# Novel Authentication Schemes for IoT Based Healthcare Systems

Authors: Jia-Li Hou; Kuo-Hui Yeh
Journal: International Journal of Distributed Sensor Networks
 (2015)

---

## Abstract

With the advancement of information communication technologies, the evolution of the Internet has given rise to a ubiquitous network consisting of interconnected objects (or things), called the Internet of Things (IoT). Recently, the academic community has made great strides in researching and developing security for IoT based applications, focusing, in particular, on healthcare systems based on IoT networks. In this paper, we propose a sensor (or sensor tags) based communication architecture for future IoT based healthcare service systems. A secure single sign-on based authentication scheme and a robust coexistence proof protocol for IoT based healthcare systems are proposed. With the formal security analysis, the robustness of the two proposed schemes is guaranteed under the adversary model.


---

## Body

## 1. Introduction

The rapid growth of population in cities calls for adequate provision of services and infrastructure to meet the needs of urban inhabitants. Various information and communications technologies (ICTs), such as Bluetooth, WiFi, 3G/4G, and NFC/RFID, go a long way to achieving this objective and create the possibility of smart cities where human based services and city monitoring are more aware, interactive, and efficient. Following this trend, the comprehensive evolution of the traditional Internet has given rise to a ubiquitous network consisting of interconnected objects (or things), called the Internet of Things (IoT). In IoT based environments, information sensing and human interaction with the physical world are fundamental concepts for the provision of human value-added services. Among these services, in particular, IoT oriented healthcare support systems are among the most promising and important directions for development and are therefore a major focus of government and industry.Cyber attackers generally exploit security vulnerabilities in computer hardware, software, and communications protocols to target the IoT ecosystems within enterprise, industrial, and government systems. The confidentiality, integrity, and availability of these systems are thus undermined, and serious attacks (e.g., ones resulting in financial losses, property damage, etc.) may be launched on IoT based environments. It is known that the IoT brings with it a broad array of new security challenges for the research community with respect to general system security, network security, and application security. We present the following observations:(i)
Securing IoT-networked devices requires implementation of secure cryptographic primitives on the devices. However, the limited computational resources of low-power-consuming and low-cost IoT based devices make the design of security components for such devices difficult. As it stands, some devices cannot even execute the currently existing encryption schemes. Hence, we must reconsider the implementation efficiency of security primitives (or cryptocomponents) on IoT-networked devices. In other words, a new lightweight cryptographic technique is urgently needed to meet the critical security and performance requirements of IoT based devices.(ii)
Owing to the level of mutual connectivity between IoT based devices, every time a user turns on an IoT-networked device which is infected by malware or is simply open to unauthorized third-party exploitation, the vulnerability may spread through the network in a short time. In light of these conditions, devices cannot be seen as stand-alone, as they once were in traditional security settings. In addition, owing to its advantages in terms of computation efficiency and identification accuracy, Bluetooth Low Energy (i.e., BLE) technology has been widely adopted in recent years for smartphones and intelligent wearable-devices such as the Apple Watch, the Sony SmartWatch, and Samsung Gear. For an IoT based application, the user may be an entry point for triggering specific services. Hence, an appropriate authentication scheme for entity verification is indispensable.(iii)
One of the most important goals of IoT is to enrich people’s daily lives. Sensor-based objects may be involved with several services at the same time. In that case, to guarantee both communication security and retrieval efficiency during interactions between sensor-based objects, a secure and intelligent access control scheme is promptly required. Moreover, as most IoT based technologies are still in the research stage, the development of a real and practical IoT application has been the focus of industry and business. The feasibility and practicability of proposed IoT based applications must be evaluated via testing scenarios.(iv)
In an IoT-wide universe, a mechanism capable of proving a group of tagged objects (or sensor tags) existing at the same time and the same place can be very useful. For example, a consignment of medication should always be accompanied by a usage leaflet to comply with pharmaceutical safety regulations. If all tablet containers and usage leaflets are labeled with RF tags, a coexistence proof mechanism on RF tags can provide the evidence that each tablet container was associated with an appropriate leaflet during medication distribution. This tag coexistence concept has been widely applied in recent years.Based on the above analysis, in this paper we would like to present a new IoT based secure healthcare process consisting of a refinement of the traditional authentication scheme, from a performance standpoint. The security components adopted in the proposed authentication scheme have been redesigned to meet the hardware requirements of IoT based devices. The suitability of the proposed authentication scheme as the main protection mechanism for the entry point of an IoT based healthcare system is evaluated. In addition, we introduce a coexistence scheme for proving the correctness of the coexisting medical items for which the ultra low-cost IoT based sensors, such as passive RF tags, are utilized. Medicine error prevention and patient safety can thus be guaranteed.


## 2. Related Work

The next generation of context-aware mobile applications require the continuous updating of relevant information about a user’s surroundings to create low latency notifications and guarantee a high quality of experience. Forsström et al. [1] studied the possibilities of doing so via transmission and monitoring of contextual information from mobile devices and found that the impact of the contextual information was to overload IoT networks. In addition, the authors presented an evaluation model to achieve dynamic control of the information flow without any centralized authority. Recently, the IoT based EPC (Electronic Product Code) system has emerged as a revolutionary new technology for modern logistics management. The IoT can achieve the properties of real-time location returning, object tracking and monitoring, and intelligent recognition. For this type of envisioned scenario, Wang [2] investigated relevant laws and technical standards with a view to increasing government investment and setting up business models for the promotion of future IoT based applications. On the other hand, as the capability to provide personalized healthcare is limited by the data available from patients, which is dynamic and often incomplete, knowledge mining, analysis, and trending are increasingly important. Therefore, Jara et al. [3] presented a knowledge acquisition and management platform relying on IoT based architecture. The platform focused on the management of personal and mobile health and enabled delivery of new services by virtue of its capabilities to predict health anomalies in real-time, offer feedback to patients, and support security and privacy.In 2011, Zakriti and Guennoun [4] investigated an IoT based model to support interconnectivity and interoperability among smart objects. The proposed method solved various challenges, such as the integration of heterogeneity among devices, the development of diversified protocols, the desired properties of self-manageability and self-organization, and adaptive security and privacy for IoT networks. Then, Tozlu et al. [5] demonstrated three types of sensor-based application scenarios and examined the feasibility of low-power WiFi technology to enable IP connectivity between battery-powered objects. Next, Jin et al. [6] proposed a framework encompassing an urban information system with a view to furthering the realization of smart cities through the concept of the IoT. The introduced framework includes cloud-based integration of respective systems and services and forms a transformational part of the existing cyber systems. This framework can be adapted to enhance the level of interconnectivity and interoperability of important city services. In 2014, Stankovic [7] investigated eight key research topics, that is, massive scaling, architecture and dependencies, creating knowledge and big data, robustness, openness, security, privacy, and human-in-the-loop, to look at how the IoT could change the world, and concluded that the future will see the IoT gradually becoming an increasingly sophisticated utility in terms of sensing, actuation, communications, control, and creating knowledge from vast amounts of data.In 2013, Hou et al. [8] designed a technique that enables secure initialization of a group of wireless devices, called Chorus, to defend against attack by an adversary. In order to achieve the key authentication property, the authors used Chorus to provide in-band group message authentication and group authenticated key agreement. In addition, two secure protocols are proposed to satisfy minimal hardware requirements and allow for minimal user effort; hence, the protocols are scalable to a large group of wireless devices. Next, in light of the coupling between diverse IoT sensors, applications, and services, Ukil et al. [9] presented the specific characteristics, visions, and challenges relating to the IoT. Based on the observations and conclusions, the authors developed a privacy preservation framework as a part of an IoT platform, including a data masking tool, for both privacy and utility preservation. After that, since security and privacy are two of the most pressing challenges for the development of IoT applications or architecture, Alqassem [10] specified the essential privacy and security requirements for the IoT and further established an engineering framework as the proof of concept. With the emerging technology brought about by the IoT, the connectivity between objects, such as home appliances and consumer electronics, can be successfully created and applied. On the other hand, as trillions of objects each require their own unique identifications, low-cost RFID technology has begun to attract attention. For this reason, Aggarwal and Das [11] developed a lightweight RFID based protocol to enhance system security while retaining the protocol’s efficiency. Later, Torjusen et al. [12] proposed a solution to integrate run-time verification enablers in the feedback adaptation loop of the ASSET [13], that is, an adaptive security framework for the IoT in the eHealth environment, and implemented the framework with colored Petri Nets. The run-time enablers produce machine based formal models of a system’s status and context available at run-time. Moreover, the authors presented requirements for verification at run-time as formal specifications and introduced dynamic context monitoring and adaptation.In recent years, IoT technologies have created an environment characterized by linkage between software systems and the physical world and have catalyzed a movement towards invisible and natural interactions among objects. However, providing efficient and customized personal services requires information about every distinct individual or entity, and this leads to the potential for privacy invasion. Hence, the information flow control and the design of low-cost tags (or, alternatively, small data size) become very important issues. From these observations, Evans and Eyers [14] introduced code templates for two small microcontrollers that make meaningful tagging possible. Later, Skarmeta et al. [15] proposed a capability-based access control mechanism that is built on public key cryptography. The essential ideas are based on the design of a lightweight token used for accessing CoAP (Constrained Application Protocol) resources and a digital signature algorithm inside the smart object. Being based on these two newly proposed techniques, the presented access control mechanism can provide better security and privacy for IoT based networks.Different wireless communication technologies and network infrastructures are continuously being integrated, such as WSN, RFID systems, 3G technology, WIMAX, PAN, and so forth. In order to solve related security problems, Chen et al. [16] proposed a security architecture for an IoT environment. The proposed system architecture is adaptive to the IoT environment, and, in addition, a security verification mechanism was introduced. Later, Berhanu et al. [17] described a setup for adaptive security for IoT devices in an eHealth environment and discussed the validation of the setup through the study of the impact of antenna orientation on energy consumption. The authors then studied the feasibility of adopting lightweight security solutions as part of the ASSET infrastructure [13]. Next, Ning et al. [18] proposed an authentication scheme for IoT networks. The authors exploited U2loT architecture to design an aggregated-proof based hierarchical authentication scheme for layered networks. In this authentication mechanism, several concepts, such as anonymous data transmission, mutual authentication, and different access authorities, were incorporated to achieve hierarchical access control. Moreover, Chen [19] proposed a possible solution based on an IBE (identity-based encryption) cryptosystem to efficiently and effectively solve the privacy and security threats encountered in the IoT. The elliptic curve cryptosystem is applied for achieving security in the IoT, and the authors established that essential security problems could be solved without too much resource consumption. After that, Paar [20] developed a concept that took into account both the destructive and constructive aspects embedded in the security of the IoT. The purpose was to examine the efficiency of tradeoffs between the desired security and the lowest possible cost.Li and Xiong [21] developed a secure scheme for achieving confidentiality, integrity, authentication, and nonrepudiation in a logical single step. The proposed method splits the signcryption into two phases, with an online phase and an offline phase, and allows a sensor node in an identity-based cryptosystem to send a message to an Internet host. Hence, this scheme successfully provides an efficient solution for integrating WSN into IoT. Afterwards, in [22] the author analyzed the security requirements in different layers of the IoT and arrived at two conclusions: (a) the future security issues related to the IoT will mainly involve an open security system, individual privacy protection, and terminal security functionality; and (b) the security of the IoT must be seen from a perspective of integration which mandates the need for a series of policies, laws, and regulations, as well as a perfect security management system for mutual collocation. In 2013, Hummen et al. [23] introduced an IoT oriented authentication scheme which is based on the designs of prevalidation, session resumption, and handshake delegation. The proposed scheme can provide peer authentication and secure data transmission. In the following year, Kantarci and Hussein [24] demonstrated a framework for ensuring public safety in a cloud-centric IoT environment, where smartphones equipped with various types of sensors are deployed. To ensure trustworthiness in the framework, the authors proposed a reputation-based S2aaS scheme, called Trustworthy Sensing for Crowd Management (TSCM), which is able to collect sensing data based on a cloud model. In addition, the authors designed an auction procedure to select mobile devices for particular sensing tasks and to determine the appropriate payments to the users of the mobile devices that provide data. Furthermore, Tilanus et al. [25] discussed the motivations for opening up a given IoT so as to make the “things” it contains part of the global IoT. The proposed method comprises the definition and control of access rights to the discovery and use of virtual objects. It has the potential to play a central role in the verification of access rights to virtual objects in the deployment of the IoT.


## 3. The Proposed Schemes

With the advancement of IoT networks, numerous network services and mobile devices have been deployed in pursuit of the betterment of human wellbeing. In general, users may register with the server once and maintain a set of verified data (or parameters) as the login token for system resource and service retrieval. The concept is called the single sign-on (SSO), whereby legal users are allowed to use the unitary token to access different services (or devices). Our proposed authentication scheme is based on the SSO technique, whereby a mobile application allows a user to utilize a mobile device with a unitary token to access multiple services. The techniques of a one-way hash function and random nonce are adopted to simultaneously ensure system efficiency and security robustness. In addition, we present a coexistence mechanism to prove the correctness of the coexisting medical items. With a proof for a group of tagged objects existing at the same time and the same place, medicine error prevention and patient safety can further be enhanced.


### 3.1. The Proposed Authentication Scheme

In our scheme, three entities, that is, the userUi or the authentication server ASj, and a trusted third-party authority TTPA, exist. The server and the trusted authority TTPA do not require the maintenance of any registration table for each registered communication entity. First, the TTPA selects two large primes p and q and computes N=p·q. Then, the TTPA determines the key pair (e,d) such that e·d≡1modφ(N), where φ(N)=(p-1)(q-1). Next, the TTPA chooses a generator g over the finite field Zn∗, where n is a large-enough odd prime number. Finally, the TTPA protects the secret d and publishes (e,g,n,N). Note that all the information about the parameters p and q is erased after initialization of the system. Now, both the user and the server need to store only one set of public parameters, that is, e,g,ga,n,N,h(·) published by the TTPA, where a is a secret generated by the TTPA and h(·) is a collision-resistant one-way hash function.Registration Phase. In the registration phase, each user Ui registers a unique and fixed bit-length identity IDi at the TTPA side and obtains a secret token Si from the TTPA through a secure channel. The secret token Si is as Si=(IDi∥h(IDi∥b))dmodN, where b is also a secret generated by the TTPA. Similarly, the server ASj registers a unique identity IDj at the TTPA side and obtains a secret token Sj from the TTPA through a secure channel, where Sj=(h(IDj∥b))dmodN. Note that IDj is public for each service request.User Identification and Verification Phase (Figure1). If the user Ui wants to request an authentication service from ASj, the user identification and verification phase is invoked.(1)
Ui computes, gn1modN, (ga)n1modN, and A=(Si∥n1)⊕h(gan1) and sends message m1=IDj,gn1,A to ASj, where n1 is a random nonce generated by Ui. Upon receiving m1, ASj generates a random nonce n2 to calculate gn2mod⁡N, (ga)n2modN, and B=Sj∥n2⊕hgan2 and forwards m2={IDj,gn1,A,gn2,B} to the TTPA.(2)
After gettingm2, the TTPA computes (gn1)amodN and (gn2)amodN and derived (Si∥n1) and (Sj∥n2) from A⊕hgan1 and B⊕h(gan2). Next, the TTPA verifies Si and Sj via the following computations:
(Si)emodN=(IDi∥h(IDi∥b))demodN(Sj)emodN=(h(IDj∥b))demodN.Figure 1
The proposed authentication scheme.Computeh(IDi∥b) with retrieved value IDi, and compare the result with retrieved value hIDi∥b.Computeh(IDi∥b) with received value IDj and retrieved value h(IDj∥b)?If the above verification is passed, the TTPA chooses a random noncen3 and computes the following values: (gn1)n3modN, (gn2)n3modN, C=h((gn1)n3∥(gn2)n3∥n2), and D=hIDj∥(gn2)n3∥n1. Next, the TTPA sends m3={gn1n3,C,gn2n3,D} to ASj.(3)
OnceASj obtains m3, ASj computes the session key Kij=(gn1n3)n2modN and examines the validity of value C. That is, ASj calculates h((gn1)n3∥(gn2)n3∥n2) and compares it with value C. If these values are not equal, the protocol terminates. Otherwise, ASj calculates E=hIDj∥Kij and sends m4={gn2n3,D,E} to Ui. After that, ASj believes that Ui is an authorized user.(4)
After receivingm4, Ui derives the session key Kij=(gn2n3)n1modN and examines the validity of values D and E. In other words, Ui computes hIDj∥(gn2)n3∥n1 and hIDj∥Kij and examines whether the following two equations hold or not.
(a)
Is computedhIDj∥(gn2)n3∥n1 equal to received D?(b)
Is computedhIDj∥Kij equal to received E?If these two examinations hold,Ui believes that ASj is an authorized service provider with current session key Kij.


### 3.2. The Proposed Coexistence Mechanism (Figure2)

Recently, the concept of coexistence proof for RF tags has been introduced to prove multiple tagged objects existing at the same time in the same place. Such proofs can be utilized in the application field of inpatient safety and medication management. In the proposed mechanism, each RF tagTi requires supporting lightweight operations, that is, a 16-bit pseudorandom number generation (PRNG) function and bitwise exclusive OR (XOR) operation, and the backend coexistence server maintains two secret keys Xi and Yi, an index-pseudonym IDSi, and a unique identity IDi for each Ti. In addition, the timestamp scheme and a random one-way permutation function F mapping within range 1,2L are adopted in the proposed mechanism, where L is the security parameter. The implementation of F is based on PRNG and XOR to obtain operational efficiency for low-cost RF tags [26].Figure 2
The proposed coexistence mechanism.Step 1.
First, the RF reader requests a well-protected timestampFts⊕Ks from the backend server, where Ks is the server’s secret key. Note that a corresponding log is created. An initial message {Hello,Fts⊕Ks} is then issued to Ta and Tb. After Ta and Tb get the incoming message, they both send IDSa,ra,va=F(F(Ya)⊕F(ts⊕Ks)⊕ra) and {IDSb,rb,vb=F(F(Yb)⊕F(ts⊕Ks)⊕rb)} to the reader, respectively. And the reader immediately forwards these two responses with Fts⊕Ks to the backend server. At the server side, if the verification of Fts⊕Ks holds, (i.e., the validity of the current process time-period is verified), the server will then verify va and vb. Once the examinations of va and vb hold, the server sends two derived key values, that is, Ka=FF(F(Ya))⊕ra and Kb=FF(F(Yb))⊕rb, to the reader and updates {Ya,IDSa,Yb,IDSb} with Ya′=F(Ya⊕ra),IDSa′=F(Ya′⊕IDSa),Yb′=F(Yb⊕rb),IDSb′=F(Yb′⊕IDSb).Step 2.
Upon obtainingKa and Kb, the reader computes αa=FKa⊕FFts⊕Ks⊕IDSb and sends αa,F(F(ts⊕Ks)⊕IDSb) to Ta.Step 3.
AfterTa receives αa,F(F(ts⊕Ks)⊕IDSb), Ta computes Ka=FF(F(Ya))⊕ra with its own secret key Ya and examines αa=FKa⊕F(F(ts⊕Ks)⊕IDSb). If it holds, Ta will then calculate ma=FIDSa⊕F(F(ts⊕Ks)⊕IDSb)⊕Xa and βa=FF(Ka)⊕ma and send {ma,βa} to the reader. Then, Ta updates {Ya,IDSa} to {Ya′=F(Ya⊕ra),IDSa′=F(Ya′⊕IDSa)}.Step 4.
Once the reader gets{ma,βa}, it verifies βa=FF(Ka)⊕ma. If the examination passes, the reader sends αb,F(ma⊕IDSa) to Tb, where αb=FKb⊕F(ma⊕IDSa).Step 5.
After receiving{αb,F(ma⊕IDSa)}, Tb uses its key Yb to compute Kb=FF(F(Yb))⊕rb and verify αb=FKb⊕F(ma⊕IDSa). If it holds, Tb will send βb,mb to the reader in which mb=FIDSb⊕F(ma⊕IDSa)⊕Xb and βb=FF(Kb)⊕mb. Next, Tb updates Yb,IDSb with Yb′=F(Yb⊕rb),IDSb′=F(Yb′⊕IDSb).Step 6.
Upon receivingβb,mb, the reader performs the verification of βb=FF(Kb)⊕mb. If it holds, the reader confirms the coexistence of Ta and Tb with a valid proof Pab=IDSa,IDSb,t,ma,mb.


## 3.1. The Proposed Authentication Scheme

In our scheme, three entities, that is, the userUi or the authentication server ASj, and a trusted third-party authority TTPA, exist. The server and the trusted authority TTPA do not require the maintenance of any registration table for each registered communication entity. First, the TTPA selects two large primes p and q and computes N=p·q. Then, the TTPA determines the key pair (e,d) such that e·d≡1modφ(N), where φ(N)=(p-1)(q-1). Next, the TTPA chooses a generator g over the finite field Zn∗, where n is a large-enough odd prime number. Finally, the TTPA protects the secret d and publishes (e,g,n,N). Note that all the information about the parameters p and q is erased after initialization of the system. Now, both the user and the server need to store only one set of public parameters, that is, e,g,ga,n,N,h(·) published by the TTPA, where a is a secret generated by the TTPA and h(·) is a collision-resistant one-way hash function.Registration Phase. In the registration phase, each user Ui registers a unique and fixed bit-length identity IDi at the TTPA side and obtains a secret token Si from the TTPA through a secure channel. The secret token Si is as Si=(IDi∥h(IDi∥b))dmodN, where b is also a secret generated by the TTPA. Similarly, the server ASj registers a unique identity IDj at the TTPA side and obtains a secret token Sj from the TTPA through a secure channel, where Sj=(h(IDj∥b))dmodN. Note that IDj is public for each service request.User Identification and Verification Phase (Figure1). If the user Ui wants to request an authentication service from ASj, the user identification and verification phase is invoked.(1)
Ui computes, gn1modN, (ga)n1modN, and A=(Si∥n1)⊕h(gan1) and sends message m1=IDj,gn1,A to ASj, where n1 is a random nonce generated by Ui. Upon receiving m1, ASj generates a random nonce n2 to calculate gn2mod⁡N, (ga)n2modN, and B=Sj∥n2⊕hgan2 and forwards m2={IDj,gn1,A,gn2,B} to the TTPA.(2)
After gettingm2, the TTPA computes (gn1)amodN and (gn2)amodN and derived (Si∥n1) and (Sj∥n2) from A⊕hgan1 and B⊕h(gan2). Next, the TTPA verifies Si and Sj via the following computations:
(Si)emodN=(IDi∥h(IDi∥b))demodN(Sj)emodN=(h(IDj∥b))demodN.Figure 1
The proposed authentication scheme.Computeh(IDi∥b) with retrieved value IDi, and compare the result with retrieved value hIDi∥b.Computeh(IDi∥b) with received value IDj and retrieved value h(IDj∥b)?If the above verification is passed, the TTPA chooses a random noncen3 and computes the following values: (gn1)n3modN, (gn2)n3modN, C=h((gn1)n3∥(gn2)n3∥n2), and D=hIDj∥(gn2)n3∥n1. Next, the TTPA sends m3={gn1n3,C,gn2n3,D} to ASj.(3)
OnceASj obtains m3, ASj computes the session key Kij=(gn1n3)n2modN and examines the validity of value C. That is, ASj calculates h((gn1)n3∥(gn2)n3∥n2) and compares it with value C. If these values are not equal, the protocol terminates. Otherwise, ASj calculates E=hIDj∥Kij and sends m4={gn2n3,D,E} to Ui. After that, ASj believes that Ui is an authorized user.(4)
After receivingm4, Ui derives the session key Kij=(gn2n3)n1modN and examines the validity of values D and E. In other words, Ui computes hIDj∥(gn2)n3∥n1 and hIDj∥Kij and examines whether the following two equations hold or not.
(a)
Is computedhIDj∥(gn2)n3∥n1 equal to received D?(b)
Is computedhIDj∥Kij equal to received E?If these two examinations hold,Ui believes that ASj is an authorized service provider with current session key Kij.


## 3.2. The Proposed Coexistence Mechanism (Figure2)

Recently, the concept of coexistence proof for RF tags has been introduced to prove multiple tagged objects existing at the same time in the same place. Such proofs can be utilized in the application field of inpatient safety and medication management. In the proposed mechanism, each RF tagTi requires supporting lightweight operations, that is, a 16-bit pseudorandom number generation (PRNG) function and bitwise exclusive OR (XOR) operation, and the backend coexistence server maintains two secret keys Xi and Yi, an index-pseudonym IDSi, and a unique identity IDi for each Ti. In addition, the timestamp scheme and a random one-way permutation function F mapping within range 1,2L are adopted in the proposed mechanism, where L is the security parameter. The implementation of F is based on PRNG and XOR to obtain operational efficiency for low-cost RF tags [26].Figure 2
The proposed coexistence mechanism.Step 1.
First, the RF reader requests a well-protected timestampFts⊕Ks from the backend server, where Ks is the server’s secret key. Note that a corresponding log is created. An initial message {Hello,Fts⊕Ks} is then issued to Ta and Tb. After Ta and Tb get the incoming message, they both send IDSa,ra,va=F(F(Ya)⊕F(ts⊕Ks)⊕ra) and {IDSb,rb,vb=F(F(Yb)⊕F(ts⊕Ks)⊕rb)} to the reader, respectively. And the reader immediately forwards these two responses with Fts⊕Ks to the backend server. At the server side, if the verification of Fts⊕Ks holds, (i.e., the validity of the current process time-period is verified), the server will then verify va and vb. Once the examinations of va and vb hold, the server sends two derived key values, that is, Ka=FF(F(Ya))⊕ra and Kb=FF(F(Yb))⊕rb, to the reader and updates {Ya,IDSa,Yb,IDSb} with Ya′=F(Ya⊕ra),IDSa′=F(Ya′⊕IDSa),Yb′=F(Yb⊕rb),IDSb′=F(Yb′⊕IDSb).Step 2.
Upon obtainingKa and Kb, the reader computes αa=FKa⊕FFts⊕Ks⊕IDSb and sends αa,F(F(ts⊕Ks)⊕IDSb) to Ta.Step 3.
AfterTa receives αa,F(F(ts⊕Ks)⊕IDSb), Ta computes Ka=FF(F(Ya))⊕ra with its own secret key Ya and examines αa=FKa⊕F(F(ts⊕Ks)⊕IDSb). If it holds, Ta will then calculate ma=FIDSa⊕F(F(ts⊕Ks)⊕IDSb)⊕Xa and βa=FF(Ka)⊕ma and send {ma,βa} to the reader. Then, Ta updates {Ya,IDSa} to {Ya′=F(Ya⊕ra),IDSa′=F(Ya′⊕IDSa)}.Step 4.
Once the reader gets{ma,βa}, it verifies βa=FF(Ka)⊕ma. If the examination passes, the reader sends αb,F(ma⊕IDSa) to Tb, where αb=FKb⊕F(ma⊕IDSa).Step 5.
After receiving{αb,F(ma⊕IDSa)}, Tb uses its key Yb to compute Kb=FF(F(Yb))⊕rb and verify αb=FKb⊕F(ma⊕IDSa). If it holds, Tb will send βb,mb to the reader in which mb=FIDSb⊕F(ma⊕IDSa)⊕Xb and βb=FF(Kb)⊕mb. Next, Tb updates Yb,IDSb with Yb′=F(Yb⊕rb),IDSb′=F(Yb′⊕IDSb).Step 6.
Upon receivingβb,mb, the reader performs the verification of βb=FF(Kb)⊕mb. If it holds, the reader confirms the coexistence of Ta and Tb with a valid proof Pab=IDSa,IDSb,t,ma,mb.


## 4. Security Analyses

In this section, we analyze the security of the proposed authentication scheme for IoT based healthcare systems. We first present the adversary model and then conduct the security analysis of the proposed authentication scheme and the coexistence proof mechanism.


### 4.1. Adversary Model

In the communication model, we assume that a userUi intends to establish a session key SKey(i,j) with an authentication server Sj via the help of the trusted third-party authority TTPA. We assume that the adversary can interact with the participants via oracle queries. The following major queries model the capabilities of the adversary. Note that ΠUi is denoted as the instance i of a participant U.(i)
SendΠUi,m: this query sends a message m to an oracle ΠUi and gets the corresponding result.(ii)
Reveal(ΠUi): this query returns the session key of the oracle ΠUi.(iii)
Corrupt(U): this query returns the long-term secret key of U.(iv)
Execute(ΠUAi,ΠUBi): this query models passive attacks in which the adversary can obtain the messages exchanged during the honest execution of the protocol between two oracles ΠUAi and ΠUBi.(v)
Hash(m): the one-way hash function can be viewed as random functions within the appropriate range in the ideal hash model. Note that if m has never been queried before, it returns a truly random number r to the adversary and stores (r,m) in the hash table. Otherwise, it returns the previously generated result to the adversary.(vi)
Test(ΠUi): this query models the security of the session key, that is, whether the real session key can be distinguished from a random string or not. For answering this question, an unbiased coin b is flipped by the oracle ΠUi. When the adversary issues a single Test query to ΠUi, the adversary obtains either the real session key SKey(i,j) if b=1 or a random string if b=0.


### 4.2. Security Analysis of the Proposed Authentication Scheme

In this subsection, we present the formal analysis of our proposed authentication scheme based on [27–29].(i)
AKE security (session key security): the adversary tries to guess the hidden bitb involved in a Test query via a guess b′. We say that the adversary wins the game of breaking the session key security of an AKE (Authenticated Key Exchange) protocol P if the adversary issues Test queries to a fresh oracle ΠUi and guesses the hidden bit b successfully. The probability that the adversary wins the game is Pr[b′=b]. In brief, the advantage of an adversary Eve in attacking protocol P can be defined as AdvPAKEEve=|2×Pr⁡b′=b-1|. In brief, P is AKE-secure if AdvPAKEEve is negligible.In the following subsection, we formally analyze the security of our proposed authentication protocol. Notations and definitions are presented first, and the formal security analysis is then demonstrated. We defineTEve as the adversary’s total running time, and qs, qr, qc, qe, and qh are the number of Send, Reveal, Corrupt, Execute, and Hash queries, respectively.(ii)
Computational Diffie-Hellman (CDH) assumption: let G=g be a multiplicative cyclic group of order N, and let two random numbers t and k be chosen in ZN∗. Given g, gt, and gk, the adversary Eve has a negligible success probability SuccGCDHEve of obtaining an element z∈G, such that z=gtk within polynomial time.Theorem 1.
Let Eve be an adversary against the AKE security of our proposed authentication scheme within a time boundTEve, with less than qs Send queries with the communication entities, and qh times Hash queries. Then, AdvPAKEEve,qs,qh≤qhqs×SuccGCDHTEve′, where TEve′ denotes the computational time for SuccGCDH and qs=∑i=15qs_i is the sum of the number of Send1, Send2, Send3, Send4, and Send5.Proof.
Let Eve be an adversary that is able to get an advantageε to break the AKE-secure protocol within time TEve. We can construct a CDH attacker ATT from Eve to respond to all of Eve’s queries and deal with the CDH problem, where ATT is given a challenge Ω=(gt,gk) and outputs an element z such that z=gtk.
First, when Eve issues aSend1 query as a start command, ATT responds with m1={IDj,gn1,A} to Eve. Second, when Eve issues a Send2 query, ATT randomly chooses two integers c1 and c2 from 1,qs_2. If c1≠c2, ATT responds with {IDj,gn1,A,gn2,B} to Eve. Otherwise, ATT replaces the corresponding parameters of m2={IDj,gn1,A,gn2,B} with the element gk from Ω to generate a new and random message m2′ and then responds with the message m2′ to Eve. Third, once ATT receives the Send3 query from Eve, ATT answers with the message m3={gn1n3,C,gn2n3,D} as the protocol. If the input of the query is from Ω, ATT generates a new message m3′ and then responds with m3′ to Eve. Fourth, when Eve issues the Send4 query, ATT answers with m4={gn2n3,D,E} to Eve. Otherwise, a random string m4′ will be generated and sent to Eve. Finally, ATT answers a null string via a Send5 query and then sets the protocol as being successful (or sets all conditions to true).
In the alternative, when Eve issues a Reveal(ΠUii) or a Reveal(ΠSjj) query, ATT checks whether the oracle has been accepted and is fresh or not. If the result is positive, ATT answers with the session key SKey(i,j) to Eve. Otherwise, if the session key has been constructed from the challenge Ω, ATT terminates. When Eve issues Corrupt(Ui), Corrupt(Sj), Execute(ΠUii,ΠSjj), Hash(m) queries, ATT answers in a straightforward way. When Eve issues a Test query, ATT answers in a straightforward way. Otherwise, if the session key has been constructed from the challenge Ω, ATT answers Eve with a random string with the same length as the session key SKey(i,j).
The above simulation is indistinguishable from any execution of the proposed protocolP except for one execution which involves the challenge Ω. The probability γ that ATT correctly guesses the session key, which Eve will make a Test query on, is equal to the probability of c1=c2. Hence, we have γ=1/qs_2≥1/qs.
Assume that Eve issues a Test query to outputb′, where b′=b. This means that Eve knows the session key, so there must be at least one Hash query that returns the session key. The probability λ that ATT will choose the Hash query correctly is λ≥1/qh. The successful probability SuccGCDHATT that ATT will expose gkt from the challenge Ω is thus SuccGCDHATT=ε×γ×λ≥ε×1/qs×1/qh. Finally, the advantage of Eve to break the AKE security of the protocol P is derived as follows:(1)ε=AdvPAKEEve,qs,qh≤qhqs×SuccGCDHTEve′.


### 4.3. Security Analysis of the Proposed Coexistence Scheme

In this subsection, we present the security claims of our proposed coexistence mechanism, such as data confidentiality and the resistance to proof counterfeit attack and replay attack.Claim 1.
The proposed coexistence mechanism is secure against proof counterfeit attack.In our proposed coexistence mechanism, the timestamp is generated from the backend server and is well-protected by the server’s secret key. This design removes the possibility of creating a legitimate but fake timestamp. Hence, it is impossible to create a counterfeit proof involving fake timestamp for the purpose of deception. In addition, the proposed mechanism is based on the random one-way permutation functionF which is an efficient and robust computation component for low-cost RF tags [26]. As all the transmitted information is involved with the function F, it is difficult to derive the information without knowing all the communication entities’ secret keys and the corresponding timestamps. Therefore, the proposed scheme can guarantee resistance to proof counterfeit attack. At the same time, system efficiency is delivered by virtue of the lightweight computation cost of the permutation function F.Claim 2.
The proposed coexistence mechanism can provide data confidentiality and resist against replay attack.We assume that a malicious adversary Eve can intercept all messages communicated between RF tagsTa, Tb, and the reader. Because the adversary Eve cannot derive the private keys, that is, Xi or Yi for the target tag Ti, from messages transmitted via the public channel, the data involved in the transmitted messages cannot be retrieved. In addition, the one-way property of the function F serves to guarantee the unrecovery of the input data, so that data confidentiality can thus be achieved. Moreover, in each session of our proposed scheme, we exploit random numbers, that is, ra and rb, in randomizing transmitted messages. In addition, the timestamp ts is involved with the construction of the verification message Pab. These random numbers and the timestamp can not only randomize the transmitted messages but can ensure resistance against replay attack.


## 4.1. Adversary Model

In the communication model, we assume that a userUi intends to establish a session key SKey(i,j) with an authentication server Sj via the help of the trusted third-party authority TTPA. We assume that the adversary can interact with the participants via oracle queries. The following major queries model the capabilities of the adversary. Note that ΠUi is denoted as the instance i of a participant U.(i)
SendΠUi,m: this query sends a message m to an oracle ΠUi and gets the corresponding result.(ii)
Reveal(ΠUi): this query returns the session key of the oracle ΠUi.(iii)
Corrupt(U): this query returns the long-term secret key of U.(iv)
Execute(ΠUAi,ΠUBi): this query models passive attacks in which the adversary can obtain the messages exchanged during the honest execution of the protocol between two oracles ΠUAi and ΠUBi.(v)
Hash(m): the one-way hash function can be viewed as random functions within the appropriate range in the ideal hash model. Note that if m has never been queried before, it returns a truly random number r to the adversary and stores (r,m) in the hash table. Otherwise, it returns the previously generated result to the adversary.(vi)
Test(ΠUi): this query models the security of the session key, that is, whether the real session key can be distinguished from a random string or not. For answering this question, an unbiased coin b is flipped by the oracle ΠUi. When the adversary issues a single Test query to ΠUi, the adversary obtains either the real session key SKey(i,j) if b=1 or a random string if b=0.


## 4.2. Security Analysis of the Proposed Authentication Scheme

In this subsection, we present the formal analysis of our proposed authentication scheme based on [27–29].(i)
AKE security (session key security): the adversary tries to guess the hidden bitb involved in a Test query via a guess b′. We say that the adversary wins the game of breaking the session key security of an AKE (Authenticated Key Exchange) protocol P if the adversary issues Test queries to a fresh oracle ΠUi and guesses the hidden bit b successfully. The probability that the adversary wins the game is Pr[b′=b]. In brief, the advantage of an adversary Eve in attacking protocol P can be defined as AdvPAKEEve=|2×Pr⁡b′=b-1|. In brief, P is AKE-secure if AdvPAKEEve is negligible.In the following subsection, we formally analyze the security of our proposed authentication protocol. Notations and definitions are presented first, and the formal security analysis is then demonstrated. We defineTEve as the adversary’s total running time, and qs, qr, qc, qe, and qh are the number of Send, Reveal, Corrupt, Execute, and Hash queries, respectively.(ii)
Computational Diffie-Hellman (CDH) assumption: let G=g be a multiplicative cyclic group of order N, and let two random numbers t and k be chosen in ZN∗. Given g, gt, and gk, the adversary Eve has a negligible success probability SuccGCDHEve of obtaining an element z∈G, such that z=gtk within polynomial time.Theorem 1.
Let Eve be an adversary against the AKE security of our proposed authentication scheme within a time boundTEve, with less than qs Send queries with the communication entities, and qh times Hash queries. Then, AdvPAKEEve,qs,qh≤qhqs×SuccGCDHTEve′, where TEve′ denotes the computational time for SuccGCDH and qs=∑i=15qs_i is the sum of the number of Send1, Send2, Send3, Send4, and Send5.Proof.
Let Eve be an adversary that is able to get an advantageε to break the AKE-secure protocol within time TEve. We can construct a CDH attacker ATT from Eve to respond to all of Eve’s queries and deal with the CDH problem, where ATT is given a challenge Ω=(gt,gk) and outputs an element z such that z=gtk.
First, when Eve issues aSend1 query as a start command, ATT responds with m1={IDj,gn1,A} to Eve. Second, when Eve issues a Send2 query, ATT randomly chooses two integers c1 and c2 from 1,qs_2. If c1≠c2, ATT responds with {IDj,gn1,A,gn2,B} to Eve. Otherwise, ATT replaces the corresponding parameters of m2={IDj,gn1,A,gn2,B} with the element gk from Ω to generate a new and random message m2′ and then responds with the message m2′ to Eve. Third, once ATT receives the Send3 query from Eve, ATT answers with the message m3={gn1n3,C,gn2n3,D} as the protocol. If the input of the query is from Ω, ATT generates a new message m3′ and then responds with m3′ to Eve. Fourth, when Eve issues the Send4 query, ATT answers with m4={gn2n3,D,E} to Eve. Otherwise, a random string m4′ will be generated and sent to Eve. Finally, ATT answers a null string via a Send5 query and then sets the protocol as being successful (or sets all conditions to true).
In the alternative, when Eve issues a Reveal(ΠUii) or a Reveal(ΠSjj) query, ATT checks whether the oracle has been accepted and is fresh or not. If the result is positive, ATT answers with the session key SKey(i,j) to Eve. Otherwise, if the session key has been constructed from the challenge Ω, ATT terminates. When Eve issues Corrupt(Ui), Corrupt(Sj), Execute(ΠUii,ΠSjj), Hash(m) queries, ATT answers in a straightforward way. When Eve issues a Test query, ATT answers in a straightforward way. Otherwise, if the session key has been constructed from the challenge Ω, ATT answers Eve with a random string with the same length as the session key SKey(i,j).
The above simulation is indistinguishable from any execution of the proposed protocolP except for one execution which involves the challenge Ω. The probability γ that ATT correctly guesses the session key, which Eve will make a Test query on, is equal to the probability of c1=c2. Hence, we have γ=1/qs_2≥1/qs.
Assume that Eve issues a Test query to outputb′, where b′=b. This means that Eve knows the session key, so there must be at least one Hash query that returns the session key. The probability λ that ATT will choose the Hash query correctly is λ≥1/qh. The successful probability SuccGCDHATT that ATT will expose gkt from the challenge Ω is thus SuccGCDHATT=ε×γ×λ≥ε×1/qs×1/qh. Finally, the advantage of Eve to break the AKE security of the protocol P is derived as follows:(1)ε=AdvPAKEEve,qs,qh≤qhqs×SuccGCDHTEve′.


## 4.3. Security Analysis of the Proposed Coexistence Scheme

In this subsection, we present the security claims of our proposed coexistence mechanism, such as data confidentiality and the resistance to proof counterfeit attack and replay attack.Claim 1.
The proposed coexistence mechanism is secure against proof counterfeit attack.In our proposed coexistence mechanism, the timestamp is generated from the backend server and is well-protected by the server’s secret key. This design removes the possibility of creating a legitimate but fake timestamp. Hence, it is impossible to create a counterfeit proof involving fake timestamp for the purpose of deception. In addition, the proposed mechanism is based on the random one-way permutation functionF which is an efficient and robust computation component for low-cost RF tags [26]. As all the transmitted information is involved with the function F, it is difficult to derive the information without knowing all the communication entities’ secret keys and the corresponding timestamps. Therefore, the proposed scheme can guarantee resistance to proof counterfeit attack. At the same time, system efficiency is delivered by virtue of the lightweight computation cost of the permutation function F.Claim 2.
The proposed coexistence mechanism can provide data confidentiality and resist against replay attack.We assume that a malicious adversary Eve can intercept all messages communicated between RF tagsTa, Tb, and the reader. Because the adversary Eve cannot derive the private keys, that is, Xi or Yi for the target tag Ti, from messages transmitted via the public channel, the data involved in the transmitted messages cannot be retrieved. In addition, the one-way property of the function F serves to guarantee the unrecovery of the input data, so that data confidentiality can thus be achieved. Moreover, in each session of our proposed scheme, we exploit random numbers, that is, ra and rb, in randomizing transmitted messages. In addition, the timestamp ts is involved with the construction of the verification message Pab. These random numbers and the timestamp can not only randomize the transmitted messages but can ensure resistance against replay attack.


## 5. Conclusion

In this paper, we have introduced two secure communication protocols for IoT based healthcare systems, in which a SSO based authentication scheme and a coexistence proof mechanism are proposed. The proposed authentication scheme is appropriate for use as the main protection technique for an IoT based healthcare environment consisting of various types of sensors, such as thin/fat sensors, sensor tags, or tagged items. For IoT network services, the proposed authentication scheme can provide robust entity authentication and secure data communication. In addition, we further present a coexistence proof protocol for proving multiple tagged objects (or sensors and/or sensor tags) existing at the same time and the same place. The generated proofs can be utilized in the application field of inpatient safety and medication management. Based on the security analysis results we have conducted, we are confident that the feasibility of these two proposed schemes can be guaranteed.



---

*Source: 183659-2015-11-01.xml*