# Patient Family Binding and Authentication Scheme with Privacy Protection for E-Health System

Authors: Yuanyuan Zhang; Zhihao Huang; Qilong Zhu; Lingzhe Meng
Journal: Security and Communication Networks
 (2022)

---

## Abstract

The emergence of the E-health system has brought convenience to many chronically ill patients and elderly people with limited mobility. With the help of the E-health system, patients can upload their physiological data timely and get a diagnosis at home, which is more convenient and efficient as they do not have to line up in hospitals. In order to ensure this convenience while protecting patients’ privacy, many schemes have been proposed which can help patient and medical server authenticate each other. However, considering these patients’ inconvenience, sometimes family members need to participate in the patient’s treatment process. So, the E-health system needs to provide a secure communication platform for the family members. At present, most of the authentication schemes for the E-health system only focus on the secure communication between the patient and the medical server, while ignoring the participation of family members. Moreover, in the E-health system, the permissions of family members and patient should be different, and the medical server needs to distinguish their permissions efficiently. In order to overcome these problems, we propose a patient family binding and authentication privacy protection scheme for the E-health system. In the scheme proposed by us, the medical server can efficiently assign different permissions to the family member and patient. And our scheme can allow patient to authorize their family members freely, and the increase in the number of family members will not impose additional burden on the server. At the same time, the authentication between the family member and the medical server does not require the participation of the patient. In addition, by comparing with other related schemes, we prove that our scheme has suitable efficiency and security performance in the E-health system.


---

## Body

## 1. Introduction

Before the emergence of the E-health system, disease monitoring and condition analysis of patients must be carried out in hospital, which means that patients should often take time from work to go to hospital for medical examination. However, limited medical resources do not allow a large number of patients to receive treatment in time, which undoubtedly brings a lot of inconveniences and risks. Especially in recent years, cardiovascular diseases have become the biggest killer threatening human health because they cannot be detected in time, and patients miss the best time of treatment. Nowadays, as people’ living standards rise, people gradually realize the importance of health and they need a better E-health system in modern society. In this context, the E-health system is growing increasingly with the goal to reduce risks of death and implement real-time disease monitoring. The E-health system adopts advanced Internet of Things (IoT) technology and digital visualization mode, which makes limiting medical resources possible to be shared by more people. Generally, after mutual authentication between the patient and the medical server, the monitor devices close to or carried by the patient can transmit the real-time data (such as blood pressure, blood sugar, heart rate) to the medical server. After data have been received from the patient, the medical server will establish an electronic medical record (EMR) for each patient in order to provide data support for doctors to track a patient’s condition [1]. The EMR includes doctor’s orders, operation records, nursing records, which is helpful for doctors to control the diseases. The E-health system is very intelligent to realize real-time health monitoring and provide effective reference value for doctors for diagnosis.In the era of big data, privacy protection attracts people. Apart from patients who do not want their information to be abused, the medical server also does not want its data to be stolen. In the actual medical activities, medical institutions often use the E-health system to collect a large amount of medical-related data for diagnosis. These data cover all the basic information of patients with high confidentiality requirements, such as physical and disease information, family address, medical insurance, personal account. However, the monitor devices are connected wirelessly, which means these confidentiality data are transmitted in open network and will threaten the security of information greatly. Lots of sensitive data are transmitted on a public channel where the adversary may intercept the useful data by passive attack. Furthermore, the adversary may forge the EMR and forward the false EMR to the medical server; then, the medical server may draw incorrect conclusion and send a wrong diagnosis to the patient. And when this least expected thing happens, the patient may suffer more pains, even lose his life.The message transmitted on public (insecure) networks is extremely vulnerable, in order to ensure the security of transmission in E-health system, a lot of schemes have been proposed [1, 2]. Zhang et al. proposed a dynamic authentication scheme for the E-health system [1] in 2018. In their paper, both patients and family members can register in the E-health system, but the authors did not clarify how family members login the system, it would be difficult to solve the problem of binding between family members and patients. If the family members log by using the same authentication scheme as the patient, it will be difficult for the server to distinguish the family member from the patient. In 2019, Karthigaiveni and Indrani [2] proposed an efficient authentication mechanism based on two-factor authentication, and they claimed that their scheme needs less computational cost. However, they also do not mention the involvement of family members.In the former proposed E-health system scheme, the majority of schemes often consider the secure communication between patients and medical servers but neglect the important effect of family members in the E-health system. When family members want to care about the patient’s condition, it is necessary for family members to participate in the E-health system. Therefore, how to let family members join the E-health system under the premise of ensuring secure communication is a problem worthy of in-depth study. In addition, family members and patients should have different rights in the E-health system. In the system, patients can upload, modify, and delete their own medical data and view doctors’ diagnosis results. On the other hand, family members can view the patient’s medical data and doctor’s diagnosis results on the basis of the patient’s authorization but cannot upload, modify, or delete the data.In this study, we propose a patient family binding and authentication scheme with privacy protection for the E-health system, and the environment of the system is shown in Figure1. The E-health system consists of patients, family members, and medical server. Our scheme contains a registration phase for patient, a binding phase for family member, and an authentication phase for the family member. Considering that there are already a lot of authentication schemes between patient and medical server, so our scheme is mainly introduced for family member authentication and focuses on solving the problem of patient-family member binding. Finally, the contributions of our scheme are as follows:(i)
We propose a binding scheme for the family member, which can bind the patient and the family member so that the family member can participate in the treatment process of the patient.(ii)
In our scheme, authentication between family member and medical server does not require the participation of patients.(iii)
One patient may have several family members that need to participate in the E-health system. In our scheme, the increase in the number of family members does not incur additional costs to the medical server.(iv)
The binding phase in our scheme between patient and their family members does not require the participation of medical server, which avoid the cost on remote information transmission. Moreover, because the only use of lightweight secures hash function, bytes connection and exclusive-or, our scheme has high-performance.(v)
Our scheme provides strong privacy protection for the E-health system, where it ensures the security of critical message.Figure 1
Environment of the scheme system.The rest of our work is organized as follows: The related works are briefly analyzed in Section2. We describe our proposed scheme in Section 3. In Section 4, we analyze the security of the proposed scheme. Section 5 discusses the performance comparison between ours and other schemes. In the end, Section 6 gives the conclusion.


## 2. Related Work

In this section, we will discuss related works for the E-health system. A number of authentication schemes [3–5] have been proposed for E-health system. In 1976, Diffie and Hellman [6] proposed a method to setup session key named Diffie-Hellman key exchange. On the basis of their scheme, many research articles [7–9] are proposed. Following that, several authentication schemes for E-health system have been developed.A remote authentication scheme for health care has been introduced by Das and Goswami [10]. However, in 2015, Amin et al. [11] indicated several vulnerabilities of Das et al.’s scheme [10], for example, Das et al.’s scheme [10] is vulnerable to user impersonation attack and user anonymity problem. To isolate such problems, they offered a user mutual authentication scheme for E-health. However, Aghili et al. [12] discovered that the scheme of Amin et al. [11] was vulnerable to Dos attacks. Later, Aghili et al. further presented a lightweight authentication scheme-based three-factor E-health system in 2019.In order to overcome security flaws in the Session Initiation Protocol (SIP) authentication procedure, Yeh et al. [13] offered a secure authentication scheme based on Elliptic Curve Cryptography (ECC). Although, authors mentioned that their authentication procedure is shown to be more suitable for SIP applications. Unfortunately, Farash et al. [14] pointed that the authentication procedure presented by Yeh et al. [13] in 2016, cannot resist user impersonation and off-line password guessing attack, if the information in the smart card is stolen. As a remedy, they [14] further offered an authentication scheme for SIP-based ECC, which can provide the user anonymity and untraceability.Mohit et al. [15] suggested a cloud computing for health care system in 2017, they proved that their scheme is more secure. In 2018, Zhang et al. [16] presented a dynamic authentication scheme for E-health system. Nevertheless, Aghili et al. [12] argued that Zhang et al.’s scheme is vulnerable to several attacks. To fix this, they further proposed lightweight authentication scheme by using three-factor scheme for E-health systems. Then 2017, Al-Saggaf et al. [17] introduced an authentication scheme for remote user by using smart cards, but according to Chen and Zhang [18], it fails to resist some secure attacks. To overcome these drawbacks, they put forward a biometric authentication scheme for E-health system, and proved that the scheme can satisfy the security requirements.Wu et al. [19] designed a new authentication system which added the pre-computing method. The author claimed that their scheme will be more secure and efficient for Telecare Medicine Information Systems (TMIS). Although Wu et al.’s scheme is more secure than previous schemes, He et al. [20] declared that the method proposed by Wu et al. [19] had some security problems and proposed their improved solution. However, Wei et al. [21] pointed that neither Wu et al.’s [19] nor He et al.’s [20] scheme guarantee security and efficiency in the authentication scheme based on two-factor scheme. Then they offered an improved scheme and demonstrated the scheme is more secure and efficient.After that, Yan et al. [22] suggested a secure authentication scheme which can be used on TMIS. They found that Tan [23] scheme cannot resist the Dos attack, and proposed their scheme to enhance security. However, Mir and Nikooghadam [24] showed that the method introduced by Yan et al. [22] still has some security faults. Then, an improved key agreement scheme based on biometrics for E-health services was presented by Mir and Nikooghadam [24] and the authors have shown that the solution is suitable for E-health services. But in 2019, Mehmood et al. [25] declared that there are some security flaws in Omid et al.’s scheme [24], and Omid et al.’s methods were susceptible to user impersonation attack. To fix all this, they offered a robust and efficient authentication scheme for E-health system. Unfortunately, Hosseini Seno and Budiarto [26] declared that Mehmood et al.’s [25] scheme is unsecure during the login and authentication process and they proposed a new scheme.In 2019, Karthigaiveni and Indrani [2] introduced an efficient scheme with smart card and password by using Elliptic Curve Cryptography, and showed that their methods not only have better security but also have well computational cost. However, Chatterjee [27] scrutinized Kar et al.’s scheme [2] and declared some security defects in their scheme which lacks mutual authentication between the client and server. In 2020, Chatterjee [27] proposed an improved authentication scheme for health care applications. The author claimed that the scheme has higher security and efficiency.In the past decade, many authentication protocols have been proposed to ensure system security. Regretfully, the former proposed schemes, which are about E-health system, mainly focus on improvement of security and efficiency but neglect the important effect of family members in the E-health system. The binding of family members can better serve patients and can improve the efficiency of diagnosis and providing binding and authentication service for family members can make the E-health system more practical. Furthermore, the E-health system should have good access control and excellent database performance.


## 3. Our Proposed Scheme

In order to ensure the security and efficiency of the E-health system operation, we propose a patient family binding and authentication privacy protection scheme. Our proposed scheme consists of three phases: registration phase for patient, binding phase for family member, and authentication phase for family member. By our scheme, family members can pay attention to the patient’s medical data in time. The notations used in the proposed scheme are given in Table1. Detailed descriptions of our scheme are as follows.Table 1
Notations used in our paper.
NotationDescriptionPTPatientMSMedical server of the E-health systemFMFamily ofPTIDMSIdentity ofMSPWPTPassword ofPTIDFMIdentity ofFMPWFMPassword ofFMrPTRandom numbers generated byPTh⋅Cryptographic one-way hash functionsMaster key of medical serverPLarge prime numbergGenerator ofZP∗‖Concatenation operation⊕Bitwise X-OR operation


### 3.1. Registration Phase for Patients

In this phase of our scheme, a new patientPT will register with the medical server MS. The patient PT’s authentication information is stored in the database of the medical server MS and a smart card, and the medical server MS issues the smart card to the patient PT. The detailed steps of the registration phase for patient are presented in Figure 2.Step R1: firstly, the patientPT chooses identity IDPT and password PWPT which he/she can remember easily. Then, he/she generates a random number rPT and uses it to calculate M1=hIDPTPWPTrPT. Next, patient PT respectively masks the identity IDPT of patient and password PWPT of patient with a random number rPT by computing RPT=hIDPT⊕PWPT⊕rPT. Then, let M1,rPT as a registration request message, the patient PT sends it to MS via secure channel.Step R2: upon receipt of the request from the patientPT, the medical server MS firstly selects two identify labels idPT,idFM for the patient and family member, respectively. Then the medical server MS uses PT′s request information M1 and MS’s master key s to calculate SCPT=hM1‖s. Afterwards, the medical server MS computes MIDPT=hM1‖idPT, MIDFM=hSCPT‖idPT, NIDPT=hIDMS‖M1⊕idPT, NIDFM=hIDMS‖idPT⊕idFM and SCFM=hidFM‖s, where IDMS is identity information of medical server MS. Then the medical server uses SCFM and SCPT to calculate LFM=SCFM⊕SCPT, and uses SCPT, PT′s random number rPT to calculate CPT=rPT⊕SCPT. Next, the medical server chooses g where g is a generator of ZP∗ and P is a large prime. Finally, the medical server MS writes MIDPT,MIDFM,SCPT,idFM,g into its database and stores IDMS,CPT,NIDPT,NIDFM,LFM,g into a smart card. Then the medical server MS sends the smart card which includes IDMS,CPT,NIDPT,NIDFM,LFM,g to the patient PT.Step R3: the patientPT writes RPT into the smart card. After that, the registration phase for the patient is completed.Figure 2
Details of the patient registration phase.


### 3.2. Binding Phase for Family Members

The binding of patient and family member can help the family member securely participate in the E-health system by performing the following steps. Figure3 presents the detailed description of the binding phase.Step A1: the patientPT chooses a secret information k and sends to family member in secure channel (for example, face to face).Step A2: upon reception of the informationk, the family member FM chooses his/her identity IDFM, password PWFM, then generates a random number rFM, and uses the information k received from the patient PT to compute IFM=k⊕rFM. After that FM sends IFM to the patient PT.Step A3: when receiving the messageIFM, patient PT inserts his/her smart card into the terminal card reader and inputs his/her identity IDPT and password PWPT in the smart card. Next, the smart card calculates rFM′=IFM⊕k, rPT′=RPT⊕hIDPT⊕PWPT, SCPT′=CPT⊕rPT′, M1′=hIDPTPWPTrPT′, idPT′=NIDPT⊕hIDMS‖M1′, idFM′=NIDFM⊕hIDMS‖idPT′, MIDFM′=hSCPT′‖idPT′, N=LFM⊕MIDFM′, M2=N⊕rFM′ and M3=idFM′⊕hN. After that, the smart card generates authorization information AuthPT=hkM2M3, and sends M2,M3,AuthPT to the family member.Step A4: after receiving informationM2,M3,AuthPT from patient PT, the family member FM verifies whether the equation AuthPT=hkM2M3 hold or not. If the verification is successful, the family member FM computes N′=M2⊕rFM, idFM″′=M3⊕hN′, MFM=hIDFM‖PWFM⊕N′ and stores MFM,idFM′″ into he/she’s smart card. Else, end the scheme.Figure 3
Details of the binding phase.


### 3.3. Authentication Phase for Family Members

If a family member has completed the binding with a patient, he/she can log in to the medical server through the authentication phase. And a session keySK is negotiated by medical server MS and family member FM. Figure 4 presents the detailed description of the authentication phase.Step C1: firstly, the family memberFM inputs his/her identity IDFM and password PWFM into the smart card and calculates N″=hIDFM‖PWFM⊕MFM. Next, the smart card generates a random number x and uses the information stored in it to calculate X=gx and AuthFM=hidFM′N″X, and then sends idFM′,AuthFM,X to the medical server MS.Step C2: upon reception of informationidFM′,AuthFM,X from the family member FM, the medical server MS computes SCFM′=idFM′‖s, LFM′=SCFM′⊕SCPT, N′′′=LFM′⊕MIDFM and verifies whether the AuthFM=hidFM′N‴X holds or not. If the verification is successful, the medical server MS generates a random number y, computes Y=gy, Q=Xy, MMS=hYN′′′Q and sends MMS,Y as a verify message to the family member FM. Else, the MS will end the scheme.Step C3: after receiving the verify message from the medical server, the family memberFM computes Q′=Yx, and then checks the equation MMS?=hYN′′Q′. If the equation does not hold, it will end the scheme. Else, the family member FM computes the session key sk=hN′′⊕Q′. Then the family member FM uses the session key to compute Authsk=hidFM′N′′sk and sends Authsk to medical server MS.Step C4: on receivingAuthsk from the family member FM, the medical server MS computes sk′=hN′′′⊕Q and checks the correctness of the Authsk by comparing it with hidFM′N′′′sk′. If the values are same, the medical server MS accepts the session key sk′. If the checking of Authsk fails, the session will be terminated.Figure 4
Details of the authentication phase.Finally, after the session key is negotiated, the family memberFM and the medical server MS get sk and sk′, respectively. The security proof process is as follows:(1)st=hN″⊕Q′=hhIDFM‖PWFM⊕MFM⊕Yx=hhIDFM‖PWFM⊕MFM⊕gxy=hM2⊕rFM⊕gxy=hN⊕Q=LFM⊕MIDFM⊕Q=hN″′⊕Q=sk′.


## 3.1. Registration Phase for Patients

In this phase of our scheme, a new patientPT will register with the medical server MS. The patient PT’s authentication information is stored in the database of the medical server MS and a smart card, and the medical server MS issues the smart card to the patient PT. The detailed steps of the registration phase for patient are presented in Figure 2.Step R1: firstly, the patientPT chooses identity IDPT and password PWPT which he/she can remember easily. Then, he/she generates a random number rPT and uses it to calculate M1=hIDPTPWPTrPT. Next, patient PT respectively masks the identity IDPT of patient and password PWPT of patient with a random number rPT by computing RPT=hIDPT⊕PWPT⊕rPT. Then, let M1,rPT as a registration request message, the patient PT sends it to MS via secure channel.Step R2: upon receipt of the request from the patientPT, the medical server MS firstly selects two identify labels idPT,idFM for the patient and family member, respectively. Then the medical server MS uses PT′s request information M1 and MS’s master key s to calculate SCPT=hM1‖s. Afterwards, the medical server MS computes MIDPT=hM1‖idPT, MIDFM=hSCPT‖idPT, NIDPT=hIDMS‖M1⊕idPT, NIDFM=hIDMS‖idPT⊕idFM and SCFM=hidFM‖s, where IDMS is identity information of medical server MS. Then the medical server uses SCFM and SCPT to calculate LFM=SCFM⊕SCPT, and uses SCPT, PT′s random number rPT to calculate CPT=rPT⊕SCPT. Next, the medical server chooses g where g is a generator of ZP∗ and P is a large prime. Finally, the medical server MS writes MIDPT,MIDFM,SCPT,idFM,g into its database and stores IDMS,CPT,NIDPT,NIDFM,LFM,g into a smart card. Then the medical server MS sends the smart card which includes IDMS,CPT,NIDPT,NIDFM,LFM,g to the patient PT.Step R3: the patientPT writes RPT into the smart card. After that, the registration phase for the patient is completed.Figure 2
Details of the patient registration phase.


## 3.2. Binding Phase for Family Members

The binding of patient and family member can help the family member securely participate in the E-health system by performing the following steps. Figure3 presents the detailed description of the binding phase.Step A1: the patientPT chooses a secret information k and sends to family member in secure channel (for example, face to face).Step A2: upon reception of the informationk, the family member FM chooses his/her identity IDFM, password PWFM, then generates a random number rFM, and uses the information k received from the patient PT to compute IFM=k⊕rFM. After that FM sends IFM to the patient PT.Step A3: when receiving the messageIFM, patient PT inserts his/her smart card into the terminal card reader and inputs his/her identity IDPT and password PWPT in the smart card. Next, the smart card calculates rFM′=IFM⊕k, rPT′=RPT⊕hIDPT⊕PWPT, SCPT′=CPT⊕rPT′, M1′=hIDPTPWPTrPT′, idPT′=NIDPT⊕hIDMS‖M1′, idFM′=NIDFM⊕hIDMS‖idPT′, MIDFM′=hSCPT′‖idPT′, N=LFM⊕MIDFM′, M2=N⊕rFM′ and M3=idFM′⊕hN. After that, the smart card generates authorization information AuthPT=hkM2M3, and sends M2,M3,AuthPT to the family member.Step A4: after receiving informationM2,M3,AuthPT from patient PT, the family member FM verifies whether the equation AuthPT=hkM2M3 hold or not. If the verification is successful, the family member FM computes N′=M2⊕rFM, idFM″′=M3⊕hN′, MFM=hIDFM‖PWFM⊕N′ and stores MFM,idFM′″ into he/she’s smart card. Else, end the scheme.Figure 3
Details of the binding phase.


## 3.3. Authentication Phase for Family Members

If a family member has completed the binding with a patient, he/she can log in to the medical server through the authentication phase. And a session keySK is negotiated by medical server MS and family member FM. Figure 4 presents the detailed description of the authentication phase.Step C1: firstly, the family memberFM inputs his/her identity IDFM and password PWFM into the smart card and calculates N″=hIDFM‖PWFM⊕MFM. Next, the smart card generates a random number x and uses the information stored in it to calculate X=gx and AuthFM=hidFM′N″X, and then sends idFM′,AuthFM,X to the medical server MS.Step C2: upon reception of informationidFM′,AuthFM,X from the family member FM, the medical server MS computes SCFM′=idFM′‖s, LFM′=SCFM′⊕SCPT, N′′′=LFM′⊕MIDFM and verifies whether the AuthFM=hidFM′N‴X holds or not. If the verification is successful, the medical server MS generates a random number y, computes Y=gy, Q=Xy, MMS=hYN′′′Q and sends MMS,Y as a verify message to the family member FM. Else, the MS will end the scheme.Step C3: after receiving the verify message from the medical server, the family memberFM computes Q′=Yx, and then checks the equation MMS?=hYN′′Q′. If the equation does not hold, it will end the scheme. Else, the family member FM computes the session key sk=hN′′⊕Q′. Then the family member FM uses the session key to compute Authsk=hidFM′N′′sk and sends Authsk to medical server MS.Step C4: on receivingAuthsk from the family member FM, the medical server MS computes sk′=hN′′′⊕Q and checks the correctness of the Authsk by comparing it with hidFM′N′′′sk′. If the values are same, the medical server MS accepts the session key sk′. If the checking of Authsk fails, the session will be terminated.Figure 4
Details of the authentication phase.Finally, after the session key is negotiated, the family memberFM and the medical server MS get sk and sk′, respectively. The security proof process is as follows:(1)st=hN″⊕Q′=hhIDFM‖PWFM⊕MFM⊕Yx=hhIDFM‖PWFM⊕MFM⊕gxy=hM2⊕rFM⊕gxy=hN⊕Q=LFM⊕MIDFM⊕Q=hN″′⊕Q=sk′.


## 4. Security Analysis

In this section, we give a security analysis of our patient–family member binding scheme by using the real-or-random (RoR) model. In addition, we discuss the security of possible attacks.


### 4.1. Security Model

In this section, we use the random-or-real model [28] to prove that our authentication scheme is secure. The definitions of the model are presented as follows:Participants: using U and Sto respectively represent the set of user and the set of server. The set of all participants P is the union of U∪S. We use Ui and Sj to represent the i-th member of U and the j-th member of S.Partnering: let the symbol ΠUix1 and ΠSjx2, respectively represent the x1-th instance of Ui, the x2-th instance of Sj. If two instances ΠUix1 and ΠSjx2 authenticate in the scheme and obtain the same no-null session identification sid, then these two instances are called partner instances.Freshness: in order to ensure freshness, there are two conditions needed to be met. First, the two partner instances can successfully negotiate a session key without being queriedReveal query. Second, the two partner instances can be only simulated by one of CorruptSC or CorruptDB query.Adversary: an adversary A which in this model runs in polynomial time, and was given the attack ability by accessing the following queries:(i)
ExecuteΠUix1/ΠSjx2: this query models passive attack in which the adversary A can obtain the message transmitted between instance ΠUix1/ΠSjx2 and its partner instance.(ii)
SendP,ℳ: this query models active attack, such as replay attacks, impersonation attacks in which the adversary A may intercept or modify the massage sent to P. The adversary A also can send a message ℳ to P and can receive the output message.(iii)
RevealΠUix1/ΠSjx2: this query allows A to gain the session key obtained by ΠUix1 (or ΠSjx2) and its partner after the current authentication. If this session key has not been defined or A has initiated a Test query for the session key that needs to be guessed, then an empty result ⊥ is returned. Otherwise, A will receive the session key.(iv)
CorruptSCu: adversary A in this query can simulate the smart card lost attack and uses this attack to get family member’s smart card data.(v)
CorruptDBs: adversary A in this query can simulate the stolen verifier attack.(vi)
Testu/s: in this function, we test the security of the simulated session by flipping the coin b∈0,1. The adversary sends an inquiry, and will return a session key if b=1 or returned a same size binary random number if b=0.(vii)
Hashx: in this function, there is a table containing x and hx. Search for x in this table after receiving the query. If x exists, returns hx; otherwise, returns a random string as the hash value hx and stores x,hx in the table.Semanticsecurity: if the adversary successfully guesses the value of b by nonnegligible advantage, the scheme fails to provide semantic security. To distinguish between the random number and the session key, the adversary can use the above-mentioned queries to increase the advantage of guessing. Let AdvAKE be the advantage of A in breaking the semantic security of the scheme. We use the notion Suc to denote the event that adversary successfully guesses the value of b. If AdvAKE is small enough to be ignored, then we say that our scheme is secure under the RoR model.


### 4.2. Formal Security Analysis

Theorem 1.
Letqs, qh, and qt be the time of Send queries, Hash queries, guessing the master key s of medical server MS. And l is the length of s. Thus, we have(2)AdvAKEA<=MaxqsI1⋅I2,qt2l+qh22⋅H+qs22l.Section1.Here,I1 and I2 denote uniformly distributed dictionaries of user identity and user password. Then, the H, I1 and I2 denote the range size of hash function, I1 and I2.Proof.
A series of gamesGmi0<=i<=4 are completed in the proof to prove the security of our proposed scheme. In each game, PrSuci0<=i<=4 represents the probability that the adversary successfully guesses a correct value of b in each Gmi.Gm0: this starting game models a real attack scenario in RoR model by the adversary A. We have(3)AdvAKEA=2PrSuc0−1.Gm1: according to the scheme, in order to increase the advantage of the adversary A successfully guessing the value of b, we add Executeu,s query in this game. In our scheme, the session key SK is computed by N and Q. The adversary A can obtain some messages through this query such as idFM′,AuthFM,X,MMS,Y,Authsk, but due to N=LFM′⊕MIDFM and Q=gxy, the adversary A cannot infer N and Q from above messages. Therefore, the adversary A cannot get additional advantage through the eavesdropping attack. Thus, we have(4)PrSuc1=PrSuc0.Gm2: in this game, the adversary A is considered to use SendP,ℳ query to simulate active attack. If the adversary A wants to get the correct feedback message, he/she needs to calculate the correct AuthFM=hidFM′N′′X, MMS=hYN′′Q and Authsk=hidFM′N′′sk, but the adversary cannot get N and Q, so they cannot calculate AuthFM, MMS or Authsk and can only rely on guessing. According to the birthday paradox, the collision probability on the hash oracle is qh2/2⋅H, and the collision probability of N requires guessing the value of master key s is qs2/2l. Thus, we have(5)PrSuc2−PrSuc1<=qh22⋅H+qs22l.Gm3: in this game, the adversary A can use Reveal query to gain the session key obtained by ΠUix1 or ΠSjx2 and its partner after the current authentication. But in our scheme, the session key is sk=hN′′⊕Q′, where Q′=Xy=Yx. The data Q′=Xy=Yx are updated after each communication. Therefore, the adversary A cannot get additional advantage through Reveal query. Thus, we have(6)PrSuc3=PrSuc2.Gm4: in this game, according to the definition of Freshness, the adversary A can only queries one of the CorruptSC and the CorruptDB oracle. So, it is discussed in the following two situations.Case 1.
In this case, the adversaryA can receive the data in smart card like MFM,idFM′ by the CorruptSC oracle. Afterwards, the adversary A wants to capture the user’s session key sk=hN′′⊕Q′, where N′′=hIDFM‖PWFM⊕MFM and Q′=Yx. The adversary A in this case only has MFM,idFM′ which cannot calculate N′′, so the adversary A needs to guess the value of IDFM‖IDFM. Since the scale of the dictionary is I1⋅I2, we have(7)PrSuc4−PrSuc3<=qsI1⋅I2.Case 2.
In this case, the adversaryA can simulate a stolen verification table attack by queries in CorruptDB oracle. Then, the adversary A receives the server’s data MIDPT,MIDFM,SCPT,idFM. According to the session key sk=hN′′⊕Q, the adversary needs to calculate N′′=hLFM′⊕MFM which LFM=SCFM⊕SCPT and SCFM=hidFM‖s. The adversary A can only get SCPT and idFM from above data. If the adversary A wants to calculate SCFM=hidFM‖s. The adversary A needs to guess the server’s master key s. Thus, we have(8)PrSuc4−PrSuc3<=qt2l.
In addition, all the random oracles are simulated. The adversary can takeTest query one time to guess the bit b. Thus,(9)PrSuc4=12.
In summary, for the Case1, combining (2)–(6) and (8), we have(10)AdvAKEA<=qh22⋅|H|+qs22l+qsI1|⋅|I2.
And for the Case2, combining (2)–(8), we have(11)AdvAKEA<=qh22⋅H+qs22l+qt2l.
The adversaryA can choose one of case as the Gm3. Thus, we have AdvAKEA<=Maxqs/I1⋅I2,qt/2l+qh2/2⋅H+qs2/2l. In summary, the adversary cannot obtain additional advantage of guessing the correct coin b through the above games. Thus, it can be proved that our patient–family member binding scheme provides semantic security in RoR model.


### 4.3. Discussion on Possible Attacks

In this section, we discuss the strong privacy protection mechanism of our scheme against the most common attacks in E-health system.


#### 4.3.1. Resist Smart Card Loss Attack

In this attack, the adversary could capture the message stored in a smart card and want to calculate important private data with that information. In our scheme, the adversary can capture informationMFM,idFM′ from family member FM′s smart card and the information RPT,IDMS,CPT,NIDPT,NIDFM,LFM from the patient PT′s smart card. After adversary obtaining smart card information MFM,idFM′, the adversary wants to calculate the value of AuthFM. But due to the absence of a necessary values N′′, the adversary cannot derive AuthFM to pass authentication. Furthermore, even if the adversary has also obtained the patient PT′s smart card information RPT,IDMS,CPT,NIDPT,NIDFM,LFM, the adversary cannot derive N′′=LFM⊕MIDFM without MIDFM. So, the adversary cannot guess the value of sk=hN′′⊕Q′ without N′′. The adversary cannot obtain the useful information to guess session key through the smart card attack. Thus, our scheme could provide security and against the stolen smart card attack successfully.


#### 4.3.2. Resisting Off-Line Guessing Attack

Assuming that the adversary intercepted the dataIFM,M2,M3,AuthPT from binding phase, the AuthFM,idFM,X,MMS,Y from authentication phase, which transmitted over the insecure channel, attempted to launch an off-line guessing attack. However, none of the above data can be used to calculate IDPT,PWPT or IDFM,PWFM. Moreover, the identity and password always appear in pairs of the equations, and our scheme could ensure the anonymity for patient and family member. So, the adversary cannot obtain the identity and password of the patient and the family member. Since the private key s of the medical server is a high-entropy random number and is protected by a one-way hash function, the adversary cannot guess it. Thus, the off-line guessing attack cannot threaten our proposed scheme.


#### 4.3.3. Resisting Replay Attack

In our scheme, if the adversary captures the messageidFM′,AuthFM,X and replays it to medical server MS, the medical server MS will use the received X to calculate Q∗=Xy, then send Y and MMS∗, which is calculated by Q∗ to the adversary. But in the next step, the adversary needs to use the message MMS∗ to calculate Authsk. Because the calculation of Authsk=hidFM′N′′sk requires sk and the calculation of sk=hN′′‖Q′ requires Q′=Yx, the adversary cannot calculate Q′ from the obtained message. So, he/she cannot pass the Verify by medical server MS. Then, if the adversary captures the message MMS,Y and wants to replay it to family member FM, the adversary also cannot be authenticated by family member FM. Because the verification message MMS=hYN′′Q′ which is calculated with Q′=Yx, and the random number x will refresh in every session. The adversary cannot get the value of x. Similarly, if the adversary captures the message Authsk and replays it to medical server MS, it will not be authenticated by the medical server MS, because the value of sk=hN′′⊕Q′ is calculated by N′′ and Q′, the random number in Q′ will change every time. The adversary also cannot pass the medical server’s authentication. Obviously, the medical server MS and family member FM can resist the replay attack. Thus, the replay attack cannot threaten our proposed scheme.


#### 4.3.4. Resisting Man-in-the-Middle Attack

In our proposed scheme, the session keysk is established in the authentication phase between the family member and the medical server. If the adversary interrupts the authentication request idFM′,AuthFM,X and computes a new request idFM′∗,AuthFM∗,X∗ to cheat the medical server, it will not successfully pass the medical server MS′s authentication, because the adversary cannot calculate the message AuthFM=hid′N′′X which is computed by N′′. And same as the adversary intercepts the authentication message MMS,Y or Authsk, he/she also cannot calculate the message MMS∗=hYN′′Q′,Y∗ or Authsk∗=hidFM′‖N′′|sk to pass the authentication without N′′. Therefore, our scheme can resist man-in-the-middle attack.


#### 4.3.5. Resisting Privileged Insider Attack

The insider attack means that the insider of system can access to obtain user-sensitive information. In our scheme, the adversary obtains the dataMIDPT,MIDFM,SCPT,idFM in the medical server database through privileged insider attack. In the authentication phase, the calculation of N′′′=LFM′⊕MIDFM requires LFM′=SCFM′⊕SCPT, but the adversary only has the data SCPT. So, the adversary cannot derive LFM′. Cause the adversary just has the data MIDFM, the adversary cannot drive N′′′=LFM′⊕MIDFM. Therefore, our scheme can resist the privileged insider attack.


#### 4.3.6. Perfect Forward Secrecy

This security feature can ensure security even if an adversary obtains all past session keys. As can be seen from our scheme, the session key issk=hN′′⊕Q′, where N′′=hIDFM‖PWFM⊕MFM, Q′=Xy=Yx. The sk is protected by the N′′ and Q′. The data Q′=Xy=Yx is updated after each communication. Even if the adversary A knows the past session key, he/she is still impossible to compute the new session key of our scheme. Therefore, our scheme can provide the perfect forward secrecy.


## 4.1. Security Model

In this section, we use the random-or-real model [28] to prove that our authentication scheme is secure. The definitions of the model are presented as follows:Participants: using U and Sto respectively represent the set of user and the set of server. The set of all participants P is the union of U∪S. We use Ui and Sj to represent the i-th member of U and the j-th member of S.Partnering: let the symbol ΠUix1 and ΠSjx2, respectively represent the x1-th instance of Ui, the x2-th instance of Sj. If two instances ΠUix1 and ΠSjx2 authenticate in the scheme and obtain the same no-null session identification sid, then these two instances are called partner instances.Freshness: in order to ensure freshness, there are two conditions needed to be met. First, the two partner instances can successfully negotiate a session key without being queriedReveal query. Second, the two partner instances can be only simulated by one of CorruptSC or CorruptDB query.Adversary: an adversary A which in this model runs in polynomial time, and was given the attack ability by accessing the following queries:(i)
ExecuteΠUix1/ΠSjx2: this query models passive attack in which the adversary A can obtain the message transmitted between instance ΠUix1/ΠSjx2 and its partner instance.(ii)
SendP,ℳ: this query models active attack, such as replay attacks, impersonation attacks in which the adversary A may intercept or modify the massage sent to P. The adversary A also can send a message ℳ to P and can receive the output message.(iii)
RevealΠUix1/ΠSjx2: this query allows A to gain the session key obtained by ΠUix1 (or ΠSjx2) and its partner after the current authentication. If this session key has not been defined or A has initiated a Test query for the session key that needs to be guessed, then an empty result ⊥ is returned. Otherwise, A will receive the session key.(iv)
CorruptSCu: adversary A in this query can simulate the smart card lost attack and uses this attack to get family member’s smart card data.(v)
CorruptDBs: adversary A in this query can simulate the stolen verifier attack.(vi)
Testu/s: in this function, we test the security of the simulated session by flipping the coin b∈0,1. The adversary sends an inquiry, and will return a session key if b=1 or returned a same size binary random number if b=0.(vii)
Hashx: in this function, there is a table containing x and hx. Search for x in this table after receiving the query. If x exists, returns hx; otherwise, returns a random string as the hash value hx and stores x,hx in the table.Semanticsecurity: if the adversary successfully guesses the value of b by nonnegligible advantage, the scheme fails to provide semantic security. To distinguish between the random number and the session key, the adversary can use the above-mentioned queries to increase the advantage of guessing. Let AdvAKE be the advantage of A in breaking the semantic security of the scheme. We use the notion Suc to denote the event that adversary successfully guesses the value of b. If AdvAKE is small enough to be ignored, then we say that our scheme is secure under the RoR model.


## 4.2. Formal Security Analysis

Theorem 1.
Letqs, qh, and qt be the time of Send queries, Hash queries, guessing the master key s of medical server MS. And l is the length of s. Thus, we have(2)AdvAKEA<=MaxqsI1⋅I2,qt2l+qh22⋅H+qs22l.Section1.Here,I1 and I2 denote uniformly distributed dictionaries of user identity and user password. Then, the H, I1 and I2 denote the range size of hash function, I1 and I2.Proof.
A series of gamesGmi0<=i<=4 are completed in the proof to prove the security of our proposed scheme. In each game, PrSuci0<=i<=4 represents the probability that the adversary successfully guesses a correct value of b in each Gmi.Gm0: this starting game models a real attack scenario in RoR model by the adversary A. We have(3)AdvAKEA=2PrSuc0−1.Gm1: according to the scheme, in order to increase the advantage of the adversary A successfully guessing the value of b, we add Executeu,s query in this game. In our scheme, the session key SK is computed by N and Q. The adversary A can obtain some messages through this query such as idFM′,AuthFM,X,MMS,Y,Authsk, but due to N=LFM′⊕MIDFM and Q=gxy, the adversary A cannot infer N and Q from above messages. Therefore, the adversary A cannot get additional advantage through the eavesdropping attack. Thus, we have(4)PrSuc1=PrSuc0.Gm2: in this game, the adversary A is considered to use SendP,ℳ query to simulate active attack. If the adversary A wants to get the correct feedback message, he/she needs to calculate the correct AuthFM=hidFM′N′′X, MMS=hYN′′Q and Authsk=hidFM′N′′sk, but the adversary cannot get N and Q, so they cannot calculate AuthFM, MMS or Authsk and can only rely on guessing. According to the birthday paradox, the collision probability on the hash oracle is qh2/2⋅H, and the collision probability of N requires guessing the value of master key s is qs2/2l. Thus, we have(5)PrSuc2−PrSuc1<=qh22⋅H+qs22l.Gm3: in this game, the adversary A can use Reveal query to gain the session key obtained by ΠUix1 or ΠSjx2 and its partner after the current authentication. But in our scheme, the session key is sk=hN′′⊕Q′, where Q′=Xy=Yx. The data Q′=Xy=Yx are updated after each communication. Therefore, the adversary A cannot get additional advantage through Reveal query. Thus, we have(6)PrSuc3=PrSuc2.Gm4: in this game, according to the definition of Freshness, the adversary A can only queries one of the CorruptSC and the CorruptDB oracle. So, it is discussed in the following two situations.Case 1.
In this case, the adversaryA can receive the data in smart card like MFM,idFM′ by the CorruptSC oracle. Afterwards, the adversary A wants to capture the user’s session key sk=hN′′⊕Q′, where N′′=hIDFM‖PWFM⊕MFM and Q′=Yx. The adversary A in this case only has MFM,idFM′ which cannot calculate N′′, so the adversary A needs to guess the value of IDFM‖IDFM. Since the scale of the dictionary is I1⋅I2, we have(7)PrSuc4−PrSuc3<=qsI1⋅I2.Case 2.
In this case, the adversaryA can simulate a stolen verification table attack by queries in CorruptDB oracle. Then, the adversary A receives the server’s data MIDPT,MIDFM,SCPT,idFM. According to the session key sk=hN′′⊕Q, the adversary needs to calculate N′′=hLFM′⊕MFM which LFM=SCFM⊕SCPT and SCFM=hidFM‖s. The adversary A can only get SCPT and idFM from above data. If the adversary A wants to calculate SCFM=hidFM‖s. The adversary A needs to guess the server’s master key s. Thus, we have(8)PrSuc4−PrSuc3<=qt2l.
In addition, all the random oracles are simulated. The adversary can takeTest query one time to guess the bit b. Thus,(9)PrSuc4=12.
In summary, for the Case1, combining (2)–(6) and (8), we have(10)AdvAKEA<=qh22⋅|H|+qs22l+qsI1|⋅|I2.
And for the Case2, combining (2)–(8), we have(11)AdvAKEA<=qh22⋅H+qs22l+qt2l.
The adversaryA can choose one of case as the Gm3. Thus, we have AdvAKEA<=Maxqs/I1⋅I2,qt/2l+qh2/2⋅H+qs2/2l. In summary, the adversary cannot obtain additional advantage of guessing the correct coin b through the above games. Thus, it can be proved that our patient–family member binding scheme provides semantic security in RoR model.


## 4.3. Discussion on Possible Attacks

In this section, we discuss the strong privacy protection mechanism of our scheme against the most common attacks in E-health system.


### 4.3.1. Resist Smart Card Loss Attack

In this attack, the adversary could capture the message stored in a smart card and want to calculate important private data with that information. In our scheme, the adversary can capture informationMFM,idFM′ from family member FM′s smart card and the information RPT,IDMS,CPT,NIDPT,NIDFM,LFM from the patient PT′s smart card. After adversary obtaining smart card information MFM,idFM′, the adversary wants to calculate the value of AuthFM. But due to the absence of a necessary values N′′, the adversary cannot derive AuthFM to pass authentication. Furthermore, even if the adversary has also obtained the patient PT′s smart card information RPT,IDMS,CPT,NIDPT,NIDFM,LFM, the adversary cannot derive N′′=LFM⊕MIDFM without MIDFM. So, the adversary cannot guess the value of sk=hN′′⊕Q′ without N′′. The adversary cannot obtain the useful information to guess session key through the smart card attack. Thus, our scheme could provide security and against the stolen smart card attack successfully.


### 4.3.2. Resisting Off-Line Guessing Attack

Assuming that the adversary intercepted the dataIFM,M2,M3,AuthPT from binding phase, the AuthFM,idFM,X,MMS,Y from authentication phase, which transmitted over the insecure channel, attempted to launch an off-line guessing attack. However, none of the above data can be used to calculate IDPT,PWPT or IDFM,PWFM. Moreover, the identity and password always appear in pairs of the equations, and our scheme could ensure the anonymity for patient and family member. So, the adversary cannot obtain the identity and password of the patient and the family member. Since the private key s of the medical server is a high-entropy random number and is protected by a one-way hash function, the adversary cannot guess it. Thus, the off-line guessing attack cannot threaten our proposed scheme.


### 4.3.3. Resisting Replay Attack

In our scheme, if the adversary captures the messageidFM′,AuthFM,X and replays it to medical server MS, the medical server MS will use the received X to calculate Q∗=Xy, then send Y and MMS∗, which is calculated by Q∗ to the adversary. But in the next step, the adversary needs to use the message MMS∗ to calculate Authsk. Because the calculation of Authsk=hidFM′N′′sk requires sk and the calculation of sk=hN′′‖Q′ requires Q′=Yx, the adversary cannot calculate Q′ from the obtained message. So, he/she cannot pass the Verify by medical server MS. Then, if the adversary captures the message MMS,Y and wants to replay it to family member FM, the adversary also cannot be authenticated by family member FM. Because the verification message MMS=hYN′′Q′ which is calculated with Q′=Yx, and the random number x will refresh in every session. The adversary cannot get the value of x. Similarly, if the adversary captures the message Authsk and replays it to medical server MS, it will not be authenticated by the medical server MS, because the value of sk=hN′′⊕Q′ is calculated by N′′ and Q′, the random number in Q′ will change every time. The adversary also cannot pass the medical server’s authentication. Obviously, the medical server MS and family member FM can resist the replay attack. Thus, the replay attack cannot threaten our proposed scheme.


### 4.3.4. Resisting Man-in-the-Middle Attack

In our proposed scheme, the session keysk is established in the authentication phase between the family member and the medical server. If the adversary interrupts the authentication request idFM′,AuthFM,X and computes a new request idFM′∗,AuthFM∗,X∗ to cheat the medical server, it will not successfully pass the medical server MS′s authentication, because the adversary cannot calculate the message AuthFM=hid′N′′X which is computed by N′′. And same as the adversary intercepts the authentication message MMS,Y or Authsk, he/she also cannot calculate the message MMS∗=hYN′′Q′,Y∗ or Authsk∗=hidFM′‖N′′|sk to pass the authentication without N′′. Therefore, our scheme can resist man-in-the-middle attack.


### 4.3.5. Resisting Privileged Insider Attack

The insider attack means that the insider of system can access to obtain user-sensitive information. In our scheme, the adversary obtains the dataMIDPT,MIDFM,SCPT,idFM in the medical server database through privileged insider attack. In the authentication phase, the calculation of N′′′=LFM′⊕MIDFM requires LFM′=SCFM′⊕SCPT, but the adversary only has the data SCPT. So, the adversary cannot derive LFM′. Cause the adversary just has the data MIDFM, the adversary cannot drive N′′′=LFM′⊕MIDFM. Therefore, our scheme can resist the privileged insider attack.


### 4.3.6. Perfect Forward Secrecy

This security feature can ensure security even if an adversary obtains all past session keys. As can be seen from our scheme, the session key issk=hN′′⊕Q′, where N′′=hIDFM‖PWFM⊕MFM, Q′=Xy=Yx. The sk is protected by the N′′ and Q′. The data Q′=Xy=Yx is updated after each communication. Even if the adversary A knows the past session key, he/she is still impossible to compute the new session key of our scheme. Therefore, our scheme can provide the perfect forward secrecy.


## 4.3.1. Resist Smart Card Loss Attack

In this attack, the adversary could capture the message stored in a smart card and want to calculate important private data with that information. In our scheme, the adversary can capture informationMFM,idFM′ from family member FM′s smart card and the information RPT,IDMS,CPT,NIDPT,NIDFM,LFM from the patient PT′s smart card. After adversary obtaining smart card information MFM,idFM′, the adversary wants to calculate the value of AuthFM. But due to the absence of a necessary values N′′, the adversary cannot derive AuthFM to pass authentication. Furthermore, even if the adversary has also obtained the patient PT′s smart card information RPT,IDMS,CPT,NIDPT,NIDFM,LFM, the adversary cannot derive N′′=LFM⊕MIDFM without MIDFM. So, the adversary cannot guess the value of sk=hN′′⊕Q′ without N′′. The adversary cannot obtain the useful information to guess session key through the smart card attack. Thus, our scheme could provide security and against the stolen smart card attack successfully.


## 4.3.2. Resisting Off-Line Guessing Attack

Assuming that the adversary intercepted the dataIFM,M2,M3,AuthPT from binding phase, the AuthFM,idFM,X,MMS,Y from authentication phase, which transmitted over the insecure channel, attempted to launch an off-line guessing attack. However, none of the above data can be used to calculate IDPT,PWPT or IDFM,PWFM. Moreover, the identity and password always appear in pairs of the equations, and our scheme could ensure the anonymity for patient and family member. So, the adversary cannot obtain the identity and password of the patient and the family member. Since the private key s of the medical server is a high-entropy random number and is protected by a one-way hash function, the adversary cannot guess it. Thus, the off-line guessing attack cannot threaten our proposed scheme.


## 4.3.3. Resisting Replay Attack

In our scheme, if the adversary captures the messageidFM′,AuthFM,X and replays it to medical server MS, the medical server MS will use the received X to calculate Q∗=Xy, then send Y and MMS∗, which is calculated by Q∗ to the adversary. But in the next step, the adversary needs to use the message MMS∗ to calculate Authsk. Because the calculation of Authsk=hidFM′N′′sk requires sk and the calculation of sk=hN′′‖Q′ requires Q′=Yx, the adversary cannot calculate Q′ from the obtained message. So, he/she cannot pass the Verify by medical server MS. Then, if the adversary captures the message MMS,Y and wants to replay it to family member FM, the adversary also cannot be authenticated by family member FM. Because the verification message MMS=hYN′′Q′ which is calculated with Q′=Yx, and the random number x will refresh in every session. The adversary cannot get the value of x. Similarly, if the adversary captures the message Authsk and replays it to medical server MS, it will not be authenticated by the medical server MS, because the value of sk=hN′′⊕Q′ is calculated by N′′ and Q′, the random number in Q′ will change every time. The adversary also cannot pass the medical server’s authentication. Obviously, the medical server MS and family member FM can resist the replay attack. Thus, the replay attack cannot threaten our proposed scheme.


## 4.3.4. Resisting Man-in-the-Middle Attack

In our proposed scheme, the session keysk is established in the authentication phase between the family member and the medical server. If the adversary interrupts the authentication request idFM′,AuthFM,X and computes a new request idFM′∗,AuthFM∗,X∗ to cheat the medical server, it will not successfully pass the medical server MS′s authentication, because the adversary cannot calculate the message AuthFM=hid′N′′X which is computed by N′′. And same as the adversary intercepts the authentication message MMS,Y or Authsk, he/she also cannot calculate the message MMS∗=hYN′′Q′,Y∗ or Authsk∗=hidFM′‖N′′|sk to pass the authentication without N′′. Therefore, our scheme can resist man-in-the-middle attack.


## 4.3.5. Resisting Privileged Insider Attack

The insider attack means that the insider of system can access to obtain user-sensitive information. In our scheme, the adversary obtains the dataMIDPT,MIDFM,SCPT,idFM in the medical server database through privileged insider attack. In the authentication phase, the calculation of N′′′=LFM′⊕MIDFM requires LFM′=SCFM′⊕SCPT, but the adversary only has the data SCPT. So, the adversary cannot derive LFM′. Cause the adversary just has the data MIDFM, the adversary cannot drive N′′′=LFM′⊕MIDFM. Therefore, our scheme can resist the privileged insider attack.


## 4.3.6. Perfect Forward Secrecy

This security feature can ensure security even if an adversary obtains all past session keys. As can be seen from our scheme, the session key issk=hN′′⊕Q′, where N′′=hIDFM‖PWFM⊕MFM, Q′=Xy=Yx. The sk is protected by the N′′ and Q′. The data Q′=Xy=Yx is updated after each communication. Even if the adversary A knows the past session key, he/she is still impossible to compute the new session key of our scheme. Therefore, our scheme can provide the perfect forward secrecy.


## 5. Performance Comparison

In this section, we compare the computation cost and function of our patient–family member binding scheme with other related authentication schemes [29–33]. Our proposed scheme has two main phases: (1) binding phase and (2) authentication phase. We use the computational cost (total time to perform all operations) to compare the performance. In order to evaluate the computational cost, let the following notions to represent time complexity:(i)
Tha: time for performing a one-way hash operation(ii)
Tsy: time for performing a symmetric encryption/decryption operation(iii)
Tec: time for performing an elliptic curve scalar point multiplication operation(iv)
To: time for performing an elliptic curve scalar addition operation(v)
Tem: time for a modular exponentiation operationWe evaluate the computation cost by using MIRACL C/C++ Library. The system used 64 bit Windows 10 operating system (CPU:2.3 GHz, RAM:8 GB). Based on the above system requirements, we get the average computation time of each cryptographic operation:Tha≈0.057ms, Tsy≈0.187ms, Tec≈1.37ms, To≈0.91ms, and Tem≈1.89ms.In Table2, we show the computational cost of the related schemes [29–33] and ours in the registration phase and authentication phase. During the evaluating process, due to the small amount of calculation, we can ignore the XOR and string concatenation. In registration phase, computational cost of ours needs 8Tha whereas other related schemes which were proposed by Zhang et al. [29], Qu et al. [30], Qi and Chen [31], Karuppiah et al. [32], and Irshad et al. [33], respectively are 3Tha, 3Tha+2Tec+1To, 3Tha, 4Tha, and 4Tha+1Tsy+1Tec. We observe that Qu et al.’s scheme and Irshad et al.’s scheme requires more computational cost during the registration phase, because of Tec/Tsy in their calculation. The methods used in Zhang et al.’s scheme, Qi-Chen’s scheme and Kar et al.’s scheme have lower costs during the registration phase. As we have known, in the key agreement scheme, the scheme only needs to be registered once, but authentication phase will be run multiple times. Therefore, the computational cost of the registration phase has little effect on the overall scheme. During the authentication phase, computational cost of our scheme needs 9Tha+4Tem, which costs less than other related schemes which were proposed by Zhang et al. [29], Qu et al. [30], Qi and Chen [31], Karuppiah et al. [32], and Irshad et al. [33]. Finally, the total computational cost of above schemes as follows:(i)
Zhang et al. [29]: 14Tha+2Tsy+6Tec=9.39ms(ii)
Qu et al. [30]: 16Tha+11Tec+6To=21.442ms(iii)
Qi and Chen [31]: 15Tha+6Tec=9.075ms(iv)
Karuppiah et al. [32]: 19Tha+4Tem=8.63ms(v)
Irshad et al. [33]: 21Tha+12Tec+5Tsy=18.57ms(vi)
Ours:17Tha+4Tem=8.52msTable 2
Computational cost comparisons.
Registration phaseAuthentication phaseTotalTimemsZhang and Zhu [29]3Tha11Tha+2Tsy+6Tec14Tha+2Tsy+6Tec9.39Qu and Tan [30]3Tha+2Tec+1To13Tha+9Tec+5To16Tha+11Tec+6To21.442Qi and Chen [31]3Tha12Tha+6Tec15Tha+6Tec9.075Karuppiah et al. [32]4Tha15Tha+4Tem19Tha+4Tem8.63Irshad et al. [33]4Tha+1Tsy+1Tec17Tha+11Tec+4Tsy21Tha+5Tsy+12Tec18.57Ours8Tha9Tha + 4Tem17Tha + 4Tem8.52In summary, our scheme has a great advantage on total costs which only needs17Tha+4Tem=8.52ms. Our scheme has the best performance with low computational cost as compared with the other related schemes [29–33]. And more performance comparison of each scheme is shown in Figures 5–7.Figure 5
Computational cost comparison.Figure 6
Total time cost.Figure 7
Computation cost for different numbers of users.In Figure5, the two graphs respectively represent the time cost in the registration phase and the authentication phase of all schemes. In the left graph, we can see that in the registration phase, the computational cost of the Qu et al.’s scheme and Irshad et al.’s scheme is much bigger than other schemes. In the authentication phase (the right graph), Qu et al.’s scheme and Irshad et al.’s scheme requires large computational cost. Meanwhile, Zhang et al.’s scheme, Qi-Chen’s scheme, Kar et al.’s scheme and ours perform well in the authentication phase. Besides, the computational cost of ours is lower than other schemes. Figure 6 shows the total time cost of those schemes and Figure 7 shows the comparison of computation cost of our proposed scheme with related schemes. From Figure 7, we can know that the number of users increases, our scheme still has good performance. In summary, our scheme shows better performance which needs lower computational cost than other related schemes.We compare the proposed scheme with other related schemes in terms of different security attacks and parameters in Table3. Zhang et al.’s [29] scheme cannot provide several security features such as fail to resist the stolen verifier attack [34]. Qu et al.’s [30] scheme focuses on preventing the impersonation attack but suffers from the off-line guessing attack and reply attack. Qi and Chen’s [31] scheme ignores the user anonymity and suffers insider attack [32]. Karuppiah et al.’s scheme [32] cannot provide perfect forward security and cannot resist impersonation attack. Irshad et al.’s scheme [33] can resist most attacks but suffers impersonation attack [35].Table 3
Functionality comparison.
[29][30][31][32][33]OursUser anonymityYYNYYYFM-MS authenticationℛℛℛℛℛYKey agreementYYYYYYResistance to stolen verifier attackNℛYYℛYResistance to insider attackYYNYYYResistance to off-line guessing attackYYYYYYPerfect forward securityYYNNYYResistance to impersonation attackYYℛNNYResistance to replay attackNNYYYYY: means can resist the attack successfully or provide the security property, N: means cannot resist the attack successfully or cannot provide the security property, and ℛ: means not refereed.Furthermore, compared with the scheme [29–33], our proposed scheme not only realizes the secure communication between the family member and the medical server, but also realizes advanced security attributes and strong security attack protection.


### 5.1. Future Works

We propose a binding scheme for the family member, which can bind the patient and the family member so that the family member can participate in the treatment process of the patient. In our paper, patients can only authorize one family member per binding phase. When multiple family members need to bind at the same time, a batch binding scheme is needed. Moreover, more and more scenarios use biometric authentication. In order to make it more convenient for patients and their families to complete the binding and the authentication, it is necessary to design a scheme that uses biometric characteristics to complete the authentication. In the future, we will conduct further studies on batch binding and biometric authentication.


## 5.1. Future Works

We propose a binding scheme for the family member, which can bind the patient and the family member so that the family member can participate in the treatment process of the patient. In our paper, patients can only authorize one family member per binding phase. When multiple family members need to bind at the same time, a batch binding scheme is needed. Moreover, more and more scenarios use biometric authentication. In order to make it more convenient for patients and their families to complete the binding and the authentication, it is necessary to design a scheme that uses biometric characteristics to complete the authentication. In the future, we will conduct further studies on batch binding and biometric authentication.


## 6. Conclusion

In this paper, through reviewed the previous papers, we find that most systems only consider the secure communication between the patient and the medical server, but ignore the important role of family member in the E-health system. In order to overcome this problem, we propose a patient family binding and authentication scheme with privacy protection for E-health system. In our scheme, not only patients can bind family member freely, but also the family member can timely process the diagnosis result when the patient is inconvenient. In addition, the increasing the number of family members will not cause additional burden on the medical server. Consequently, our scheme is proved to be efficient and secure.



---

*Source: 1883293-2022-08-08.xml*