A Hash Based Remote User Authentication and Authenticated Key Agreement Scheme for the Integrated EPR Information System.
To protect patient privacy and ensure authorized access to remote medical services, many remote user authentication schemes for the integrated electronic patient record (EPR) information system have been proposed in the literature. In a recent paper, Das proposed a hash based remote user authentication scheme using passwords and smart cards for the integrated EPR information system, and claimed that the proposed scheme could resist various passive and active attacks. However, in this paper, we found that Das's authentication scheme is still vulnerable to modification and user duplication attacks. Thereafter we propose a secure and efficient authentication scheme for the integrated EPR information system based on lightweight hash function and bitwise exclusive-or (XOR) operations. The security proof and performance analysis show our new scheme is well-suited to adoption in remote medical healthcare services.
Department of Information Management, Tainan University of Technology, No. 529, Zhongzheng Road, Tainan City, 71002, Taiwan. th0040@mail.tut.edu.tw.
Chun-Ta
CT
Li
Department of Computer Science, National Pingtung University, No. 4-18, Min-Sheng Road, Pingtung City, 90003, Taiwan. cyweng@mail.nptu.edu.tw.
Chi-Yao
CY
Weng
Department of Library and Information Science, Fu Jen Catholic University, No. 510, Jhongjheng Road, New Taipei City, 24205, Taiwan. cclee@mail.fju.edu.tw.|Department of Photonics and Communication Engineering, Asia University, No. 500, Lioufeng Road, Taichung City, 41354, Taiwan. cclee@mail.fju.edu.tw.
Cheng-Chi
CC
Lee
Department of Information Management, Tainan University of Technology, No. 529, Zhongzheng Road, Tainan City, 71002, Taiwan.
Chun-Cheng
CC
Wang
D016494:Computer Security / Q000295:instrumentation*; D003219:Confidentiality; D057286:Electronic Health Records / Q000295:instrumentation*; D000069098:Health Smart Cards; D006801:Humans
Hash function; Integrated EPR information system; Key agreement; Network security; User authentication