On the Security of a Two-Factor Authentication and Key Agreement Scheme for Telecare Medicine Information Systems

Abstract

Telecare medicine information systems (TMISs) aim to deliver appropriate healthcare services in an efficient and secure manner to patients. A secure mechanism for authentication and key agreement is required to provide proper security in these systems. Recently, Bin Muhaya demonstrated some security weaknesses of Zhu's authentication and key agreement scheme and proposed a security enhanced authentication and key agreement scheme for TMISs. However, we show that Bin Muhaya's scheme is vulnerable to off-line password guessing attacks and does not provide perfect forward secrecy. Furthermore, in order to overcome the mentioned weaknesses, we propose a new two-factor anonymous authentication and key agreement scheme using the elliptic curve cryptosystem. Security and performance analyses demonstrate that the proposed scheme not only overcomes the weaknesses of Bin Muhaya's scheme, but also is about 2.73 times faster than Bin Muhaya's scheme.

A secure two-factor mutual authentication and session key agreement protocol using Elliptic curve cryptography

“…The total communication cost of our proposed scheme and other relevant scheme [11,12,13,14] are 160*4+512*2=1664, 160*7=1120, 160*5+512=1312, 4*160+1024=1664 and 4*160+1024*2=2688 bits respectively. Next, we will compare the memory requirements to store security parameters in the smartcard of the proposed scheme with some other relevant schemes [11,12,13,14]. In our proposed scheme, the smart card incorporates the information {U S , G, r A } thus, the storage cost is 160*3=480 bits.…”

“…In this section, we compare the performance of the proposed protocol with some other existing relevant schemes [11,12,13,14] in terms of several security functionalities, computation and communication cost. In Table 2, we have compared the functionality features of our protocol with other relevant protocols [11,12,13,14]. It may be noted that the proposed protocol is secure against various relevant security attacks and achieves several security attributes than other protocols.…”

“…It may be noted that the proposed protocol is secure against various relevant security attacks and achieves several security attributes than other protocols. In Table 3, we summarized the communication cost, computation cost and storage cost of our proposed protocol and other relevant protocol [11,12,13,14]. The total communication cost of our proposed scheme and other relevant scheme [11,12,13,14] are 160*4+512*2=1664, 160*7=1120, 160*5+512=1312, 4*160+1024=1664 and 4*160+1024*2=2688 bits respectively.…”

“…In Table 3, we summarized the communication cost, computation cost and storage cost of our proposed protocol and other relevant protocol [11,12,13,14]. The total communication cost of our proposed scheme and other relevant scheme [11,12,13,14] are 160*4+512*2=1664, 160*7=1120, 160*5+512=1312, 4*160+1024=1664 and 4*160+1024*2=2688 bits respectively. Next, we will compare the memory requirements to store security parameters in the smartcard of the proposed scheme with some other relevant schemes [11,12,13,14].…”

“…In order to maintain less computation and communication overhead, recently many two-factor authentication schemes based on ECC have been proposed [7][8][9][10][11][12]. In 2013, Islam et al [7] proposed an ECC based password authentication and key agreement using smart card in remote login environment.…”