Capability-Aware Authentication Mechanisms in the Internet of Medical Things (IoMT): A Systematic Literature Review

Abstract

The Internet of Medical Things (IoMT) has become an important component of modern healthcare systems by enabling continuous patient monitoring, remote healthcare services, and real-time medical data exchange. Despite these benefits, securing communications among interconnected medical devices remains a significant challenge due to the sensitive nature of healthcare information and the resource limitations of many IoMT devices. Authentication plays a central role in addressing these challenges by preventing unauthorized access and establishing trust among communicating entities. This paper presents a systematic literature review of authentication mechanisms developed for IoMT environments. Following the PRISMA 2020 methodology, relevant studies were collected from major scientific databases and analyzed according to their authentication techniques, security characteristics, and resource requirements. Unlike many existing reviews, this study adopts a capability-aware perspective by classifying authentication mechanisms according to the resource characteristics of the target devices, including ultra-constrained devices, resource-constrained devices, and resource-rich systems.The review shows that hash-based and physically unclonable function (PUF)-based approaches are generally suitable for highly constrained medical devices due to their low computational and energy requirements. For wearable and smart sensing devices, elliptic curve cryptography (ECC) and lightweight mutual authentication schemes provide a practical balance between security and efficiency. In contrast, resource-rich environments such as edge gateways and healthcare servers can support more sophisticated mechanisms, including public key infrastructure (PKI), blockchain-based authentication, and hybrid approaches. The findings indicate that no single authentication mechanism can satisfy the requirements of all IoMT environments. Instead, authentication design should consider both security requirements and device capabilities. The review also highlights current challenges related to scalability, heterogeneity, adaptive authentication, and post-quantum security, while identifying emerging opportunities for future IoMT authentication frameworks.