On the Security of Authentication Protocols for Remote Healthcare Systems Through Cryptographic Vulnerability Analysis and Secure Protocol Redesign

This paper revisits a previously proposed authentication scheme for remote healthcare systems in Cloud-IoT. Although that protocol was introduced as a repair of an earlier healthcare design and was claimed to satisfy the usual confidentiality and mutual-authentication goals, a closer reconstruction of its registration, login, authentication, and password-update logic reveals several structural weaknesses. The analysis shows that a stolen smart card combined with one captured transcript enables offline password verification, that the session key is deterministic for a fixed user-sensor pair, that static pseudonyms expose long-term linkability, and that compromise of the server-wide secret expands immediately to all registered sensors. To address these problems, the core key-management path is redesigned while keeping the original cloud-assisted remote healthcare architecture. The revised scheme uses a device-bound seed only for local recovery, a fresh elliptic-curve Diffie-Hellman exchange for every run, dynamic pseudonyms, and KDF-based session-key derivation with explicit context binding. A comparative evaluation against the Sharma-Kalra baseline and the 2021 Azrour design indicates that the revised protocol raises resistance to guessing, replay, cross-session correlation, and compromise propagation with only modest latency growth.

@article{Byeon2026,
  title     = {On the Security of Authentication Protocols for Remote Healthcare Systems Through Cryptographic Vulnerability Analysis and Secure Protocol Redesign},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {17},
  number    = {4},
  year      = {2026},
  publisher = {The Science and Information Organization},
  author    = {Haewon Byeon},
  doi       = {10.14569/IJACSA.2026.0170440},
  url       = {https://doi.org/10.14569/IJACSA.2026.0170440}
}