RAPCHI: Robust authentication protocol for IoMT-based cloud-healthcare infrastructure.

With the fast growth of technologies like cloud computing, big data, the Internet of Things, artificial intelligence, and cyber-physical systems, the demand for data security and privacy in communication networks is growing by the day. Patient and doctor connect securely through the Internet utilizing the Internet of medical devices in cloud-healthcare infrastructure (CHI). In addition, the doctor offers to patients online treatment. Unfortunately, hackers are gaining access to data at an alarming pace. In 2019, 41.4 million times, healthcare systems were compromised by attackers. In this context, we provide a secure and lightweight authentication scheme (RAPCHI) for CHI employing Internet of medical Things (IoMT) during pandemic based on cryptographic primitives. The suggested framework is more secure than existing frameworks and is resistant to a wide range of security threats. The paper also explains the random oracle model (ROM) and uses two alternative approaches to validate the formal security analysis of RAPCHI. Further, the paper shows that RAPCHI is safe against man-in-the-middle and reply attacks using the simulation programme AVISPA. In addition, the paper compares RAPCHI to related frameworks and discovers that it is relatively light in terms of computation and communication. These findings demonstrate that the proposed paradigm is suitable for use in real-world scenarios.

Introduction

People choose an applicable medical system for high perfection of healthcare due to the quick growth of the Internet and its technology [1, 2]. Health centres provide medical services in remote regions in order to support the development of medical institutions and the medical sectors. The medical structure not only offers the necessary facilities, but it also improves medical care while maintaining the protection of patient data. Hospitals are working to develop their assistance so that patients may receive care that is easily accessible. When a patient enters the hospital, medical personnel immediately creates a medical report detailing their care in order to prevent mistakes. However, because this is not feasible everywhere, internet medical care has become a need in today’s world. Blood pressure, heart rate, body temperature, ECG, electromyography, and other physiological data are all measured by the medical equipment. The employment of wireless-assisted technology has removed the bulk of physical, geographical, and organisational barriers, removing the need to pass over medical papers and information to the relevant authorities [3]. Patients save information in the cloud for secure retrieval in a cloud-based telecare medical information system (TMIS) in medical management. Because it is well recognised that the cloud environment is not completely secure, a robust authentication structure should be implemented to handle security risks [4]. Both the patient and the doctor can share information over the cloud via TMIS. Following that the doctor gathers medical information from patients and uploads a diagnosis report to the cloud as if they had specifically participated. The medical report is a very important aim in TMIS to maintain security and privacy. In a CHI, it is not possible to acknowledge it openly. In terms of security and privacy, data transmitted between the cloud, the patient, and the doctor are a major concern that must be addressed in this system. The medical report falls under the heading of “essential information” and is vulnerable to theft. It might be a delicate decline in one’s life [5], and therefore, it is an important to provide a secure authentication framework so that an attacker cannot look into patients’ medical records [6].

IoMT, Internet of Things, Internet of Service, Artificial Intelligence, Cyber-Physical Systems (CPS), and Multi-access Edge-based Cloud Computing are some of the technical contexts in which CHIs operate. Due to many advantages of cloud computing platform in an IoMT driven smart healthcare system and extensive information processing, such as the requirement of mobility support, heterogeneity distributed architecture, and other factors, data security and privacy, authentication, and key agreement protocols in cloud environments are no longer secure in IoMT healthcare systems. A user’s data security, privacy, and physical control over the communication system are all compromised under this paradigm. Illegal data and data breath actions such as copy, deletion, alteration, and distribution can pose a number of security risks in these systems [7-9]. Data integrity, authenticity, secrecy, and other aspects of the cloud system may be affected by an attacker. As a result, it is a critical to develop a new solution against malicious attackers in order to build a safe and efficient environment.

Smart CHI is a technology that enables for the transfer of patient data across two or more sites. During COVID-19 pandemic, there are many users using many application of CHI. Hackers are obtaining access to data at an alarming pace. In 2019, healthcare systems were hacked 41.4 million times. In July 2020, 640,000 patient records were hacked at Florida Orthopedic Institute. In June 2020, Elite Emergency Physicians will have served 550,000 patients. It is necessary to preserve the data integrity of a patient in this system. CHI is playing an important role in medical user care for preserving the required physical distance during the ongoing COVID-19 epidemic. To safeguard sensitive patient data, integrity, secrecy, authentication, and key agreement methods are required in the current situation [10].

IoMT is a new field of CPS that aims to create a ubiquitous patient monitoring system. The majority of CHI’s demands are met by this technology. It also allows for more consistent and definite essential treatment before the patient’s health worsens. It is a cutting-edge technology approach for saving human lives by lowering the cost of medical treatment while removing the need for physical contact between the doctor and the patient. It has benefited medical users during COVID-19, according to [11]. The authentication and key agreement protocol in CHI is designed to manage security and privacy, including computation, data hiding, message authentication, mutual authentication, integrity, confidentiality, anonymity, non-repudiation, session key security communication, watermarking, and presume property rights, among other things [12]. A CHI system based on IoMT is expected to deal with algorithms that are computationally efficient, content authentication and key agreement that is safe, and so on.

Related work

In cloud-medical system, user should have particular access of medical information and privilege. They store data in cloud and TMIS can be classified into several applications to client constraints and organized classifications. A cloud-based approach for healthcare systems was proposed by Padhy et al. [13]. Banerjee et al. [14] proposed a cloud-based emergency healthcare system that retrieves the patient’s data centrally before any medical treatment begins. Li et al. [15] suggested a privacy-preserving strategy for TMIS employing a cloud environment in order to offer security, privacy, and medical resource access. Chatterjee et al. [16] proposed a secure biometric authentication protocol for TMIS with proper user authentication. In this protocol, authors had not discussed the user linkability and users relationship. Islam et al. [17] created a framework for user authentication and key agreement that is highly suited to modern information systems. Wazid et al. [18] proposed user authentication and session key agreement schemes with client anonymity for TMIS. It is suggested the patient’s healthcare record should be secure from malicious attacks. RSA-based safe authentication mechanism with user anonymity was proposed by Sutrala et al. [19]. They also used a verification tool to assure the security of the medical communication system. Chen et al. developed a cloud-based TMIS authentication technique [20] in 2014. In 2015, Amin et al. offered design and investigation authentication work for a healthcare system [21], He et al proposed robust authentication work for TMIS [22], and Zhou et al suggested a security-preserving cloud-supported wireless body area network approach [23]. Castiglione et al. developed a Software-as-a-Service (SaaS)-assisted cloud heterogeneous equipments communication system for TMIS resources used by clients [24]. Chiou et al. [25] exhibited Chen et al. framework [20] in 2016, claiming that it fails to provide actual telemedicine, communication authentication, or patient anonymity. Then, in a similar situation, Chiou et al. devised a modification technique. In 2017, Mohit et al. [26] challenged that Chiou et al.’s protocol cannot support in mobile stolen verifier attack and patient anonymity. In addition to, Mohit et al. suggested authentication work for healthcare system. Kumar et al. [6] and Li et al. [27] shown the drawbacks of Mohit et al. scheme. Most recently, Kumar et al. [28] reviewed Li et al. scheme and discussed demerits of [27]. In 2019, Chandrakar et al. [29] presented cloud-based authenticated protocol for healthcare monitoring system which is not secure against patient anonymity, data confidentiality, impersonation attack and patient password change. For wireless body area network, Chen and Peng proposed analysing and improving a mutual authentication and key agreement mechanism [30]. Chen et al. [31] presented an authorization mechanism for smart device usage in cloud environments in the year 2020. For RFID-based healthcare systems, Zhu et al. [32] proposed a lightweight authentication technique. Arunkumar and Kousalya [33] suggested a decentralised and safe lightweight E-health system based on blockchain technology. For TMIS, Amintoosi and Nikooghadam suggested an ECC-based authentication and key management mechanism that is probably safe [33]. In this protocol, they claimed that Khatoon et al.’s [34] scheme is vulnerable to known-session-specific temporary information attacks as well as perfect forward secrecy. Deebak and Turjman [35] proposed a protocol for CHI using IoMT. It does not contain patient password change phase, high computation and communication cost. Chen et al. [36] a RFID authentication protocol for epidemic prevention and epidemic emergency management systems. They claimed that the designed scheme can aid in the realisation of the safety and traceability of epidemic prevention materials, as well as improving the automation and decision-making efficiency of epidemic prevention. Hathaliy and Tanwar presented an exhaustive survey on security and privacy issues in Healthcare 4.0 [37]. The authors claim that different taxonomies used in Healthcare 4.0 to investigate various security and privacy issues are also presented in a structured manner. The benefits and drawbacks of various security and privacy techniques are then discussed. Awotunde et al. proposed the big data analytics of IoT-based cloud system framework: smart healthcare monitoring systems [38]. They discussed Raj et al. published a work entitle issues and challenges related to privacy and security in healthcare using IoT, Fog, and cloud computing [39]. According to them, the published paper also includes some methodology used in various research papers to address security and privacy issues in the IoT, fog, and cloud computing environments. Singh et al. [40] proposed IoT for sustaining a smart and secure healthcare system. The performance of work [40] is measured in terms of latency, network utilisation, RAM utilisation, and energy consumption. On the other hand, the suggested classifier’s accuracy, precision, specificity, sensitivity, and F1 score are all evaluated. The results show that the proposed framework and classifier consistently outperform conventional frameworks and classifiers.

Motivation and contribution

Because of their increasing utility, dependability, autonomy, efficiency, and safety, various scopes of CHI in IoMT are currently opening as research and technology advance. By allowing users to obtain programmes on demand, cloud computing is excellent at reducing infrastructure expenses. However, impersonation, stolen-verifier attacks, data non-repudiation, data confidentiality, anonymity, known-key security, replay attack, message authentication, privileged-insider attacks, parallel session, and man-in-the-middle attacks are all vulnerable to communication across entities in CHI. CHI’s security and privacy were breached by hackers during the COVID-19 epidemic. As a result, in a cloud-based CHI environment, information, security, and privacy are top priorities. In recent years, protocols [20, 25–27, 29, 35, 41] have been proposed in healthcare communication systems. However, these are insufficient to address the system’s fundamental security and privacy issues. As a result, many procedures have significant omissions. A secure and efficient structure is required to safeguard CHI’s security and privacy at all times. In this paper, the authors introduce a novel RAPCHI: Robust authentication protocol method for IoMT-based CHI to assure the security and privacy of CHI. The proposed RAPCHI has a number of important characteristics, which are listed below:

To ensure the security of CHI as an IoMT application, an authentication and key agreement are formed among the patient, cloud server, and doctor.

Without keeping data in a cloud database system, a session key is formed between patient and doctor.

Further, RAPCHI is also resistant to a variety of security threats and meets a number of security requirements.

Based on the random oracle concept, we give two independent formal security analyses of RAPCHI.

We use the AVISPA tool to simulate RAPCHI.

The comparison study shows that during a pandemic, RAPCHI is more effective than other protocols in the same context.

Threat model for RAPCHI

We consider the Dolev-Yao (DY) [42] in RAPCHI. Any opponent E has the following assumptions and capabilities:

The public network system is open to E. In the network system, he/she can create new messages, retrieve, inject, edit, replay, and discard any information.

Intruders or public users of the underlying network infrastructure can both be E.

E knows the public keys of all the users in public channel.

The paper organization

The remaining paper is constructed as follows. In Section 2, we express the preliminaries. In Section 3, we proposed RAPCHI framework for CHI. Section 4 describes security analysis. Section 5 describes performance analysis. Lastly, we discuss conclusion of the paper. Furthermore, we have given notations in Table 1.

Table 1

Notations

Symbol	Description
l	The security parameter
P	The Patient
E(F_q)	Elliptic curve E over a prime finite field F_q
q	Large prime
H	The healthcare centre with secret key γ
ID_i	Unique identity of i^th participant
h(·)	Collision free one-way hash function
D	The doctor
E_k(M)	Encryption of information M using key k
Sig_i	The signature of i^th participant
S	The cloud server
PK_i	Public key of i participant
SK_χψ	The computing session key between entities χ and ψ
S_K(J)	Signature of J with using key K
χ=?ψ	Whether χ equals ψ
V_K(J)	Verification of signature J using key K
SK_i	The secret key of i^th participant
K_i	The executing key of i^th participant
PWi	The password of i^th participant
D_k(M)	Decryption of information M using key k
E	Adversary
ΔT	Maximum communication delay
ECC	Elliptic curve cryptography
G	Additive ECC-based group
g	Base point of G
s	The secret key of S
i···⇒j:{M}	i sends information M to j via secure channel
i···→j:{M}	i sends information M to j via public channel

Preliminaries

One-way collision-resistant hash function

Definition

Hash function converts arbitrary string length in finite length string . is the hash function then, .

The following properties of best hash function as below [6]:It is a deterministic method that takes any string as input and returns a fixed-length string as output. Let denote any E’s benefices in obtaining collision. Then, we have , where Prob[W] represents the probability of a random appearance W, and E expresses the pair is elected randomly by E. Here, E is made probabilistic, and the probability in advantage is calculated using any E with a computing time of . The h(.) is called collision-resistant, if , for any adequately slight [43].

If inputs x then output the digest h(x).

One-way If output . Then, it is hard to compute x.

Weak-collision resistance If x is the input and is the output. Finding y is then computationally impossible..

Strong-collision resistance If is the output. Finding pair (x, y) with then becomes computationally impossible.

Elliptic curve cryptography

Classically, cryptographic protocols are used to ensure the security and privacy of communicated data. An emerging trend for security and privacy, authors are using two cryptographic techniques 1) symmetric key cryptography and 2) public key cryptography. In this paper, we use the concepts of elliptic curve cryptography (ECC) which is the branch of public key cryptography. The basic information of ECC is explained as below:

Let q be the large prime then be the prime finite field of order q. An equation of elliptic curve (EC) is given by with . The elliptic curve is said to be non-singular if . Then, G define as , where the point is known as the identity element of G. ECC contains the following properties: For more information of elliptic curve group and its properties, we refer [44]. The comparison of key size in ECC, DSA, RSA, and Diffie–Hellman given in Table 2.

Table 2

Compassion of the key size [45, 46]

S.No.	ECC key Size (bits)	RSA key Size (bits)	Diffie–Hellman and DSA
1.	163	1024	L = 1024, N = 160
2.	256	3072	L = 3072, N = 256
3.	384	7680	L = 7680, N = 384
4.	512	15360	L = 15360, N = 512

N = Size of private key and L = Size of public

If then and

If then scalar multiplication: .

If , . Then, , where , and

ECC-based computational hard problems

The following computational hard problems which are based on ECC:

Elliptic curve Discrete Logarithms problem (ECDLP) The detail of ECDLP discussed in [6].

Remark The symbol to express value x is taken randomly from T.

Input: (R, S, r) for some .

Output Yes, if , means that, , and result No, otherwise.

Assume the following two handling:

.

The benefits of any probabilistic, polynomial-time 0/1-listed recognizer in solving ECDLP on is explained as , where the probability Prob(.) is take on the random values k and r. is called a - ECDLP recognizer for , if executes at most in time such that .

ECDLP assumption There exits no -ECDLP recognizer for . On the otherhand, for every probabilistic, polynomial-time 0/1- listed recognizer , we have , for any sufficient small [47].

Elliptic curve computational Diffie–Hellman problem (ECCDHP) The detail of ECCDHP discussed in [6].

The RAPCHI framework

Figure 1 shows the proposed framework’s architecture.

Fig. 1

Architecture for RAPCHI

There are four participants in CHI such as Patient, Doctor, Cloud server, and Body sensor RAPCHI framework having following phases:

Initialization

S selects security parameter l, the nonsingular elliptic curve over , elliptic curve additive group G with base point g, hash function and ECDLP which is intractable. S publishes public parameters .

Patient registration in cloud server

With the help of medical device, P gets registration by S via secure channel as below:

To register with S, P inputs identity and password . Then, P generates random value and selects as a secret key. Further, P executes and .

On getting , S verifies and PWP in database. If, these are new, S computes , generates random value , computes , , , stores in database and .

On collecting , P sets public key and stores parameters in database.

Doctor registration in cloud server

D gets registration via secure channel as below:

To register with S, D inputs identity and .

On collecting , S verifies in database. If, is new, S generates random number , computes , , stores in database and .

On getting , S generates and sets as a public key . Further, D stores parameters in database.

Patient login, authentication and key agreement phase

P uses the medical sensors device, forward regular medical record to S and get treatment by D via S. The process of this phase is explained as below:

P login with and . Further, P computes , and verifies . After that P generates random number , computes , inserts medical data , computes signature , computes , , encrypts by using key . Then, = .

On collecting , S verifies and . Further, S computes , , encrypts by using key . Then, .

On getting , D verifies . Then, D decrypts by using key , verifies , computes , decrypts by using key , verifies and . Further, D generates medical report , computes signature . Then, D generates random number , computes , , session key , , encrypts by using key and .

On collecting , S verifies and .

Upon accepting , P verifies . Then, P computes , decrypts by using key and verifies . Further, P computes and verifies . Furthermore, P computes session key .

Thus, common session key between P and D is . Hence, P gets treatment by authenticated D (Table 3).

Table 3

Patient login, authentication and key agreement phase via public channel

Patient P with medical device	Cloud server S	Doctor D
Login with IDP′ and pwP′
Computes PWP^′=pwP′⊕h(pwP′‖IDP′‖a_P)
Computes AP′=h(h(IDP′)⊕h(PWP^′‖IDP′))
Verifies AP′=?A_P
Generates x∈Zq⋆
Computes α=x.g
Generates M_P=(ID_P,Data_P)
Computes Sig_P=S_SK_P(h(M_P))
Computes H_1=h(ID_P‖PK_D‖(ID_P⊕T_1))
Computes H_2=h(A_P‖B_D‖ID_P)	Verifies T_2-T_1≤▵T
Encrypts E_1=E_h(ID_P‖P_1‖P_2)(H_1,M_P,α,Sig_P,T_1)	Verifies H2∗=?h(P_P‖B_P‖ID_D)
Sends M_1= {E_1,H_2,T_1}	Computes ID_P1=ID_P⊕h(ID_1‖ID_D‖B_D)
················ →	Computes H_3=h(ID_D‖B_D‖D_1‖T_3)	Verifies T_4-T_3≤▵T
(via public channel)	Encrypts E_2=E_h(ID_D‖B_D‖D_1)(E_1,H_3,ID_P1,	Decrypts (E_1,H_3,ID_P1,P_1,P_2,B_P)=D_h(ID_D‖B_D‖D_1)(E_2)
	P_1,P_2,B_P)	Verifies H3∗=?h(ID_D‖B_D‖D_1‖T_3)
	Sends M_2={E_2,T_3}	Computes IDP∗=ID_P1⊕h(ID_1‖ID_D‖B_D)
	················→	Decrypts (H_1,M_P,α,Sig_P,T_1)=D_h(IDP∗‖P_1‖P_2)(E_1)
	(via public channel)	Verifies H1∗=?h(ID_P‖a_D.g‖(ID_P⊕T_1))
		Verifies V_PK_P(Sig_P)=?h(M_P)
		Generates M_D=(ID_D,Data_D)
		Computes Sig_D=S_SK_D(h(M_D))
		Generates y∈Zq⋆, β=y.g,
		Computes MAC_D=h(IDP∗‖ID_D‖B_P‖B_D‖T_5)
		Computes SK_DP=h(IDP∗‖ID_D‖Sig_P‖Sig_D‖MAC_D‖B_D‖B_P‖y.α‖T_5)
		Computes ID_D1=ID_D⊕h(Sig_P‖B_P‖H1∗)
		Encrypts E_3=E_h(H1∗‖B_P‖P_2)(ID_D1,MAC_D,Sig_D,M_D,B_D,β,T_5)
	Verifies T_6-T_5≤▵T	Sends M_3={E_3,T_5}
Verifies T_8-T_7≤▵T	Sends M_4={E_3,T_5,T_7}	←················
Computes IDD∗=ID_D1⊕h(Sig_P‖B_P‖H_1)	←················	(via public channel)
Decrypts (ID_D1,MAC_D,Sig_D,M_D,B_D,β,T_5)	(via public channel)
=D_h(H_1‖B_P‖P_2)(E_3)
Verifies V_PK_D(Sig_D)=?h(M_D)
Computes MAC_P=h(ID_P‖IDD∗‖B_P‖B_D‖T_5)
Verifies MAC_P=?MAC_D
Computes SK_PD=h(ID_P‖IDD∗‖Sig_P‖Sig_D‖MAC_P‖B_D‖B_P‖x.β‖T_5)

Patient password change

The details of this phase is given as below:

P login with and . P computes , and verifies whether holds or not.

P verifies the validity of the condition . Then, P selects new password . Further, P computes and .

P replaces by , by PWP, and by , respectively.

Security evaluation

In this session, we will look at RAPCHI’s security in the following ways:

Formal security analysis by method I

Here, we apply the formal method of security evaluation under the approach of ROM, we prove that RAPCHI is safe. We take the proof of this approach by the mechanism of contradiction as [48]. We apply same investigation as [49-51]. In RAPCHI, we implement this method under the generic group method of secure communication environment. Assume that there are two oracles for any E:

Reveal 1  Here, x is an arbitrary value, and is a fixed length value [52].

Reveal 2  Given and the public key , this oracle will find as secret key k [52].

Theorem 1

Under ECDLP assumption, RAPCHI is safe against any E for determining and between a patient and the doctor, if h(.) nearly acts such a random oracle.

Proof

Here, we want to compose E which has the capacity to determine both of P and between P and D. Any E uses the random oracles Reveal 1 and Reveal 2 in order to test the algorithm, say prepared in Algorithm. For the proposed framework RAPCHI, define the success probability for as where Prob[W] presents the probability on a game W. For the experiment, the benefit function becomes , where the maximal is seized overall E with queries , done to Reveal 1 and Reveal 2 oracles and execution time et, respectively. RAPCHI is said to be provably safe against an E for determining and , if , for any adequately slight . As an experiment, if E has the capability to change h(.) and deals with ECDLP, she/he can simply determine both and and achieve the game. However, by Subsect. 2.3, it is a findable computing unattainable issue to revert , means that, , for any adequately slight . Also, in subsection 2.3, it is computationally unattainable to determine k from R and in , means that , for any sufficient slight . Hence, we contain , as depends into other advantages and .

Theorem 2

Under the assumption that h(.) nearly performs such an oracle, RAPCHI is provably safe against attacker E for acquire of a valid patient P, even if her/his registration phase is breakable.

This proof is also same as Theorem 1. We wish to make any E who will contain the capacity to rid the password of a valid P, even if her/his registration. By Threat model [42] and Sect. 2.1E can extract all information of P. Any E uses the Reveal oracle for Algorithm 2, say for RAPCHI. The progressive probability for as and the experiment’s advantage , where the maximal is seized overall E with the queries , made to the Reveal 1 oracles and execution time , respectively. The RAPCHI is said to be provably safe against E for determining , if , for any adequately slight . As experiment 2, if E has the capability to change h(.) and achieve the game. However, by subsection 2.1, it is a possible for computing unattainable issue to invert , means that, , for any adequately slight , means that , since depends on other advantages .

Formal security by method II

Here, we adopt the random oracle model II for RAPCHI from [53-56].

Theorem 3

The RAPCHI employees a group G under addition with a base point g of order q. According to the assumption of hash output digest of length l bit which performs an exact random oracle. Therefore, we haveFor a probabilistic polynomial time-bounded technique, which is the probability of success. Any E is trying to hack the semantic security (SS) of RAPCHI and is denoted a chance of success for E to find the solution of the ECCDHP. The password dictionary is represented by , while the identity dictionary is represented by in this competition. Where times H, times Execute queries and times Send queries for E to breach the communication of entities in RAPCHI.

We believe E is capable of cracking the RAPCHI mechanism. In addition, the ECCDHP may be used to find a polynomial time-bounded method [57], i.e. from a random input (g, xg, yg), sum returns xyg within polynomial time bounds, where . Here, we consider a sequence of games [55, 56], and in the simulation of the game , E can compute the exact attack against RAPCHI by computing , but E has no security. Further, we define the term game where E defeats in breaking into the RAPCHI’s communication system. Furthermore, we believe that the event , which separates , may occur while E is being calculated, causing to detect . Unless is present, neither nor can be distinguished. As a result, we have

The execution of is akin to the ROR model of a real-world security attack. As a result, in this oracle, all P and D outcomes are modelled as expected. When is computed, E can guess which bit in the Test question is related to , which is the exact bit. Therefore, we have

Here, is similar to without the hash oracle H is calculated by E by maintaining a list , which runs the (Hin, Hout). If E inputs and find output . Then, a new list of tuple in . Otherwise, randomly prefers a number , returns to E and considers new tuples in . Here, Execute, Send, Corrupt, Reveal,  and are polished in the same way that genuine attacks are calculated. So that’s it.

In this contest, is similar to except if a collision occurs during the simulation of the values, will be exited and which are based on the birthday attack. Probability of collisions of the simulated hash oracle is at most . In the contents simulation, the possibility of collisions is . Thus, we have

Here, suppose E is guessed attributes without hash query. Further, is similar to with P and S occurrence refuses authenticated numbers. Thus, we have

In this contest, E accurately guessed attributes without hash query. Further, is similar to with S and D occurrence refuses authenticated values. Thus, we have

In this game, E accurately guessed the authenticated attributes without hash query. Further, is similar to with S and D occurrence refuses authenticated values. Thus, we have

In this event, E accurately guessed attributes without hash query. Further, is similar to with S and P occurrence refuses a legitimated values. Thus, we have

In this game, E is session key with find the values xyg. As a result, when using the ECCDHP’s random self-reducibility, and are comparable in execution. Thus E applied queries with random values (g, xg, yg) to compute , where .Therefore, we have

This game is identical to the previous game except for the addition of a . If E asks a with information , the game will end. By running the with a probability at most , E can obtain the session key . Thus, we have

If E will not get a session key without perfect input which contains different parameters, thus . Furthermore, it specifies that the password has not been made in [53] if the Corrupt(U, 2)query has been made. The probability of applying off-line password guessing attack and identity guessing attacks are and by E. Thus, from equations , we obtainedHence, the theorem is established.

Informal security analysis

The following security aspects and properties are discussed in this session for RAPCHI analysis:

Patient anonymity

We express P anonymity in RAPCHI which is given as below:Thus, our protocol provides P anonymity.

S computes P’ partial identity , encrypts by with using key (h( and sends to D. Further, D decrypts using key and computes anonymous identity of P as . Furthermore, D uses in authentication phase of RAPCHI.

Doctor anonymity

We describe D anonymity in RAPCHI as below:Thus, our protocol provides D anonymity.

D computes his/her partial identity and sends to P. Further, P computes D’s anonymous identity as and uses in RAPCHI.

Man-in-the-middle attack

In RAPCHI, each step of authentication phase having time-stamp status and hash conditions . If possible, any E enters in authentication and key agreement phase after checks then, verifies . This condition is not achievable to verify by the definition of hash function which is secure. Further, E cannot verify P’s signature and D’s signature . Thus, E will unsuccessful in authentication and key agreement phase. Therefore, RAPCHI secures against this attack.

Replay attack

Every time we utilise the time-stamp condition in RAPCHI, we use random values as a counter-measure. In RAPCHI, the valid time length is . Furthermore, the hash value, encryption, decryption, various keys, and session keys are all computed using the current time value and a random number. It is well known that in a network system, an ECC-based one-way hash function is secure. Hence, the replay attack is not possible in RAPCHI.

Known-key security property

The session keys are expressed in the following way by RAPCHI:RAPCHI presents session key in communication system. Even if E finds the past key, she/he cannot execute it. Thus, RAPCHI maintains this property.

P executes session key .

D executes session key .

Data confidentiality

It is a way to send secure data in communication system without E. In RAPCHI, the following are the details of encryption and description:Thus, if E tries to find communicated message at the time of communication, E encrypts information which cannot be decrypted without the hash value and generated key. By the definition of hash function, it assumed to be secure and one way. So that, it is hard to compute generated key and hash value. Therefore, RAPCHI maintains the confidentiality.

P encrypts by using key and uploads to S. Further, S encrypts by using key and forwards to D. After that, D decrypts by using key and by using key . Furthermore, D encrypts by using key and uploads to S. In addition to, S sends to P. Then, P decrypts by using key .

Data non-repudiation

The details of this attribute in RAPCHI are given as:Thus, P checks the health information. If, the medical information is incorrect, the authenticated party cannot be denied. The non-repudiation arguments are saved in S. Therefore, RAPCHI protests data non-repudiation.

P makes digital signature and verifies D’s digital signature .

D verifies P’s digital signature by . After that, D makes digital signature .

Message authentication

The details of it describe in RAPCHI as below:If any E endeavours change any charge in data of P, S and D will recognize it. Therefore, RAPCHI protests against the message authentication attack.

S gets , verifies and hash function . Similarly, S accepts message and checks the validity by confirming times-stamps condition .

D receives message , verifies , , and .

P receives message , checks , and .

Impersonation attack

The details of an impersonation attack describe in RAPCHI as below:Hence, RAPCHI is secured against this attack.

Any E attempts to masquerade as an authenticated P and tries to compute , , , encrypts by using key . Then, P sends = to S . E cannot compute , , and by the definition explanation of hash function and digital signature. Thus, E cannot impersonate as authenticated P.

Any E attempts to masquerade as an authenticated D. On getting , D decrypts by using key , computes , decrypts by using key . Further, D generates medical report , computes signature . Then, D generates random value , computes , , session key , , encrypts by using key and D sends to S. E cannot compute these parameters as discussed above. Thus, E cannot impersonate as an authenticated D.

Any adversary E attempts to masquerade as an authenticate S and eavesdrop the transmitted and . Further, S , , encrypts by using key . E cannot compute these parameters as discussed above. Thus E cannot impersonate as authenticated S.

Session key security

RAPCHI contains two session keys which are computed between P and D. The details of session key are shown in RAPCHI as below:Hence, RAPCHI could defend the session key.

D computes and P computes . E cannot execute or , where . With the help of impersonation attack, and cannot be executed by E. Furthermore, for given , it is impossible for an attacker G to compute xyg using ECCDHP in ECC for and g is the base point of G. As a result, the authenticated participant is the only one who can build SK.

Simulation study using AVISPA tool

AVISPA is a tool for evaluating the proposed protocols’ security against passive/active attacks, man-in-the-middle attacks, and reply assaults. AVISPA’s back-end servers, such as the On-the-Fly Modeler (OFMC), constraint-Logic (Cl-AtSe) attacker search, SAT-based Model-Checker (SATMC), and Tree Automata based on Automatic Approximations for the evaluation of security protocols, include an integrated automated validation security analysis (TA4SP) [45, 58]. It can examine the capability of the RAPCHI under security attacks. As a result, we decided to investigate RAPCHI’s security and confidentiality against active and passive attacks. The analysis results are depicted in Fig. 2. RAPCHI is secure in communication channel. AVISPA’s outcome is that one of the four back-ends is used: CL-AtSe, OFMC, TA4SP and SATMC. The results reveal that the private parameters between P and D are kept secret. It also protects against both passive and active attacks. In the execution of RAPCHI, the parameters cannot be determined by E in public channel.

Fig. 2

Results of AVISPA using the OFMC and CL-AtSe back-ends

It is worth noting that we did not use the TA4SP and SATMC simulation results because they do not support running bitwise XOR () operations.

Performance analysis

In this part, we compare RAPCHI’s security and functionality aspects, as well as communication and computation costs, to other frameworks such Mohit et al.[26], Chen et al.[20], Li et al.[27], Chen et al. [41], Chiou et al. [25], Chandrakar et al. [29] and Deebak and Turjman [35]. The details of this phase following as:

Comparison of the security and functionality attributes

In Table 4, we compare security and functionality attributes of RAPCHI with related frameworks below as:In this context, RAPCHI satisfies all above security attributes.

Table 4

Comparison of different attributes

Protocol	Γ1	Γ2	Γ3	Γ4	Γ5	Γ6	Γ7	Γ8	Γ9	Γ10	Γ11	Γ12	Γ13	Γ14	Γ15	Γ16
Chen et al. [20]	√	×	×	√	×	√	√	√	√	×	√	×	×	×	×	×
Mohit et al. [26]	√	×	×	√	×	√	√	√	×	√	×	×	×	×	×	×
Chen et al. [41]	√	×	×	√	√	√	√	×	×	√	×	×	×	×	×	×
Li et al. [27]	√	×	×	√	√	√	√	×	×	√	√	√	×	×	×	×
Chiou et al. [25]	√	×	×	√	×	√	√	√	×	√	×	×	×	×	×	×
Chandrakar et al.[29]	√	×	√	√	√	×	√	√	×	√	√	√	×	×	×	×
Deebak and Turjman [35]	√	√	√	√	√	√	√	√	√	√	√	×	√	×	×	√
RAPCHI	√	√	√	√	√	√	√	√	√	√	√	√	√	√	√	√

: Attribute protected by the protocol, : Attribute not protected by the protocol, : Man-in-the-middle attack, : Patient anonymity, : Doctor anonymity, : Replay attack, : Known-key security property, : Data confidentiality, : Data non-repudiation, : Message authentication, : Impersonation attack, : Session key security, : Patient unlinkability, : Doctor unlinkability, : Patient password change, : Low Computation cost, : Low communication cost and : Secure protocol

Chen et al.’s protocol [20] fails against , , , , , , , and .

Mohit et al.’s protocol [26] fails against , , , ,, , , and .

Chen et al’s. protocol [41] fails against , , , , , , , , and .

Li et al.’s protocol [27] fails , , , , , , and .

Chiou et al.’s protocol [25] fails against , , , ,, , , , and .

Chandrakar et al.’s protocols [29] fails against , , , , , and .

Deebak and Turjman protocol [35] fails against , and .

Comparison of the computation cost

We have taken several cryptographic operations those based on the information applicable in [6, 25, 26] to test the execution cost of the presented scheme which are related frameworks. The RAPCHI used time for computing to verify/execute a signature , asymmetric decryption/encryption , multiplication , bilinear pairing , symmetric decryption/encryption and hash function is .

The communication overhead concatenation operation () and XOR operation () are generally known to be minimal. Table 5 shows the computation cost of the proposed framework and related frameworks as follows:

Table 5

Comparison of computation and communication cost

Protocol	Total cost	Execution time	Communication cost
Chen et al. [20]	3T_Sign+3T_M+6T_P+15T_S+6T_H+10T_A	≈ 4.7091  Sec	2576 bits
Mohit et al. [26]	6T_Sign+9T_S+35T_H	≈ 2.086  Sec	5312 bits
Chen et al. [41]	6T_Sign+12T_M+15T_P+15T_S+22T_H+2T_A	≈ 4.379  Sec	7952 bits
Li et al. [27]	7T_Sign+15T_S+36T_H	≈ 2.4704  Sec	3776 bits
Chiou et al. [25]	5T_Sign+4T_M+13T_P+10T_S+33T_H	≈ 2.7705  Sec	6528 bits
Chandrakar et al. [29]	10T_Sign+18T_S+59T_H	≈ 3.5031  Sec	9440 bits
Deebak and Turjman [35]	8T_Sign+17T_S+51T_H+T_mul	≈ 2.9503  Sec	7646 bits
RAPCHI	4T_Sign+6T_S+2T_M+24T_H	≈ 1.4916  Sec	752 bits

The computation cost Chen et al.’s protocol [20] is which is 4.7091  Sec.

The computation cost Mohit et al.’s protocol [26]is which is 2.086  Sec.

The computation cost Chen et al.’s protocol [41] is which is 4.379  Sec.

The computation cost Li et al.’s protocol [27] is which is 2.4704  Sec.

The computation cost Chiou et al.’s protocol [25]is which is 2.7705  Sec.

The computation cost Chandrakar et al.’s protocol [29] is which is 3.5031  Sec.

The computation cost of Deebak and Turjman protocol [35] is which is 2.9503  Sec.

The computation cost of RAPCHI is which is 1.4916  Sec.

Thus, RAPCHI is more efficient and secure in CHI. Figure 3 details of computation cost. As a result, as compared to other CHI protocols, RAPCHI is both secure and cost-effective in terms of computation cost.

Fig. 3

Computation cost comparison

Comparison of the communication cost

The communication cost of RAPCHI is compared to that of equivalent frameworks in this section. For this, we use the method of the Mohit et al. [26] protocol. There are several cryptographic components, including produced random numbers, time stamps, and a 48-bit identity length; 128-bit symmetric encryption/decryption, asymmetric encryption/decryption, and modular multiplication/inversion operations; length of cryptographic hash function and bilinear pairing to be 160-bits and length of executing/verifying a signature is 512-bits. Table 5 displays the communication cost of RAPCHI and other comparable related frameworks in details as below:

The communication cost Chen et al.’s protocol [20] is 2576 bits.

The communication cost Mohit et al.’s protocol [26]is 5312 bits.

The communication cost Chen et al.’s protocol [41] is 7952 bits.

The communication cost Li et al.’s protocol [27] is 3776 bits.

The communication cost Chiou et al.’s protocol [25]is 6528 bits.

The communication cost Chandrakar et al.’s protocol [29] is 9440 bits.

The communication cost of Deebak and Turjman protocol [35] is 7646 bits.

The communication cost of RAPCHI is 752 bits.

Figure 4 details of communication cost. As a result, RAPCHI has a lower communication cost than other protocols CHI.

Fig. 4

Communication cost comparison

Conclusions

In this work, we have proposed a secure and lightweight authentication mechanism for IoMT-based CHI. The study demonstrates formal security analysis using two distinct ROM-based techniques. We also used the simulation software AVISPA to demonstrate that RAPCHI is not vulnerable to replay and man-in-the-middle attacks. Furthermore, informal security analysis based on various security attributes and properties such as replay attack, data confidentiality, man-in-the-middle attack, patient anonymity, doctor anonymity, data non-repudiation, known-key property, patient unlinkability, impersonation attack, session key security, message authentication, and doctor unlinkability is demonstrated. Furthermore, we compared the proposed framework to existing frameworks in a similar environment, demonstrating that RAPCHI is more secure and efficient in terms of computation and communication cost. As a result, our proposed framework could be more useful in IoT-based cloud-healthcare infrastructure. It is also a real-world application that protects humans from attackers through online treatment.