# A Provably Secure Authentication and Key Agreement Protocol in Cloud-Based Smart Healthcare Environments

Authors: Tsu-Yang Wu; Lei Yang; Jia-Ning Luo; Jimmy Ming-Tai Wu
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The wide applications of the Internet of Things and cloud computing technologies have driven the development of many industries. With the improvement of living standards, health has become the top priority of people’s attention. The emergence of the wireless body area network (WBAN) enables people to master their physical condition all the time and make it more convenient for patients and doctors to communicate with each other. Doctors can provide real-time online treatment with cloud-based smart healthcare environments for patients. In this process, patients, health records, and doctors need to maintain security and privacy. Recently, Kumari et al. proposed a secure framework for the smart medical system. However, we found that their framework cannot provide the anonymity of patients and doctors, data confidentiality, and patient unlinkability and also is subject to impersonation attacks and desynchronization attacks. In order to ensure the security and privacy of patients and doctors, we propose an authentication and key exchange protocol in cloud-based smart healthcare environments. Formal and informal security analyses, as well as performance analysis, demonstrated that our protocol is suitable for these environments.


---

## Body

## 1. Introduction

With the development of wireless networks, hardware, and sensing devices, the application of the Internet of Things (IoT) [1, 2] involves various fields including artificial intelligence [3–6]. The increase of the business volume of the IoT requires more data storage space and stronger analytical and computing power, and cloud computing technology can meet these demands. It can be said that cloud computing technology is the cornerstone of the development of the IoT, and the IoT is the largest application platform of cloud computing technology.An important application of the IoT based on cloud computing technology is in the field of healthcare. With the popularity of big data and mobile devices, people’s demand for health services is growing. Smart healthcare uses IoT technologies to construct an electronic health information platform to realize the interaction between patients with wearable devices, medical staff, and medical institutions, greatly improve the service quality of medical treatment, and reduce the cost of medical treatment. In smart healthcare, both patients and doctors need to register in the cloud health center to obtain legal identity and store health data and diagnostic records. The body data collected by wearable devices and the physical condition reported by patients need to be transmitted to doctors through the cloud health center, and then the doctors return the diagnosis results to them. In this process, the security of the transmitted messages and the privacy [7–10] of patients and doctors need to be improved.For the privacy protection of patients and doctors, a common system model for smart healthcare [11–13] is shown in Figure 1. In Figure 1, the cloud and health center are bound together, which is called the “cloud health center.” Patients and doctors who want to use smart healthcare must register with the cloud health center, and the registration information is stored directly in the cloud. After that, patients establish contact with doctors through the center to obtain the diagnosis and treatment results. This model reduces the amount of information transmission, and doctors can timely grasp the physical state of patients to provide better treatment.Figure 1
Architecture of the information exchange between patients, doctors, and the cloud health center.In order to ensure the confidentiality and integrity of patients’ portable electronic medical records, Lambrinoudakis and Gritzalis [14] presented a health insurance information system based on the smart card. Patients and the medical center need to complete mutual authentication, and some remote authentication protocols have been proposed. In 2002, Chien et al. [15] proposed a remote authentication solution based on the smart card. In 2005, Gritzalis et al. [16] analyzed how to protect patient privacy and medical data in the modern e-medical environment. In 2006, Yeh [17] pointed out that, in [15], the attacker forges the user to pass the server’s authentication, which leads to forgery attacks. Therefore, he improved the verification phase of [15]. In 2012, some smart card-based authentication schemes for the telemedicine information system (TMIS) were proposed. Wu et al. [18] proposed an authentication scheme with the precomputation phase in telemedicine communication. Then, He et al. [19] demonstrated that [18] would be subject to impersonation attacks and insider attacks and proposed an improved TMIS authentication scheme based on [18]. Wei et al. [20] stated that both [18, 19] are subject to offline password guessing attacks and proposed a TMIS authentication scheme without the precomputation phase. Zhu [21] pointed out that [20] can also be subject to offline password guessing attacks and proposed a new TMIS authentication scheme. However, in 2013, Lee and Liu [22] found a parallel session attack in [21] and proposed a TMIS authentication scheme to protect the anonymity of patients.In recent years, to ensure that electronic medical records have enough storage space, researchers have introduced cloud computing technology into the TMIS and proposed many authentication protocols to solve the security problems of the medical systems. Chen et al. [23] proposed a TMIS authentication scheme based on dynamic identity and claimed that the scheme overcame the defect of not providing user anonymity. Jiang et al. [24] observed that [23] did not provide user anonymity and untraceability, which would lead to identity guessing attacks and tracking attacks. Therefore, they proposed an enhanced scheme to ensure user privacy and claimed that the scheme can resist all kinds of attacks. Kumari et al. [25] found that the scheme proposed by Jiang et al. [24] was vulnerable to various attacks such as password guessing attacks, user impersonation attacks, denial-of-service attacks, and even incorrect login request verification. Furthermore, they proposed an improved authentication scheme to enhance user privacy. In order to avoid the security loopholes of the above schemes and ensure the health information of patients, Chen et al. [26] proposed an authentication scheme for medical data exchange in the cloud environment. In 2016, Chiou et al. [27] found that [26] cannot provide patient anonymity and message authentication and did not achieve real telemedicine. As a result, they improved the privacy authentication scheme in the cloud health environment and claimed that the scheme achieved the real telemedicine. In 2017, Mohit et al. [28] found that [27] could not guarantee the anonymity of patients and could also be subject to stolen mobile device attacks. To increase security and complexity, they designed a lightweight two-way authentication protocol for the healthcare system based on cloud computing technology. In 2018, Li et al. [29] pointed out that [28] cannot guarantee the anonymity and data confidentiality of patients and also is attacked by the impersonated inspection report. After that, they designed a cloud-assisted mutual authentication and privacy protection protocol for the TMIS. Some important related works are summarized in Table 1.Table 1
Cryptographic techniques and limitations.
SchemeCryptographic techniquesLimitationsChen et al. [23](i) Utilized one-way hash function(i) Does not provide user anonymity(ii) Dynamic ID-based authentication(ii) Does not provide untraceability(iii) Based on the smart card(iii) Does not resist identity guessing attacks(iv) Does not resist tracking attacksJiang et al. [24](i) Utilized one-way hash function(i) Does not resist password guessing attacks(ii) Based on the encryption algorithm(ii) Does not resist impersonation attacks(iii) Based on the smart card(iii) Does not resist denial-of-service attacks(iv) Incorrect login request verificationChen et al. [26](i) Based on bilinear pairings(i) Does not provide patient anonymity(ii) Based on the encryption algorithm(ii) Does not provide message authentication(iii) Based on the Diffie–Hellman problemChiou et al. [27](i) Based on bilinear pairings(i) Does not provide patient anonymity(ii) Utilized one-way hash function(ii) Does not resist mobile device stolen attacks(iii) Based on the encryption algorithm(iv) Based on the Diffie–Hellman problemMohit et al. [28](i) Utilized one-way hash function(i) Does not provide patient anonymity(ii) Based on the encryption algorithm(ii) Does not provide data confidentiality(iii) Does not resist inspection report impersonation attacksKumari et al. [30](i) Utilized one-way hash function(i) Does not resist known session-specific temporary information attacks(ii) Based on the encryption algorithm(ii) Does not provide patient anonymity(iii) Based on the Diffie–Hellman problem(iii) Does not provide data confidentiality(iv) Does not resist impersonation attacks(v) Does not resist desynchronization attacks(vi) Does not provide patient unlinkabilityRecently, Kumari et al. [30] designed a cloud-based smart medical system. Their system includes patient data upload, treatment, and emergency phases. In addition, the authentication process between the healthcare center and cloud is divided into healthcare center upload and emergency phases. In this paper, we found that their system has some security flaws, specifically, impersonation attacks, desynchronization attacks, failure to provide patient and doctor anonymity, data confidentiality, and patient unlinkability. Meanwhile, we observe that Kumari et al.’s system required more steps for information transmission. It increases the probability of attackers breaking the system. Hence, we based on the system model mentioned in Figure 1 to propose a secure authentication and key agreement protocol in cloud-based smart healthcare environments. Our protocol can reduce the amount of information transmitted and enhance the security of doctors and patients. Furthermore, we provide both formal and informal security analyses, ProVerif software analysis, and performance analysis to demonstrate that our protocol can meet the requirements of the cloud-based smart healthcare environments.The rest of the paper is organized as follows. In Section2, Kumari et al.’s system is reviewed and cryptanalyzed. In Sections 3 and 4, we describe the proposed protocol and demonstrate the security, respectively. In Section 5, we show the performance evaluation. The conclusion is drawn in Section 6.


## 2. Review and Cryptanalysis of Kumari et al.’s System

### 2.1. Review of Kumari et al.’s System

Kumari et al.’s cloud-based smart medical system [30] includes four entities: cloud, healthcare center, patient, and doctor. After a patient is registered with a healthcare center, the center uploads the patient’s information to the cloud. After that, the patient established contact with the healthcare center through the cloud. Here, we ignore the registration phase. The symbolic description is shown in Table 2.Table 2
Symbols and descriptions.
SymbolDescriptionIDPIdentity of the patientIDDIdentity of the doctorHHealthcare centerCHCCloud healthcare centerAAdversarySCSmart cardsMaster key ofCHCSKkSession key generated by entitykTkTimestamp generated by entitykSigkSignature generated by entitykRIdkDynamic identity of entitykGen⋅/Rep⋅Fuzzy generator/reproduction functionh⋅One-way hash function


#### 2.1.1. Healthcare Center Upload Phase

The health centerH sends the medical record of the patient P to the cloud C. Meanwhile, H and C will establish a session key SKHC. The details are as follows:(1)
H generates a and mH=IDP,DataP, inputs IDH and a, and encrypts E1=EhPKH⊕TH1⊕PKC⊕TH1IDH,ag. Then, H sends M1=E1,TH1 to C.(2)
Upon receivingM1, C checks the validity of the timestamp TH1. If TH1 times out, the session is terminated. Otherwise, C decrypts IDH,ag=DhPKH⊕TH1⊕PKC⊕TH1E1. Then, C generates b, computes H1=hIDH‖ag‖bg‖TH1, and encrypts E2=EhIDH‖ag‖TH1‖TC2bg,H1. Finally, C sends M2=E2,TC2 to H.(3)
Upon receivingM2, H checks the validity of the timestamp TC2. If TC2 times out, the session is terminated. Otherwise, H decrypts bg,H1=DhIDH‖ag‖TH1‖TC2E2 and checks H1=?hIDH‖ag‖bg‖TH1. Then, P computes SKHC=hIDH‖H1‖abg‖TC2‖TH1, CH=EhIDP‖IDH‖NIDPmH, SigH=SPRHhmH, H2=hSKHC‖CH‖SigH‖TH3‖TC2, and E3=ESKHCIDP,NIDP,snP,CH,H2,SigH and sends M3=E3,TH3 to C.(4)
Upon receivingM3, C checks the validity of the timestamp TH3. If TH3 times out, the session is terminated. Otherwise, C computes SKCH=hIDH‖H1‖abg‖TC2‖TH1 and IDP,NIDP,snP,CH,H2,SigH=DSKCHE3 and checks H2=?hSKCH‖CH‖SigH‖TH3‖TC2. Then, C stores IDP,CH,SigH,NIDP,snP in the database.


#### 2.1.2. Patient Data Upload Phase

P sends medical data from body sensors to C. The details are as follows:(1)
P generates mB=IDP,DataB, inputs IDP,NIDP, and encrypts E4=EhIDP‖NIDP‖TP1IDP,NIDP. Then, P sends M4=IDP,TP1 to C.(2)
Upon receivingM4, C checks the validity of the timestamp TP1. If TP1 times out, the session is terminated. Otherwise, C decrypts IDP,NIDP=DhIDP‖NIDP‖TP1E4. Then, C generates c, computes H3=hNIDP‖sni‖CH‖SigH‖cg‖TC5|TP1, and encrypts E5=EhsnP‖NIDP‖TC5‖TP1SigH,CH,H3,IDH,cg. Finally, C sends M5=E5,TC5 to P.(3)
Upon receivingM5, P checks the validity of the timestamp TC5. If TC5 times out, the session is terminated. Otherwise, P decrypts SigH,CH,H3,IDH,cg=DhsnP‖NIDP‖TC5‖TP1E5 and checks H3=?hNIDP‖sni‖CH‖SigH‖cg‖TC5‖TP1. Furthermore, P generates d, computes SKPC=hIDP‖IDH‖CH‖H3‖cdg‖TC5‖TP1, and checks mH=?DhIDP‖IDH‖NIDPCH and VPKHSigH=?hmH. Then, P computes CP=EhsnP‖NIDP‖IDPmH,mB, SigP=SPRPhmB, H4=hSKPC‖CP‖SigP‖H3‖cdg‖TP3‖TC5, and E6=EhsnP‖NIDP‖IDPdg,H4,SigP,CP and sends M6=E6,TP3 to C.(4)
Upon receivingM6, C checks the validity of the timestamp TP3. If TP3 times out, the session is terminated. Otherwise, C computes dg,H4,SigP,CP=DhsnP‖NIDP‖IDPE6 and SKCP=hIDP‖IDH‖CH‖H3‖cdg‖TC5‖TP1 and checks H4=?hSKCP‖CP‖SigP‖H3‖cdg‖TP3‖TC5. Then, C stores CP,IDP,SigP in the database.


#### 2.1.3. Treatment Phase

D obtains medical records from C. The details are as follows:(1)
D inputs IDD, generates r, and encrypts E7=EhPKD⊕PKC⊕TD1IDD,rg. Then, D sends M7=E7,TD1 to C.(2)
Upon receivingM7, C checks the validity of the timestamp TD1. If TD1 times out, the session is terminated. Otherwise, C computes IDD,rg=DhPKD⊕PKC⊕TD1E7 and I=snP⊕hIDD‖rg‖TD1. Then, C generates s, computes H5=hIDP‖IDD‖SigH‖SigP‖CP‖TC8‖TD1, and encrypts E8=EsnPSigP,SigH,NIDP,CP,IDP,H6,sg. Finally, C sends M8=E8,I,TC8 to D.(3)
Upon receivingM8, D checks the validity of the timestamp TC8. If TC8 times out, the session is terminated. Otherwise, D computes snP=I⊕hIDD‖rg‖TD1 and SigP,SigH,NIDP,CP,IDP,H6,sg=DsnPE8 and checks H5=?hIDP‖IDD‖SigH‖SigP‖CP‖TC8‖TD1. Furthermore, D encrypts mH,mB=DhsnP‖NIDP‖IDPCP and checks VPKPSigP=?hmB. Then, D generates mD=IDP,DataD, computes CD=EhIDP‖IDD‖snP‖NIDPmH,mB,mD, SigD=SPRDhmD, H6=hIDP‖IDD‖CD‖SigD‖SigP‖TD3‖TC8, SKDC=hH6‖IDP‖IDD‖SigD‖SigP‖rsg‖TD3‖TC8, and E9=EsnPSigD,CD,H6, and sends M9=E9,TD3 to C.(4)
Upon receivingM9, C checks the validity of the timestamp TD3. If TD3 times out, the session is terminated. Otherwise, C computes SigD,CD,H6=DsnPE9 and checks H6=?hIDP‖IDD‖CD‖SigD‖SigP‖TD3‖TC8. Then, C computes SKCD=hH6‖IDP‖IDD‖SigD‖SigP‖rsg‖TD3‖TC8 and stores CD,SigD in the database.


#### 2.1.4. Checkup Phase

P asks C for treatment results. The details are as follows:(1)
P inputs IDP,NIDP,snP, generates x, and encrypts E10=ESKPCIDP,NIDP,snP,xg. Then, P sends M10=E10,TP4 to C.(2)
Upon receivingM10, C checks the validity of the timestamp TP4. If TP4 times out, the session is terminated. Otherwise, C decrypts IDP,NIDP,snP,xg=DSKPCE10. Then, C generates y, computes H7=hSKCP‖IDP‖IDD‖CD‖xyg‖SigP‖TC11‖TP4, and encrypts E11=ESKCPH7,IDD,SigD,CD,yg. Finally, C sends M11=E11,TC11 to P.(3)
Upon receivingM11, P checks the validity of the timestamp TC11. If TC11 times out, the session is terminated. Otherwise, P decrypts H7,IDD,SigD,CD,yg=DSKPCE11 and checks H7=?hSKPC‖IDP‖IDD‖CD‖xyg‖SigP‖TC11‖TP4. Furthermore, P decrypts mH,mB,mD=EhIDP‖IDD‖snP‖NIDPCD and checks VPKDSigD=?hmD. Then, P computes CE=EhIDP‖IDD‖snP‖NIDP‖SigPmH,mB,mD, H8=hSKPC‖lH7‖CE‖SigP‖SigD‖xyg‖TP6‖TC11, and E12=ESKPCCE,H8 and sends M12=E12,TP6 to C.(4)
Upon receivingM12, C checks the validity of the timestamp TP6. If TP6 times out, the session is terminated. Otherwise, C computes CE,H8=DSKCPE12 and SKCP=hIDP‖IDH‖CH‖H3‖cdg‖TC5‖TP1 and checks H8=?hSKCP‖H7‖CE‖SigP‖SigD‖xyg‖TP6‖TC11. Then, C stores CE in the database.


#### 2.1.5. Emergency Phase

In case of emergency,P can contact H through C. The details are as follows:(1)
P inputs IDP,EPrequest and computes H9=hH6‖IDP‖TEP1. Then, P selects α, encrypts E13=ESKPCH9,α,EPrequest, and sends M13=E13,TEP1 to C.(2)
Upon receivingM13, C checks the validity of the timestamp TEP1. If TEP1 times out, the session is terminated. Otherwise, C decrypts H9,α,EPrequest=DSKCPE13 and checks H9=?hH6‖IDP‖TEP1. Then, C computes H10=hH2‖IDH‖IDP‖TEP3 and E14=ESKCHEPrequest,IDP,H10,α,H9 and sends M14=E14,TEP3 to H.(3)
Upon receivingM14, H checks the validity of the timestamp TEP3. If TEP3 times out, the session is terminated. Otherwise, H decrypts EPrequest,IDP,H10,α,H9=DSKHCE14 and checks H10=?hH2‖IDH‖IDP‖TEP3. Then, H generates β, computes SKHP=hH9‖IDP‖IDH‖αβg‖TEP3‖TEP5, H11=hH9‖IDH‖IDP‖αg‖TEP5, KH=hIDH‖IDP‖H9‖αg, and E15=EKHβ,H11,EPreplay,TEP3,TEP5, and sends M15=E15,TEP5 to C.(4)
Upon receivingM15, C checks the validity of the timestamp TEP5. If TEP5 times out, the session is terminated. Otherwise, C sends M16=E15,TEP7 to H.(5)
Upon receivingM16, H checks the validity of the timestamp TEP7. If TEP7 times out, the session is terminated. Otherwise, H computes KP=hIDH‖IDP‖H9‖αg and β,H11,EPreplay,TEP3,TEP5=DKPE15 and checks H11=?hH9‖IDH‖IDP‖αg‖TEP5. Then, P computes SKPH=hH9‖IDP‖IDH‖αβg‖TEP3‖TEP5.


### 2.2. Cryptanalysis of Kumari et al.’s System

In this section, we introduce in detail the shortcomings of Kumari et al.’s system. According to the CK-adversary model, adversaryA has the ability to intercept and modify public channel messages and also has the ability to obtain long-term key or session temporary secret value. The specific security vulnerabilities are described as follows.


#### 2.2.1. Known Session-Specific Temporary Information Attacks

Based on this attack model, we allow thatA gets the random number a generated in the healthcare center upload phase (Section 2.2.2). Then, A can compute the session key SKHC as follows:(1)
A eavesdrops on M1=E1,TH1 and gets IDH,ag by decrypting IDH,ag=DhPKH⊕TH1⊕PKC⊕TH1E1. Note that PKH and PKC are the public keys for H and C, respectively.(2)
Furthermore,A eavesdrops on M2=E2,TC2 and gets bg,H1 by decrypting bg,H1=DhIDH‖ag‖TH1‖TC2E2.(3)
A computes the session key SKHC=SKCH=hIDH‖H1‖abg‖TC2‖TH1 of H and C. Therefore, Kumari et al.’s system cannot resist known session-specific temporary information attacks.


#### 2.2.2. Anonymity Cannot Be Provided

Based on the attack approach from Section2.2.1, A already knows SKHC=SKCH=hIDH‖H1‖abg‖TC2‖TH1.(1)
In the healthcare center upload phase,A eavesdrops on M3=E3,TH3 and gets IDP,NIDP,snP,CH,H2,SigH by decrypting IDP,NIDP,snP,CH,H2,SigH=DSKCHE3.(2)
In the treatment phase,A eavesdrops on M7=E7,TD1 and gets IDD,rg by decrypting IDD,rg=DhPKD⊕PKC⊕TD1E7. Note that PKD is the public key of D.At this point,A has obtained a,ag,bg,rg,H1,IDD,IDH,IDP,NIDP,snP,CH,H2,SigH, where IDP and IDD are the identities of P and D, respectively. Therefore, Kumari et al.’s system cannot provide patient and doctor’s anonymity.


#### 2.2.3. Impersonation Attacks

Based on the attack approach from Sections2.2.1 and 2.2.2, A has obtained IDH and SKHC. Then, A can impersonate H establishing a session key with P through C in the emergency phase as follows:(1)
A intercepts M14=E14,TEP3 and gets H9,α,IDP by decrypting EPrequest,IDP,H10,α,H9=DSKHCE14.(2)
A generates β′,TEP5′ and calculates SKAP=hH9‖IDP‖IDH‖αβ′g‖TEP3‖TEP5′, H11′=hH9‖IDH‖IDP‖αg‖TEP5′, KH′=hIDH‖IDP‖H9‖αg, and E15′=EKH′β′,H11′,EPreplay′,TEP3,TEP5′. Then, A sends M15′=E15′,TEP5′ to C.(3)
C checks the validity of the timestamp TEP5′ and sends M16′=E15′,TEP7 to H.(4)
H computes KP=hIDH‖IDP‖H9‖αg and β′,H11′,EPreplay′,TEP3,TEP5′=DKPE15′ and checks H11′=?hH9‖IDH‖IDP‖αg‖TEP5′. Obviously, H11′ can pass the verification. Then, P computes SKPA=hH9‖IDP‖IDH‖αβ′g‖TEP3‖TEP5′.Now, the patientH and A have successfully established the session key SKAP=SKPA; that is, A successfully impersonated H. In other words, Kumari et al.’s system cannot resist impersonation attacks.


#### 2.2.4. Desynchronization Attacks

Based on the attack approach from Sections2.2.1 and 2.2.2, A gets IDH,ag,bg,H1 and IDP,NIDP,snP,CH,H2,SigH by decrypting E1, E2, and E3 in the healthcare center upload phase. Then, A can generate another NIDP′,snP′,CH′,SigH′,TH3′ and sends M3′=E3′,TH3′ to C, where E3′=ESKHCIDP,NIDP′,snP′,CH′,H2′,SigH′ and H2′=hSKHC‖CH′‖SigH′‖TH3′‖TC2. Obviously, H2′ will be successfully verified by C, and it stores IDP,NIDP′,snP′,CH′,SigH′ into its database, and the data will be used in the patient data upload phase.In the patient data upload phase,C uses hIDP‖NIDP‖TP1 to decrypt E4. However, NIDP has been changed to NIDP′. Thus, C cannot successfully decrypt E4 and cannot continue to further steps. In other words, Kumari et al.’s system cannot resist desynchronization attacks.


#### 2.2.5. Data Confidentiality Cannot Be Provided

Based on the attack approach from Section2.2.1, A has obtained IDH,IDP,NIDP,snP,CH.(1)
In the healthcare center upload phase,A gets the medical record mH by decrypting mH=DhIDP‖IDH‖NIDPCH.(2)
In the patient data upload phase,A eavesdrops on M6=E6,TP3 and gets SigP,CP by decrypting dg,H4,SigP,CP=DhsnP‖NIDP‖IDPE6. Then, A gets the medical data mB by decrypting mH,mB=DhsnP‖NIDP‖IDPCP.(3)
In the treatment phase,A eavesdrops on M9=E9,TD3 and gets SigD,CD by decrypting SigD,CD,H6=DsnPE9. In the checkup phase, A gets the medical record mD by decrypting mH,mB,mD=EhIDP‖IDD‖snP‖NIDPCD.Hence,A can obtain all the medical records including body data of patients. In other words, Kumari et al.’s system cannot provide data confidentiality.


#### 2.2.6. Patient Unlinkability Cannot Be Provided

Patient unlinkability refers to that outsiders cannot obtain the medical relationship between doctors and patients through any channels. In the healthcare center upload phase,A can calculate mH=EhIDP‖IDH‖NIDPCH=IDP,DataP based on Section 2.2.2, so as to know the medical relationship between doctors and patients. Therefore, Kumari et al.’s system cannot provide patient unlinkability.


#### 2.2.7. Architecture Problem Statement

Based on the above attack approaches,A launched known session-specific temporary information attacks and desynchronization attacks and also knew the confidential data and the identities of patients, doctors, and the healthcare center. The main reason for these vulnerabilities in the system is that each phase of the system is linked with each other, and each entity needs to transfer a large number of private values. For example, A obtains some private information IDD,IDH,IDP,mH,mB,mD by decrypting E1, E2, E3, E9, CD.Due to the separate deployment of the cloud and the healthcare center, the transmission volume is increased. As a result, Kumari et al.’s system not only increases the cost of computing but also suffers from a variety of security threats.


## 2.1. Review of Kumari et al.’s System

Kumari et al.’s cloud-based smart medical system [30] includes four entities: cloud, healthcare center, patient, and doctor. After a patient is registered with a healthcare center, the center uploads the patient’s information to the cloud. After that, the patient established contact with the healthcare center through the cloud. Here, we ignore the registration phase. The symbolic description is shown in Table 2.Table 2
Symbols and descriptions.
SymbolDescriptionIDPIdentity of the patientIDDIdentity of the doctorHHealthcare centerCHCCloud healthcare centerAAdversarySCSmart cardsMaster key ofCHCSKkSession key generated by entitykTkTimestamp generated by entitykSigkSignature generated by entitykRIdkDynamic identity of entitykGen⋅/Rep⋅Fuzzy generator/reproduction functionh⋅One-way hash function


### 2.1.1. Healthcare Center Upload Phase

The health centerH sends the medical record of the patient P to the cloud C. Meanwhile, H and C will establish a session key SKHC. The details are as follows:(1)
H generates a and mH=IDP,DataP, inputs IDH and a, and encrypts E1=EhPKH⊕TH1⊕PKC⊕TH1IDH,ag. Then, H sends M1=E1,TH1 to C.(2)
Upon receivingM1, C checks the validity of the timestamp TH1. If TH1 times out, the session is terminated. Otherwise, C decrypts IDH,ag=DhPKH⊕TH1⊕PKC⊕TH1E1. Then, C generates b, computes H1=hIDH‖ag‖bg‖TH1, and encrypts E2=EhIDH‖ag‖TH1‖TC2bg,H1. Finally, C sends M2=E2,TC2 to H.(3)
Upon receivingM2, H checks the validity of the timestamp TC2. If TC2 times out, the session is terminated. Otherwise, H decrypts bg,H1=DhIDH‖ag‖TH1‖TC2E2 and checks H1=?hIDH‖ag‖bg‖TH1. Then, P computes SKHC=hIDH‖H1‖abg‖TC2‖TH1, CH=EhIDP‖IDH‖NIDPmH, SigH=SPRHhmH, H2=hSKHC‖CH‖SigH‖TH3‖TC2, and E3=ESKHCIDP,NIDP,snP,CH,H2,SigH and sends M3=E3,TH3 to C.(4)
Upon receivingM3, C checks the validity of the timestamp TH3. If TH3 times out, the session is terminated. Otherwise, C computes SKCH=hIDH‖H1‖abg‖TC2‖TH1 and IDP,NIDP,snP,CH,H2,SigH=DSKCHE3 and checks H2=?hSKCH‖CH‖SigH‖TH3‖TC2. Then, C stores IDP,CH,SigH,NIDP,snP in the database.


### 2.1.2. Patient Data Upload Phase

P sends medical data from body sensors to C. The details are as follows:(1)
P generates mB=IDP,DataB, inputs IDP,NIDP, and encrypts E4=EhIDP‖NIDP‖TP1IDP,NIDP. Then, P sends M4=IDP,TP1 to C.(2)
Upon receivingM4, C checks the validity of the timestamp TP1. If TP1 times out, the session is terminated. Otherwise, C decrypts IDP,NIDP=DhIDP‖NIDP‖TP1E4. Then, C generates c, computes H3=hNIDP‖sni‖CH‖SigH‖cg‖TC5|TP1, and encrypts E5=EhsnP‖NIDP‖TC5‖TP1SigH,CH,H3,IDH,cg. Finally, C sends M5=E5,TC5 to P.(3)
Upon receivingM5, P checks the validity of the timestamp TC5. If TC5 times out, the session is terminated. Otherwise, P decrypts SigH,CH,H3,IDH,cg=DhsnP‖NIDP‖TC5‖TP1E5 and checks H3=?hNIDP‖sni‖CH‖SigH‖cg‖TC5‖TP1. Furthermore, P generates d, computes SKPC=hIDP‖IDH‖CH‖H3‖cdg‖TC5‖TP1, and checks mH=?DhIDP‖IDH‖NIDPCH and VPKHSigH=?hmH. Then, P computes CP=EhsnP‖NIDP‖IDPmH,mB, SigP=SPRPhmB, H4=hSKPC‖CP‖SigP‖H3‖cdg‖TP3‖TC5, and E6=EhsnP‖NIDP‖IDPdg,H4,SigP,CP and sends M6=E6,TP3 to C.(4)
Upon receivingM6, C checks the validity of the timestamp TP3. If TP3 times out, the session is terminated. Otherwise, C computes dg,H4,SigP,CP=DhsnP‖NIDP‖IDPE6 and SKCP=hIDP‖IDH‖CH‖H3‖cdg‖TC5‖TP1 and checks H4=?hSKCP‖CP‖SigP‖H3‖cdg‖TP3‖TC5. Then, C stores CP,IDP,SigP in the database.


### 2.1.3. Treatment Phase

D obtains medical records from C. The details are as follows:(1)
D inputs IDD, generates r, and encrypts E7=EhPKD⊕PKC⊕TD1IDD,rg. Then, D sends M7=E7,TD1 to C.(2)
Upon receivingM7, C checks the validity of the timestamp TD1. If TD1 times out, the session is terminated. Otherwise, C computes IDD,rg=DhPKD⊕PKC⊕TD1E7 and I=snP⊕hIDD‖rg‖TD1. Then, C generates s, computes H5=hIDP‖IDD‖SigH‖SigP‖CP‖TC8‖TD1, and encrypts E8=EsnPSigP,SigH,NIDP,CP,IDP,H6,sg. Finally, C sends M8=E8,I,TC8 to D.(3)
Upon receivingM8, D checks the validity of the timestamp TC8. If TC8 times out, the session is terminated. Otherwise, D computes snP=I⊕hIDD‖rg‖TD1 and SigP,SigH,NIDP,CP,IDP,H6,sg=DsnPE8 and checks H5=?hIDP‖IDD‖SigH‖SigP‖CP‖TC8‖TD1. Furthermore, D encrypts mH,mB=DhsnP‖NIDP‖IDPCP and checks VPKPSigP=?hmB. Then, D generates mD=IDP,DataD, computes CD=EhIDP‖IDD‖snP‖NIDPmH,mB,mD, SigD=SPRDhmD, H6=hIDP‖IDD‖CD‖SigD‖SigP‖TD3‖TC8, SKDC=hH6‖IDP‖IDD‖SigD‖SigP‖rsg‖TD3‖TC8, and E9=EsnPSigD,CD,H6, and sends M9=E9,TD3 to C.(4)
Upon receivingM9, C checks the validity of the timestamp TD3. If TD3 times out, the session is terminated. Otherwise, C computes SigD,CD,H6=DsnPE9 and checks H6=?hIDP‖IDD‖CD‖SigD‖SigP‖TD3‖TC8. Then, C computes SKCD=hH6‖IDP‖IDD‖SigD‖SigP‖rsg‖TD3‖TC8 and stores CD,SigD in the database.


### 2.1.4. Checkup Phase

P asks C for treatment results. The details are as follows:(1)
P inputs IDP,NIDP,snP, generates x, and encrypts E10=ESKPCIDP,NIDP,snP,xg. Then, P sends M10=E10,TP4 to C.(2)
Upon receivingM10, C checks the validity of the timestamp TP4. If TP4 times out, the session is terminated. Otherwise, C decrypts IDP,NIDP,snP,xg=DSKPCE10. Then, C generates y, computes H7=hSKCP‖IDP‖IDD‖CD‖xyg‖SigP‖TC11‖TP4, and encrypts E11=ESKCPH7,IDD,SigD,CD,yg. Finally, C sends M11=E11,TC11 to P.(3)
Upon receivingM11, P checks the validity of the timestamp TC11. If TC11 times out, the session is terminated. Otherwise, P decrypts H7,IDD,SigD,CD,yg=DSKPCE11 and checks H7=?hSKPC‖IDP‖IDD‖CD‖xyg‖SigP‖TC11‖TP4. Furthermore, P decrypts mH,mB,mD=EhIDP‖IDD‖snP‖NIDPCD and checks VPKDSigD=?hmD. Then, P computes CE=EhIDP‖IDD‖snP‖NIDP‖SigPmH,mB,mD, H8=hSKPC‖lH7‖CE‖SigP‖SigD‖xyg‖TP6‖TC11, and E12=ESKPCCE,H8 and sends M12=E12,TP6 to C.(4)
Upon receivingM12, C checks the validity of the timestamp TP6. If TP6 times out, the session is terminated. Otherwise, C computes CE,H8=DSKCPE12 and SKCP=hIDP‖IDH‖CH‖H3‖cdg‖TC5‖TP1 and checks H8=?hSKCP‖H7‖CE‖SigP‖SigD‖xyg‖TP6‖TC11. Then, C stores CE in the database.


### 2.1.5. Emergency Phase

In case of emergency,P can contact H through C. The details are as follows:(1)
P inputs IDP,EPrequest and computes H9=hH6‖IDP‖TEP1. Then, P selects α, encrypts E13=ESKPCH9,α,EPrequest, and sends M13=E13,TEP1 to C.(2)
Upon receivingM13, C checks the validity of the timestamp TEP1. If TEP1 times out, the session is terminated. Otherwise, C decrypts H9,α,EPrequest=DSKCPE13 and checks H9=?hH6‖IDP‖TEP1. Then, C computes H10=hH2‖IDH‖IDP‖TEP3 and E14=ESKCHEPrequest,IDP,H10,α,H9 and sends M14=E14,TEP3 to H.(3)
Upon receivingM14, H checks the validity of the timestamp TEP3. If TEP3 times out, the session is terminated. Otherwise, H decrypts EPrequest,IDP,H10,α,H9=DSKHCE14 and checks H10=?hH2‖IDH‖IDP‖TEP3. Then, H generates β, computes SKHP=hH9‖IDP‖IDH‖αβg‖TEP3‖TEP5, H11=hH9‖IDH‖IDP‖αg‖TEP5, KH=hIDH‖IDP‖H9‖αg, and E15=EKHβ,H11,EPreplay,TEP3,TEP5, and sends M15=E15,TEP5 to C.(4)
Upon receivingM15, C checks the validity of the timestamp TEP5. If TEP5 times out, the session is terminated. Otherwise, C sends M16=E15,TEP7 to H.(5)
Upon receivingM16, H checks the validity of the timestamp TEP7. If TEP7 times out, the session is terminated. Otherwise, H computes KP=hIDH‖IDP‖H9‖αg and β,H11,EPreplay,TEP3,TEP5=DKPE15 and checks H11=?hH9‖IDH‖IDP‖αg‖TEP5. Then, P computes SKPH=hH9‖IDP‖IDH‖αβg‖TEP3‖TEP5.


## 2.1.1. Healthcare Center Upload Phase

The health centerH sends the medical record of the patient P to the cloud C. Meanwhile, H and C will establish a session key SKHC. The details are as follows:(1)
H generates a and mH=IDP,DataP, inputs IDH and a, and encrypts E1=EhPKH⊕TH1⊕PKC⊕TH1IDH,ag. Then, H sends M1=E1,TH1 to C.(2)
Upon receivingM1, C checks the validity of the timestamp TH1. If TH1 times out, the session is terminated. Otherwise, C decrypts IDH,ag=DhPKH⊕TH1⊕PKC⊕TH1E1. Then, C generates b, computes H1=hIDH‖ag‖bg‖TH1, and encrypts E2=EhIDH‖ag‖TH1‖TC2bg,H1. Finally, C sends M2=E2,TC2 to H.(3)
Upon receivingM2, H checks the validity of the timestamp TC2. If TC2 times out, the session is terminated. Otherwise, H decrypts bg,H1=DhIDH‖ag‖TH1‖TC2E2 and checks H1=?hIDH‖ag‖bg‖TH1. Then, P computes SKHC=hIDH‖H1‖abg‖TC2‖TH1, CH=EhIDP‖IDH‖NIDPmH, SigH=SPRHhmH, H2=hSKHC‖CH‖SigH‖TH3‖TC2, and E3=ESKHCIDP,NIDP,snP,CH,H2,SigH and sends M3=E3,TH3 to C.(4)
Upon receivingM3, C checks the validity of the timestamp TH3. If TH3 times out, the session is terminated. Otherwise, C computes SKCH=hIDH‖H1‖abg‖TC2‖TH1 and IDP,NIDP,snP,CH,H2,SigH=DSKCHE3 and checks H2=?hSKCH‖CH‖SigH‖TH3‖TC2. Then, C stores IDP,CH,SigH,NIDP,snP in the database.


## 2.1.2. Patient Data Upload Phase

P sends medical data from body sensors to C. The details are as follows:(1)
P generates mB=IDP,DataB, inputs IDP,NIDP, and encrypts E4=EhIDP‖NIDP‖TP1IDP,NIDP. Then, P sends M4=IDP,TP1 to C.(2)
Upon receivingM4, C checks the validity of the timestamp TP1. If TP1 times out, the session is terminated. Otherwise, C decrypts IDP,NIDP=DhIDP‖NIDP‖TP1E4. Then, C generates c, computes H3=hNIDP‖sni‖CH‖SigH‖cg‖TC5|TP1, and encrypts E5=EhsnP‖NIDP‖TC5‖TP1SigH,CH,H3,IDH,cg. Finally, C sends M5=E5,TC5 to P.(3)
Upon receivingM5, P checks the validity of the timestamp TC5. If TC5 times out, the session is terminated. Otherwise, P decrypts SigH,CH,H3,IDH,cg=DhsnP‖NIDP‖TC5‖TP1E5 and checks H3=?hNIDP‖sni‖CH‖SigH‖cg‖TC5‖TP1. Furthermore, P generates d, computes SKPC=hIDP‖IDH‖CH‖H3‖cdg‖TC5‖TP1, and checks mH=?DhIDP‖IDH‖NIDPCH and VPKHSigH=?hmH. Then, P computes CP=EhsnP‖NIDP‖IDPmH,mB, SigP=SPRPhmB, H4=hSKPC‖CP‖SigP‖H3‖cdg‖TP3‖TC5, and E6=EhsnP‖NIDP‖IDPdg,H4,SigP,CP and sends M6=E6,TP3 to C.(4)
Upon receivingM6, C checks the validity of the timestamp TP3. If TP3 times out, the session is terminated. Otherwise, C computes dg,H4,SigP,CP=DhsnP‖NIDP‖IDPE6 and SKCP=hIDP‖IDH‖CH‖H3‖cdg‖TC5‖TP1 and checks H4=?hSKCP‖CP‖SigP‖H3‖cdg‖TP3‖TC5. Then, C stores CP,IDP,SigP in the database.


## 2.1.3. Treatment Phase

D obtains medical records from C. The details are as follows:(1)
D inputs IDD, generates r, and encrypts E7=EhPKD⊕PKC⊕TD1IDD,rg. Then, D sends M7=E7,TD1 to C.(2)
Upon receivingM7, C checks the validity of the timestamp TD1. If TD1 times out, the session is terminated. Otherwise, C computes IDD,rg=DhPKD⊕PKC⊕TD1E7 and I=snP⊕hIDD‖rg‖TD1. Then, C generates s, computes H5=hIDP‖IDD‖SigH‖SigP‖CP‖TC8‖TD1, and encrypts E8=EsnPSigP,SigH,NIDP,CP,IDP,H6,sg. Finally, C sends M8=E8,I,TC8 to D.(3)
Upon receivingM8, D checks the validity of the timestamp TC8. If TC8 times out, the session is terminated. Otherwise, D computes snP=I⊕hIDD‖rg‖TD1 and SigP,SigH,NIDP,CP,IDP,H6,sg=DsnPE8 and checks H5=?hIDP‖IDD‖SigH‖SigP‖CP‖TC8‖TD1. Furthermore, D encrypts mH,mB=DhsnP‖NIDP‖IDPCP and checks VPKPSigP=?hmB. Then, D generates mD=IDP,DataD, computes CD=EhIDP‖IDD‖snP‖NIDPmH,mB,mD, SigD=SPRDhmD, H6=hIDP‖IDD‖CD‖SigD‖SigP‖TD3‖TC8, SKDC=hH6‖IDP‖IDD‖SigD‖SigP‖rsg‖TD3‖TC8, and E9=EsnPSigD,CD,H6, and sends M9=E9,TD3 to C.(4)
Upon receivingM9, C checks the validity of the timestamp TD3. If TD3 times out, the session is terminated. Otherwise, C computes SigD,CD,H6=DsnPE9 and checks H6=?hIDP‖IDD‖CD‖SigD‖SigP‖TD3‖TC8. Then, C computes SKCD=hH6‖IDP‖IDD‖SigD‖SigP‖rsg‖TD3‖TC8 and stores CD,SigD in the database.


## 2.1.4. Checkup Phase

P asks C for treatment results. The details are as follows:(1)
P inputs IDP,NIDP,snP, generates x, and encrypts E10=ESKPCIDP,NIDP,snP,xg. Then, P sends M10=E10,TP4 to C.(2)
Upon receivingM10, C checks the validity of the timestamp TP4. If TP4 times out, the session is terminated. Otherwise, C decrypts IDP,NIDP,snP,xg=DSKPCE10. Then, C generates y, computes H7=hSKCP‖IDP‖IDD‖CD‖xyg‖SigP‖TC11‖TP4, and encrypts E11=ESKCPH7,IDD,SigD,CD,yg. Finally, C sends M11=E11,TC11 to P.(3)
Upon receivingM11, P checks the validity of the timestamp TC11. If TC11 times out, the session is terminated. Otherwise, P decrypts H7,IDD,SigD,CD,yg=DSKPCE11 and checks H7=?hSKPC‖IDP‖IDD‖CD‖xyg‖SigP‖TC11‖TP4. Furthermore, P decrypts mH,mB,mD=EhIDP‖IDD‖snP‖NIDPCD and checks VPKDSigD=?hmD. Then, P computes CE=EhIDP‖IDD‖snP‖NIDP‖SigPmH,mB,mD, H8=hSKPC‖lH7‖CE‖SigP‖SigD‖xyg‖TP6‖TC11, and E12=ESKPCCE,H8 and sends M12=E12,TP6 to C.(4)
Upon receivingM12, C checks the validity of the timestamp TP6. If TP6 times out, the session is terminated. Otherwise, C computes CE,H8=DSKCPE12 and SKCP=hIDP‖IDH‖CH‖H3‖cdg‖TC5‖TP1 and checks H8=?hSKCP‖H7‖CE‖SigP‖SigD‖xyg‖TP6‖TC11. Then, C stores CE in the database.


## 2.1.5. Emergency Phase

In case of emergency,P can contact H through C. The details are as follows:(1)
P inputs IDP,EPrequest and computes H9=hH6‖IDP‖TEP1. Then, P selects α, encrypts E13=ESKPCH9,α,EPrequest, and sends M13=E13,TEP1 to C.(2)
Upon receivingM13, C checks the validity of the timestamp TEP1. If TEP1 times out, the session is terminated. Otherwise, C decrypts H9,α,EPrequest=DSKCPE13 and checks H9=?hH6‖IDP‖TEP1. Then, C computes H10=hH2‖IDH‖IDP‖TEP3 and E14=ESKCHEPrequest,IDP,H10,α,H9 and sends M14=E14,TEP3 to H.(3)
Upon receivingM14, H checks the validity of the timestamp TEP3. If TEP3 times out, the session is terminated. Otherwise, H decrypts EPrequest,IDP,H10,α,H9=DSKHCE14 and checks H10=?hH2‖IDH‖IDP‖TEP3. Then, H generates β, computes SKHP=hH9‖IDP‖IDH‖αβg‖TEP3‖TEP5, H11=hH9‖IDH‖IDP‖αg‖TEP5, KH=hIDH‖IDP‖H9‖αg, and E15=EKHβ,H11,EPreplay,TEP3,TEP5, and sends M15=E15,TEP5 to C.(4)
Upon receivingM15, C checks the validity of the timestamp TEP5. If TEP5 times out, the session is terminated. Otherwise, C sends M16=E15,TEP7 to H.(5)
Upon receivingM16, H checks the validity of the timestamp TEP7. If TEP7 times out, the session is terminated. Otherwise, H computes KP=hIDH‖IDP‖H9‖αg and β,H11,EPreplay,TEP3,TEP5=DKPE15 and checks H11=?hH9‖IDH‖IDP‖αg‖TEP5. Then, P computes SKPH=hH9‖IDP‖IDH‖αβg‖TEP3‖TEP5.


## 2.2. Cryptanalysis of Kumari et al.’s System

In this section, we introduce in detail the shortcomings of Kumari et al.’s system. According to the CK-adversary model, adversaryA has the ability to intercept and modify public channel messages and also has the ability to obtain long-term key or session temporary secret value. The specific security vulnerabilities are described as follows.


### 2.2.1. Known Session-Specific Temporary Information Attacks

Based on this attack model, we allow thatA gets the random number a generated in the healthcare center upload phase (Section 2.2.2). Then, A can compute the session key SKHC as follows:(1)
A eavesdrops on M1=E1,TH1 and gets IDH,ag by decrypting IDH,ag=DhPKH⊕TH1⊕PKC⊕TH1E1. Note that PKH and PKC are the public keys for H and C, respectively.(2)
Furthermore,A eavesdrops on M2=E2,TC2 and gets bg,H1 by decrypting bg,H1=DhIDH‖ag‖TH1‖TC2E2.(3)
A computes the session key SKHC=SKCH=hIDH‖H1‖abg‖TC2‖TH1 of H and C. Therefore, Kumari et al.’s system cannot resist known session-specific temporary information attacks.


### 2.2.2. Anonymity Cannot Be Provided

Based on the attack approach from Section2.2.1, A already knows SKHC=SKCH=hIDH‖H1‖abg‖TC2‖TH1.(1)
In the healthcare center upload phase,A eavesdrops on M3=E3,TH3 and gets IDP,NIDP,snP,CH,H2,SigH by decrypting IDP,NIDP,snP,CH,H2,SigH=DSKCHE3.(2)
In the treatment phase,A eavesdrops on M7=E7,TD1 and gets IDD,rg by decrypting IDD,rg=DhPKD⊕PKC⊕TD1E7. Note that PKD is the public key of D.At this point,A has obtained a,ag,bg,rg,H1,IDD,IDH,IDP,NIDP,snP,CH,H2,SigH, where IDP and IDD are the identities of P and D, respectively. Therefore, Kumari et al.’s system cannot provide patient and doctor’s anonymity.


### 2.2.3. Impersonation Attacks

Based on the attack approach from Sections2.2.1 and 2.2.2, A has obtained IDH and SKHC. Then, A can impersonate H establishing a session key with P through C in the emergency phase as follows:(1)
A intercepts M14=E14,TEP3 and gets H9,α,IDP by decrypting EPrequest,IDP,H10,α,H9=DSKHCE14.(2)
A generates β′,TEP5′ and calculates SKAP=hH9‖IDP‖IDH‖αβ′g‖TEP3‖TEP5′, H11′=hH9‖IDH‖IDP‖αg‖TEP5′, KH′=hIDH‖IDP‖H9‖αg, and E15′=EKH′β′,H11′,EPreplay′,TEP3,TEP5′. Then, A sends M15′=E15′,TEP5′ to C.(3)
C checks the validity of the timestamp TEP5′ and sends M16′=E15′,TEP7 to H.(4)
H computes KP=hIDH‖IDP‖H9‖αg and β′,H11′,EPreplay′,TEP3,TEP5′=DKPE15′ and checks H11′=?hH9‖IDH‖IDP‖αg‖TEP5′. Obviously, H11′ can pass the verification. Then, P computes SKPA=hH9‖IDP‖IDH‖αβ′g‖TEP3‖TEP5′.Now, the patientH and A have successfully established the session key SKAP=SKPA; that is, A successfully impersonated H. In other words, Kumari et al.’s system cannot resist impersonation attacks.


### 2.2.4. Desynchronization Attacks

Based on the attack approach from Sections2.2.1 and 2.2.2, A gets IDH,ag,bg,H1 and IDP,NIDP,snP,CH,H2,SigH by decrypting E1, E2, and E3 in the healthcare center upload phase. Then, A can generate another NIDP′,snP′,CH′,SigH′,TH3′ and sends M3′=E3′,TH3′ to C, where E3′=ESKHCIDP,NIDP′,snP′,CH′,H2′,SigH′ and H2′=hSKHC‖CH′‖SigH′‖TH3′‖TC2. Obviously, H2′ will be successfully verified by C, and it stores IDP,NIDP′,snP′,CH′,SigH′ into its database, and the data will be used in the patient data upload phase.In the patient data upload phase,C uses hIDP‖NIDP‖TP1 to decrypt E4. However, NIDP has been changed to NIDP′. Thus, C cannot successfully decrypt E4 and cannot continue to further steps. In other words, Kumari et al.’s system cannot resist desynchronization attacks.


### 2.2.5. Data Confidentiality Cannot Be Provided

Based on the attack approach from Section2.2.1, A has obtained IDH,IDP,NIDP,snP,CH.(1)
In the healthcare center upload phase,A gets the medical record mH by decrypting mH=DhIDP‖IDH‖NIDPCH.(2)
In the patient data upload phase,A eavesdrops on M6=E6,TP3 and gets SigP,CP by decrypting dg,H4,SigP,CP=DhsnP‖NIDP‖IDPE6. Then, A gets the medical data mB by decrypting mH,mB=DhsnP‖NIDP‖IDPCP.(3)
In the treatment phase,A eavesdrops on M9=E9,TD3 and gets SigD,CD by decrypting SigD,CD,H6=DsnPE9. In the checkup phase, A gets the medical record mD by decrypting mH,mB,mD=EhIDP‖IDD‖snP‖NIDPCD.Hence,A can obtain all the medical records including body data of patients. In other words, Kumari et al.’s system cannot provide data confidentiality.


### 2.2.6. Patient Unlinkability Cannot Be Provided

Patient unlinkability refers to that outsiders cannot obtain the medical relationship between doctors and patients through any channels. In the healthcare center upload phase,A can calculate mH=EhIDP‖IDH‖NIDPCH=IDP,DataP based on Section 2.2.2, so as to know the medical relationship between doctors and patients. Therefore, Kumari et al.’s system cannot provide patient unlinkability.


### 2.2.7. Architecture Problem Statement

Based on the above attack approaches,A launched known session-specific temporary information attacks and desynchronization attacks and also knew the confidential data and the identities of patients, doctors, and the healthcare center. The main reason for these vulnerabilities in the system is that each phase of the system is linked with each other, and each entity needs to transfer a large number of private values. For example, A obtains some private information IDD,IDH,IDP,mH,mB,mD by decrypting E1, E2, E3, E9, CD.Due to the separate deployment of the cloud and the healthcare center, the transmission volume is increased. As a result, Kumari et al.’s system not only increases the cost of computing but also suffers from a variety of security threats.


## 2.2.1. Known Session-Specific Temporary Information Attacks

Based on this attack model, we allow thatA gets the random number a generated in the healthcare center upload phase (Section 2.2.2). Then, A can compute the session key SKHC as follows:(1)
A eavesdrops on M1=E1,TH1 and gets IDH,ag by decrypting IDH,ag=DhPKH⊕TH1⊕PKC⊕TH1E1. Note that PKH and PKC are the public keys for H and C, respectively.(2)
Furthermore,A eavesdrops on M2=E2,TC2 and gets bg,H1 by decrypting bg,H1=DhIDH‖ag‖TH1‖TC2E2.(3)
A computes the session key SKHC=SKCH=hIDH‖H1‖abg‖TC2‖TH1 of H and C. Therefore, Kumari et al.’s system cannot resist known session-specific temporary information attacks.


## 2.2.2. Anonymity Cannot Be Provided

Based on the attack approach from Section2.2.1, A already knows SKHC=SKCH=hIDH‖H1‖abg‖TC2‖TH1.(1)
In the healthcare center upload phase,A eavesdrops on M3=E3,TH3 and gets IDP,NIDP,snP,CH,H2,SigH by decrypting IDP,NIDP,snP,CH,H2,SigH=DSKCHE3.(2)
In the treatment phase,A eavesdrops on M7=E7,TD1 and gets IDD,rg by decrypting IDD,rg=DhPKD⊕PKC⊕TD1E7. Note that PKD is the public key of D.At this point,A has obtained a,ag,bg,rg,H1,IDD,IDH,IDP,NIDP,snP,CH,H2,SigH, where IDP and IDD are the identities of P and D, respectively. Therefore, Kumari et al.’s system cannot provide patient and doctor’s anonymity.


## 2.2.3. Impersonation Attacks

Based on the attack approach from Sections2.2.1 and 2.2.2, A has obtained IDH and SKHC. Then, A can impersonate H establishing a session key with P through C in the emergency phase as follows:(1)
A intercepts M14=E14,TEP3 and gets H9,α,IDP by decrypting EPrequest,IDP,H10,α,H9=DSKHCE14.(2)
A generates β′,TEP5′ and calculates SKAP=hH9‖IDP‖IDH‖αβ′g‖TEP3‖TEP5′, H11′=hH9‖IDH‖IDP‖αg‖TEP5′, KH′=hIDH‖IDP‖H9‖αg, and E15′=EKH′β′,H11′,EPreplay′,TEP3,TEP5′. Then, A sends M15′=E15′,TEP5′ to C.(3)
C checks the validity of the timestamp TEP5′ and sends M16′=E15′,TEP7 to H.(4)
H computes KP=hIDH‖IDP‖H9‖αg and β′,H11′,EPreplay′,TEP3,TEP5′=DKPE15′ and checks H11′=?hH9‖IDH‖IDP‖αg‖TEP5′. Obviously, H11′ can pass the verification. Then, P computes SKPA=hH9‖IDP‖IDH‖αβ′g‖TEP3‖TEP5′.Now, the patientH and A have successfully established the session key SKAP=SKPA; that is, A successfully impersonated H. In other words, Kumari et al.’s system cannot resist impersonation attacks.


## 2.2.4. Desynchronization Attacks

Based on the attack approach from Sections2.2.1 and 2.2.2, A gets IDH,ag,bg,H1 and IDP,NIDP,snP,CH,H2,SigH by decrypting E1, E2, and E3 in the healthcare center upload phase. Then, A can generate another NIDP′,snP′,CH′,SigH′,TH3′ and sends M3′=E3′,TH3′ to C, where E3′=ESKHCIDP,NIDP′,snP′,CH′,H2′,SigH′ and H2′=hSKHC‖CH′‖SigH′‖TH3′‖TC2. Obviously, H2′ will be successfully verified by C, and it stores IDP,NIDP′,snP′,CH′,SigH′ into its database, and the data will be used in the patient data upload phase.In the patient data upload phase,C uses hIDP‖NIDP‖TP1 to decrypt E4. However, NIDP has been changed to NIDP′. Thus, C cannot successfully decrypt E4 and cannot continue to further steps. In other words, Kumari et al.’s system cannot resist desynchronization attacks.


## 2.2.5. Data Confidentiality Cannot Be Provided

Based on the attack approach from Section2.2.1, A has obtained IDH,IDP,NIDP,snP,CH.(1)
In the healthcare center upload phase,A gets the medical record mH by decrypting mH=DhIDP‖IDH‖NIDPCH.(2)
In the patient data upload phase,A eavesdrops on M6=E6,TP3 and gets SigP,CP by decrypting dg,H4,SigP,CP=DhsnP‖NIDP‖IDPE6. Then, A gets the medical data mB by decrypting mH,mB=DhsnP‖NIDP‖IDPCP.(3)
In the treatment phase,A eavesdrops on M9=E9,TD3 and gets SigD,CD by decrypting SigD,CD,H6=DsnPE9. In the checkup phase, A gets the medical record mD by decrypting mH,mB,mD=EhIDP‖IDD‖snP‖NIDPCD.Hence,A can obtain all the medical records including body data of patients. In other words, Kumari et al.’s system cannot provide data confidentiality.


## 2.2.6. Patient Unlinkability Cannot Be Provided

Patient unlinkability refers to that outsiders cannot obtain the medical relationship between doctors and patients through any channels. In the healthcare center upload phase,A can calculate mH=EhIDP‖IDH‖NIDPCH=IDP,DataP based on Section 2.2.2, so as to know the medical relationship between doctors and patients. Therefore, Kumari et al.’s system cannot provide patient unlinkability.


## 2.2.7. Architecture Problem Statement

Based on the above attack approaches,A launched known session-specific temporary information attacks and desynchronization attacks and also knew the confidential data and the identities of patients, doctors, and the healthcare center. The main reason for these vulnerabilities in the system is that each phase of the system is linked with each other, and each entity needs to transfer a large number of private values. For example, A obtains some private information IDD,IDH,IDP,mH,mB,mD by decrypting E1, E2, E3, E9, CD.Due to the separate deployment of the cloud and the healthcare center, the transmission volume is increased. As a result, Kumari et al.’s system not only increases the cost of computing but also suffers from a variety of security threats.


## 3. Proposed Protocol

Based on the communication architecture described in Figure1, we can clearly understand its communication advantages. In order to ensure the convenience and secrecy of patients seeking medical treatment, we bind the cloud to the healthcare center, which is called the cloud healthcare center CHC. Patients and doctors can obtain the corresponding services only after they register in the cloud healthcare center. Patients establish contact with doctors through the cloud healthcare center to obtain effective treatment. The process of the protocol is as follows.


### 3.1. Patient Registration Phase

In order to seek treatment from a doctor, patientPi first registers with CHC, and the registration process is as follows:(1)
Pi selects IDi and PWi and inputs biological information Bi. Furthermore, Pi computes σi,τi=GenBi and RIdi=hIDi‖PWi‖σi and sends IDi,RIdi to CHC via a secure channel.(2)
CHC first checks whether there is a record of IDi in the database. If not, it means that Pi is a new patient, and set c=0. If so, set c=c+1. Then, continue with the following process. CHC computes Ai=hIDi‖s‖c and RIdiCHC=hAi‖RIdi and stores RIdiCHC,IDi,c in the database and Ai,RIdiCHC in SC. Finally, SC is sent to Pi via a secure channel.(3)
Pi computes A1=Ai⊕σi and A2=hIDi‖PWi‖A1 and stores A2,τi in SC.The patient registration phase is shown in Figure2.Figure 2
Patient registration phase.


### 3.2. Doctor Registration Phase

To ensure the confidentiality of patient information, doctorDj needs to register with CHC. The steps are as follows:(1)
Dj selects IDj, PWj, and a random number rj. Then, Dj computes RIdj=hIDj‖Wj‖rj and sends IDj to CHC via a secure channel.(2)
CHC computes RIdjCHC=hIDj‖s and returns RIdjCHC to Dj.(3)
Dj computes PKj=RIdjCHCg and public key PKj.The doctor registration phase is shown in Figure3.Figure 3
Doctor registration phase.


### 3.3. Authentication and Key Agreement Phase

This phase combines the treatment and checkup phases of Kumari et al.’s system. AfterPi successfully logs in to the smart card, the body data collected by the sensor or his/her own physical condition can be reported to Dj through CHC so that the patient can have a more comprehensive understanding of the health situation. The steps are as follows:(1)
Pi inputs IDi, PWi, and Bi. Then, Pj computes σi=RepBi,τi and A1=Ai⊕σi, A2′=hIDi‖PWi‖A1 and checks A2′=?A2. If not, terminate the session. Otherwise, Pi selects a random number x and T1, computes H1=hIDi‖Ai‖xg and E1=EhIDi‖Ai‖T1H1,xg,T1, and sends M1=E1,T1,RIdiCHC to CHC.(2)
CHC checks T2−T1≤ΔT. According to RIdiCHC, CHC can find IDi to compute H1,xg,T1=DhIDi‖Ai‖T1E1 and check H1=?hIDi‖Ai‖xg. If not, terminate the session. Otherwise, CHC selects y,T3, updates RIdinew=hy‖Ai‖RIdiCHC, and computes RIdjnew=hy‖IDi‖s, H2=hH1‖IDj‖PKj, F1=IDi⊕hH1‖H2, and E2=EhIDj‖RIdjCHC‖PKj‖H1,H2,F1,T3,xg,yg,RIdinew,RIdjnew. Then, CHC sends M2=E2,T3 to Dj.(3)
Dj checks T4−T3≤ΔT. Dj computes H1,H2,F1,T3,xg,yg,RIdinew,RIdjnew=DhIDj‖RIdjCHC‖PKjE2 and checks H2=?hH1‖IDj‖PKj‖. If not, terminate the session. Otherwise, Dj replaces RIdjCHC with RIdjnew. Then, Dj selects z,T5, computes IDi=F1⊕hH1‖H2, H3=hIDi‖IDj‖yg‖zg‖H2, SKj=hIDi‖IDj‖yg‖xzg‖H1‖H3, F2=IDj⊕hH1‖H2‖H3, and E3=EhH1‖xg‖T5H2,H3,F2,T5,yg,zg,RIdinew, and sends M3=E3,T5 to CHC.(4)
CHC checks T6−T5≤ΔT. If not, terminate the session. Otherwise, CHC sends M4=E3,T5,T7 to Pi.(5)
Pi checks T7−T6≤ΔT. Pi computes H2,H3,F2,T5,yg,zg,RIdinew=DhH1‖xg‖T5E3 and IDj=F2⊕hH1‖H2‖H3 and checks H3=?hIDi‖IDj‖yg‖zg‖H2. If not, terminate the session. Otherwise, Pi computes SKi=hIDi‖IDj‖yg‖xzg‖H1‖H3 and replaces RIdiCHC with RIdinew.The authentication and key agreement phase is shown in Figure4.Figure 4
Authentication and key agreement phase.


## 3.1. Patient Registration Phase

In order to seek treatment from a doctor, patientPi first registers with CHC, and the registration process is as follows:(1)
Pi selects IDi and PWi and inputs biological information Bi. Furthermore, Pi computes σi,τi=GenBi and RIdi=hIDi‖PWi‖σi and sends IDi,RIdi to CHC via a secure channel.(2)
CHC first checks whether there is a record of IDi in the database. If not, it means that Pi is a new patient, and set c=0. If so, set c=c+1. Then, continue with the following process. CHC computes Ai=hIDi‖s‖c and RIdiCHC=hAi‖RIdi and stores RIdiCHC,IDi,c in the database and Ai,RIdiCHC in SC. Finally, SC is sent to Pi via a secure channel.(3)
Pi computes A1=Ai⊕σi and A2=hIDi‖PWi‖A1 and stores A2,τi in SC.The patient registration phase is shown in Figure2.Figure 2
Patient registration phase.


## 3.2. Doctor Registration Phase

To ensure the confidentiality of patient information, doctorDj needs to register with CHC. The steps are as follows:(1)
Dj selects IDj, PWj, and a random number rj. Then, Dj computes RIdj=hIDj‖Wj‖rj and sends IDj to CHC via a secure channel.(2)
CHC computes RIdjCHC=hIDj‖s and returns RIdjCHC to Dj.(3)
Dj computes PKj=RIdjCHCg and public key PKj.The doctor registration phase is shown in Figure3.Figure 3
Doctor registration phase.


## 3.3. Authentication and Key Agreement Phase

This phase combines the treatment and checkup phases of Kumari et al.’s system. AfterPi successfully logs in to the smart card, the body data collected by the sensor or his/her own physical condition can be reported to Dj through CHC so that the patient can have a more comprehensive understanding of the health situation. The steps are as follows:(1)
Pi inputs IDi, PWi, and Bi. Then, Pj computes σi=RepBi,τi and A1=Ai⊕σi, A2′=hIDi‖PWi‖A1 and checks A2′=?A2. If not, terminate the session. Otherwise, Pi selects a random number x and T1, computes H1=hIDi‖Ai‖xg and E1=EhIDi‖Ai‖T1H1,xg,T1, and sends M1=E1,T1,RIdiCHC to CHC.(2)
CHC checks T2−T1≤ΔT. According to RIdiCHC, CHC can find IDi to compute H1,xg,T1=DhIDi‖Ai‖T1E1 and check H1=?hIDi‖Ai‖xg. If not, terminate the session. Otherwise, CHC selects y,T3, updates RIdinew=hy‖Ai‖RIdiCHC, and computes RIdjnew=hy‖IDi‖s, H2=hH1‖IDj‖PKj, F1=IDi⊕hH1‖H2, and E2=EhIDj‖RIdjCHC‖PKj‖H1,H2,F1,T3,xg,yg,RIdinew,RIdjnew. Then, CHC sends M2=E2,T3 to Dj.(3)
Dj checks T4−T3≤ΔT. Dj computes H1,H2,F1,T3,xg,yg,RIdinew,RIdjnew=DhIDj‖RIdjCHC‖PKjE2 and checks H2=?hH1‖IDj‖PKj‖. If not, terminate the session. Otherwise, Dj replaces RIdjCHC with RIdjnew. Then, Dj selects z,T5, computes IDi=F1⊕hH1‖H2, H3=hIDi‖IDj‖yg‖zg‖H2, SKj=hIDi‖IDj‖yg‖xzg‖H1‖H3, F2=IDj⊕hH1‖H2‖H3, and E3=EhH1‖xg‖T5H2,H3,F2,T5,yg,zg,RIdinew, and sends M3=E3,T5 to CHC.(4)
CHC checks T6−T5≤ΔT. If not, terminate the session. Otherwise, CHC sends M4=E3,T5,T7 to Pi.(5)
Pi checks T7−T6≤ΔT. Pi computes H2,H3,F2,T5,yg,zg,RIdinew=DhH1‖xg‖T5E3 and IDj=F2⊕hH1‖H2‖H3 and checks H3=?hIDi‖IDj‖yg‖zg‖H2. If not, terminate the session. Otherwise, Pi computes SKi=hIDi‖IDj‖yg‖xzg‖H1‖H3 and replaces RIdiCHC with RIdinew.The authentication and key agreement phase is shown in Figure4.Figure 4
Authentication and key agreement phase.


## 4. Security Analysis

### 4.1. Formal Security Analysis

In this section, we formally analyze the security of the proposed protocol in the real-or-random (ROR) model [31–33]. Assume that ΠPx, ΠDy, and ΠCHCz, respectively, represent the xth communication of Pi, the yth communication of Dj, and the zth communication of CHC. Let O=ΠPx,ΠDy,ΠCHCz.


#### 4.1.1. Queries

The adversaryA can make the following query:(i)
ExecuteO: by executing this query, A can eavesdrop on the information transmitted by the public channel.(ii)
Hashstring: by executing this query, A can obtain the hash value of the string.(iii)
SendO,M: by executing this query (that is, A sends M to O), A can obtain the response from O.(iv)
CorruptO: by executing this query, A can obtain the parameters in the smart card or temporary information or long-term key.(v)
TestO: when this query is executed, A judges the correctness of the session key by flipping the coin C. IfC=1, A obtains the correct session key; if C = 0, A obtains a string of the same length as the session key.


#### 4.1.2. Definitions

Elliptic Curve Discrete Logarithm Problem (ECDLP). The proposed protocol uses the elliptic curve cryptography (ECC), and we briefly describe the computational difficulties of ECC. Suppose that G is a generation group of elliptic curves defined on the field Fp, and given points R and sR, where R belongs to G and s belongs to Fp, it is infeasible to obtain s in calculation. In polynomial time ξ, the probability that A solves ECDLP is defined as(1)AdvAECDLPξ=PrAR,sR=s:s∈Fp,R∈G.For a small enough valueμ, we have AdvAECDLPξ<μ.The proposed protocol uses symmetric encryption and decryption algorithmΩ. Suppose Ek1, Ek2,…, Ekn represent different independent encryption oracles, corresponding to encryption key k1, k2,…, kn, and k is the safety parameter. Then, in polynomial time ξ, the probability that A breaks the security parameter k is(2)AdvAΩ,kξ=2PrA←Ek1;b0,b1←A;α←0,1;β←Ek1bα:Aβ=α−1.


#### 4.1.3. Theorem

In polynomial timeξ, the advantage that A breaks the proposed protocol P by executing Execute, Hash, Send, Corrupt, and Test queries is(3)AdvAPξ≤qhash22l−1+qsend+qexe22n−1+2maxC′⋅qsends′,qsend2l+2AdvAECDLPξ+2AdvAΩ,kξ,where qhash, qsend, and qexe are the times of Hash, Send, and Execute queries, respectively, l is the length of the password, and C′ and s′ are constants.Proof.
We define six game sequencesGM0 to GM5 and use game sequences to prove the theorem. SuccAGMiξ is the probability that A succeeds in GMi. The proof is as follows.
GM0: flip the coin C to start the game. In GM0, A does not initiate any queries that can represent real attack. According to semantic security, we can get(4)AdvAPξ=2PrSuccAGM0ξ−1.
GM1: GM1 adds the Execute query based on GM0. By executing GM1, A can obtain M1=E1,T1,RIdiCHC, M2=E2,T3, M3E3,T5, and M4=E3,T5,T7, but A cannot extract valid information from the message. The probability of GM1 is equal to GM0; that is,(5)PrSuccAGM1ξ=PrSuccAGM0ξ.
GM2: GM2 adds Hash and Send queries based on GM1. According to the birthday paradox, we can get that the highest probability of hash collision is qhash2/2l+1; similarly, the highest probability of the collision of the transmitted text is qsend+qexe2/2n. Furthermore, we can get(6)PrSuccAGM2ξ−PrSuccAGM1ξ≤qhash22l+1+qsend+qexe22n,where l is the length of a hash value and n is the length of a transmitted text.
GM3: in GM3, A uses the Corrupt query to obtain the information Ai,RIdiCHC,A2,τi stored in the smart card and then carries out offline key guessing attacks. First, A calculates A1=Ai⊕σi, where σi=RepBi,τi; that is to say, A needs to know the biometric information of the patient to calculate A1. Second, A calculates A2′=hIDi‖PWi‖A1, until A2′=A2. However, IDi, PWi, and Bi are all confidential to A. The probability of A guessing the correct biometric information of the l bit is 1/2l [34], which is almost negligible. According to Zipf’s law [35], we have(7)PrSuccAGM3ξ−PrSuccAGM2ξ≤maxC′⋅qsends′,qsend2l,where C′ and s′ are two constants.
GM4: in GM4, we mainly analyze the security of the session key, which can be divided into the following three cases. The first is to verify whether patient anonymity can be provided. The probabilities of this situation and offline key guessing attacks are equal. The second is to obtain the long-term key and verify perfect forward security. The third is to obtain temporary information and verify whether it can resist known session-specific temporary information attacks.(i)
Patient anonymity:A uses the Corrupt query to obtain the information Ai,RIdiCHC,A2,τi in the smart card and calculates A2′=hIDi‖PWi‖A1, until A2′=A2. Therefore, this verification is the same as the offline key guessing attacks.(ii)
Perfect forward security:A used CorruptΠCHCz to obtain the long-term key s.(iii)
Known session-specific temporary information attacks:A uses CorruptΠPx, CorruptΠDy, or CorruptΠCHCz to obtain one of the random numbers.
IfA wants to calculate the session key SKi=SKj=hIDi‖IDj‖yg‖xzg‖H1‖H3, it must satisfy the above three conditions at the same time. In the first case, even if A obtains IDi or IDj, yg and xyg need to solve ECDLP, and H1 and H3 need symmetric decryption. In the second case, A obtains s to calculate H1=hIDi‖Ai‖xg or H3=hIDi‖IDj‖yg‖zg‖H2, where Ai=hIDi∥s∥c. However, IDi, x, y, and z are all unknown. In the third case, suppose A obtains y; then, yg is calculated, but xzg cannot be calculated. Moreover, IDi and IDj are confidential, and H1 and H3 need to be decrypted. Therefore, we have(8)PrSuccAGM4ξ−PrSuccAGM3ξ≤AdvAECDLPξ+AdvAΩ,kξ.
GM5: A uses hIDi‖IDj‖yg‖xzg‖H1‖H3 query to launch impersonation attacks; then, the probability of A guessing the session key is(9)PrSuccAGM5ξ−PrSuccAGM4ξ≤qhash22l+1.
Since the probability ofA guessing the session key right is equal to that of A guessing the session key wrong,(10)PrSuccAGM5ξ=12.
According to formulas (4) to (10), we can get(11)12AdvAPξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM5ξ=PrSuccAGM1ξ−PrSuccAGM5ξ≤∑i=04PrSuccAGMi+1ξ−PrSuccAGMiξ=qhash22l+qsend+qexe22n+maxC′⋅qsends′,qsend2l+AdvAECDLPξ+AdvAΩ,kξ.
Furthermore, we haveAdvAPξ≤qhash2/2l−1+qsend+qexe2/2n−1+2maxC′⋅qsends′,qsend/2l+2AdvAECDLPξ+2AdvAΩ,kξ.


### 4.2. ProVerif

The ProVerif tool [36, 37] is used to automatically formalize the security analysis of the proposed protocol. ProVerif can simulate whether the protocol can resist known attacks by executing code and computing. Here, we use ProVerif to judge whether the protocol provides anonymity and session key security and further analyzes the rationality and security of the whole protocol.Because the registration phase and authentication phase of the protocol are carried out in the secure channel and the public channel, respectively, the secure channel is set tosch and the public channel is set to ch before the security certification. At the same time, the constants, functions, events, and queries used in the protocol are defined. The definitions of channels, variables, and functions in the proposed protocol are shown in Figure 5(a). IDi and IDj are the identities of the patient and the doctor, respectively, and SKi and SKj are the session keys established between the patient and the doctor through the cloud health center. Note that IDi, IDj, SKi, and SKj are confidential.Figure 5
Definitions, queries, and results.The events and queries are shown in Figure5(b). There are five events involved: PatientStarted, PatientAuthed, CHCAcPatient, DoctorAcCHC, and PatientAcDoctor. The event PatientStarted indicates that the patient has started certification. The event PatientAuthed indicates that the patient has been successfully certified. The event CHCAcPatient indicates that CHC successfully certified the patient. The event DoctorAcCHC indicates that the doctor successfully certified CHC. The event PatientAcDoctor indicates that the patient successfully certified the doctor. Seven queries are involved. The first four queries are used to prove the security of identities and the session key, and the last four queries are used to prove the logic of the protocol.The process part of the protocol is shown in Figure6. The proposed protocol includes three processes: Patient, Doctor, and CHC. CHC includes three subprocesses: PatientReg, DoctorReg, and CHCAuth, where PatientReg represents the registration phase of the patient. DoctorReg represents the registration phase of the doctor. CHCAuth represents the authentication process of the cloud health center. After running the code, the simulation results are shown in Figure 5(c). According to the results, IDi, IDj, SKi, and SKj cannot be obtained by the adversary. The last three contents in the simulation results prove that our protocol has good security and logic.Figure 6
Processes.


### 4.3. Informal Security Analysis

#### 4.3.1. Man-in-the-Middle Attacks

In the protocol, the messages transmitted between the patient, the cloud health center, and the doctor are processed by the encryption algorithm and authenticated by the recipient.(i)
AfterCHC receives M1=E1,T1,RIdiCHC, in addition to checking the timestamp, it will also verify H1=?hIDi‖Ai‖xg(ii)
AfterDj receives M2=E2,T3, in addition to checking the timestamp, it will also verify H2=?hH1‖IDj‖PKj(iii)
AfterCHC receives M3E3,T5, check the timestamp(iv)
AfterPi receives M4=E3,T5,T7, in addition to checking the timestamp, it will also verify H3=?hIDi‖IDj‖yg‖zg‖H2A cannot obtain the encrypted parameters, let alone modify them. Therefore, the proposed protocol can protect against this attack.


#### 4.3.2. Mutual Authentication

Mutual authentication of messages is mainly to ensure the integrity of messages. In the proposed protocol,CHC verifies the timestamps T1,T5 and the hash value H1 to judge the validity of the messages transmitted by Pi and Dj. Dj verifies the timestamp T3 and the hash value H2 to judge the validity of the messages transmitted by CHC. Pi verifies the timestamp T7 and the hash value H3 to judge the validity of the messages transmitted by CHC. Therefore, our protocol provides message authentication at each step.


#### 4.3.3. Data Confidentiality

In the proposed protocol,E1=EhIDi‖Ai‖T1H1,xg,T1, E2=EhIDj‖RIdjCHC‖PKjH1,H2,F1,T3,xg,yg,RIdinew,RIdjnew, and E3=EhH1‖xg‖T5H2,H3,F2,T5,yg,zg,RIdinew are encrypted with hIDi‖Ai‖T1,hIDj‖RIdjCHC‖PKj, and hH1‖xg‖T5, respectively. A cannot obtain the decryption key, so the encrypted data is secure, which ensures the data confidentiality.


#### 4.3.4. Patient Anonymity

During the authentication and key agreement phase,CHC searched the database for IDi based on RIdiCHC. Furthermore, Dj learns about IDi when it is symmetric decrypted H1,H2,F1,T3,xg,yg,RIdinew,RIdjnew=DhIDj‖RIdjCHC‖PKjE2 and calculated IDi=F1⊕hH1‖H2. In both cases, IDi is not available to outsiders.


#### 4.3.5. Doctor Anonymity

During the authentication and key agreement phase,CHC searched the database for IDj. Furthermore, Pi learns about IDj when it is symmetric decrypted H2,H3,F2,T5,yg,zg,RIdinew=DhH1‖xg‖T5E3 and calculated IDj=F2⊕hH1‖H2‖H3. In both cases, IDj is not available to outsiders.


## 4.1. Formal Security Analysis

In this section, we formally analyze the security of the proposed protocol in the real-or-random (ROR) model [31–33]. Assume that ΠPx, ΠDy, and ΠCHCz, respectively, represent the xth communication of Pi, the yth communication of Dj, and the zth communication of CHC. Let O=ΠPx,ΠDy,ΠCHCz.


### 4.1.1. Queries

The adversaryA can make the following query:(i)
ExecuteO: by executing this query, A can eavesdrop on the information transmitted by the public channel.(ii)
Hashstring: by executing this query, A can obtain the hash value of the string.(iii)
SendO,M: by executing this query (that is, A sends M to O), A can obtain the response from O.(iv)
CorruptO: by executing this query, A can obtain the parameters in the smart card or temporary information or long-term key.(v)
TestO: when this query is executed, A judges the correctness of the session key by flipping the coin C. IfC=1, A obtains the correct session key; if C = 0, A obtains a string of the same length as the session key.


### 4.1.2. Definitions

Elliptic Curve Discrete Logarithm Problem (ECDLP). The proposed protocol uses the elliptic curve cryptography (ECC), and we briefly describe the computational difficulties of ECC. Suppose that G is a generation group of elliptic curves defined on the field Fp, and given points R and sR, where R belongs to G and s belongs to Fp, it is infeasible to obtain s in calculation. In polynomial time ξ, the probability that A solves ECDLP is defined as(1)AdvAECDLPξ=PrAR,sR=s:s∈Fp,R∈G.For a small enough valueμ, we have AdvAECDLPξ<μ.The proposed protocol uses symmetric encryption and decryption algorithmΩ. Suppose Ek1, Ek2,…, Ekn represent different independent encryption oracles, corresponding to encryption key k1, k2,…, kn, and k is the safety parameter. Then, in polynomial time ξ, the probability that A breaks the security parameter k is(2)AdvAΩ,kξ=2PrA←Ek1;b0,b1←A;α←0,1;β←Ek1bα:Aβ=α−1.


### 4.1.3. Theorem

In polynomial timeξ, the advantage that A breaks the proposed protocol P by executing Execute, Hash, Send, Corrupt, and Test queries is(3)AdvAPξ≤qhash22l−1+qsend+qexe22n−1+2maxC′⋅qsends′,qsend2l+2AdvAECDLPξ+2AdvAΩ,kξ,where qhash, qsend, and qexe are the times of Hash, Send, and Execute queries, respectively, l is the length of the password, and C′ and s′ are constants.Proof.
We define six game sequencesGM0 to GM5 and use game sequences to prove the theorem. SuccAGMiξ is the probability that A succeeds in GMi. The proof is as follows.
GM0: flip the coin C to start the game. In GM0, A does not initiate any queries that can represent real attack. According to semantic security, we can get(4)AdvAPξ=2PrSuccAGM0ξ−1.
GM1: GM1 adds the Execute query based on GM0. By executing GM1, A can obtain M1=E1,T1,RIdiCHC, M2=E2,T3, M3E3,T5, and M4=E3,T5,T7, but A cannot extract valid information from the message. The probability of GM1 is equal to GM0; that is,(5)PrSuccAGM1ξ=PrSuccAGM0ξ.
GM2: GM2 adds Hash and Send queries based on GM1. According to the birthday paradox, we can get that the highest probability of hash collision is qhash2/2l+1; similarly, the highest probability of the collision of the transmitted text is qsend+qexe2/2n. Furthermore, we can get(6)PrSuccAGM2ξ−PrSuccAGM1ξ≤qhash22l+1+qsend+qexe22n,where l is the length of a hash value and n is the length of a transmitted text.
GM3: in GM3, A uses the Corrupt query to obtain the information Ai,RIdiCHC,A2,τi stored in the smart card and then carries out offline key guessing attacks. First, A calculates A1=Ai⊕σi, where σi=RepBi,τi; that is to say, A needs to know the biometric information of the patient to calculate A1. Second, A calculates A2′=hIDi‖PWi‖A1, until A2′=A2. However, IDi, PWi, and Bi are all confidential to A. The probability of A guessing the correct biometric information of the l bit is 1/2l [34], which is almost negligible. According to Zipf’s law [35], we have(7)PrSuccAGM3ξ−PrSuccAGM2ξ≤maxC′⋅qsends′,qsend2l,where C′ and s′ are two constants.
GM4: in GM4, we mainly analyze the security of the session key, which can be divided into the following three cases. The first is to verify whether patient anonymity can be provided. The probabilities of this situation and offline key guessing attacks are equal. The second is to obtain the long-term key and verify perfect forward security. The third is to obtain temporary information and verify whether it can resist known session-specific temporary information attacks.(i)
Patient anonymity:A uses the Corrupt query to obtain the information Ai,RIdiCHC,A2,τi in the smart card and calculates A2′=hIDi‖PWi‖A1, until A2′=A2. Therefore, this verification is the same as the offline key guessing attacks.(ii)
Perfect forward security:A used CorruptΠCHCz to obtain the long-term key s.(iii)
Known session-specific temporary information attacks:A uses CorruptΠPx, CorruptΠDy, or CorruptΠCHCz to obtain one of the random numbers.
IfA wants to calculate the session key SKi=SKj=hIDi‖IDj‖yg‖xzg‖H1‖H3, it must satisfy the above three conditions at the same time. In the first case, even if A obtains IDi or IDj, yg and xyg need to solve ECDLP, and H1 and H3 need symmetric decryption. In the second case, A obtains s to calculate H1=hIDi‖Ai‖xg or H3=hIDi‖IDj‖yg‖zg‖H2, where Ai=hIDi∥s∥c. However, IDi, x, y, and z are all unknown. In the third case, suppose A obtains y; then, yg is calculated, but xzg cannot be calculated. Moreover, IDi and IDj are confidential, and H1 and H3 need to be decrypted. Therefore, we have(8)PrSuccAGM4ξ−PrSuccAGM3ξ≤AdvAECDLPξ+AdvAΩ,kξ.
GM5: A uses hIDi‖IDj‖yg‖xzg‖H1‖H3 query to launch impersonation attacks; then, the probability of A guessing the session key is(9)PrSuccAGM5ξ−PrSuccAGM4ξ≤qhash22l+1.
Since the probability ofA guessing the session key right is equal to that of A guessing the session key wrong,(10)PrSuccAGM5ξ=12.
According to formulas (4) to (10), we can get(11)12AdvAPξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM5ξ=PrSuccAGM1ξ−PrSuccAGM5ξ≤∑i=04PrSuccAGMi+1ξ−PrSuccAGMiξ=qhash22l+qsend+qexe22n+maxC′⋅qsends′,qsend2l+AdvAECDLPξ+AdvAΩ,kξ.
Furthermore, we haveAdvAPξ≤qhash2/2l−1+qsend+qexe2/2n−1+2maxC′⋅qsends′,qsend/2l+2AdvAECDLPξ+2AdvAΩ,kξ.


## 4.1.1. Queries

The adversaryA can make the following query:(i)
ExecuteO: by executing this query, A can eavesdrop on the information transmitted by the public channel.(ii)
Hashstring: by executing this query, A can obtain the hash value of the string.(iii)
SendO,M: by executing this query (that is, A sends M to O), A can obtain the response from O.(iv)
CorruptO: by executing this query, A can obtain the parameters in the smart card or temporary information or long-term key.(v)
TestO: when this query is executed, A judges the correctness of the session key by flipping the coin C. IfC=1, A obtains the correct session key; if C = 0, A obtains a string of the same length as the session key.


## 4.1.2. Definitions

Elliptic Curve Discrete Logarithm Problem (ECDLP). The proposed protocol uses the elliptic curve cryptography (ECC), and we briefly describe the computational difficulties of ECC. Suppose that G is a generation group of elliptic curves defined on the field Fp, and given points R and sR, where R belongs to G and s belongs to Fp, it is infeasible to obtain s in calculation. In polynomial time ξ, the probability that A solves ECDLP is defined as(1)AdvAECDLPξ=PrAR,sR=s:s∈Fp,R∈G.For a small enough valueμ, we have AdvAECDLPξ<μ.The proposed protocol uses symmetric encryption and decryption algorithmΩ. Suppose Ek1, Ek2,…, Ekn represent different independent encryption oracles, corresponding to encryption key k1, k2,…, kn, and k is the safety parameter. Then, in polynomial time ξ, the probability that A breaks the security parameter k is(2)AdvAΩ,kξ=2PrA←Ek1;b0,b1←A;α←0,1;β←Ek1bα:Aβ=α−1.


## 4.1.3. Theorem

In polynomial timeξ, the advantage that A breaks the proposed protocol P by executing Execute, Hash, Send, Corrupt, and Test queries is(3)AdvAPξ≤qhash22l−1+qsend+qexe22n−1+2maxC′⋅qsends′,qsend2l+2AdvAECDLPξ+2AdvAΩ,kξ,where qhash, qsend, and qexe are the times of Hash, Send, and Execute queries, respectively, l is the length of the password, and C′ and s′ are constants.Proof.
We define six game sequencesGM0 to GM5 and use game sequences to prove the theorem. SuccAGMiξ is the probability that A succeeds in GMi. The proof is as follows.
GM0: flip the coin C to start the game. In GM0, A does not initiate any queries that can represent real attack. According to semantic security, we can get(4)AdvAPξ=2PrSuccAGM0ξ−1.
GM1: GM1 adds the Execute query based on GM0. By executing GM1, A can obtain M1=E1,T1,RIdiCHC, M2=E2,T3, M3E3,T5, and M4=E3,T5,T7, but A cannot extract valid information from the message. The probability of GM1 is equal to GM0; that is,(5)PrSuccAGM1ξ=PrSuccAGM0ξ.
GM2: GM2 adds Hash and Send queries based on GM1. According to the birthday paradox, we can get that the highest probability of hash collision is qhash2/2l+1; similarly, the highest probability of the collision of the transmitted text is qsend+qexe2/2n. Furthermore, we can get(6)PrSuccAGM2ξ−PrSuccAGM1ξ≤qhash22l+1+qsend+qexe22n,where l is the length of a hash value and n is the length of a transmitted text.
GM3: in GM3, A uses the Corrupt query to obtain the information Ai,RIdiCHC,A2,τi stored in the smart card and then carries out offline key guessing attacks. First, A calculates A1=Ai⊕σi, where σi=RepBi,τi; that is to say, A needs to know the biometric information of the patient to calculate A1. Second, A calculates A2′=hIDi‖PWi‖A1, until A2′=A2. However, IDi, PWi, and Bi are all confidential to A. The probability of A guessing the correct biometric information of the l bit is 1/2l [34], which is almost negligible. According to Zipf’s law [35], we have(7)PrSuccAGM3ξ−PrSuccAGM2ξ≤maxC′⋅qsends′,qsend2l,where C′ and s′ are two constants.
GM4: in GM4, we mainly analyze the security of the session key, which can be divided into the following three cases. The first is to verify whether patient anonymity can be provided. The probabilities of this situation and offline key guessing attacks are equal. The second is to obtain the long-term key and verify perfect forward security. The third is to obtain temporary information and verify whether it can resist known session-specific temporary information attacks.(i)
Patient anonymity:A uses the Corrupt query to obtain the information Ai,RIdiCHC,A2,τi in the smart card and calculates A2′=hIDi‖PWi‖A1, until A2′=A2. Therefore, this verification is the same as the offline key guessing attacks.(ii)
Perfect forward security:A used CorruptΠCHCz to obtain the long-term key s.(iii)
Known session-specific temporary information attacks:A uses CorruptΠPx, CorruptΠDy, or CorruptΠCHCz to obtain one of the random numbers.
IfA wants to calculate the session key SKi=SKj=hIDi‖IDj‖yg‖xzg‖H1‖H3, it must satisfy the above three conditions at the same time. In the first case, even if A obtains IDi or IDj, yg and xyg need to solve ECDLP, and H1 and H3 need symmetric decryption. In the second case, A obtains s to calculate H1=hIDi‖Ai‖xg or H3=hIDi‖IDj‖yg‖zg‖H2, where Ai=hIDi∥s∥c. However, IDi, x, y, and z are all unknown. In the third case, suppose A obtains y; then, yg is calculated, but xzg cannot be calculated. Moreover, IDi and IDj are confidential, and H1 and H3 need to be decrypted. Therefore, we have(8)PrSuccAGM4ξ−PrSuccAGM3ξ≤AdvAECDLPξ+AdvAΩ,kξ.
GM5: A uses hIDi‖IDj‖yg‖xzg‖H1‖H3 query to launch impersonation attacks; then, the probability of A guessing the session key is(9)PrSuccAGM5ξ−PrSuccAGM4ξ≤qhash22l+1.
Since the probability ofA guessing the session key right is equal to that of A guessing the session key wrong,(10)PrSuccAGM5ξ=12.
According to formulas (4) to (10), we can get(11)12AdvAPξ=PrSuccAGM0ξ−12=PrSuccAGM0ξ−PrSuccAGM5ξ=PrSuccAGM1ξ−PrSuccAGM5ξ≤∑i=04PrSuccAGMi+1ξ−PrSuccAGMiξ=qhash22l+qsend+qexe22n+maxC′⋅qsends′,qsend2l+AdvAECDLPξ+AdvAΩ,kξ.
Furthermore, we haveAdvAPξ≤qhash2/2l−1+qsend+qexe2/2n−1+2maxC′⋅qsends′,qsend/2l+2AdvAECDLPξ+2AdvAΩ,kξ.


## 4.2. ProVerif

The ProVerif tool [36, 37] is used to automatically formalize the security analysis of the proposed protocol. ProVerif can simulate whether the protocol can resist known attacks by executing code and computing. Here, we use ProVerif to judge whether the protocol provides anonymity and session key security and further analyzes the rationality and security of the whole protocol.Because the registration phase and authentication phase of the protocol are carried out in the secure channel and the public channel, respectively, the secure channel is set tosch and the public channel is set to ch before the security certification. At the same time, the constants, functions, events, and queries used in the protocol are defined. The definitions of channels, variables, and functions in the proposed protocol are shown in Figure 5(a). IDi and IDj are the identities of the patient and the doctor, respectively, and SKi and SKj are the session keys established between the patient and the doctor through the cloud health center. Note that IDi, IDj, SKi, and SKj are confidential.Figure 5
Definitions, queries, and results.The events and queries are shown in Figure5(b). There are five events involved: PatientStarted, PatientAuthed, CHCAcPatient, DoctorAcCHC, and PatientAcDoctor. The event PatientStarted indicates that the patient has started certification. The event PatientAuthed indicates that the patient has been successfully certified. The event CHCAcPatient indicates that CHC successfully certified the patient. The event DoctorAcCHC indicates that the doctor successfully certified CHC. The event PatientAcDoctor indicates that the patient successfully certified the doctor. Seven queries are involved. The first four queries are used to prove the security of identities and the session key, and the last four queries are used to prove the logic of the protocol.The process part of the protocol is shown in Figure6. The proposed protocol includes three processes: Patient, Doctor, and CHC. CHC includes three subprocesses: PatientReg, DoctorReg, and CHCAuth, where PatientReg represents the registration phase of the patient. DoctorReg represents the registration phase of the doctor. CHCAuth represents the authentication process of the cloud health center. After running the code, the simulation results are shown in Figure 5(c). According to the results, IDi, IDj, SKi, and SKj cannot be obtained by the adversary. The last three contents in the simulation results prove that our protocol has good security and logic.Figure 6
Processes.


## 4.3. Informal Security Analysis

### 4.3.1. Man-in-the-Middle Attacks

In the protocol, the messages transmitted between the patient, the cloud health center, and the doctor are processed by the encryption algorithm and authenticated by the recipient.(i)
AfterCHC receives M1=E1,T1,RIdiCHC, in addition to checking the timestamp, it will also verify H1=?hIDi‖Ai‖xg(ii)
AfterDj receives M2=E2,T3, in addition to checking the timestamp, it will also verify H2=?hH1‖IDj‖PKj(iii)
AfterCHC receives M3E3,T5, check the timestamp(iv)
AfterPi receives M4=E3,T5,T7, in addition to checking the timestamp, it will also verify H3=?hIDi‖IDj‖yg‖zg‖H2A cannot obtain the encrypted parameters, let alone modify them. Therefore, the proposed protocol can protect against this attack.


### 4.3.2. Mutual Authentication

Mutual authentication of messages is mainly to ensure the integrity of messages. In the proposed protocol,CHC verifies the timestamps T1,T5 and the hash value H1 to judge the validity of the messages transmitted by Pi and Dj. Dj verifies the timestamp T3 and the hash value H2 to judge the validity of the messages transmitted by CHC. Pi verifies the timestamp T7 and the hash value H3 to judge the validity of the messages transmitted by CHC. Therefore, our protocol provides message authentication at each step.


### 4.3.3. Data Confidentiality

In the proposed protocol,E1=EhIDi‖Ai‖T1H1,xg,T1, E2=EhIDj‖RIdjCHC‖PKjH1,H2,F1,T3,xg,yg,RIdinew,RIdjnew, and E3=EhH1‖xg‖T5H2,H3,F2,T5,yg,zg,RIdinew are encrypted with hIDi‖Ai‖T1,hIDj‖RIdjCHC‖PKj, and hH1‖xg‖T5, respectively. A cannot obtain the decryption key, so the encrypted data is secure, which ensures the data confidentiality.


### 4.3.4. Patient Anonymity

During the authentication and key agreement phase,CHC searched the database for IDi based on RIdiCHC. Furthermore, Dj learns about IDi when it is symmetric decrypted H1,H2,F1,T3,xg,yg,RIdinew,RIdjnew=DhIDj‖RIdjCHC‖PKjE2 and calculated IDi=F1⊕hH1‖H2. In both cases, IDi is not available to outsiders.


### 4.3.5. Doctor Anonymity

During the authentication and key agreement phase,CHC searched the database for IDj. Furthermore, Pi learns about IDj when it is symmetric decrypted H2,H3,F2,T5,yg,zg,RIdinew=DhH1‖xg‖T5E3 and calculated IDj=F2⊕hH1‖H2‖H3. In both cases, IDj is not available to outsiders.


## 4.3.1. Man-in-the-Middle Attacks

In the protocol, the messages transmitted between the patient, the cloud health center, and the doctor are processed by the encryption algorithm and authenticated by the recipient.(i)
AfterCHC receives M1=E1,T1,RIdiCHC, in addition to checking the timestamp, it will also verify H1=?hIDi‖Ai‖xg(ii)
AfterDj receives M2=E2,T3, in addition to checking the timestamp, it will also verify H2=?hH1‖IDj‖PKj(iii)
AfterCHC receives M3E3,T5, check the timestamp(iv)
AfterPi receives M4=E3,T5,T7, in addition to checking the timestamp, it will also verify H3=?hIDi‖IDj‖yg‖zg‖H2A cannot obtain the encrypted parameters, let alone modify them. Therefore, the proposed protocol can protect against this attack.


## 4.3.2. Mutual Authentication

Mutual authentication of messages is mainly to ensure the integrity of messages. In the proposed protocol,CHC verifies the timestamps T1,T5 and the hash value H1 to judge the validity of the messages transmitted by Pi and Dj. Dj verifies the timestamp T3 and the hash value H2 to judge the validity of the messages transmitted by CHC. Pi verifies the timestamp T7 and the hash value H3 to judge the validity of the messages transmitted by CHC. Therefore, our protocol provides message authentication at each step.


## 4.3.3. Data Confidentiality

In the proposed protocol,E1=EhIDi‖Ai‖T1H1,xg,T1, E2=EhIDj‖RIdjCHC‖PKjH1,H2,F1,T3,xg,yg,RIdinew,RIdjnew, and E3=EhH1‖xg‖T5H2,H3,F2,T5,yg,zg,RIdinew are encrypted with hIDi‖Ai‖T1,hIDj‖RIdjCHC‖PKj, and hH1‖xg‖T5, respectively. A cannot obtain the decryption key, so the encrypted data is secure, which ensures the data confidentiality.


## 4.3.4. Patient Anonymity

During the authentication and key agreement phase,CHC searched the database for IDi based on RIdiCHC. Furthermore, Dj learns about IDi when it is symmetric decrypted H1,H2,F1,T3,xg,yg,RIdinew,RIdjnew=DhIDj‖RIdjCHC‖PKjE2 and calculated IDi=F1⊕hH1‖H2. In both cases, IDi is not available to outsiders.


## 4.3.5. Doctor Anonymity

During the authentication and key agreement phase,CHC searched the database for IDj. Furthermore, Pi learns about IDj when it is symmetric decrypted H2,H3,F2,T5,yg,zg,RIdinew=DhH1‖xg‖T5E3 and calculated IDj=F2⊕hH1‖H2‖H3. In both cases, IDj is not available to outsiders.


## 5. Performance Evaluation

In this section, we evaluate the performance of several authentication protocols in the cloud healthcare environment, including Mohit et al. [28], Li et al. [29], Kumari et al. [30], Karthigaiveni and Indrani [38], Sahoo et al. [39], and ours.


### 5.1. Security Evaluation

The evaluation of security is shown in Table3. We use A1 for patient anonymity, A2 for doctor anonymity, A3 for data confidentiality, A4 for impersonation attacks, A5 for session key security, and A6 for replay attacks. Note that “√” indicates that the functional feature has been realized, and “χ” indicates that the functional feature has not been realized. According to Table 3, we can see that [28–30, 38] cannot provide patient anonymity. [28–30] cannot resist impersonation attacks. In addition, [28, 30] cannot guarantee the confidentiality of the data; [29, 30] do not provide session key security; [38] cannot resist the replay attack yet. Sahoo et al. [39] and our protocol not only provide the security of the patient and doctor but also resist some known attacks.Table 3
Security evaluation.
Mohit et al. [28]Li et al. [29]Kumari et al. [30]Karthigaiveni and Indrani [38]Sahoo et al. [39]OursA1χ [29]χ [40]χχ [41]√√A2√√χ√√√A3χ [29]√χ√√√A4χ [29]χ [40]χ√√√A5√χ [40]χ√√√A6√√√χ [41]√√


### 5.2. Computational Cost Evaluation

The evaluation of the computational cost is shown in Table4. The evaluation environment is Windows 10 operating system, the processor is Intel(R) Core(TM) i5-8500 CPU @ 3.00 Hz, and the memory is 8G. Development software is IntelliJ IDEA version 2019.3, which is based on the calls of the Java pairing library, signature library, and symmetric encryption/decryption function. After ten experiments, the average value is calculated to determine Th=0.004ms, Ts=11.8ms, Tm=8.6ms, and TSig=10.9ms, where Th is the execution time of the one-way hash operation, Ts is the execution time of symmetric encryption or decryption, Tm is the execution time of elliptic curve scalar point multiplication, and TSig is the time of the execution or verification of the elliptic curve digital signature. It is assumed that the execution time of the fuzzy extractor function is equal to the point multiplication of the elliptic curve. According to Table 4, we can see that the total computational consumption of our protocol is lower than [29, 30, 38, 39] but higher than [28] because the cloud in [28] only performs simple hash operations, which leads to the threat of various attacks such as private data disclosure. Note that, here, the computational cost of the authentication and key agreement phase is compared.Table 4
Computational cost comparison.
Mohit et al. [28]Li et al. [29]Kumari et al. [30]Karthigaiveni and Indrani [38]Sahoo et al. [39]OursPatient3Th+2Ts+TSig≈34.512ms5Th+2Ts+TSig≈34.52ms3Th+5Ts+TSig+2Tm≈87.112ms6Th+2Ts+9Tm≈101.024ms9Th+2Ts+3Tm≈49.436ms5Th+2Ts+3Tm≈49.42msDoctor6Th+2Ts+2TSig≈45.424ms6Th+4Ts+3TSig≈79.924ms5Th+5Ts+2TSig+2Tm≈98.02ms——5Th+2Ts+2Tm≈40.82msCloud and healthcare center5Th≈0.02ms6Th+2Ts≈23.624ms6Th+6Ts+4Tm≈105.224ms4Th+2Ts+9Tm≈101.016ms8Th+4Ts+4Tm≈81.632ms5Th+2Ts+Tm≈32.22msTotal79.956ms138.068ms290.356ms202.04ms131.068ms122.46ms


### 5.3. Communication Cost Evaluation

Table5 shows the evaluation of communication cost. Assume that the hash operation, symmetric encryption or decryption operation, and signature are 256 bits, and the identity, timestamp, and random number are 64 bits. Here, the communication consumption in the authentication and key agreement phase is compared.Table 5
Communication cost comparison.
RoundsCommunication cost (bits)Mohit et al. [28]73200Li et al. [29]62688Kumari et al. [30]62176Karthigaiveni and Indrani [38]21024Sahoo et al. [39]42304Ours41600The messages transmitted by Mohit et al.’s protocol areIDD,RD, IDP,sni, S5,SigP,CP, S6,CD,SigD, IDD,Request, S8,CD,SigD, and S9,C2, where IDD,IDP are identities; RD,sni,Request are random numbers; S5,S6,S8,S9 are hash operations; SigP,SigD are signatures; and CP,CD,C2 are encryption operations. The total communication cost is estimated at 3200 bits.The messages transmitted by Li et al.’s protocol areIDD,IDP,RD, S5,C3, S6,C4, IDP,IDD,sni, S8,CD,SigD, and S9,C5, where IDD,IDP are identities; RD,sni are random numbers; S5,S6,S8,S9 are hash operations; SigD is the signature; and C3,C4,CD,C5 are encryption operations. The total communication cost is estimated at 2688 bits.The messages transmitted by Kumari et al.’s protocol areE7,TD1, E8,I,TC8, E9,TD3, E10,TP4, E11,TC11, and E12,TP6, where TD1,TC8,TD3,TP4,TC11,TP6 are timestamps and E7,E8,E9,E10,E11,E12 are encryption operations. The total communication cost is estimated at 2176 bits.The messages transmitted by Karthigaiveni and Indrani’s protocol areB1,B2,PIDi,Tc and B3,B4,Ts, where Tc,Ts are timestamps; PIDi is an identity; B3 is a random number; and B1,B2,B4 are hash operations. The total communication cost is estimated at 1024 bits.The messages transmitted by Sahoo et al.’s protocol areM4,M5,Ci,Tu, M6,M7,Tr, S3,S4,Ts∗, and M8,Tu∗∗, where Tu,Tr,Ts∗,Tu∗∗ are timestamps; M4,Ci,M6,S3,M8 are hash operations; and M5,M7,S4 are encryption operations. The total communication cost is estimated at 2304 bits.The messages transmitted by our protocol areE1,T1,RIdiCHC, E2,T3, E3,T5, and E3,T5,T7, where T1,T3,T5,T7 are timestamps; RIdiCHC is the hash operation; and E1,E2,E3 are encryption operations. The total communication cost is estimated at 1600 bits. The above analysis shows that the communication overhead consumed by our protocol is less than [28–30, 39] and slightly higher than [38]. However, [38] cannot resist replay attacks and cannot provide patient anonymity. Therefore, our protocol is most suitable for the authentication protocol in the cloud medical environment.


## 5.1. Security Evaluation

The evaluation of security is shown in Table3. We use A1 for patient anonymity, A2 for doctor anonymity, A3 for data confidentiality, A4 for impersonation attacks, A5 for session key security, and A6 for replay attacks. Note that “√” indicates that the functional feature has been realized, and “χ” indicates that the functional feature has not been realized. According to Table 3, we can see that [28–30, 38] cannot provide patient anonymity. [28–30] cannot resist impersonation attacks. In addition, [28, 30] cannot guarantee the confidentiality of the data; [29, 30] do not provide session key security; [38] cannot resist the replay attack yet. Sahoo et al. [39] and our protocol not only provide the security of the patient and doctor but also resist some known attacks.Table 3
Security evaluation.
Mohit et al. [28]Li et al. [29]Kumari et al. [30]Karthigaiveni and Indrani [38]Sahoo et al. [39]OursA1χ [29]χ [40]χχ [41]√√A2√√χ√√√A3χ [29]√χ√√√A4χ [29]χ [40]χ√√√A5√χ [40]χ√√√A6√√√χ [41]√√


## 5.2. Computational Cost Evaluation

The evaluation of the computational cost is shown in Table4. The evaluation environment is Windows 10 operating system, the processor is Intel(R) Core(TM) i5-8500 CPU @ 3.00 Hz, and the memory is 8G. Development software is IntelliJ IDEA version 2019.3, which is based on the calls of the Java pairing library, signature library, and symmetric encryption/decryption function. After ten experiments, the average value is calculated to determine Th=0.004ms, Ts=11.8ms, Tm=8.6ms, and TSig=10.9ms, where Th is the execution time of the one-way hash operation, Ts is the execution time of symmetric encryption or decryption, Tm is the execution time of elliptic curve scalar point multiplication, and TSig is the time of the execution or verification of the elliptic curve digital signature. It is assumed that the execution time of the fuzzy extractor function is equal to the point multiplication of the elliptic curve. According to Table 4, we can see that the total computational consumption of our protocol is lower than [29, 30, 38, 39] but higher than [28] because the cloud in [28] only performs simple hash operations, which leads to the threat of various attacks such as private data disclosure. Note that, here, the computational cost of the authentication and key agreement phase is compared.Table 4
Computational cost comparison.
Mohit et al. [28]Li et al. [29]Kumari et al. [30]Karthigaiveni and Indrani [38]Sahoo et al. [39]OursPatient3Th+2Ts+TSig≈34.512ms5Th+2Ts+TSig≈34.52ms3Th+5Ts+TSig+2Tm≈87.112ms6Th+2Ts+9Tm≈101.024ms9Th+2Ts+3Tm≈49.436ms5Th+2Ts+3Tm≈49.42msDoctor6Th+2Ts+2TSig≈45.424ms6Th+4Ts+3TSig≈79.924ms5Th+5Ts+2TSig+2Tm≈98.02ms——5Th+2Ts+2Tm≈40.82msCloud and healthcare center5Th≈0.02ms6Th+2Ts≈23.624ms6Th+6Ts+4Tm≈105.224ms4Th+2Ts+9Tm≈101.016ms8Th+4Ts+4Tm≈81.632ms5Th+2Ts+Tm≈32.22msTotal79.956ms138.068ms290.356ms202.04ms131.068ms122.46ms


## 5.3. Communication Cost Evaluation

Table5 shows the evaluation of communication cost. Assume that the hash operation, symmetric encryption or decryption operation, and signature are 256 bits, and the identity, timestamp, and random number are 64 bits. Here, the communication consumption in the authentication and key agreement phase is compared.Table 5
Communication cost comparison.
RoundsCommunication cost (bits)Mohit et al. [28]73200Li et al. [29]62688Kumari et al. [30]62176Karthigaiveni and Indrani [38]21024Sahoo et al. [39]42304Ours41600The messages transmitted by Mohit et al.’s protocol areIDD,RD, IDP,sni, S5,SigP,CP, S6,CD,SigD, IDD,Request, S8,CD,SigD, and S9,C2, where IDD,IDP are identities; RD,sni,Request are random numbers; S5,S6,S8,S9 are hash operations; SigP,SigD are signatures; and CP,CD,C2 are encryption operations. The total communication cost is estimated at 3200 bits.The messages transmitted by Li et al.’s protocol areIDD,IDP,RD, S5,C3, S6,C4, IDP,IDD,sni, S8,CD,SigD, and S9,C5, where IDD,IDP are identities; RD,sni are random numbers; S5,S6,S8,S9 are hash operations; SigD is the signature; and C3,C4,CD,C5 are encryption operations. The total communication cost is estimated at 2688 bits.The messages transmitted by Kumari et al.’s protocol areE7,TD1, E8,I,TC8, E9,TD3, E10,TP4, E11,TC11, and E12,TP6, where TD1,TC8,TD3,TP4,TC11,TP6 are timestamps and E7,E8,E9,E10,E11,E12 are encryption operations. The total communication cost is estimated at 2176 bits.The messages transmitted by Karthigaiveni and Indrani’s protocol areB1,B2,PIDi,Tc and B3,B4,Ts, where Tc,Ts are timestamps; PIDi is an identity; B3 is a random number; and B1,B2,B4 are hash operations. The total communication cost is estimated at 1024 bits.The messages transmitted by Sahoo et al.’s protocol areM4,M5,Ci,Tu, M6,M7,Tr, S3,S4,Ts∗, and M8,Tu∗∗, where Tu,Tr,Ts∗,Tu∗∗ are timestamps; M4,Ci,M6,S3,M8 are hash operations; and M5,M7,S4 are encryption operations. The total communication cost is estimated at 2304 bits.The messages transmitted by our protocol areE1,T1,RIdiCHC, E2,T3, E3,T5, and E3,T5,T7, where T1,T3,T5,T7 are timestamps; RIdiCHC is the hash operation; and E1,E2,E3 are encryption operations. The total communication cost is estimated at 1600 bits. The above analysis shows that the communication overhead consumed by our protocol is less than [28–30, 39] and slightly higher than [38]. However, [38] cannot resist replay attacks and cannot provide patient anonymity. Therefore, our protocol is most suitable for the authentication protocol in the cloud medical environment.


## 6. Conclusion

In this paper, we have described the security flaws in Kumari et al.’s system such as known session-specific temporary information attacks, patient and doctor anonymity, data confidentiality, patient unlinkability, desynchronization attacks, and impersonation attacks. Moreover, Kumari et al.’s system required more steps for information transmission. It increases the probability of attackers breaking the system. Then, we propose a provably secure authentication and key exchange protocol, which can reduce the amount of information transmitted and ensure the security of patients and doctors. In addition, we also provide formal and informal security analyses, as well as performance comparisons with related protocols in recent years. The results show that our protocol is suitable for cloud smart healthcare environments.



---

*Source: 2299632-2021-09-28.xml*