Design of a secure and privacy preserving authentication protocol for telecare medical information systems

Abstract

With the advancement of communication technology, Telecare Medicine Information Systems (TMIS) provides convenient healthcare services for patients, doctors, and health organizations over the insecure Internet. As a result, when accessing sensitive medical data over an insecure connection, user privacy, data security, and user authentication is very crucial. A secure authentication protocol plays a crucial role in securing communications over TMIS, these environments are very vulnerable to numerous attacks due to resource constraints and the nature of the communication medium. Recently, an efficient authentication framework has been introduced for TMIS to address various security issues. However, the existing mutual authentication and key agreement protocols are vulnerable to replay attacks, insider attacks, impersonation attacks, and password guessing attacks. Furthermore, the current authentication systems do not guarantee user privacy and the fair key agreement between the patient and the medical server. We propose a more robust authentication approach for healthcare information systems to address these security issues. To assess the authentication protocol's security strength, we employ formal verification tools like Automated Validation of Internet Security Protocols and Applications (AVISPA). Finally, a thorough performance analysis demonstrates that the proposed mutual authentication framework not only ensures privacy but also maintains a low computing overhead. As a result, when compared to other related systems, the proposed authentication protocol is both secure and computationally efficient.