Privacy Protection for E-Health Systems by Means of Dynamic Authentication and Three-Factor Key Agreement

Abstract

During the past decade, the electronic healthcare (e-health) system has been evolved into a more patient-oriented service with smaller and smarter wireless devices. However, these convenient smart devices have limited computing capacity and memory size, which makes it harder to protect the user's massive private data in the e-health system. Although some works have established a secure session key between the user and the medical server, the weaknesses still exist in preserving the anonymity with low energy consumption. Moreover, the misuse of biometric information in key agreement process may lead to privacy disclosure, which is irreparable. In this study, we design a dynamic privacy protection mechanism offering the biometric authentication at the server side whereas the exact value of the biometric template remains unknown to the server. And the user anonymity can be fully preserved during the authentication and key negotiation process because the messages transmitted with the proposed scheme are untraceable. Furthermore, the proposed scheme is proved to be semantic secure under the Real-or-Random Model. The performance analysis shows that the proposed scheme suits the e-health environment at the aspect of security and resource occupation.

An Improved Anonymous Authentication Protocol for Wearable Health Monitoring Systems

“…Before elaborating a security analysis, we summarize the following adversary model used in this work. (2) The attacker can extract all the secret data stored in MD if the lost/stolen mobile device is obtained by him [42,43] (3) The attacker can guess the user's identity and password offline by enumerating pairs in (ID and PW) from Cartesian product D ID × D PW in polynomial time, where D ID and D PW denote the identity space and the password space [37,44], respectively (4) The random numbers and the secret keys selected by each communication parties are adequately large to prevent the attacker from guessing these data successfully in polynomial time (5) The insider can obtain the registration request message of the user, and the insider can access the verifier table [45,46] 3.2. KSSTI Attack.…”

“…At present, electronic-health (e-health) services are greatly promoted with the significant advances in computer science, wireless communication technologies, low-power sensors, and various security solutions [1][2][3][4][5][6][7][8] have been developed to build secure e-health systems. Wireless sensor network (WSN) plays an important role in e-health via sensing, measuring, gathering patient's information for doctor's diagnosis, or recording in the medical server.…”

Privacy-preserving fusion of IoT and big data for e-health

“…Mutual authentication protocol is designed in [9] for smart city IoT application, which is constructed based on learning with errors complexity assumption. Zhang et al [10] suggest a three-factor key agreement protocol for e-health system, which supports dynamic authentication. Another key agreement protocol for multi-gateway IoT network is proposed in [11].…”

A Secure and Privacy-Aware Smart Health System with Secret Key Leakage Resilience

“…Dawoud et al [45] defined different scenarios for the integration of the ehealth systems with the cloud computing systems and these scenarios discussed the authentication and data processing in the different parts of the system. Zhang et al [46] proposed a three-factor authenticated key agreement scheme based on a dynamic authentication mechanism to protect the users privacy using for e-health systems, and it was proved to be semantically secure under the real or random model. Sahi et al [47] reviewed the latest research with regard to privacy preservation in e-Healthcare and explored whether this research offers any possible solutions to patient privacy requirements for e-Healthcare.…”