An Improved and Secure Anonymous Biometric-Based User Authentication with Key Agreement Scheme for the Integrated EPR Information System

Abstract

Nowadays, many hospitals and medical institutes employ an authentication protocol within electronic patient records (EPR) services in order to provide protected electronic transactions in e-medicine systems. In order to establish efficient and robust health care services, numerous studies have been carried out on authentication protocols. Recently, Li et al. proposed a user authenticated key agreement scheme according to EPR information systems, arguing that their scheme is able to resist various types of attacks and preserve diverse security properties. However, this scheme possesses critical vulnerabilities. First, the scheme cannot prevent off-line password guessing attacks and server spoofing attack, and cannot preserve user identity. Second, there is no password verification process with the failure to identify the correct password at the beginning of the login phase. Third, the mechanism of password change is incompetent, in that it induces inefficient communication in communicating with the server to change a user password. Therefore, we suggest an upgraded version of the user authenticated key agreement scheme that provides enhanced security. Our security and performance analysis shows that compared to other related schemes, our scheme not only improves the security level, but also ensures efficiency.

iPatient Privacy Copyright Cloud Management

“…In this section, we compare recent electronic medical solutions by their computational and communication costs. Comparisons of Wen et al [7], Li et al [12], Jung et al [13], Wu et al [17], Lin et al [28], Lee et al [29], and our method are illustrated in Table 2, a performance comparison table, where T H denotes the execution time of the biometric-hash function operation, T h denotes the execution time of the one-way hash function operation, T xor denotes the execution time of the Exclusive-OR (short for XOR) operation, T M denotes the execution time of multiplication operations, and T qr denotes the execution time of computing a square root modulo n. T xor , T h , and T H belong to lightweight operations. According to the description of [15,23], the calculation of the XOR operation is negligible, and the T h ≈ T H time cost is similar.…”

“…Alternatively, in the case of offline processing, a zero-knowledge information exchange key agreement was performed through the public network [11]. In the case of the key agreement mechanism, many scholars had proposed related agreements [8,[11][12][13][14][15]. In 2002, using fingerprints as passwords and using a remote login authentication through smart cards and biometrics were common [9].…”

“…According to the description of [15,23], the calculation of the XOR operation is negligible, and the T h ≈ T H time cost is similar. [13] 3T Appl. Sci.…”

Authenticated content distribution framework for digital rights management systems with smart card revocation

“…They used an ID‐based signature and encryption to contract an anonymously key agreement scheme. Jung et al first mentioned the security flaws of Li et al's scheme and showed that this is not resisted against password guessing and spoofing attack also does not achieve password verification. Doshi et al proposed a crucial password‐based agreement protocol for Internet of Things (IoT) environment.…”

“…They mentioned that the presented protocol accomplishes smart meter security and SK‐security under the CK‐adversary model. Lee et al mentioned some low flows in Jung et al and showed that it fails to ensure user anonymity. Moreover, they proposed a biometric‐based key agreement scheme for a DRM system.…”