1
|
Gupta DS, Mazumdar N, Nag A, Singh JP. Secure data authentication and access control protocol for industrial healthcare system. JOURNAL OF AMBIENT INTELLIGENCE AND HUMANIZED COMPUTING 2023; 14:4853-4864. [PMID: 36684481 PMCID: PMC9838518 DOI: 10.1007/s12652-022-04370-2] [Citation(s) in RCA: 0] [Impact Index Per Article: 0] [Reference Citation Analysis] [Abstract] [Key Words] [Track Full Text] [Figures] [Subscribe] [Scholar Register] [Received: 12/02/2021] [Accepted: 07/30/2022] [Indexed: 05/25/2023]
Abstract
Because of recent COVID-19 epidemic, the Internet-of-Medical-Things (IoMT) has acquired a significant impetus to diagnose patients remotely, regulate medical equipment, and track quarantined patients via smart electronic devices installed at the patient's end. Nevertheless, the IoMT confronts various security and privacy issues, such as entity authentication, confidentiality, and integrity of health-related data, among others, rendering this technology vulnerable to different attacks. To address these concerns, a number of security procedures based on traditional cryptographic approaches, such as discrete logarithm and integer factorization problems, have been developed. All of these protocols, however, are vulnerable to quantum attacks. This paper, in this context, presents a data authentication and access control protocol for IoMT systems that can withstand quantum attacks. A comprehensive formal security assessment demonstrates that the proposed algorithm can endure both current and future threats. In terms of data computing, transmission, and key storage overheads, it also surpasses other related techniques.
Collapse
Affiliation(s)
- Daya Sagar Gupta
- Department of Computer Science and Engineering, Rajiv Gandhi Institute of Petroleum Technology Jais, Amethi, UP 229304 India
| | - Nabajyoti Mazumdar
- Department of Information Technology, Indian Institute of Information Technology Allahabad, Prayagraj, India
| | - Amitava Nag
- Department of Computer Science and Engineering, Central Institute of Technology Kokrajhar, BTR, Kokrajhar, India
| | - Jyoti Prakash Singh
- Department of Computer Science and Engineering, National Institute of Technology Patna, Patna, India
| |
Collapse
|
2
|
Chen Y, Chen J. A biometrics-based mutual authentication and key agreement protocol for TMIS using elliptic curve cryptography. MULTIMEDIA TOOLS AND APPLICATIONS 2022; 82:16009-16032. [PMID: 36250183 PMCID: PMC9553637 DOI: 10.1007/s11042-022-14007-3] [Citation(s) in RCA: 0] [Impact Index Per Article: 0] [Reference Citation Analysis] [Abstract] [Key Words] [Track Full Text] [Figures] [Subscribe] [Scholar Register] [Received: 03/14/2021] [Revised: 05/25/2021] [Accepted: 01/31/2022] [Indexed: 06/16/2023]
Abstract
Telecare Medicine Information System (TMIS) refers to a medical model that uses communication and information technology to realize multiple medical functions such as remote disease diagnosis, treatment, and health care. Because TMIS is carried out on an insecure public Internet, a large number of mutual authentication and key agreement protocols for TMIS have been proposed to protect the privacy of patients. Recently, Ostad-Sharif et al. proposed a novel anonymous authentication and key agreement scheme for TMIS. In this work, we will demonstrate that Ostad-Sharif et al.'s scheme exists the problems of strong authentication and inefficient password change, and it cannot resist the off-line password guessing attack. To overcome the weaknesses found in Ostad-Sharif et al.'s scheme, we propose a biometrics-based mutual authentication and key agreement protocol for TMIS, making full use of the advantages of one-way hash function and elliptic curve cryptosystem (ECC). The security of the proposed scheme is formally proved under the widely used random oracle model (ROM), and various known malicious attack resistances also are presented by the heuristic discussion. Compared with the existing related schemes, the computation cost and communication overhead of our scheme are reduced by 74.5% and 27.3% respectively.
Collapse
Affiliation(s)
- Yulei Chen
- School of Mathematics and Statistics, Zhoukou Normal University, Zhoukou, 466001 China
| | - Jianhua Chen
- School of Mathematics and Statistics, Wuhan University, Wuhan, 430072 China
| |
Collapse
|
3
|
Radhakrishnan N, Muniyandi AP. Dependable and Provable Secure Two-Factor Mutual Authentication Scheme Using ECC for IoT-Based Telecare Medical Information System. JOURNAL OF HEALTHCARE ENGINEERING 2022; 2022:9273662. [PMID: 35198134 PMCID: PMC8860519 DOI: 10.1155/2022/9273662] [Citation(s) in RCA: 0] [Impact Index Per Article: 0] [Reference Citation Analysis] [Abstract] [MESH Headings] [Track Full Text] [Download PDF] [Figures] [Subscribe] [Scholar Register] [Received: 12/06/2021] [Revised: 01/07/2022] [Accepted: 01/08/2022] [Indexed: 11/21/2022]
Abstract
With the recent tremendous growth in technology, the Internet of Things (IoT) Telecare Medicine Information System (TMIS) is the most widely used medical information system with prominent achievements. Authentication schemes, which use Smart cards, offer the best solution for TMIS applications that in turn provide efficiency and security. Furthermore, authentication schemes that combine passwords and smart cards are considered to be an effective solution for the two-factor authentication scheme. Such schemes contribute to high security along with the public-key cryptosystem. In this research work, a two-factor authentication technique that is both efficient and secure, which makes use of Elliptic Curve Cryptography (ECC) with smart cards, has been proposed. Here, we have used the fundamental assumptions of strong and collision free cryptographic Hash function and Elliptic Curve arithmetic. The proposed authentication technique protects user privacy by allowing registered users to change their passwords without revealing their identity to the server. The proposed authentication scheme has been subjected to formal and informal security investigations. In terms of efficiency and performance, the proposed two-factor authentication technique was compared with the existing relevant two-factor authentication schemes based on ECC. This scheme satisfies the two-factor authentication scheme's basic security standards.
Collapse
Affiliation(s)
- Niranchana Radhakrishnan
- School of Computer Science and Engineering, Vellore Institute of Technology, Vellore 632014, Tamil Nadu, India
| | - Amutha Prabakar Muniyandi
- School of Computer Science and Engineering, Vellore Institute of Technology, Vellore 632014, Tamil Nadu, India
| |
Collapse
|
4
|
da Fonseca MH, Kovaleski F, Picinin CT, Pedroso B, Rubbo P. E-Health Practices and Technologies: A Systematic Review from 2014 to 2019. Healthcare (Basel) 2021; 9:healthcare9091192. [PMID: 34574966 PMCID: PMC8470487 DOI: 10.3390/healthcare9091192] [Citation(s) in RCA: 27] [Impact Index Per Article: 9.0] [Reference Citation Analysis] [Abstract] [Key Words] [Track Full Text] [Download PDF] [Figures] [Journal Information] [Subscribe] [Scholar Register] [Received: 07/16/2021] [Revised: 08/17/2021] [Accepted: 08/26/2021] [Indexed: 12/17/2022] Open
Abstract
E-health can be defined as a set of technologies applied with the help of the internet, in which healthcare services are provided to improve quality of life and facilitate healthcare delivery. As there is a lack of similar studies on the topic, this analysis uses a systematic literature review of articles published from 2014 to 2019 to identify the most common e-health practices used worldwide, as well as the main services provided, diseases treated, and the associated technologies that assist in e-health practices. Some of the key results were the identification of the four most common practices used (mhealth or mobile health; telehealth or telemedicine; technology; and others) and the most widely used technologies associated with e-health (IoT, cloud computing, Big Data, security, and systems).
Collapse
Affiliation(s)
- Maria Helena da Fonseca
- Department of Production Engineering, Federal University of Technology—Paraná (UTFPR), Ponta Grossa 84017-220, Brazil; (F.K.); (C.T.P.)
- Correspondence: ; Tel.: +55-42-999388129
| | - Fanny Kovaleski
- Department of Production Engineering, Federal University of Technology—Paraná (UTFPR), Ponta Grossa 84017-220, Brazil; (F.K.); (C.T.P.)
| | - Claudia Tania Picinin
- Department of Production Engineering, Federal University of Technology—Paraná (UTFPR), Ponta Grossa 84017-220, Brazil; (F.K.); (C.T.P.)
| | - Bruno Pedroso
- Division of Physical Education, State University of Ponta Grossa—Paraná (UEPG), Ponta Grossa 84030-900, Brazil;
| | - Priscila Rubbo
- Department of Accounting Sciences, Federal University of Technology—Paraná (UTFPR), Pato Branco 85503-390, Brazil;
| |
Collapse
|
5
|
Singla R, Kaur N, Koundal D, Bharadwaj A. Challenges and Developments in Secure Routing Protocols for Healthcare in WBAN: A Comparative Analysis. WIRELESS PERSONAL COMMUNICATIONS 2021; 122:1767-1806. [PMID: 34456514 PMCID: PMC8380194 DOI: 10.1007/s11277-021-08969-0] [Citation(s) in RCA: 2] [Impact Index Per Article: 0.7] [Reference Citation Analysis] [Abstract] [Key Words] [Track Full Text] [Figures] [Subscribe] [Scholar Register] [Accepted: 08/09/2021] [Indexed: 06/13/2023]
Abstract
The rise in life expectancy of humans, COVID-19 pandemic and growing cost of medical services has brought up huge challenges for the government and healthcare industry. Due to unhealthy lifestyle, there is an increased need for continual health monitoring and diagnosis of diseases. Wireless Body Area Network (WBAN) is attracted attention of researchers as various biosensors can be embedded in or worn on the body of human beings for the measurement of health parameters. The patient's health data is then sent wirelessly to the physician for health analysis. The biosensors used to measure physiological parameters have limited power due to its small size and hence smaller form factor. For the longevity of the network, it is imperative to transmit the data in an energy-efficient manner. Moreover, the health information of the patient is stringently private. Hence, the privacy and security of transmitted information needs to be ensured. It necessitates the development of effective, lightweight and secure routing protocols that provides security with minimal use of resources. This paper has identified the numerous security requirements in WBANs and has provided the extensive review on existing secure routing protocols reported in the literature. A comparative analysis of the various existing state-of-the art secure routing protocols and critical analysis based on security techniques along with different performance parameters has been presented.
Collapse
Affiliation(s)
- Ripty Singla
- Department of Computer Science and Engineering, Chandigarh University, Mohali, India
| | - Navneet Kaur
- Department of Computer Science, Chandigarh University, Mohali, Punjab India
| | - Deepika Koundal
- Department of Virtualization, School of Computer Science, University of Petroleum & Energy Studies, Kandholi, Dehradun, Uttarakhand India
| | - Anuj Bharadwaj
- Department of Computer Science and Engineering, Chandigarh University, Mohali, India
| |
Collapse
|
6
|
Gupta BB, Prajapati V, Nedjah N, Vijayakumar P, El-Latif AAA, Chang X. Machine learning and smart card based two-factor authentication scheme for preserving anonymity in telecare medical information system (TMIS). Neural Comput Appl 2021. [DOI: 10.1007/s00521-021-06152-x] [Citation(s) in RCA: 5] [Impact Index Per Article: 1.7] [Reference Citation Analysis] [Track Full Text] [Journal Information] [Subscribe] [Scholar Register] [Indexed: 11/28/2022]
|
7
|
Sowjanya K, Dasgupta M, Ray S. Elliptic Curve Cryptography based authentication scheme for Internet of Medical Things. JOURNAL OF INFORMATION SECURITY AND APPLICATIONS 2021. [DOI: 10.1016/j.jisa.2021.102761] [Citation(s) in RCA: 3] [Impact Index Per Article: 1.0] [Reference Citation Analysis] [Track Full Text] [Subscribe] [Scholar Register] [Indexed: 11/24/2022]
|
8
|
Modified Chebyshev polynomial-based access control mechanism for secured data access in cloud computing environment. SERVICE ORIENTED COMPUTING AND APPLICATIONS 2020. [DOI: 10.1007/s11761-020-00307-9] [Citation(s) in RCA: 0] [Impact Index Per Article: 0] [Reference Citation Analysis] [Track Full Text] [Subscribe] [Scholar Register] [Indexed: 10/23/2022]
|
9
|
A dual privacy-preservation scheme for cloud-based eHealth systems. JOURNAL OF INFORMATION SECURITY AND APPLICATIONS 2019. [DOI: 10.1016/j.jisa.2019.04.010] [Citation(s) in RCA: 6] [Impact Index Per Article: 1.2] [Reference Citation Analysis] [Track Full Text] [Subscribe] [Scholar Register] [Indexed: 11/18/2022]
|
10
|
Punithavathi P, Geetha S, Karuppiah M, Islam SKH, Hassan MM, Choo KKR. A lightweight machine learning-based authentication framework for smart IoT devices. Inf Sci (N Y) 2019. [DOI: 10.1016/j.ins.2019.01.073] [Citation(s) in RCA: 42] [Impact Index Per Article: 8.4] [Reference Citation Analysis] [Track Full Text] [Journal Information] [Subscribe] [Scholar Register] [Indexed: 11/25/2022]
|
11
|
Kumar V, Ahmad M, Kumari A. A secure elliptic curve cryptography based mutual authentication protocol for cloud-assisted TMIS. TELEMATICS AND INFORMATICS 2019. [DOI: 10.1016/j.tele.2018.09.001] [Citation(s) in RCA: 39] [Impact Index Per Article: 7.8] [Reference Citation Analysis] [Track Full Text] [Journal Information] [Subscribe] [Scholar Register] [Indexed: 11/17/2022]
|
12
|
Renuka K, Kumari S, Li X. Design of a Secure Three-Factor Authentication Scheme for Smart Healthcare. J Med Syst 2019; 43:133. [PMID: 30945011 DOI: 10.1007/s10916-019-1251-3] [Citation(s) in RCA: 14] [Impact Index Per Article: 2.8] [Reference Citation Analysis] [Abstract] [Key Words] [Track Full Text] [Journal Information] [Subscribe] [Scholar Register] [Received: 11/24/2018] [Accepted: 03/15/2019] [Indexed: 10/27/2022]
Abstract
Now-a-days, the society is witnessing a keen urge to enhance the quality of healthcare services with the intervention of technology in the health sector. The main focus in transforming traditional healthcare to smart healthcare is on facilitating the patients as well as medical professionals. However, this changover is not easy due to various issues of security and integrity associated with it. Security of patients's personal health record and privacy can be handled well by permitting only authorized access to the confidential health-data via suitably designed authentication scheme. In pursuit to contribute in this direction, we came across the role of Universal Serial Bus (USB), the most widely accepted interface, in enabling communication between peripheral devices and a host controller like laptop, personal computer, smart phone, tablet etc. In the process, we analysed a recently proposed a three-factor authentication scheme for consumer USB Mass Storage Devices (MSD) by He et al. In this paper, we demonstrate that He et al.'s scheme is vulnerable to leakage of temporary but session specific information attacks, late detection of message replay, forward secrecy attacks, and backward secrecy attacks. Then motivated with the benefits of USB, we propose a secure three-factor authentication scheme for smart healthcare.
Collapse
Affiliation(s)
- Km Renuka
- Department of Mathematics, Chaudhary Charan Singh University, Meerut, Uttar Pradesh, 250004, India
| | - Saru Kumari
- Department of Mathematics, Chaudhary Charan Singh University, Meerut, Uttar Pradesh, 250004, India
| | - Xiong Li
- School of Computer Science and Engineering, Hunan University of Science and Technology, Xiangtan, 411201, China.
| |
Collapse
|
13
|
Kumar D, Chand S, Kumar B. A PKC-based user authentication scheme without smart card. JOURNAL OF INTELLIGENT & FUZZY SYSTEMS 2018. [DOI: 10.3233/jifs-169820] [Citation(s) in RCA: 1] [Impact Index Per Article: 0.2] [Reference Citation Analysis] [Track Full Text] [Journal Information] [Subscribe] [Scholar Register] [Indexed: 11/15/2022]
Affiliation(s)
- Devender Kumar
- Division of Information Technology, NSIT, New Delhi, India
| | - Satish Chand
- School of Computer and System Sciences, JNU, New Delhi, India
| | - Bijendra Kumar
- Division of Computer Engineering, NSIT, New Delhi, India
| |
Collapse
|
14
|
Xu D, Chen J, Zhang S, Liu Q. Privacy-Preserving and Efficient Truly Three-Factor Authentication Scheme for Telecare Medical Information Systems. J Med Syst 2018; 42:219. [PMID: 30280263 DOI: 10.1007/s10916-018-1047-x] [Citation(s) in RCA: 10] [Impact Index Per Article: 1.7] [Reference Citation Analysis] [Abstract] [Key Words] [MESH Headings] [Track Full Text] [Journal Information] [Subscribe] [Scholar Register] [Received: 11/01/2017] [Accepted: 08/27/2018] [Indexed: 11/26/2022]
Abstract
Significant development of information technologies has made Telecare Medical Information Systems (TMISs) increasingly popular. In a TMIS, patients upload their medical data through smart devices to obtain a doctor's diagnosis. However, these smart devices have limited computing and storage capacities, so it is difficult to store substantial patient information and to support time-consuming operations. Moreover, although many three-factor authentication protocols have been proposed for TMISs, the problems of privacy leaks and other security flaws are serious. In addition, authentication factors are verified at the user side in most protocols, giving users a high level of trust and resulting in a potential lack of security. In this paper, we propose a novel efficient truly three-factor authentication protocol for TMISs. In our proposed protocol, three factors (i.e., password, smart card and biometrics) are verified at the server side, which reduces the storage and computational burden of the user side. Additionally, our proposed protocol uses only lightweight operators and is thus efficient. A formal proof analysis demonstrates that our proposed protocol is provably secure in the random oracle model. The performance evaluation shows that the proposed protocol is very efficient and suitable for TMISs.
Collapse
Affiliation(s)
- Dongqing Xu
- School of Mathematics and Statistics, Wuhan University, Wuhan, China
| | - Jianhua Chen
- School of Mathematics and Statistics, Wuhan University, Wuhan, China
| | - Shu Zhang
- School of Mathematics and Statistics, Wuhan University, Wuhan, China
| | - Qin Liu
- Key Laboratory of Aerospace Information Security and Trusted Computing Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan, 430072, China.
| |
Collapse
|
15
|
Cryptanalysis and Biometric-Based Enhancement of a Remote User Authentication Scheme for E-Healthcare System. ARABIAN JOURNAL FOR SCIENCE AND ENGINEERING 2018. [DOI: 10.1007/s13369-018-3220-4] [Citation(s) in RCA: 13] [Impact Index Per Article: 2.2] [Reference Citation Analysis] [Track Full Text] [Subscribe] [Scholar Register] [Indexed: 10/17/2022]
|
16
|
Li CT, Shih DH, Wang CC. Cloud-assisted mutual authentication and privacy preservation protocol for telecare medical information systems. COMPUTER METHODS AND PROGRAMS IN BIOMEDICINE 2018; 157:191-203. [PMID: 29477428 DOI: 10.1016/j.cmpb.2018.02.002] [Citation(s) in RCA: 15] [Impact Index Per Article: 2.5] [Reference Citation Analysis] [Abstract] [Key Words] [MESH Headings] [Track Full Text] [Subscribe] [Scholar Register] [Received: 12/12/2017] [Revised: 01/25/2018] [Accepted: 02/02/2018] [Indexed: 06/08/2023]
Abstract
BACKGROUND AND OBJECTIVE With the rapid development of wireless communication technologies and the growing prevalence of smart devices, telecare medical information system (TMIS) allows patients to receive medical treatments from the doctors via Internet technology without visiting hospitals in person. By adopting mobile device, cloud-assisted platform and wireless body area network, the patients can collect their physiological conditions and upload them to medical cloud via their mobile devices, enabling caregivers or doctors to provide patients with appropriate treatments at anytime and anywhere. In order to protect the medical privacy of the patient and guarantee reliability of the system, before accessing the TMIS, all system participants must be authenticated. METHODS Mohit et al. recently suggested a lightweight authentication protocol for cloud-based health care system. They claimed their protocol ensures resilience of all well-known security attacks and has several important features such as mutual authentication and patient anonymity. In this paper, we demonstrate that Mohit et al.'s authentication protocol has various security flaws and we further introduce an enhanced version of their protocol for cloud-assisted TMIS, which can ensure patient anonymity and patient unlinkability and prevent the security threats of report revelation and report forgery attacks. RESULTS The security analysis proves that our enhanced protocol is secure against various known attacks as well as found in Mohit et al.'s protocol. Compared with existing related protocols, our enhanced protocol keeps the merits of all desirable security requirements and also maintains the efficiency in terms of computation costs for cloud-assisted TMIS. CONCLUSIONS We propose a more secure mutual authentication and privacy preservation protocol for cloud-assisted TMIS, which fixes the mentioned security weaknesses found in Mohit et al.'s protocol. According to our analysis, our authentication protocol satisfies most functionality features for privacy preservation and effectively cope with cloud-assisted TMIS with better efficiency.
Collapse
Affiliation(s)
- Chun-Ta Li
- Department of Information Management, Tainan University of Technology, 529 Zhongzheng Road, Tainan City 71002, Taiwan, ROC.
| | - Dong-Her Shih
- Department of Information Management, National Yunlin University of Science and Technology, 123 University Road, Yunlin 64002, Taiwan, ROC.
| | - Chun-Cheng Wang
- Department of Information Management, National Yunlin University of Science and Technology, 123 University Road, Yunlin 64002, Taiwan, ROC
| |
Collapse
|
17
|
An Anonymity, Availability and Security-Ensured Authentication Model of the IoT Control System for Reliable and Anonymous eHealth Services. J Med Biol Eng 2018. [DOI: 10.1007/s40846-017-0351-0] [Citation(s) in RCA: 2] [Impact Index Per Article: 0.3] [Reference Citation Analysis] [Track Full Text] [Journal Information] [Subscribe] [Scholar Register] [Indexed: 11/29/2022]
|
18
|
Secure Authentication and Prescription Safety Protocol for Telecare Health Services Using Ubiquitous IoT. APPLIED SCIENCES-BASEL 2017. [DOI: 10.3390/app7101069] [Citation(s) in RCA: 22] [Impact Index Per Article: 3.1] [Reference Citation Analysis] [Track Full Text] [Subscribe] [Scholar Register] [Indexed: 11/16/2022]
|
19
|
Choi Y, Lee Y, Moon J, Won D. Security enhanced multi-factor biometric authentication scheme using bio-hash function. PLoS One 2017; 12:e0176250. [PMID: 28459867 PMCID: PMC5411053 DOI: 10.1371/journal.pone.0176250] [Citation(s) in RCA: 16] [Impact Index Per Article: 2.3] [Reference Citation Analysis] [Abstract] [MESH Headings] [Grants] [Track Full Text] [Download PDF] [Figures] [Journal Information] [Subscribe] [Scholar Register] [Received: 01/26/2017] [Accepted: 04/08/2017] [Indexed: 11/19/2022] Open
Abstract
With the rapid development of personal information and wireless communication technology, user authentication schemes have been crucial to ensure that wireless communications are secure. As such, various authentication schemes with multi-factor authentication have been proposed to improve the security of electronic communications. Multi-factor authentication involves the use of passwords, smart cards, and various biometrics to provide users with the utmost privacy and data protection. Cao and Ge analyzed various authentication schemes and found that Younghwa An’s scheme was susceptible to a replay attack where an adversary masquerades as a legal server and a user masquerading attack where user anonymity is not provided, allowing an adversary to execute a password change process by intercepting the user’s ID during login. Cao and Ge improved upon Younghwa An’s scheme, but various security problems remained. This study demonstrates that Cao and Ge’s scheme is susceptible to a biometric recognition error, slow wrong password detection, off-line password attack, user impersonation attack, ID guessing attack, a DoS attack, and that their scheme cannot provide session key agreement. Then, to address all weaknesses identified in Cao and Ge’s scheme, this study proposes a security enhanced multi-factor biometric authentication scheme and provides a security analysis and formal analysis using Burrows-Abadi-Needham logic. Finally, the efficiency analysis reveals that the proposed scheme can protect against several possible types of attacks with only a slightly high computational cost.
Collapse
Affiliation(s)
- Younsung Choi
- Department of Cyber Security, Howon University, Impi-Myeon, Gunsan-Si, Jeonrabuk-Do 573-718, Korea
| | - Youngsook Lee
- Department of Cyber Security, Howon University, Impi-Myeon, Gunsan-Si, Jeonrabuk-Do 573-718, Korea
| | - Jongho Moon
- Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 440-746, Korea
| | - Dongho Won
- Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 440-746, Korea
- * E-mail:
| |
Collapse
|
20
|
Mohit P, Amin R, Karati A, Biswas GP, Khan MK. A Standard Mutual Authentication Protocol for Cloud Computing Based Health Care System. J Med Syst 2017; 41:50. [PMID: 28213882 DOI: 10.1007/s10916-017-0699-2] [Citation(s) in RCA: 60] [Impact Index Per Article: 8.6] [Reference Citation Analysis] [Abstract] [Key Words] [Track Full Text] [Journal Information] [Subscribe] [Scholar Register] [Received: 08/24/2016] [Accepted: 02/05/2017] [Indexed: 11/28/2022]
Abstract
Telecare Medical Information System (TMIS) supports a standard platform to the patient for getting necessary medical treatment from the doctor(s) via Internet communication. Security protection is important for medical records (data) of the patients because of very sensitive information. Besides, patient anonymity is another most important property, which must be protected. Most recently, Chiou et al. suggested an authentication protocol for TMIS by utilizing the concept of cloud environment. They claimed that their protocol is patient anonymous and well security protected. We reviewed their protocol and found that it is completely insecure against patient anonymity. Further, the same protocol is not protected against mobile device stolen attack. In order to improve security level and complexity, we design a light weight authentication protocol for the same environment. Our security analysis ensures resilience of all possible security attacks. The performance of our protocol is relatively standard in comparison with the related previous research.
Collapse
Affiliation(s)
- Prerna Mohit
- Department of Computer Science and Engineering, Indian Institute of Technology (ISM), Dhanbad, 826004, Jharkhand, India
| | - Ruhul Amin
- Department of Computer Science and Engineering, Thapar University, Patiala, 147004, Punjab, India.
| | - Arijit Karati
- Department of Computer Science and Engineering, Indian Institute of Technology (ISM), Dhanbad, 826004, Jharkhand, India
| | - G P Biswas
- Department of Computer Science and Engineering, Indian Institute of Technology (ISM), Dhanbad, 826004, Jharkhand, India
| | - Muhammad Khurram Khan
- Center of Excellence in Information Assurance, King Saud University, Riyadh, Saudi Arabia
| |
Collapse
|
21
|
Liu X, Zhang R, Liu Q. A Temporal Credential-Based Mutual Authentication with Multiple-Password Scheme for Wireless Sensor Networks. PLoS One 2017; 12:e0170657. [PMID: 28135288 PMCID: PMC5279753 DOI: 10.1371/journal.pone.0170657] [Citation(s) in RCA: 7] [Impact Index Per Article: 1.0] [Reference Citation Analysis] [Abstract] [MESH Headings] [Track Full Text] [Download PDF] [Figures] [Journal Information] [Subscribe] [Scholar Register] [Received: 03/16/2016] [Accepted: 01/09/2017] [Indexed: 11/19/2022] Open
Abstract
Wireless sensor networks (WSNs), which consist of a large number of sensor nodes, have become among the most important technologies in numerous fields, such as environmental monitoring, military surveillance, control systems in nuclear reactors, vehicle safety systems, and medical monitoring. The most serious drawback for the widespread application of WSNs is the lack of security. Given the resource limitation of WSNs, traditional security schemes are unsuitable. Approaches toward withstanding related attacks with small overhead have thus recently been studied by many researchers. Numerous studies have focused on the authentication scheme for WSNs, but most of these works cannot achieve the security performance and overhead perfectly. Nam et al. proposed a two-factor authentication scheme with lightweight sensor computation for WSNs. In this paper, we review this scheme, emphasize its drawbacks, and propose a temporal credential-based mutual authentication with a multiple-password scheme for WSNs. Our scheme uses multiple passwords to achieve three-factor security performance and generate a session key between user and sensor nodes. The security analysis phase shows that our scheme can withstand related attacks, including a lost password threat, and the comparison phase shows that our scheme involves a relatively small overhead. In the comparison of the overhead phase, the result indicates that more than 95% of the overhead is composed of communication and not computation overhead. Therefore, the result motivates us to pay further attention to communication overhead than computation overhead in future research.
Collapse
Affiliation(s)
- Xin Liu
- School of information Science & Engineering, Lanzhou University, Lanzhou, China
| | - Ruisheng Zhang
- School of information Science & Engineering, Lanzhou University, Lanzhou, China
| | - Qidong Liu
- School of information Science & Engineering, Lanzhou University, Lanzhou, China
| |
Collapse
|
22
|
Jung J, Kang D, Lee D, Won D. An Improved and Secure Anonymous Biometric-Based User Authentication with Key Agreement Scheme for the Integrated EPR Information System. PLoS One 2017; 12:e0169414. [PMID: 28046075 PMCID: PMC5207724 DOI: 10.1371/journal.pone.0169414] [Citation(s) in RCA: 26] [Impact Index Per Article: 3.7] [Reference Citation Analysis] [Abstract] [MESH Headings] [Track Full Text] [Download PDF] [Figures] [Journal Information] [Subscribe] [Scholar Register] [Received: 10/11/2016] [Accepted: 12/17/2016] [Indexed: 12/04/2022] Open
Abstract
Nowadays, many hospitals and medical institutes employ an authentication protocol within electronic patient records (EPR) services in order to provide protected electronic transactions in e-medicine systems. In order to establish efficient and robust health care services, numerous studies have been carried out on authentication protocols. Recently, Li et al. proposed a user authenticated key agreement scheme according to EPR information systems, arguing that their scheme is able to resist various types of attacks and preserve diverse security properties. However, this scheme possesses critical vulnerabilities. First, the scheme cannot prevent off-line password guessing attacks and server spoofing attack, and cannot preserve user identity. Second, there is no password verification process with the failure to identify the correct password at the beginning of the login phase. Third, the mechanism of password change is incompetent, in that it induces inefficient communication in communicating with the server to change a user password. Therefore, we suggest an upgraded version of the user authenticated key agreement scheme that provides enhanced security. Our security and performance analysis shows that compared to other related schemes, our scheme not only improves the security level, but also ensures efficiency.
Collapse
Affiliation(s)
- Jaewook Jung
- Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 16419, Korea
| | - Dongwoo Kang
- Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 16419, Korea
| | - Donghoon Lee
- Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 16419, Korea
| | - Dongho Won
- Department of Computer Engineering, Sungkyunkwan University, 2066 Seoburo, Suwon, Gyeonggido 16419, Korea
- * E-mail:
| |
Collapse
|
23
|
Secure and Efficient Two-Factor User Authentication Scheme with User Anonymity for Network Based E-Health Care Applications. J Med Syst 2016; 40:268. [PMID: 27734256 DOI: 10.1007/s10916-016-0629-8] [Citation(s) in RCA: 28] [Impact Index Per Article: 3.5] [Reference Citation Analysis] [Abstract] [Key Words] [Track Full Text] [Journal Information] [Subscribe] [Scholar Register] [Received: 06/29/2016] [Accepted: 09/28/2016] [Indexed: 10/20/2022]
Abstract
Benefited from the development of network and communication technologies, E-health care systems and telemedicine have got the fast development. By using the E-health care systems, patient can enjoy the remote medical service provided by the medical server. Medical data are important privacy information for patient, so it is an important issue to ensure the secure of transmitted medical data through public network. Authentication scheme can thwart unauthorized users from accessing services via insecure network environments, so user authentication with privacy protection is an important mechanism for the security of E-health care systems. Recently, based on three factors (password, biometric and smart card), an user authentication scheme for E-health care systems was been proposed by Amin et al., and they claimed that their scheme can withstand most of common attacks. Unfortunate, we find that their scheme cannot achieve the untraceability feature of the patient. Besides, their scheme lacks a password check mechanism such that it is inefficient to find the unauthorized login by the mistake of input a wrong password. Due to the same reason, their scheme is vulnerable to Denial of Service (DoS) attack if the patient updates the password mistakenly by using a wrong password. In order improve the security level of authentication scheme for E-health care application, a robust user authentication scheme with privacy protection is proposed for E-health care systems. Then, security prove of our scheme are analysed. Security and performance analyses show that our scheme is more powerful and secure for E-health care systems when compared with other related schemes.
Collapse
|
24
|
An Efficient and Practical Smart Card Based Anonymity Preserving User Authentication Scheme for TMIS using Elliptic Curve Cryptography. J Med Syst 2015; 39:180. [DOI: 10.1007/s10916-015-0351-y] [Citation(s) in RCA: 53] [Impact Index Per Article: 5.9] [Reference Citation Analysis] [Track Full Text] [Journal Information] [Subscribe] [Scholar Register] [Received: 05/09/2015] [Accepted: 09/17/2015] [Indexed: 10/23/2022]
|