Can Formal Security Verification Really Be Optional? Scrutinizing the Security of IMD Authentication Protocols

Abstract

The need for continuous monitoring of physiological information of critical organs of the human body, combined with the ever-growing field of electronics and sensor technologies and the vast opportunities brought by 5G connectivity, have made implantable medical devices (IMDs) the most necessitated devices in the health arena. IMDs are very sensitive since they are implanted in the human body, and the patients depend on them for the proper functioning of their vital organs. Simultaneously, they are intrinsically vulnerable to several attacks mainly due to their resource limitations and the wireless channel utilized for data transmission. Hence, failing to secure them would put the patient’s life in jeopardy and damage the reputations of the manufacturers. To date, various researchers have proposed different countermeasures to keep the confidentiality, integrity, and availability of IMD systems with privacy and safety specifications. Despite the appreciated efforts made by the research community, there are issues with these proposed solutions. Principally, there are at least three critical problems. (1) Inadequate essential capabilities (such as emergency authentication, key update mechanism, anonymity, and adaptability); (2) heavy computational and communication overheads; and (3) lack of rigorous formal security verification. Motivated by this, we have thoroughly analyzed the current IMD authentication protocols by utilizing two formal approaches: the Burrows–Abadi–Needham logic (BAN logic) and the Automated Validation of Internet Security Protocols and Applications (AVISPA). In addition, we compared these schemes against their security strengths, computational overheads, latency, and other vital features, such as emergency authentications, key update mechanisms, and adaptabilities.

1. Introduction

The need for continuous monitoring of physiological information of critical organs of the human body, combined with the ever-growing field of electronics and sensor technologies, and the colossal opportunities brought by 5G connectivity, have made implantable medical devices (IMDs) the most necessitated devices in the health arena. This is clearly shown by the global IMD market share, which was worth USD 96.6 billion in 2018 [1] and grew to around USD 103.3 Billion in 2019, and will likely rise to USD 148.8 Billion in 2024 [2].

IMDs possess several applications to help manage numerous health conditions. These include controlling the heart rhythm using cardiac pacemakers, heart support using ventricular assist devices, and chronic spinal pain reliefs using spinal cord stimulators [3]. Furthermore, they extend their applications by enabling wireless communication technologies that help manage the interaction between IMDs and external devices in wireless body area networks (WBANs) [4,5]. IMDs functioning in WBANs have made a significant contribution in resolving several challenges in both medical and non-medical fields, yet they have their hurdles.

Despite their critical roles in improving human health conditions, IMDs have various challenges, among which, limitations of resource (power, storage, computation, etc.) and security concerns are the most serious. The former challenge is directly related to their small size and inflexibility since they are implanted in the human body. Concerning the latter, IMDs are susceptible to many security and privacy threats that put a patient’s life in danger [6]. Some of the most common security problems that IMDs face are impersonation, requesting confidential information, causing a shock to the patient, reprogramming of IMD, etc. Moreover, security assaults (e.g., side-channel attacks) targeting a wide range of internet of things (IoT) processors, such as the Cortex-A platform, also threaten the wellbeing of IMDs [7].

To date, many countermeasures have been taken to keep the confidentiality, integrity, and availability of IoT systems, along with different privacy and safety mechanisms [8,9,10,11,12]. In particular, to IMDs, different researchers have proposed several solutions that can be categorized into three main groups: cryptographic, access control, and misbehavior detection. The first group of solutions utilizes cryptographic rudiments (including public-key encryption, symmetric-key encryption, cryptographic hash functions, etc.) [13,14]. Access control mechanisms [15,16,17], on the other hand, protect IMDs from unauthorized access by employing different techniques, such as certificates and lists, designation-based, juxtaposition-based, and biometric-based [6]. The last type of method involves malicious behavior detection to shield IMDs from a range of attacks that may not be easily addressed by the former two solutions [18,19].

IMDs are very sensitive as they are implanted in the human body, and the patients depend on them for the proper functioning of their vital organs. Moreover, due to their resource limitations and the open channel utilized for data transmission, they are intrinsically vulnerable to several attacks, such as distributed denial of service with different attacker intentions [20]. Hence, failing to secure them would put the life of the patient in jeopardy, and damage the reputations of the manufacturer. Consequently, it is imperative to carefully examine the security of the IMD authentication protocols for any vulnerabilities. To do so, we followed two methods. First, we conducted an extensive literature review to understand the operations, architectural perspectives, critical security, and privacy requirements and proposed solutions. We also leveraged empirical data that approximated delays introduced by cryptographic operations for comparative analysis of the authentication protocols. Next, we used two well-known security verification approaches, BAN logic [21] and AVISPA [22], to formally analyze the authentication protocols. Unfortunately, many security protocols designed for IMDs are not formally verified, or they use only one verification method [23,24,25,26,27,28,29,30].

The main contributions of this research work can be summarized as follows:

• We examined various security and privacy requirements along with numerous threats that surround IMDs.
• We performed formal security validation of the contemporary authentication schemes based on BAN logic and AVISPA against several security goals.
• We compared these schemes concerning security strength, computational overhead, latency, and additional features, such as emergency authentication, adaptiveness, and key update mechanisms.

The rest of the paper continues as follows. Section 2 describes the components of a typical IMD system architecture. Section 3 outlines various security and privacy requirements, issues, and proposed solutions. Section 4 presents the formal security analysis of different IMD authentication protocols using BAN logic and AVISPA. Section 5 puts forward the discussion of the results found in Section 4. Section 6 describes the comparative analysis of the authentication protocols concerning functionality, computational overhead, and communication latency. Finally, Section 7 concludes the paper.

2. Typical IMD System Architecture

IMDs play a critical role in sensing vital physiological information, which is then sent out to an external device via the wireless medium for different actions, such as remote monitoring and drug delivery. Typically, such systems are assembled from various components, as shown in Figure 1, among which the following are the main ones.

• Sensor devices. These are small, in-body implanted, battery-powered, and wireless communication enabled sensors to sense, collect, and send patient information to a controller. In general, there are three categories (based on the data measured/collected) of such sensors: those that measure vital physiological information (such as glucose level, EEG, ECG, etc.), those that gather main environmental parameters, such as humidity, temperature, and pressure, and those that measure signals related to the human body movements [31].

• Battery. Implanted sensors need the power to sense information on the body and produce an output. The source of energy for active implants comes from batteries. These batteries can be chargeable or non-chargeable, depending on the sensor type [32], and external or through independent power sources [33]. While the former approach uses optical charging, ultrasonic transducer, and inductive coupling, the latter uses the body environment energy to generate electrical energy for IMDs. Either way, efficient power management is a must since it is difficult (or not desirable) to change batteries now and then. Hence, batteries fixed with these implants should serve for a prolonged period.
• Memory. Memory is vital for the proper functioning of IMDs. It enables implants to store sensed data, configurations, and other important information (such as security keys). The device memory is generally non-volatile (read-only memory (ROM)), retaining its contents regardless of the power supply. In addition, the electrically erasable programmable ROM (EEPROM) and flash memories can be good candidates [32].
• Processing unit. The processing unit is the brain of the entire IMD system, which processes instructions and control signals. The processing unit actively directs the communication between IMDs and external devices, efficient power and transceiver management, and is responsible for other essential tasks, such as sensing and processing data [32].
• Transceiver. To communicate different sensed data to the external devices (such as a programmer) and receive other information from the external devices, IMDs need to establish a wireless medium. An electronic device, known as a transceiver (transmitter and receiver), assists this exchange of information. A specifically designed transceiver called the Medical Implant Communication System (MICS) is available for medical implants with low-power, short-range, and high data rate features [34].
• Application-Specific Components. These components are optional, meaning they may not appear in all implanted devices. One good illustration is the Smart Implant Security Core (SISC) [35]. Communication between IMD and a programmer via wireless medium passes through this device. It runs an energy-efficient security protocol by using energy harvesting when it performs authentication with the programmer. Apart from that, SISC helps defend against denial-of-service attacks, particularly resource exhaustion attacks.
• Wireless Identification and Sensing Platform (WISP). One of the significant constraints of implanted devices is related to power. These devices reside in the human body, making them challenging to recharge or frequently change. Hence, a device called WISP is proposed [32]. Using WISP, therefore, it is possible to conserve the battery of an IMD, especially during an authentication process, as it harvests energy from the reader via radiofrequency.
• Programmer/Controller. Sensing or measuring vital physiological states is only half of the primary goal of using implants. The sensors should also convey the sensed information to an external device (a specially designed controller or a smartphone) near the IMDs. Apart from collecting sensed information from the implants, programmers/controllers assist in configuration setup and regulation of therapy, among others.

3. Security and Privacy Requirements, Threats, and Proposed Solutions

IMDs encounter several challenges, from their conception through their operation. These devices are implanted and severely limited in terms of power, storage, and computing capabilities, making it challenging to build effective communication technologies and security mechanisms. In this regard, IMDs must satisfy various security requirements to withstand the ever-increasing attacks that target them.

The privacy of patients is of paramount importance. Two critical issues in this regard are user anonymity and non-traceability [6,36]. The former refers to a strong requirement that it should be impossible (or difficult enough) for the attacker to intercept the patient’s identity from the messages exchanged. Often, this is the first step towards an impersonation attack in which an adversary identifies the user’s real identity to fool the other party. Non-traceability, on the other hand, protects the IMD by making it difficult for an attack to know where the patient is or from where he is communicating. As a result, the locations of patients remain confidential, and any acts they conduct cannot be traced back to them by an unauthorized entity.

3.1. Security and Privacy Requirements

Here, we describe nine essential security requirements relevant to the IMDs:

• Confidentiality: the physiological information collected by IMDs is often sent out to a reader via a wireless medium, which both authorized and malicious users can observe. Accordingly, it is essential to encrypt this information to protect the data transmitted from exploitation by the adversaries sitting between the IMD and the reader.
• Integrity: protecting the integrity of the information transmitted via the wireless link in IMD reader communication defends against unauthorized modification. In addition, when illegitimate users tamper with the data, it should be known by the authorized users that the data is modified.
• Availability: this is one of the three security triads (confidentiality, integrity, and availability) that has the objective of making the IMD-enabled system accessible to authorized users despite the presence of adversaries.
• Mutual authentication: unless authorized access is in place, an adversary can impersonate the IMD or the reader to fool the other. Hence, communicating parties need to make sure whom they are talking to before disclosing important information.
• Authorization: once the confidentiality, integrity, and availability of IMDs are guaranteed, and the users (a human user or a device such as a reader) are authenticated, proper authorization to identify the privileges of these users’ proceeds. For instance, a doctor who may issue commands to the IMD should be distinct from a nurse who may only read information to monitor the patient.
• Non-repudiation: there are cases in which one party’s actions (knowingly or not) bring unwanted consequences. For instance, in an IMD-enabled health care system, there can be many participants in the process of diagnosing, monitoring, and treating patients. These professionals should not be able to repudiate the actions they took during the process so that, if anything terrible happened next, it is possible to know who did what.
• Session key agreement: communicating entities need to agree on a session key and use that key to encrypt the exchanged information. Session keys are symmetric keys that are primarily derived from another key (called a master key) to restrict ciphertexts and minimize the exposure of an attack. Furthermore, using session keys improves communication performance since these keys do not need to be stored and searched. Moreover, symmetric key encryption is faster.
• Perfect forward secrecy: satisfying this security requirement means the past sessions will not be compromised even if a master key is compromised. In the context of IMDs, if the long-term key is stolen, and if this is known, the key can be updated, and only minimal information would be disclosed while all past communications can be kept safe from future compromises.
• Emergency authentication: if we deal with patients with implanted devices, there can always be emergencies requiring human intervention. Emergency authentication is one of the paradox requirements since unauthorized users need to access the implants to override the authorization and authentication properties, which calls for a clear definition of an emergency.

Concerning privacy, there are at least five privacy requirements [12,37] that should be satisfied:

• Device-existence privacy: this privacy requirement challenges the protocol designers to conceal the device’s information of an IMD-enabled system and prohibit an adversary from learning its existence.
• Device-type privacy: in the cases where the presence of a device cannot be wholly concealed or its privacy cannot be maintained, the type of the device should stay anonymous. By doing so, it is possible to protect the patient from device-type specific attacks.
• Specific-device ID privacy: the unique ID (or serial number) of an IMD should not be disclosed to unauthorized users. Doing so protects the patients by prohibiting attackers from tracking down their locations.
• Measurement and log privacy: the information measured, collected, and analyzed in either IMD or the reader should be kept private. Keeping the privacy of logs enables the investigation and trace actions taken during the communication.
• Bearer privacy: these are often related to information such as patients’ names, record history, tests, IMD characteristics, etc., which should be kept private.

3.2. Security Issues and Proposed Solutions

Threats are only dangerous because of adversaries, malicious entities that usually have access to the communication media and are placed between the authorized entities to violate confidentiality (and privacy), integrity, and availability. These adversaries can be passive or active, internal or external, computationally restrained or unrestrained, and single individual vs. group [6].

In regard to IMD security, we can broadly classify adversaries based on their capabilities as passive eavesdroppers and active attackers [37,38,39]. The first class of adversaries can only eavesdrop on the radio communication between the legitimate entities to discover unencrypted messages. Sometimes, even if the messages are encrypted, passive adversaries may observe patterns to violate the privacy of communicating parties, such as learning the existence of IMD.

On the other hand, active attackers can replay, modify, or delete messages in addition to possessing all of the capabilities of passive adversaries. These are the most dangerous types of adversaries that can bring life-threatening attacks to IMD-enabled systems. Adversaries in this category can execute replay attacks by forwarding exchanged messages later, changing critical settings of the implants by producing new commands, and exhausting the battery life of IMDs.

Different researchers have studied various security and privacy issues that challenge the normal operations of IMDs along with various proposed solutions that can be generally categorized as auditing-alone solutions, cryptographic solutions, and access control schemes [6]. The first category refers to solutions that solely depend on the access logs for the IMD. However, such techniques may not be suitable, as they cannot withstand active attacks if not used with other techniques such as access control mechanisms. The second measure utilizes cryptographic rudiments such as asymmetric-key cryptography, symmetric-key cryptography, and cryptographic hash functions. Three problems have been identified concerning the cryptographic solutions for IMDs [40]—the difficulty of implementation as most of the IMDs are already implanted in the human body, challenging to authenticate doctors during emergencies in which the patient is unconscious, and difficulty in maintaining the hardware and software of the implanted devices. The third solution refers to schemes that make use of access control help to protect IMDs from unauthorized access. The noticeable weakness in this solution is the difficulty of access during an emergency [6].

4. Formal Security Verification

Checking the safety of security protocols via a formal approach boosts users’ confidence, giving more convincing proof than its informal counterpart. When it comes to security protocols, such techniques may be divided into three categories: modal logic, model checkers, and theorem provers. This section will use one from the variants of modal logic (BAN logic) and another from model checking (AVISPA) to perform formal security verification for the authentication schemes proposed to safeguard IMDs. It is worth mentioning that the last two IMD authentication protocols (shown in Section 4.3.6 and Section 4.3.7) have also been analyzed, in [41,42], by the same authors.

4.1. BAN Logic Based Formal Security Verification

BAN logic uses logic of beliefs to analyze authentication protocols by following its own rules. First, the messages exchanged between the participants of the protocol are idealized. Then, reasonable assumptions will be formulated, and the objectives that the protocol intends to meet are defined. Finally, a derivation step follows where the BAN logic rules are used together with the assumptions and the intermediate results to reach the goals. Figure 2 shows a typical procedure of carrying out formal analysis using BAN logic. The BAN logic symbols and rules are shown in

Table 1. BAN logic notations.

Notation	Meaning
$\mathrm{M} \mathrm{believes} \mathrm{U}$	M believes that the message U is true
$\mathrm{M} \mathrm{sees} \mathrm{U}$	M receives the message U at any point in time
$\mathrm{M} \mathrm{said} \mathrm{U}$	M previously sent the message U
$\mathrm{M} \mathrm{controls} \mathrm{U}$	M has jurisdiction over U
$\mathrm{Fresh} \left(\mathrm{U}\right)$	U is fresh
$\mathrm{M}\stackrel{\mathrm{S}}{\leftrightarrow }\mathrm{N}$	S is a secret key shared between M and N
$\stackrel{\mathrm{S}}{\to }\mathrm{M}$	S is the M’s public key
$\mathrm{M}\stackrel{\mathrm{S}}{\iff }\mathrm{N}$	S is a shared secret between M and N.
${\left\{\mathrm{U}\right\}}_{\mathrm{K}}$	U is encrypted with a key K
$\mathrm{U},\mathrm{V}$	U is combined with V

and

Table 2. BAN logic rules.

Rule Name	Rule
Message Meaning Rule (MM)	$\frac{\mathrm{M} \mathrm{believes} \mathrm{M}\stackrel{\mathrm{S}}{\leftrightarrow }\mathrm{N}, \mathrm{M} \mathrm{sees} {\left\{\mathrm{U}\right\}}_{\mathrm{S}} }{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{said} \mathrm{U}}$ $\frac{\mathrm{M} \mathrm{believes} \mathrm{M}\stackrel{\mathrm{S}}{\iff }\mathrm{N},{\mathrm{M} \mathrm{sees} \langle \mathrm{U}\rangle }_{\mathrm{S}} }{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{said} \mathrm{U}}$ $\frac{\mathrm{M} \mathrm{believes} \stackrel{\mathrm{S}}{\to }\mathrm{N},\mathrm{M} \mathrm{sees} {\left\{\mathrm{U}\right\}}_{{\mathrm{L}}^{-1}} }{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{said} \mathrm{U}}$
Nonce Verification (NV) Rule	$\frac{\mathrm{M} \mathrm{believes} \#\left(\mathrm{U}\right), \mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{said} \mathrm{U}}{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{believes} \mathrm{U}}$
Jurisdiction (JR) Rule	$\frac{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{controls} \mathrm{U}, \mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{believes} \mathrm{U}}{\mathrm{M} \mathrm{believes} \mathrm{U}}$
Freshness (FR) Rule	$\frac{\mathrm{M} \mathrm{believes} \mathrm{fresh}\left(\mathrm{U}\right)}{\mathrm{M} \mathrm{believes} \mathrm{fresh}\left(\mathrm{U},\mathrm{V}\right)}$
Decomposition (DR) Rule	$\frac{\mathrm{M} \mathrm{sees} \left(\mathrm{U},\mathrm{V}\right)}{\mathrm{M} \mathrm{sees} \mathrm{U}}$
Belief Conjunction (BC) Rule	$\frac{\mathrm{M} \mathrm{believes} \mathrm{U},\mathrm{M} \mathrm{believes} \mathrm{V} }{\mathrm{M} \mathrm{believes} \left(\mathrm{U},\mathrm{V}\right)}$ $\frac{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{believes} \left(\mathrm{U},\mathrm{V}\right) }{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{believes} \mathrm{U}}$ $\frac{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{said} \left(\mathrm{U},\mathrm{V}\right) }{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{said} \mathrm{U}}$
Diffie–Hellman (DH) Rule	$\frac{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{said} \stackrel{{\mathrm{g}}^{\mathrm{V}}}{\to }\mathrm{N},\mathrm{M} \mathrm{believes} \stackrel{{\mathrm{g}}^{\mathrm{U}}}{\to }\mathrm{M} }{\mathrm{M} \mathrm{believes} \mathrm{M}\stackrel{{\mathrm{g}}^{\mathrm{UV}}}{\leftrightarrow } \mathrm{N}}$ $\frac{\mathrm{M} \mathrm{believes} \mathrm{N} \mathrm{said} \stackrel{{\mathrm{g}}^{\mathrm{V}}}{\to }\mathrm{N},\mathrm{M} \mathrm{believes} \stackrel{{\mathrm{g}}^{\mathrm{U}}}{\to }\mathrm{M} }{\mathrm{M} \mathrm{believes} \mathrm{M}\stackrel{{\mathrm{g}}^{\mathrm{UV}}}{\iff }\mathrm{N}}$

, respectively.

4.2. AVISPA Based Formal Security Analysis

The previous section shows that BAN logic has been extensively used to verify authentication protocols by transforming them into a particular format and validating them through different logical rules. Unfortunately, BAN logic has limitations in accurately specifying a protocol in the idealization phase [21,43]. For that reason, most authentication protocols use automated formal security verification tools alongside BAN logic.

AVISPA provides a language called the high-level protocol specification language (HLPSL) [44] for describing security protocols and specifying their intended security properties, as well as a set of tools to validate them formally. An hlpsl2if translates the HLPSL specification into the Intermediate Format (IF). IF is a lower-level language that is read directly by the back-ends of the AVISPA Tool. The IF specification of a protocol is then input to the back-ends of the AVISPA Tool to analyze the stated security goals. Figure 3 shows this process.

The HLPSL specification is consists of basic roles, transitions, and composed roles used in three modules: role, session, and environment. Basic role refers to the specification of each of the modeled protocol participants and the initially known information as a parameter. These roles are then called to specify how the resulting participants interact by connecting various basic roles into a composed role. The transition part of an HLPSL specification encompasses a set of transitions between different roles. Each transition symbolizes the acceptance of a message and the sending of a response message.

4.3. Formal Security Analysis of IMD Authentication Protocols

4.3.1. Khan et al.’s Protocol

The protocol proposed by Khan et al. [23] is a privacy-preserving key agreement protocol for WBANs. The protocol has four main participants: the system administrator (SA), the hub node (HN), the intermediary nodes (IN), and the normal nodes (N). HN is often considered a trusted high-end server that does not have computing resource constraints. The Ns are implanted sensors with computational limitations. The intermediary nodes have better processing, battery, and storage than Ns, and they are placed between HN and Ns to relay traffic. Furthermore, the protocol is executed in three main phases: initialization, registration, and authentication. Figure 4 shows the final phase of the protocol. Figure 5 presents the OFMC and CL-AtSe back-end results of the protocol.

• BAN logic based Formal Security Analysis

  ●    Idealization
  (I1)	$\mathrm{SN}\to \mathrm{HN}:{ \langle \mathrm{id}{}^{\prime }}_{\mathrm{N}},{ \mathrm{r}}_{\mathrm{N}},{ \mathrm{t}}_{\mathrm{N}},\mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}\rangle {}_{\mathrm{SN}\stackrel{{\mathrm{id}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}}$
  (I2)	$\mathrm{HN}\to \mathrm{SN}:{ \langle \mathrm{r}}_{\mathrm{N}},{\mathrm{f}}_{\mathrm{N}},\mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}, \mathrm{SN}\stackrel{\mathrm{ks}}{\leftrightarrow }\mathrm{HN}\rangle {}_{\mathrm{SN}\stackrel{{\mathrm{id}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}}$
  ●    Assumption
  (A1)	$\mathrm{HN} \mathrm{believes} \mathrm{SN}\stackrel{{\mathrm{id}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}$
  (A2)	$\mathrm{HN} \mathrm{believes} \mathrm{fresh}\left({\mathrm{t}}_{\mathrm{N}}\right)$
  (A3)	${\mathrm{HN} \mathrm{believes} \mathrm{SN} \mathrm{controls} \mathrm{id}{}^{\prime }}_{\mathrm{N}}$
  (A4)	$\mathrm{HN} \mathrm{believes} \mathrm{SN} \mathrm{controls} \mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}$
  (A5)	$\mathrm{SN} \mathrm{believes} \mathrm{SN}\stackrel{{\mathrm{id}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}$
  (A6)	$\mathrm{SN} \mathrm{believes} \mathrm{fresh}\left({\mathrm{f}}_{\mathrm{N}}\right)$
  (A7)	$\mathrm{SN} \mathrm{believes} \mathrm{HN} \mathrm{controls} \mathrm{SN}\stackrel{\mathrm{ks}}{\leftrightarrow }\mathrm{HN}$
  ●    Goals
  (G1)	${\mathrm{HN} \mathrm{believes} \mathrm{N} \mathrm{belives} \mathrm{id}{}^{\prime }}_{\mathrm{N}}$
  (G2)	${\mathrm{HN} \mathrm{believes} \mathrm{id}{}^{\prime }}_{\mathrm{N}}$
  (G3)	$\mathrm{HN} \mathrm{believes} \mathrm{SN} \mathrm{belives} \mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}$
  (G4)	$\mathrm{HN} \mathrm{belives} \mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}$
  (G5)	$\mathrm{SN} \mathrm{believes} \mathrm{HN} \mathrm{belives} \mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}$
  (G6)	$\mathrm{SN} \mathrm{believes} \mathrm{HN} \mathrm{belives} \mathrm{SN}\stackrel{\mathrm{ks}}{\leftrightarrow }\mathrm{HN}$
  (G7)	$\mathrm{SN} \mathrm{belives} \mathrm{SN}\stackrel{\mathrm{ks}}{\leftrightarrow }\mathrm{HN}$

  Figure 4. Khan et al.’s protocol.

  Figure 4. Khan et al.’s protocol.

  ●    Derivations
  (D1)	${\mathrm{HN} \mathrm{sees} \langle \mathrm{i}\mathrm{d}{}^{\prime }}_{\mathrm{N}},{ \mathrm{r}}_{\mathrm{N}},{ \mathrm{t}}_{\mathrm{N}},\mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}\rangle {}_{\mathrm{SN}\stackrel{{\mathrm{id}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}}$	$\left(\mathrm{I}1\right)$
  (D2)	$\mathrm{HN} \mathrm{believes} \mathrm{SN} \mathrm{said} \left[{\mathrm{i}\mathrm{d}{}^{\prime }}_{\mathrm{N}},{ \mathrm{r}}_{\mathrm{N}},{ \mathrm{t}}_{\mathrm{N}},\mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}\right]$	$\mathrm{By} \left(\mathrm{D}1\right),\left(\mathrm{A}1\right),\mathrm{MM}$
  (D3)	$\mathrm{HN} \mathrm{believes} \mathrm{SN} \mathrm{belives} \left[{\mathrm{i}\mathrm{d}{}^{\prime }}_{\mathrm{N}},{ \mathrm{r}}_{\mathrm{N}},{ \mathrm{t}}_{\mathrm{N}},\mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}\right]$	$\mathrm{By} \left(\mathrm{D}2\right),\left(\mathrm{A}2\right),\mathrm{NV}, \mathrm{FR}$
  (D4)	${\mathrm{HN} \mathrm{believes} \mathrm{SN} \mathrm{belives} \mathrm{id}{}^{\prime }}_{\mathrm{N}}$	$\mathrm{By} \left(\mathrm{D}3\right),\mathrm{BC}$
  (D5)	${\mathrm{HN} \mathrm{believes} \mathrm{id}{}^{\prime }}_{\mathrm{N}}$	$\mathrm{By} \left(\mathrm{D}4\right),\left(\mathrm{A}3\right),\mathrm{JR}$.
  (D6)	$\mathrm{HN} \mathrm{believes} \mathrm{SN} \mathrm{belives}$ $\mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}$	$\mathrm{By} \left(\mathrm{D}3\right),\mathrm{BC}$
  (D7)	$\mathrm{HN} \mathrm{belives} \mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}$	$\mathrm{By} \left(\mathrm{D}6\right), \left(\mathrm{A}4\right), \mathrm{JR}$
  (D8)	${\mathrm{SN} \mathrm{sees} \langle \mathrm{r}}_{\mathrm{N}},{\mathrm{f}}_{\mathrm{N}},\mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}, \mathrm{SN}\stackrel{\mathrm{ks}}{\leftrightarrow }\mathrm{HN}\rangle {}_{\mathrm{SN}\stackrel{{\mathrm{id}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}}$	$\left(\mathrm{I}2\right)$
  (D9)	$\mathrm{SN} \mathrm{believes} \mathrm{HN} \mathrm{said} \left[{ \mathrm{r}}_{\mathrm{N}},{\mathrm{f}}_{\mathrm{N}},\mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}, \mathrm{SN}\stackrel{\mathrm{ks}}{\leftrightarrow }\mathrm{HN}\right]$	$\mathrm{By} \left(\mathrm{D}8\right),\left(\mathrm{A}5\right),\mathrm{MM}$
  (D10)	$\mathrm{SN} \mathrm{believes} \mathrm{HN} \mathrm{belives} \left[{ \mathrm{r}}_{\mathrm{N}},{\mathrm{f}}_{\mathrm{N}},\mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}, \mathrm{SN}\stackrel{\mathrm{ks}}{\leftrightarrow }\mathrm{HN}\right]$	$\mathrm{By} \left(\mathrm{D}9\right),\left(\mathrm{A}6\right),\mathrm{NV}, \mathrm{FR}$
  (D11)	$\mathrm{SN} \mathrm{believes} \mathrm{HN} \mathrm{belives} \mathrm{SN}\stackrel{{\mathrm{x}}_{\mathrm{N}}}{\leftrightarrow }\mathrm{HN}$	$\mathrm{By} \left(\mathrm{D}10\right), \mathrm{BC}$
  (D12)	$\mathrm{SN} \mathrm{believes} \mathrm{HN} \mathrm{believes} \mathrm{SN}\stackrel{\mathrm{ks}}{\leftrightarrow }\mathrm{HN}$	$\mathrm{By} \left(\mathrm{D}10\right), \mathrm{BC}$
  (D13)	$\mathrm{SN} \mathrm{believes} \mathrm{SN}\stackrel{\mathrm{ks}}{\leftrightarrow }\mathrm{HN}$	$\mathrm{By} \left(\mathrm{D}12\right), \left(\mathrm{A}7\right), \mathrm{JR}$

• AVISPA based Formal Security Analysis Result

  Figure 5. AVISPA result of Khan et al.’s protocol.

  Figure 5. AVISPA result of Khan et al.’s protocol.

4.3.2. Wu et al.’s Protocol

This protocol [24] is a proxy-based access control protocol that uses attribute-based encryption, particularly the ciphertext policy attribute-based encryption (CP-ABE). The protocol is executed by three participants—IMD, operator, and proxy. The IMDs have unique identifications ID_i and a master key K_i^M, which is only used for the initial pairing process with the proxy. All operators with the public parameters PK used in CP-ABE, unique identifications ID_o, a public and private key pair (PU_OP and PR_OP, respectively), and a certificate Cert must first be registered at a Central Health Authority (CHA). The CHA will then generate the secret key SK. The operator uses a programmer to communicate with the IMD and proxy after it obtains the required information by manual inputting or reading in from a smart card. With the identification of ID_p and connection with an IMD programmer through an audio cable, the proxy device performs the access control for the IMD. Figure 6 shows the flow of messages in the protocol. Figure 7 illustrates the OFMC and CL-AtSe back-end results of the protocol.

• BAN logic-based formal security analysis.

  Figure 6. Wu et al.’s protocol.

  Figure 6. Wu et al.’s protocol.

  ●    Idealization
  (I1)	$\mathrm{PRG}\to \mathrm{PRX}:\langle {\mathrm{ID}}_{\mathrm{O}},\mathrm{SN},{ \mathrm{t}}_1\rangle {}_{{\mathrm{PU}}^{-1}{}_{\mathrm{OP}}}$
  (I2)	$\mathrm{PRX}\to \mathrm{PRG}:\langle \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}\rangle {}_{\mathrm{PKT}}$
  (I3)	$\mathrm{PRX}\to \mathrm{IMD}:\langle \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD},\rangle {}_{\mathrm{PRX}\stackrel{{\mathrm{K}}_{\mathrm{S}}}{\leftrightarrow }\mathrm{IMD}}$, $\langle \mathrm{SN},{ \mathrm{ID}}_{\mathrm{P}},{\mathrm{ID}}_{\mathrm{I}},{ \mathrm{ID}}_{\mathrm{O}},{ \mathrm{t}}_2\rangle {}_{\mathrm{PRX}\stackrel{{\mathrm{K}}_{\mathrm{S}}}{\leftrightarrow }\mathrm{IMD}}$
  (I4)	$\mathrm{PRG}\to \mathrm{IMD}:\langle \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}, \mathrm{C}\rangle {}_{\mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}}$, $\langle \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}, \mathrm{SN},{ \mathrm{ID}}_{\mathrm{O}},{\mathrm{ID}}_{\mathrm{I}},{ \mathrm{t}}_3\rangle {}_{\mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}}$
  (I5)	$\mathrm{IMD}\to \mathrm{PRG}:\langle \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}, \mathrm{D}\rangle {}_{\mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}}$, $\langle \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}, \mathrm{SN},{ \mathrm{ID}}_{\mathrm{I}},{\mathrm{ID}}_{\mathrm{O}},{ \mathrm{t}}_4\rangle {}_{\mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}}$
  ●    Assumption
  (A1)	$\mathrm{PRX} \mathrm{believes} \stackrel{{\mathrm{PU}}_{\mathrm{OP}}}{\to }\mathrm{PRG}$
  (A2)	$\mathrm{PRX} \mathrm{believes} \mathrm{fresh}\left({\mathrm{t}}_1\right)$
  (A3)	${\mathrm{PRX} \mathrm{believes} \mathrm{PRG} \mathrm{Controls} \mathrm{ID}}_{\mathrm{O}}$
  (A4)	$\mathrm{PRX} \mathrm{believes} \stackrel{{\mathrm{PKT}}^{-1}}{\to }\mathrm{PRG}$
  (A5)	$\mathrm{PRG} \mathrm{believes} \mathrm{fresh}\left({\mathrm{K}}_{\mathrm{t}}\right)$
  (A6)	$\mathrm{PRG} \mathrm{believes} \mathrm{PRX} \mathrm{Controls} \mathrm{PRX}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{PRG}$
  (A7)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRX}\stackrel{{\mathrm{K}}_{\mathrm{s}}}{\leftrightarrow }\mathrm{IMD}$
  (A8)	$\mathrm{IMD} \mathrm{believes} \mathrm{fresh} \left({\mathrm{K}}_{\mathrm{t}}\right)$
  (A9)	$\mathrm{IMD} \mathrm{believes} \mathrm{fresh}\left({\mathrm{t}}_2\right)$
  (A10)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRX} \mathrm{Controls} \mathrm{PRX}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$
  (A11)	${\mathrm{IMD} \mathrm{believes} \mathrm{PRX} \mathrm{Controls} \mathrm{ID}}_{\mathrm{P}}$
  (A12)	$\mathrm{IMD} \mathrm{believes} \mathrm{fresh}\left({\mathrm{t}}_3\right)$
  (A13)	${\mathrm{IMD} \mathrm{believes} \mathrm{PRG} \mathrm{Controls} \mathrm{ID}}_{\mathrm{O}}$
  (A14)	$\mathrm{IMD} \mathrm{believes} \mathrm{fresh}\left({\mathrm{t}}_4\right)$
  (A15)	${\mathrm{PRG} \mathrm{believes} \mathrm{IMD} \mathrm{Controls} \mathrm{ID}}_{\mathrm{I}}$
  ●    Goals
  (G1)	${\mathrm{PRX} \mathrm{believes} \mathrm{ID}}_{\mathrm{O}}$
  (G2)	$\mathrm{PRG} \mathrm{believes} \mathrm{PRX} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$
  (G3)	$\mathrm{PRG} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$
  (G4)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRX} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$
  (G5)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$
  (G6)	${\mathrm{IMD} \mathrm{believes} \mathrm{ID}}_{\mathrm{P}}$
  (G7)	${\mathrm{IMD} \mathrm{believes} \mathrm{ID}}_{\mathrm{O}}$
  (G8)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRG} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$
  (G9)	$\mathrm{PRG} \mathrm{believes} \mathrm{IMD} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$
  (G10)	${\mathrm{PRG} \mathrm{believes} \mathrm{ID}}_{\mathrm{I}}$
  ●    Derivations
  (D1)	${\mathrm{PRX} \mathrm{sees} \langle \mathrm{ID}}_{\mathrm{O}},\mathrm{SN},{ \mathrm{t}}_1\rangle {}_{{\mathrm{PU}}^{-1}{}_{\mathrm{OP}}}$	$\left(\mathrm{I}1\right)$
  (D2)	$\mathrm{PRX} \mathrm{believes} \mathrm{PRG} \mathrm{said} \left[{\mathrm{ID}}_{\mathrm{O}}, \mathrm{SN},{ \mathrm{t}}_1\right]$	$\mathrm{By} \left(\mathrm{D}1\right),\left(\mathrm{A}1\right),\mathrm{MM}$
  (D3)	$\mathrm{PRX} \mathrm{believes} \mathrm{PRG} \mathrm{believes} \left[{\mathrm{ID}}_{\mathrm{O}}, \mathrm{SN},{ \mathrm{t}}_1\right]$	$\mathrm{By} \left(\mathrm{D}2\right),\left(\mathrm{A}2\right),\mathrm{NV}, \mathrm{FR}$
  (D4)	${\mathrm{PRX} \mathrm{believes} \mathrm{PRG} \mathrm{believes} \mathrm{ID}}_{\mathrm{O}}$	$\mathrm{By} \left(\mathrm{D}3\right),\mathrm{BC}$
  (D5)	${\mathrm{PRX} \mathrm{believes} \mathrm{ID}}_{\mathrm{O}}$	$\mathrm{By} \left(\mathrm{D}4\right),\left(\mathrm{A}3\right),\mathrm{JR}$
  (D6)	$\mathrm{PRG} \mathrm{sees} \langle \mathrm{PRG} \stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}\rangle {}_{\mathrm{PKT}}$	$\left(\mathrm{I}2\right)$
  (D7)	$\mathrm{PRG} \mathrm{believes} \mathrm{PRX} \mathrm{said} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$	$\mathrm{By} \left(\mathrm{D}6\right), \left(\mathrm{A}4\right), \mathrm{JR}$
  (D8)	$\mathrm{PRG} \mathrm{believes} \mathrm{PRX} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$	$\mathrm{By} \left(\mathrm{D}7\right), \left(\mathrm{A}5\right), \mathrm{NV}, \mathrm{FR}$
  (D9)	$\mathrm{PRG} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$	$\mathrm{By} \left(\mathrm{D}8\right),\left(\mathrm{A}6\right),\mathrm{JR}$
  (D10)	$\mathrm{IMD} \mathrm{sees} \langle \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}\rangle {}_{\mathrm{PRX}\stackrel{{\mathrm{K}}_{\mathrm{S}}}{\leftrightarrow }\mathrm{IMD} }, \langle \mathrm{SN},{ \mathrm{ID}}_{\mathrm{P}},{\mathrm{ID}}_{\mathrm{I}},{ \mathrm{ID}}_{\mathrm{O}},{ \mathrm{t}}_2\rangle {}_{\mathrm{PRX}\stackrel{{\mathrm{K}}_{\mathrm{S}}}{\leftrightarrow }\mathrm{IMD}}$	(I3)
  (D11)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRX} \mathrm{said} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$	$\mathrm{By} \left(\mathrm{D}10\right), \mathrm{DR}, \left(\mathrm{A}7\right),\mathrm{MM}$
  (D12)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRX} \mathrm{said} \left[\mathrm{SN},{ \mathrm{ID}}_{\mathrm{P}},{\mathrm{ID}}_{\mathrm{I}},{ \mathrm{ID}}_{\mathrm{O}},{ \mathrm{t}}_2\right]$	$\mathrm{By} \left(\mathrm{D}10\right), \mathrm{DR}, \left(\mathrm{A}7\right),\mathrm{MM}$
  (D13)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRX} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$	$\mathrm{By} \left(\mathrm{D}11\right), \left(\mathrm{A}8\right), \mathrm{NV}, \mathrm{FR}$
  (D14)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRX} \mathrm{believes} \left[\mathrm{SN},{ \mathrm{ID}}_{\mathrm{P}},{\mathrm{ID}}_{\mathrm{I}},{ \mathrm{ID}}_{\mathrm{O}},{ \mathrm{t}}_2\right]$	$\mathrm{By} \left(\mathrm{D}12\right), \left(\mathrm{A}9\right), \mathrm{NV}, \mathrm{FR}$
  (D15)	${\mathrm{IMD} \mathrm{believes} \mathrm{PRX} \mathrm{believes} \mathrm{ID}}_{\mathrm{P}}$	$\mathrm{By} \left(\mathrm{D}14\right), \mathrm{BC}$
  (D16)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$	$\mathrm{By} \left(\mathrm{D}13\right), \left(\mathrm{A}10\right), \mathrm{JR}$
  (D17)	${\mathrm{IMD} \mathrm{believes} \mathrm{ID}}_{\mathrm{P}}$	$\mathrm{By} \left(\mathrm{D}15\right), \left(\mathrm{A}11\right), \mathrm{JR}$
  (D18)	$\mathrm{IMD} \mathrm{sees} \langle \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}, \mathrm{SN},{ \mathrm{ID}}_{\mathrm{O}},{\mathrm{ID}}_{\mathrm{I}},{ \mathrm{t}}_3\rangle {}_{\mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}}$	$\mathrm{By} \left(\mathrm{I}4\right), \mathrm{DR}$
  (D19)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRG} \mathrm{said} \left[\mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}, \mathrm{SN},{ \mathrm{ID}}_{\mathrm{O}},{\mathrm{ID}}_{\mathrm{I}},{ \mathrm{t}}_3\right]$	$\mathrm{By} \left(\mathrm{D}18\right), \left(\mathrm{D}16\right), \mathrm{MM}$
  (D20)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRG} \mathrm{believes} \left[\mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}, \mathrm{SN},{ \mathrm{ID}}_{\mathrm{O}},{\mathrm{ID}}_{\mathrm{I}},{ \mathrm{t}}_3\right]$	$\mathrm{By} \left(\mathrm{D}19\right), \left(\mathrm{A}12\right), \mathrm{NV}, \mathrm{FR}$
  (D21)	${ \mathrm{IMD} \mathrm{believes} \mathrm{PRG} \mathrm{believes} \mathrm{ID}}_{\mathrm{O}}$	$\mathrm{By} \left(\mathrm{D}20\right), \mathrm{BC}$
  (D22)	${\mathrm{IMD} \mathrm{believes} \mathrm{ID}}_{\mathrm{O}}$	$\mathrm{By} \left(\mathrm{D}21\right), \left(\mathrm{A}13\right),\mathrm{JR}$
  (D23)	$\mathrm{IMD} \mathrm{believes} \mathrm{PRG} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$	$\mathrm{By} \left(\mathrm{D}20\right), \mathrm{BC}$
  (D24)	$\mathrm{PRG} \mathrm{sees} \langle \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}, \mathrm{SN},{ \mathrm{ID}}_{\mathrm{I}},{\mathrm{ID}}_{\mathrm{O}},{ \mathrm{t}}_4\rangle {}_{\mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}}$	$\mathrm{By} \left(\mathrm{I}5\right), \mathrm{DR}$
  (D25)	$\mathrm{PRG} \mathrm{believes} \mathrm{IMD} \mathrm{said} \left[\mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}, \mathrm{SN},{ \mathrm{ID}}_{\mathrm{I}},{\mathrm{ID}}_{\mathrm{O}},{ \mathrm{t}}_4\right]$	$\mathrm{By} \left(\mathrm{D}24\right), \left(\mathrm{D}9\right), \mathrm{MM}$
  (D26)	$\mathrm{PRG} \mathrm{believes} \mathrm{IMD} \mathrm{believes} \left[\mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}, \mathrm{SN},{ \mathrm{ID}}_{\mathrm{I}},{\mathrm{ID}}_{\mathrm{O}},{ \mathrm{t}}_4\right]$	$\mathrm{By} \left(\mathrm{D}25\right), \left(\mathrm{A}14\right), \mathrm{NV}, \mathrm{FR}$
  (D27)	$\mathrm{PRG} \mathrm{believes} \mathrm{IMD} \mathrm{believes} \mathrm{PRG}\stackrel{{\mathrm{K}}_{\mathrm{t}}}{\leftrightarrow }\mathrm{IMD}$	$\mathrm{By} \left(\mathrm{D}26\right), \mathrm{BC}$
  (D28)	${\mathrm{PRG} \mathrm{believes} \mathrm{IMD} \mathrm{believes} \mathrm{ID}}_{\mathrm{I}}$	$\mathrm{By} \left(\mathrm{D}26\right), \mathrm{BC}$
  (D29)	${\mathrm{PRG} \mathrm{believes} \mathrm{ID}}_{\mathrm{I}}$	By (D28),(I15), JR

• AVISPA-based formal security analysis result.

  Figure 7. AVISPA result of Wu et al.’s protocol.

  Figure 7. AVISPA result of Wu et al.’s protocol.

4.3.3. Chi et al.’s Protocol

This protocol [25] uses a compressing-based encryption mechanism and public key infrastructure, and other cryptographic protocols, such as RSA, AES, and HMAC. The protocol comprises three participants—IMD, smartphone, and programmer. The IMD communicates with the patient’s smartphone via Bluetooth, and it interacts with the doctor’s programmer through the wireless medium. The smartphone refers to both the patient and doctor smartphones, in which the patient’s smartphone links with the IMD utilizing Bluetooth and connects with a programmer wirelessly. The protocol involves four stages—initialization, pairing, authentication, and authorization, as shown in Figure 8 and Figure 9 presents the OFMC and CL-AtSe back-end results of the protocol.

• BAN logic-based formal security analysis.

  ●    Idealization
  (I1)	$\mathrm{S}\to \mathrm{I}:\langle {\mathrm{R}}_1,{\mathrm{SN}}_{\mathrm{O}},{\mathrm{ID}}_{\mathrm{S}},{\mathrm{TS}}_1,\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}\rangle {}_{\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}}$
  (I2)	$\mathrm{D}\to \mathrm{S}:\langle {\mathrm{R}}_3,\mathrm{SN},{\mathrm{ID}}_{\mathrm{D}},{\mathrm{TS}}_2\rangle {}_{{\mathrm{PK}}^{-1}}$
  (I3)	$\mathrm{S}\to \mathrm{D}:\langle \mathrm{nonce}\rangle {}_{\mathrm{PK}}$
  (I4)	$\mathrm{D}\to \mathrm{S}:\langle {\mathrm{R}}_4,\mathrm{SN},{\mathrm{ID}}_{\mathrm{D}},{\mathrm{ID}}_{\mathrm{S}},{\mathrm{TS}}_3,\mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}\rangle {}_{\mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}}$
  (I5)	$\mathrm{S}\to \mathrm{I}:\langle { \mathrm{R}}_6,\mathrm{SN},{\mathrm{ID}}_{\mathrm{D}},{\mathrm{C}}_1,{\mathrm{TS}}_5{}_{\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}},\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D},\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}\rangle {}_{\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}}$
  (I6)	$\mathrm{S}\to \mathrm{D}:\langle \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\rangle {}_{\mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}}$
  (I7)	$\mathrm{I}\to \mathrm{D}:\langle \mathrm{SN},{\mathrm{C}}_2,\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D},\rangle {}_{\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}},\langle \mathrm{data},\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\rangle {}_{\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}}$
  (I8)	$\mathrm{I}\to \mathrm{S}:\langle \mathrm{CMD},{\mathrm{ID}}_{\mathrm{I}},{\mathrm{TS}}_7\rangle {}_{\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}}$
  ●    Assumption
  (A1)	$\mathrm{I} \mathrm{believes} \mathrm{S}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{I}$
  (A2)	${\mathrm{I} \mathrm{believes} \mathrm{ID}}_{\mathrm{I}}$
  (A3)	${\mathrm{I} \mathrm{believes} \mathrm{ID}}_{\mathrm{S}}$
  (A4)	$\mathrm{I} \mathrm{believes} \mathrm{fresh}\left({\mathrm{TS}}_1\right)$
  (A5)	$\mathrm{S} \mathrm{believes} \stackrel{\mathrm{PK}}{\to }\mathrm{D}$
  (A6)	$\mathrm{S} \mathrm{believes} \mathrm{fresh}\left({\mathrm{TS}}_2\right)$
  (A7)	$\mathrm{S} \mathrm{believes} \mathrm{D} \mathrm{Controls} \mathrm{SN}$
  (A8)	$\mathrm{D} \mathrm{believes} \stackrel{\mathrm{PK}}{\to }\mathrm{D}$
  (A9)	$\mathrm{D} \mathrm{believes} \mathrm{fresh}\left(\mathrm{nonce}\right)$
  (A10)	$\mathrm{D} \mathrm{believes} \mathrm{S} \mathrm{Controls} \mathrm{nonce}$
  (A11)	$\mathrm{D} \mathrm{believes} \mathrm{RM}$
  (A12)	$\mathrm{D} \mathrm{believes} \mathrm{SN}$
  (A13)	$\mathrm{S} \mathrm{believes} \mathrm{RM}$
  (A14)	$\mathrm{S} \mathrm{believes} \mathrm{nonce}$
  (A15)	$\mathrm{S} \mathrm{believes} \mathrm{fresh}\left({\mathrm{TS}}_3\right)$
  (A16)	$\mathrm{I} \mathrm{believes} \mathrm{fresh}\left(\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\right)$
  (A17)	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{Controls} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}$
  (A18)	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{Controls} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}$
  (A19)	$\mathrm{D} \mathrm{believes} \mathrm{fresh}\left(\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\right)$
  (A20)	$\mathrm{D} \mathrm{believes} \mathrm{S} \mathrm{Controls} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}$
  (A21)	$\mathrm{D} \mathrm{believes} \mathrm{fresh}\left(\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}\right)$
  (A22)	$\mathrm{S} \mathrm{believes} \mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}$
  (A23)	$\mathrm{S} \mathrm{believes} \mathrm{fresh}\left({\mathrm{TS}}_7\right)$
  ●    Goals
  (G1)	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{belives} \mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}$
  (G2)	$\mathrm{I} \mathrm{belives} \mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}$
  (G3)	$\mathrm{S} \mathrm{believes} \mathrm{I} \mathrm{belives} \mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}$
  (G4)	$\mathrm{D} \mathrm{believes} \mathrm{S} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}$
  (G5)	$\mathrm{D} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}$
  (G6)	$\mathrm{S} \mathrm{believes} \mathrm{D} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}$
  (G7)	$\mathrm{S} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}$
  (G8)	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{S}$
  (G9)	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{S}$
  (G10)	$\mathrm{I} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{S}$
  (G11)	$\mathrm{I} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{S}$
  (G12)	$\mathrm{D} \mathrm{believes} \mathrm{S} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{S}$
  (G13)	$\mathrm{D} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{S}$
  (G14)	$\mathrm{D} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{S}$
  (G15)	$\mathrm{I} \mathrm{believes} \mathrm{D} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{S}$
  (G16)	$\mathrm{I} \mathrm{believes} \mathrm{D} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{S}$
  (G17)	$\mathrm{D} \mathrm{believes} \mathrm{I} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{S}$
  ●    Derivations
  $\left(\mathrm{D}1\right)$	${\mathrm{I} \mathrm{sees} \langle \mathrm{R}}_1,{ \mathrm{SN}}_{\mathrm{O}},{\mathrm{ID}}_{\mathrm{S}},{\mathrm{TS}}_1,\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}\rangle {}_{\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}}$	$\left(\mathrm{I}1\right)$
  $\left(\mathrm{D}2\right)$	$\mathrm{I} \mathrm{believes} \mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}$	$\left(\mathrm{A}1\right),\left(\mathrm{A}2\right),\left(\mathrm{A}3\right), \mathrm{BC}$
  $\left(\mathrm{D}3\right)$	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{said} \left[{\mathrm{R}}_1,{ \mathrm{SN}}_{\mathrm{O}},{\mathrm{ID}}_{\mathrm{S}},{\mathrm{TS}}_1,\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}\right]$	$\mathrm{By} \left(\mathrm{D}1\right),\left(\mathrm{D}2\right),\mathrm{MM}$
  $\left(\mathrm{D}4\right)$	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{believes} \left[{\mathrm{R}}_1,{ \mathrm{SN}}_{\mathrm{O}},{\mathrm{ID}}_{\mathrm{S}},{\mathrm{TS}}_1,\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}\right]$	$\mathrm{By} \left(\mathrm{D}2\right),\left(\mathrm{A}4\right),\mathrm{NV}, \mathrm{FR}$
  $\left(\mathrm{D}5\right)$	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{believes} \mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}$	By $\left(\mathrm{D}4\right),\mathrm{BC}$
  $\left(\mathrm{D}6\right)$	${\mathrm{S} \mathrm{sees} \langle \mathrm{R}}_3, \mathrm{SN},{\mathrm{ID}}_{\mathrm{D}},{\mathrm{TS}}_2\rangle {}_{{\mathrm{PK}}^{-1}}$	(I2)
  $\left(\mathrm{D}7\right)$	$\mathrm{S} \mathrm{believes} \mathrm{D} \mathrm{said} \left[{\mathrm{R}}_3, \mathrm{SN},{\mathrm{ID}}_{\mathrm{D}},{\mathrm{TS}}_2\right]$	$\mathrm{By} \left(\mathrm{D}6\right), \left(\mathrm{A}5\right), \mathrm{MM}$
  $\left(\mathrm{D}8\right)$	$\mathrm{S} \mathrm{believes} \mathrm{D} \mathrm{believes} \left[{\mathrm{R}}_3, \mathrm{SN},{\mathrm{ID}}_{\mathrm{D}},{\mathrm{TS}}_2\right]$	By $\left(\mathrm{D}7\right), \left(\mathrm{A}6\right), \mathrm{NV}, \mathrm{FR}$
  $\left(\mathrm{D}9\right)$	$\mathrm{S} \mathrm{believes} \mathrm{D} \mathrm{believes} \mathrm{SN}$	$\mathrm{By} \left(\mathrm{D}8\right), \mathrm{BC}$
  $\left(\mathrm{D}10\right)$	$\mathrm{S} \mathrm{believes} \mathrm{SN}$	$\mathrm{By} \left(\mathrm{D}9\right), \left(\mathrm{A}7\right), \mathrm{JR}$
  $\left(\mathrm{D}11\right)$	$\mathrm{D} \mathrm{sees} \langle \mathrm{nonce}\rangle {}_{\mathrm{PK}}$	(I3)
  $\left(\mathrm{D}12\right)$	$\mathrm{D} \mathrm{believes} \mathrm{S} \mathrm{said} \left[\mathrm{nonce}\right]$	$\mathrm{By} \left(\mathrm{D}11\right), \left(\mathrm{A}8\right), \mathrm{MM}$
  $\left(\mathrm{D}13\right)$	$\mathrm{D} \mathrm{believes} \mathrm{S} \mathrm{believes} \mathrm{nonce}$	$\mathrm{By} \left(\mathrm{D}12\right),\left(\mathrm{A}9\right),\mathrm{NV}, \mathrm{FR}$
  $\left(\mathrm{D}14\right)$	$\mathrm{D} \mathrm{believes} \mathrm{nonce}$	$\mathrm{By} \left(\mathrm{D}13\right),\left(\mathrm{A}10\right),\mathrm{JR}$
  $\left(\mathrm{D}15\right)$	$\mathrm{D} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}$	$\mathrm{By} \left(\mathrm{D}14\right),\left(\mathrm{A}11\right),\left(\mathrm{A}12\right), \mathrm{BC}$
  $\left(\mathrm{D}16\right)$	$\mathrm{S} \mathrm{belives} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}$	$\mathrm{By} \left(\mathrm{D}10\right),\left(\mathrm{A}13\right),\left(\mathrm{A}14\right),\mathrm{BC}$
  $\left(\mathrm{D}17\right)$	${\mathrm{S} \mathrm{sees} \langle \mathrm{R}}_4, \mathrm{SN},{\mathrm{ID}}_{\mathrm{D}},{ \mathrm{ID}}_{\mathrm{S}},{\mathrm{TS}}_3,\mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}\rangle {}_{\mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}}$	(I4)
  $\left(\mathrm{D}18\right)$	$\mathrm{S} \mathrm{believes} \mathrm{D} \mathrm{said} \left[{\mathrm{R}}_4, \mathrm{SN},{\mathrm{ID}}_{\mathrm{D}},{ \mathrm{ID}}_{\mathrm{S}},{\mathrm{TS}}_3,\mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}\right]$	By $\left(\mathrm{D}17\right), \left(\mathrm{D}16\right), \mathrm{MM}$
  $\left(\mathrm{D}19\right)$	$\mathrm{S} \mathrm{believes} \mathrm{D} \mathrm{belives} \left[{\mathrm{R}}_4, \mathrm{SN},{\mathrm{ID}}_{\mathrm{D}},{ \mathrm{ID}}_{\mathrm{S}},{\mathrm{TS}}_3,\mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}\right]$	$\mathrm{By} \left(\mathrm{D}18\right), \left(\mathrm{A}15\right), \mathrm{NV}, \mathrm{FR}$
  $\left(\mathrm{D}20\right)$	$\mathrm{S} \mathrm{believes} \mathrm{D} \mathrm{believes} \mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}$	$\mathrm{By} \left(\mathrm{D}19\right), \mathrm{BC}$
  $\left(\mathrm{D}21\right)$	${\mathrm{I} \mathrm{sees} \langle \mathrm{R}}_6, \mathrm{SN},{\mathrm{ID}}_{\mathrm{D}},{\mathrm{C}}_1,{ \mathrm{TS}}_5\rangle {}_{\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}},\langle \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D},\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}\rangle {}_{\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}}$	(I5)
  $\left(\mathrm{D}22\right)$	$\mathrm{I} \mathrm{sees} \langle \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D},\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}\rangle {}_{\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}}$	$\mathrm{By} \left(\mathrm{D}21\right),\mathrm{DR}$
  $\left(\mathrm{D}23\right)$	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{said} \left[\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D},\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}\right]$	$\mathrm{By} \left(\mathrm{D}22\right), \left(\mathrm{D}2\right), \mathrm{MM}$
  $\left(\mathrm{D}24\right)$	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{belives} \left[\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D},\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}\right]$	$\mathrm{By} \left(\mathrm{D}23\right), \left(\mathrm{A}16\right), \mathrm{NV}, \mathrm{FR}$
  $\left(\mathrm{D}25\right)$	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{belives} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}$	$\mathrm{By} \left(\mathrm{D}24\right), \mathrm{BC}$
  $\left(\mathrm{D}26\right)$	$\mathrm{I} \mathrm{believes} \mathrm{S} \mathrm{belives} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}$	$\mathrm{By} \left(\mathrm{D}24\right), \mathrm{BC}$
  $\left(\mathrm{D}27\right)$	$\mathrm{I} \mathrm{believes} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}$	$\mathrm{By} \left(\mathrm{D}25\right), \left(\mathrm{A}17\right), \mathrm{JR}$
  $\left(\mathrm{D}28\right)$	$\mathrm{I} \mathrm{believes} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}$	$\mathrm{By} \left(\mathrm{D}26\right), \left(\mathrm{A}18\right), \mathrm{JR}$
  $\left(\mathrm{D}29\right)$	$\mathrm{D} \mathrm{sees} \langle \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\rangle {}_{\mathrm{D}\stackrel{{\mathrm{K}}_{\mathrm{p}}}{\leftrightarrow }\mathrm{S}}$	(I6)
  $\left(\mathrm{D}30\right)$	$\mathrm{D} \mathrm{believes} \mathrm{S} \mathrm{said} \left[\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\right]$	$\mathrm{By} \left(\mathrm{D}30\right), \left(\mathrm{A}15\right), \mathrm{MM}$
  $\left(\mathrm{D}31\right)$	$\mathrm{D} \mathrm{believes} \mathrm{S} \mathrm{belives} \left[\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\right]$	$\mathrm{By} \left(\mathrm{D}30\right), \left(\mathrm{A}19\right), \mathrm{NV}, \mathrm{FR}$
  $\left(\mathrm{D}32\right)$	$\mathrm{D} \mathrm{believes} \mathrm{S} \mathrm{belives} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}$	$\mathrm{By} \left(\mathrm{D}31\right), \mathrm{BC}$
  $\left(\mathrm{D}33\right)$	$\mathrm{D} \mathrm{believes} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}$	$\mathrm{By} \left(\mathrm{D}32\right), \left(\mathrm{A}20\right), \mathrm{JR}$
  $\left(\mathrm{D}34\right)$	$\mathrm{D} \mathrm{sees} \langle \mathrm{SN},{ \mathrm{C}}_2, \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}\rangle {}_{\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}},\langle \mathrm{data}, \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\rangle {}_{\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}}$	(I7)
  $\left(\mathrm{D}35\right)$	$\mathrm{D} \mathrm{sees} \langle \mathrm{data}, \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\rangle {}_{\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}}$	$\mathrm{By} \left(\mathrm{D}34\right), \mathrm{DR}$
  $\left(\mathrm{D}36\right)$	$\mathrm{D} \mathrm{believes} \mathrm{I} \mathrm{said} \left[\mathrm{data}, \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\right]$	$\mathrm{By} \left(\mathrm{D}35\right), \left(\mathrm{D}33\right), \mathrm{MM}$
  $\left(\mathrm{D}37\right)$	$\mathrm{D} \mathrm{believes} \mathrm{I} \mathrm{belives} \left[\mathrm{data}, \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}\right]$	$\mathrm{By} \left(\mathrm{D}30\right), \left(\mathrm{A}19\right), \mathrm{NV}, \mathrm{FR}$
  $\left(\mathrm{D}38\right)$	$\mathrm{D} \mathrm{believes} \mathrm{I} \mathrm{belives} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{d}}}{\leftrightarrow }\mathrm{D}$	$\mathrm{By} \left(\mathrm{D}37\right), \mathrm{BC}$
  $\left(\mathrm{D}39\right)$	$\mathrm{D} \mathrm{sees} \langle \mathrm{SN},{ \mathrm{C}}_2, \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}\rangle {}_{\mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}}$	$\mathrm{By} \left(\mathrm{D}34\right), \mathrm{DR}$
  $\left(\mathrm{D}40\right)$	$\mathrm{D} \mathrm{believes} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}$	$\mathrm{By} \left(\mathrm{D}33\right), \left(\mathrm{A}12\right), \mathrm{BC}$
  $\left(\mathrm{D}41\right)$	$\mathrm{D} \mathrm{believes} \mathrm{I} \mathrm{said} \left[\mathrm{SN},{ \mathrm{C}}_2, \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}\right]$	$\mathrm{By} \left(\mathrm{D}39\right), \left(\mathrm{D}40\right), \mathrm{MM}$
  $\left(\mathrm{D}42\right)$	$\mathrm{D} \mathrm{believes} \mathrm{I} \mathrm{believes} \left[\mathrm{SN},{ \mathrm{C}}_2, \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}\right]$	$\mathrm{By} \left(\mathrm{D}41\right), \left(\mathrm{A}21\right), \mathrm{NV}, \mathrm{FR}$
  $\left(\mathrm{D}43\right)$	$\mathrm{D} \mathrm{believes} \mathrm{I} \mathrm{believes} \mathrm{I}\stackrel{{\mathrm{K}}_{\mathrm{r}}}{\leftrightarrow }\mathrm{D}$	$\mathrm{By} \left(\mathrm{D}42\right), \mathrm{BC}$
  $\left(\mathrm{D}44\right)$	$\mathrm{S} \mathrm{sees} \langle \mathrm{CMD},{ \mathrm{ID}}_{\mathrm{I}},{\mathrm{TS}}_7, \mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}\rangle {}_{\mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}}$	$\left(\mathrm{I}8\right)$
  $\left(\mathrm{D}45\right)$	$\mathrm{S} \mathrm{believes} \mathrm{I} \mathrm{said} \left[\mathrm{CMD},{ \mathrm{ID}}_{\mathrm{I}},{\mathrm{TS}}_7, \mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}\right]$	$\mathrm{By} \left(\mathrm{D}44\right), \left(\mathrm{A}22\right), \mathrm{MM}$
  $\left(\mathrm{D}46\right)$	$\mathrm{S} \mathrm{believes} \mathrm{I} \mathrm{belives} \left[\mathrm{CMD},{ \mathrm{ID}}_{\mathrm{I}},{\mathrm{TS}}_7, \mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}\right]$	$\mathrm{By} \left(\mathrm{D}45\right), \left(\mathrm{A}23\right), \mathrm{NV}, \mathrm{FR}$
  $\left(\mathrm{D}47\right)$	$\mathrm{S} \mathrm{believes} \mathrm{I} \mathrm{belives} \mathrm{S}\stackrel{{\mathrm{K}}_{\mathrm{i}}}{\leftrightarrow }\mathrm{I}$	$\mathrm{By} \left(\mathrm{D}46\right), \mathrm{BC}$

• AVISPA-based formal security analysis result.

  Figure 9. AVISPA result of Chi et al.’s protocol.

  Figure 9. AVISPA result of Chi et al.’s protocol.

4.3.4. Parvez et al.’s Protocol

The proposed authentication scheme [26] extended the protocol in [45] that comprises of sensors, which are resource-constrained devices that are implanted in (or wearable on) human body; mobile devices, which are small handheld devices to collect the data sent by the sensors; gateway, which is a trusted server that is used to register sensors, mobile devices and medical experts, and generates different keys for secure communication; and medical experts refers to medical professionals, such as doctors or nurses who analyze and take action with the collected information. The proposed protocol is executed in two phases—registration and authentication—as shown in Figure 10 and Figure 11 illustrates the OFMC and CL-AtSe back-end results of the protocol.

• BAN logic-based formal security analysis.

  ●    Idealization
  (I1)	$\mathrm{ME}\to \mathrm{GW}:\langle { \mathrm{M}}_{\mathrm{id}},\mathrm{nonce},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},{\mathrm{t}}_1\rangle {}_{\mathrm{GW}\stackrel{{\mathrm{K}}_{\mathrm{l}}}{\leftrightarrow }\mathrm{ME}},\langle {\mathrm{M}}_{\mathrm{id}},{ \mathrm{ID}}_{\mathrm{gw}}\rangle {}_{\mathrm{GW}\stackrel{{\mathrm{K}}_{\mathrm{j}}}{\leftrightarrow }\mathrm{ME}}$
  (I2)	$\mathrm{GW}\to \mathrm{MD}:\langle { \mathrm{M}}_{\mathrm{id}},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},\mathrm{nonce},{\mathrm{t}}_3\rangle {}_{\mathrm{GW}\stackrel{{\mathrm{K}}_{\mathrm{GW}-\mathrm{U}}}{\leftrightarrow }\mathrm{MD}}$
  (I3)	$\mathrm{MD}\to \mathrm{IMD}:\langle { \mathrm{M}}_{\mathrm{id}},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},\mathrm{nonce},{\mathrm{t}}_5\rangle {}_{\mathrm{MD}\stackrel{{\mathrm{K}}_{\mathrm{U}-{\mathrm{SN}}_{\mathrm{j}}}}{\leftrightarrow }\mathrm{IMD}}$
  (I4)	$\mathrm{IMD}\to \mathrm{ME}:\langle { \mathrm{SN}}_{\mathrm{j}},{\mathrm{M}}_{\mathrm{id}}, \mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME},{\mathrm{t}}_7\rangle {}_{\mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME}}$

  Figure 10. Parvez et al.’s protocol. (a) Registration procedure. (b) Authentication Procedure.

  Figure 10. Parvez et al.’s protocol. (a) Registration procedure. (b) Authentication Procedure.

  ●    Assumption
  (A1)	$\mathrm{GW} \mathrm{believes} \mathrm{GW}\stackrel{{\mathrm{K}}_{\mathrm{l}}}{\leftrightarrow }\mathrm{ME}$
  (A2)	$\mathrm{GW} \mathrm{believes} \mathrm{fresh}\left({\mathrm{t}}_1\right)$
  (A3)	$\mathrm{GW} \mathrm{believes} \mathrm{ME} \mathrm{Controls} \mathrm{nonce}$
  (A4)	$\mathrm{MD} \mathrm{believes} \mathrm{GW}\stackrel{{\mathrm{K}}_{\mathrm{GW}-\mathrm{U}}}{\leftrightarrow }\mathrm{MD}$
  (A5)	$\mathrm{MD} \mathrm{believes} \mathrm{fresh}\left({\mathrm{t}}_3\right)$
  (A6)	${\mathrm{MD} \mathrm{believes} \mathrm{GW} \mathrm{Controls} \mathrm{SN}}_{\mathrm{j}}$
  (A7)	${\mathrm{MD} \mathrm{believes} \mathrm{GW} \mathrm{Controls} \mathrm{M}}_{\mathrm{id}}$
  (A8)	$\mathrm{IMD} \mathrm{believes} \mathrm{MD}\stackrel{{\mathrm{K}}_{\mathrm{U}-{\mathrm{SN}}_{\mathrm{j}}}}{\leftrightarrow }\mathrm{IMD}$
  (A9)	$\mathrm{IMD} \mathrm{believes} \mathrm{fresh}\left({\mathrm{t}}_5\right)$
  (A10)	${\mathrm{ME} \mathrm{believes} \mathrm{SN}}_{\mathrm{j}}$
  (A11)	$\mathrm{ME} \mathrm{believes} \mathrm{nonce}$
  (A12)	${\mathrm{ME} \mathrm{believes} \mathrm{M}}_{\mathrm{id}}$
  (A13)	$\mathrm{ME} \mathrm{believes} \mathrm{fresh}\left({\mathrm{t}}_7\right)$
  (A14)	${\mathrm{ME} \mathrm{believes} \mathrm{IMD} \mathrm{Controls} \mathrm{K}}_{\mathrm{ssk}}$
  ●    Goals
  (G1)	$\mathrm{GW} \mathrm{believes} \mathrm{nonce}$
  (G2)	${\mathrm{MD} \mathrm{believes} \mathrm{SN}}_{\mathrm{j}}$
  (G3)	${\mathrm{MD} \mathrm{believes} \mathrm{M}}_{\mathrm{id}}$
  (G4)	$\mathrm{ME} \mathrm{believes} \mathrm{IMD} \mathrm{believes} \mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME}$
  (G5)	$\mathrm{IMD} \mathrm{believes} \mathrm{ME} \mathrm{believes} \mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME}$
  (G6)	$\mathrm{IMD} \mathrm{believes} \mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME}$
  ●    Derivations
  (D1)	${\mathrm{GW} \mathrm{sees} \langle \mathrm{M}{}^{\prime }}_{\mathrm{id}},\mathrm{nonce},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},{\mathrm{t}}_1\rangle {}_{\mathrm{GW}\stackrel{{\mathrm{K}}_{\mathrm{l}}}{\leftrightarrow }\mathrm{ME}}$	$\mathrm{By} \left(\mathrm{I}1\right),\mathrm{DR}$
  (D2)	$\mathrm{GW} \mathrm{believes} \mathrm{ME} \mathrm{said} \left[{\mathrm{M}{}^{\prime }}_{\mathrm{id}},\mathrm{nonce},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},{\mathrm{t}}_1\right]$	$\mathrm{By} \left(\mathrm{D}1\right),\left(\mathrm{A}1\right),\mathrm{MM}$
  (D3)	$\mathrm{GW} \mathrm{believes} \mathrm{ME} \mathrm{believes} \left[{\mathrm{M}{}^{\prime }}_{\mathrm{id}},\mathrm{nonce},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},{\mathrm{t}}_1\right]$	$\mathrm{By} \left(\mathrm{D}2\right),\left(\mathrm{A}2\right),\mathrm{NV}, \mathrm{FR}$
  (D4)	$\mathrm{GW} \mathrm{believes} \mathrm{ME} \mathrm{believes} \mathrm{nonce}$	$\mathrm{By} \left(\mathrm{D}3\right),\mathrm{BC}$
  (D5)	$\mathrm{GW} \mathrm{believes} \mathrm{nonce}$	$\mathrm{By} \left(\mathrm{D}4\right),\left(\mathrm{A}3\right),\mathrm{JR}$
  (D6)	${\mathrm{MD} \mathrm{sees} \langle \mathrm{M}}_{\mathrm{id}},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},\mathrm{nonce},{\mathrm{t}}_3\rangle {}_{\mathrm{GW}\stackrel{{\mathrm{K}}_{\mathrm{GW}-\mathrm{U}}}{\leftrightarrow }\mathrm{MD}}$	(I2)
  (D7)	$\mathrm{MD} \mathrm{believes} \mathrm{GW} \mathrm{said} \left[{\mathrm{M}}_{\mathrm{id}},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},\mathrm{nonce},{\mathrm{t}}_3\right]$	$\mathrm{By} \left(\mathrm{D}6\right), \left(\mathrm{A}4\right), \mathrm{MM}$
  (D8)	$\mathrm{MD} \mathrm{believes} \mathrm{GW} \mathrm{believes} \left[{\mathrm{M}}_{\mathrm{id}},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},\mathrm{nonce},{\mathrm{t}}_3\right]$	$\mathrm{By} \left(\mathrm{D}7\right), \left(\mathrm{A}5\right), \mathrm{NV}, \mathrm{FR}$
  (D9)	${\mathrm{MD} \mathrm{believes} \mathrm{GW} \mathrm{believes} \mathrm{SN}}_{\mathrm{j}}$	$\mathrm{By} \left(\mathrm{D}8\right), \mathrm{BC}$
  (D10)	${\mathrm{MD} \mathrm{believes} \mathrm{SN}}_{\mathrm{j}}$	$\mathrm{By} \left(\mathrm{D}9\right),\left(\mathrm{A}6\right),\mathrm{JR}$
  (D11)	${\mathrm{MD} \mathrm{believes} \mathrm{GW} \mathrm{believes} \mathrm{M}}_{\mathrm{id}}$	$\mathrm{By} \left(\mathrm{D}8\right), \mathrm{BC}$
  (D12)	${\mathrm{MD} \mathrm{believes} \mathrm{M}}_{\mathrm{id}}$	$\mathrm{By} \left(\mathrm{D}11\right),\left(\mathrm{A}7\right),\mathrm{JR}$
  (D13)	${\mathrm{IMD} \mathrm{sees} \langle \mathrm{M}}_{\mathrm{id}},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},\mathrm{nonce},{\mathrm{t}}_5\rangle {}_{\mathrm{MD}\stackrel{{\mathrm{K}}_{\mathrm{U}-{\mathrm{SN}}_{\mathrm{j}}}}{\leftrightarrow }\mathrm{IMD}}$	$\left(\mathrm{I}3\right)$.
  (D14)	$\mathrm{IMD} \mathrm{believes} \mathrm{MD} \mathrm{said} \left[{\mathrm{M}}_{\mathrm{id}},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},\mathrm{nonce},{\mathrm{t}}_5\right]$	$\mathrm{By} \left(\mathrm{D}13\right), \left(\mathrm{A}8\right), \mathrm{MM}$
  (D15)	$\mathrm{IMD} \mathrm{believes} \mathrm{MD} \mathrm{belives} \left[{\mathrm{M}}_{\mathrm{id}},{ \mathrm{U}}_{\mathrm{i}},{\mathrm{SN}}_{\mathrm{j}},\mathrm{nonce},{\mathrm{t}}_5\right]$	$\mathrm{By} \left(\mathrm{D}14\right), \left(\mathrm{A}9\right), \mathrm{NV}, \mathrm{FR}$
  (D16)	${\mathrm{IMD} \mathrm{believes} \mathrm{MD} \mathrm{believes} \mathrm{M}}_{\mathrm{id}}$	$\mathrm{By} \left(\mathrm{D}15\right), \mathrm{BC}$
  (D17)	$\mathrm{IMD} \mathrm{believes} \mathrm{MD} \mathrm{believes} \mathrm{nonce}$	$\mathrm{By} \left(\mathrm{D}15\right), \mathrm{BC}$
  (D18)	${\mathrm{ME} \mathrm{sees} \langle \mathrm{SN}}_{\mathrm{j}},{\mathrm{M}}_{\mathrm{id}}, \mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME},{\mathrm{t}}_7\rangle {}_{\mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME}}$	$\mathrm{By} \left(\mathrm{I}4\right)$
  (D19)	$\mathrm{ME} \mathrm{believes} \mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME}$	$\mathrm{By} \left(\mathrm{A}10\right),\left(\mathrm{A}11\right),\left(\mathrm{A}12\right), \mathrm{BC}$
  (D20)	$\mathrm{ME} \mathrm{believes} \mathrm{IMD} \mathrm{said} \left[{\mathrm{SN}}_{\mathrm{j}},{\mathrm{M}}_{\mathrm{id}}, \mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME},{\mathrm{t}}_7\right]$	$\mathrm{By} \left(\mathrm{D}18\right), \left(\mathrm{D}19\right), \mathrm{MM}$
  (D21)	$\mathrm{ME} \mathrm{believes} \mathrm{IMD} \mathrm{belives} \left[{\mathrm{SN}}_{\mathrm{j}},{\mathrm{M}}_{\mathrm{id}}, \mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME},{\mathrm{t}}_7\right]$	$\mathrm{By} \left(\mathrm{D}20\right), \left(\mathrm{A}13\right), \mathrm{NV}, \mathrm{FR}$
  (D22)	$\mathrm{ME} \mathrm{believes} \mathrm{IMD} \mathrm{believes} \mathrm{IMD}\stackrel{{\mathrm{K}}_{\mathrm{ssk}}}{\leftrightarrow }\mathrm{ME}$	$\mathrm{By} \left(\mathrm{D}21\right), \mathrm{BC}$

• AVISPA-based formal security analysis result.

  Figure 11. AVISPA result of Parvez et al.’s protocol.

  Figure 11. AVISPA result of Parvez et al.’s protocol.

4.3.5. Iqbal et al.’s Protocol

The proposed protocol [27] works between the sensor nodes (SN), controller (BS), and a medical server (MS). The SNs are (implanted) medical devices that sense vital physiological information. In this protocol, a BS is only used to assist the authentication process so that the SN directly communicates with the MS after successful authentication is achieved. The protocol is executed in three stages: deployment, authentication, and data communication, as shown in Figure 12 and Figure 13 presents the OFMC and CL-AtSe back-end results of the protocol.

• BAN logic-based formal security analysis

  ●    Idealization
  (I1)	$\mathrm{SN}\to \mathrm{BS}: {\left\{\mathrm{Nonce},\mathrm{SK},{\mathrm{ID}}_{\mathrm{i}}\right\}}_{{\mathrm{M}}_{\mathrm{sk}}}$
  (I2)	$\mathrm{BS}\to \mathrm{SN}: {\left\{\mathrm{Nonce}\right\}}_{\mathrm{SK}}$
  (I3)	$\mathrm{SN}\to \mathrm{MS}: {\left\{\mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{MS}\right\}}_{{\mathrm{M}}_{\mathrm{sk}}}$
  (I4)	$\mathrm{SN}\to \mathrm{MS}: {\left\{\mathrm{M}\right\}}_{\mathrm{SK}}$
  ●    Assumption
  (A1)	$\mathrm{BS} \mathrm{believes} \mathrm{SN}\stackrel{{\mathrm{M}}_{\mathrm{sk}}}{\leftrightarrow }\mathrm{BS}$
  (A2)	$\mathrm{BS} \mathrm{believes} \mathrm{fresh}\left(\mathrm{Nonce}\right)$
  (A3)	$\mathrm{BS} \mathrm{believes} \mathrm{SN} \mathrm{Controls} \mathrm{SK}$
  (A4)	$\mathrm{SN} \mathrm{believes} \mathrm{SK}$
  (A5)	$\mathrm{SN} \mathrm{believes} \mathrm{fresh}\left(\mathrm{Nonce}\right)$
  (A6)	$\mathrm{MS} \mathrm{believes} \mathrm{MS}\stackrel{{\mathrm{M}}_{\mathrm{sk}}}{\leftrightarrow }\mathrm{SN}$
  ●    Hypotheses
  (H1)	$\mathrm{MS} \mathrm{believes} \mathrm{fresh}\left(\mathrm{MS}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{BS}\right)$
  (H2)	$\mathrm{MS} \mathrm{believes} \mathrm{SN} \mathrm{Controls} \mathrm{MS}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{BS}$
  ●    Goals
  (G1)	$\mathrm{BS} \mathrm{believes} \mathrm{SN} \mathrm{believes} \mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{BS}$
  (G2)	$\mathrm{BS} \mathrm{believes} \mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{BS}$
  (G3)	$\mathrm{SN} \mathrm{believes} \mathrm{BS} \mathrm{believes} \mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{BS}$
  (G4)	$\mathrm{MS} \mathrm{believes} \mathrm{SN} \mathrm{believes} \mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{MS}$
  (G5)	$\mathrm{MS} \mathrm{believes} \mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{MS}$
  ●    Derivations
  (D1)	$\mathrm{BS} \mathrm{sees} \langle \mathrm{Nonce},\mathrm{SK},{ \mathrm{ID}}_{\mathrm{i}}\rangle {}_{{\mathrm{M}}_{\mathrm{SK}}}$	$\left(\mathrm{I}1\right)$
  (D2)	$\mathrm{BS} \mathrm{believes} \mathrm{SN} \mathrm{said} \left[\mathrm{Nonce},\mathrm{SK},{ \mathrm{ID}}_{\mathrm{i}}\right]$	$\mathrm{By} \left(\mathrm{D}1\right),\left(\mathrm{A}1\right),\mathrm{MM}$
  (D3)	$\mathrm{BS} \mathrm{believes} \mathrm{SN} \mathrm{believes} \left[\mathrm{Nonce},\mathrm{SK},{ \mathrm{ID}}_{\mathrm{i}}\right]$	$\mathrm{By} \left(\mathrm{D}2\right),\left(\mathrm{A}2\right),\mathrm{NV}, \mathrm{FR}$
  (D4)	$\mathrm{BS} \mathrm{believes} \mathrm{SN} \mathrm{believes} \mathrm{SK}$	$\mathrm{By} \left(\mathrm{D}3\right),\mathrm{BC}$
  (D5)	$\mathrm{BS} \mathrm{believes} \mathrm{SK}$	$\mathrm{By} \left(\mathrm{D}4\right),\left(\mathrm{A}3\right), \mathrm{JR}$
  (D6)	$\mathrm{SN} \mathrm{sees} \langle \mathrm{Nonce},\mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{BS}\rangle {}_{\mathrm{SK}}$	(I2)
  (D7)	$\mathrm{SN} \mathrm{believes} \mathrm{BS} \mathrm{said} \left[\mathrm{Nonce},\mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{BS}\right]$	$\mathrm{By} \left(\mathrm{D}6\right),\left(\mathrm{A}4\right),\mathrm{MM}$
  (D8)	$\mathrm{SN} \mathrm{believes} \mathrm{BS} \mathrm{believes} \mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{BS}$	$\mathrm{By} \left(\mathrm{D}7\right),\left(\mathrm{A}5\right),\mathrm{NV}$, FR, BC
  (D9)	$\mathrm{MS} \mathrm{sees} \langle \mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{MS}\rangle {}_{{\mathrm{M}}_{\mathrm{SK}}}$	$\left(\mathrm{I}3\right)$
  (D10)	$\mathrm{MS} \mathrm{believes} \mathrm{SN} \mathrm{said} \left[\mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{MS}\right]$	$\mathrm{By} \left(\mathrm{D}9\right),\left(\mathrm{A}6\right),\mathrm{MM}$
  (D11)	$\mathrm{MS} \mathrm{believes} \mathrm{SN} \mathrm{believes} \mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{BS}$	$\mathrm{By} \left(\mathrm{D}10\right),\left(\mathrm{H}1\right),\mathrm{NV}$, FR
  (D12)	$\mathrm{MS} \mathrm{believes} \mathrm{SN}\stackrel{\mathrm{SK}}{\leftrightarrow }\mathrm{BS}$	By (D10), (H2), JR

• AVISPA-based formal security analysis result.

  Figure 13. AVISPA result of Iqbal et al.’s protocol.

  Figure 13. AVISPA result of Iqbal et al.’s protocol.

4.3.6. He and Zeadally’s Protocol

He and Zeadally’s authentication protocol [28] comprises a programmer/controller, the AAL server, and a user. The controller is responsible for communicating with the IMDs and receiving collected physiological information. Once such information is collected, it can be accessed by a remote user after the AAL server authenticates the user. Furthermore, the controller may communicate with different devices, such as home robots for immediate nearby assistance, located in the patient’s premises. The protocol is also executed in two stages: registration and authentication, as shown in Figure 14 and Figure 15 illustrates the OFMC and CL-AtSe back-end results of the protocol.

• BAN logic-based formal security analysis.

  ●    Idealization
  (I1)	$\mathrm{U}\to \mathrm{A}: {\left\{{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U},{\mathrm{TS}}_{\mathrm{U}},\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\right\}}_{\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}}\langle \stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U},{\mathrm{TS}}_{\mathrm{U}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\rangle {}_{\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}}$
  (I2)	$\mathrm{A}\to \mathrm{C}: {\left\{{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U},{\mathrm{TS}}_{{\mathrm{A}}_1},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}\right\}}_{\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}}$
  (I3)	$\mathrm{C}\to \mathrm{A}: {\left\{{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{C}}}{\to }\mathrm{C},{\mathrm{TS}}_{\mathrm{C}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}\right\}}_{\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}}$
  (I4)	$\mathrm{A}\to \mathrm{U}: {\left\{{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{C}}}{\to }\mathrm{C},{\mathrm{TS}}_{{\mathrm{A}}_2},\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\right\}}_{\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}}$
  ●    Assumption
  (A1)	$\mathrm{A} \mathrm{believes} \mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$
  (A2)	$\mathrm{A} \mathrm{believes} \#\left({\mathrm{TS}}_{\mathrm{U}}\right)$
  (A3)	$\mathrm{A} \mathrm{believes} \stackrel{{\mathrm{Q}}_{\mathrm{A}}}{\to }\mathrm{A}$
  (A4)	$\mathrm{C} \mathrm{believes} \mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}$
  (A5)	$\mathrm{C} \mathrm{believes} \#\left({\mathrm{TS}}_{{\mathrm{A}}_1}\right)$
  (A6)	$\mathrm{C} \mathrm{believes} \stackrel{{\mathrm{Q}}_{\mathrm{C}}}{\to }\mathrm{C}$
  (A7)	$\mathrm{A} \mathrm{believes}\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}$
  (A8)	$\mathrm{A} \mathrm{believes} \#\left({\mathrm{TS}}_{\mathrm{C}}\right)$
  (A9)	$\mathrm{U} \mathrm{believes} \mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$
  (A10)	$\mathrm{U} \mathrm{believes} \#\left({\mathrm{TS}}_{{\mathrm{A}}_2}\right)$
  (A11)	$\mathrm{U} \mathrm{believes} \stackrel{{\mathrm{Q}}_{\mathrm{U}}}{\to }\mathrm{U}$

  Figure 14. He and Zeadally’s protocol. (a) Registration phase. (b) Authentication phase.

  Figure 14. He and Zeadally’s protocol. (a) Registration phase. (b) Authentication phase.

  ●    Hypotheses
  (H1)	$\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{Controls}\stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U}$
  ●    Goals
  (G1)	$\mathrm{A} \mathrm{believes} \mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$
  (G2)	$\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{believes} \mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$
  (G3)	${\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{believes} \mathrm{ID}}_{\mathrm{U}}$
  (G4)	$\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{believes} \mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$
  (G5)	${\mathrm{C} \mathrm{believes} \mathrm{A} \mathrm{believes} \mathrm{ID}}_{\mathrm{U}}$
  (G6)	$\mathrm{C} \mathrm{believes} \mathrm{C}\stackrel{{\mathrm{SK}}_{\mathrm{C}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$
  (G7)	$\mathrm{C} \mathrm{believes} \mathrm{A} \mathrm{believes} \mathrm{C}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{A}$
  (G8)	${\mathrm{A} \mathrm{believes} \mathrm{C} \mathrm{believes} \mathrm{ID}}_{\mathrm{C}}$
  (G9)	$\mathrm{A} \mathrm{believes} \mathrm{C} \mathrm{believes} \mathrm{C}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{A}$
  (G10)	${\mathrm{U} \mathrm{believes} \mathrm{A} \mathrm{believes} \mathrm{ID}}_{\mathrm{C}}$
  (G11)	$\mathrm{U} \mathrm{believes} \mathrm{C}\stackrel{{\mathrm{SK}}_{\mathrm{C}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$
  (G12)	$\mathrm{U} \mathrm{believes} \mathrm{A} \mathrm{believes} \mathrm{U}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{A}$
  ●    Derivations
  (D1)	${\mathrm{A} \mathrm{sees} \langle \mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},{\mathrm{TS}}_{\mathrm{U}},\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\rangle {}_{\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}}$, $\langle \stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U},{\mathrm{TS}}_{\mathrm{U}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\rangle {}_{\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}}$	$\left(\mathrm{I}1\right)$
  (D2)	$\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{said} \left[\stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U},{\mathrm{TS}}_{\mathrm{U}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\right]$	$\mathrm{By} \left(\mathrm{D}1\right),\left(\mathrm{A}1\right),\mathrm{MM}$
  (D3)	$\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{believes} \left[\stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U},{\mathrm{TS}}_{\mathrm{U}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\right]$	$\mathrm{By} \left(\mathrm{D}2\right),\left(\mathrm{A}2\right),\mathrm{FR},\mathrm{NV}$
  (D4)	$\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{believes} \stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U}$	$\mathrm{By} \left(\mathrm{D}3\right),\mathrm{BC}$
  (D5)	$\mathrm{A} \mathrm{believes} \stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U}$	$\mathrm{By} \left(\mathrm{D}4\right),\left(\mathrm{H}1\right), \mathrm{JR}$
  (D6)	$\mathrm{A} \mathrm{believes} \mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$	$\mathrm{By} \left(\mathrm{D}5\right),\left(\mathrm{A}3\right),\mathrm{BC}$
  (D7)	$\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{believes} \mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$	$\mathrm{By} \left(\mathrm{D}3\right),\mathrm{BC}$
  (D8)	$\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{said} \left[{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},{\mathrm{TS}}_{\mathrm{U}},\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\right]$	$\mathrm{By} \left(\mathrm{D}1\right),\left(\mathrm{D}6\right),\mathrm{MM}$
  (D9)	$\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{believes} \left[{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},{\mathrm{TS}}_{\mathrm{U}},\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\right]$	$\mathrm{By} \left(\mathrm{D}8\right),\left(\mathrm{A}2\right),\mathrm{FR},\mathrm{NV}$
  (D10)	${\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{believes} \mathrm{ID}}_{\mathrm{U}}$	$\mathrm{By} \left(\mathrm{D}9\right),\mathrm{BC}$
  (D11)	$\mathrm{A} \mathrm{believes} \mathrm{U} \mathrm{believes} \mathrm{U}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{A}$	$\mathrm{By} \left(\mathrm{D}9\right),\mathrm{BC}$
  (D12)	$\mathrm{C} \mathrm{sees} {\left\{{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U},{\mathrm{TS}}_{\mathrm{A}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}\right\}}_{\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}}$	$\left(\mathrm{I}2\right)$
  (D13)	$\mathrm{C} \mathrm{believes} \mathrm{A} \mathrm{said} \left[{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U},{\mathrm{TS}}_{\mathrm{A}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}\right]$	$\mathrm{By} \left(\mathrm{D}12\right),\left(\mathrm{A}4\right),\mathrm{MM}$
  (D14)	$\mathrm{C} \mathrm{believes} \mathrm{A} \mathrm{believes} \left[{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{U}}}{\to }\mathrm{U},{\mathrm{TS}}_{\mathrm{A}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}\right]$	$\mathrm{By} \left(\mathrm{D}13\right),\left(\mathrm{A}5\right),\mathrm{FR},\mathrm{NV}$
  (D15)	${\mathrm{C} \mathrm{believes} \mathrm{A} \mathrm{believes} \mathrm{ID}}_{\mathrm{U}}$	$\mathrm{By} \left(\mathrm{D}14\right),\mathrm{BC}$
  (D16)	$\mathrm{C} \mathrm{believes} \mathrm{C}\stackrel{{\mathrm{SK}}_{\mathrm{C}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$	By (D13), BC, (A6), DH
  (D17)	$\mathrm{C} \mathrm{believes} \mathrm{A} \mathrm{believes} \mathrm{C}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{A}$	$\mathrm{By} \left(\mathrm{D}14\right),\mathrm{BC}$
  (D18)	$\mathrm{A} \mathrm{sees} {\left\{{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{C}}}{\to }\mathrm{C},{\mathrm{TS}}_{\mathrm{C}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}\right\}}_{\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}}$	$\left(\mathrm{I}3\right)$
  (D19)	$\mathrm{A} \mathrm{believes} \mathrm{C} \mathrm{said} \left[{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{C}}}{\to }\mathrm{C},{\mathrm{TS}}_{\mathrm{C}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}\right]$	$\mathrm{By} \left(\mathrm{D}18\right),\left(\mathrm{A}7\right),\mathrm{MM}$
  (D20)	$\mathrm{A} \mathrm{believes} \mathrm{C} \mathrm{believes} \left[{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{C}}}{\to }\mathrm{C},{\mathrm{TS}}_{\mathrm{C}},\mathrm{A}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{C}\right]$	$\mathrm{By} \left(\mathrm{D}19\right),\left(\mathrm{A}8\right),\mathrm{FR},\mathrm{NV}$
  (D21)	${\mathrm{A} \mathrm{believes} \mathrm{C} \mathrm{believes} \mathrm{ID}}_{\mathrm{C}}$	$\mathrm{By} \left(\mathrm{D}20\right),\mathrm{BC}$
  (D22)	$\mathrm{A} \mathrm{believes} \mathrm{C} \mathrm{believes} \mathrm{C}\stackrel{{\mathrm{K}}_{\mathrm{A}-\mathrm{C}}}{\leftrightarrow }\mathrm{A}$	$\mathrm{By} \left(\mathrm{D}20\right),\mathrm{BC}$
  (D23)	$\mathrm{U} \mathrm{sees} {\left\{{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{C}}}{\to }\mathrm{C},{\mathrm{TS}}_{{\mathrm{A}}_2},\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\right\}}_{\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}}$	$\left(\mathrm{I}4\right)$
  (D24)	$\mathrm{U} \mathrm{believes} \mathrm{A} \mathrm{said} \left[{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{C}}}{\to }\mathrm{C},{\mathrm{TS}}_{{\mathrm{A}}_2},\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\right]$	$\mathrm{By} \left(\mathrm{D}23\right),\left(\mathrm{A}9\right),\mathrm{MM}$
  (D25)	$\mathrm{U} \mathrm{believes} \mathrm{A} \mathrm{believes} \left[{\mathrm{ID}}_{\mathrm{U}},{\mathrm{ID}}_{\mathrm{C}},\stackrel{{\mathrm{P}}_{\mathrm{C}}}{\to }\mathrm{C},{\mathrm{TS}}_{{\mathrm{A}}_2},\mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}\right]$	$\mathrm{By} \left(\mathrm{D}24\right),\left(\mathrm{A}10\right),\mathrm{FR},\mathrm{NV}$
  (D26)	${\mathrm{U} \mathrm{believes} \mathrm{A} \mathrm{believes} \mathrm{ID}}_{\mathrm{C}}$	$\mathrm{By} \left(\mathrm{D}25\right),\mathrm{BC}$
  (D27)	$\mathrm{U} \mathrm{believes} \mathrm{C}\stackrel{{\mathrm{SK}}_{\mathrm{C}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$	$\mathrm{By} \left(\mathrm{D}24\right),\mathrm{BC},\left(\mathrm{A}11\right),\mathrm{DH}$
  (D28)	$\mathrm{U} \mathrm{believes} \mathrm{A} \mathrm{believes} \mathrm{A}\stackrel{{\mathrm{TK}}_{\mathrm{A}-\mathrm{U}}}{\leftrightarrow }\mathrm{U}$	$\mathrm{By} \left(\mathrm{D}25\right),\mathrm{BC}$

• AVISPA-based formal security analysis result.

  Figure 15. AVISPA result of He and Zeadally’s protocol.

  Figure 15. AVISPA result of He and Zeadally’s protocol.

4.3.7. Ellouze et al.’s Protocol

This protocol [29] is a mutual authentication protocol for cardiac IMDs that integrates a powerless device called wireless identification and sensing platform (WISP) with IMDs to conserve the battery lifetime of IMDs by drawing energy from an RFID reader. The authentication scheme operates in regular and emergency modes between the WISP and the RFID reader. The final goal is to create mutual authentication between the programmer and the IMD. Figure 16 shows both modes of the protocol. The authors of this protocol performed AVISPA-based security verification and claimed that the protocol is secure. Hence, only BAN logic-based analysis is performed here.

• BAN logic-based formal security analysis.
• Regular mode.

  ●    Idealization
  (I1)	$\mathrm{R}\to \mathrm{W}:\langle { \mathrm{N}}_{\mathrm{R}},{ \mathrm{ID}}_{\mathrm{R}},\mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}}$
  (I2)	$\mathrm{W}\to \mathrm{R}:\langle { \mathrm{N}}_{\mathrm{R}},{ \mathrm{N}}_{\mathrm{W}},{\mathrm{ID}}_{\mathrm{W}},\mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}}$
  (I3)	$\mathrm{R}\to \mathrm{WISP}:\langle { \mathrm{N}}_{\mathrm{W}},{\mathrm{Seq}}_1,\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}}$
  ●    Assumption
  (A1)	$\mathrm{W} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}$
  (A2)	$\mathrm{W} \mathrm{believes} \#\left({\mathrm{N}}_{\mathrm{W}}\right)$
  (A3)	$\mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}$
  (A4)	$\mathrm{R} \mathrm{believes} \#\left({\mathrm{N}}_{\mathrm{R}}\right)$
  ●    Hypotheses
  (H1)	$\mathrm{W} \mathrm{believes} \#\left({\mathrm{N}}_{\mathrm{R}}\right)$
  (H2)	$\mathrm{R} \mathrm{believes} \#\left({\mathrm{N}}_{\mathrm{W}}\right)$
  ●    Goals
  (G1)	${\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{ID}}_{\mathrm{R}}$
  (G2)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}$
  (G3)	$\mathrm{W} \mathrm{believes}\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$
  (G4)	${\mathrm{R} \mathrm{believes} \mathrm{W} \mathrm{believes} \mathrm{ID}}_{\mathrm{W}}$
  (G5)	$\mathrm{R} \mathrm{believes} \mathrm{W} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}$
  (G6)	$\mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$
  (G7)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$
  ●    Derivations
  (D1)	${\mathrm{W} \mathrm{sees} \langle \mathrm{N}}_{\mathrm{R}},{ \mathrm{ID}}_{\mathrm{R}},\mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}}$	$\left(\mathrm{I}1\right)$
  (D2)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{said} \left[{\mathrm{N}}_{\mathrm{R}},{ \mathrm{ID}}_{\mathrm{R}},\mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}\right]$	$\mathrm{By} \left(\mathrm{D}1\right),\left(\mathrm{A}1\right),\mathrm{MM}$
  (D3)	${\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{ID}}_{\mathrm{R}}$	$\mathrm{By} \left(\mathrm{D}2\right),\left(\mathrm{H}1\right),\mathrm{FR},\mathrm{NV}$
  (D4)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}$	$\mathrm{By} \left(\mathrm{D}2\right),\left(\mathrm{H}1\right),\mathrm{FR},\mathrm{NV}$
  (D5)	$\mathrm{W} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$	$\mathrm{By} \left(\mathrm{A}1\right),\left(\mathrm{A}2\right),\mathrm{BC}$
  (D6)	${\mathrm{R} \mathrm{sees} \langle \mathrm{N}}_{\mathrm{R}},{ \mathrm{N}}_{\mathrm{W}},{\mathrm{ID}}_{\mathrm{W}},\mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}}$	(I2)
  (D7)	$\mathrm{R} \mathrm{believes} \mathrm{W} \mathrm{said} \left[{\mathrm{N}}_{\mathrm{R}},{ \mathrm{N}}_{\mathrm{W}},{\mathrm{ID}}_{\mathrm{W}},\mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}\right]$	$\mathrm{By} \left(\mathrm{D}6\right),\left(\mathrm{A}3\right),\mathrm{MM}$
  (D8)	${\mathrm{R} \mathrm{believes} \mathrm{W} \mathrm{believes} \mathrm{ID}}_{\mathrm{W}}$	$\mathrm{By} \left(\mathrm{D}7\right),\left(\mathrm{A}4\right),\mathrm{FR},\mathrm{NV}$
  (D9)	$\mathrm{R} \mathrm{believes} \mathrm{W} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}}{\leftrightarrow }\mathrm{R}$	$\mathrm{By} \left(\mathrm{D}7\right),\left(\mathrm{A}4\right),\mathrm{FR},\mathrm{NV}$
  (D10)	$\mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$	$\mathrm{By} \left(\mathrm{A}3\right),\left(\mathrm{H}2\right),\mathrm{BC}$
  (D11)	${\mathrm{W} \mathrm{sees} \langle \mathrm{N}}_{\mathrm{W}},{\mathrm{Seq}}_1,\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}}$	$\mathrm{By} \left(\mathrm{D}8\right), \mathrm{BC}$
  (D12)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{said} \left[{\mathrm{N}}_{\mathrm{W}},{\mathrm{Seq}}_1,\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}\right]$	$\mathrm{By} \left(\mathrm{D}11\right),\left(\mathrm{D}5\right),\mathrm{MM}$
  (D13)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$	By (D12), (A2), FR, NV

• Emergency Mode

  ●    Idealization
  (I1)	$\mathrm{R}\to \mathrm{W}:\langle \mathrm{Q},{\mathrm{N}}_{\mathrm{R}},{\mathrm{ID}}_{\mathrm{R}},\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}}$
  (I2)	$\mathrm{W}\to \mathrm{R}:\langle { \mathrm{N}}_{\mathrm{R}},{ \mathrm{N}}_{\mathrm{W}},{\mathrm{ID}}_{\mathrm{W}},\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}}$
  (I3)	$\mathrm{R}\to \mathrm{W}:\langle { \mathrm{N}}_{\mathrm{W}},{\mathrm{Seq}}_1,\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}}$

  Figure 16. Ellouze et al.’s protocol. (a) Regular Mode. (b) Emergency Mode.

  Figure 16. Ellouze et al.’s protocol. (a) Regular Mode. (b) Emergency Mode.

  ●    Assumption
  (A1)	$\mathrm{W} \mathrm{believes} \mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}$
  (A2)	$\mathrm{W} \mathrm{believes} \#\left({\mathrm{N}}_{\mathrm{W}}\right)$
  (A3)	$\mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}$
  (A4)	$\mathrm{R} \mathrm{believes} \#\left({\mathrm{N}}_{\mathrm{R}}\right)$
  ●    Hypotheses
  (H1)	$\mathrm{W} \mathrm{believes} \#\left({\mathrm{N}}_{\mathrm{R}}\right)$
  (H2)	$\mathrm{R} \mathrm{believes} \#\left({\mathrm{N}}_{\mathrm{W}}\right)$
  ●    Goals
  (G1)	${\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{ID}}_{\mathrm{R}}$
  (G2)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}$
  (G3)	$\mathrm{W} \mathrm{believes}\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$
  (G4)	${\mathrm{R} \mathrm{believes} \mathrm{W} \mathrm{believes} \mathrm{ID}}_{\mathrm{W}}$
  (G5)	$\mathrm{R} \mathrm{believes} \mathrm{W} \mathrm{believes} \mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}$
  (G6)	$\mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$
  (G7)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$
  ●    Derivations
  (D1)	$\mathrm{W} \mathrm{sees} \langle \mathrm{Q},{\mathrm{N}}_{\mathrm{R}},{\mathrm{ID}}_{\mathrm{R}},\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}}$	$\left(\mathrm{I}1\right)$
  (D2)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{said}$. $\left[\mathrm{Q},{\mathrm{N}}_{\mathrm{R}},{\mathrm{ID}}_{\mathrm{R}},\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}\right]$	$\mathrm{By} \left(\mathrm{D}1\right),\left(\mathrm{A}1\right),\mathrm{MM}$
  (D3)	${\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{ID}}_{\mathrm{R}}$.	$\mathrm{By} \left(\mathrm{D}2\right),\left(\mathrm{H}1\right),\mathrm{FR},\mathrm{NV}$
  (D4)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}$	$\mathrm{By} \left(\mathrm{D}2\right),\left(\mathrm{H}1\right),\mathrm{FR},\mathrm{NV}$
  (D5)	$\mathrm{W} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$	$\mathrm{By} \left(\mathrm{A}1\right),\left(\mathrm{A}2\right),\mathrm{BC}$
  (D6)	${\mathrm{R} \mathrm{sees} \langle \mathrm{N}}_{\mathrm{R}},{ \mathrm{N}}_{\mathrm{W}},{\mathrm{ID}}_{\mathrm{W}},\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}}$	(I2)
  (D7)	$\mathrm{R} \mathrm{believes} \mathrm{W} \mathrm{said}$ $\left[{\mathrm{N}}_{\mathrm{R}},\mathrm{N}\mathrm{W},{\mathrm{ID}}_{\mathrm{W}},\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}\right]$	$\mathrm{By} \left(\mathrm{D}6\right),\left(\mathrm{A}3\right),\mathrm{MM}$
  (D8)	$\mathrm{R} \mathrm{believes} \mathrm{W} \mathrm{believes}$ ${\mathrm{ID}}_{\mathrm{W}}$	$\mathrm{BY} \left(\mathrm{D}7\right),\left(\mathrm{A}4\right),\mathrm{FR},\mathrm{NV}$
  (D9)	$\mathrm{R} \mathrm{believes} \mathrm{W} \mathrm{believes}$ $\mathrm{W}\stackrel{{\mathrm{K}}_{\mathrm{bio}}}{\leftrightarrow }\mathrm{R}$	$\mathrm{By} \left(\mathrm{D}7\right),\left(\mathrm{A}4\right),\mathrm{FR},\mathrm{NV}$
  (D10)	$\mathrm{R} \mathrm{believes} \mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$	$\mathrm{By} \left(\mathrm{A}3\right),\left(\mathrm{H}2\right),\mathrm{BC}$
  (D11)	${\mathrm{W} \mathrm{sees} \langle \mathrm{N}}_{\mathrm{W}},{\mathrm{Seq}}_1,\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}\rangle {}_{\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}}$	(I3)
  (D12)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{said}$ $\left[{\mathrm{N}}_{\mathrm{W}},{\mathrm{Seq}}_1,\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}\right]$	$\mathrm{By} \left(\mathrm{D}11\right),\left(\mathrm{D}5\right),\mathrm{MM}$
  (D13)	$\mathrm{W} \mathrm{believes} \mathrm{R} \mathrm{believes}$ $\mathrm{W}\stackrel{\mathrm{K}‘}{\leftrightarrow }\mathrm{R}$	$\mathrm{By} \left(\mathrm{D}12\right),\left(\mathrm{A}2\right),\mathrm{FR},\mathrm{NV}$

5. Discussion

The authentication protocols described and analyzed in the previous section have shown the importance of formally analyzing security protocols for usage reliability.

Khan et al.’s protocol is safe as per the output of both BAN logic and AVISPA in satisfying the goals. The hub node can be sure about the validity of the temporary identification (G1 and G2) and the auxiliary authentication parameter (G3 and G4). Furthermore, the sensor node trusts the newly generated session key (G6 and G7).

The proxy-assisted access control scheme proposed by Wu et al. is the second safe protocol for the authentication goals set. The main objective of the protocol is to device a shared symmetric key K_t that the programmer and the IMD will use to secure the information exchanged. Accordingly, (G2) to (G5), (G8), and (G9) show that this objective is satisfied. Furthermore, other less essential facts that involve the IDs of the participating agents are authentic.

Chi et al.’s access control scheme with forensic capability is designed to safeguard IMDs from unauthorized access. The protocol is secure as per the results of BAN logic and AVISPA on authenticity and secrecy properties. The goals in the BAN logic analysis investigated the authentication between the IMD, smartphone, and the programmer through the keys K_d, K_r, K_p, and K_i.

The user authentication scheme in WBAN, as proposed by Parvez et al., is found to be unsafe, by both AVISPA and BAN logic, on the authentication of the shared key K_ssk. The shared key that will be used by the medical expert and the IMD is computed from the nonce, SN_j, and M_id. In terms of BAN logic, this means the IMD has to believe these values to believe the computed session key. Consequently, the derivations (D11) to (D13) alone cannot enable the IMD to derive its belief to the shared key- which calls for two new hypotheses about the control of the nonce and M_id by the mobile device that acts as a proxy between the IMD and the external devices. Such hypotheses may not be accurate given that ME and GW generated these values, respectively. However, since the message passed from the MD to the IMD is fresh and protected by the key that both parties trust, we may still be convinced that the IMD can derive the session key. The final goal, (G5), can be derived after a new message arrives from the ME to IMD using the session key K_ssk.

Iqbal et al.’s authentication and key agreement scheme are proposed for node authentication in the body sensor environment. The protocol has some serious issues, typically concerning reply attacks. Specifically, the security goals (G4) and (G5) related to the mutual authentication between the medical server and the IMD cannot be satisfied as-is. The medical server cannot be sure about the freshness of the shared session key forwarded by the base station, making the message vulnerable to replay attack. Consequently, the hypotheses (H1) and (H2) need to be added to maintain authentication. More importantly, it is possible to improve the protocol by including a nonce along with the session key SK when BS sends the message to the MS.

He and Zeadally’s scheme aims to improve the security of ambient assisted living. It mainly focuses on the mutual authentication between the Controller and the User via the AAL server. With this regard, the goals (G3), (G5), (G8), and (G10) refer to the secure information exchange, while (G6) and (G11) specify the secure session key exchange between the User and the Controller. The remaining goals are related to the exchange of symmetric keys among all the participants of the authentication scheme. The result of both the BAN logic and AVISPA illustrate that it is not possible to conclusively state the protocol as safe to use. That is, the derivations show that for the AAL server to believe that TK_A-U is a key that is only known by itself and the User (G1), it must first believe that PU is the public key of the User that is encrypting the messages by the key TK_A-U (G2). This, in turn, needs the AAL server to believe that this User has jurisdiction over the public key PU, meaning that the AAL server has to trust this User concerning PU (H1). Consequently, we cannot prove the goals (G1) and (G2) without the hypothesis we added.

Ellouze et al.’s scheme is a specific authentication protocol proposed for cardiac IMDs with powerless authentication mechanisms. The protocol operates in both emergency and regular modes to authenticate the programmer to the IMD and vice versa. The authors of this protocol have performed AVISPA based formal security analysis and reported that the protocol is safe. However, when the protocol is analyzed using BAN logic, a contrary result is found. The result from the analysis of the BAN logic in the emergency mode of the protocol shows the requirement of two additional hypotheses to satisfy the authentication between the WISP and the RFID Reader. Specifically, the WISP cannot conclusively believe the K_Bio. This key will be used to derive the session key K’ latter if the reader believes it without guaranteeing the freshness of NR. Furthermore, the security goal that conditions the guarantee for the WISP that the RFID Reader believes the session key K’ (G7) can only be satisfied if the freshness of NW is guaranteed. Concerning the regular mode, the same issue exists as shown in the hypotheses (H1) and (H2) for the derivation of (D3), (D4), and (D10).

6. Comparative Analysis

6.1. Comparison by Security Strength

Here, we compare the authentication schemes that are formally analyzed in Section 3. The comparisons are based on security properties, key features that IMD authentication protocols need to possess, computational overhead, and latency. Accordingly, each of the authentication protocols is checked against different security requirements (integrity (INT), confidentiality (CNF), authentication (AUT), session key agreement (SKA), perfect forward secrecy (PFS), and replay attack protection (RAP)) as shown in

Table 3. Comparison by security strength.

Notation	INT	CNF	AUT	SKA	PFS	RAP
Khan et. al	✓	✓	✓	✓	✓	✓
Wu et. al.	✓	✓	✓	✓	✓	✓
Chi et. al.	✓	✓	✓	✓	✓	✓
Parvez et al.	✗	∆	✓	✓	✓	✗
Iqbal et. al.	✗	✗	✓	✓	✗	✗
He and Zeadally	∆	✓	✓	✓	✓	✓
Ellouze et. al.	∆	∆	✓	✓	∆	✓

✓ denotes that the scheme supports a particular requirement; ✗ denotes that the scheme does not support a particular requirement, ∆ denotes calls for the additional assumption.

.

6.2. Comparison by Functionality

Various vital functionalities are expected to be satisfied by authentication protocols, in particular features like emergency authentication (EMA), key update mechanisms (KUM), adaptability (ADP), application (APP), and anonymity (ANO) is used to compare the protocols. The comparison result of the authentication schemes concerning these functionalities is shown in

Table 4. Comparison by functionality.

Notation	EMA	KUM	ADP	APP	ANO
Khan et. al	✗	✗	A	Generic	✓
Wu et. al.	✗	✗	A	Generic	✗
Chi et. al.	✓	✗	A	Generic	✓
Parvez et al.	✗	✗	A	Generic	✓
Iqbal et. al.	✗	✗	A+	Generic	✗
He and Zeadally	✗	✗	A+	Generic	✓
Ellouze et. al.	✓	✗	A-	Specific	✗

✓ denotes that the scheme supports a particular requirement; ✗ denotes that the scheme does not support a particular requirement. A+: Adaptable for the already implanted device, A: adaptable for yet to be implanted but manufactured, A-: difficult to adapt.

.

6.3. Comparison by Computational and Communicational Overhead

The computational and communication overheads, in terms of time, to perform the cryptographic operations (such as the number of signatures, symmetric, and asymmetric key encryption and decryption, hash functions, and XOR operations) [46,47,48], and size of the messages communicated [46,49], respectively, are shown in

Table 5. Approximate computational time in millisecond.

Notation	Meaning	Computational Time
TH	Cryptographic hash function	0.32
TSE	Symmetric encryption	5.6
TSD	Symmetric decryption	5.6
TEM	Elliptic curve point multiplication	63
TAE	Asymmetric encryption	62
TAD	Asymmetric decryption	36
TSIGN	RSA-1024 digital signature	7
TVER	RSA-1024 digital signature verification	~0
TXOR	Bitwise XOR operation	0.32

,

Table 6. Approximate message length in Bits.

Message Type	Message Length
Public key size for an RSA encryption	1024
Length of an RSA Signature	1024
RSA-1024 digital Certificate	602
Elliptic curve point	320
Cryptographic hash function (SHA-1)	160
Key size for AES encryption	128
Identity	32
Timestamp	32
Sequence number	32
Symmetric decryption	32

,

Table 7. Computational overheads of the authentication protocols.

Protocol	Overhead	Time (Milliseconds)
Khan et. al	12TH + 23TXOR	3.84
Wu et. al.	9TH + 3TSE +3TSD + 1TAE +1TAD + 2TSIGN + 2TVER	247.48
Chi et. al.	16TH + 4TSE + 4TSD + 1TAE +1TAD + 2TSIGN + 2TV ER	260.92
Parvez et al.	4TH + 4TSE + 4TSD	46.08
Iqbal et. al.	4TSE + 4TSD	44.80
He and Zeadally.	4TH + 4TSE + 4TSD + 6TEM	148.68
Ellouze et. al.	6TH + 1TSE + 1TSD	13.12

and

Table 8. Communication overheads of the authentication protocols.

Protocol	Roundtrips	Overheads (Bits)
Khan et. al	2	1504
Wu et. al.	6	6554
Chi et. al.	9	7866
Parvez et al.	3.5	2304
Iqbal et. al.	2	1024
He and Zeadally.	3.5	3232
Ellouze et. al.	3	961

. The comparison of protocols concerning computational and communication overheads is depicted in Figure 17.

6.4. Overall Comparison of the Authentication Protocols

The comparison metrics—security strength, functionality, and efficiency—can be collectively used to understand better these schemes regarding security, competence, and capability. Such comparison can be best described in a triangular graph, as shown in Figure 18.

Figure 18 shows that Khan et al.’s scheme is located at the center since the protocol satisfies all the three metrics compared to the other protocols. On the other hand, while Iqbal et al. and Ellouze et al.’s schemes are only good at efficiency, Wu et al.’s and He and Zeadally’s protocols fulfill only security and functionality, respectively. Concerning Chi et al.’s scheme, only functionality and security is satisfied while efficiency is not met. On the other hand, the Parvez et al.’s, satisfy functionality and efficiency while falling short in meeting security.

7. Conclusions

In this research, we studied various IMD-related security and privacy requirements, such as confidentiality, integrity, availability, mutual authentication, non-traceability, user anonymity, session-key agreement, forward and backward secrecy, known attack resistance, device-existence privacy, device-type privacy, specific-device ID privacy, measurement and log privacy, and bearer privacy. Furthermore, we examined some of the well-known threats of IMDs: learning the existence of IMD, eavesdropping on the wireless channel that links the IMDs to the external devices, replay attacks by forwarding exchanged messages at a later time, changing critical settings of the implants by producing new commands, and exhausting the battery life of IMDs to execute denial of service attacks. After studying various IMD-related security and privacy concepts, we have used a formal approach to test the strength of seven contemporary authentication schemes designed to thwart attacks surrounding IMD-enabled systems. Consequently, we formally analyzed these authentication schemes using AVISPA and BAN logic, and compared them against their security strength, computational and communication overheads, and other features. The result analysis indicates that Khan et al. is the lightest and fastest while preserving privacy and satisfying the security properties shown in Table 3. The protocol uses only a cryptographic hash function and a bitwise XOR function, which made its computational and communication overheads lighter. Furthermore, the protocol is adaptable with minimal effort for the already implanted devices and no trouble for the yet-to-be implanted devices. Another important lesson taken from the analysis of the protocols is the necessity of formal security verification before IMD protocols are released for public use. In addition, IMD authentication schemes need to satisfy essential functionalities such as portability and emergency authentication while remaining lightweight. Accordingly, there is an interest to design a new security protocol for IMD-enabled insulin pumps in the future, which will serve as an artificial pancreas for patients in need. While designing such protocols, the authors would like to apply the essential lessons learned during this study. The newly designed protocol should be formally analyzed while satisfying the emergency authentication, adaptability, key update mechanisms, and anonymity requirements. The authors would also put forth an effort to balance these requirements with efficient communication and computational overhead and good attack resistance.