A Lightweight and Anonymous Authentication and Key Agreement Protocol for Wireless Body Area Networks

• Published in: IEEE internet of things journal Vol. 9; no. 21; pp. 21136 - 21146
• Main Authors: Pu, Cong, Zerkle, Haleigh, Wall, Andrew, Lim, Sunho, Choo, Kim-Kwang Raymond, Ahmed, Imtiaz
• Format: Journal Article
• Language: English
• Published: Piscataway IEEE 01.11.2022; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Agreements; Authentication; Authentication and key agreement protocol; Body area networks; Chaotic communication; Communication; Computation; Energy consumption; Information dissemination; Lightweight; lightweight and anonymous; Medical electronics; Medical services; Performance enhancement; Performance evaluation; Privacy; Protocol (computers); Protocols; Security; security and privacy; Sensors; wireless body area networks (WBANs); Wireless communication; Wireless communications; Wireless networks
• ISSN: 2327-4662; 2327-4662
• DOI: 10.1109/JIOT.2022.3175756

As a major building block of Healthcare 4.0, wireless body area networks (WBANs) play an important role in collecting patient's real-time physical phenomena through small wearable or implantable intelligent medical devices and communicating with remote medical experts using short-range wireless communication techniques. However, the challenges of securing information access are partly evidenced by the difficulty in designing secure and efficient security protocols. For example, existing authentication and key agreement schemes have either potential security vulnerabilities or high communication and computation overhead. In this article, we propose a lightweight and anonymous authentication and key agreement protocol, also called liteAuth, for WBANs. In our approach, mutual authentication and session key agreement are achieved using the Tinkerbell map-based random shuffling, physical unclonable function, one-way hash function, and bitwise exclusive OR operation. The security of liteAuth is first verified using the AVISPA tool, and then its cyber resilience is analyzed. In addition, we develop a real-world testbed, implement liteAuth and two existing schemes (i.e., PSLAP and HARCI), and conduct experiments for performance evaluation and analysis. Experimental results indicate that liteAuth can improve the performance of communication overhead and computation time as well as reduce energy consumption, while meeting all security requirements.