The Internet of Things (IoT) is among the most promising technologies of the future, and its development has garnered attention worldwide. However, the rise of the IoT has been accompanied by a proportionate increase in security concerns regarding communication between IoT entities. Recently, Alzahrani et al. proposed an identity-based authentication and key agreement protocol for an IoT environment, wherein a physically unclonable function was employed. They claimed that their protocol can resist various types of attacks; however, after thorough analysis, we determined it to be ineffective against privileged internal attacks, physical IoT device capture attacks, stolen-verifier attacks, and known temporary information exposure attacks. To resolve these security weaknesses, we propose a new authentication and key agreement protocol. In addition, we demonstrate that the proposed protocol is provably secure in real-or-random (ROR) model and BurrowsAbadiNeedham (BAN) logic, resisting known attacks while incurring low communication and computation costs.

Recently, Akram et al. (2021) proposed a drones-access protocol for monitoring urban security. Akram et al. claimed that their protocol is secure and can resist known security attacks. However, in this comment article, we demonstrate that their protocol is still vulnerable to drone capture attacks and stolen-verifier attacks. In addition, their protocol does not provide perfect forward secrecy. Finally, we present an improved protocol to manage the security weaknesses we found.

In the rapidly evolving field of smart healthcare, integrating modern information technologies such as IoT, big data, and AI has significantly enhanced the quality, efficiency, and accessibility of medical services. However, this technological advancement also brings substantial security challenges, particularly regarding protecting electronic medical records (EMRs) from phishing attacks. This paper presents a provably secure anti-phishing scheme to safeguard EMRs in smart healthcare systems. By utilizing Authentication and Key Agreement technology, our proposed scheme ensures mutual authentication between users and servers, leveraging elliptic curve encryption, symmetric encryption, hash functions, and XOR operations to secure session keys and verify the legitimacy of medical records. Our scheme addresses critical security challenges, including phishing attacks, stolen mobile device attacks, offline password guessing attacks, replay attacks, and temporary information leakage. The Real-Oracle-Random (ROR) model validates the correctness and security of our scheme, confirming its robustness against common cybersecurity threats. Performance evaluations demonstrate that our scheme provides enhanced security and offers lower time and communication costs compared to existing methods. This makes it a highly efficient and practical solution for safeguarding patient data in smart healthcare environments, ultimately contributing to the reliability and trustworthiness of smart healthcare systems.

The Internet of Things (IoT) is a huge network formed by connecting various information sensing devices through the Internet. Although IoT has been popularized in many fields, connected devices can be used only when network security is guaranteed. Recently, Rana et al. proposed a secure and lightweight authentication protocol for the next-generation IoT infrastructure. They claim that their protocol can resist major security attacks. However, in this study, we prove that their protocol is still vulnerable to offline password guessing attacks and privilege internal attacks. In order to solve these shortcomings, we propose an improved protocol, which is proved to be secure by formal and informal analysis. In addition, after comparing the time and memory consumption with other protocols, we find that our protocol has more advantages.

In Vehicular Ad Hoc Networks(VANETs) environments, information needs to be exchanged frequently between vehicles, Road Side Units (RSUs), and management centers to support safe and efficient traffic management. However, due to the openness of wireless communication and dynamic network topology, VANETs face many security threats such as forging, eavesdropping, and man-in-the-middle attacks. Therefore, it is crucial to design efficient and secure authentication protocols. To address this problem, Sibahee et al. proposed a two-factor privacy-preserving authentication protocol in IEEE Internet of Things Journal (pp. 14253-14266, DOI: 10.1109/JIOT.2023.3340259, April 15, 2024) and claimed that it can resist multiple attacks. However, we find that the protocol cannot resist temporary random number leakage attacks and privileged insider attacks, and does not have perfect forward security. To address the above problems, this paper proposes an improved authentication scheme based on elliptic curve cryptography (ECC) to enhance the security of the scheme. We conduct formal (Real-Or-Random Model) and informal security analyses of the improved scheme and evaluate its performance in terms of computational overhead and communication cost. The experimental results show that the improved scheme has significant advantages in both security and performance.

With the rapid development of the Internet of Things (IoT), the Internet of Medical Things (IoMT) has significantly improved the intelligence and efficiency of healthcare services. As a crucial component of IoMT, smart drug management facilitates efficient collaboration in drug storage, prescription management, and drug delivery. However, the drug distribution process involves multiple entities and sensitive medical data, posing serious security challenges, including patient privacy leakage, identity forgery, unauthorized access to medicines, and data tampering. To address these challenges, this paper proposes a blockchain-assisted drug management and authentication scheme that integrates identity authentication mechanisms. Using the decentralization, immutability, and traceability features of the blockchain, the proposed scheme ensures the transparency and integrity of drug distribution records. In addition, the authentication and key agreement mechanism establishes a secure communication channel between patients, pharmacies, and delivery personnel, preventing unauthorized access and data leakage. The security of the proposed scheme is formally analyzed using the Real-Or-Random (ROR) model, demonstrating its robustness against common security threats. Performance evaluations indicate that the proposed scheme significantly reduces computational and communication overhead compared to existing schemes, making it a secure and efficient solution for smart drug management in smart healthcare.