title: Secure anonymity-preserving password-based user authentication and session key agreement scheme for telecare medicine information systems.
abstract: OBJECTIVE
  Information and communication and technology (ICT) has changed the entire paradigm of society. ICT facilitates people to use medical services over the Internet, thereby reducing the travel cost, hospitalization cost and time to a greater extent. Recent advancements in Telecare Medicine Information System (TMIS) facilitate users/patients to access medical services over the Internet by gaining health monitoring facilities at home.
  
  
  METHODS
  Amin and Biswas recently proposed a RSA-based user authentication and session key agreement protocol usable for TMIS, which is an improvement over Giri et al.'s RSA-based user authentication scheme for TMIS. In this paper, we show that though Amin-Biswas's scheme considerably improves the security drawbacks of Giri et al.'s scheme, their scheme has security weaknesses as it suffers from attacks such as privileged insider attack, user impersonation attack, replay attack and also offline password guessing attack. A new RSA-based user authentication scheme for TMIS is proposed, which overcomes the security pitfalls of Amin-Biswas's scheme and also preserves user anonymity property.
  
  
  RESULTS
  The careful formal security analysis using the two widely accepted Burrows-Abadi-Needham (BAN) logic and the random oracle models is done. Moreover, the informal security analysis of the scheme is also done. These security analyses show the robustness of our new scheme against the various known attacks as well as attacks found in Amin-Biswas's scheme. The simulation of the proposed scheme using the widely accepted Automated Validation of Internet Security Protocols and Applications (AVISPA) tool is also done.
  
  
  CONCLUSIONS
  We present a new user authentication and session key agreement scheme for TMIS, which fixes the mentioned security pitfalls found in Amin-Biswas's scheme, and we also show that the proposed scheme provides better security than other existing schemes through the rigorous security analysis and verification tool. Furthermore, we present the formal security verification of our scheme using the widely accepted AVISPA tool. High security and extra functionality features allow our proposed scheme to be applicable for telecare medicine information systems which is used for e-health care medical applications.
authors: Center for Security, Theory and Algorithmic Research, International Institute of Information Technology, Hyderabad 500 032, India.
authors: Anil Kumar
authors: AK
authors: Sutrala
authors: Center for Security, Theory and Algorithmic Research, International Institute of Information Technology, Hyderabad 500 032, India. Electronic address: iitkgp.akdas@gmail.com.
authors: Ashok Kumar
authors: AK
authors: Das
authors: Department of Mathematics, Indian Institute of Technology, Kharagpur 721 302, India; Department of Computer Science and Engineering, Indian Institute of Information Technology, Sri City, Chittoor 517 588, Andhra Pradesh, India.
authors: Vanga
authors: V
authors: Odelu
authors: Center for Security, Theory and Algorithmic Research, International Institute of Information Technology, Hyderabad 500 032, India.
authors: Mohammad
authors: M
authors: Wazid
authors: Department of Mathematics, Ch. Charan Singh University, Meerut 250 005, Uttar Pradesh, India.
authors: Saru
authors: S
authors: Kumari
mesh_terms: D016494:Computer Security; D007256:Information Systems; D018907:Privacy; D017216:Telemedicine
keywords: AVISPA; Authentication; BAN logic; Security; Telecare medicine information systems; User anonymity