A Cluster-based User Authentication Protocol for Internet of Medical Things Deployment

User authentication has been recognized as a promising technique for secure communication in the Internet of Medical Things (IOMT). Considering the limited storage resources of sensor devices and the problem of user privilege segmentation under the serverless model, we investigate the establishment of secure associations between users and sensor clusters through fine-grained access control. Specifically, we utilize merkle clusters to perfectly realize hierarchical user permissions, replacing the original database permission verification. We propose a three-factor cluster-based user authentication protocol (3CUAP) in a serverless model, and utilize non-formal security analysis, Proverif tools, etc. to analyze the security performance and communication cost. Simulation results demonstrate the robustness of 3CUAP to cyber-attacks such as internal privilege escalation, and its applicability for IOMT devices with limited storage resources.