A Privacy Protection User Authentication and Key Agreement Scheme Tailored for the Internet of Things Environment: PriAuth

Abstract EN

In a wearable sensor-based deployment, sensors are placed over the patient to monitor their body health parameters.

Continuous physiological information monitored by wearable sensors helps doctors have a better diagnostic and a suitable treatment.

When doctors want to access the patient’s sensor data remotely via network, the patient will authenticate the identity of the doctor first, and then they will negotiate a key for further communication.

Many lightweight schemes have been proposed to enable a mutual authentication and key establishment between the two parties with the help of a gateway node, but most of these schemes cannot enable identity confidentiality.

Besides, the shared key is also known by the gateway, which means the patient’s sensor data could be leaked to the gateway.

In PriAuth, identities are encrypted to guarantee confidentiality.

Additionally, Elliptic Curve Diffie–Hellman (ECDH) key exchange protocol has been adopted to ensure the secrecy of the key, avoiding the gateway access to it.

Besides, only hash and XOR computations are adopted because of the computability and power constraints of the wearable sensors.

The proposed scheme has been validated by BAN logic and AVISPA, and the results show the scheme has been proven as secure.