Security analysis and Improvement of a Privacy Authentication Scheme for Telecare Medical Information Systems

Abstract

Nowadays, patients can gain many kinds of medical service on line via Telecare Medical Information Systems(TMIS) due to the fast development of computer technology. So security of communication through network between the users and the server is very significant. Authentication plays an important part to protect information from being attacked by malicious attackers. Recently, Jiang et al. proposed a privacy enhanced scheme for TMIS using smart cards and claimed their scheme was better than Chen et al.’s. However, we have showed that Jiang et al.’s scheme has the weakness of ID uselessness and is vulnerable to off-line password guessing attack and user impersonation attack if an attacker compromises the legal user’s smart card. Also, it can’t resist DoS attack in two cases: after a successful impersonation attack and wrong password input in Password change phase. Then we propose an improved mutual authentication scheme used for a telecare medical information system. Remote monitoring, checking patients’ past medical history record and medical consultant can be applied in the system where information transmits via Internet. Finally, our analysis indicates that the suggested scheme overcomes the disadvantages of Jiang et al.’s scheme and is practical for TMIS.

Introduction

With the rapid development of computer network technology, the TMIS provide a way for relating patients, doctors and a medical server. By building TMIS, hospitals try to cut down medical and time expenses and meanwhile make the quality of medical service better. Many patients can be diagnosed at home via TMIS. The medical server owns patients’ private medical information such as names, telephone numbers, past medical history and so on. Patients can send instant data of their body to the server via the Internet and doctors can give some advice according to the accumulated patients’ health data. For some patients who have chronic illnesses, it may save them a lot of time on the way between his own house and the hospital.

Based on the development background, we take part in an initial research on a telecare medical information system for the residents which may be inconvenient to go to hospital. The old or disabled people who have chronic illnesses can get advice from doctors in time and not to go to hospital usually. Also, people may consult the doctors about recent symptoms. Doctors can monitor patients’ physiological data and make corresponding decisions for them. The users should be authenticated and the messages between communication entities should be protected. In order to keep privacy, an authentication scheme should be built in the TMIS to enable the service available for legal users, either patients or doctors. So user authentication becomes important for remote systems. Our contribution is the proposed new secure authentication scheme for this system.

To enhance the security, schemes based on smart cards and passwords have appeared. They belong to two-factor authentication schemes. However, information in the smart card can be extracted [9, 11]. So a successful authentication scheme based on the smart card should still be secure even if the information in the card is stolen.

Recently, many two-factor authentication schemes for TMIS have been raised and unfortunately some of them have been criticized quickly. In 2012, Wu et al. [15] proposed one remote user authentication scheme for telecare medical service. He et al. [5] pointed out Wu et al.’s scheme [15] was vulnerable to impersonation attacks and insider attacks and proposed a new scheme for TMIS. But Wei et al. [13] showed that schemes in [5, 15] were not secure due to no two-factor authentication and proposed an improved scheme to overcome the problem. Soon after that Zhu [17] pointed that scheme in [13] was vulnerable to off-line password guessing attack and proposed a new scheme according to RSA. However, none of the schemes in [5, 13, 15, 17] protects the user’s identity secretly. That is to say, the identity of the user in the above schemes are in plaintext over the network.

In 2004, Das et al. [4] proposed a dynamic ID-based authentication scheme to conceal user’s identity in transmission. A lot of ID-based schemes have been proposed. However, many of them have been attacked [3, 8, 12, 14]. In 2012, Chen et al. [2] showed that Khan et al.’s scheme [8] did not have the character of anonymity and presented a new dynamic ID-based authentication scheme with smart cards for TMIS. Then Cao et al. [1], Xie et al. [16], Lin [10] and Jiang et al. [7] all demonstrated that Chen et al.’s scheme [2] had weaknesses such as off-line password guessing attack, tracking attack, lack of privacy protection and so on. They also proposed their own scheme respectively. Unfortunately, we find that Jiang et al.’s scheme [7] has useless ID and it is vulnerable to off-line password guessing attack,user impersonation attack and DoS attack. And we propose an improved authentication scheme for TMIS which can protect the user’s privacy.

The rest of the paper is organized as follows. In next section we give some notations and definitions throughout this paper. In Section “Review of Jiang et al.’s scheme” we briefly review their scheme. Then the Section “Security analysis of Jiang et al.’s scheme” shows its disadvantages. In Section “System environment and the improved scheme” and Section “Security analysis and comparison”, we propose the framework of the project and an improved authentication scheme. Then we analyze our scheme’s security and performance. And in the last Section some conclusions are drawn.

Notations and definitions

In this Section, we list the notations used throughout the paper. They are defined in Table 1. Also, we describe some premises in order to analyze the schemes. They are listed as definitions after Table 1:

Table 1 Notations in the paper

Definition 1

A user’s password can be collected in a finite set, which can be guessed in polynomial time.

Definition 2

The secret number x in S is a strong key, which can not be guessed in polynomial time.

Definition 3

The hash function h(.) and symmetric key cryptosystem are secure(e.g.SHA-1 and AES).

Definition 4

The attacker A can control over the communication channel between the user and the remote server. And A may either (1) get a user’s password, or (2) obtain the smart card and extract secret parameters in it, (3) but not the both above.

Review of Jiang et al.’s scheme

In this Section, we briefly review Jiang’ et al.’s scheme [7]. It contains five phases: Registration phase, Login phase, Authentication phase, Password change phase and Lost smart card revocation phase.

Registration phase

The user registers or re-registers with the remote server. A person who wants to become a new legal user U _i must do the following steps through a secure channel:

• (1) U _i ⇒ S: ID _i , RPW _i .

  U _i selects an identity ID _i , a password PW _i and produces a random number r _i . Then he computes RPW _i = h(r _i ||PW _i ) and sends the message R = {ID _i ,RPW _i } to the server S.

• (2) S ⇒ U _i :card.

  After receiving R, S verifies whether ID _i is valid, and rejects it if it is invalid. Then S checks the account record. If U _i is a new user, S adds (ID _i ,N = 0) into the database. Otherwise, S sets N = N + 1, chooses a random number b and computes

  $$\begin{array}{l} J_{i} = h(x||ID_{i}||N) \\ L_{i} = J_{i}\oplus RPW_{i} \\ AID_{i} = E_{x}(ID_{i}||b) \end{array} $$

  Finally, S stores (L _i , AID _i , h(.), E _key (.), D _key (.)) into a smart card and sends it to U _i .

• (3) U _i ⇒ card : r _i .

  U _i stores r _i into the smart card.

Login phase

To login the system, U _i inserts his smart card into the device. Then he inputs ID _i and PW _i .

• (1) The smart card retrieves r _i , L _i and AID _i in itself, and computes

  $$\begin{array}{l} RPW_{i} = h(r_{i}||PW_{i}) \\ J_{i} = L_{i}\oplus RPW_{i}\\ C_{1} = h(T_{i}||J_{i}) \end{array} $$

• (2) U _i → S : m = {AID _i ,T _i ,C ₁}.

  U _i sends the login message m = {AID _i ,T _i ,C ₁} to S.

Authentication phase

Upon receiving the message m, S follows steps below:

• (1) S → U _i : m′ = {C ₂}.

  S checks the validity of the user’s timestamp T _i . If it is invalid, S rejects this request. Otherwise, S uses x to decrypt AID _i , obtains ID _i and b and calculates J _i = h(x||ID _i ||N). Then S compares whether C ₁ is equal to h(T _i ||J _i ). If it does not hold, S rejects the request. Otherwise, S selects another random number b′, computes

  $$\begin{array}{l} AID_{i}' = E_{x}(ID_{i}||b') \\ C_{2} = E_{J_{i}}(AID_{i}'||C_{1}||T_{s}) \end{array} $$

  and sends m′ = {C ₂} to U _i . At last S can compute sk = h(J _i ||T _i ||T _s ).

• (2) After receiving m′, the smart card decrypts C ₂ to get $AID_{i}',C_{1}'$ and T _s , checks the validity of T _s and stops this session if T _s is invalid. Then the card checks the equation $C_{1}'=C_{1}$. If $C_{1}'\neq C_{1}$, U _i terminates the session. Otherwise, S is authenticated. U _i calculates the session key sk = h(J _i ||T _i ||T _s ). The smart card replaces AID _i with $AID_{i}'$, which will be used in the user’s next login phase.

Password change phase

If U _i wants to change his password, he inserts the smart card and inputs the old password PW _i and the new password $PW_{i}^{new}$. Then the card computes

$$\begin{array}{l} RPW_{i} = h(r_{i}||PW_{i})\\ RPW_{i}^{new} = h\left(r_{i}||PW_{i}^{new}\right) \\ L_{i}^{new} = L_{i}\oplus RPW_{i} \oplus RPW_{i}^{new} \end{array} $$

and replaces L _i with $L_{i}^{new}$.

Lost smart card revocation phase

To revoke the lost smart card and request a new one, U _i can re-register with S through the secure channel as the registration phase. S verifies U _i ’s secret information such as date of birth known to U _i . After validating, S issues a new smart card to U _i .

Security analysis of Jiang et al.’s scheme

Jiang et al. claimed their scheme achieved many security characters. However, in their scheme the user’s identity is useless and the scheme is vulnerable to off-line password guessing attack,user impersonation attack and DoS attack.

ID uselessness

Let’s see the login phase of Jiang et al.’s scheme. U _i inputs ID _i and PW _i , but the card does not use ID _i at all. The login message m employs AID _i as the user’s identity on the communication channel, which is directly read from the smart card. ID _i is useless in the login phase. The user can input any string as an identity.

Off-line password guessing attack

If the attacker A steals U _i ’s smart card temporarily, he can extract ($L_{i}$, $AID_{i}'$,$r_{i}$) from the card and then return it to U _i . A gets the login and authentication message of U _i : m = {AID _i , T _i , C ₁} and $m' = \{E_{J_{i}}(AID_{i}'||C_{1}||T_{s})\}$. Then A guesses the password as $PW_{i}^{*}$, computes RPW ^∗ = h(r _i ||PW ^∗), $J_{i}^{*} = L_{i}\oplus RPW_{i}$ and $C_{1}^{*} = h(T_{i}||J_{i})$. He can use J _i to get C ₁ from decryption of m ^′. If $C_{1}^{*} = C_{1}$, the password PW ^∗ is correct. Otherwise, A can try the next candidate password. Since T _i , C ₁, L _i , r _i are all known to A, A only need to repeat guessing the password until $PW_{i}^{*}$ is correct. Because J _i does not vary in different sessions, A can use many Login & Authentication messages between U _i and S to guess the password. Once A has guessed the correct password, J _i , T _s can be obtained and the session key sk can be computed easily.

User impersonation attack

After the above off-line guessing attack, A gets the right password and then he can pass himself off as a legal user. Due to the disadvantage of ID uselessness, A can input a random string for the identity to start a session and impersonate a legal user successfully.

DoS attack

There are two cases of DoS attack:

• (1) Once A logins successfully, he can get the next AID _i and make the legal U _i under DoS attack right away. In other words, U _i does not owns the next login information AID _i . So he can not login unless he re-registers again.

• (2) In fact, due to the lack of checking password mechanism, Password change phase can always be successful. User might input a wrong old password by mistake and this will lead to a failed login next time. So without verification, changing one’s password is insecure. Obviously, there is no password-checking mechanism for Password change phase in Jiang et al.’s scheme. So the scheme is also under this attack. And we find that schemes proposed in[5, 7, 10, 13, 14, 16] are all vulnerable to this attack, too.

System environment and the improved scheme

We first show the structure of system environment and its application. After that, we will present our authentication scheme.

Structure of system environment

First, some medical devices should be placed in residents’ houses or a service center in community. For example, cameras, microphones, transducers for collecting temperature and signals of pulse, blood pressure and so on are needed in the terminal. The collected information should be transmitted via the communication channel. In Fig. 1, if the patient requests a medical help, he should login with his smart card at the beginning. Then the user uses devices to collect body data and sends the information to the server. The doctor should also have identity checked first. According to the patient’s video, audio body information and history data, the doctor can communicate with the patient and give some advice to the patient for concrete symptoms. At the end of the diagnosis, the doctor verifies the service the patient requested before and the patient pays the bill. Moreover, a patient can access his own health history data, too.

Figure 1

Simple frame of our system.

All users of this system must register on the server first and the server issues a smart card to the user. These data flows are via a secure channel. Then the legal user uses his own smart card with devices like personal computers and notebooks to login in. Of course the messages from Login phase to the end of the session are in insecure channel.

Our proposed scheme also has five phases: Registration phase, Login phase, Authentication phase, Password change phase and Lost smart card revocation phase. In Fig. 2, we show the Registration, Login and Authentication phase. The details are as follows:

Figure 2

Registration, Login & Authentication phases of our scheme.

Registration phase

U _i can register or re-register at the remote server S and perform the following steps through a secure channel:

• (1) U _i ⇒S : ID _i , RPW _i .

  U _i chooses his identity ID _i , a password PW _i and generates a random number r _i . Then he calculates RPW _i = h(r _i ||PW _i ) and sends the message R = {ID _i ,RPW _i } to S.

• (2) S ⇒ U _i : ca rd.

  Upon receiving R, S checks if ID _i is valid. If it is invalid, S rejects it. Then S checks the account records in database. If U _i is a new user, S adds (ID _i ,N = 0) into the database. Otherwise, S sets N = N + 1 and stores it. Then S calculates

  $$\begin{array}{l} J_{i} = h(x||ID_{i}||N) \\ L_{i} = J_{i}\oplus RPW_{i} \\ e_{i} = h(x)\oplus h(RPW_{i}||ID_{i}) \end{array} $$

  Finally, S stores (L _i , e _i , h(.), E _key (.), D _key (.)) into a smart card and issues it to U _i .

• (3) U _i ⇒ card : r _i .

  U _i stores r _i into the smart card.

Login phase

When U _i wants to login the system, he inserts his smart card into the card reader and inputs ID _i with PW _i . The messages between U _i and S transmit via an insecure channel.

• (1) The smart card retrieves r _i , L _i and e _i , and computes

  $$\begin{array}{l} RPW_{i} = h(r_{i}||PW_{i})\\ J_{i} = L_{i}\oplus RPW_{i} \\ AID_{i} = e_{i}\oplus h(RPW_{i}||ID_{i})\oplus h(T_{i})\oplus ID_{i} \\ B_{1} = e_{i}\oplus h(RPW_{i}||ID_{i})\oplus T_{i} \\ V_{i} = h(T_{i}||J_{i}) \\ C_{1} = E_{h(T_{i})}(AID_{i}||T_{i}||V_{i}) \end{array} $$

• (2) U _i → S : m = {B ₁, C ₁}

  U _i sends the login message m = {B ₁, C ₁} to S.

Authentication phase

Upon receiving the message m, S does the steps as follows:

• (1) S → U _i : m′ = {B ₂, C ₂}.

  S computes $T_{i}'=B_{1}\oplus h(x)$, and checks the validity of the user’s timestamp $T_{i}'$. If it is invalid, S terminates this request. Otherwise, S decrypts C ₁ with $h(T_{i}')$, gets $AID_{i}'$, $T_{i}''$, $V_{i}'$, and checks if the equation $T_{i}'=T_{i}''$ is true. If it does not hold, S rejects the request. Otherwise, S calculates $ID_{i}'=AID_{i}'\oplus h(x)\oplus h(T_{i}')$ and checks whether $ID_{i}'$ is in the account table. If it is true, S obtains N, computes $J_{i}'=h(x||ID_{i}'||N)$ and compares whether $V_{i}'$ is equal to $h(T_{i}'||J_{i}')$. If it does not hold, S rejects the request. Otherwise, S computes

  $$\begin{array}{l} B_{2} = h(x)\oplus T_{s}\\ C_{2} = E_{h(T_{s})}(V_{i}'||T_{s})\\ sk = h(J_{i}'||T_{i}'||T_{s}||ID_{i}') \end{array} $$

  and sends m′ = {B ₂,C ₂} to U _i .

• (2) When U _i receives m′, the smart card computes $T_{s}'=B_{2}\oplus e_{i}\oplus h(RPW_{i}||ID_{i})$, and checks the validity of $T_{s}'$. If it passes, U _i should decrypt C ₂ with $h(T_{s}')$ and gets $V_{i}''$ and $T_{s}''$. U _i checks the equations $T_{s}'=T_{s}''$ and $V_{i}''=V_{i}$ and ends the session if either of them is not correct. Otherwise, U _i calculates the session key $sk=h(J_{i}||T_{i}||T_{s}'||ID_{i})$.

Password change phase

If U _i wants to change his password, he inserts the smart card and inputs his identity ID _i , the old password PW _i and the new password $PW_{i}^{new}$.

• (1) It’s as same as the Login phase.

• (2) It’s as same as the first step of Authentication phase. But S need not to compute sk.

• (3) After receiving m′, the smart card gets $T_{s}'$ as in Authentication phase, decrypts C ₂ with $h(T_{s}')$ and checks $T_{s}'=T_{s}''$ and $V_{i}''=V_{i}$. If either of them is not right, U _i terminates the session. Otherwise, the smart card computes

  $$\begin{array}{l} RPW_{i}^{new} = h\left(r_{i}||PW_{i}^{new}\right)\\ L_{i}^{new} = L_{i}\oplus RPW_{i} \oplus RPW_{i}^{new}\\ e_{i}^{new} = e_{i}\oplus h(RPW_{i}||ID_{i})\oplus h\left(RPW_{i}^{new}||ID_{i}\right)\\ \end{array} $$

  and replaces L _i , e _i with $L_{i}^{new},e_{i}^{new}$ respectively.

Lost smart card revocation phase

If U _i has lost his smart card, he can re-register at S through the secure channel as the registration phase. S verifies U _i , makes N = N + 1 and stores (ID _i ,N) into the account table. At last, S issues a new smart card to U _i .

Security analysis and comparison

In this Section, we analyze our scheme. Clearly it can resist general attacks and has common security features. Then we compare it with Jiang et al.’s scheme. The details are as follows:

ID usefulness

In the login and authentication phase, ID _i is used to compute session parameter AID _i and the session key sk. So the user’s identity is useful in the scheme.

On-line password guessing attack

On-line password guessing attack denotes that an attacker A can guess a legal user’s password on line successfully. To overcome this attack, we can limit the login times of the same identity in a short time. If A tries more times than the upper bound, S can reject the request and do some extra secure steps such as freezing the card.

Off-line password guesssing attack

If A eavesdrops all the messages in the communication channel and steals U _i ’s smart card, A can get L _i , e _i , r _i , B ₁, C ₁ and C ₂. Because x is unknown to A, A can’t guess PW _i via any of above parameters. For example, A guesses a password PW ^∗ to compute J _i = L _i ⊕h(r _i ||PW ^∗), but J _i is protected in V _i and V _i is encrypted by h(T _i ). So A has to get T _i to check J _i . If A wants to get T _i , he has only one way, which is to calculate T _i = B ₁⊕h(x). Unfortunately A can’t get x and fails to guess correct PW _i .

Privileged insider attack

The manager of the medical server may impersonate the user if he knows the legal user’s password. There is no password table in S in our scheme. And every PW _i is protected by a random number r _i and hash function in the registration, login and password change phase. Therefore our scheme can resist privileged insider attacks.

Stolen-verifier attack

There is no verification table such as hashed passwords or any information containing PW _i . The server S authenticates the user’s session by its secret number x and uses no number relating to PW _i . So our scheme is secure against stolen-verifier attack.

Replay attack

Suppose A replays the eavesdropped messages, such as m which is sent to S, he will not succeed. Each message can be checked by the timestamp. So a replayed message can be easily detected and dropped.

Man-in-middle attack

Assume that A intercepts the messages between U _i and S, and replaces part or the whole message with his own faked information to impersonate the user or the server. However, it’s impossible for A to fabricate legal messages due to lack of x. The faked message can not pass either side’s verification. In other words, the fact A can’t produce false session information denotes that our scheme withstands User impersonation attack, Server impersonation attack and Modification attack which are referred in Jiang et al.’s scheme.

Mutual authentication

It’s important for the TMIS to let the user and the remote server verify the identity of each other. In fact, once the scheme can withstand user & server impersonation attack, it satisfies the character of mutual authentication. According to the analysis of Man-in-middle attack, we can see this point. Furthermore, in our scheme, the session key formed at the last of Authentication phase is denoted as h(J _i ||T _i ||T _s ||ID _i ). Only the server and the user know the elements of the key and can build it without any difficulty. Because the two timestamps are not directly transmitted in the channel, the session key including them means both sides confirm each other. So our scheme satisfies this feature.

DoS attack

Compared to the analysis of DoS attack to Jiang et al.’s scheme, our scheme avoids the two cases. That is to say, weaknesses including off-line password guessing attack and no password-checking do not happen in it. First, our scheme does not employ the method that S gives the next login identity to U _i and it can resist off-line password guessing attack. Thus the first case of DoS attack in Jiang et al. does not exist. Second, in our scheme, U _i must input ID _i and the old PW _i , which are to be authenticated by S. The old password does not pass the verification means legal user’s wrong input by mistake or a malicious attacker’s trial. Only after the proper authentication, L _i and e _i can be changed correctly. Also, it’s certain that the password change phase can be transferred via insecure channel. So our scheme can resist DoS attack.

User anonymity and untraceability

It’s obvious that any third party can’t know the real identity of U _i , because ID _i is concealed in AID _i and AID _i is encrypted by h(T _i ). And T _i is protected in B ₁ by h(x), so the attacker A faces the problem to get T _i . Furthermore, AID _i varies in each session because AID _i is generated by the timestamp T _i . It’s difficult for A to tell apart U _i from others in communication channel. So our scheme satisfies user anonymity and untraceability.

Known-key security

The session key is produced as sk = h(J _i ||T _i ||T _s ||ID _i ) and the two timestamps T _i , T _s can not be same in different sessions. Keys in different sessions are independent of each other. Due to the secure hash function, A can not get the plaintext J _i ||T _i ||T _s ||ID _i . So if the attacker A knows some session keys, other session keys will not be affected.

Freely password chosen and update

According to our scheme, the user can randomly choose his password according to his hobbies in registration phase and change it without restriction when required. So this feature can be satisfied.

Comparisons

Here Table 2 lists security comparisons and Table 3 shows performance comparisons.

Table 2 Security comparison

Table 3 Performance comparison

From Table 2, it’s easy to know our scheme is secure while Jiang et al.’s scheme is under off-line password guessing attacks, user impersonation attacks and DoS attacks.

We use the time cost of hash function and symmetric encryption/decryption in [6], and compare our scheme with Jiang et al.’s in Table 3. T _H denotes the computation time of the hash function, e.g., SHA-1, which costs about 0.5ms. And T _s denotes the computation time of symmetric encryption/ decryption, e.g., AES, which costs about 8.7ms. Other operations, such as XOR and concatenation, cost too little time, so we omits them.

From Table 3, in our scheme the total computation time of registration phase is 4T _H ≈ 2 ms, which is lower than Jiang et al.’s scheme. In Login and Authentication phase, the computation of our scheme costs 11T _H + 4T _S ≈ 40.3 ms totally, while Jiang et al.’s scheme costs 6T _H + 4T _S ≈ 37.8 ms. The time cost of our scheme is 2.5 ms, or 6.6 % more than Jiang et al.’s. But more specifically, the time cost in Server side is less than Jiang et al.’s, with only 19.9 ms in our scheme, reduced by 36.7 %. In other words, our scheme needs more time in user side. It’s good for easing the Server’s stress. Password change phase in our scheme costs a lot more time because it employs steps in Login phase and part of Authentication phase. However, we should notice that the probability of using password change phase is far less than Login and Authentication. The card revocation phase in two schemes costs the same time as the registration phase respectively, so we omit it. The most important thing is, our scheme is secure and on the contrary, Jiang et al.’s scheme is vulnerable to three different attacks. From the above analysis, we can see that our scheme is better.

Conclusion

In this paper, we show that Jiang et al.’s scheme has some disadvantages including ID uselessness and under off-line password guessing attack, user impersonation attack and DoS attack. In order to overcome those defects, we propose a new scheme for our telecare medical information system research. With analysis we can see that our scheme can resist general attacks and overcome the drawback of Jiang et al.’s scheme. The scheme can protect the messages transmitting through the insecure channel between the user and the server obviously. There’s no doubt that our scheme is suitable for using in the TMIS.