Efficient Session Key Generation for Securing IoT-Enabled Telecare Medical Systems

Although recent advancements in the information and communication technologies have facilitated the deployment of Internet of Things (IoT)-enabled telecare medical information systems (TMISs), security concerns have greatly hindered their acceptability. A good deal of session key generation protocols (SKGPs) has been proposed recently to bring a secure medium for medical data transfer in the TMISs. Nevertheless, careful investigation indicates that there are two critical gaps in current schemes. First and the foremost, most lightweight schemes are insecure against advanced threats and relatively secure schemes have a delay in each shared key generation. Second, most schemes are designed using the Rivest–Shamir–Adleman (RSA) or EC cryptosystem (ECC) cryptosystem, making them insecure against quantum attacks. To fill these gaps, this article proposes a low-latency high-reliability SKGP for resource-limited IoT devices using only symmetric encryption/decryption and hash functions. Since the proposed scheme is only based on the AES-256 and is free from the RSA or ECC cryptosystem, it can also resist quantum attacks. To support the security and efficiency claims, we have provided extensive formal security analyses and all-inclusive literature review. Our comparative results indicate that the proposed protocol is the best compared to even top 10 protocols considering both execution and communication costs. Our implementation results also indicate that the protocol execution on the selected IoT device only takes almost $80\:\mu $ s and it is scalable enough so that servers can service thousands of devices.