SecureHealthKey+: Integrating Explainable TinyML Anomaly Detection Into Lightweight Authentication Protocols in IoT-Enabled Healthcare Systems.

The Internet of Medical Things (IoMT) and Wireless Body Area Networks (WBANs) enable real-time, remote, and continuous patient monitoring but remain vulnerable to cyber-physical attacks, including unauthorized device access, replay, man-in-the-middle (MITM), and slow-rate denial-of-service (DoS) attacks. Existing lightweight authentication protocols are computationally suitable for resource-constrained wearable sensors but may not detect behavioral anomalies occurring during otherwise valid cryptographic handshakes. This study presents SecureHealthKey+, a hybrid security framework that extends the lightweight mutual authentication mechanism of the SecureAuthKey scheme by integrating an Explainable Tiny Machine Learning-based Anomaly Detection (ETAD) layer within an Institute of Electrical and Electronics Engineers (IEEE) 802.15.6-inspired WBAN architecture. The framework uses a microcontroller-based Smart Medical Device (SMD) and a single-board-computer-based Medical Gateway Server (MGS). The SMD computes a cryptographic authentication token using a pre-shared body-sensor key, fresh nonce, and device identifier while extracting a five-dimensional Health Feature Metadata (HFM) vector comprising timestamp deviation (HFM1), sensor-identity novelty (HFM2), packet rate (HFM3), physiological signal drift index (HFM4), and inter-frame gap variance (HFM5). At the MGS, an 8-bit integer (INT8)-quantized Tiny Machine Learning (TinyML) autoencoder processes the HFM vector to generate a Health Anomaly Decision (HAD), cryptographically bound to the session key (SK) through SK_H = H(SK ∥ HAD). A SHapley Additive exPlanations (SHAP) layer provides feature-level attribution for anomalous sessions. Evaluation used 12,000 benign authentication traces and 4,800 synthetic attack traces generated on a single-device benchtop testbed. The framework achieved a weighted true-positive rate of 97.4% across four synthetic attack types. An IEEE 802.11 wireless link using the Message Queuing Telemetry Transport (MQTT) protocol emulated the WBAN gateway tier; dedicated IEEE 802.15.6 radio hardware was not used. Therefore, the results represent a proof-of-concept rather than validation of real-world, multi-patient WBAN efficacy.