For academics, e-healthcare is a sensitive research area. Furthermore, any flaws in the protocol could result in the patients’ fatal accidents. As a result, we take advantage of the opportunity to propose a secure and efficient authentication scheme for e-healthcare that reduces complexity while improving security over existing schemes. Our protocol is efficient and lightweight for IoT-enabled devices because we only use the XOR and hash functions. Recently author [10] proposed an authentication scheme for the healthcare system. According to [10], the scheme achieves mutual authentication, untraceability, forward secrecy, and resistance to replay and desynchronization attacks. However, careful examination reveals that the scheme is vulnerable to spoofing, masquerading, and impersonation attacks. In the scheme [10], when the attacker copies M₄ = {X, A_n} and transmits it again later, the adversary (𝒜) can easily spoof the reader’s radio frequency identification (RFID) because for each session, the same message is transmitted over the public network channel. Furthermore, an attacker may also modify it to masquerade as a legitimate peer. Similarly, for M₅ = {Y, A_R1, X, A_n}, the attacker can easily impersonate the server for a wrong decision due to its static nature. Therefore, the scheme suffers from spoofing, impersonation, and masquerading attacks. The following is our primary contribution:

We identified security vulnerabilities in [10] and rectified them using our proposed scheme, which is lightweight and efficient because it utilizes only XOR and a hash function.

We extended the famous threat model developed by Dolev and Yao (DY), also called the DY model [13]. We are adopting a solid adversary 𝒜. According to the DY model, any danger to the system must be examined and analyzed before operationalizing it in real-world environments. We also consider the adversary model of Cannetti and Knawezk (CK) model [14] and utilized [15] for a more solid adversary. The CK model is the most used in authentication and key exchange protocols. In the DY model, the 𝒜 delivers the message, while in the CK model, the 𝒜 can also compromise the session key and secret key.

Furthermore, IoT-enabled devices or sensor nodes can be accessed by the 𝒜 physically. Thus, the 𝒜 will try to extract secret information from it. Further, the communication between IoT-enable devices or sensor nodes and edge computing can be intercepted by the 𝒜. Sensor nodes are connected to the edge node using a wireless network; therefore, the 𝒜 can access open channel data and modify, delete, or insert it. The 𝒜 can monitor the data between the IoT-enable sensor node and the user. The 𝒜 can pretend to be a legal user to the edge server and launch Man-In-The-Middle (MITM) to masquerade and impersonate attacks.

Our system model consists of patients with IoT-enable sensor nodes, medical staff, edge server, and registration server, as shown in Fig. 1. First, the IoT-enable sensor nodes and users need to register themself with the registration server. After that, medical staff can monitor patients’ activities in real-time using these IoT-enabled devices, whereas the edge server reduces latency. The registration server and edge server are the trusted authorities in our proposed scheme. The registration server is in charge of registering users and IoT-enabled devices. Finally, our system model detailed explanation is given in the proposed scheme.

The rest of the article is structured as follows: Section 2 describes the literature review in detail. Additionally, Section 3 contains the proposed scenario. Then, in Section 4, we examine the proposed framework’s security, Section 5 discusses informal security analysis, and Section 6 conducts a performance analysis. Finally, Section 7 concludes the paper.

The registration server generates the secret key SKrs in our proposed protocol. The edge server and IoT-enable sensor node both have their own unique identities, ID_e and ID_w, and a secret user key, PKu.

Our proposed scheme registration phase comprises of two-part. In the first portion, we will register the IoT-enable sensor node with the registration server, while in the second phase, we will register the user with the registration server. The process is under:

The user input identity ID_u and password PW_u and computes, r_u = h(ID_u||PW_u) ⊕  B₁, HPW_u = h (PWu||r_u), B₂^* = h(ID_u||PW_u||r_u||HPW_u). The user check B₂^*? = B₂ and if it corrects then proceed further otherwise terminate connection. The user generates random number r_u1 and calculates XID_u = h(HPW_u||r_u)  ⊕  B₃, V₁ = h(HPW_u||XID_u) ⊕  B₄, N = h(X_u||XID_u||V₁) ⊕  (X_u||r_u1), D = h (ID_u||r_u)  ⊕  h(V₁||r_u1), F_u = h (X_u||XID_u ||r_u1||X_w||V₁). After calculations the user sends M1 = {N, D, F_e, X_u} towards edge server.

The user enters their identity ID_u and password PW_u.

We used the ROR model [11] to demonstrate our proposed scheme’s session key security SK. In our proposed scheme login and authentication phase, we have three participants P^t, user P^t_u, edge server P^t_e, and IoT-enable sensor node P^t_w. The 𝒜 has the ability to intercept, manipulate, and eavesdrop on data delivered across an unsecured connection. The 𝒜 may attack actively or passively by executing various queries outlined in the ROR model, including CorruptedMD, Executive, Send, Reveal, and Test queries. The exact instructions for these queries are included below:

CorruptedMD (P^t_u): The 𝒜 can obtain secret information stored on the user side.

Theorem 1: The 𝒜 can access the session key security of our proposed scheme. The proof of Theorem 1 is similarly presented in [42]. The polynomial-time of 𝒜 as Adv 𝒜.  AdvA ≤ q2h|Hash|+{c. q2send}

q2h denoted the number of hash queries, q_send is the number of send queries, and |Hash| is the range of hash function h(.) while c is a parameter from Zipf’s law [43].

Proof: We prove the session key security in four-game “Game_i” where i ∈ [0, 3]. The 𝒜 use S_A, i to win the Game_i by guessing the random bit fc correctly. Pr[S_A, Game_i] shows the advantage of 𝒜 to win Game_i. The games are described below:

Game₀: In this game, we allow the 𝒜 to launch an actual attack on our proposed scheme. The 𝒜 select random bit fc at the start of the Game₀. (1)AdvA=|2 Pr[SA, GAME0] – 1|

By running these games, the 𝒜 must guess the bit in order to win the game. Thus, we obtain (5)Pr[SA,GAME3]=1/2

From Eqs. (1) and (2), we get (6)1/2 AdvA=|Pr[SA,GAME0−1/2]| = |Pr[SA, GAME1 −1/2]|

By using Eqs. (5) and (6). (7)1/2 AdvA=|Pr[SA,Game1] – Pr[SA,Game3]|

With Eqs. (4), (5), and (7) and using triangular inequality, we obtain 1/2 AdvA=|Pr[SA,GAME1] − Pr[SA,GAME3]|                  ≤ |Pr[SA,GAME1] − Pr[SA,GAME2]|                  +|Pr[SA,GAME2] − Pr[SA,GAME3]| (8)                 ≤q2h2 |Hash|+c.qssend

By multiplying both sides of Eq. (8) by 2, we get (9)AdvA≤ q2h|Hash|+2{c. qssend}

As we obtain in Eq. (9), we proved Theorem 1.

ProVerif2.03 verification software toolkit [12] is used to determine if the session secret is secure if it is computed confidentially, if it is exchanged securely among peers, and if an attacker may acquire it during a starting session. It is a popular simulation verification toolkit. Fig. 2 depicts ProVerif’s results.

In our proposed scheme the 𝒜 cannot get B₁= h(ID_u||PW_u)  ⊕  ru, B2=h(IDu||PWu||ru||HPWu), B3=h(HPWu||ru) ⊕ XIDu, B4=h(HPWu||XIDu) ⊕  V₁, X_u = h(ID_u||r_u). The values of B₁, B₂, B₃, B₄, and X_u were constructed using ID_u, PW_u, and random number r_u. Therefore, the 𝒜 cannot construct B₁, B₂, B₃, B₄, and X_u. Thus, our proposed scheme resists offline password guessing attacks.

The user, edge server, and IoT-enable sensor node check the message’s validity in the login and authentication phase. The user, edge server, and IoT-enable node checks F_u? = F_u, F_e? = F_e, F_w? = F_w, F_ec? = F_ec, and N₆ ? = N₆. If these values are correct, then the entities authenticate each other. Therefore, our proposed scheme provides mutual authentication property.

In registration phase, the 𝒜 might obtain X_u = h(ID_u||r_u). The 𝒜 try to construct {B₁, B₂, B₃, B₄, X_u} store on the user side. However, the 𝒜 cannot obtain actual ID_u, PW_u, and r_u. Therefore, the 𝒜 cannot construct S_K. Thus, our proposed scheme resists insider attacks.

The 𝒜 trying to modify and block the transmitted messages to the user, edge server, and IoT-enable sensor node cannot authenticate each other. However, the 𝒜 cannot do it because, according to our protocol, the 𝒜 cannot obtain ID_u, PW_u, r_u, and S_k. Thus, user and edge servers always have synchronized values. Therefore, in our proposed scheme, a desynchronization attack is not possible.

The 𝒜 cannot obtain the actual identities of ID_u, PW_u, ID_e, ID_w, to construct X_u = h(ID_u||ru), X_w = h(ID_w ||r_w). Therefore, our proposed scheme provides anonymity.

In our proposed protocol for every session, the edge server and user update X_u^new = h(X_u||r_u1). Therefore, our protocol provides untraceability.

The 𝒜 obtains secret key SK_rs and tries to create a session key S_K. Although, the 𝒜 needs a random number {r_u, r_u1, r_e, r_w, r_w1} because the S_K is composed of a random number for every session. Therefore, our proposed protocol; provides perfect forward secrecy.

The 𝒜 attempts to obtain random numbers and construct the session key in accordance with the CK-adversary model. However, the 𝒜 needs the identities of a user, edge server, and IoT-enable sensor node. Because in our proposed scheme, the session key was constructed using the identities of the user, edge server, and IoT-enable sensor node. Thus, our proposed scheme resists known session attacks.

Let us suppose the 𝒜 gets a previous authentication request between the user and edge server. Further, the 𝒜 tries to send it again to the edge server. However, the edge server checks the freshness of the random number and rejects the request of 𝒜. Thus, our scheme resists the MITM attack.

The 𝒜 might get {B₁, B₂, B₃, B₄, X_u} and {S₁, S₁, X_u} of the user and IoT-enable sensor node to calculate the S_K. However, the 𝒜 need actual identities (ID_u, ID_w, ID_e} and random numbers {r_u, r_u1, r_e, r_w, r_w1}. The identities and random numbers cannot obtain from transmitted messages because these values are encrypted. Thus, our proposed scheme resists session key leakage attacks.

Let us suppose the 𝒜 tries to modify the authentication request and pretend to be a user or edge server. However, the 𝒜 cannot change {N, E₁, F_u} and {F_ec, N₆} without the knowledge of ID_u, PW_u, r_u, ID_e ID_w. Therefore, the proposed scheme resists replay attacks.

Let us suppose the 𝒜 extract secret values {X_u, B₁, B₂, B₃, B₄}. The 𝒜 tries to impersonate the user using these values. However, the 𝒜 cannot send authentication messages towards the edge server because the 𝒜 needs ID_u, PW_u, r_u, and HPW_u to construct {N, D, F_u, X_u}. Therefore, our proposed scheme resists user impersonation attacks.

The 𝒜 found a lost IoT-enable sensor node to impersonate the IoT-enable sensor node. However, the 𝒜 cannot construct {F_u, r_u} because the 𝒜 needs ID_w, r_w, and r_w1 to construct {F_w, N₄}. Therefore, our proposed scheme resists IoT-enable sensor node impersonation attacks.

Let suppose the 𝒜 get stolen IoT-enable sensor node and obtain secret {S₁, S₂, X_w} stored in the memory of IoT-enable sensor node. However, the 𝒜 cannot get ID_w, r_w, and r_w1. Thus, our proposed scheme resists stolen IoT-enable sensor node attacks.

In this section, we compare our protocol with [10,21–23,33,45–47] in terms of security features. Table 5 shows that our scheme achieved all security features and provided mutual authentication, anonymity, and untraceability.

In this section, we first calculate our proposed scheme communication cost and then compare it with recent related protocols [10,21–23,33,45–48] in Table 6. The value of a hash function is (160 bits), the ECC point of multiplication is (320 bits), the symmetric key is (256 bits) timestamp is (32 bits), while the random number is (128 bits), and identities are (160 bits) [49]. Our proposed scheme exchange messages are {N, D, F_u, X_u} is {640 bits}, {X_u, N₃, E₂, F_e} is {640 bits}, {F_w, N₄} is {320 bits}, {F_ec, N₅} is {320 bits} and {N₆} is {160}. As a result, our suggested scheme’s overall communication cost is equivalent to 2080 bits. The scheme [45] has a lower communication cost, but the computation cost is high, and the scheme is vulnerable to offline password guessing attacks and unable to provide perfect forward secrecy.

We compared our proposed scheme computation cost with other related schemes [10,21–23,33,45–48]. First, we calculated our proposed scheme computation cost. According to [50], the ECC point of multiplication T_M is (7.3529 ms), hash function T_h is (0.0004 ms), symmetric key T_S is (0.1303 ms), and fuzzy extractor T_R is (7.3529 ms). Therefore, our scheme total computation cost is 66T_h is equal to 0.264 ms. Detail comparison of our proposed scheme computation and communication cost is shown in Fig. 3. The scheme [22] has a lower computation cost. However, the communication cost of the scheme [22] is very high. In contrast, Table 5 shows that the scheme is vulnerable to offline password guessing attacks, insider attacks, and known session attacks.

In this portion of our research article, we consider the work [49]. The hash function is 160, multiplication point is 320, identity is 160, symmetric key 256, timestamp is 32, and random numbers are 128 bits. Keep view this in mind, our proposed scheme storage cost calculation is X_w = 160, S₁= 160 + 128, S₂ = 160 + 160, X_u = 160, B₁= 160 + 128, B₂ = 160, B₃ = 160 + 160, B₄ = 160 + 160. Hence total storage cost is 2016 bits. Table 7 shows the comparison with other state-of-the-art schemes.