A Lightweight Mutual Authentication Protocol for Healthcare RFID Systems Using the ASCON Algorithm

Abstract

This study addresses the shortcomings of traditional verification mechanisms used in health insurance cards, particularly systems based on Quick Response (QR) codes. These systems are vulnerable to forgery, replay, and eavesdropping, potentially allowing unauthorized access to sensitive medical data. To address these challenges, this study proposes a lightweight mutual authentication protocol for RFID-based healthcare systems using the ASCON lightweight cryptographic algorithm, which supports Authenticated Encryption with Associated Data (AEAD) and cryptographic hash functions. The proposed model consists of three entities: a resource-constrained RFID tag, an RFID reader that serves as a communication intermediary, and a trusted backend server responsible for key management and database administration. The protocol employs fresh random nonces and derived temporary keys, exchanges encrypted messages protected by authentication tags, and establishes a unique session key for each authentication session. The proposed protocol was formally verified using BAN logic and the ProVerif tool, in addition to an informal security analysis and an evaluation of its computational and communication costs. The theoretical results demonstrate that the protocol achieves mutual authentication, key secrecy, and session freshness while resisting replay, impersonation, eavesdropping, man-in-the-middle, and desynchronization attacks. The estimated computational cost is approximately 21.7 μs, whereas the communication cost of the two main authentication messages is approximately 768 bits, increasing to 896 bits when the optional RN0 challenge is included, making the proposed protocol a suitable solution for developing more secure and scalable RFID-based health insurance cards for retirees.