extfieldsofstudy:
Computer Science
Medicine

text:
Small-Target Complex-Scene Detection Method Based on Information Interworking High-Resolution Network

The CNN (convolutional neural network)-based small target detection techniques for static complex scenes have been applied in many fields, but there are still certain technical challenges. This paper proposes a novel high-resolution small-target detection network named the IIHNet (information interworking high-resolution network) for complex scenes, which is based on information interworking processing technology. The proposed network not only can output a high-resolution presentation of a small target but can also keep the detection network simple and efficient. The key characteristic of the proposed network is that the target features are divided into three categories according to image resolution: high-resolution, medium-resolution, and low-resolution features. The basic features are extracted by convolution at the initial layer of the network. Then, convolution is carried out synchronously in the three resolution channels with information fusion in the horizontal and vertical directions of the network. At the same time, multiple utilizations and augmentations of feature information are carried out in the channel convolution direction. Experimental results show that the proposed network can achieve higher reasoning performance than the other compared networks without any compromise in terms of the detection effect.

Introduction
With the development of CNNs (convolutional neural networks), their application in the field of target detection has gradually increased, and new methods have been emerging one after another. The latest research includes the HRNet [1,2] based on pose estimation, cascade RCNN [3,4] developed on the basis of IoU (Intersection over Union), CenterNet [5,6], and CornerNet-Lite [7]. At present, since a high detection performance is required in real-world application scenarios, it is a common practice to use a method developed based on a faster RCNN [8] for performance improvement and optimization. For instance, the cascade RCNN mainly analyzes the influence of the IoU threshold selection on results at different stages; the HRNet network achieves a high-resolution presentation by using parallel multiresolution networks and multiscale information fusion on the basis of learning the underlying information exchange; the DenseNet network [9] provides a high-performance network by performing information fusion between channels and employs the ResNext [10] and Xception [11] models to use the convoluted data of every channel.
In the current applications in various scenarios, a test is first carried out on the abovementioned general networks to find which network strategy suits the best for a specific task and dataset. Currently, there are multitudes of network strategies to choose from. The testing process can show which strategies are suitable for a particular task and which are not. Therefore, it is necessary to test multiple schemes before an effective strategy and a network type are selected. On this basis, a particular network is built according to the requirements of a specific scene and good detection performance can be obtained through

Related Studies
In the field of deep learning-based target detection, detectors mostly adopt two architectures: one-stage architecture represented by SSD [12][13][14][15][16] and YOLO series [17][18][19] and two-stage architecture represented by the faster RCNN series [3,8,20] and its improved version. In the target-detection tasks with a high requirement for reasoning performance but a low requirement for detection performance, the one-stage detector architecture is preferred. In contrast, the two-stage detector architecture is preferred when there is a high requirement for detection performance, but the requirement for reasoning performance is not very high. However, when the requirements for both reasoning performance and detection performance are high, two-stage detector architecture yields better results than the one-stage detector architecture. Both have certain problems when it refers to the small target detection problem [21], where the one-stage approach is mainly due to its low detection accuracy and fixed sampling method, which makes it difficult to detect when objects are too close or too small to each other; similarly, the two-stage approach requires a fine global effective stride (GES) when detecting small targets, this leads to a very large memory overhead.
Currently, to solve the problem of small target detection based on deep learning, researchers have proposed more novel methods, which have achieved good performance on some typical datasets such as MS-COCO and PASCAL-VOC [22]. Guo et al. [23] proposed an effective and stable single-stage detector called CenterNet++, which consists of three modules. The feature refinement module is mainly used to extract multiscale contextual information; the feature pyramid fusion module is responsible for generating powerful semantic information; the head enhancement module can eliminate the impact of the complex background. Experiments show that the model achieves a state-of-the-art performance in the task of detecting the position of small target ships in SAR image datasets. In addition, this author also proposed a rotational Libra R-convolutional neural network (CNN) method for balancing the feature, sample, and objective level of a neural network, which achieves state-of-the-art accuracy on the DOTA dataset [24]. Bosquet et al. [25] proposed STDnet, a convolutional neural network focused on the detection of small objects that are defined as those under 16 pixels × 16 pixels, the authors proposes a novel early visual attention mechanism called the region context network (RCN), which processes only the most promising regions and discards the rest of the input image, allowing the STDnet to keep high resolution feature maps in deeper layers providing low memory consumption and higher frame rates.
In the IIHNet network used in this study, the data augmentation strategy was adopted at the stage of data preprocessing. After convolution was performed in the initial layer of the network, the convolution operations on the features of three different resolutions were performed simultaneously, and the information from the three convolution channels was further integrated to maintain the uninterrupted exchange of information in the horizontal and vertical directions of the network. Through repeated fusion and information processing, the underlying convolution features were utilized to the largest possible extent. The network was applied to the task of human detection of small targets in construction site scenes, experimental results show that the proposed network could reduce the reasoning time by 50% on average compared to the other classical networks without making any compromise in detection performance.

Proposed Model
This section introduces the IIHNet detection architecture and provides all related details. As there are multiple layers in a deep convolution network, the information presentation ability of each layer of the network depends on the richness of information obtained from the previous layer; therefore, the first principle of network pruning is channel reduction from back to front. Based on the MMDetection object detection toolbox, a network is designed and tested from the aspects of data augmentation and network structure.
A network structure called the ResNeXt-RC that is based on ResNet [26] and ResNeXt networks was designed and it is shown in Figure 1a,b. The proposed network structure first regrouped channels of the previous two networks and used 16 × 16 convolution groups, then fused the information in two ways, using the concatenation and summing operations, and, finally, used a 1 × 1 convolution to reduce the channels number and fuse the information. The proposed ResNeXt-RC structure is presented in Figure 1c.
Sensors 2021, 21, x FOR PEER REVIEW 3 of 14 channels was further integrated to maintain the uninterrupted exchange of information in the horizontal and vertical directions of the network. Through repeated fusion and information processing, the underlying convolution features were utilized to the largest possible extent. The network was applied to the task of human detection of small targets in construction site scenes, experimental results show that the proposed network could reduce the reasoning time by 50% on average compared to the other classical networks without making any compromise in detection performance.

Proposed Model
This section introduces the IIHNet detection architecture and provides all related details. As there are multiple layers in a deep convolution network, the information presentation ability of each layer of the network depends on the richness of information obtained from the previous layer; therefore, the first principle of network pruning is channel reduction from back to front. Based on the MMDetection object detection toolbox, a network is designed and tested from the aspects of data augmentation and network structure.
A network structure called the ResNeXt-RC that is based on ResNet [26] and ResNeXt networks was designed and it is shown in Figure 1a,b. The proposed network structure first regrouped channels of the previous two networks and used 16 × 16 convolution groups, then fused the information in two ways, using the concatenation and summing operations, and, finally, used a 1 × 1 convolution to reduce the channels number and fuse the information. The proposed ResNeXt-RC structure is presented in Figure 1c. In the stage of feature information extraction and fusion, a widely used way of superimposing and combining information of channels was adopted to maximize the utilization of information. In order to use the convolution network to detect better the key parts of the human body or the human head, an efficient and simple IIHNet network was designed. Considering that the key features of detection targets in the dataset used in this study were sensitive to color information and that the main targets were relatively small, branches with an excessively low resolution were not needed. So, the network was divided into three resolution channels (from high-to-low resolution) for synchronous convolution. The convolution layer of the network is denoted as Nij, where i (i = 1, 2, 3) represents the resolution (resolution 2 is a half of resolution 1, and resolution 3 is a half of resolution 2) and j (j = 1, 2, 3) represents the information fusion stage. Thus, the convolution processes of the three convolution channels are as follows: In the stage of feature information extraction and fusion, a widely used way of superimposing and combining information of channels was adopted to maximize the utilization of information. In order to use the convolution network to detect better the key parts of the human body or the human head, an efficient and simple IIHNet network was designed. Considering that the key features of detection targets in the dataset used in this study were sensitive to color information and that the main targets were relatively small, branches with an excessively low resolution were not needed. So, the network was divided into three resolution channels (from high-to-low resolution) for synchronous convolution. The convolution layer of the network is denoted as N ij , where i (i = 1, 2, 3) represents the resolution (resolution 2 is a half of resolution 1, and resolution 3 is a half of resolution 2) and j (j = 1, 2, 3) represents the information fusion stage. Thus, the convolution processes of the three convolution channels are as follows: The network structure consists of 10 convolution layers, where N 10 is the initial convolution module of the network. After the convolution operation in the initial convolution module was finished, the next convolution operation was performed in the three convolution channels. Further, N 11 , N 12 , and N 13 represent the convolution modules of the first, second, and third information interworking stages in the high-resolution channel, respectively; N 11 , N 21 , and N 31 represent the convolution modules of the first information interworking stage in the high-resolution, subresolution, and low-resolution channels, respectively. The meanings of other annotations can be inferred in the same way.
In the IIHNet network structure, information exchanges mainly occur in two directions, the horizontal direction (representing resolution channel) and the vertical direction (information interworking), as shown in Figure 2a. Each N ij module consists of four ResNeXt-RC structures and one 1 × 1 convolution block, which is used to perform information interworking for channel reduction. In Figure 2a, "Info" represent fused information, which includes the same resolution convolution information in the horizontal direction and the convolution information with different resolution at the same stage in the vertical direction, we adopted concatenated operation to generate high dimension features with these multiscale information to learn the relationship of channels, so that it improves the representational power. As shown in Figure 2b, the curves have different meanings, for instance, curves "0," "1," "2," and "3" represent different transmission distances of information within the same convolution channel, which are passing through zero modules, passing through one module, passing through two modules, and passing through three modules, respectively; curves "4" and "5" represent two different convolution operations, namely 3 × 3 transpose convolution and 3 × 3 slide convolution. In the horizontal direction (represents by X ij , i = 1, 2, 3 represents the resolution; j = 1, 2, 3 represents the information fusion stage), the high-resolution convolution information is expressed in stages as follows: In order to maximize utilization of the multiresolution convolution information in the network structure and produce the output of multiscale information on the premise of increasing only a few parameters and at a small amount of computational overhead, three multiscale output modes were designed, as shown in Figure 3. In the three output modes, three resolutions were used for data processing. Bilinear interpolation was used for upsampling from low to high resolution, average pooling was used for downsampling from high to low resolution and a 1 × 1 convolution kernel was used for backward transmission at the same resolution. The output module Yx (x = 1, 2, 3, etc.) is shown in Figure 3a. The In the vertical direction (represented by Y ij , i = 1, 2, 3. j = 1, 2, 3), the three stages of information interworking of the three convolution channels are expressed as follows: Sensors 2021, 21, 5103

of 15
The presentations of other convolution channels and information interworking stages can be inferred in the same way.
When the resolution changes from high resolution X 1 to medium resolution X 2 , the 3 × 3 sliding convolution kernel was used to generate the feature map. During this process, the resolution was halved and the number of feature map channels was doubled. Conversely, when the resolution changed from medium resolution X 2 to high resolution X 1 , the 3 × 3 transpose convolution kernel was used to generate the feature map. During this process, the resolution was doubled and the number of feature map channels was halved.
In order to maximize utilization of the multiresolution convolution information in the network structure and produce the output of multiscale information on the premise of increasing only a few parameters and at a small amount of computational overhead, three multiscale output modes were designed, as shown in Figure 3. In the three output modes, three resolutions were used for data processing. Bilinear interpolation was used for upsampling from low to high resolution, average pooling was used for downsampling from high to low resolution and a 1 × 1 convolution kernel was used for backward transmission at the same resolution. The output module Y x (x = 1, 2, 3, etc.) is shown in Figure 3a. The input feature image was flipped 90 degrees and then operated by the concat function, and then a 1 × 1 convolution kernel was used for information interworking.  In order to maximize utilization of the multiresolution convolution information in the network structure and produce the output of multiscale information on the premise of increasing only a few parameters and at a small amount of computational overhead, three multiscale output modes were designed, as shown in Figure 3. In the three output modes, three resolutions were used for data processing. Bilinear interpolation was used for upsampling from low to high resolution, average pooling was used for downsampling from high to low resolution and a 1 × 1 convolution kernel was used for backward transmission at the same resolution. The output module Yx (x = 1, 2, 3, etc.) is shown in Figure 3a. The input feature image was flipped 90 degrees and then operated by the concat function, and then a 1 × 1 convolution kernel was used for information interworking.
(i = 1, 2, 3) represents the final result of information fusion at different resolutions.
In Figure 3b, the multiscale outputs are expressed as: In Figure 3c, the multiscale outputs are expressed as: In Figure 3d, the multiscale outputs are expressed as:

Experimental Setup
The dataset used in this study mainly involved seven static scenes. The dataset included 5304 training images and 1769 test images with the size of 1280 pixels × 720 pixels. The training images contained 22,234 samples of the human body and 13,634 samples of the human head; the test images contained 7843 samples of the human body and 4513 samples of the human head. Unless otherwise specified, the dataset mentioned in this paper refers to this particular dataset.

Evaluation Metrics
The mAP (mean average precision) is the most widely used performance indicator in the field of target detection. In this paper, precision P, recall R, and mAP were jointly used In Figure 3b, the multiscale outputs are expressed as: In Figure 3c, the multiscale outputs are expressed as: In Figure 3d, the multiscale outputs are expressed as: The dataset used in this study mainly involved seven static scenes. The dataset included 5304 training images and 1769 test images with the size of 1280 pixels × 720 pixels. The training images contained 22,234 samples of the human body and 13,634 samples of the human head; the test images contained 7843 samples of the human body and 4513 samples of the human head. Unless otherwise specified, the dataset mentioned in this paper refers to this particular dataset.

Evaluation Metrics
The mAP (mean average precision) is the most widely used performance indicator in the field of target detection. In this paper, precision P, recall R, and mAP were jointly used to compare and evaluate the detection performance of the proposed model. The values of P and R were respectively calculated by Equations (7) and (8): where TP represents the true positive; FP represents the false positive; FN represents the false negative.
In order to obtain P and R values, it is necessary to calculate IoU so as to determine whether a result is correct. The threshold used in this study was set to 0.5; therefore, if IoU > 0.5, a sample was considered as TP; otherwise, it was considered as FP. For P and R, the confidence was obtained according to classification, and it was divided into 18 thresholds {0.1, 0.15, ..., 0.95}. As for mAP, the attention was mainly paid to AP50 (IoU0.5) and mAP (the mean value of AP under 10 IoU thresholds {0.50, 0.55, ..., 0.95}).

Model Training
In this study, the most advantageous training parameters were determined by the analysis; the anchor length-width ratio of the anchor box was set to [0.3, 0.4, 0.5, 1.0]. Different training parameters were used for different algorithm networks. After passing the test, the SGD + COS learning and adjustment mode was used and multiscale training and verification mode was adopted. The parameter training scale was set to [(1280, 720), (1120, 630), (960, 540), (800, 450)] and the validation scale was set to [(1280, 720), (1120, 630), (960, 540)]. The input scales of training and verification were set according to the lengthwidth ratio.

Infer Metric
In this study, the reasoning performance of the network was tested using the Nsight Compute tool based on the MMdetecion framework. The Nsight Compute, which is an analysis tool used to test and optimize the performance of CUDA applications, can collect, view, and analyze data in the command lines. The parameters related to the network reasoning process, including the time consumption of each item and the proportion of time, are presented in Table 1. The primary concern of this study was the reasoning performance of the designed model. Table 1 shows only part of the results and the parameter named CUDA memcpy HtoD indicates the time spent on copying image data from the host to the device. Omitting the calculation of the network reasoning time, the reasoning ability on a single image is expressed as Equation (9): where T C represents the time spent on copying data of an item (CUDA memcpy HtoD); P C represents the percentage of data copying time in the total used time; Y represents the reasoning time consumed by a single image on the reasoning device, i.e., reasoning performance.

Model
Due to various reasons, in real-world applications, the volume of training data is usually limited. To address this limitation, a common practice is to perform basic weight training on other datasets first and then to retrain the trained model using the training data of the current project. A weight training dataset was designed for the proposed model, and it contained the following data: Based on the basic weight training, three training schemes were designed. The IoU threshold was set to 0.5 and AP50 (AP-average precision) and AR50 (AR-average recall) were used as the evaluation criteria. The network detection result corresponding to AP50 is shown in Figure 4a, where the abscissa indicates the confidence interval and the ordinate indicates the percentage of accurate predictions. The network detection result corresponding to AR50 is shown in Figure 4b, where the abscissa indicates the confidence interval and the ordinate indicates the recall percentage. The importance of data to the network generalization was clearly verified by the results presented in Figure 4 and the sequence is as follows: ImageNet → PHFCOCO → MSCOCO. The accuracy improved significantly in the low-confidence section and dropped slightly in the high-confidence zone. The model trained on the MSCOCO dataset achieved a great improvement in recall (above 90%). In terms of the overall trend, the curve tended to be stable after pretraining and the prediction became more accurate, which was mainly due to the rich features of the MSCOCO dataset. The generalization ability of the proposed model was improved essentially by the implementation of migration learning based on the pretrained model; thus, the detection performance of the proposed model was greatly improved.

Input Data
In the dataset used in this study, most of the targets were persons wearing maroon clothes and yellow helmets. Considering that the proposed model can be sensitive to the color jitter and that the dataset is relatively small in scale, the data augmentation strategy was adopted. Two strategies based on data analysis were designed: the JITTER strategy based on color dithering and contrast transformation of images and the STYLE strategy based on the offline style conversion of images. Considering the influence of data scenes, 10 different styles of augmentations were used randomly for scenes in the dataset during training. Several typical conversion effects are shown in Figure 5a.
In this section, three experimental schemes are presented. The first scheme uses a BRG image as input data of the network. The second scheme is similar to the first scheme, except that it also accepts the data obtained by implementing the JITTER strategy on an image such as the input. The third scheme is similar to the second scheme, except that it also accepts the data obtained by implementing the STYLE strategy on an image as the input. On the premise that the accuracy could reach the detection standard, the latter two schemes achieved significantly higher detection accuracy compared to the first scheme. The detection performances of the three schemes are presented in Figure 5b,c.

Input Data
In the dataset used in this study, most of the targets were persons wearing maroon clothes and yellow helmets. Considering that the proposed model can be sensitive to the color jitter and that the dataset is relatively small in scale, the data augmentation strategy was adopted. Two strategies based on data analysis were designed: the JITTER strategy based on color dithering and contrast transformation of images and the STYLE strategy based on the offline style conversion of images. Considering the influence of data scenes, 10 different styles of augmentations were used randomly for scenes in the dataset during training. Several typical conversion effects are shown in Figure 5a. BRG image as input data of the network. The second scheme is similar to the first sche except that it also accepts the data obtained by implementing the JITTER strategy on image such as the input. The third scheme is similar to the second scheme, except th also accepts the data obtained by implementing the STYLE strategy on an image as input. On the premise that the accuracy could reach the detection standard, the latter schemes achieved significantly higher detection accuracy compared to the first sche The detection performances of the three schemes are presented in Figure 5b,c.

Convolution Module
From the Inception V1-4 [29][30][31][32] and ResNet architectures to the Xception and NeXt architectures, researchers have been continually exploring appropriate width depth values of a network, studying the fusion of information from the bottom an network layers, and increasing the utilization of the underlying information in the work. The main goal has been to maximize the utilization and fusion of the convol information at the lowest possible computational cost by processing the post-convol information. In this section, the detection results of several basic network schemes u different convolution methods, including the ResNet101, HRNetv2p_ HRNetv2p_w32, ResNeXt101, Dconv_c3-c5_ResNeXt101, and ResNeXt-RC, were pared. On the premise of meeting the application requirements of the project, the ev tion criteria of the experimental results favored the highest possible detection effect w ensuring a recall rate over 90%. The results are shown in Figure 6a,b, where F stand the Faster RCNN, R stands for the ResNet101, H18 stands for the HRNetv2p_w stands for the ResNeXt101, DX stands for the Dconv_c3-c5_ResNeXt101, and F stands for the Faster RCNN network structure based on the ResNeXt-RC underlying work. The results showed that when the confidence threshold was in the range of 0.8], the recall was over 90% in all cases. The detection accuracy curves are display Figure 6a, where it can be seen that when the confidence threshold was in the ran [0.7, 0.95], the detection accuracy was always over 90%, and the scheme based on the NeXt-RC achieved the highest accuracy of 96.67%. These experimental results verified the utilization of the underlying information and the design of the convolution mo were successful. It should be noted that the larger network depth was beneficial in cases, but in certain cases, its advantages cannot be demonstrated in specific tasks. T fore, it is highly necessary to design an efficient and simple network for specific dat In this section, three experimental schemes are presented. The first scheme uses a BRG image as input data of the network. The second scheme is similar to the first scheme, except that it also accepts the data obtained by implementing the JITTER strategy on an image such as the input. The third scheme is similar to the second scheme, except that it also accepts the data obtained by implementing the STYLE strategy on an image as the input. On the premise that the accuracy could reach the detection standard, the latter two schemes achieved significantly higher detection accuracy compared to the first scheme. The detection performances of the three schemes are presented in Figure 5b,c.

Convolution Module
From the Inception V1-4 [29][30][31][32] and ResNet architectures to the Xception and ResNeXt architectures, researchers have been continually exploring appropriate width and depth values of a network, studying the fusion of information from the bottom and top network layers, and increasing the utilization of the underlying information in the network. The main goal has been to maximize the utilization and fusion of the convolution information at the lowest possible computational cost by processing the post-convolution information. In this section, the detection results of several basic network schemes using different convolution methods, including the ResNet101, HRNetv2p_w18, HRNetv2p_w32, ResNeXt101, Dconv_c3-c5_ResNeXt101, and ResNeXt-RC, were compared. On the premise of meeting the application requirements of the project, the evaluation criteria of the experimental results favored the highest possible detection effect while ensuring a recall rate over 90%.
The results are shown in Figure 6a,b, where F stands for the Faster RCNN, R stands for the ResNet101, H18 stands for the HRNetv2p_w18, X stands for the ResNeXt101, DX stands for the Dconv_c3-c5_ResNeXt101, and FX-RC stands for the Faster RCNN network structure based on the ResNeXt-RC underlying network. The results showed that when the confidence threshold was in the range of [0.1, 0.8], the recall was over 90% in all cases. The detection accuracy curves are displayed in Figure 6a, where it can be seen that when the confidence threshold was in the range of [0.7, 0.95], the detection accuracy was always over 90%, and the scheme based on the ResNeXt-RC achieved the highest accuracy of 96.67%. These experimental results verified that the utilization of the underlying information and the design of the convolution module were successful. It should be noted that the larger network depth was beneficial in most cases, but in certain cases, its advantages cannot be demonstrated in specific tasks. Therefore, it is highly necessary to design an efficient and simple network for specific datasets and special scenarios.

Detection Effect and Reasoning Performance
The main objective of this study was to improve the detection performance of the network while maintaining high reasoning performance. Much work has been done on the optimization and improvement of network depth and width and information exchange. Considering that different tasks have different requirements for performance and effect, nine schemes, including all the schemes mentioned in the previous section, were selected to perform network training and testing and different models comparison. These include ResNet101, HRNetv2p_w18, HRNetv2p_w32, ResNeXt101, Dconv_c3-c5_ResNeXt101, ResNeXt-RC based on the Faster RCNN structure and HRNetv2p_w32, ResNeXt101, and ResNeXt-RC based on the Cascade RCNN structure. The experimental reasoning platform included a NVidia GeForce GTX1080Ti 11G graphics card. The P and R curves plotted according to the test data are shown in Figure 7a,b, where the meaning of each curve was the same as in the previous figures, C stands for the Cascade RCNN. With regard to the detection accuracy, the network based on the cascade structure achieved an overall accuracy that was 2.5% higher than that achieved by the network based on the faster structure and the prediction stability of the former was also higher than that of the latter. The prediction accuracy of the network based on the faster structure fluctuated in the range of approximately 8%, while the accuracy fluctuation range of the network based on the cascade structure was only 3%. This was because the feature extraction operation was performed thrice during the detection process in the network based on the cascade structure. Based on the recall curves, the network based on the cascade structure achieved the absolute advantage in the detection accuracy on the premise that its performance in recall could meet the requirement of the task. The proposed network based on the ResNeXt-RC modular structure could also achieve high accuracy and its detection performance is shown in Figure 7c,d, where the red frames denote the annotation boxes of the dataset and the green frames are the detection box added to the experiment.

Detection Effect and Reasoning Performance
The main objective of this study was to improve the detection performance of the network while maintaining high reasoning performance. Much work has been done on the optimization and improvement of network depth and width and information exchange. Considering that different tasks have different requirements for performance and effect, nine schemes, including all the schemes mentioned in the previous section, were selected to perform network training and testing and different models comparison.
These include ResNet101, HRNetv2p_w18, HRNetv2p_w32, ResNeXt101, Dconv_c3-c5_ResNeXt101, ResNeXt-RC based on the Faster RCNN structure and HRNetv2p_w32, ResNeXt101, and ResNeXt-RC based on the Cascade RCNN structure. The experimental reasoning platform included a NVidia GeForce GTX1080Ti 11G graphics card. The P and R curves plotted according to the test data are shown in Figure 7a,b, where the meaning of each curve was the same as in the previous figures, C stands for the Cascade RCNN. With regard to the detection accuracy, the network based on the cascade structure achieved an overall accuracy that was 2.5% higher than that achieved by the network based on the faster structure and the prediction stability of the former was also higher than that of the latter. The prediction accuracy of the network based on the faster structure fluctuated in the range of approximately 8%, while the accuracy fluctuation range of the network based on the cascade structure was only 3%. This was because the feature extraction operation was performed thrice during the detection process in the network based on the cascade structure. Based on the recall curves, the network based on the cascade structure achieved the absolute advantage in the detection accuracy on the premise that its performance in recall could meet the requirement of the task. The proposed network based on the ResNeXt-RC modular structure could also achieve high accuracy and its detection performance is shown in Figure 7c,d, where the red frames denote the annotation boxes of the dataset and the green frames are the detection box added to the experiment. In Figure 7c,d, from left to right and from top to bottom, the images denote the data annotation map, the detection result map of the network based on the faster-RCNN structure, and the detection result map of the network based on the cascade RCNN. The detection results showed that the network based on the cascade RCNN structure had a salient advantage in detecting small targets, which was mainly because it had two extra cascaded detectors compared to the network based on the faster-RCNN structure. Compared to the ResNeXt101 network based on the cascade structure, the proposed IIHNet network could reduce the reasoning time by approximately 50% without making a compromise in detection performance. The reasoning performance is given in Table 2.
The nine schemes were put under the multiscale reasoning performance test, in which three scales, namely, 1280 × 720, 960 × 540, and 800 × 450, were used. The analysis and performance calculations were conducted by the Nsight Compute tool and the calculation results for evaluating the reasoning performance were obtained by averaging the calculation data of three rounds. As shown in Table 2, the IIHNet network achieved significant improvement in reasoning performance when it was used on the dataset; it achieved the highest accuracy for the scale of 1280 × 720 and this accuracy was 20% higher than the second-highest accuracy achieved by the ResNeXt101 scheme. From the perspective of practical application, the IIHNet network based on the MMdetection framework could achieve an accuracy of 96.67% without any reasoning acceleration, which corresponded to the reasoning performance of 12 frames per second. Table 2 shows the reasoning performance results of the nine schemes for different scales. The pretraining of each of the schemes was performed on the COCO dataset. In Table 2, "Input size" represents the size of the input image, and A, B, and C correspond to the scales of 1280 × 720, 960 × 540, and 800 × 450, respectively; "Infer" represents the reasoning performance and its unit is ms; AP50 and AP75 represent the average precisions at an IoU of 0.5 and 0.75, respectively. The nine schemes were put under the multiscale reasoning performance test, in which three scales, namely, 1280 × 720, 960 × 540, and 800 × 450, were used. The analysis and performance calculations were conducted by the Nsight Compute tool and the calculation results for evaluating the reasoning performance were obtained by averaging the

Conclusions and Future Works
To meet the requirements of small-target detection, this paper proposed a new CNNbased network model named the IIHNet. The proposed model exhibited a considerable advantage in both the detection effect and reasoning performance. The results of the comparative experiment show that the IIHNet network improved the detection reasoning performance by 20-70% compared to the existing detection network models, such as the faster RCNN (Resnext101-DCONV, HRNet) and cascade RCNN (ResNeXt101), when tested on different datasets on the premise that its detection performance is on a par with or even exceeds that of those networks.
There are three main reasons for the excellent performance of the proposed IIHNet network model and they are as follows: (1) the convolution module design based on information fusion; (2) information exchange among the convolution channels of different resolution and among different modules during the entire detection process; (3) multiscale network output mode.
In future works, the application scope of small-target detection will be expanded so to include satellite image detection, face detection, semantic segmentation, and other modern applications. The main aim is to develop smaller, faster, and stronger network strategies.


text:
A robust and lightweight secure access scheme for cloud based E-healthcare services

Traditional healthcare services have transitioned into modern healthcare services where doctors remotely diagnose the patients. Cloud computing plays a significant role in this change by providing easy access to patients’ medical records to all stakeholders, such as doctors, nurses, patients, life insurance agents, etc. Cloud services are scalable, cost-effective, and offer a broad range of mobile access to patients’ electronic health record (EHR). Despite the cloud’s enormous benefits like real-time data access, patients’ EHR security and privacy are major concerns. Since the information about patients’ health is highly sensitive and crucial, sharing it over the unsecured wireless medium brings many security challenges such as eavesdropping, modifications, etc. Considering the security needs of remote healthcare, this paper proposes a robust and lightweight, secure access scheme for cloud-based E-healthcare services. The proposed scheme addresses the potential threats to E-healthcare by providing a secure interface to stakeholders and prohibiting unauthorized users from accessing information stored in the cloud. The scheme makes use of multiple keys formed through the key derivation function (KDF) to ensure end-to-end ciphering of information for preventing misuse. The rights to access the cloud services are provided based on the identity and the association between stakeholders, thus ensuring privacy. Due to its simplicity and robustness, the proposed scheme is the best fit for protecting data security and privacy in cloud-based E-healthcare services.

Introduction
Storing the health records manually and retaining them for future references becomes challenging to manage with large data volumes. The most peculiar example is the number of patients surpassing the capacity of the hospitals due to the coronavirus pandemic. In countries like the USA, Brazil, and India, the healthcare system has been reeling under pressure as its capacities were falling short of taking in more patients. The load on the healthcare infrastructure is unimaginable due to the current global crises of this current pandemic.
The problem with the traditional method of storing all data manually or on paper is that it's tough to find a patient's data from the record room where a large number of health records are being kept. It takes a lot of time and energy to find the specific medical record of a patient. It is also possible that data can get lost and eradicated in any natural or human-made disaster. Data can be stolen easily because it is in the form of plain text so anyone can read and write the data in records or modify it as it is easily accessible [1]. Keeping the health records in digital format is enabled by the technology powered by the Internet of Things (IoT) [2,3]. Security in E-healthcare is even more important because it concerns the sensitive health data of the patient. The attackers can exploit the vulnerabilities of the open wireless channels to conduct attacks [4][5][6][7][8][9][10]. These attacks can cause various types of damage to the E-healthcare framework.
Let us consider a scenario where a patient has received treatment from a hospital in a different city from his hometown, after which he/she gets discharged and goes home. Later, he suddenly falls ill and is admitted to a nearby hospital, but he does not have the full details or the file of his treatment from the previous hospital. Lack of information can cause a delay in his treatment, which can be fatal. But if the patient already has/her his data on devices accessible via the cloud, retrieval of patient's data would be done in seconds, thus enabling the new hospital staff to begin the treatment as soon as possible [11][12][13][14][15]. The health care department can store data on the cloud in encrypted form with high secure algorithms used in cryptography that allow only the legitimate user to access any remote location provided it has internet connectivity, wired or wireless. The "cloud" has servers on which many software and databases are run, and they are accessed over the Internet. Cloud servers are located in every part of the world. With the help of cloud computing, stakeholders, insurance companies, and healthcare departments don't have to manage physical servers by themselves or run any software applications on their machines [16]. Cloud computing offers advantages like sharing enormous amounts of data, and patients' medical records in a timely and safe manner [17][18][19][20][21][22][23]. Digital solutions in hospitals recommend healthcare providers manage their infrastructure well and provide them ample opportunity to familiarize themselves with IT, service providers [24,25]. Other benefits of Cloud and mobile computing include scalability, cost-effectiveness, agility enhancement, and collaborative sharing of resources [26][27][28].
E-healthcare can be made flexible in hospitals not having the full provisions for implementing cloud-based services. Some of the hospital's data can be stored using the traditional medium of paper to store the general data, and the cloud can be used to store more important data. The access to the legitimate users is provided irrespective of the location, and the exchange of data is secure [29][30][31]. Only specific stakeholders can read the data, delete the data, and modify the data according to the need or future use [29,32,33]. The health data of patients must be protected end to end, and it's also a big challenge to ensure patients' privacy while also retaining data quality [1]. 90 percent of healthcare institutions in Australia and many other countries have already adopted E-healthcare to facilitate effective health care services. Digitally, the medical records are stored in the form of Electronic medical record (EMR), Electronic Health Data (EHD), and Personal Health Record (PHR) [34]. EHR and EMR health records are maintained by health care professionals, whereas PHR is handled by the patients themselves or by their relatives. The communication exchange between doctors and patients or between cloud and systems usually occurs through a wireless medium, which is highly prone to attacks like denial of service (DoS), man in the middle attack (MITM), and eavesdropping, and so forth. Although the health care department asserts that it is the staff's responsibility to maintain the patient's data confidentiality, the technology used in e-healthcare should also protect the data.
The stakeholders in the dynamic and complex IoT environment of the healthcare system are the patient, nurse, doctor, pharmacist, lab technicians, etc. To successfully run the healthcare system, a specific set of regulations are necessary. There are several organizations in the world like Health Information Technology for Economic and Clinical Health (HITECH) and Health Insurance Portability and Accountability Act (HIPAA) that provide the regulations related to healthcare [35][36][37].
In 1996, HIPAA [37] was established to regulate the US healthcare industry. The HIPAA's primary focus is to ensure the patients' security and privacy and protect the full information of the hospital and its different services. HIPAA ensures that only authorized users can access the hospital data from any part of the world.
This paper proposes a scheme in which only legitimate staff can access the patient's data. The doctor has access to reading and writing the data, and others can only read the data but cannot modify it. The proposed scheme explains how an admin generates the subkeys from the master key to ensure end-to-end security of critical information. We have also addressed the requirements of key security for a secure healthcare system such as integrity, confidentiality, and protection from known key attacks, etc. [5,[38][39][40][41][42][43]].

Motivation
Internet of Things offers a variety of features that support the real-time applications of the e-healthcare. The IoT and WSN networks are prone to diverse attacks because they share the information through insecure public channels. Moreover, cloud access, if not protected, could disclose potential confidential information to adversaries. It becomes more dangerous for medical applications as it can endanger the lives of the patients. The adversary can misuse the information to exploit the reputation of the hospital as well. The frequency of cyberattack incidents reported in the HIPAA journal points out the adversaries' interest in the information stored in the cloud. As per the report, 32,205 users information were breached through 8 separate incidents of unauthorized access reported in August 2020 [44]. The few healthcare institutions whose users are victimized are the University of Florida Health, Northwestern Memorial Healthcare, Hamilton Health Center, Inc. A possible solution to protect against these cyber attacks in the future is the use of robust access control protocols. However, designing such protocols is challenging due to the resource-constrained user devices and vulnerable wireless channels. Therefore, lightweight security protocols with extreme robustness to protect sensitive networks should be developed.

Our contribution
1. We propose a robust and lightweight, secure access scheme for cloud-based e-healthcare services. 2. The proposed security protocol verifies the user's identity (doctor, patient, nurse, etc.) and permits only legitimate users to access cloud services. 3. The proposed protocol attains data confidentiality, message freshness, etc., as security measures while preventing the networks from various threats like man in the middle (MITM) attack, message modification attack, replay attack, etc.
The remaining paper is structured as follows: Section 2 discusses the literature review whereas Section 3 presents the system model. Section 4 describes the proposed scheme. Section 5 provides the security and comparative analysis followed by conclusions in Section 6.

Literature review
Olutayo Boyinbode et al.
[45] suggests a new web-based technology that enables nurse, doctor, and pharmacist to access the patients' medical records. It uses the local cloud to store the information of the patient. The data is accessible remotely, and it can also be updated. It is ideal for healthcare units where patients' data records need to be shared with other doctors for collaborative treatments. But the drawback of this scheme is that it does not allow the patient to access the health records.
Another group of researchers at the Eindhoven University of Technology have proposed a secure E-healthcare scheme, "My PHR Machine" [46]. It is a mixture of cloud and PHR systems. The hospital crew and himself can access, share, and analyze the PHR data through HR software. Another advantage of this scheme is that the data of different users can be accessed with more flexibility at the same time and with proper security measures. The information accessed through My PHR machine is also accessible via the cloud. This scheme does not enable faster access to health records.
The authors in [47] have suggested a cloud-based healthcare framework for successful communication between caregivers and healthcare providers that can completely replace the manual record system in hospitals. The healthcare providers, as well as the patient, can access the records using the above system without any restriction of time or place. The framework incorporates a collaborative service so that only the legitimate healthcare provider or the patient himself can access the data through the Authentication Management service. Patients are not allowed to modify the data, whereas the healthcare staff can write, read, or modify. The patient's health record is divided into two parts, one of which is stored in the concerned health care department's system in local databases, and the other is stored in a cloud server database. This system's main problem is that if a hospital or a healthcare unit does not have its local EHR system, the whole data is stored on the cloud server.
Masud and Hossain [48] introduces a new methodology of storing medical records electronically in the cloud storage system. The suggested method takes care of data privacy using Shamir's Secret Sharing Mechanism. The EHR is categorized into multiple segments by the healthcare center. The segments are distributed equally to the cloud servers. Whenever any legitimate user wants to access the EHR, the healthcare center captures all segments from partial cloud servers to reconstruct the EHR. This method increases the efficiency of the EHR by outsourcing every patient's data, which can be reconstructed using cloud computing. The authors claim that they have introduced the novel concept of separation and reconstruction of EHR. The method's experiential and theoretical analysis suggests that it is a highly efficient and secure method of handling medical records electronically. The framework is not suitable to protect from intruders and unauthorized access of resources.
Shekha chenthara, [34] and a few other experts have surveyed, investigated, and reviewed various articles and identified multiple concerns in protecting E-healthcare. Some of them are EHR privacy, EHR security, and EHR cloud architecture. Authors also indicate that there is still a broad scope of research in EHR security.
Another approach in [49] discusses a data sharing and profile matching scheme for Mobile Healthcare Social Networks (MHSN) in cloud computing for EHR. The scheme allows the encryption of health records using an identity based encryption scheme. Not only this, attributebased conditional data re-encryption can also be performed under this scheme. The scheme is claimed to be preventive against eavesdropping on sensitive data. A profile matching mechanism in MHSN based on identity-based encryption and an equality test helps achieve a very flexible and robust authorization. A trust negotiation based framework is proposed to provide authentication, sensitivity, and other access control services in healthcare systems [50][51][52]. Mutual disclosure of attributes to perform sensitive transactions is done using digital credentials. However, the technique is not able to protect E-healthcare system from all the prominent threats.
The authors in [53] emphasized the security aspects of the E-Healthcare systems especially access control mechanisms. The authors have declared that their scheme outperforms the traditional access control systems. The proposed access control model is based on the trust degree of the communicating parties. The degree of trust is evaluated based on user behavior. The user request is only granted when the degree of trust from both parties (from the user and service) is greater than or equal to the mutual trust threshold value. The author explains that the model ensures that only legitimate and trustful users can access medical records. Table 1 provides a comprehensive comparison of various E-Healthcare security protocols. Table 1 elaborates the various vulnerabilities that could easily be exploited by attackers to conduct cyber-attacks on different medical devices. Additionally, the level of difficulty required to conduct a successful cyber-attack, the impact of cyberattacks on medical devices, and the cyber awareness of stakeholders are also included in Table 1. Conclusively, it can be stated that most of the techniques discussed in the literature review section do not offer complete security in terms of identity anonymity, authenticity, confidentiality, and integrity of communications. Absentia of these security properties makes the traditional schemes inappropriate for the sensitive applications of e-healthcare. The inadequacies in the framework of existing schemes allow the adversaries to intrude and access unauthorized resources. Besides, the conventional schemes incur high computation and communication costs that result in precious resource deprivation of tiny smart nodes. Therefore, E-Healthcare applications need a robust authenticated key agreement scheme to protect the network from unauthorized abuses.

System model
The system model describes the relationship between admin, gateway (G W ), doctor, patient, and nurse. Figure 1 illustrates the process of accessing the medical records from the cloud by stakeholders via Gateway.

Admin
Admin is an IT in charge of the hospital who successfully registers the hospital with the cloud. The admin communicates securely with the cloud through the gateway by using a public key of the cloud. The cloud computes the master key of the hospital upon registration and returns this master key to the admin. Afterward, the admin creates various subkeys from the master key through KDF. Admin also performs the offline registration of the patient, doctor, and nurse's devices and issues the subkeys to them.

Doctor
A doctor is a person who takes care of the patients assigned to him for treatment. Ideally, only the associated doctor should access the information of the patient. This is achieved by matching the patient id (stored in the cloud) with the patient id requested by the doctor, and if the association exists, the request is permitted else denied. According to his treatment, the doctor has the right to both read and write/modify the patient's medical record. The doctor enters all the patient information and stores it in the cloud using encryption, hash, and subkey. Only the legitimate staff can access the information for reading. The doctor provides his two unique identity

Patient
The patient is the person who is admitted to the hospital for his diagnosis or checkup. According to his diagnosis, a particular doctor and nurse are assigned to take care of him in the hospital. The patient also provides the two unique identity numbers issued by the govt. (UI D G ) and the hospital (UI D G ), respectively to the admin. Admin receives both the ids and stores the same on the cloud. The cloud returns the unique patient id (P I D ) to the admin. A patient uses the secret subkey provided by the admin to communicate with the gateway securely. It is assumed that devices used by the stakeholders are resource constrained.

Nurse
A nurse is the caretaker of the patient after the doctor leaves. She uses her subkey S K to securely get the information from the cloud via a gateway. In offline registration, the nurse provides her unique identity number issued by govt.
(UI D G ) and the hospital (UI D H ). In return, the nurse gets the secret subkey S K , issued by admin and N I D issued by cloud. A nurse can only access the data of patients assigned to her by the healthcare department. A nurse can only read the data and can not change the data because she does not have access to modify or write the information in the patient's EHR. The nurse also uses her secret subkey provided by the admin to communicate with the gateway securely, and it is assumed that the user's devices are resource constrained.

Gateway
Gateway provides the interface to the doctor, patient, nurse, and admin to get connected to the cloud. The present system model is constructed considering the hospital's applications, where the Gateway is not resource-constrained. The Gateway receives full security credentials of doctor, patient, and nurse from the admin and provides a secure interface to access the records from the cloud. During the offline registration, the Gateway receives the master key M K , subkeys S K , and H I D from the admin. Gateway secures the communication with different users like a doctor, nurse, and patient using various subkeys, whereas it uses the master key (M K ) for ciphering the communication between Gateway and cloud.

Adversary model
The adversarial nodes are deployed to hinder the routine operations of the network and its services. The authors have considered the Dolev-Yao (DY) adversary model to evaluate the proposed protocol's strength against malicious activities. As per the DY model, the adversary can eavesdrop on the messages exchanged between the user, gateway, and cloud. The attacker can capture the authentication messages while in transit from the user to the cloud and replay those messages to get unauthorized access to cloud services. The captured messages can also lead to the disclosure of secret credentials that the adversary may use later by the adversary to perform impersonation, known key, and man-in-themiddle attacks. Besides, the adversary can flood the cloud with redundant requests to launch a DoS attack. Therefore, it can be summarized that adversary has the power to disrupt the functioning of the network either temporarily or permanently.

Proposed secure access scheme
In the hospital environment, the staff's work life is very complicated as they have to do multi-tasking when it comes to handling and storing the patient's records, and it is a big challenge for every hospital. To solve their problem, we have proposed the scheme in which the medical records are stored in the cloud, which helps the hospital staff get relief from doing everything manually. Note that to run the proposed protocol, we have considered the following assumptions: -The user device is a resource-constrained entity having limited storage and computation capabilities, whereas gateway and cloud are trusted entities with extensive computation and storage resources. -All the entities (user device, gateway, and cloud) can execute the identical cryptography functions. -The user can access the data only after the authentication at a cloud.
The cryptography function used to derive one or more secret keys from the master key is the Key Derivation Function (KDF). KDF can be used for stretching keys into longer key or to obtain the keys of the required format. KDF is an example of a pseudo-random function used for key derivation. KDF is used as DK = KDF (key, salt, iteration), DK is the derived key, KDF is the key derivation function, key is the original key, salt is the random number that acts as cryptographic salt, and iteration is the number of iterations of sub-function.
The proposed protocol has been implemented in four steps: a) Hospital registration phase, b) Offline registration phase, c) Information retrieval phase, and d) Information storage phase. Table 2 lists out the notations used throughout the paper. Figure 2 illustrates the hospital registration process with the cloud by the admin through the gateway. Admin generates the nonce (N 1 ) and concatenates the values R RN || P RN || H I D || N 1 to form α. The message α is encrypted using P U C to form β and the generated message (M 1 ) is sent to the gateway. Gateway receives the message β and generates the nonce N 2 which is encrypted using P U C to generate γ . The encrypted message is concatenated with β to form δ and the generated message M 2 is sent to the cloud. The received message is decrypted with P R C to compute followed by generation of nonce N 2 . The cloud verifies the freshness of the nonce N 2 . If N 2 is fresh, then the operation is continued else aborted. The cloud decrypts the message β with P R C to compute F. Cloud also verifies the freshness of nonce N 1 , if fresh then operation is carried on else canceled. The computed value G is encrypted with a key, K T A . Using the hash function, K T G is obtained (= H(N 2 ). The obtained key, K T G , is used to encrypt the nonce N 4 to form L. The message L is concatenated with K and stored in M.

Hospital registration
The message M is sent to the gateway. The gateway computes the K T G by taking the hash of N 2 . The message L is decrypted using K T G to form R. The freshness of N 4 is checked if found true then the process recommences else it is stopped. Gateway sends the value K as the message M 4 to the admin. Admin computes the hash value of {R RN || P RN || H I D || N 1 } to generate K T A . The received message K is decrypted with K T A to generate Y. The freshness of nonce N 3 is checked at this stage, if found fresh, then the operation is returned to where it was left off. Finally, the admin is able to retrieve the master key (M K ) successfully. This master key is a secret key to securing the communications between the gateway and the cloud. In the offline registration phase, the unique identifiers help the admin ensure that the patient's records' privacy is maintained. The admin gives the patient access to only those doctors and nurses who are treating that particular patient.

Offline registration
The proposed scheme enables the admin to choose stakeholders' access rights to the information stored in the cloud. Table 3 provides the default settings used by the administrator, where doctors treating the patient has been given rights to access and store the information. In contrast,

Information retrieval phase
In Fig. 4

Information storage phase
In Fig. 5, the user device (doctor) generates the Nonce N 1 and concatenates the all other values D I D || P I D || D A || N 1 to generate φ. The value φ is encrypted with S K to give χ. Using the hash function, H(D I D ) is computed and stored in Q. Now user concatenates the values χ || Q to form W. Next, the user sends the message K 1 to the gateway. D I D is extracted from the database by the gateway and its hash value is calculated to form Z. Gateway compares, Z == Q for choosing the appropriate subkey for decryption. Next, gateway compute by decrypting the χ with S K . Now gateway checks the freshness of the nonce N 1 , if fresh then operation stays on else it is abandoned. Gateway generates the nonce N 2 which is concatenated with other values as H I D || P I D || D I D || D A || N 2 to generate ω. Next, ω gets encrypted using M K and result is stored in . Now gateway sends the message K 2 to cloud. Cloud decrypts the message using M K to prepare . Cloud evalutes the freshness of nonce After this, the gateway encrypts the message ∝ with S K and form ∈. Then gateway sends the message K 4 to user device (doctor). After receiving the message, the user decrypts the message ∅ = D(S K , ∈). Further, the user device examines the freshness of nonce N 4 , if found fresh, then the operation is carried forward else terminated. In the end, the user can retrieve the acknowledgment (A) successfully.
Similarly, the nurse and the patient can also use the proposed access model to securely access the cloud's information. We have shown only one instance, that of the doctor in the paper, since the process is identical for other stakeholders as well. Table 4 demonstrates the computational cost of different entities (device, gateway, and cloud) in all phases: hospital registration, information retrieval, and information storage phase. It can be seen from the Table 4 that resource constrained nodes, i.e., user's device is only computing few crypto operations in each phase; thus the proposed scheme is suitable for all resource constrained devices and applications. and 'tree automata-based on automatic approximations for the analysis of security protocols (TA4SP) [8].
However, only OFMC and CL-AtSe are considered for the present evaluation; SATMC and TA4SP are excluded because they do not support few cryptography operations used in the algorithm [9]. The simulation requires the conversion of protocol code to the 'High-Level Protocol Specification Language (HLPSL)'. Afterward, the HLPSL script is transformed into 'Intermediate Format' (IF) for understanding by OFMC and CL-AtSe backends [63]. The script consists of agent descriptions, session information, intruder capabilities, security goals, and environment details. The interested readers can refer to [64] for detailed knowledge on AVISPA. The backends of AVISPA produces any of these outcomes: 'safe', 'unsafe', and 'inconclusive'. Figure 6 demonstrates the robustness of the proposed protocol against various vulnerabilities. After many reiterations, it is concluded by AVISPA that the proposed protocol is safe to use for e-healthcare applications.

Informal analysis
The informal security analysis of our proposed scheme has been discussed in this sub-section.

Theorem 1 Resistant to replay attacks.
Proof of Theorem 1 Freshness in each session is guaranteed as the messages (M N , S N , K N ) are composed of nonce N 1 , N 2 , N 3 , N 4 . Every entity verifies the freshness of the message by examining the nonce present in the message. For example, when gateway sends the encrypted message δ = E(β || γ ) to cloud, it decrypts the message γ with P R C to form . Further cloud verifies the freshness of nonce N 2 , if found true, then operation goes on else it is closed. Assume that an attacker eavesdropped the message, δ = E(β || γ ) and Device   ), and tries to modify δ = E(β || γ )*. However, it is computationally difficult for the attacker to make any changes as the information is encrypted with the secret key. Neither the key nor the security credentials are ever shared in plain text over the unsecured medium. Therefore, the attacker does not find a way to modify the content. Similarly, other messages M N , S N , K N are ciphered to prevent modifications. Thus, the proposed scheme is secure against modification attacks.

Theorem 4 Proposed scheme exhibits data confidentiality.
Proof of Theorem 4 Revealing information to unreliable entities can pose serious threats to the existence of any network. Let us assume that an attacker eavesdrops a message, γ = E(P U C , N 2 ). Despite successful eavesdropping, the attacker would not be able to interpret the information due to the non-availability of the private key of Cloud, D(P R ? C , N 2 ). The Cloud has never shared its private key (P R C ) with anyone; therefore, the attacker remains unsuccessful in obtaining the information from the captured message. Similarly, the messages M N , S N , K N are also encrypted. Therefore, the confidentiality of the information is ensured at all levels of communication. The attacker does not have these keys, P U C , S K , M K . Thus the proposed scheme exhibits the security property of data confidentiality.

Theorem 5 Proposed scheme exhibits Authorization of legitimate stakeholders.
Proof of Theorem 5 The proposed cloud based e-healthcare system assigns a unique identity (D I D , P I D , etc.) to each stakeholder to classify the access level and the privileges assigned to each authorized entity. The proposed scheme allows only the authorized entities to communicate with the cloud. The admin during offline registration collects the identity details (UI D G , UI D H ) of the legitimate users and stores it in the cloud. Cloud generates a unique identifier for every user (D I D , P I D , etc.) and shares it with the admin. Admin provides the unique identifier to each user during offline registration and the secret subkey (S K ). During the communication, a user has to append its hashed identity (e.g., H(D I D ) along with the message. The hashed identity is verified at the gateway (G W ) to prevent the flow of unauthorized abuses. Moreover, the communication is encrypted using the admin's secret subkey and shared securely during offline registration. Therefore, permitting the authorized entities to communicate with the gateway. The scheme offers two-step authenticity verification, i.e., gateway and cloud. Cloud upon reception of messages also verifies the details (H I D , D I D , P I D , etc.). If the details do not match with the database, the request is aborted. Therefore, the proposed scheme only allows the authorized entities to read and write data in the cloud.

Comparative analysis
The Table 5 depicts a clear comparison of old and the proposed protocols' security properties. It can be observed from the last row in the Table 5 that the proposed scheme attains all the significant security properties (e.g., confidentiality, integrity, authorization, authentication and anonymity). In contrast, none of the traditional approaches is able to attain all of them, as is evident from all the rows of the table except the last one. Non-achievement of all essential security properties by not even a single traditional scheme points out the possible vulnerabilities and increased possibility of attacks. Therefore, based on the investigation, the proposed scheme is found more superior in contrast to the conventional schemes.

Conclusions
Cloud based e-healthcare services are becoming increasingly popular due to the easy availability and mobility of the patient's medical records. Practices like telemedicine have become a reality due to the cost-effective solutions provided by cloud service vendors. Despite the benefits, the framework of storing and accessing the information through the cloud is highly vulnerable due to the use of open wireless channels. The proposed scheme provides a secure interface of access that only permits the legitimate entities (doctors, nurses, etc.) to store and access the patient's information.
The scheme provides end-to-end encryption using multiple keys derived through KDF to preserve patient's sensitive information privacy. The hospital's burden of patient record keeping is eased, and the health records' access and storage are enhanced. Investigation reveals that the proposed scheme is lightweight and exhibits the must have security properties like confidentiality, integrity, authentication, freshness, etc. Security analysis revealed the scheme's robustness against various prominent attacks like message modification, MITMA, and replay, etc. The potential of the scheme for cloud based solutions is evident. However, the proposed scheme is not cost-effective for Low Power Wide Area Networks (LPWAN) using a local database. This is the future scope to enhance the scheme a cost-effective solution for LPWAN.