PLAKA-MD: PUF-Based Lightweight Authentication and Key Agreement Scheme for Medical Devices in IoHT

Internet of Health Things (IoHT) integrates medical services and Internet of Things (IoT) to improve the accessibility of healthcare and accuracy of diagnosis. In IoHT environments, the transmission of sensitive data, such as patient medical records, physical characteristics, and genetic information, necessitates robust security mechanisms to protect privacy and ensure the integrity of real-time communication. Moreover, it is essential for healthcare professionals to have seamless access to patient data for accurate diagnoses. To address these demands, a lightweight and secure authentication protocol is critical for IoHT environments. Although some authentication protocols have been recently proposed in IoHT, they are susceptible to user insiders, privileged insiders, stolen verifiers, ephemeral key leakage, sensor insiders, physical attacks, and lack traceability. To overcome these vulnerabilities, we propose a mutual authentication protocol for IoHT environments. We design the proposed protocol as a lightweight using only hash functions and exclusive-OR operators. Furthermore, we utilized biometric information, physical unclonable functions (PUFs), and fuzzy extractors to strengthen security for both users and sensors. We validate the security robustness of the proposed protocol through formal analyses, including Automated Validation of Internet Security Protocols and Applications (AVISPAs), the Real-or-Random (RoR) model, and Burrows-Abadi-Needham (BAN) logic. Additionally, we evaluate the performance of the protocol by measuring the execution time of cryptographic primitives and comparing the computational and communication overheads with existing protocols. Results demonstrate that our protocol provides the most various kinds of security and functional features while maintaining similar efficiency than competing schemes.