title: Improvement of a uniqueness-and-anonymity-preserving user authentication scheme for connected health care.
abstract: Patient's privacy-preserving, security and mutual authentication between patient and the medical server are the important mechanism in connected health care applications, such as telecare medical information systems and personally controlled health records systems. In 2013, Wen showed that Das et al.'s scheme is vulnerable to the replay attack, user impersonation attacks and off-line guessing attacks, and then proposed an improved scheme using biometrics, password and smart card to overcome these weaknesses. However, we show that Wen's scheme is still vulnerable to off-line password guessing attacks, does not provide user's anonymity and perfect forward secrecy. Further, we propose an improved scheme to fix these weaknesses, and use the applied pi calculus based formal verification tool ProVerif to prove the security and authentication.
authors.affiliation: Hangzhou Key Laboratory of Cryptography and Network Security, Hangzhou Normal University, Hangzhou, 311121, China, qixie68@126.com.
authors.forename: Qi
authors.initials: Q
authors.lastname: Xie
authors.forename: Wenhao
authors.initials: W
authors.lastname: Liu
authors.forename: Shengbao
authors.initials: S
authors.lastname: Wang
authors.forename: Lidong
authors.initials: L
authors.lastname: Han
authors.forename: Bin
authors.initials: B
authors.lastname: Hu
authors.forename: Ting
authors.initials: T
authors.lastname: Wu
mesh_terms: D000465:Algorithms; D003195:Computer Communication Networks; D016494:Computer Security; D003219:Confidentiality; D057286:Electronic Health Records; D066275:Health Information Exchange; D006801:Humans; D010355:Patient Identification Systems; D012985:Software Design; D014584:User-Computer Interface