Privacy-Preserving Authentication for Tree-Structured Data with Designated Verification in Outsourced Environments

Zhu, Fei; Yi, Xun; Abuadbba, Alsharif; Khalil, Ibrahim; Yang, Xu; Nepal, Surya; Huang, Xinyi

doi:10.1007/978-3-030-62576-4_8

Cited by 1 publication

(2 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Compared to the traditional paper-based health record, the EHR has many benefits, such as lowering costs, improving health care quality, promoting evidence-based medicine usage, helping in record-keeping, and ensuring the records' mobility. To secure the storage and sharing of privacy-sensitive EHR data over the potentially untrusted cloud, many cryptographic schemes have been proposed in the literature [16][17][18]. Zhu et al [16] proposed an authentication scheme with privacy protection and designated verification for XMLbased healthcare records.…”

Section: Introductionmentioning

confidence: 99%

“…To secure the storage and sharing of privacy-sensitive EHR data over the potentially untrusted cloud, many cryptographic schemes have been proposed in the literature [16][17][18]. Zhu et al [16] proposed an authentication scheme with privacy protection and designated verification for XMLbased healthcare records. Domadiya et al [17] put forward a privacy-preserving scheme for distributed healthcare data collection and mining for EHR systems, which provides a healthcare data mining platform to medical researchers and physicians.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Cryptanalysis of Two Privacy-Preserving Authentication Schemes for Smart Healthcare Applications

Luo

Rahman

2023

Mathematics

View full text Add to dashboard Cite

Ensuring the secure sharing of privacy-sensitive healthcare data is attracting considerable interest from researchers. Recently, Ogundoyin et al. designed a lightweight privacy-preserving authentication scheme named PAASH for smart health applications. Benil et al. proposed a public verification and auditing scheme named ECACS for securing e-health systems. Ogundoyin et al. and Benil et al. proposed an efficient certificateless aggregate signature (CLAS) scheme as their respective foundation signature schemes. They declared that their constructions were provably secure under the hardness assumption of cryptographic problems. In this work, we disprove their claim by analyzing the correctness and security of their underlying CLAS schemes. We first show that the batch verification process of n signatures for the CLAS scheme in PAASH is incorrect, and any public-key replacement attacker can easily break the scheme. We analyze the reasons for our attack and propose an improved scheme, named PAASH+. We then show that the CLAS scheme in ECACS fails to achieve correctness, an essential property that a cryptographic scheme should provide. As a result, it is impractical to deploy the designed PAASH and ECACS constructions in any real smart health applications.

show abstract