Lattice-Based Threshold Encryption for Data Privacy Protection With Zero Trust in Internet of Medical Things

The interconnection of electronic health devices through the Internet of Things (IoT) technology plays a crucial role in improving healthcare services. The existing schemes usually use traditional cryptographic algorithms and secret sharing to protect the privacy of user health data records generated by smart electronic devices. However, key transmission is exposed to the risk of leakage, and it is vulnerable to quantum attacks. To address these issues, this paper proposes a novel data privacy protection named Lattice-based Threshold Encryption for Data Privacy Protection with Zero Trust in Internet of Medical Things (LTEN-ZTIoMT). Specifically, this paper proposes a lattice-based encryption algorithm by introducing zero trust and threshold secret sharing in managing users and IoT devices, distributing private keys, thus enhancing the ability to resist quantum attacks in LTEN-ZTIoMT. To prevent tampering in transmitting private key sub-shares, this paper adopts the oblivious transfer protocol, where the private key sub-shares escrow only receives his select private key sub-shares without gaining other private key sub-shares information. Moreover, we design a dynamic authentication and authorization mechanism based on a whitelist, which enables the dynamic verification of IoT devices and the revocation of certificates. To prevent unauthorized users from accessing the private key sub-shares and data ciphertexts, we have introduced the token verification mechanism, in which the user identity can be verified by the private key sub-shares escrow. The formal security analysis in Scyther tool and theory analysis of the proposed scheme are provided. The thorough performance simulation experiments on private key share distribution, private key recovery, encryption, decryption, throughput, and energy consumption are conducted, demonstrating the effectiveness of the proposed LTEN-ZTIoMT.