Lightweight and privacy-preserving device-to-device authentication to enable secure transitive communication in IoT-based smart healthcare systems

Internet of Things (IoT) devices are often directly authenticated by the gateways within the network. In complex and large systems, IoT devices may be connected to the gateway through another device in the network. In such a scenario, new device should be authenticated with the gateway through the intermediate device. To address this issue, an authentication process is proposed in this paper for IoT-enabled healthcare systems. This approach performs a privacy-preserving mutual authentication between the gateway and an IoT device through intermediate devices, which are already authenticated by the gateway. The proposed approach relies on the session key established during gateway-intermediate device authentication. To emphasizes lightweight and efficient system, the proposed approach employs lightweight cryptographic operations, such as XOR, concatenation, and hash functions within IoT networks. This approach goes beyond the traditional device-to-device authentication, allowing authentication to propagate across multiple devices or nodes in the network. The proposed work establishes a secure session between an authorized device and a gateway, preventing unauthorized devices from accessing healthcare systems. The security of the protocol is validated through a thorough analysis using the AVISPA tool, and its performance is evaluated against existing schemes, demonstrating significantly lower communication and computation costs.