Privacy-preserving multi-factor authentication and role-based access control scheme for the E-healthcare system

Abstract

E-healthcare assists medical specialists in remotely collecting patient health data and providing remote health diagnoses. The roles are distributed among the system's users, contrasted between admin to data entry within certain rules and policies. Role-based access control (RBAC) is a technique of advanced access control that restricts key operations of users (addition, deletion and modification) access based on a user's role within a healthcare system. This paper proposes a privacy-preserving using RBAC and smart multi-factor authentication for the healthcare system to overcome the limitation flaw in previous schemes such as security risk tolerance, scalability and dynamism. This work relies on low-complexity cryptographic hash functions and symmetric operations to authenticate users while using an asymmetric cryptosystem based on the Schnorr digital signature lightweight operation to authenticate the administrator to provide multi-factor authentication. The administrator represents the system's core, and any his information leak could attack the entire system and its components. The proposed scheme conducted two thorough formal security proofs for the proposed work based on informal analysis and the Scyther tool. Furthermore, comparisons with other schemes reveal that the proposed scheme provides greater security features, and resisting attacks than the others while also being efficient in computing and communication costs.

Patient-Generated Health Data (PGHD): Understanding, Requirements, Challenges, and Existing Techniques for Data Security and Privacy

“…To ensure the security and privacy of patient information inside healthcare systems, many main tactics are employed. These include the implementation of multifactor authentication (MFA) [ 77 ], the use of role-based access control (RBAC) [ 78 ], the adherence to the principle of least privilege, conducting frequent audits, and the deployment of firewalls and virtual private networks (VPNs) [ 79 ]. Multifactor authentication (MFA) improves security by necessitating the provision of two or more distinct forms of proof by users as a prerequisite for access, such as a password and a fingerprint.…”

“…Improved Security Measures [ 77 , 78 , 79 , 81 ]: The rise in security threats could drive innovation in security technologies. We might see the development of more robust encryption methods, secure data transmission protocols, and advanced user authentication processes specifically designed for wearable and IoMT devices.…”

“…In this context, we have pinpointed a range of security measures, varying from basic [ 3 , 23 , 24 , 77 , 84 , 85 , 95 , 96 , 97 , 98 , 99 , 100 , 101 ] to advanced [ 62 , 102 , 103 , 104 , 105 , 106 , 107 , 108 , 109 , 110 , 111 ], which can be effectively implemented to ensure the secure usage and management of PGHD. RQF2 [ 6 , 21 , 23 , 24 , 25 , 26 , 27 , 37 , 53 , 58 , 73 , 77 , 78 , 79 , 81 , 85 , 95 , 112 ] suggests that the development of wearable devices and internet-connected medical devices over the next decade will profoundly impact PGHD security and privacy. Key influences include a massive increase in PGHD volume, advanced data analytics, improved security measures, new regulations, greater public awareness, systems integration challenges, ethical implications, market-driven solutions, personalized security settings, and global disparities.…”

“…This could lead to the development of more sophisticated algorithms for data processing, which could either strengthen data security (by identifying and mitigating breaches more quickly) or create new vulnerabilities (if the algorithms themselves are not secure). (c) Improved Security Measures [77][78][79]81]: The rise in security threats could drive innovation in security technologies. We might see the development of more robust encryption methods, secure data transmission protocols, and advanced user authentication processes specifically designed for wearable and IoMT devices.…”

“…To ensure the security and privacy of patient information inside healthcare systems, many main tactics are employed. These include the implementation of multifactor authentication (MFA) [77], the use of role-based access control (RBAC) [78], the adherence to the principle of least privilege, conducting frequent audits, and the deployment of firewalls and virtual private networks (VPNs) [79].…”