{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T16:52:28Z","timestamp":1785430348136,"version":"3.56.0"},"reference-count":47,"publisher":"MDPI AG","issue":"10","license":[{"start":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T00:00:00Z","timestamp":1779148800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100003725","name":"National Research Foundation of Korea","doi-asserted-by":"publisher","award":["RS-2024-00450915"],"award-info":[{"award-number":["RS-2024-00450915"]}],"id":[{"id":"10.13039\/501100003725","id-type":"DOI","asserted-by":"publisher"}]},{"award":["RS-2024-00450915"],"award-info":[{"award-number":["RS-2024-00450915"]}],"id":[{"id":"https:\/\/ror.org\/013aysd81","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>The development of sensor and communication technology has enabled the Internet of Things in healthcare. In Medical Internet of Things (MIoT) environments, sensors support real-time patient monitoring, remote diagnosis, and early disease detection. However, communication between users and sensors over public channels is vulnerable to various security attacks, making secure and lightweight authentication with session key establishment essential for protecting medical data. Recently, a lightweight and anonymous authentication protocol for MIoT environments was proposed using Physical Unclonable Functions (PUFs); however, we show that their protocol is vulnerable to eavesdropping, stolen verifier, and ephemeral secret leakage attacks, and fails to guarantee untraceability. To address these weaknesses, we propose a secure and lightweight PUF-based authentication protocol for MIoT environments. The security of our protocol is formally verified using Burrows\u2013Abadi\u2013Needham logic, the Real-or-Random model, and the Scyther tool. Furthermore, the practical validation of the proposed protocol is conducted on a hardware platform along with an evaluation of energy consumption based on the MIRACL cryptographic library. Performance comparisons demonstrate that our protocol achieves enhanced security properties with minimal computational overhead and communication costs. Ultimately, this research provides a secure and robust architectural option for healthcare applications aiming to preserve patient privacy in resource-constrained MIoT.<\/jats:p>","DOI":"10.3390\/s26103223","type":"journal-article","created":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T16:07:26Z","timestamp":1779206846000},"page":"3223","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A PUF-Based Secure and Lightweight Authentication Protocol for Medical IoT Environments"],"prefix":"10.3390","volume":"26","author":[{"given":"Hyeongeun","family":"Lim","sequence":"first","affiliation":[{"name":"School of Electronic and Electrical Engineering, Kyungpook National University, Daegu 41566, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9011-8410","authenticated-orcid":false,"given":"Yohan","family":"Park","sequence":"additional","affiliation":[{"name":"School of Computer Engineering, Keimyung University, Daegu 42601, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0406-6547","authenticated-orcid":false,"given":"Youngho","family":"Park","sequence":"additional","affiliation":[{"name":"School of Electronic and Electrical Engineering, Kyungpook National University, Daegu 41566, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,5,19]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"10168","DOI":"10.1109\/JIOT.2023.3327322","article-title":"A Security-Enhanced and Ultralightweight Communication Protocol for Internet of Medical Things","volume":"11","author":"Chen","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"15664","DOI":"10.1109\/JIOT.2020.3047662","article-title":"A Lightweight and Robust Secure Key Establishment Protocol for Internet of Medical Things in COVID-19 Patients Care","volume":"8","author":"Masud","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1202","DOI":"10.1109\/TGCN.2021.3077318","article-title":"LightIoT: Lightweight and secure communication for energy-efficient IoT in health informatics","volume":"5","author":"Jan","year":"2021","journal-title":"IEEE Trans. Green Commun. Netw."},{"key":"ref_4","first-page":"8885","article-title":"Blockchain and PUF-Based Lightweight Authentication Protocol for Wireless Medical Sensor Networks","volume":"9","author":"Wang","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Kumar, P., Kumar, R., Garg, S., Kaur, K., Zhang, Y., and Guizani, M. (2022, January 4\u20138). A secure data dissemination scheme for IoT-based e-health systems using AI and blockchain. Proceedings of the GLOBECOM 2022\u20142022 IEEE Global Communications Conference, Rio de Janeiro, Brazil.","DOI":"10.1109\/GLOBECOM48099.2022.10000801"},{"key":"ref_6","first-page":"272","article-title":"Security and privacy issues in implantable medical devices: A comprehensive survey","volume":"56","author":"Tapiador","year":"2015","journal-title":"J. Biomed. Inform."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Shojaei, P., Vlahu-Gjorgievska, E., and Chow, Y.W. (2024). Security and privacy of technologies in health information systems: A systematic literature review. Computers, 13.","DOI":"10.3390\/computers13020041"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Lee, H.J., Kook, S., Kim, K., Ryu, J., Lee, Y., and Won, D. (2025). LAMT: Lightweight and Anonymous Authentication Scheme for Medical Internet of Things Services. Sensors, 25.","DOI":"10.3390\/s25030821"},{"key":"ref_9","first-page":"014","article-title":"Authenticated Key Exchange Secure against Dictionary Attacks","volume":"Volume 2000","author":"Bellare","year":"2000","journal-title":"International Conference on the Theory and Applications of Cryptographic Techniques"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"65","DOI":"10.1007\/978-3-540-30580-4_6","article-title":"Password-Based Authenticated Key Exchange in the Three-Party Setting","volume":"Volume 3386","author":"Vaudenay","year":"2005","journal-title":"Public Key Cryptography\u2014PKC 2005"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1145\/77648.77649","article-title":"A logic of authentication","volume":"8","author":"Burrows","year":"1990","journal-title":"ACM Trans. Comput. Syst."},{"key":"ref_12","unstructured":"Cremers, C. (2026, April 06). The Scyther Tool. Available online: https:\/\/people.cispa.io\/cas.cremers\/scyther\/."},{"key":"ref_13","unstructured":"(2026, May 07). MIRACL Crypto SDK. Available online: https:\/\/github.com\/miracl\/MIRACL."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"156","DOI":"10.4258\/hir.2016.22.3.156","article-title":"Medical Internet of Things and Big Data in Healthcare","volume":"22","author":"Dimitrov","year":"2016","journal-title":"Healthc. Inform. Res."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Khan, M.A., Din, I.U., Majali, T., and Kim, B.-S. (2022). A Survey of Authentication in Internet of Things-Enabled Healthcare Systems. Sensors, 22.","DOI":"10.3390\/s22239089"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"3484","DOI":"10.1109\/TII.2021.3097759","article-title":"Lightweight Privacy and Confidentiality Preserving Anonymous Authentication Scheme for WBANs","volume":"18","author":"Subramani","year":"2022","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"3753","DOI":"10.1007\/s11276-022-03070-1","article-title":"A PUF-based Anonymous Authentication Protocol for Wireless Medical Sensor Networks","volume":"28","author":"Shao","year":"2022","journal-title":"Wirel. Netw."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"361","DOI":"10.1109\/JSAC.2020.3020605","article-title":"HARCI: A Two-Way Authentication Protocol for Three-Entity Healthcare IoT Networks","volume":"39","author":"Alladi","year":"2021","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"21807","DOI":"10.1109\/ACCESS.2024.3361921","article-title":"A New PUF-Based Protocol for Mutual Authentication and Key Agreement Between Three Layers of Entities in Cloud-Based IoMT Networks","volume":"12","author":"Modarres","year":"2024","journal-title":"IEEE Access"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Chen, C.T., Lee, C.C., and Lin, I.C. (2020). Efficient and secure three-party mutual authentication key agreement protocol for WSNs in IoT environments. PLoS ONE, 15.","DOI":"10.1371\/journal.pone.0234631"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"741","DOI":"10.1016\/j.neucom.2022.05.099","article-title":"A two-factor security authentication scheme for wireless sensor networks in IoT environments","volume":"500","author":"Hu","year":"2022","journal-title":"Neurocomputing"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1787","DOI":"10.1038\/s41598-024-52134-z","article-title":"ECC-based three-factor authentication and key agreement scheme for wireless sensor networks","volume":"14","author":"Huang","year":"2024","journal-title":"Sci. Rep."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1016\/j.adhoc.2014.03.009","article-title":"A novel user authentication and key agreement scheme for heterogeneous ad hoc wireless sensor networks, based on the Internet of Things notion","volume":"20","author":"Brumen","year":"2014","journal-title":"Ad Hoc Netw."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"186","DOI":"10.24138\/jcomss-2023-0068","article-title":"User-Authentication Protocol to Secure Wireless Sensor Network Access in the Internet of Things Context","volume":"20","author":"Mostefa","year":"2024","journal-title":"J. Commun. Softw. Syst."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"8871204","DOI":"10.1155\/2021\/8871204","article-title":"A Secure and Lightweight Three-Factor Remote User Authentication Protocol for Future IoT Applications","volume":"2021","author":"Taher","year":"2021","journal-title":"J. Sens."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"3132","DOI":"10.1038\/s41598-025-33020-8","article-title":"Two secure authentication protocols for mitigating vulnerabilities in IoD","volume":"16","author":"Safkhani","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"109202","DOI":"10.1016\/j.compeleceng.2024.109202","article-title":"Edge AI for Internet of Medical Things: A Literature Review","volume":"116","author":"Rocha","year":"2024","journal-title":"Comput. Electr. Eng."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"101272","DOI":"10.1016\/j.iot.2024.101272","article-title":"The Computing Continuum: From IoT to the Cloud","volume":"27","author":"Jansen","year":"2024","journal-title":"Internet Things"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Suh, G.E., and Devadas, S. (2007, January 4\u20138). Physical Unclonable Functions for Device Authentication and Secret Key Generation. Proceedings of the 44th Annual Design Automation Conference (DAC \u201907), San Diego, CA, USA.","DOI":"10.1145\/1278480.1278484"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Maiti, A., Casarona, J., McHale, L., and Schaumont, P. (2010, January 13\u201314). A Large Scale Characterization of RO-PUF. Proceedings of the 2010 IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), Anaheim, CA, USA.","DOI":"10.1109\/HST.2010.5513108"},{"key":"ref_31","first-page":"44299","article-title":"Modeling and Reliability Analysis of Delay-Based Physical Unclonable Functions Using Low-Density Parity-Check Codes for Dependable Security","volume":"12","author":"Yavuz","year":"2024","journal-title":"IEEE Access"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"2957","DOI":"10.1109\/JSSC.2022.3192903","article-title":"A 20F2\/Bit Current-Integration-Based Differential NAND-Structured PUF for Stable and VT Variation-Tolerant Low-Cost IoT Security","volume":"57","author":"Lee","year":"2022","journal-title":"IEEE J. Solid-State Circuits"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"2765","DOI":"10.1109\/JSSC.2019.2920714","article-title":"A Physically Unclonable Function Using Soft Oxide Breakdown Featuring 0 Native BER and 51.8 fJ\/bit in 40-nm CMOS","volume":"54","author":"Chuang","year":"2019","journal-title":"IEEE J. Solid-State Circuits"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"198","DOI":"10.1109\/TIT.1983.1056650","article-title":"On the Security of Public Key Protocols","volume":"29","author":"Dolev","year":"1983","journal-title":"IEEE Trans. Inf. Theory"},{"key":"ref_35","first-page":"453","article-title":"Analysis of Key-Exchange Protocols and Their Use for Building Secure Channels","volume":"Volume 2045","author":"Canetti","year":"2001","journal-title":"Advances in Cryptology\u2014EUROCRYPT 2001; Lecture Notes in Computer Science"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"13815","DOI":"10.1109\/JIOT.2026.3656524","article-title":"Robust and Lightweight User Authentication Scheme Using Deep Learning-Based Cancelable Biometrics in Smart Home Environments","volume":"13","author":"Kim","year":"2026","journal-title":"IEEE Internet Things J."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"7231","DOI":"10.1109\/TITS.2025.3525505","article-title":"Explainable Deep Learning-Enabled Malware Attack Detection for IoT-Enabled Intelligent Transportation Systems","volume":"26","author":"Wazid","year":"2025","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"904","DOI":"10.1109\/TIFS.2022.3231121","article-title":"Blockchain-Enabled Authenticated Key Agreement Scheme for Mobile Vehicles-Assisted Precision Agricultural IoT Networks","volume":"18","author":"Vangala","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"16980","DOI":"10.1109\/JIOT.2026.3660968","article-title":"Ascon-Based Lightweight and Robust Authentication Scheme for IoT-Enabled Healthcare System","volume":"13","author":"Jang","year":"2026","journal-title":"IEEE Internet Things J."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"98944","DOI":"10.1109\/ACCESS.2022.3206457","article-title":"Design of Secure Mutual Authentication Scheme for Metaverse Environments Using Blockchain","volume":"10","author":"Ryu","year":"2022","journal-title":"IEEE Access"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"2776","DOI":"10.1109\/TIFS.2017.2721359","article-title":"Zipf\u2019s law in passwords","volume":"12","author":"Wang","year":"2017","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Boyko, V., MacKenzie, P., and Patel, S. (2000). Provably secure password-authenticated key exchange using Diffie-Hellman. Advances in Cryptology\u2014EUROCRYPT 2000, Springer.","DOI":"10.1007\/3-540-45539-6_12"},{"key":"ref_43","unstructured":"Lim, H. (2026, May 07). MIRACL Code. Available online: https:\/\/github.com\/KNUCISL\/MIRACL_Simulation."},{"key":"ref_44","unstructured":"(2012). IEEE Standard for Local and Metropolitan Area Networks\u2014Part 15.6: Wireless Body Area Networks (Standard No. IEEE 802.15.6). Available online: https:\/\/standards.ieee.org\/ieee\/802.15.6\/5364\/."},{"key":"ref_45","unstructured":"(2024). IEEE Standard for Low-Rate Wireless Networks (Standard No. IEEE 802.15.4). Available online: https:\/\/standards.ieee.org\/ieee\/802.15.4\/7029\/."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Akbar, M.S., Hussain, Z., Sheng, M., and Shankaran, R. (2022). Wireless Body Area Sensor Networks: Survey of MAC and Routing Protocols for Patient Monitoring under IEEE 802.15.4 and IEEE 802.15.6. Sensors, 22.","DOI":"10.3390\/s22218279"},{"key":"ref_47","unstructured":"Carman, D.W., Kruus, P.S., and Matt, B.J. (2000). Constraints and Approaches for Distributed Sensor Network Security (Final): DARPA Project Report, Network Associates, Inc.. Available online: https:\/\/people.cs.vt.edu\/~kafura\/cs6204\/Readings\/SensorNetworks\/SensorNetSecurity-NAILabs.pdf."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/10\/3223\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,23]],"date-time":"2026-05-23T04:19:27Z","timestamp":1779509967000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/10\/3223"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,19]]},"references-count":47,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2026,5]]}},"alternative-id":["s26103223"],"URL":"https:\/\/doi.org\/10.3390\/s26103223","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,19]]}}}