## 3 Proposed Extended Chaotic-Map-Based User-Authentication and Key-Agreement Scheme
### Emergency-Exception-Handling Phase  
Figure 5 illustrates the processes of the emergency-exception-handling phase of the proposed scheme, which are described as follows.  
Step 1: Doctor \(Doc\) selects random numbers \(R_{D}\), \(a\) and timestamp \(TS_{1}\), computes \(T_{a}(x)mod\ p\), \(Cer_{D}=h(T_{r_{D}}(T_{r_{MCS}}(x)mod\ p)\|TS_{1})\), \(R_{PatH}=E_{Cer_{D}}(ID_{P}\|R_{D}\|IND_{PHI})\), where \(IND_{PHI}\) is the medical-record index number that \(Doc\) requires. \(V_{1}=h(ID_{D}\|ID_{P}\|Cer_{D}\|T_{a}(x)\|R_{D})\). Then, \(Doc\) sends \(\{ID_{D},R_{PatH},V_{1},T_{a}(x),TS_{1}\}\) to \(MCS\).  
Step 2: On receiving the messages from \(Doc\), \(MCS\) checks the timestamp \(TS_{1}\leqq\Delta T\), and computes \(SK_{DMCS}=h(T_{r_{MCS}}(T_{b}(x)mod\ p))\) by using \(r_{MCS}\), \((ID_{D}\|R_{D}\|IND_{PHI})=D_{SK_{DMCS}}(R_{PatH})\), \(Cer_{D}=h(T_{r_{MCS}}(T_{r_{D}}(x)mod\ p)\|TS_{1})\), \(V_{1}=h(ID_{D}\|ID_{P}\|Cer_{D}\|T_{a}(x)\|R_{D})\). If \(V_{1}^{\prime}=V_{1}\) does not hold, then \(MCS\) rejects this service request; otherwise, \(MCS\) successfully authenticates \(Doc\), stores \(PHI_{P}\) in its database by using the index \(IND_{PHI}\), selects \(TS_{2},\ b\) and computes \(T_{b}(x)mod\ p\), \(SK_{D}=h(T_{b}(T_{a}(x)mod\ p))\), \(D_{PHI}=E_{SK_{D}}(PHI_{P})\), \(V_{2}=h(ID_{D}\|SK_{D}\|h(PHI_{P})\|TS_{2}\|R_{D})\). Then, \(MCS\) sends \(\{D_{PHI},V_{2},T_{b}(x),TS_{2}\}\) to \(Doc\).  
Step 1: Patient \(Pat\) inputs his/her identity \(ID_{P}\), password \(PW_{P}\) and a new password \(PW_{P}^{new}\) and computes \(W_{P}=ID_{P}\oplus PW_{P}\), \(X_{P}=Y_{P}\oplus W_{P}\), \(W_{P}^{new}=ID_{P}\oplus PW_{P}^{new}\).  
Figure 5: The processes of emergency-exception handling phase of the proposed scheme.  
Figure 6: The processes of password-updating phase of the proposed scheme.  
Then, \(Pat\) selects random numbers \(R_{P}\) and a, a timestamp \(TS_{1}\), computes \(T_{a}(x)mod\ p\), \(P_{P}=h(W_{P}\|ID_{P}\|ID_{D}\|T_{a}(x))\), \(Cer_{P}=h(T_{r_{P}}(T_{{}_{MCS}}(x)mod\ p)\|TS_{1})\), \(NPW_{P}=Cer_{P}\oplus(W_{P}^{new}\|R_{P})\), \(V_{1}=h(X_{P}\|Cer_{P}\|R_{P}\|T_{a}(x)\|W_{P}\|W_{P}^{new})\) and sends \(\{NID_{P},NPW_{P},V_{1},T_{a}(x),TS_{1}\}\) to \(MCS\).  
Step 2: On receiving the messages from \(Pat\), \(MCS\) checks the timestamp \(TS_{1}\leq\Delta T\), and computes \((ID_{P}\|W_{P}\|R_{MCS}\|w)=D_{{}_{MCS}}(NID_{P})\), \(Cer_{P}^{\prime}=h(T_{r_{P}}(T_{{}_{MCS}}(x)mod\ p)\|TS_{1})\), \((W_{P}^{new}\|R_{P})=NPW_{P}\oplus Cer_{P}^{\prime}\), \(X_{P}^{\prime}=h(ID_{P}\|R_{MCS})\) and \(V_{1}=h(X_{P}^{\prime}\|Cer_{P}\|R_{P}\|T_{a}(x)\|W_{P}\|W_{P}^{new})\). If \(V_{1}=V_{1}^{\prime}\) holds, then \(MCS\) successfully authenticates the patient \(Pat\), and selects \(Renv\), \(c\), computes \(T_{c}(x)mod\ p,SK_{MCSP}=h(T_{c}(T_{a}(x)mod\ p))\), \(NID_{P}^{new}=E_{T_{MCS}(x)}(ID_{P}\|W_{P}^{new}\|R_{new}\|w)\), \(X_{P}^{new}=h(ID_{P}\|R_{new})\) and sends \(\{QID_{P},V_{2},T_{c}(x)\}\) to \(Pat\).  
Step 3: On receiving \(\{QID_{P},V_{2},T_{c}(x)\}\) from \(MCS\), \([PERSON]\) computes \(SK_{MCSP}=h(T_{a}(T_{c}t(x)\ mod\ p))\), decrypts \(QID_{P}\) with \(SK_{MCSP}\) and obtains \((NID_{P}^{new}\|X_{P}^{new})\). Then, \([PERSON]\) computes \(V_{2}^{\prime}=h\big{(}NID_{P}^{new}\|SK_{MCSP}\|R_{P}\|X_{P}^{new}\big{)}\) and checks whether \(V_{2}^{\prime}=V_{2}\) holds or not. If unsuccessful, \([PERSON]\) adopts this request. Otherwise, \([PERSON]\) computes \(Y_{P}^{new}=X_{P}^{new}\oplus W_{P}\) and replaces \(\{NID_{P},Y_{P}\}\) as \(\{NID_{P}^{new},Y_{P}^{new}\}\) in SC.