5Th + 1 Tsym≈ 6 Th390.5Th + 1 TfeOurs online, 2nd node1Th5Th + 1 Tsym≈ 6 Th5Th + 1 Tsym≈ 6 Th13ThOurs offline, 1st node08Th + 2 Tsym+1Tfe≈ 10 Th+1Tfe5Th + 1 Tsym≈ 6 Th16Th+1TfeOurs offline, 1st node05Th + 1 Tsym≈ 6 Th5Th + 1 Tsym≈ 6 Th12ThIn the case of online access, the proposed protocols IotC and TA must perform the authorization process described in Figure4. Therefore, when accessing the first WS node, the TA must perform three EC scalar multiplications and six hash calculations, that is, 2Tsm+6Th≈151Th calculation time, IotC requires 1Tfe+ 3 Tsm+13Th+3Tsym≈233.5Th+1Tfe calculation time, and WS requires 5Th+1Tsym≈6Th calculation time. When the IotC offline line accesses the second WS node, the proposed scheme no longer needs to perform the authorization process described in Figure 4. Currently, IotC requires only a calculation time of 5Th+1Tsym≈6Th, whereas WS requires a calculation time of 5Th+1Tsym≈6Th.Figure8 shows a comparison of the schemes in Table 4 when only one WS node needs to be accessed. The x-axis represents the theoretically calculated resource demand quantity, and the unit is Th. The computational performance of Li et al. [9] scheme is the best, and the proposed scheme has certain advantages.Figure 8
WS calculation time.Figure9 shows the proposed scheme and compares the demand for computing resources with the protocol proposed by Jiang et al. [26] for multi-WS node access. The x-axis represents the number of access WS nodes, and the y-axis represents the theoretically calculated resource demand in units of Th. Figure 9(a) describes the changes in the computing resource requirements of IotC. Figure 9(b) represents the change in computing resource demand of server TA. Figure 9(c) describes the change in overall computing resources. The increase in the number of nodes has little impact on IotC and the overall computing resource requirements in the scheme proposed in this study, which is better than Jiang’s scheme.Figure 9
Computing resource requirements when multiple WS nodes are connected.
(a)(b)(c)


## 7.2. Server Database I/O Resources

The number of WS, IotCs, and users in an IoHT system is huge, and the necessary information needs to be stored in the database. When IotC is connected to WS, TA must perform the necessary data reading or writing operations to verify the privileges of users after IotC binding and authorize IotC to access the specified WS. The operation of the database requires server I/O resources. This operation is too frequent, which causes insufficient input-output resources and seriously affects the stability of the system.In Jiang et al.’s scheme [26], privacy protection is realized and device tracking is prevented by synchronizing a set of one-time identity IDs between the WS and server CS. Thus, Ta must perform three queries and one updated data operation during the AKA process. Specifically, an IotC identity query, a temporary ID query of WS, avoids the repeated query of the one-time ID of the newly generated WS at one time and an operation to update the database with a new ID. The proposed scheme requires only one PID query and WS information query. Moreover, when the number of WS nodes increases, the number of queries must be increased to be equal to the number of authorized WS nodes. Figure 10 shows the changes in the I/O operation resource requirements of the server TA database in the case of multi-WS access in the proposed scheme and Jiang et al.’s scheme [26].Figure 10
Comparison of server database I/O operations.


## 8. Conclusions

The rapid development of the Internet of Things and wearable sensing technology has continuously promoted Internet of Health Things (IoHT) systems in medical institutions. However, the IoHT systems not only provide a more convenient and faster channel for health detection data but also make sensitive Personal Health Information (PHI) face many new security risks. Physical channel security between Internet of Things Connectors (IotC) and wearable sensors (WS) is an important link for building IoHT systems into a secure health system (SHS).Therefore, this study proposes a lightweight three-party authentication and key agreement (AKA) protocol that meets the characteristics of the two-hop structure and the requirements of multi-WS network monitoring. The results of the formal security proof, BAN logic analysis, and simulation experiment of the AVISPA tools show that the scheme proposed in this study can meet the expected security requirements. The results of the comparison with relevant protocols show that the protocol has certain advantages in WS individual computing resource consumption: in the scenario of multiple WS node applications, the increasing trend of computing resource demand of IotC and the server is not obvious, as the I/O operation resources of the server are not affected by the number of WS nodes.



---

*Source: 1044282-2023-02-22.xml*