A Lightweight and Privacy-Preserving Biometric Authentication Framework for Sustainable IoMT Systems

Biometric authentication provides secure, identity-bound access control for the Internet of Medical Things (IoMT), crucial for wearable, implantable, and ambient devices. However, the inherent immutability and sensitivity of biometric data pose severe privacy risks in the event of a breach. Furthermore, conventional public-key cryptography is often too computationally intensive for resource-constrained IoMT hardware. To address these challenges, this paper proposes a lightweight, privacy-preserving authentication framework for sustainable IoMT. Our system integrates cancellable biometrics with fuzzy extractors to generate secure, revocable, and non-invertible templates. We replace elliptic curve cryptography with lightweight symmetric primitives, TinyAES and SPECK, to minimize overhead. The mutual authentication protocol is formally verified using BAN logic, ensuring session security and freshness. Implemented on commercial IoMT devices (ESP32, Raspberry Pi), the framework demonstrates a 3.4× reduction in execution time, 57% lower memory usage, and 66% lower energy consumption compared to ECC-based schemes. In summary, this work presents an efficient, deployable architecture for viable and sustainable biometric authentication in resource-limited e-healthcare.