Analysis and Improvement of a Privacy-Preserving Authentication Scheme for Telecare Medical Information System Environment

Shufang NIU; Baoyuan KANG; Anqian LI; Yuyan HUO; Xinyu ZUO

doi:10.1051/wujns/2023286531

All issues

Volume 28 / No 6 (December 2023)

Wuhan Univ. J. Nat. Sci., 28 6 (2023) 531-540

Full HTML

Open Access

Issue		Wuhan Univ. J. Nat. Sci. Volume 28, Number 6, December 2023


Page(s)		531 - 540
DOI		https://doi.org/10.1051/wujns/2023286531
Published online		15 January 2024

Wuhan University Journal of Natural Sciences, 2023 Vol.28 No.6, 531-540

Computer Science

CLC number: TP309.2

Analysis and Improvement of a Privacy-Preserving Authentication Scheme for Telecare Medical Information System Environment

Shufang NIU¹, Baoyuan KANG²^†, Anqian LI², Yuyan HUO² and Xinyu ZUO²

¹ School of Computer Science and Technology, Tiangong University, Tianjin 300387, China
² School of Software, Tiangong University, Tianjin 300387, China

^† To whom correspondence should be addressed. E-mail: baoyankang@aliyun.com

Received: 23 May 2023

Abstract

Telecare Medical Information System (TMIS) can provide various telemedicine services to patients. However, information is communicated over an open channel. An attacker may intercept, replay, or modify this information. Therefore, many authentication schemes are proposed to provide secure communication for TMIS. Recently, Yu et al proposed a privacy-preserving authentication scheme in the Internet of Medical Things (IoMT)-enabled TMIS environments. They emphasize that their scheme is resistant to various attacks and ensures anonymity. Unfortunately, this paper demonstrates that Yu et al's scheme is vulnerable to impersonation attacks, replay attacks, and tracking attacks and cannot mutually authenticate. To overcome the shortcomings of Yu et al's scheme, we mainly improve the authentication and key agreement process and propose a corresponding improved scheme. We also compare the improved scheme with several existing authentication schemes in terms of security and computational efficiency.

Key words: medical / authentication scheme / Telecare Medical Information System (TMIS) / privacy-preserving

Biography: NIU Shufang, female, Master candidate, research direction: cryptography. E-mail:shufangniu@aliyun.com

© Wuhan University 2023

This is an Open Access article distributed under the terms of the Creative Commons Attribution License (https://creativecommons.org/licenses/by/4.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

0 Introduction

With the rapid development of network and information technology, the Telecare Medical Information System (TMIS) provides an efficient and convenient connection between patients and medical servers. Patients can collect their physiological data, such as blood glucose, blood pressure, body temperature, and heart rate, through wearable sensor devices (smart wristbands or sensors deployed in or on the body, etc.) and access medical services through public networks at any time and place. While providing this convenience, protecting the patient's privacy and providing security in TMIS is imperative. In TMIS, the telecare server maintains patients' confidentiality and medical information, including identity, password, and electronic medical records^[1]. Only legitimate patients can access their medical information to protect their privacy and the confidentiality of medical information. Since the communication is transmitted in a public channel, the transmitted data can be intercepted or even tampered with by a malicious attacker. When a patient's transmitted information is tampered with, doctors will likely make the wrong diagnosis and treatment modality. All these can cause irreversible harm to the patient and is likely to threaten the patient's life. Therefore, ensuring secure information transmission is considered an issue in TMIS. Fortunately, authentication schemes can ensure privacy and secure communication between the patients and the remote servers, providing good anonymity and privacy protection for the patients. Simultaneously, authentication schemes are used in many areas to ensure secure communications^[2-4].So far, many authentication and key agreement schemes have been proposed for TMIS^[5-10].

In 2015, Chaudhry et al^[11] proposed an improved two-factor authentication scheme for telecare medical information systems. However, Qiu et al^[12] remarked that Chaudhry et al's scheme^[11] is prone to offline password guessing attack, user/server impersonation attack, and man-in-middle attack, and proposed a mutual authentication scheme based on elliptic curve cryptography for TMIS. In 2019, Gupta et al^[13] proposed a lightweight anonymous user authentication scheme for TMIS based only on simple XOR and a one-way cryptographic hash function. However, Hajian et al^[14] proved Gupta et al's^[13] scheme is vulnerable to desynchronization attack, compromised wearable devices, compromise gateway attack, offline guessing attack and privileged insider attacks. Subsequently, Hajian et al^[14] proposed a scalable healthcare authentication scheme with attack resilience and anonymous key agreement (SHAPARAK). In 2022, Yu et al^[15] proved that SHAPARAK^[14] suffers from many security drawbacks, such as man-in-the-middle (MITM), impersonation attacks, and session key disclosure attacks. Yu et al^[15] proposed a three-factor-based privacy-preserving scheme in IoMT-enabled TMIS environments (SALS-TMIS) to resolve the security ﬂaws of SHAPARAK^[14]. We prove that Yu et al's scheme^[15] is vulnerable to replay attacks, tracking attacks, and impersonation attacks. Moreover, Yu et al's scheme^[15] does not provide mutual authentication. Therefore, we propose an improved privacy-preserving authentication scheme for the telecare medical information system environment to resolve the security ﬂaws of Yu et al's scheme^[15]. Our improved scheme has good user anonymity and security and can resist all existing attacks.

The rest of the paper is organized as follows. In Section 1, we briefly review Yu et al's scheme. In Section 2, we analyze its weaknesses. The improved scheme is proposed in Section 3. Security cryptanalysis and comparisons are given in Section 4. Finally, the article is concluded in Section 5.

1 Review of Yu et al's Scheme

This section reviews Yu et al's scheme^[15]. It is a three-factor authentication scheme for TMIS, which includes the registration phase for the user and sensor device, the login and authentication phase, and the password change phase. For the sake of brevity, the password and biometric update phase is not reviewed here. Table 1 represents the notations of this paper.

Table 1

Notations

1.1 System Setup Process

This process includes the sensor device and the gateway setup processes. S registers SD_j and assigns the secret credentials to it. S chooses a sensor device's temporal identity TSID_j, a sensor device's identity SID_j, and a shared secret key $X_{S D_{j}}$ for each SD_j. Then, S stores {TSID_j, SID_j, $X_{S D_{j}}$ } in the memory of each SD_j. After that, S stores {TSID_j, SID_j, $X_{S D_{j}}$ , h (∙)} in a secure database. To register a GW_i, S chooses a shared secret key $X_{G D_{i}}$ , a gateway's identity GID_i, and a temporal identity TGID_i for each GW_i and then stores {TGID_i, GID_i, $X_{G D_{i}}$ , h (∙)} in the memory of GW_i. After that, S stores {TGID_i, GID_i, $X_{G D_{i}}$ , h (∙)} in a secure database.

1.2 Registration Process

1.2.1 User registration process

The user (U_i/GW_i) must register with TMIS Server (S) to access the medical services. This process is described in detail as follows:

Step 1 The user U_i/GW_i selects an ID_i, PW_i, and generates a random number RU_i. Then U_i/GW_i computes $H I D_{i} = h (I D_{i} | | R U_{i}), H P W_{i} = h (P W_{i} | | R U_{i})$ and sends ${H I D_{i}, H P W_{i}}$ to the S via a secure channel.

Step 2 Upon receiving the message, S computes $X_{i} = h (T G I D_{i} | | K_{i} | | X_{G D_{i}})$ , $Q_{i} = H I D_{i} \oplus h (X_{i} | | K_{i} | | X_{G D_{i}})$ . Then, S sends {X_i} to the U_i through a secure channel. Finally, S computes $W_{i} = E_{K_{i}} (X_{i}, H I D_{i})$ and stores {W_i} in a secure database.

Step 3 After receiving the message, the user imprints a biometric BIO_i and computes

$A_{i} = (R U_{i} | | X_{i}) \oplus h (I D_{i} | | P W_{i} | | B I O_{i})$

$B_{i} = h (H I D_{i} | | H P W_{i} | | R U_{i} | | X_{i})$

Finally, U_i/GW_i stores ${A_{i}, B_{i}}$ in the memory.

1.2.2 Sensor device process

SD_j must register with S to access healthcare services. This process is described in detail as follows:

Step 1 SD_j first generates a random number RS_j and computes

$S I_{j} = h (T S I D_{j} | | S I D_{j} | | R S_{j})$

$N_{j} = h (S I D_{j} | | X_{S D_{j}} | | T S I D_{j}) \oplus R S_{j}$

After that, SD_j sends ${S I_{j}, T S I D_{j}, N_{j}}$ to the GW_ivia a public channel.

Step 2 After getting the message, GW_i computes $U I_{i} = h (T S I D_{j} | | G I D_{i} | | X_{G D_{i}})$ and sends ${S I_{j}, T S I D_{j}, N_{j},$ $T G I D_{i}, U I_{i}}$ to the S.

Step 3 Upon getting the message, S computes $U I_{i}^{*} = h (T S I D_{j} | | G I D_{i} | | X_{G D_{i}})$ and checks whether $U I_{i}^{*} \overset{?}{=} U I_{i}$ . If it is correct, S computes $R S_{j} = h (S I D_{j} | | X_{S D_{j}} | | T S I D_{j}) \oplus N_{j}$ , $S I_{j}^{*} = h (T S I D_{j} | | S I D_{j} | | R S_{j})$ and checks whether $S I_{j}^{*} \overset{?}{=} S I_{j}$ . If it is valid, S computes

$d_{j} = h (S I D_{j} | | R S_{j} | | K_{i})$

$f_{j} = d_{j} \oplus h (S I D_{j} | | R S_{j} | | X_{S D_{j}})$

$g_{i} = h (G I D_{i} | | T G I D_{i} | | K_{i})$

$f_{i} = g_{i} \oplus h (G I D_{i} | | X_{G D_{i}} | | T G I D_{i})$

$T S_{j} = h (S I D_{j} | | d_{j} | | X_{S D_{j}} | | R S_{j})$

$T U_{i} = h (G I D_{i} | | g_{i} | | X_{G D_{i}})$

Then, S sends ${f_{j}, T S_{j}, f_{i}, T U_{i}}$ to the GW_ivia a public channel. Finally, S encrypts $S A_{j} = E_{K_{i}} (R S_{j})$ and then stores ${S A_{j}}$ in a secure channel.

Step 4 After getting the message, GW_i computes $g_{i} = f_{i} \oplus h (G I D_{i} | | X_{G D_{i}} | | T G I D_{i})$ , $T U_{i}^{*} = h (G I D_{i} | | g_{i} | | X_{G D_{i}})$ and verifies $T U_{i}^{*} \overset{?}{=} T U_{i}$ . If it is equal, GW_isends ${f_{j}, T S_{j}}$ to the SD_j and then stores {TSID_j} in the memory.

Step 5 Upon getting the message, SD_j computes $d_{j} = f_{j} \oplus h (S I D_{j} | | R S_{j} | | X_{S D_{j}})$ , $T S_{j}^{*} = h (S I D_{j} | | d_{j} | | X_{S D_{j}} | | R S_{j})$ and checks $T S_{j}^{*} \overset{?}{=} T S_{j}$ . If it is valid, SD_j computes $C_{j} = (d_{j} | | R S_{j}) \oplus h (X_{S D_{j}} | | S I D_{j})$ and then stores ${C_{j}}$ in the memory.

1.3 Authentication and Key Agreement Process

The registered GW_i and SD_j perform mutual authentication with S to establish a common session key between GW_i and SD_j. All messages are transmitted through a public channel. The detailed descriptions are as follows:

Step 1 U_i inputs a unique ID_i, PW_i, and imprints BIO_i into GW_i. Then, GW_icomputes

$(R U_{i} | | X_{i}) = A_{i} \oplus h (I D_{i} | | P W_{i} | | B I O_{i})$

$H I D_{i} = h (I D_{i} | | R U_{i})$

$H P W_{i} = h (P W_{i} | | R U_{i})$

$B_{i}^{*} = h (H I D_{i} | | H P W_{i} | | R U_{i} | | X_{i})$

and checks whether $B_{i}^{*} \overset{?}{=} B_{i}$ . If it is not equal, GW_i terminates the current session; otherwise, it generates a random nonce R_u and computes $M_{1} = R_{u} \oplus h (X_{i} | | X_{G D_{i}} | | T G I D_{i})$ , $A u t h_{u} = h (H I D_{i} | | T G I D_{i} | | R_{u} | | X_{i} | | X_{G D_{i}})$ . After that, GW_i sends ${M_{1}, A u t h_{u}, T G I D_{i}}$ to the SD_j through a public channel.

Step 2 After obtaining the message, SD_j computes $(d_{j} | | R S_{j}) = C_{j} \oplus h (X_{S D_{j}} | | S I D_{j})$ . After that, SD_j generates a random nonce R_s and computes $M_{2} = R_{s} \oplus h (R S_{j} | | d_{j} | |$ $X_{S D_{j}} | | T S I D_{j})$ , $A u t h_{s} = h (S I D_{j} | | T S I D_{j} | | R S_{j} | | R_{s} | | X_{S D_{j}})$ and then sends ${M_{1}, A u t h_{u}, T G I D_{i}, M_{2}, A u t h_{s}, T S I D_{j}}$ to S.

Step 3 Upon getting the message, S retrieves ${W_{i}, S A_{j}}$ in a secure database. After that, S decrypts $R S_{j} = D_{K_{i}} (S A_{j})$ and computes

$d_{j} = h (S I D_{j} | | R S_{j} | | K_{i})$

$R_{s} = M_{2} \oplus h (R S_{j} | | X_{S D_{j}} | | T S I D_{j})$

$A u t h_{s}^{*} = h (S I D_{j} | | T S I D_{j} | | R S_{j} | | R_{s} | | X_{S D_{j}})$

and then checks whether $A u t h_{s}^{*} \overset{?}{=} A u t h_{s}$ . If it is not valid, S aborts the current session. Otherwise, it decrypts $(X_{i}, H I D_{i}) = D_{K_{i}} (W_{i})$ and computes

$X_{i} = h (T G I D_{i} | | K_{i} | | X_{G D_{i}})$

$R_{u} = M_{1} \oplus h (X_{i} | | X_{G D_{i}} | | T G I D_{i})$

$A u t h_{u}^{*} = h (H I D_{i} | | T G I D_{i} | | R_{u} | | X_{i} | | X_{G D_{i}})$

Then S checks whether $A u t h_{u}^{*} \overset{?}{=} A u t h_{u}$ . If it is not equal, S terminates the current session, otherwise it computes

$T S I D_{j}^{n e w} = h (T S I D_{j} | | R_{s})$

$M_{3} = R_{u} \oplus h (d_{j} | | T S I D_{j} | | R S_{j} | | X_{S D_{j}})$

$A u t h_{t u} = h (T G I D_{i} | | H I D_{i} | | X_{G D_{i}} | | X_{i} | | R_{u})$

$A u t h_{t s} = h (T S I D_{j}^{n e w} | | S I D_{j} | | R S_{j} | | X_{S D_{j}} | | R_{s})$

Then, S sends ${M_{3}, A u t h_{t u}, A u t h_{t s}}$ to the SD_j through a public channel.

Step 4 After obtaining the message, SD_j computes

$T S I D_{j}^{n e w} = h (T S I D_{j} | | R_{s})$

$A u t h_{t s}^{*} = h (T S I D_{j}^{n e w} | | S I D_{j} | | R S_{j} | | X_{S D_{j}} | | R_{s})$

and verifies whether $A u t h_{t s}^{*} \overset{?}{=} A u t h_{t s}$ . If it is correct, SD_j computes $R_{u} = M_{3} \oplus h (d_{j} | | T S I D_{j} | | S I D_{j} | | R S_{j} | | X_{S D_{j}})$ , $M_{4} = R_{s} \oplus$ $h (R_{u} | | T G I D_{i} | | T S I D_{j})$ , $S K_{i j} = h (R_{u} | | R_{s} | | T G I D_{i} | | T S I D_{j})$ , $A u t h_{s u}$ $= h (T S I D_{j}^{n e w} | | T G I D_{i} | | S K_{i j})$ and updates TSID_jwith $T S I D_{j}^{n e w}$ . Finally, SD_j sends ${M_{4}, A u t h_{t u}, A u t h_{s u}}$ to the GW_i.

Step 5 Upon getting the message, GW_i computes $A u t h_{t u}^{*} = h (T G I D_{i} | | H I D_{i} | | X_{G D_{i}} | | X_{i} | | R_{u})$ and checks whether $A u t h_{t u}^{*} \overset{?}{=} A u t h_{t u}$ . If it is not valid, GW_i aborts the current session, otherwise it computes

$R_{s} = M_{4} \oplus h (R_{u} | | T G I D_{i} | | T S I D_{j})$

$T S I D_{j}^{n e w} = h (T S I D_{j} | | R_{s})$

$S K_{i j} = h (R_{u} | | R_{s} | | T G I D_{i} | | T S I D_{j})$

$A u t h_{s u}^{*} = h (T S I D_{j}^{n e w} | | T G I D_{i} | | S K_{i j})$

and then verifies whether $A u t h_{s u}^{*} \overset{?}{=} A u t h_{s u}$ . If it is correct, GW_i updates TSID_j within $T S I D_{j}^{n e w}$ in the memory. Consequently, the mutual authentication between each entity is successful, and a common session key is established between GW_i and SD_j successfully.

2 Flaws of Yu et al's Scheme

In this section, based on the "Dolev-Yao (DY)" threat model^[16], we show the security flaws of Yu et al's scheme^[15], such as replay attack, tracking attack, and fake sensor attack to Yu et al's scheme^[15]. Moreover, Yu et al's scheme^[15] does not provide mutual authentication.

2.1 Replay Attack

During the authentication and key agreement phases, information is transmitted in the public channel; a malicious attacker can intercept the message ${M_{1}, A u t h_{u}, T G I D_{i}}$ sent by the user (U_i/GW_i), and resend this message to the sensor device (SD_j). SD_j gets the message and computes $(d_{j} | | R S_{j}) = C_{j} \oplus h (X_{S D_{j}} | | S I D_{j})$ . SD_j then generates the random number $R_{s}^{'}$ and computes

$M_{2}^{'} = R_{s}^{'} \oplus h (R S_{j} | | d_{j} | | X_{S D_{j}} | | T S I D_{j}^{n e w})$

$A u t h_{s}^{'} = h (S I D_{j} | | T S I D_{j}^{n e w} | | R S_{j} | | R_{s}^{'} | | X_{S D_{j}})$

and sends the message ${M_{1}, A u t h_{u}, T G I D_{i}, M_{2}^{'},$ $A u t h_{s}^{'}, T S I D_{j}^{n e w}}$ to the TMIS Server (S). After S receives the message, it retrieves {W_i, SA_j} in its database. After that, S decrypts $R S_{j} = D_{k_{i}} (S A_{j})$ and computes

$d_{j} = h (S I D_{j} | | R S_{j} | | K_{i})$

$R_{s}^{'} = M_{2}^{'} \oplus h (R S_{j} | | X_{S D_{j}} | | T S I D_{j}^{n e w})$

$A u t {h_{s}^{'}}^{*} = h (S I D_{j} | | T S I D_{j}^{n e w} | | R S_{j} | | R_{s} | | X_{S D_{j}})$

and then S checks whether $A u t {h_{s}^{'}}^{*} \overset{?}{=} A u t h_{s}^{'}$ . These two values are equal, and the verification passes. S calculates

$(X_{i}, H I D_{i}) = D_{K_{i}} (W_{i})$

$X_{i} = h (T G I D_{i} | | K_{i} | | X_{G D_{i}})$

$R_{u} = M_{1} \oplus h (X_{i} | | X_{G D_{i}} | | T G I D_{i})$

$A u t h_{u}^{*} = h (H I D_{i} | | T G I D_{i} | | R_{u} | | X_{i} | | X_{G D_{i}})$

Then S checks whether $A u t h_{u}^{*} \overset{?}{=} A u t h_{u}$ , at this time $A u t h_{u}^{*} = A u t h_{u}$ , because it is the intercepted real message sent by the user (U_i/GW_i), then the verification passes. So, the replay attack is successful.

2.2 Tracking Attacks

Since malicious attackers are ubiquitous, during the authentication and key agreement phases, an attacker intercepts the messages sent by U_i/GW_i ${M_{1}, A u t h_{u}, T G I D_{i}}$ and the messages sent by SD_j ${M_{1}, A u t h_{u}, T G I D_{i}, M_{2},$ $A u t h_{s}, T S I D_{j}}$ . The TGID_i in these two messages is invariable in any session. Consequently, the attacker can know a message is from the same user. Hence, the attacker can track the user.

2.3 Sensor Impersonation Attacks

When a user U_i/GW_i authenticates with a sensor device SD_j to establish a session key, SD_j can obtain the U_i/GW_i's random number R_u, and get $h (X_{i} | | X_{G D_{i}} | | T G I D_{i})$ from M₁. In the next session, when this user U_i/GW_i authenticates with another sensor SD_k, the sensor device SD_j of the last session can play the role of an attacker to impersonate SD_k and reach a session key with the user U_i/GW_i. The specific attack process is as follows.

After user U_i/GW_i authenticates with SD_j to establish the session key, SD_j obtains the U_i/GW_i's random number R_u, $R_{u} = M_{3} \oplus h (d_{j} | | T S I D_{j} | | S I D_{j} | | R S_{j} | | X_{S D_{j}})$ . The sensor device SD_j solves $h (X_{i} | | X_{G D_{i}} | | T G I D_{i})$ according to the message M₁ by $h (X_{i} | | X_{G D_{i}} | | T G I D_{i}) = M_{1} \oplus R_{u}$ . Since X_i, $X_{G D_{i}}$ , and TGID_i are constant, the value of $h (X_{i} | | X_{G D_{i}} | |$ $T G I D_{i})$ is constant. This shows that SD_jobtains a critical secret value of U_i/GW_i.

In the next session, assume user U_i/GW_i authenticates with sensor device SD_k, and U_i/GW_i sends the message ${M_{1}^{'}, A u t h_{u}^{'}, T G I D_{i}}$ to SD_k. SD_k receives message from U_i and sends message

${M_{1}^{'}, A u t h_{u}^{'}, T G I D_{i}, M_{2}, A u t h_{s}, T S I D_{k}}$

to server S. Server S receives the message from SD_k and sends ${M_{3}, A u t h_{t u}, A u t h_{t s}}$ to SD_k. In such a process as described above, SD_j can intercept $T G I D_{i}, T S I D_{k}, M_{1}^{'},$ $A u t h_{t u}$ from these messages. Since the value of TGID_i is constant in any session, SD_j can identify the user U_i/GW_i. Since $h (X_{i} | | X_{G D_{i}} | | T G I D_{i})$ is known, SD_jcan get the random number $R_{u}^{'}$ selected by the user according to $M_{1}^{'}$ , $R_{u}^{'} = M_{1}^{'} \oplus h (X_{i} | | X_{G D_{i}} | | T G I D_{i})$ . Then SD_j picks a random number $R_{s}^{*}$ , and then calculates

$T S I {D_{k}^{n e w}}^{*} = h (T S I D_{k} | | R_{s}^{*})$

$M_{4}^{*} = R_{s}^{*} \oplus h (R_{u}^{'} | | T G I D_{i} | | T S I D_{k})$

$S {K_{i k}}^{*} = h (R_{u}^{'} | | R_{s}^{*} | | T G I D_{i} | | T S I D_{k})$

$A u t h_{s u}^{*} = h (T S I {D_{k}^{n e w}}^{*} | | T G I D_{i} | | S K_{i k}^{*})$

Then, SD_j sends the message ${M_{4}^{*}, A u t h_{t u}, A u t h_{s u}^{*}}$ to the user U_i/GW_i. After receiving the message ${M_{4}^{*}, A u t h_{t u}, A u t h_{s u}^{*}}$ , user U_i/GW_icalculates $A u t h_{t u}^{*} = h (T G I D_{i} | | H I D_{i} | | X_{G D_{i}} | | X_{i} | | R_{u})$ , verifies $A u t h_{t u}^{*} \overset{?}{=} A u t h_{t u}$ and the authentication will pass. U_i/GW_i computes

$R_{s}^{*} = M_{4}^{*} \oplus h (R_{u} | | T G I D_{i} | | T S I D_{k})$

$T S I {D_{k}^{n e w}}^{*} = h (T S I D_{k} | | R_{s}^{*})$

$S {K_{i k}}^{*} = h (R_{u} | | R_{s}^{*} | | T G I D_{i} | | T S I D_{k})$

$A u t {h_{s u}^{*}}^{*} = h (T S I {D_{k}^{n e w}}^{*} | | T G I D_{i} | | S K_{i k}^{*})$

and verifies $A u t {h_{s u}^{*}}^{*} \overset{?}{=} A u t h_{s u}^{*}$ , and the authentication can pass. U_i/GW_i replaces $T S I D_{k}$ in memory with $T S I {D_{k}^{n e w}}^{*}$ . SD_j successfully impersonates the sensor device SD_k and establishes a session key SK_ikwith U_i/GW_i.

2.4 The Scheme does not Achieve Mutual Authentication

Based on Section 2.3, because the attacker successfully impersonates the SD_k and makes the U_i/GW_i update the $T S I D_{k}$ of SD_k with $T S I {D_{k}^{n e w}}^{*}$ . But $T S I {D_{k}^{n e w}}^{*} \neq T S I D_{k}^{n e w}$ . The $T S I {D_{k}^{n e w}}^{*}$ is updated by the attacker SD_jand $T S I D_{k}^{n e w}$ is updated by TMIS server(S). The next time the U_i/GW_i tries to contact SD_k, the U_i/GW_i cannot contact the target SD_k because of the wrong SD_k's temporary identity $T S I {D_{k}^{n e w}}^{*}$ , and the scheme eventually fails and does not achieve mutual authentication.

3 Improved Scheme

In this section, we propose an improved secure and anonymous privacy-preserving authentication scheme to resolve the shortcomings of Yu et al's scheme^[15]. The improved scheme consists of three phases: user registration phase, sensor registration phase, and authentication and key agreement phase. However, the setup phase user and sensor device registration phases are the same as those of Yu et al's scheme^[15]. We mainly improve on the authentication and key agreement phase.

The registered GW_iand SD_j perform mutual authentication with S to establish a common session key between GW_i and SD_j. All messages are transmitted through a public channel. In Fig. 1, we present the authentication and key agreement of the improved scheme. The detailed descriptions of this phase are as follows:

Fig. 1

Authentication and key agreement phase of the proposed scheme

Step 1 U_i inputs a unique ID_i, PW_i, and imprints BIO_i into GW_i. Then, GW_icomputes

$(R U_{i} | | X_{i}) = A_{i} \oplus h (I D_{i} | | P W_{i} | | B I O_{i})$

$H I D_{i} = h (I D_{i} | | R U_{i})$

$H P W_{i} = h (P W_{i} | | R U_{i})$

$B_{i}^{*} = h (H I D_{i} | | H P W_{i} | | R U_{i} | | X_{i})$

and checks whether $B_{i}^{*} \overset{?}{=} B_{i}$ . If it is not equal, GW_i terminates the current session; otherwise, it generates a random nonce R_u and the current timestamps T₁. Then GW_i computes

$M_{1} = R_{u} \oplus h (X_{i} | | X_{G D_{i}} | | T G I D_{i} | | T_{1})$

$A u t h_{u} = h (H I D_{i} | | T G I D_{i} | | R_{u} | | X_{i} | | X_{G D_{i}} | | T_{1})$

After that, GW_i sends ${M_{1}, A u t h_{u}, T G I D_{i}, T_{1}}$ to the SD_j through a public channel.

Step 2 After obtaining the message, SD_j computes $(d_{j} | | R S_{j}) = C_{j} \oplus h (X_{S D_{j}} | | S I D_{j})$ . After that, SD_j generates a random nonce R_s and the current timestamps T₂. Then S computes $M_{2} = R_{s} \oplus h (R S_{j} | | d_{j} | | X_{S D_{j}} | | T S I D_{j} | | T_{2})$ , $A u t h_{s} = h (S I D_{j} | | T S I D_{j} | | R S_{j} | | R_{s} | | X_{S D_{j}} | | T_{2})$ and then sends ${M_{1}, A u t h_{u}, T G I D_{i}, M_{2}, A u t h_{s}, T S I D_{j}, T_{1}, T_{2}}$ to S.

Step 3 Upon getting the message, S retrieves ${W_{i}, S A_{j}}$ in a secure database by TGID_i and TSID_j. After that, S decrypts $R S_{j} = D_{K_{i}} (S A_{j})$ and computes

$d_{j} = h (S I D_{j} | | R S_{j} | | K_{i})$

$R_{s} = M_{2} \oplus h (R S_{j} | | d_{j} | | X_{S D_{j}} | | T S I D_{j} | | T_{2})$

$A u t h_{s}^{*} = h (S I D_{j} | | T S I D_{j} | | R S_{j} | | R_{s} | | X_{S D_{j}} | | T_{2})$

and then checks whether $A u t h_{s}^{*} \overset{?}{=} A u t h_{s}$ . If it is not valid, S aborts the current session. Otherwise, it decrypts $(X_{i}, H I D_{i}) = D_{K_{i}} (W_{i})$ and computes

$X_{i} = h (T G I D_{i} | | K_{i} | | X_{G D_{i}})$

$R_{u} = M_{1} \oplus h (X_{i} | | X_{G D_{i}} | | T G I D_{i} | | T_{1})$

$A u t h_{u}^{*} = h (H I D_{i} | | T G I D_{i} | | R_{u} | | X_{i} | | X_{G D_{i}} | | T_{1})$

and then checks whether $A u t h_{u}^{*} \overset{?}{=} A u t h_{u}$ . If it is not equal, S terminates the current session, otherwise it generates the current timestamps T₃ and computes

$T S I D_{j}^{n e w} = h (T S I D_{j} | | R_{s})$

$T G I D_{i}^{n e w} = h (T G I D_{i} | | G I D_{i} | | X_{G D_{i}} | | R_{u})$

$M_{3} = R_{u} \oplus h (d_{j} | | T S I D_{j} | | S I D_{j} | | R S_{j} | | X_{S D_{j}} | | T_{3})$

$A u t h_{t u} = h (T G I D_{i} | | H I D_{i} | | X_{G D_{i}} | | X_{i} | | R_{u} | | T_{3})$

$A u t h_{t s} = h (T S I D_{j}^{n e w} | | S I D_{j} | | R S_{j} | | X_{S D_{j}} | | R_{s} | | T_{3})$

Then S sends ${M_{3}, A u t h_{t u}, A u t h_{t s}, T_{3}}$ to the SD_j through a public channel. S updates TSID_jwith $T S I D_{j}^{n e w}$ and updates TGID_iwithin $T G I D_{i}^{n e w}$ in the memory.

Step 4 After obtaining the message, SD_j computes

$T S I D_{j}^{n e w} = h (T S I D_{j} | | R_{s})$

$A u t h_{t s}^{*} = h (T S I D_{j}^{n e w} | | S I D_{j} | | R S_{j} | | X_{S D_{j}} | | R_{s} | | T_{3})$

and verifies whether $A u t h_{t s}^{*} \overset{?}{=} A u t h_{t s}$ . If it is correct, SD_j generates the current timestamps T₄ and computes

$R_{u} = M_{3} \oplus h (d_{j} | | T S I D_{j} | | S I D_{j} | | R S_{j} | | X_{S D_{j}} | | T_{3})$

$M_{4} = R_{s} \oplus h (R_{u} | | T G I D_{i} | | T S I D_{j} | | T_{4})$

$S K_{i j} = h (R_{u} | | R_{s} | | T G I D_{i} | | T S I D_{j})$

$A u t h_{s u} = h (T S I D_{j}^{n e w} | | T G I D_{i} | | S K_{i j} | | T_{4})$

and updates TSID_jwith $T S I D_{j}^{n e w}$ . Finally, SD_j sends ${M_{4}, A u t h_{t u}, A u t h_{s u}, T_{3}, T_{4}}$ to GW_i.

Step 5 Upon getting the message, GW_i computes $A u t h_{t u}^{*} = h (T G I D_{i} | | H I D_{i} | | X_{G D_{i}} | | X_{i} | | R_{u} | | T_{3})$ and checks whether $A u t h_{t u}^{*} \overset{?}{=} A u t h_{t u}$ . If it is not valid, GW_iaborts the current session, otherwise it computes

$R_{s} = M_{4} \oplus h (R_{u} | | T G I D_{i} | | T S I D_{j} | | T_{4})$

$T S I D_{j}^{n e w} = h (T S I D_{j} | | R_{s})$

$T G I D_{i}^{n e w} = h (T G I D_{i} | | G I D_{i} | | X_{G D_{i}} | | R_{u})$

$S K_{i j} = h (R_{u} | | R_{s} | | T G I D_{i} | | T S I D_{j})$

$A u t h_{s u}^{*} = h (T S I D_{j}^{n e w} | | T G I D_{i} | | S K_{i j} | | T_{4})$

and then verifies whether $A u t h_{s u}^{*} \overset{?}{=} A u t h_{s u}$ . If it is correct, GW_i updates TSID_j with $T S I D_{j}^{n e w}$ and updates TGID_iwith $T G I D_{i}^{n e w}$ in the memory. Consequently, the mutual authentication between each entity is successful, and a common session key is established between GW_i and SD_j successfully.

4 Security Analysis and Comparison

In this section, we conducted a security analysis and comparison to demonstrate that our scheme provides various security features. Through the analysis, our proposed scheme prevents multiple security attacks, including impersonation attack,replay attack,tracking attack, MIMT attack, offline password guessing attack, perfect forward secrecy, and session key disclosure attack. In addition, our scheme ensures user anonymity and mutual authentication. We compare our scheme's computation costs and security features with the related schemes.

4.1 Security Analysis

4.1.1 Anonymity

In the improved scheme, on the one hand, no real identity is transmitted in the open channel, and the temporary identities TGID_i and TSID_jare transmitted. On the other hand, suppose an attacker eavesdrops the messages TGID_i and TSID_jfrom the public channel. However, the attacker cannot obtain the true identity ID_i of U_i and the true identity SID_j of SD_j because the identity information is protected by random numbers RU_i and RS_j, secret credentials X_i and d_j, shared secret keys $X_{G D_{i}}$ , $X_{S D_{j}}$ and biometric BIO_i through Hash and XOR functions. Moreover, the attacker cannot guess the correct identity since HID_i=h(ID_i||RU_i), (d_j||RS_j)=C_j⊕h( $X_{S D_{j}}$ ||SID_j), the attacker cannot gain HID_i, RU_i,d_j, RS_j, C_j and SID_j. Therefore, the improved scheme provides anonymity.

4.1.2 Replay attack

Since the messages are transmitted in a public channel, an attacker can eavesdrop or even tamper with the messages. The attacker may try to retransmit the intercepted message to server S or sensor device SD_jin an attempt to perform a replay attack, but this will not succeed because the improved scheme uses timestamps. When server S or sensor device SD_j receives the message, it will verify that the timestamp is within a reasonable interval and terminate the session as soon as it is outside the valid range. Even if the attacker modifies the intercepted timestamp to the current time, server S or sensor device SD_j will still terminate the session because the sent {M₁, Auth_u, M₂, Auth_s, M₃, Auth_tu, Auth_ts, Auth_su} all contain timestamps T₁, T₂, T₃, T₄ and for the attacker to make the sent message not be rejected, the attacker must modify {M₁, Auth_u, M₂, Auth_s, M₃, Auth_tu, Auth_ts, Auth_su}, but the attacker cannot modify these values. In order to modify these values, the attacker must know the random numbers {R_u, R_s}, the true identity {ID_i, SID_j}, the shared key { $X_{G D_{i}}$ , $X_{S D_{j}}$ }, and the secret credentials {X_i, d_j, RS_j}. And there is no way for the attacker to obtain these values. Therefore, the improved scheme can resist the replay attack.

4.1.3 Tracking attack

In the improved scheme, the temporary identities TGID_i and TSID_j are transmitted in the open channel. But TGID_i and TSID_j are updated in each session and cannot be traced even if an attacker picks them up. To try to know the updated TGID_i, TGID_i=h(TGID_i||GID_i|| $X_{G D_{i}}$ ||R_u), the attacker must obtain GID_i, $X_{G D_{i}}$ , R_u. But GID_i, $X_{G D_{i}}$ , and R_u are not available. Even if the attacker obtains the random number R_u, since $X_{G D_{i}}$ is the shared key of U_i and S, only U_i and S can know it, and from Section 4.1.1 we can know that the real identity GID_i attacker cannot obtain it. So, the improved scheme can effectively resist the tracking attack.

4.1.4 Impersonation attack

Suppose an attacker tries to perform impersonation by eavesdropping the transmitted messages on the public channel. However, in order to generate authentication request messages {M₁, Auth_u, TGID_i, T₁}, {M₁, Auth_u, TGID_i, M₂, Auth_s, TSID_j, T₁, T₂} or response messages {M₃, Auth_tu, Auth_ts, T₃}, {M₄, Auth_tu, Auth_su, T₃, T₄}, an attacker must know random numbers R_u and R_s, shared secret keys $X_{G D_{i}}$ and $X_{S D_{j}}$ , secret credentials X_i, d_j and RS_j and sensor device identity SID_j, but these values are invisible to the attacker. Even if an attacker obtains the random number R_u and gets h(X_i|| $X_{G D_{i}}$ ||TGID_i||T₁) by M₁ to try to impersonate the sensor device, this approach is not feasible. Because h(X_i|| $X_{G D_{i}}$ ||TGID_i||T₁) contains the timestamp T₁, the value of h(X_i|| $X_{G D_{i}}$ ||TGID_i||T₁) changes in each session. Therefore, the improved scheme can effectively resist the impersonation attack.

4.1.5 Perfect forward secrecy

Suppose the attacker eavesdrops on the transmitted message {M₁, Auth_u, TGID_i, M₂, TSID_j, T₂}. Then, an attacker can attempt to calculate SK_ij=h(R_u||R_s||TGID_i||TSID_j). But an attacker cannot obtain the random nonce R_u and R_s. Even if the session key SK_ijof this communication is compromised, it will not compromise the session key of the last communication because the random numbers R_u and R_s in the session key are randomly generated. Therefore, the improved scheme has excellent forward security.

4.1.6 Offline password guessing attack

Suppose an attacker tries to guess the real password PW_iof the legitimate user U_i based on HID_i, the attacker must know RU_i and HID_i, but these two values are unknown to the attacker. If the attacker extracts all the secret parameters {A_i, B_i} in the mobile device's memory and tries to guess PW_i based on A_i, the attacker must know the user's unique biometric BIO_i, a real identity ID_i, a random number RU_i and the secret value X_i. Because the attacker has no way to obtain U_i's biometric BIO_i, identity ID_i, random number RU_i, and secret value X_i. Therefore, it is impossible for the attacker to correctly guess U_i's real password PW_i.

4.1.7 Session key disclosure attack

To obtain the session key SK_ij, an attacker must obtain the random numbers R_u and R_s. But the random numbers are masked by the secret credentials X_i and d_j, shared secret keys $X_{G D_{i}}$ and $X_{S D_{j}}$ with hash and XOR functions. The attacker cannot obtain these values. Therefore, the improved scheme is secure against session key leakage attacks.

4.1.8 MITM attack

An attacker can eavesdrop on the information exchanged through the public channel. However, in order to generate authentication request messages {M₁, Auth_u, TGID_i, T₁}, {M₁, Auth_u, TGID_i, M₂, Auth_s, TSID_j, T₁, T₂} or response messages {M₃, Auth_tu, Auth_ts, T₃}, {M₄, Auth_tu, Auth_su, T₃, T₄}, an attacker must know random numbers R_u and R_s, shared secret keys $X_{G D_{i}}$ and $X_{S D_{j}}$ , secret credentials X_i, d_j, and RS_j and sensor device identity SID_j, but these values are invisible to the attacker. Therefore, the attacker cannot generate authentication messages or reach a session key. So, the improved scheme can effectively resist man-in-the-middle attacks.

4.1.9 Mutual authentication

In the process of mutual authentication and key agreement, all entities of scheme successfully authenticate each other. After obtaining the messages {M₁, Auth_u, TGID_i, M₂, Auth_s, TSID_j, T₁, T₂} of SD_j, S verifies that $A u t h_{u}^{*} \overset{?}{=} A u t h_{u}$ . If equal, S authenticates U_i/GW_i. And S verifies that $A u t h_{s}^{*} \overset{?}{=} A u t h_{s}$ . If equal, S authenticates to SD_j. After getting the message {M₃, Auth_tu, Auth_ts, T₃} from S, SD_j verifies whether $A u t h_{t s}^{*} \overset{?}{=} A u t h_{t s}$ . If the verification passes, SD_j authenticates to S. After receiving the messages {M₄, Auth_tu, Auth_su, T₄} from SD_j and S, U_i/GW_i verifies that $A u t h_{t u}^{*} \overset{?}{=} A u t h_{t u}$ $A u t h_{s u}^{*} \overset{?}{=} A u t h_{s u}$ . If the authentication passes, U_i/GW_i authenticates SD_j and S and establishes a common session key SK_ij with SD_j.

4.1.10 Stolen verifier attack

In this attack, the attacker steals the information stored in S's database related to U_i and SD_j and tries to impersonate the legitimate entity. However, the attackers cannot impersonate the legitimate entity even if they obtain the stored information {W_i, SA_j} from S's database because they cannot access the secret information related to U_i and SD_j without S's master key K_i. Thus, the stolen verifier attack is not viable in our scheme.

4.2 Comparision

Table 2 shows the experimental results obtained in Refs. [1,17] . The comparison results of computation costs and the security features are shown in Tables 3 and 4, respectively. Table 3 shows the improved scheme is superior to the schemes^[18,19] in terms of computation costs. Table 4 shows the comparison results of security features between the improved scheme and the relative schemes^[15,18,20]. Although the improved scheme has a higher computation cost than Refs. [15,20], it offers better security functionalities. Ref. [21] also has good safety properties, but its computational cost is higher than our scheme. Thus, the improved scheme is suitable for TMIS environments.

Table 2

Execution time

Table 3

Computation cost comparison (unit:s)

Table 4

Security features of different schemes

5 Conclusion

This paper shows that Yu et al's scheme is vulnerable to replay attack, tracking attacks, and impersonation attacks. To overcome the security flaws of their scheme, we propose an improved authentication scheme for the telecare medical information system environment. We conducted a security analysis to demonstrate that the improved scheme can prevent various security attacks, including impersonation attack, replay attack, tracking attack, MIMT attack, offline password guessing attack, user anonymity, mutual authentication, and perfect forward secrecy. And the improved scheme offers excellent anonymity. The improved scheme also provides lower computation costs and better security than related existing schemes. Therefore, the improved scheme is applicable for the TMIS environments.

References

Ryu J, Oh J, Kwon D, et al. Secure ECC-based three-factor mutual authentication protocol for telecare medical information system[J]. IEEE Access, 2022, 10: 11511-11526. [CrossRef] [Google Scholar]
Li R, Kang B Y, Mai K Q . Analysis and improvement on a Hash-based authentication scheme for multi-server architecture[J]. Wuhan University Journal of Natural Sciences, 2021, 26(5): 394-404. [Google Scholar]
Du J Q, Kang B Y, Han Y B. Improvement on a biometric based user authentication scheme in wireless sensor networks using smart cards[J]. Wuhan University Journal of Natural Sciences, 2020, 25(2): 155-161. [Google Scholar]
Kang B Y, Du J Q, Si L, et al. Analysis and improvement on a mobile payment protocol with outsourced verification in cloud service[J]. Wuhan University Journal of Natural Sciences, 2019, 24(3): 223-228. [CrossRef] [Google Scholar]
Radhakrishnan N, Muniyandi A P. Dependable and provable secure two-factor mutual authentication scheme using ECC for IoT-based telecare medical information system[J]. Journal of Healthcare Engineering, 2022, 2022:9273662. [CrossRef] [Google Scholar]
Shamshad S, Ayub M F, Mahmood K, et al. An identity-based authentication protocol for the telecare medical information system (TMIS) using a physically unclonable function[J]. IEEE Systems Journal, 2022, 16(3): 4831-4838. [NASA ADS] [CrossRef] [Google Scholar]
Tanveer M, Alkhayyat A, Chaudhry S A, et al. REAS-TMIS: Resource-efficient authentication scheme for telecare medical information system[J]. IEEE Access, 2022, 10: 23008-23021. [NASA ADS] [CrossRef] [Google Scholar]
Chen Y L, Chen J H. An efficient and privacy-preserving mutual authentication with key agreement scheme for telecare medicine information system[J]. Peer-to-Peer Networking and Applications, 2022, 15(1):516-528. [CrossRef] [Google Scholar]
Zhai X Y, Wang J. A multi-server biometric authentication scheme based on extended chaotic map for telecare medical information system[J]. Multimedia Tools and Applications, 2022, 81(28): 40159-40179. [CrossRef] [Google Scholar]
Chen Y L, Chen J H. A biometrics-based mutual authentication and key agreement protocol for TMIS using elliptic curve cryptography[J]. Multimedia Tools and Applications, 2023, 82(11): 16009-16032. [CrossRef] [PubMed] [Google Scholar]
Chaudhry S A, Naqvi H, Shon T, et al. Cryptanalysis and improvement of an improved two factor authentication protocol for telecare medical information systems[J]. Journal of Medical Systems, 2015, 39(6): 66. [Google Scholar]
Qiu S M, Xu G A, Ahmad H, et al. A robust mutual authentication scheme based on elliptic curve cryptography for telecare medical information systems[J]. IEEE Access, 2017, 6: 7452-7463. [Google Scholar]
Gupta A, Tripathi M, Shaikh T J, et al. A lightweight anonymous user authentication and key establishment scheme for wearable devices[J]. Computer Networks, 2019, 149: 29-42. [CrossRef] [Google Scholar]
Hajian R, ZakeriKia S, Erfani S H, et al. SHAPARAK: Scalable healthcare authentication protocol with attack-resilience and anonymous key-agreement[J]. Computer Networks, 2020, 183: 107567. [CrossRef] [Google Scholar]
Yu S, Park K. SALS-TMIS: Secure, anonymous, and lightweight privacy-preserving scheme for IoMT-enabled TMIS environments[J]. IEEE Access, 2022, 10: 60534-60549. [NASA ADS] [CrossRef] [Google Scholar]
Dolev D, Yao C C. On the security of public key protocols[C]// Symposium on Foundations of Computer Science. New York: IEEE, 1981. [Google Scholar]
Lee S, Kim S, Yu S, et al. Provably secure PUF-based lightweight mutual authentication scheme for wireless body area networks[J]. Electronics, 2022, 11(23): 3868. [CrossRef] [Google Scholar]
Wang Y B, Liu W R, Li B. An improved authentication protocol for smart healthcare system using wireless medical sensor network[J]. IEEE Access, 2021, 9: 105101-105117. [CrossRef] [Google Scholar]
Lee J Y, Oh J, Park Y. A secure and anonymous authentication protocol based on three-factor wireless medical sensor networks[J]. Electronics, 2023, 12(6): 1368. [CrossRef] [Google Scholar]
Gupta A, Tripathi M, Muhuri S, et al. A secure and lightweight anonymous mutual authentication scheme for wearable devices in Medical Internet of Things[J]. Journal of Information Security and Applications, 2022, 68: 103259. [CrossRef] [Google Scholar]
Wu T Y, Wang T, Lee Y Q, et al. Improved authenticated key agreement scheme for fog-driven IoT healthcare system[J]. Security and Communication Networks, 2021, 2021: 6658041. [Google Scholar]

All Tables

Notations

Execution time

Computation cost comparison (unit:s)

In the text

Table 4

Security features of different schemes

In the text

All Figures

	Fig. 1 Authentication and key agreement phase of the proposed scheme
In the text

Current usage metrics show cumulative count of Article Views (full-text article views including HTML views, PDF and ePub downloads, according to the available data) and Abstracts Views on Vision4Press platform.

Data correspond to usage on the plateform after 2015. The current usage metrics is available 48-96 hours after online publication and is updated daily on week days.

Initial download of the metrics may take a while.

Homepage

Table of Contents

Previous article Next article

Article contents

Metrics

Show article metrics

Services

Articles citing this article
CrossRef (3)
Same authors
- Google Scholar
- EDP Sciences database
- PubMed

Bookmarking

[1] Ryu J, Oh J, Kwon D, et al. Secure ECC-based three-factor mutual authentication protocol for telecare medical information system[J]. IEEE Access, 2022, 10: 11511-11526. [CrossRef] [Google Scholar]

[2] Li R, Kang B Y, Mai K Q . Analysis and improvement on a Hash-based authentication scheme for multi-server architecture[J]. Wuhan University Journal of Natural Sciences, 2021, 26(5): 394-404. [Google Scholar]

[3] Du J Q, Kang B Y, Han Y B. Improvement on a biometric based user authentication scheme in wireless sensor networks using smart cards[J]. Wuhan University Journal of Natural Sciences, 2020, 25(2): 155-161. [Google Scholar]

[4] Kang B Y, Du J Q, Si L, et al. Analysis and improvement on a mobile payment protocol with outsourced verification in cloud service[J]. Wuhan University Journal of Natural Sciences, 2019, 24(3): 223-228. [CrossRef] [Google Scholar]

[5] Radhakrishnan N, Muniyandi A P. Dependable and provable secure two-factor mutual authentication scheme using ECC for IoT-based telecare medical information system[J]. Journal of Healthcare Engineering, 2022, 2022:9273662. [CrossRef] [Google Scholar]

[6] Shamshad S, Ayub M F, Mahmood K, et al. An identity-based authentication protocol for the telecare medical information system (TMIS) using a physically unclonable function[J]. IEEE Systems Journal, 2022, 16(3): 4831-4838. [NASA ADS] [CrossRef] [Google Scholar]

[7] Tanveer M, Alkhayyat A, Chaudhry S A, et al. REAS-TMIS: Resource-efficient authentication scheme for telecare medical information system[J]. IEEE Access, 2022, 10: 23008-23021. [NASA ADS] [CrossRef] [Google Scholar]

[8] Chen Y L, Chen J H. An efficient and privacy-preserving mutual authentication with key agreement scheme for telecare medicine information system[J]. Peer-to-Peer Networking and Applications, 2022, 15(1):516-528. [CrossRef] [Google Scholar]

[9] Zhai X Y, Wang J. A multi-server biometric authentication scheme based on extended chaotic map for telecare medical information system[J]. Multimedia Tools and Applications, 2022, 81(28): 40159-40179. [CrossRef] [Google Scholar]

[10] Chen Y L, Chen J H. A biometrics-based mutual authentication and key agreement protocol for TMIS using elliptic curve cryptography[J]. Multimedia Tools and Applications, 2023, 82(11): 16009-16032. [CrossRef] [PubMed] [Google Scholar]

[11] Chaudhry S A, Naqvi H, Shon T, et al. Cryptanalysis and improvement of an improved two factor authentication protocol for telecare medical information systems[J]. Journal of Medical Systems, 2015, 39(6): 66. [Google Scholar]

[12] Qiu S M, Xu G A, Ahmad H, et al. A robust mutual authentication scheme based on elliptic curve cryptography for telecare medical information systems[J]. IEEE Access, 2017, 6: 7452-7463. [Google Scholar]

[13] Gupta A, Tripathi M, Shaikh T J, et al. A lightweight anonymous user authentication and key establishment scheme for wearable devices[J]. Computer Networks, 2019, 149: 29-42. [CrossRef] [Google Scholar]

[14] Hajian R, ZakeriKia S, Erfani S H, et al. SHAPARAK: Scalable healthcare authentication protocol with attack-resilience and anonymous key-agreement[J]. Computer Networks, 2020, 183: 107567. [CrossRef] [Google Scholar]

[15] Yu S, Park K. SALS-TMIS: Secure, anonymous, and lightweight privacy-preserving scheme for IoMT-enabled TMIS environments[J]. IEEE Access, 2022, 10: 60534-60549. [NASA ADS] [CrossRef] [Google Scholar]

[16] Dolev D, Yao C C. On the security of public key protocols[C]// Symposium on Foundations of Computer Science. New York: IEEE, 1981. [Google Scholar]

[17] Lee S, Kim S, Yu S, et al. Provably secure PUF-based lightweight mutual authentication scheme for wireless body area networks[J]. Electronics, 2022, 11(23): 3868. [CrossRef] [Google Scholar]

[18] Wang Y B, Liu W R, Li B. An improved authentication protocol for smart healthcare system using wireless medical sensor network[J]. IEEE Access, 2021, 9: 105101-105117. [CrossRef] [Google Scholar]

[19] Lee J Y, Oh J, Park Y. A secure and anonymous authentication protocol based on three-factor wireless medical sensor networks[J]. Electronics, 2023, 12(6): 1368. [CrossRef] [Google Scholar]

[20] Gupta A, Tripathi M, Muhuri S, et al. A secure and lightweight anonymous mutual authentication scheme for wearable devices in Medical Internet of Things[J]. Journal of Information Security and Applications, 2022, 68: 103259. [CrossRef] [Google Scholar]

[21] Wu T Y, Wang T, Lee Y Q, et al. Improved authenticated key agreement scheme for fog-driven IoT healthcare system[J]. Security and Communication Networks, 2021, 2021: 6658041. [Google Scholar]