A Comprehensive Survey on Lightweight Cryptography Algorithms to Enhance Quality of Service in Medical Internet of Things

Internet of Healthcare Things (IoHT) or Internet of Medical Things (IoMT) is anticipated to bring about substantial advancements in healthcare efficiency and care quality as a result of its varied and exciting advances [1]. Recent developments in microelectronics, materials, and biosensor designs have piqued interest in a variety of smart medical devices, but notably implantable and wearable ones. The privacy and security of these healthcare systems that rely on IoMT have, however, been neglected due to the fast development of IoMT. Inadequate security in IoMT healthcare systems can lead to implications such as patients' privacy being compromised through eavesdropping and life-threatening incidents going undetected due to Denial of Service (DoS) attacks disrupting the usual functioning of IoMT devices [2]. In 2022, numerous researchers discovered that every one of the top ten smart watches sold at the time had security flaws due to things like inadequate authorization or authentication, unencrypted data transmission [3], insecure user interfaces, insecure software/firmware, and privacy problems [4]. As an example, authentication is the procedure that verifies the user's identification. Only authorized individuals or devices should be able to access any IoMT healthcare system [5].

Inadequate authentication protection leaves users' sensitive healthcare data vulnerable to attackers. It is critical to authenticate users and devices in order to ensure correct data attribution and restrict system information access to authorized parties only [6]. Data from patients who are overweight, for example, could be more reliably recorded if healthcare systems had the ability to confirm the identity of those who use medical devices [7]. Electronic medical records (EMRs) and other personally identifiable information can be better protected with authentication, as only authorized individuals can access them [8]. There are a lot of various ways to make sure that computer systems and networks are secure, and this is an established field of study. There is a wide variety of medical Internet of Things (IoT) applications, including remote health monitoring, care for the aged, and early diagnosis. With the use of the IoT, medical sensors [9], smartwatches, and fitness trackers can gather crucial health data that can illuminate patients' conditions. These devices are essential in healthcare as they enable efficient data collection and sharing. They improve patient monitoring, diagnostics, and overall treatment effectiveness [10]. Thus, the IoT exemplifies new information technology advancements in healthcare. It allows healthcare institutions to track patients' health issues remotely by continuously monitoring patients' vital signs such as temperature, blood pressure, and heart rate [11]. Medical professionals electronically access patient data for remote monitoring. This enables prompt intervention and timely medical decisions [12].

Concerns about data security have grown in response to the increased collection of data, particularly about the private and personal nature of healthcare records. Examples of this type of sensitive personal data are patient diagnoses, medical records, and genetic information [13]. Inadequate protection of sensitive information puts patients at risk of psychological injury, prejudice, and identity theft [14]. The interconnectedness of IoT devices renders them vulnerable to cyber assaults, which in turn compromises the security, privacy, and accessibility of patient information. These breaches have serious legal and financial consequences in addition to endangering patient care [15]. Traditional cryptography algorithms are effective, but many IoT devices just don't have the chip power to use them [16]. Lightweight cryptography (LWC) is a viable option since it lessens the computing burden without compromising security. Elliptic Curve Cryptography (ECC) to increase the scheme's security is proposed [17]. In addition, fresh healthcare-related data supports the idea that safeguarding sensitive medical data requires IoT technologies and lightweight encryption. The data security model for IoMT data is shown in Figure 1.

Figure 1. General Internet of Medical Things (IoMT) data security model

The IoT enables real-time data transmission through a network of connected devices. This connectivity enhances communication and data sharing across various systems. The IoT is supported by three layers: perception, network, and application. RFID tags, cameras, and sensors all contribute to the physical layer's data collection capabilities [18]. An integral part of IoT is the network layer, which relays data acquired by the physical layer. It is made up of hardware and software parts. Users' devices are linked to the IoT through the application layer. Two ways of LWC are symmetric key and asymmetric key. In contrast to asymmetric key encryption, which is too complex and computationally costly for the majority of IoT devices, symmetric encryption is useful since it is fast, secure, and has low latency. It is recommended to employ symmetric key cryptography algorithms when constructing IoT devices [19]. They are more popular than asymmetric encryption because they are simpler and need less space, computer power, bandwidth, and storage. Figure 2 depicts the encipher and decipher process using the set of keys.

Figure 2. Encipher/decipher process

The varieties of symmetric ciphers are block and stream. When encrypting data, stream ciphers utilize keys of the same length as the data, while block ciphers use keys of a predetermined number of bits. Block ciphers are better suited for the IoT than stream ciphers due to their increased flexibility. The use of block ciphers in resource-constrained computer system design has been ubiquitous in the past decade [20]. This choice was made because of the improved error propagation and diffusion features, the simpler software and hardware implementation, and the ease of use. Fewer hardware resources are needed compared to stream ciphers. Considerations such as structure, key size, round count, and block size are crucial in determining LWC requirements. This research presents a comprehensive analysis of cutting-edge lightweight encryption algorithms that are based on IoT. The size of blocks, length of keys, encryption times, number of rounds, and throughput are some of the metrics used to compare. This research helps numerous researchers and academicians to analyze the models and to provide solutions to enhance the data security levels in medical IoT.

3.1 Device-level attacks

Because of their extensive use in unprotected settings, including patients' homes, ambulances, and distant healthcare facilities, medical IoT devices are especially susceptible to physical manipulation assaults. Physically gaining access to insulin pumps, pacemakers, or continuous glucose monitoring enables attackers to steal critical information, alter firmware, or install malicious software. In order to physically tamper with a device, one can open its casing and access its internal components, connect it to unapproved hardware ports, or use specialized equipment to retrieve cryptographic keys from its memory. The fact that many medical equipment does not have strong tamper-detection features and keep working properly even after being hacked makes these attacks all the more worrisome.

3.2 Network-level attacks

Medical IoT networks are vulnerable to man-in-the-middle attacks because these attacks take advantage of the wireless communication channels that devices and healthcare systems typically employ to transmit data. In order to stealthily alter, reroute, or intercept medical data without the knowledge of authorized parties, attackers position themselves between communicating equipment. Impacting patient vital sign readings transmitted from patient monitors to central systems, changing drug dose instructions transmitted to infusion pumps, or intercepting sensitive patient information during transmission are all examples of the serious outcomes that can result from these types of assaults in healthcare settings. Medical IoT connections are especially vulnerable to interception attempts due to their wireless nature and the fact that encryption implementations are typically poor. In order to carry out these assaults, hackers can utilize easily accessible tools to intercept wireless traffic, take advantage of insecure authentication procedures, or even build fake access points that look like real healthcare network infrastructure.

3.3 Data-level attacks

Because they can change vital health information covertly, data manipulation assaults are among the most dangerous threats to medical IoT systems and the safety of patients. Medical monitoring data, prescription administration records, and diagnostic results are all potential targets of attackers looking to fabricate medical emergencies, conceal real health issues, or provoke unwarranted medical treatments. Threats like this can happen at any stage of the data lifecycle, from when sensors are collecting data to when it is transmitted, stored, or processed in healthcare databases or clinical decision support systems. Healthcare providers may be misdiagnosed, given the wrong therapy, or even delayed in responding to emergencies due to manipulated information that looks very valid because of the sophistication of modern data manipulation tools.

3.4 Authentication and authorization attacks

By taking advantage of loopholes in device authentication methods, identity spoofing attacks can masquerade as genuine medical devices or healthcare workers on IoT networks. In order to obtain unauthorized access to healthcare systems, attackers might counterfeit digital certificates, clone device identifiers, or take advantage of weak authentication procedures. By impersonating a trusted healthcare provider, an attacker in a healthcare setting can get access to sensitive patient information, inject malicious data into medical devices, or inject fraudulent medical data. Because they seem to come from trustworthy sources within the healthcare network, these assaults can overcome perimeter security safeguards, making them particularly deadly. To make matters worse, a lot of medical IoT devices are susceptible to easy spoofing attacks since they use basic authentication mechanisms or depend on easily replicable identities.

5.1 Overview of cryptographic models

Cryptographic models ensure data security, authentication, privacy, and secure communication across various domains. Authentication Models verify user or device identities through techniques such as password-based authentication, biometric authentication, multi-factor authentication (MFA), and digital signatures, ensuring only systems and data have authorized access. LWC Models are optimized for “resource-constrained devices like IoT, RFID, and embedded systems” using efficient encryption techniques such as lightweight block ciphers (SIMON, PRESENT, SPECK) and hash functions (PHOTON, SPONGENT) to balance security with low computational cost. Privacy Preservation Models focus on protecting sensitive information through methods like Homomorphic Encryption, Differential Privacy, Zero-Knowledge Proofs (ZKP), and Secure Multi-Party Computation (SMPC), enabling secure data processing in untrusted environments. Communication Security Models safeguard data transmission over networks through protocols like Transport Layer Security (TLS/SSL), End-to-End Encryption (E2EE), and Internet Protocol Security (IPSec), emerging technologies like Quantum Cryptography, preventing unauthorized interception and tampering in applications such as messaging, VPNs, and online banking. Together, these cryptographic models provide a comprehensive security framework, ensuring confidentiality, integrity, and authentication in digital systems. The cryptography model for IoMT data is shown in Figure 10.

Figure 10. Cryptographic model for Internet of Medical Things (IoMT)

5.1.1 Authentication models

A wide range of readily and commercially available components can be used to construct consumer electronics devices that are capable of communicating with one another. The security of the system and the environment are put at risk since thieves have more chances to take advantage of security holes and conduct a full-scale attack on the network. Since intruding hostile devices can corrupt servers and transmit dangerous data to the cloud or the server itself, they constitute a threat to the entire network. To get around this, Yanambaka et al. [1] designed a Physical Unclonable Function (PUF)–based device authentication approach that is interoperable with the IoMT.

Threats, such as man-in-the-middle attacks, modification assaults, and DoS, compromise the security and confidentiality of IoT networks. These attacks mostly utilize wireless channels for communication. A lightweight user authentication technique that safeguards users' anonymity in response to these security concerns is presented by Masud et al. [2]. Using the method that is given, legitimate users can set up secure sessions, and the IoT sensor nodes can be protected from unauthorized users. To safeguard real-time patient data, a lightweight anonymous user authentication solution was introduced. Since this protocol relies solely on hash functions rather than public-key cryptography, many researchers considered it suitable for sensor node deployment. This protocol desynchronizes in response to message jamming or blocking, and as demonstrated by Shihab and AlTawy [3], it is susceptible to session key leaks and hence cannot guarantee forward secrecy in all circumstances. A lightweight mutual authentication protocol called LAPRD was proposed by the author as a remedy for these issues; it provides resilience against desynchronization attacks.

To ensure secure communication between doctors, gateways, and IoT sensor nodes in healthcare, protecting patients' physiological data is essential. A lightweight and anonymous user authentication mechanism is being studied for this purpose. Still, in this piece, Wang et al. [4] examined their plan once again. Attacks like session key disclosure, offline password guessing, and tracing can compromise it, as the author pointed out. These vulnerabilities imply that the attacker has access to the doctor's smartphone and the sensor nodes. Furthermore, the author provided answers to each of these security issues. Authentication is a critical step in securing physiological data by verifying user identity and preventing unauthorized access. Some proposed authentication systems for WBANs have had their weaknesses and resource requirements pointed out. Two-Party Lightweight Authentication Protocol (TLAP) was proposed by Lara et al. [5] for use with WBANs. Verified by both official and informal assessments, TLAP safeguards WBANs from potential attacks and enables two-way authentication.

Zhou et al. [6] implemented various security measures to uphold the integrity of traditional protocols. To validate the effectiveness of the enhanced protocol, the author applied comprehensive formal and heuristic security analyses. Comparative evaluations with similar protocols confirmed that the proposed approach delivers efficient performance in resource-limited IoMT environments. The potential for modern WBANs to revolutionize the way the IoT networks is used to enhance human health and well-being is enormous. Using mobile-edge computing as an example, Yang et al. [7] suggest a very lightweight authentication method for WBANs. Sensor nodes and Edge nodes (ENs) use the modular square roots technique for intra-BAN authentication, and application providers and ENs use it for inter-BAN authentication. On top of that, two separate authentication phases are planned. When evaluating performance, we also take into account the costs of computation, networking, and storage.

Lightweight hybrid authentication, data privacy, and preservation were proposed by Adil et al. [8] as a solution to these security challenges. The proposed model integrates a supervised machine learning (SML) algorithm with a cryptographic parameter-based encryption and decryption (CPBE&D) mechanism. This approach verifies the authenticity of IoMT-based cyber-physical systems (CPS) before allowing encrypted data transmission over wireless networks. The authentication models are shown in Table 1.

Table 1. Authentication models

5.1.2 Lightweight cryptography models

The decision-making process is further complicated by the fact that healthcare IoT devices have intrinsic limitations such as low computing power, memory, and bandwidth. To be more precise, Ning et al. [9] provided a methodology for evaluating lightweight cryptographic ciphers that consider the most important aspects. The proposed framework factors in the recommendations of internationally recognized standards, such as ISO/IEC 29192 for building evaluation criteria and NIST for performance, physical, and security. In this study, Yavuz and Ozmen [10] make two contributions: Signer Efficient Multiple-time Elliptic Curve Signature (SEMECS) is a digital signature framework designed for resource-limited embedded systems. It enables the creation of elliptic curve (EC)-based signatures even when the signer has limited familiarity with EC operations by optimizing private key and signature sizes.

The development of a secure, lightweight block cipher presents a significant obstacle in such situations. As a result, the Error-Correcting Lightweight Block Cipher (ECLBC), proposed by Guo et al. [11], is a lightweight block cipher that incorporates error repair and detection algorithms. ECLBC enhances security with fewer rounds by serving a dual purpose as it switches modes within AND-rotation-XOR (AND-RX) lightweight block ciphers. The models of LWC are shown in Table 2.

Table 2. Lightweight cryptography (LWC) models

5.1.3 Privacy preservation models

The expansion of the IoT has given rise to a new paradigm in healthcare, dubbed smart health. It can reliably predict the onset of some diseases and also improve the quality of healthcare. Data security and consumer privacy issues, however, remain unresolved. Despite their many drawbacks, such as a lack of privacy for user attributes and excessive overhead, cipher text policy attribute-based encryption (CP-ABE) systems provide a potential solution to the challenge of securing s-health applications that are targeted toward the IoT. Sun et al. [14] proposed an ideal vector transformation approach to reduce the length and remove redundancy from the list of user attributes and access regulations, which is an important step in addressing these issues.

Table 3. Privacy preservation models

In healthcare, the capacity to swiftly retrieve patient records during an emergency is crucial. A lightweight break-glass access control system called LiBAC was developed by Yang et al. [15]. It enables both attribute-based and break-glass access to encrypted medical data. The access policy associated with a medical file dictate whether a healthcare professional can decrypt and retrieve the stored information. In emergencies, the break-glass access mechanism overrides the file's access policy, allowing rapid data retrieval for urgent medical care or rescue operations. To solve the problem of centralized management, Li et al. [16] used distributed storage to lay the groundwork for hidden reconstruction and retrieval. After that, a plan to improve the safety and efficacy of medical data sharing is devised for lightweight (t,n) -threshold secret sharing (t/n -SS). Using the interleaving encoding technique, it partitions the original message into smaller pieces.

Delegating the generation of encrypted EMRs, which integrate health data from IoT devices with medical applications, enhances accessibility, facilitates efficient collaboration, and eliminates computational overhead. This approach aligns with advancements in healthcare-related IoT and cloud computing. Fugkeaw et al. [17] suggested LightMED, an access control method that utilizes fog computing, CP-ABE, and blockchain technology, for secure, granular, and scalable EMR sharing in the cloud. The author laid out a safe method for sending and aggregating IoT data using lightweight encryption and digital signing. At its core, the product is a blockchain-enabled encryption and decryption technique that is outsourced. Additionally, it has a privacy-protecting access policy framework. The author introduced a novel approach to further aid EMR data owners in securely and efficiently administering their rules. Table 3 shows the models for privacy preservation.

5.1.4 Communication security models

Quite a few of these solutions put users' anonymity and privacy at risk. In view of the problems with existing protocols, Chen et al. [18] proposed a safe and effective protocol based on extremely lightweight symmetric key operations. The author provided formal and informal assessments to bolster the safety of the protocol. Furthermore, a real-time experiment was conducted by the author to evaluate the protocol's efficiency. However, there are a lot of challenges to secure data transfer caused by the nanoscale aspect of this technology. For data transmission to be secure, authentication is a must. Regarding this, a novel IoNT authentication method based on elliptic curve encryption was presented by Rana et al. [19]. Considering the limited processing power of nanoscale devices, this approach ensures lightweight yet robust authentication using a secure hash function and XOR operations. A subfield of healthcare IT, Telecare Medical Information Systems (TMIS) allows for the remote provision of medical treatment thanks to the expansion and enhancement of ICT. Mobile healthcare apps (MHA), smartphones, the IoT, and hospital servers form the backbone of TMIS. Ahamad et al. [20] presented the Secure and Resilient Scheme for Telecare Medical Information Systems (SRSTMIS), protected by white-box cryptography (WBC) are keys utilized in healthcare applications, SE, UICC, and TPM.

7.1 Unique identification of nodes and Tri Token Secret Key set for authentication

Each IoMT node must be individually analyzed to overcome the limitations of traditional models. The node’s information should be processed to assign a Digital Unique Identity, ensuring precise identification in future transmissions. Additionally, a Tri Token Secret Key Set must be generated to enable authentication and access control. This approach enhances security by verifying nodes before permitting data exchanges. Implementing these measures reduces unauthorized access and strengthens the overall integrity of the IoMT system. Proper identification and authentication establish a strong foundation for secure communication, ensuring that only authorized nodes participate in network activities.

7.2 Lightweight cryptographic algorithms for encryption and decryption

Besides authentication, integrating lightweight cryptographic algorithms is essential for ensuring secure medical data transmission. Algorithms such as Advanced Encryption Standard with a 128-bit key (AES-128), Elliptic Curve Cryptography (ECC), and PRESENT cipher offer effective encryption and decryption while maintaining low computational complexity. These cryptographic techniques help protect sensitive patient data from unauthorized access without overburdening IoMT devices. Since IoMT devices have limited resources, lightweight encryption models ensure secure communication while optimizing performance. Implementing efficient cryptographic methods guarantees data confidentiality and integrity, making medical data transmission more secure and reliable in healthcare applications.

7.3 Detection of security threats and comparative analysis

Monitoring node behavior and analyzing traffic patterns is necessary to detect security threats within the IoMT network. Lightweight cryptographic techniques such as Speck, Simon, and High-speed Lightweight Cryptography (HIGHT) can further enhance security by providing fast and efficient encryption. These algorithms ensure data protection while minimizing power consumption and processing delays. Additionally, a comparative analysis between the proposed model and traditional approaches must be conducted to evaluate security improvements. The results will demonstrate that the proposed model offers enhanced protection against cyber threats. By integrating authentication, encryption, and attack detection, the model ensures a secure and efficient IoMT network.

To overcome the limitations of the traditional models that are analyzed in this research, it is necessary to analyze each IoMT node, process the node information, and allocate a Digital Unique Identity for accurate identification of nodes in future transmissions and to generate a Tri Token Secret Key Set for performing node authentication and access control for initiating secure data transmission in the IoT network. It is also required to design an LWC model to perform encryption and decryption for securing the medical data, and then to analyze the node behaviour and patterns, and to perform attack detection in the IoMT network to improve the QoS levels in the network. Finally, it is required to perform a comparative analysis of the proposed model with the traditional models and to demonstrate that the proposed model's security levels are high.