A Secure Three-Factor User Authentication and Key Agreement Protocol for TMIS With User Anonymity

Abstract

Telecare medical information system (TMIS) makes an efficient and convenient connection between patient(s)/user(s) and doctor(s) over the insecure internet. Therefore, data security, privacy and user authentication are enormously important for accessing important medical data over insecure communication. Recently, many user authentication protocols for TMIS have been proposed in the literature and it has been observed that most of the protocols cannot achieve complete security requirements. In this paper, we have scrutinized two (Mishra et al., Xu et al.) remote user authentication protocols using smart card and explained that both the protocols are suffering against several security weaknesses. We have then presented three-factor user authentication and key agreement protocol usable for TMIS, which fix the security pitfalls of the above mentioned schemes. The informal cryptanalysis makes certain that the proposed protocol provides well security protection on the relevant security attacks. Furthermore, the simulator AVISPA tool confirms that the protocol is secure against active and passive attacks including replay and man-in-the-middle attacks. The security functionalities and performance comparison analysis confirm that our protocol not only provide strong protection on security attacks, but it also achieves better complexities along with efficient login and password change phase as well as session key verification property.

A Two-Factor RSA-Based Robust Authentication System for Multiserver Environments

“…Here, we analyze that our protocol can defy all the relevant security attacks. In this regard, we define some valid assumptions [2,10,20] as follows.…”

“…Therefore, A intercepts, deletes, modifies, reroutes, and resends the transmitted message. It is worth noting that A cannot intercept any information from the secure network [10].…”

“…As mentioned in [7,10], if the insider person A of RC or AS gets 's password PW by some means, she/he can attempt to login different accounts of . Thus, the protection against the insider attack is also an important issue in password-based authentication system.…”

“…In this regard, two-factor authentication protocols using smart-card and password are widely used and designing a robust and efficient two-factor authentication protocol is a critical task. The concept of client-server communication over insecure networks has been introduced for single server environment, and many researchers have proposed numerous authentication protocols [1][2][3] using hash function [4][5][6], RSA cryptosystem [7][8][9], elliptic curve [10], chaotic map [11,12], and bilinear pairing [13]. However, these protocols are unsuitable for multiserver communications.…”

“…User anonymity [18,19] is one of the security issues in user authentication protocol, where user's identity should be kept secret from the adversary. There are several application areas such as banking, medical system [7,10], and wireless sensor network [20], where the authorized users want to keep their identity secret from an adversary; that is, the adversary is unable to extract or guess user's original identity from the login and authentication messages. In addition to that, the mutual authentication is another important security aspect, where client and server both can verify each other to avoid man-in-the-middle attack.…”