https://orcid.org/0000-0001-9803-5882
Figures
Abstract
Secure data transmission is critical to cloud-based electronic healthcare (e-healthcare) systems. Upon delving into the literature, it becomes clear that several security mechanisms have been developed to ensure the security of exchanged information across patients, physicians, and the cloud server, but they do not resist vulnerabilities such as man-in-the-middle, side-channel, and session key hijacking attacks. These vulnerabilities can seriously compromise the integrity of exchanged medical records. In light of this, the article proposes a cloud-assisted key agreement protocol for the e-healthcare system to enable secure authentication for patient monitoring, enhancing mutual authentication of the participating entities and creating protected session keys for secure open-channel communication. The proposed methodology employs robust and lightweight procedures, including SHA-256 and Elliptic Curve Cryptography (ECC), while considering the challenges of implementing strong security protocols in healthcare systems, such as the need for high performance and low energy consumption. The proof of correctness and robustness of the proposed protocol has been analyzed through the Real-Or-Random (RoR) model, ProVerif verification toolkit, and pragmatic illustration, while the efficiency and efficacy were checked by measuring computation, communication, storage costs, and energy consumption. The result obtained from the security analysis demonstrated that the proposed protocol resisting man-in-the-middle, replay, DoS, traceability/tracking, desynchronization, impersonation, and side channel attacks offers key secrecy, confidentiality, integrity, and authorization. In contrast, the result depicted from the performance analysis section shows that the proposed protocol is 46.99% better in communication, 96.46% in computation, and 53.69% in energy consumption, which is inaugurating its superiority over its competitors. Hence, it is recommended for practical implementation in the real-world cloud-based e-healthcare scenario.
Citation: Keshta I (2025) A cloud-assisted key agreement protocol for the E-healthcare system. PLoS One 20(6): e0322313. https://doi.org/10.1371/journal.pone.0322313
Editor: Arijit Karati, National Sun Yat Sen University, TAIWAN
Received: December 29, 2024; Accepted: March 18, 2025; Published: June 3, 2025
Copyright: © 2025 Ismail Keshta. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Data Availability: All the data is avialbel within the manuscript.
Funding: The author(s) received no specific funding for this work.
Competing interests: The author declared that he has no known competing interest with any entity.
Introduction
The e-healthcare system, a complex, networked structure, demonstrates the power of technology in revolutionizing healthcare delivery. This heterogeneous distributed system, comprising many components, tools, and technologies, collaborates to enhance patient care and health outcomes. With its diverse functions, communication protocols, and data formats, it seamlessly integrates a wide array of hardware, sensors, and software platforms. For example, the system incorporates wearable sensors, mobile devices, cloud servers, and medical databases. The geographical dispersion of the system’s components confirms its versatility. For instance, wearable sensors can collect patient data at home, which can then be transmitted to a local gateway, processed on a cloud server, and accessed by a remote doctor [1]. Cloud computing gives users on-demand access to resources like storage, processing power, and apps because the underlying systems are managed and maintained by cloud service providers (CSPs); this paradigm does away with local hardware or infrastructure requirements [2]. E-healthcare-driven hospitals are reassured by this arrangement, which frees them from the inconvenience of hardware monitoring and maintenance so they can concentrate on using computer resources [3]. Public, private, hybrid, and multi-cloud systems are among the many deployment choices offered by cloud computing, each with unique advantages and factors to consider. Public clouds are accessible to many customers via third-party cloud service providers [4]. Private clouds, on the other hand, can be hosted on-site by a third-party provider or customized just for one company [5]. By combining the benefits of private and public clouds, hybrid clouds allow businesses to benefit from each of their finest features [6]. Multi-cloud settings, on the other hand, use services from several cloud providers, reducing CSP lock-in and increasing efficiency, cost-effectiveness, and dependability [7]. All things considered, cloud computing offers more flexibility, scalability, and cost reductions than traditional physical infrastructure, radically changing how patient and e-healthcare service providers access and use computer power. For instance, cloud-based electronic health records (EHRs) have made patient data more accessible and secure, providing reassurance and confidence in better-informed decisions and improved patient outcomes [8].
For the e-healthcare system services, the integration of cloud computing resources like storage, processing power, and software applications is a powerful tool. It empowers healthcare professionals to improve productivity, connection, and care quality in patient diagnoses. The trust is bolstered by the use of wearable/sensors and IoT technology, which connect with the cloud server to make remote monitoring of sensitive patient signs and health data easier. The cloud-based video conferencing technology further enhances e-healthcare services, enabling physicians to confidently conduct remote consultations with patients and medical professionals. Healthcare companies can harness the power of cloud computing to analyze vast amounts of data, find patterns, and gain insights that guide clinical judgment and enhance patient care. Providers can use cloud platforms to deploy artificial intelligence and machine learning algorithms, empowering them in infection diagnosis, patient outcome prediction, and personalized treatment plans [9]. With the aforementioned importance of the cloud-assisted e-healthcare systems, integrating different technologies utilized by patients and physicians, avoiding large expenditures in physical infrastructure, and scaling their computer resources up or down as needed, cloud computing brings significant efficiency and time-saving benefits. This not only saves money but also eases the workload for all stakeholders, improving resource management [10]. However, the security of records in all participating entities depends on the sound service providers, their strong security protocols, and compliance guidelines to ensure safety against cyber threats, illegal access, and vulnerabilities [11].
Motivation
The existing authentication protocols presented by different researchers from time to time (discussed in detail in the related work section of this article) for cloud-assisted e-healthcare systems either suffered from privacy, anonymity, efficiency, and design issues or failed to resist impersonation, DoS, insider, desynchronization, replay, MITM, and side-channel attacks. Some of these protocols suffer from scalability issues, complexity in implementation, and limited device compatibility challenges, while others are susceptible to specific types of attacks, such as ESL, tracking/traceability attacks, or session key hijacking issues, and some of them have maximum computation due to modular exponentiation.
Furthermore, a robust authentication of all the participating entities must be followed because the cloud-based e-healthcare infrastructure designated for patient health information is extremely sensitive and needs to be protected against abuse, breaches, and unauthorized access. The data sent between sensors, wearables, and IoT devices to the cloud server is susceptible to numerous threats, modifications, and interruptions by adversaries without secure key agreement methods. The inadequacy of current security measures is a pressing issue that demands improvement and innovation. Healthcare professionals, IT security experts, and developers play a crucial role in ensuring the security of said cloud-assisted e-healthcare system, but unfortunately, internet-connected devices (sensors, wearables, or IoT devices) are resource-constrained and lack inadequate security measures to address contemporary threats, and the said service providers occasionally mismanage their security features. It is also necessary to introduce network capabilities in these network-enabled devices, which is needed for a dynamic authentication protocol (like the protocol proposed in this article), but it is too challenging and needs careful consideration and strategic planning, which is often lacking in current cloud service providers. Considering all the aforementioned issues and challenges, there is a need to address the critical security, privacy, and efficiency problems in the exchanged patient-sensitive information by designing a cloud-assisted key agreement protocol in the e-healthcare system that can guarantee to mitigate all the weaknesses discussed above.
Contributions
The contributions of this research are summarized in bullet points, highlighting the innovative application of advanced technologies in developing this new protocol.
- To propose a key-agreement protocol for a cloud-assisted e-healthcare system operating without passwords or user biometrics that has the potential to significantly improve security by eliminating online/offline password guessing, password breaches, and compromised biometric data by utilizing a lightweight and robust cryptographic technique called elliptic curve cryptography (ECC) and a collision-free one-way hash cryptographic function called SHA256 algorithm.
- To comprehensively analyze the proof of correctness and robustness of the proposed key agreement protocol employing the well-known and widely used Real-Or-Random (ROR) model and ProVerif simulation, confirming integrity, secrecy, confidentiality, and reachability of the patient-sensitive information exchanged in a potentially hostile environment.
- To methodologically evaluate the performance metrics of the proposed key agreement scheme using a testbed research method, confirming its effectiveness, strength, and efficacy while considering computation, communication, storage costs, and energy consumption.
- To comparatively analyze the proposed protocol for performance metrics in checking how well it balances with security, the often conflicting aspects of a protocol are frequently ignored in previous studies.
The remainder of the article is organized as follows: in the related works section, the review of existing schemes was discussed, and their pros and cons are presented in the form of a table; in the system architecture section, the role of each participating entity, how it will work and associated aspects were given in textual as well as diagrammatically; in the proposed key agreement scheme section, the solution is presented in three phases, including setup, registration, and authentication. The algorithmic representation has been given for the proposed scenario, emphasizing its practical implications and making the relevance and applicability of the research clear. In the security analysis section, a demonstration regarding the security of the proposed key agreement scheme has been presented both formally using the RoR model and informally through pragmatic discussion. In contrast, in the performance and comparative analysis section, an illustration of the performance metrics in terms of communication, computation, storage, and comparative analysis has been presented, and in the conclusion section, what has been done in this article for easy understandability of the readers.
Related works
Cloud computing can offer services to many fields ranging from logistics to e-healthcare systems; however, security is still a major concern that is repeatedly noted in the cloud computing paradigm because numerous vulnerabilities are identified from time to time. In this connection, researchers from different times have proposed numerous security schemes to make the system secure and attractive for all areas, especially health care, where patient-sensitive records are publically exchanged. These proposed security schemes are solutions and the future of e-healthcare security. Lopes et al. [12] proposed a protocol to provide safe and reciprocal device authentication within the system. However, this protocol is vulnerable to a traceability attack because the identity is transmitted openly over a public network channel, through which an attacker can easily trace a legitimate user. Ayub et al. [13] introduced a lightweight authentication protocol for e-health clouds using a three-factor authentication mechanism to guarantee safe access in an IoT-based system, but it has design issues because when a legitimate user desires to update their credentials, it never changes in the succeeding entities. Khan et al. [14] securely authenticated the e-health sector utilizing blockchain technology with the addition of conventional cryptographic techniques, but efficiency is still an issue there, as the computation cost is too high and maximum bandwidth is utilized. Shariq et al. [15] have significantly contributed to cloud computing by devising radio frequency identification (RFID)-based authentication methods, but traceability has not been appropriately tackled, as the patient is traceable through the RFID serial number. Ansari et al. [16] have proposed a privacy-enabled architecture for cloud-based e-healthcare systems, further advancing the field but prone to impersonation and DoS attacks because the secret key and random numbers are too short that adversaries can easily break and reach the sensitive credentials.
Masud et al. [17] made a compelling case for the urgent shift from conventional to cloud-based healthcare. They then proposed a scheme to ensure secure access to electronic healthcare records by employing a key generation function for end-to-end encryption and efficient access to the cloud server, but they failed to examine/scrutinize the proof of correctness and robustness of their scheme. Padmaja et al. [18] addressed the security issues in the cloud computing paradigm by proposing an authentication scheme for patients to avail of medical services in an effective manner. However, due to using the MD5 encryption technique in the device authentication phase, it is inadequate, falling short of providing the robust security necessary for the e-healthcare system, as MD5 is weak against a hash collision attack. Chandrakar et al. [19] concentrated on the design of a cloud-based protocol through a hybrid cryptosystem method to monitor the e-healthcare record and protect patient privacy via mobile phones without attending the hospital. However, their protocol’s performance is excessively high due to the use of bilinear mapping and XOR, making it easy to trace the patient. Deebak et al. [20] presented an intelligent service authentication architecture that uses symmetric cryptography, XOR operations, bilinear pairing, and bio-hashing. Their [20] technique used biometric data for hashing to improve mutual authentication in cloud-based medical systems, but the communication cost is high because of the expansive execution time complexity due to modular exponentiation in paring cryptography.
Chiou et al. [21] presented a cloud-enabled e-healthcare system that offered services to patients in an efficient manner via a telemedicine system, ensuring patient privacy and unlinkability, message authentication, and lower computational costs due to modular exponentiation. However, they did not address the problems of key hijacking, server spoofing, and attacks, and doesn’t preserve patient anonymity, as an adversary on their scheme easily launches an identity-guessing attack. Qadir et al. [22] employed a modular approach in which a registered patient was granted access to medical documents many hospitals do not offer. However, privacy isn’t considered a serious concern, and hence patient privacy is a big issue in the model, underscoring the ethical implications of the their systems. Okikiola et al. [23] focused on identifying an insider threat in the cloud-based system and proposed a methodology that uses watermarking extraction and logging methods employing symmetric encryption/decryption and watermark extraction techniques to identify fraudulent activity in the telemedical information server. However, their model did not take into account record alteration. Benil et al. [24] suggested an elliptic curve aggregate certificateless signing technique for data integrity and secrecy using blockchain technology, but the performance of their hybrid system is too high for practical applications because of the elliptic curve discrete algorithmic problem (ECDLP) and exchange of public key each time require high bandwidth.
Alqarni et al. [25] presented a lightweight authentication system for the resource-constrained healthcare setting and showed that their plan would effectively provide services to deployed devices; however, the second message, which is sent from the gateway node to the sensor node, has an identity in plain text format, which an attacker may discover and use to initiate an insider, tracking threats and create privacy issues to the system. Abbasi et al. [26] offered security architecture for the healthcare system that would allow all involved entities to access associated medical facilities efficiently. Notably, despite its security, this method ensures the reliability of two-party authentication, as the cloud-assisted e-health system needs to be effective and privately deal with every patient and guarantee the confidentiality and security of electronic medical records, which is unfortunately missed in [26]. Resolving security and privacy concerns, [27] said that the cloud-assisted electronic healthcare system should be designed to retrieve electronic medical records as quickly as possible to attract more people towards cloud-equipped healthcare systems. However, their strategy lacks a privacy security feature because the patient preferences, location, and coordinates are easily traceable due to the easy launch of an identity spoofing attack on their scheme. The authors of [28] argued that a cloud-based system is an attractive solution for efficiently exchanging electronic medical records and protecting everyone’s privacy. However, privacy is still an issue in the system due to the inability to adequately protect user credentials while exchanging them over an open channel. The authors in [29] proposed a fog-assisted health data sharing technique, a method that utilizes edge computing to process data closer to the source, which is a safe and efficient method and increases the effectiveness and privacy of patient-sensitive information; however, they failed to verify the dynamic nature of their scheme, because all the credentials are once generated and utilized throughout the process. The author [30] proposed a symmetric-based encryption method for cloud-assisted smart healthcare systems for straightforward, secure data sharing but found it vulnerable to insider, masquerade, and man-in-the-middle attacks because an adversary can easily pick the transmission of the parameter over a public network channel and later act as a malicious user and launches the said attacks. The summary of the critical literature review is demonstrated in Table 1.
In conclusion, various protocols and strategies have been developed for cloud-based e-healthcare to ensure patient-sensitive records’ confidentiality, security, and efficiency, maintain privacy, and securely exchange data amongst all participating entities. These schemes either suffer from impersonation, masquerade, side-channel, traceability attacks having design flaws, or heavyweight due to weather using heavyweight cryptographic algorithms or completed in three to four round trips. Also, these schemes lack privacy, anonymity, or key secrecy features or have outdated data transmission flaws. To cope with these issues and challenges, this research proposes a cloud-assisted key agreement technique for a healthcare system to securely monitor a patient remotely. This study is grounded in the premise that our proposed method, with its focus on maintaining patient privacy, has the potential to significantly impact the e-healthcare industry, providing essential services to patients while supporting healthcare providers and medical professionals.
System architecture
To utilize the e-healthcare system, paramedical staff (including nurses, doctors, physicians, and patients) must first register with the cloud-based platform, in which the registration-related credentials of patient sensors/wearables or IoT devices and paramedical staff mobile devices are stored on a cloud server. This cloud server plays a pivotal role in the system’s architecture, providing a secure environment for all data, including patient and paramedical staff information. Subsequently, patients can contact physicians through the cloud server to receive diagnoses and treatment plans, which minimizes the amount of information transmitted. This enables physicians to swiftly evaluate patients’ physical conditions and provide more effective treatment, ultimately enhancing productivity. The system architecture for the proposed cloud-assisted key agreement scheme, detailed in this section, consists of three entities: the patient, equipped with either internal sensors or wearables for real-time psychological data collection; the cloud server, a central entity responsible for networking and setup, providing a secure environment for both patient and paramedical staff; and the paramedical staff, which can be a physician for real-time patient examination and treatment or a nurse for care. The real-time physiological data is transmitted to the cloud-assisted e-healthcare system, allowing physicians to efficiently access it on their own devices through a cloud data center, as shown in Fig 1.
Patient sensors/wearables (P)
Biosensors, robust tools that merge biology and technology, enable real-time, precise, and portable detection of various analysts. They have revolutionized illness management, patient monitoring, and diagnostics in the medical field. With continuous advancements in data analytics, nanotechnology, and materials science, biosensors are set to become even more critical in the medical field and beyond. By combining a biological component with a physicochemical detector, these sensors assess the presence or quantity of certain compounds, often in real time. They are widely used in diverse fields, including biotechnology, food safety, environmental monitoring, and healthcare. Biosensors play a crucial role in tracking physiological indicators, identifying illnesses, and managing long-term disorders in healthcare [39].
The embedded sensors in the human body are capable of continuous monitoring, collecting and transmitting vital health-related data (physiological vitals) to a cloud data center (server), serving as a key component in healthcare technology. For instance, temperature sensors monitor the body’s standard temperature, while oxygen saturation sensors track blood oxygen levels. Visual sensors evaluate eyesight, and pressure sensors measure the duration of a patient’s breathing or the stress exerted on the central nervous system (CNS) and lower jaw. Additionally, EEG, ECG, and MRI sensors assess the heart and other bodily functions, while ventilator sensors ensure a continuous oxygen supply to patients. These sensors and wearables provide a constant stream of data, ensuring that patient care is continuous and comprehensive [40].
Mobile device (PM)
In the realm of e-healthcare systems, integrating mobile devices with physicians is a transformative strategy that empowers healthcare providers. It enhances healthcare delivery through improved data access, real-time communication, and remote monitoring. This integration allows healthcare providers to improve patient results by leveraging the widespread adoption and advanced capabilities of smartphones, tablets, and other mobile devices. They facilitate physicians for secure data access, real-time monitoring, and enhanced communication, all contributing to improved patient care and operational efficiency.
Cloud server (CS)
A cloud data center/server is an integral part of the e-healthcare system, facilitating all the associated entities (wearables, sensors, IoT, mobile devices, etc.) for storing, managing, and processing healthcare-related matters and applications. It gives patients and healthcare personnel real-time access to affordable services, enabling both groups to monitor health-related concerns instantly. The efficiency of cloud data centers in managing and processing healthcare-related matters ensures that these systems can handle a large volume of data with ease and speed. Additionally, a cloud server offers scalability, privacy, and security to both patient and paramedical staff by playing a crucial role in the e-healthcare ecosystem, delivering timely medical assistance, performing life-saving procedures, and transporting patients to medical facilities. It is trained to provide emergency medical care and support healthcare professionals effectively, provide networking facilities and run the resources efficiently and effectively.
Proposed protocol
This article section presents the proposed cloud-assisted key agreement protocol for e-healthcare. The proposed key agreement protocol consisted of initialization, registration, and key agreement phases, which are explained below. The symbols and notations used for the design of the protocol are presented in Table 2.
Initialization phase
In this phase of the protocol, the cloud server chooses an integer secret number µ∈Zq* over curve point (a, b) ⸦ q, a collision-free one-way hash function h(.), private key s, and produces produced {µ, h(.), Eq(a, b)} public parameters, and s as the secret key.
Registration phase
The registration phase is accomplished in two sub-phases: patient registration (sensor/wearable registration) and physician registration (mobile device registration). The steps of computations performed while registering these entities are explained as follows:
Patient sensor/wearable registration.
First, the patient selects a unique identity IDP, and the system picks a random number N∈Zq* and calculates HPIDP=h(IDP||N). The patient side terminal sends {HIDP, IDP} to the cloud server. When the cloud server receives the {HPIDP, IDP} message, it also selects a random number N∈Zq*, calculates public key KP=N.µ and HP=h(IDP||KP), XP=(N⨁Hp)||s. The system ensures the security of the communication by sending {s, XP, HP, KP} back to the patient terminal, where it is stored in its memory, as shown in Fig 2.
Physician mobile device registration.
Secondly, the paramedical staff/doctor or nurse selects a unique identity IDPM; the app installed in their portable device picks a random number N∈Zq* and calculates HPIDPM=h(IDPM||N). This secure calculation is then sent, along with the original IDPM, to the cloud server. Upon receiving the {HPIDPM, IDPM} message, the cloud server also selects a random number N∈Zq*, calculates public key KP=N.µ and HPM=h(IDP||KP), XPM=(N⨁HpM)||s, and sends {s, XPM, HPM, KP} back. This data is then stored in the cloud server’s memory, as shown in Fig 3.
Authentication and key agreement phase
This is the most crucial phase of the proposed protocol, in which the three participating entities agreed on a single key to alter secure communication. This phase, with its intricate and vital computation steps, is the backbone of the protocol.
Step 01: The patient selects identity, chooses a random number, calculates XPM=(N. µ)||T1 and sends {KP, HPIDPM, XPM, T1} towards the physician. The physician, after verifying the time T1-Tc≤∆T, calculates KP=XPM⨁h(HPIDPM||KPM), YP=(XPM||(XPM⨁N)||KP), and sends {HPIDP, KP, YP, T2} message towards the cloud server, a crucial component in this distributed protocol.
Step 02: The cloud server when receiving {HPIDP, KP, YP, T2} parameters, checks T2-Tc≤∆T, calculates KP*=XPM⨁h(HPIDPM||KPM), confirm KP*?=KP, compute YP*=(XPM||(XPM⨁N)||KP), verify YP*?=YP calculate the session key SK=h(YP||KP), RP=h(SK||XPM), and sends {KP*, YP*, RP, T3} message back to the physician/doctor/nurse.
Step 03: They too verify Check: T3-Tc≤∆T, calculates KP**=XPM⨁h(HPIDPM||XPM), verifies KP**?=KP* compute YP**=(XPM||(XPM⨁N)||KP), validate YP**?=YP*, calculates the session key SK=h(YP||KP), RP*=h(SK||XPM), confirms RP*?=RP and sends {KP**, YP**, RP*, T4} message to the patient.
Step 04: The patient when receiving {KP**, YP**, RP*, T4} message, validates Check: T4-Tc≤∆T, computes KP***=XPM⨁h(HPIDPM||XPM), confirm KP***?=KP** calculates YP***=(XPM||(XPM⨁N)||KP), verifies YP***?=YP** computes the session key SK=h(YP||KP), RP**=h(SK||XPM), verifies RP**?=RP* and keeps SK as session key as shown in Fig 4.
A thorough algorithmic description of the suggested key agreement protocol has been explicitly established, and the Python programming language has been used to implement it. A careful evaluation of the cryptographic key produced by this implementation has shown that the protocol is resilient to various security risks, such as insider threats, forgery attacks, and session key hijacking attacks. The protocol’s remarkable effectiveness in addressing these vulnerabilities underscores its suitability for safe communication in the cloud computing paradigm. The session secret key generated is shown below while the algorithmic representation is shown in Fig 5.
Security analysis
This section thoroughly analyzes the proposed key agreement protocol. We use both formal techniques, such as the Real-Or-Random model [41,42] and [43], and ProVerif [44] validation, and informal methods, including discussion and illustrations. This comprehensive analysis demonstrates the correctness of the proposed cloud-assisted protocol, which we describe in detail below.
RoR analysis
The RoR model is applied to the suggested technique in this study. In cryptography, ROR [41]-[42] is an idealized hypothesis model used to evaluate the security of algorithms and protocols. Formal models and strict mathematical reasoning confirm the protocol’s security. P, PM, and CS are the three entities that actively participate with one another in this paradigm. Suppose means the ith instance of the patient over time t1,
means the jth instance of paramedical staff (PM) over time t2, and
means the kth instance of a cloud server (CS) over time interval t3. The establishment of a partnership and the computation of SK are contingent on meeting specific conditions, which we will now discuss in detail:
and
or
and
are in the accepted state
=
means the partnership between P and PM is not empty.
- When the Reveal(.) query is not accepted – it means that the instance is fresh
- The adversary Α performs different queries against the proposed protocol as described as follows:
- Send(
, M): In this query, the adversary Α sends a message M towards
and obtains some output. The adversary Α keeps the received output in his record, which is a crucial step in his reconnaissance and potential future attacks.
- Corrupt(
): The adversary Α meticulously uses this query to corrupt the mobile device with the paramedical staff and extract secret credentials like s, secret tokens, and the ECC key from memory.
- Corrupt(
): The adversary Α employs precise methods in this query to corrupt the embedded sensor or wearable for physiological data collection of the patient’s body and extract the secret credentials, such as s, secret tokens, and ECC-key, from memory.
- Execute(
,
,
): The adversary actively eavesdrops among P, PM, and CS to notice, update, divert the flow, and falsify the publically transmitted credentials.
- Reveal(
): In this query, the adversary Α discloses the session key SK by acting as a man–in–the–middle between P and PM, PM and CS, CS and PM, or PM and P. This could lead to unauthorized access and potential data breaches, highlighting the severity of the threat.
- Test(
): After numerous attempts, the adversary Α tosses a coin. If the output becomes 1, SK is successfully computed; if the output is zero, the adversary failed; however, if it gets nothing, it means a null value (⟘).
- Semantic Security: Suppose W means probability with A in winning a game among a series of games to differentiate among SK and taken under the RoR model. In this regard, adversary A guesses the random number in the Test(.) query. Suppose the guess of A is accurate; then the advantage with A in winning the first game is
For an actual attack, the advantage with A in winning the game is
For passive attack
According to the birthday paradox [35], the probability of hash images is , and random number hash queries are
, then the advantage with A in polynomial time t for the collision of the hash query is
Next, for obtaining the public key, secret key, and point over curve KP
Breaking the ECC-Key, the adversary gets
Upon applying the Test(.) Query: adversary gets
Finally,
The responses from the various queries and semantic security analysis in the Oracle answer, particularly the encryption of the queried message or a randomly chosen string of the same length, consistently demonstrate the robust security of the proposed security protocol. This should reinforce your sense of security, as adversaries cannot break the hash code, random numbers, or ECC key, further protecting the protocol’s security.
ProVerif simulation
This toolkit simulated a man-in-the-middle attack and determined that the proposed protocol fulfills essential security features, including secrecy, authentication, and process equivalencies. It is capable of handling an infinite message space and an unlimited number of sessions. The ProVerif software verification toolkit, a renowned tool in the field, automatically transforms the proposed protocol into Horn clauses (a specific type of logical formula). This renowned software verification tool [44] evaluates the protocol for reachability, session key secrecy, and confidentiality, demonstrating that the attacker cannot gain control of the session key at any stage of the authentication process among the involved entities, as shown in Fig 6.
The code provided includes the definition of two queries, which allows for a thorough examination and the identification of potential loopholes or the simulation of malicious user actions. The above mentioned result summary from this code, a key component of our assessment, demonstrates that the SK remains uncompromised, and an attacker would be unable to exploit it from an open line. This leads to the conclusion that a man-in-the-middle attack, insider attack, forgery attack, and session key hijacking attack are all infeasible on the proposed protocol.
Pragmatic discussion
In this section of the article, the proposed cloud-assisted key agreement protocol will be informally assessed against various well-known attacks. The discussions about these different attacks are as follows:
MITM attack.
Suppose the adversary captures the first transmitted message {KP, HPIDPM, XPM, T1} between P and PM. This message consisted of HPIDP=h(IDP||N), KP= N. µ, and XPM=(N. µ)||T1, which means nothing is open or in plain text format, so the adversary failed to act as a malicious user between P and PM. Now, suppose they capture the second transmitted message {HPIDP, KP, YP, T2} which consisted of HPIDP=h(IDP||N), YP=(XPM||(XPM⨁N)||KP) and KP=XPM⨁h(HPIDPM||KPM) which means nothing is open, all the credentials are not in plain text format, so adversary cannot find anything helpful to act as MITM. Therefore, the proposed protocol resists man-in-the-middle attacks.
Key disclosure attack.
If an attacker captures the SK from the memory of either SN or a mobile device and desires to figure out something useful from it, as SK=h(YP||KP), which means YP=(XPM||(XPM⨁N)||KP) and KP=XPM⨁h(HPIDPM||KPM), they couldn’t find anything useful or in plain text format. Therefore, a key disclosure attack is not possible on the proposed protocol.
Traceability attack.
If the attacker attempts to trace out the patient or physician or the information, due to 160 bits of ECC key, SHA256 hash function, and complex set of calculations, privacy is preserved for all the entities. The physician received {KP, HPIDPM, XPM, T1} message containing HPIDP=h(IDP||N), KP= N. µ, and XPM=(N. µ)||T1, the cloud server receiving {HPIDP, KP, YP, T2} consisted of HPIDP=h(IDP||N), KP=XPM⨁h(HPIDPM||KPM), and YP=(XPM||(XPM⨁N)||KP), and the patient side received {KP**, YP**, RP*, T4} parameters having KP*=XPM⨁h(HPIDPM||KPM), and YP*=(XPM||(XPM⨁N)||KP) which means nothing is concealed to the attacker. So, traceability attacks are not valid for the proposed protocol.
Insider threat.
The sensor node embedded inside the patient body or wearable for other vital collection consisted of {s, XP, HP, KP} parameters; if the illegitimate one attempts to calculate some parameters from it, they will fail because of KP=N.µ and HP=h(IDP||KP), XP=(N⨁Hp)||s so adversary was unable to act as an insider. Similarly, the memory of a mobile device consists of {s, XPM, HPM, KP}, which is a set of complex calculations; again, the adversary cannot act as an insider, and the memory of the cloud server also has nothing in plain text format, so the adversary cannot succeed for launching an insider threat on any of the entity. Therefore, an insider attack on the proposed protocol is not possible.
DoS attack.
The patient side calculates XPM=(N. µ)||T1 and sends {KP, HPIDPM, XPM, T1} before further computation. The doctor-side IoT device or mobile phone verifies the time T1-Tc≤∆T and sends {HPIDP, KP, YP, T2} message towards the cloud server. The cloud server, as the final gatekeeper, verifies the time threshold T2-Tc≤∆T, computes, KP*=XPM⨁h(HPIDPM||KPM), confirms KP*?=KP, YP*=(XPM||(XPM⨁N)||KP), and confirms YP*?=YP to pass to the next step. This crucial role of the cloud server in the verification process ensures the mitigation of both DoS and DDoS attacks, providing a strong sense of reassurance in the proposed protocol’s robustness.
Replay attack.
Verification of time with the current system, along with the parameters KP*?=KP, YP*?=YP in the first round, and KP**?=KP*, YP**?=YP* in the second round, plays a crucial role in the mitigation of replay attacks in the proposed protocol. The system’s refusal to allow replay attacks is further reinforced by the computation steps, SK=h(YP||KP), RP=h(SK||XPM), YP**=(XPM||(XPM⨁N)||KP), KP***=XPM⨁h(HPIDPM||XPM).
Tracking attack.
An attacker’s attempts to track the original identity, keys, or sensitive credentials are futile, even if they manage to obtain valuable information through the public network channel. This is due to our robust security measures, which include using ECC keys and 60-bit random numbers that are dynamically changed after each proposed key agreement protocol round-trip. This approach not only enhances security but also ensures that the patient/physician cannot be tracked by the adversary at any stage of the communication. It’s reassuring that tracking the position of the patient, physician, or cloud server remains secure, thereby providing a high level of trust in the effectiveness of our recommended security measures and showing resilience to a tracking attack.
Desynchronization attack.
The proposed protocol, involving both the sensor and the physician, is designed to handle desynchronization. It is a reliable system that can adapt to various situations and maintain communication. From the physician’s end to the patient, the synchronization characteristics, PKP, and PKMP are modified before being replaced with distinctive features. Even if an insider changes some credentials or floods the cloud server with new credentials, the protocol ensures the communication’s integrity by preserving the available data, maintain the synchrony of shared secret thereby providing a secure environment for communication to all the participating entities in efficient and effective manner.
Performance analysis
In this section of the article, a comprehensive analysis of the proposed protocol’s metrics, including storage, communication, and computation costs, are thoroughly examined. Following this, the proposed key agreement protocol will be compared with the state-of-the-art schemes in terms of communication and computation costs and then measured the energy consumption of it. This meticulous approach ensures the validity and reliability of the proposed key agreement scheme. So, these different analyses are described one by one as follows:
Computation cost analysis
For the implementation of the proposed protocol, the MIRACLE crypto SDK [45] was utilized, employing the C programming language across a diverse range of three devices: the Raspberry Pi 5, which is powered by a Broadcom BCM2712 quad-core Arm Cortex A76 processor running at 2.4GHz; the Samsung Galaxy A05s featuring an octa-core processor (2x2.0 GHz Cortex-A75 & 6x1.8 GHz Cortex-A55) with 6GB of RAM; and a laptop equipped with a Core i7-6500U processor at 2.5 GHz and 16GB of RAM. The execution times for various cryptographic operations, detailed in Table 3, offer valuable insights into the performance capabilities of each device. Notably, the execution time for the Raspberry Pi 5 is considered in the context of a patient’s sensor/wearable device, the Samsung Galaxy A05s serves as the mobile device for paramedical staff, and the Core i7 laptop functions as the cloud server.
So far, for the proposed protocol, the number of multiplication operations is 5TX, the number of addition operations is 8T+ and the number of hash cryptographic operations is 10TH, resulting in a precise computation cost of 5TX + 8T+ + 10TH = 5(1.67) + 8(1.52) + 10(2.47) = 8.35 + 12.16 + 24.7 = 45.21 ms for the sensor/wearable for patient devices. When measured for a doctor, nurse, or paramedical staff device, the cost is =5(0.68) + 8(0.98) + 10(1.11) = 3.4 + 7.84 + 11.1 = 22.34 ms. finally, for the cloud server, the cost is =5(0.91) + 8(0.78) + 10(0.91) = 4.55 + 6.24 + 9.1 = 19.89 ms, as shown in Table 4 and plotted in Fig 7.
Communication cost analysis
The communication cost is basically the bandwidth utilized during the exchange of various parameters and messages in the key agreement phase of the protocol. According to [38,46]the hash function occupies a space of 256 bits because, using the SHA256 algorithm, random numbers are 60-bit, a 64-bit identity, a 160-bit ECC key, and a 32-bit timestamp. So, the first transmitted message {KP, HPIDPM, XPM, T1}, incurs a total cost of 704 bits, calculated as 160 + 256 + 256 + 32 = 704; the second message, {HPIDP, KP, YP, T2}, costs 800 bits, with a breakdown of 256 + 256 + 256 + 32 = 800 bits, and the third message, {KP*, YP*, RP, T3}, also cost 800 bits, following the same breakdown; while, the last message, {KP**, YP**, RP*, T4}, again total 800 bits. The overall communication cost of the proposed protocol is 3104 bits, calculated as 704 + 800 + 800 + 800 = 3104 bits, as highlighted in Table 5 and illustrated in Fig 8.
Storage cost analysis
The memory of the patient sensor stores parameters {s, XP, HP, KP} with a total cost of 64 + 256 + 256 + 160 = 736 bits (according to [46]). The doctor device memory consists of parameters {s, XPM, HPM, KP}, which also amounts to 64 + 256 + 256 + 160 = 736 bits (according to [46]). The cloud server memory includes i) Parameters {s, µ, h(.), Eq(a, b)} with a cost of 64 + 32 + 56 + 256 = 408 bits, ii) Parameters {s, XP, HP, KP} costing 64 + 256 + 256 + 160 = 736 bits, and iii) the parameters {s, XPM, HPM, KP} also costing 64 + 256 + 256 + 160 = 736 bits. The cloud server stores 408 + 736 + 736 = 1880 bits. Thus, the overall storage cost of the proposed protocol is calculated as follows: 736 + 736 + 1880 = 3352 bits, as detailed in Table 6 and illustrated in Fig. 9.
Comparative analysis
When comparing the proposed protocol with Mohit et al. [47], Li et al. [48], Sahoo et al. [49], and Zhou et al. [50] in terms of performance metrics (communication and computation costs), the result in Table 7 provides a comprehensive comparison. It demonstrates that the proposed key agreement protocol is lightweight and robust, as shown diagrammatically in Fig 10, and outperforms the existing protocols in these aspects.
The proposed protocol stands out with its exceptional performance. It is 41.57% better in terms of communication cost than Mohit et al. [47], 24.22% from Li et al. [48], 28.35% from Sahoo et al. [49], and 46.99% from Zhou et al. [50]. Similarly, it is 58.08% better in terms of computation costs from Mohit et al. [47], 96.46% from Li et al. [48], 9.35% from Sahoo et al. [49], and 21.47% from Zhou et al. [50]. These results underscore the overall outstanding performance of the proposed protocol.
Energy consumption
The resources use a certain amount of battery power while the proposed key agreement protocol is executed as soon as its initialization phase is run. The amount of power consumed by the Raspberry Pi, laptop, and cell phone for calculating the session secret key is represented by the equation EX=CY x CZ for a wireless channel [51]. The reliability of the proposed key agreement protocol is evident in its consistent power consumption. Suppose the computation costs of the proposed key agreement protocol is CY, which is 87.44 ms, and suppose CZ is the CPU’s maximum power consumption, which is fixed and equal to 10.88 Watts, according to [52–53] for wireless data transmission. By entering these numbers into the calculation, EX = 87.44 x 10.88 = 951.34 mJ or 0.96 joule. Therefore, 0.88-joule power is consumed upon running the proposed key agreement protocol for security authentication all the participating entities in the cloud computing paradigm and computes session secret key SK.
Conclusion
This research introduces a cloud-assisted key agreement protocol designed for secure communication within the e-healthcare system, utilizing ECC and SHA256 cryptographic primitives. The proposed method facilitates cross-verification among the parties involved and ensures the legality of participating entities in the cloud computing paradigm. What sets this protocol apart is the thoroughness of its examination, which includes formal security proofs utilizing the RoR model and ProVerif simulation, as well as informal security proofs through pragmatic illustrations. This comprehensive approach has been evaluated by considering computation, communication, storage costs, and energy consumption metrics, with results indicating that it is lightweight, effective for cloud setting, robust against known threats, and fulfills essential security requirements. Comparisons with state-of-the-art schemes reveal that the proposed protocol outperforms others regarding communication and computation costs, thus affirming its applicability in the real-world scenario. In future, the same e-healthcare setting can be secured by designing a protocol using advanced AI and machine learning algorithms and can be explained with the help of a real-world use case.
Acknowledgments
The author would like to thank AlMaarefa University, Riyadh, Saudi Arabia, for continuous support and encouragement.
References
- 1. Sultan N. Making use of cloud computing for healthcare provision: Opportunities and challenges. International Journal of Information Management. 2014;34(2):177–84.
- 2. Agapito G, Cannataro M. An Overview on the Challenges and Limitations Using Cloud Computing in Healthcare Corporations. BDCC. 2023;7(2):68.
- 3. Lin H-Y. A secure heterogeneous mobile authentication and key agreement scheme for e-healthcare cloud systems. PLoS One. 2018;13(12):e0208397. pmid:30540838
- 4. Wallis LA, Fleming J, Hasselberg M, Laflamme L, Lundin J. A Smartphone App and Cloud-Based Consultation System for Burn Injury Emergency Care. PLoS One. 2016;11(2):e0147253. pmid:26918631
- 5. Jan SU, Ali S, Abbasi IA, Mosleh MAA, Alsanad A, Khattak H. Secure Patient Authentication Framework in the Healthcare System Using Wireless Medical Sensor Networks. J Healthc Eng. 2021;2021:9954089. pmid:34336174
- 6. Masud M, Gaba GS, Choudhary K, Alroobaea R, Hossain MS. A robust and lightweight secure access scheme for cloud based E-healthcare services. Peer Peer Netw Appl. 2021;14(5):3043–57. pmid:33968292
- 7. Ahmad G, Singla J, Giri K. Security and privacy of e-health data. Multimedia security: Algorithm development, analysis and applications. 2021:199–214.
- 8. Alanazi R. Analysis of privacy and security challenges in e-health clouds. International Journal of Advanced Computer Science and Applications. 2022;13(9).
- 9. Ansari A, Mishra B, Gera P, Khan M, Chakraborty C, Mishra D. Privacy-enabling framework for cloud-assisted digital healthcare industry. IEEE Transactions on Industrial Informatics. 2022;18(11):8316–25.
- 10. Bao Y, Qiu W, Cheng X. Secure and lightweight fine-grained searchable data sharing for IoT-oriented and cloud-assisted smart healthcare system. IEEE Internet of Things Journal. 2021;9(4):2513–26.
- 11. Jan S, Ghani A, Alzahrani A, Saqlain S, Yahya K, Sajjad H. Bandwidth and power efficient lightweight authentication scheme for healthcare system. Journal of King Saud University-Computer and Information Sciences. 2023;35(7):101601.
- 12. Lopes G, Gondim PR. Mutual authentication protocol for D2D communications in a cloud-based e-health system. Sensors. 2020;20(7):2072.
- 13. Ayub M, Mahmood K, Kumari S, Sangaiah A. Lightweight authentication protocol for e-health clouds in IoT-based applications through 5G technology. Digital Communications and Networks. 2021;7(2):235–44.
- 14. Khan A, Laghari A, Shaikh A, Dootio M, Estrela V, Lopes R. A blockchain security module for brain-computer interface (BCI) with multimedia life cycle framework (MLCF). Neuroscience Informatics. 2022;2(1):100030.
- 15. Shariq M, Singh K. A secure and lightweight RFID-enabled protocol for IoT healthcare environment: A vector space based approach. Wireless Personal Communications. 2022;127(4):3467–91.
- 16. Ansari A, Mishra B, Gera P, Khan M, Chakraborty C, Mishra D. Privacy-enabling framework for cloud-assisted digital healthcare industry. IEEE Transactions on Industrial Informatics. 2022;18(11):8316–25.
- 17. Masud M, Gaba GS, Choudhary K, Alroobaea R, Hossain MS. A robust and lightweight secure access scheme for cloud based E-healthcare services. Peer Peer Netw Appl. 2021;14(5):3043–57. pmid:33968292
- 18. Padmaja K, Seshadri R. A real-time secure medical device authentication for personal E-Healthcare services on cloud computing. International Journal of System Assurance Engineering and Management. 2021:1–1.
- 19. Chandrakar P, Sinha S, Ali R. Cloud-based authenticated protocol for healthcare monitoring system. Journal of Ambient Intelligence and Humanized Computing. 2020;11:3431–47.
- 20. Deebak BD, Al-Turjman F. Smart mutual authentication protocol for cloud based medical healthcare systems using internet of medical things. IEEE Journal on Selected Areas in Communications. 2020;39(2):346–60.
- 21. Chiou S-Y, Ying Z, Liu J. Improvement of a Privacy Authentication Scheme Based on Cloud for Medical Environment. J Med Syst. 2016;40(4):101. pmid:26875078
- 22. Qadir GA, Hussan BK. An Authentication and Access Control Model for Healthcare based Cloud Services. Journal of Engineering. 2023;29(3):15–26.
- 23.
Okikiola FM, Mustapha AM, Akinsola AF, Sokunbi MA. A new framework for detecting insider attacks in cloud-based e-health care system. In: 2020 International Conference in Mathematics, Computer Engineering and Computer Science (ICMCECS). IEEE; 2020 Mar 18, p. 1–6.
- 24. Benil T, Jasper JJ. Cloud based security on outsourcing using blockchain in E-health systems. Computer Networks. 2020 Sep 4;178:107344.
- 25. Algarni AD, Algarni F, Jan SU, Innab N. LSP–eHS: A Lightweight and Secure Protocol for e-Healthcare System. IEEE Access. 2024.
- 26. Abbasi IA, Jan SU, Alqahtani AS, Khan AS, Algarni F. A lightweight and robust authentication scheme for the healthcare system using public cloud server. PLoS One. 2024;19(1):e0294429. pmid:38289970
- 27.
Vellaichamy A, Kalaiarasan K, Ratheeshkumar AM. Reliable and secure system design for IoT enabled E-healthcare services for patient monitoring. In: AIP Conference Proceedings 2024 Feb 13 (Vol. 2742, No. 1). AIP Publishing.
- 28. Arpitha T, Chouhan D, Shreyas J. Anonymous and robust biometric authentication scheme for secure social IoT healthcare applications. J Eng Appl Sci. 2024;71(1):8.
- 29. Zhang C, Miao Y, Xie Q, Guo Y, Du H, Jia X. Privacy-preserving deduplication of sensor compressed data in distributed fog computing. IEEE Transactions on Parallel and Distributed Systems. 2022;33(12):4176–91.
- 30. Gajmal Y, Udayakumar R. Privacy and utility-assisted data protection strategy for secure data sharing and retrieval in cloud system. Information Security Journal: A Global Perspective. 2022;31(4):451–65.
- 31. Nikkhah F, Safkhani M. LAPCHS: A lightweight authentication protocol for cloud-based health-care systems. Computer Networks. 2021;187:107833.
- 32.
Hu J, Li Z, Li P, Liu J. A Lightweight and Secure Authentication Protocol for 5G mMTC. In: 2022 IEEE 9th International Conference on Cyber Security and Cloud Computing (CSCloud)/2022 IEEE 8th International Conference on Edge Computing and Scalable Cloud (EdgeCom). IEEE; 2022 Jun 25, p. 195–200.
- 33. Tanveer M, Chelloug S, Alabdulhafith M, Abd El-Latif A. Lightweight authentication protocol for connected medical IoT through privacy-preserving access. Egyptian Informatics Journal. 2024;26(1):100474.
- 34. Masud M, Gaba GS, Choudhary K, Alroobaea R, Hossain MS. A robust and lightweight secure access scheme for cloud based E-healthcare services. Peer Peer Netw Appl. 2021;14(5):3043–57. pmid:33968292
- 35.
Kohli R, Garg A, Phutela S, Kumar Y, Jain S. An improvised model for securing cloud-based E-healthcare systems. IoT in healthcare and ambient assisted living. 2021, p. 293–310.
- 36. Lee T, Lin K, Hsieh Y, Lee K. Lightweight cloud computing-based RFID authentication protocols using PUF for e-healthcare systems. IEEE Sensors Journal. 2023;23(6):6338–49.
- 37. Alzahrani A. RLKS-TMS: A Robust and Lightweight Key Agreement Scheme for Telemedicine System. IEEE Access. 2024 Jul 2.
- 38. Alzahrani A, Alzahrani H. A privacy-preserving and energy efficient authentication protocol for the cloud-based e-healthcare system. Alexandria Engineering Journal. 2025;118(1):59–90.
- 39. Wu TY, Yang L, Luo JN, Wu M-T. A provably secure authentication and key agreement protocol in cloud‐based smart healthcare environments. Security and Communication Networks. 2021;2021(1):2299632.
- 40. Karaca Y, Moonis M, Zhang Y, Gezgez C. Mobile cloud computing based stroke healthcare system. International Journal of Information Management. 2019;45(1):250–61.
- 41. Koblitz N, Menezes A. The random oracle model: a twenty-year retrospective. Designs, Codes and Cryptography. 2015;77(6):587–610.
- 42. Backes M. Real-or-random key secrecy of the Otway-Rees protocol via a symbolic security proof. Electronic Notes in Theoretical Computer Science. 2006;155:111–45.
- 43.
Suzuki K, Tonien D, Kurosawa K, Toyota K. Birthday paradox for multi-collisions. InInformation Security and Cryptology–ICISC 2006: 9th International Conference, Busan, Korea, November 30-December 1, 2006. Proceedings 9. Springer Berlin Heidelberg; 2006, p. 29–40.
- 44. Blanchet B, Smyth B, Cheval V, Sylvestre M. ProVerif 2.00: automatic cryptographic protocol verifier, user manual and tutorial. Version from. 2018 May 16;16:05–16.
- 45. Available from: https://github.com/miracl/MIRACL
- 46. Kilinc HH, Yanik T. A survey of SIP authentication and key agreement schemes. IEEE Communications Surveys & Tutorials. 2013;16(2):1005–23.
- 47. Mohit P, Amin R, Karati A, Biswas GP, Khan MK. A Standard Mutual Authentication Protocol for Cloud Computing Based Health Care System. J Med Syst. 2017;41(4):50. pmid:28213882
- 48. Li C, Shih D, Wang C. Cloud-assisted mutual authentication and privacy preservation protocol for telecare medical information systems. Computer methods and programs in biomedicine. 2018;157(1):191–203.
- 49.
Sahoo S, Mohanty S, Polai M. A secure biometric based user authentication scheme for multi-server environment using chaotic map. 2019 6th International Conference on Signal Processing and Integrated Networks (SPIN). 2019, p. 637–42.
- 50. Zhou L, Li X, Yeh K, Su C, Chiu W. Lightweight IoT-based authentication scheme in cloud computing circumstance. Future Generation Computer Systems. 2019;91:244–51.
- 51.
Nyangaresi VO, AlRababah AA, Yenurkar GK, Chinthaginjala R, Yasir M. Anonymous authentication scheme based on physically unclonable function and biometrics for smart cities. Engineering Reports. 2024, p. e13079.
- 52. Bera B, Das AK, Garg S, Piran MJ, Hossain MS. Access control protocol for battlefield surveillance in drone environment. IEEE Internet of Things Journal. 2022;9(4):2708–21.
- 53. Ni Y, Cai L, He J, Vinel A, Li Y, Mosavat-Jahromi H, et al. Toward reliable and scalable internet of vehicles: Performance analysis and resource management. Proceedings of the IEEE. 2019;108(2):324–40.