Simple Group Password-based Authenticated Key Agreements for the Integrated EPR Information System

Abstract

The security and privacy are important issues for electronic patient records (EPRs). The goal of EPRs is sharing the patients' medical histories such as the diagnosis records, reports and diagnosis image files among hospitals by the Internet. So the security issue for the integrated EPR information system is essential. That is, to ensure the information during transmission through by the Internet is secure and private. The group password-based authenticated key agreement (GPAKE) allows a group of users like doctors, nurses and patients to establish a common session key by using password authentication. Then the group of users can securely communicate by using this session key. Many approaches about GAPKE employ the public key infrastructure (PKI) in order to have higher security. However, it not only increases users' overheads and requires keeping an extra equipment for storing long-term secret keys, but also requires maintaining the public key system. This investigation presents a simple group password-based authenticated key agreement (SGPAKE) protocol for the integrated EPR information system. The proposed SGPAKE protocol does not require using the server or users' public keys. Each user only remembers his weak password shared with a trusted server, and then can obtain a common session key. Then all users can securely communicate by using this session key. The proposed SGPAKE protocol not only provides users with convince, but also has higher security.

A Systematic Literature Review on Security and Privacy of Electronic Health Record Systems: Technical Perspectives

“…Studies have also indicated that patients are reluctant to share their health information other than for direct clinical care (Li et al 2011). EHRs are shared among different systems and this openness raises considerable concern about patient privacy owing to the possibility of unauthorised access or misuse owing to improper security implementation . Privacy means that patients have the right to handle the disclosure of their personal information (Lee, Chang & Wang 2013). Data security means the protection of personal information against 'accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access' (van der Haak et al 2003).…”

Light-Weighted Password-Based Multi-Group Authenticated Key Agreement for Wireless Sensor Networks

“…The first comparison concerned computations. These GAKA protocols [3,7,8,13,14] require many time-consuming modular exponential computations or scalar multiplications on elliptic curves to realize authentication and negotiate group keys. Only the proposed GAKA protocol was developed using extended chaotic map operations and did not have a heavy computational burden.…”

“…The protocols of Kim et al [7] and Boyd and Nieto [8] realize authentication using users' public keys. The GAKA protocols of Abdalla et al [3], Dutta and Barua [13], and Lee et al [14] as well as the proposed GAKA protocol realize authentication using users' passwords. However, in the GAKA protocols of Abdalla et al [3] and Dutta and Barua [13], all users share the same password so their protocols do not ensure users' privacy.…”

“…The protocols of Kim et al [7] and Boyd and Nieto [8] employ users' public keys, and thus require extra equipment to store long-term secret keys and the results of time-consuming exponential computations in clients. The GAKA protocols of Abdalla et al [3], Dutta and Barua [13], and Lee et al [14] as well as the proposed GAKA protocol are password-based authentication protocols. Each user remembers only his weak password without the need for any extra equipment to store long-term secret keys.…”

“…Although these approaches do not require the maintenance of public key systems, all communicating users share the same password so these protocols do not protect the privacy of users. In 2013, Lee et al [14] proposed a password-based group-authenticated key agreement protocol for the integrated electronic patient record (EPR) information system, which enabled users to have their own passwords. A multi-server authentication protocol based on dynamic identity is proposed by Sood et al [15].…”