Robust ECC-based Authenticated Key Agreement Scheme with Privacy Protection for Telecare Medicine Information Systems

Abstract

To protect the transmission of the sensitive medical data, a secure and efficient authenticated key agreement scheme should be deployed when the healthcare delivery session is established via Telecare Medicine Information Systems (TMIS) over the unsecure public network. Recently, Islam and Khan proposed an authenticated key agreement scheme using elliptic curve cryptography for TMIS. They claimed that their proposed scheme is provably secure against various attacks in random oracle model and enjoys some good properties such as user anonymity. In this paper, however, we point out that any legal but malicious patient can reveal other user's identity. Consequently, their scheme suffers from server spoofing attack and off-line password guessing attack. Moreover, if the malicious patient performs the same time of the registration as other users, she can further launch the impersonation attack, man-in-the-middle attack, modification attack, replay attack, and strong replay attack successfully. To eliminate these weaknesses, we propose an improved ECC-based authenticated key agreement scheme. Security analysis demonstrates that the proposed scheme can resist various attacks and enables the patient to enjoy the remote healthcare services with privacy protection. Through the performance evaluation, we show that the proposed scheme achieves a desired balance between security and performance in comparisons with other related schemes.

Security analysis and design of an efficient ECC‐based two‐factor password authentication scheme

“…But, elliptic curve cryptosystem (ECC) is used to design an authentication scheme due to its small key size than RSA‐based cryptosystem. Therefore, ECC‐based authentication schemes have been developed by the researchers.…”

“…In , Chaudhry et al pointed out that Islam and Khan's scheme cannot prevent forgery attack and then designed another improved scheme. Furthermore, Zhang and Zhu disclosed that scheme in also suffers from off‐line password guessing and server spoofing attacks, respectively. Li et al , introduced a user authentication scheme with the ECC; however, Mishra et al highlighted that the scheme of Li et al , suffers from password guessing attack and replay attack.…”

An Improved RSA Based User Authentication and Session Key Agreement Protocol Usable in TMIS

“…Thereafter, Lu et al [30] also pointed out that the Arshad's [8] scheme cannot achieve complete security requirements and proposed an authentication scheme based on the elliptic curve cryptosystem. Very recently, Zhang-Zhu [45] pointed out that the Islam-Khan's [17] scheme is insecure against several security weaknesses and also proposed a improved scheme to enhance the mentioned security flaws. Recently, Giri et al [11] illustrated that the Khan et al's is insecure against off-line password guessing attack and they also proposed an improved scheme to withstand the mentioned attack.…”

An improved authenticated key agreement protocol for telecare medicine information system

“…In order to overcome the above defects, they proposed a new anonymous two-factor authentication protocol for TMIS. Recently, Zhang and Zhou ( 2015 ) pointed out that Islam et al’s protocol has many security defects such as: (1) Any legal but malicious patient can reveal other user’s identity; (2) An attacker can launch off-line password guessing attack and the impersonation attack if he knows legal user’s identity. Zhang et al then proposed a new ECC-based authenticated key agreement scheme in order to fix the above security problems.…”