title: A Multiserver Biometric Authentication Scheme for TMIS using Elliptic Curve Cryptography.
abstract: Recently several authentication schemes are proposed for telecare medicine information system (TMIS). Many of such schemes are proved to have weaknesses against known attacks. Furthermore, numerous such schemes cannot be used in real time scenarios. Because they assume a single server for authentication across the globe. Very recently, Amin et al. (J. Med. Syst. 39(11):180, 2015) designed an authentication scheme for secure communication between a patient and a medical practitioner using a trusted central medical server. They claimed their scheme to extend all security requirements and emphasized the efficiency of their scheme. However, the analysis in this article proves that the scheme designed by Amin et al. is vulnerable to stolen smart card and stolen verifier attacks. Furthermore, their scheme is having scalability issues along with inefficient password change and password recovery phases. Then we propose an improved scheme. The proposed scheme is more practical, secure and lightweight than Amin et al.'s scheme. The security of proposed scheme is proved using the popular automated tool ProVerif.
authors.affiliation: Department of Computer Science & Software Engineering, International Islamic University Islamabad, Islamabad, Pakistan. shahzad@iiu.edu.pk.
authors.forename: Shehzad Ashraf
authors.identifier: http://orcid.org/0000-0002-9321-6956
authors.initials: SA
authors.lastname: Chaudhry
authors.affiliation: Department of Computer Science & Software Engineering, International Islamic University Islamabad, Islamabad, Pakistan.
authors.forename: Muhammad Tawab
authors.initials: MT
authors.lastname: Khan
authors.affiliation: Center of Excellence in Information Assurance, King Saud University, Riyadh, Saudi Arabia.
authors.forename: Muhammad Khurram
authors.initials: MK
authors.lastname: Khan
authors.affiliation: Division of Information and Computer Engineering, College of Information Technology, Ajou University, San 5, Woncheon-Dong, Yeongtong-Gu, Suwon, 443-749, Korea.
authors.forename: Taeshik
authors.initials: T
authors.lastname: Shon
mesh_terms: D056667:Biometric Identification / Q000295:instrumentation*; D016494:Computer Security / Q000295:instrumentation*; D003219:Confidentiality; D066275:Health Information Exchange; D000069098:Health Smart Cards; D006801:Humans; D017216:Telemedicine / Q000295:instrumentation*
keywords: Authentication; Biometrics; Impersonation attack; Multiserver; ProVerif; Smart card stolen; Stolen verifier