title: An Improved and Secure Biometric Authentication Scheme for Telecare Medicine Information Systems Based on Elliptic Curve Cryptography.
abstract: Telecare medicine information system (TMIS) offers the patients convenient and expedite healthcare services remotely anywhere. Patient security and privacy has emerged as key issues during remote access because of underlying open architecture. An authentication scheme can verify patient's as well as TMIS server's legitimacy during remote healthcare services. To achieve security and privacy a number of authentication schemes have been proposed. Very recently Lu et al. (J. Med. Syst. 39(3):1-8, 2015) proposed a biometric based three factor authentication scheme for TMIS to confiscate the vulnerabilities of Arshad et al.'s (J. Med. Syst. 38(12):136, 2014) scheme. Further, they emphasized the robustness of their scheme against several attacks. However, in this paper we establish that Lu et al.'s scheme is vulnerable to numerous attacks including (1) Patient anonymity violation attack, (2) Patient impersonation attack, and (3) TMIS server impersonation attack. Furthermore, their scheme does not provide patient untraceability. We then, propose an improvement of Lu et al.'s scheme. We have analyzed the security of improved scheme using popular automated tool ProVerif. The proposed scheme while retaining the plusses of Lu et al.'s scheme is also robust against known attacks.
authors.affiliation: Department of Computer Science and Software Engineering, International Islamic University, Islamabad, Pakistan. shahzad@iiu.edu.pk.
authors.forename: Shehzad Ashraf
authors.identifier: http://orcid.org/0000-0002-9321-6956
authors.initials: SA
authors.lastname: Chaudhry
authors.affiliation: Department of Computer Science and Software Engineering, International Islamic University, Islamabad, Pakistan. khalid.phdcs74@iiu.edu.pk.
authors.forename: Khalid
authors.initials: K
authors.lastname: Mahmood
authors.affiliation: Department of Computer Science and Software Engineering, International Islamic University, Islamabad, Pakistan. husnain.naqvi@iiu.edu.pk.
authors.forename: Husnain
authors.initials: H
authors.lastname: Naqvi
authors.affiliation: Center of Excellence in Information Assurance, King Saud University, Riyadh, Saudi Arabia. mkhurram@ksu.edu.sa.
authors.forename: Muhammad Khurram
authors.initials: MK
authors.lastname: Khan
mesh_terms: D000465:Algorithms; D056667:Biometric Identification / Q000295:instrumentation*; D016494:Computer Security / Q000295:instrumentation*; D003219:Confidentiality; D006801:Humans; D017216:Telemedicine / Q000295:instrumentation*; D059015:Wireless Technology
keywords: Anonymity; BioHashing; Elliptic curve cryptography; Impersonation attack; Privacy; ProVerif; TMIS; Three factor authentication