Design of a Secure Authentication and Key Agreement Scheme Preserving User Privacy Usable in Telecare Medicine Information Systems.
Authentication and key agreement schemes play a very important role in enhancing the level of security of telecare medicine information systems (TMISs). Recently, Amin and Biswas demonstrated that the authentication scheme proposed by Giri et al. is vulnerable to off-line password guessing attacks and privileged insider attacks and also does not provide user anonymity. They also proposed an improved authentication scheme, claiming that it resists various security attacks. However, this paper demonstrates that Amin and Biswas's scheme is defenseless against off-line password guessing attacks and replay attacks and also does not provide perfect forward secrecy. This paper also shows that Giri et al.'s scheme not only suffers from the weaknesses pointed out by Amin and Biswas, but it also is vulnerable to replay attacks and does not provide perfect forward secrecy. Moreover, this paper proposes a novel authentication and key agreement scheme to overcome the mentioned weaknesses. Security and performance analyses show that the proposed scheme not only overcomes the mentioned security weaknesses, but also is more efficient than the previous schemes.
Department of Computer Engineering, Ferdowsi University of Mashhad, Mashhad, Iran. hamedarshad@aol.com.
Hamed
H
Arshad
Department of Computer Engineering, Ferdowsi University of Mashhad, Mashhad, Iran. rasoolzadegan@um.ac.ir.
Abbas
A
Rasoolzadegan
D016494:Computer Security / Q000295:instrumentation*; D003219:Confidentiality; D006801:Humans; D007256:Information Systems / Q000295:instrumentation*; D017216:Telemedicine / Q000295:instrumentation*
Authentication; Key agreement; Security; Telecare medicine information systems
J Med Syst. 2015 Jan;39(1):145
25486889
J Med Syst. 2015 Aug;39(8):79
26123833
IEEE J Biomed Health Inform. 2017 Mar;21(2):465-475
26766384
Springerplus. 2016 May 03;5:555
27218005