## 3 System Model and Problem Identification
### Security Model  
In this section, the identification of the possible threat scenarios that can be launched by exploiting user identity is discussed. An adversary can expose the user ID through exhaustive offline guessing because it is usually shorter and has a certain format which can be easily guessed [37]. To secure participants' medicinal prescription, the identity must not be disclosed at intermediate nodes when the information is being exchanged over the uncertain channel. An intruder can attempt to get the private information of the participant from the system, causing a potential risk for confidential data. There is no check of the rightness of a client's old secret key amid the secret password change stage, implying that an individual [38] who has other individual's smart card can change secret code and bio-metric without giving the original password. Other conceivable assaults are participant impersonation attacks, brute-force attacks, or dictionary assaults. Furthermore, an illegal participant may misuse the other participant's personal information to conduct various login sessions and follow participant's exercises by phishing techniques [30]. Also, the breaching of user privacy and their routine activities may likewise encourage an unapproved user to follow the participant's login history and even their current location. After obtaining the password by off-line password guessing, the user can easily guess or deduce common shared secret keys between end users like \(A\) and \(B\) after intercepting the transmitted messages \(R_{A}\) and \(R_{B}\).  
An intruder can attempt to retrieve the identity of the legitimate user from their login message. As the user's identity is short, the adversary (A) finds \(AId_{i}\) with polynomial time by executing exhaustive guessing. During multiple valid user sessions using the same unique password, forgery is possible [37]. The well-known threats that can be launched to breech the security of legitimate users are as follows.  
1. Applying reverse engineering by monitoring user activities, the adversary extracts the privately stored data in the participant's device [38].  
Figure 2: TMIS System Model.  
2. During private information transmission over an open channel, there are possibilities of eavesdropping, intercepting, content modification, and reply attacking to influence overall communication.
3. A user registers with a true identity but acts as a malicious user in the TMIS.
4. To overcome low entropy issues, the password must be robust enough to defend against password guessing attacks.  
Using two parameters, such as a secret password and unique identity, is more feasible and is cannot be guessed by an attacker in polynomial time. Considering this assumption, a malicious user can obtain private data from the location of data storage of the user and re-transmit all messages using the public channel. In case a security protocol is unable to handle these issues, then it cannot protect users from password guessing attacks (which is possible offline), replay attacks (by altering the original message), denial of services, man-in-the-middle attacks, and cannot provide seamless forward privacy.  
By the above analysis, [PERSON]'s scheme [11] cannot survive tracking attacks and it has failed to uphold user un-traceability. It is defenseless against guessing attacks and tracking attacks. A smart card holds a secret number (\(r\)) and this can be determined from the fix value of \(W=h(r||pw_{i})\). An adversary (A) can eavesdrop on a legal user's login request message \(R_{m}=h(Id_{i},W)\) and get the value of \(W\) to subvert the privacy of the participant unless a new authentication session is established [37]. Moreover, tracking attacks are possible by monitoring different session of same user using \(W\).