# A Blockchain-Based User Authentication Scheme with Access Control for Telehealth Systems

Authors: Shuyun Shi; Min Luo; Yihong Wen; Lianhai Wang; Debiao He
Journal: Security and Communication Networks
 (2022)

---

## Abstract

With the development of telecommunication systems and customized monitoring devices, telehealth has been widely used to improve medical quality and reduce overall health costs. However, the convenience of connection between the providers and patients through a public channel also leads to significant security and privacy concerns. Though there have been many authentication schemes designed for secure communications in telecare systems, most of them suffer from malicious attacks or have heavy computation and communication costs. Thus, in this article, we proposed a blockchain-based user authentication scheme integrating with access control and physical unclonable function (PUF). Permissioned blockchain and PUF are used to support secure data sharing across the healthcare service providers and identify the devices, respectively. Security analysis shows that our protocol satisfies the security requirements for telehealth services and is provably secure in the random oracle model. The performance evaluation demonstrates that it has less computation and communication costs compared with three of the latest schemes.


---

## Body

## 1. Introduction

Telecare medical information systems (TMIS) support remote medical services by providing online patient diagnosis to reduce healthcare service costs and improve patient health outcomes. The COVID-19 pandemic has promoted the use of telehealth to deliver, which can interrupt the transmission of the disease and facilitate public health mitigation by reducing outings.As shown in Figure1, patients at home are equipped with wearable monitoring devices. These devices can continually collect and transmit health data (e.g., blood pressure, blood sugar, heart rate, and more) to mobile devices. Health data will be transmitted to healthcare service providers (e.g., hospitals and health authorities) over the open internet. Then, care staff (e.g., doctors and nurses) can monitor the patient’s condition remotely and make timely treatment decisions for better outcomes.Figure 1
General architecture for telehealth system.Vulnerabilities in the wireless networks offer some easy entry points for malicious adversaries, yet these networks are important for connections between patients at home and remote healthcare organizations. Many countries have laws that are designed to protect the patient’s privacy, such as the Health Insurance Portability and Accounting Act (HIPAA) in the United States. Security in telecare services, i.e., how to ensure patient data security and privacy during transmission through the public channel, becomes a significant concern [1, 2].User authentication is a necessary first step to ensure that only authorized users have access to protected data. Password-based user authentication scheme as the most convenient mechanism is widely employed, however, it is vulnerable to various attacks and could be a threat to data security. Multifactor authentication is a recommended approach in which any user is granted access to certain data after validating two or more pieces of evidence the user has.In the meantime, people’s mobility between different healthcare institutions raises some problems: user authentication in multiple servers and secure data sharing across different servicers. To address the above issues, multiserver authentication is used for access to multiple servers with one credential [3] in existing schemes. However, most schemes [4–6] have unsatisfactory performance or may suffer serious security problems in the telehealth services environment.Furthermore, interaction with patient records from personal devices may be fraught with peril since it is difficult for healthcare servers to verify whether those devices meet security configuration requirements. Attackers could impersonate legal users for free treatment or profit once they guess the correct password. Otherwise, they could impersonate the healthcare providers to offer false treatment, which will cause a critical medical accident.Therefore, it is necessary to design a new authentication scheme to ensure security and data sharing and resist various attacks in the telecare services environment.


### 1.1. Our Contribution

In this paper, we propose a multiserver authentication scheme with the integration of user authentication and access control, which determines the access control to achieve selective data disclosure, enhance data privacy, and improve the scheme’s efficiency.Blockchain has been widely applied in different areas because of its properties of immutability and decentralization [7–9]. In our scheme, some registration information will be recorded in the blockchain served as a trusted bulletin board to achieve secure data sharing across different healthcare provider servers.PUF has been a promising cryptographic primitive, and it has been demonstrated in the security domain as well [10]. It serves as one of the authentication factors to identify the devices in the IoT systems, with the characteristics of being unclonable, unpredictable, and computable. We will introduce this technology to resist various attacks (e.g., impersonation attacks and physical attacks) for telehealth services.The major contributions of this paper are summarized as follows:(i)
Firstly, by leveraging blockchain technology and PUFs, we design an efficient user authentication protocol with access control for the telehealth system.(ii)
Secondly, a comprehensive security analysis is given to show that the proposed protocol is provably secure and can satisfy the security requirements in the telehealth system.(iii)
Finally, we implement a prototype by smart contract based on Hyperledger Fabric. We analyze the performance to show that our scheme has less computation and communication costs than previously proposed protocols.


### 1.2. Organization of Our Paper

The paper is organized as follows: in section2, we discuss some related literature. In section 3, we introduce the preliminaries used in this paper. In sections 4 and 5, we present the details of the system framework and proposed authentication protocol for telecare service. In sections 6 and 7, we give provable security in the random oracle model and evaluate the performance of the proposed scheme. Finally, section 8 concludes this paper.


## 1.1. Our Contribution

In this paper, we propose a multiserver authentication scheme with the integration of user authentication and access control, which determines the access control to achieve selective data disclosure, enhance data privacy, and improve the scheme’s efficiency.Blockchain has been widely applied in different areas because of its properties of immutability and decentralization [7–9]. In our scheme, some registration information will be recorded in the blockchain served as a trusted bulletin board to achieve secure data sharing across different healthcare provider servers.PUF has been a promising cryptographic primitive, and it has been demonstrated in the security domain as well [10]. It serves as one of the authentication factors to identify the devices in the IoT systems, with the characteristics of being unclonable, unpredictable, and computable. We will introduce this technology to resist various attacks (e.g., impersonation attacks and physical attacks) for telehealth services.The major contributions of this paper are summarized as follows:(i)
Firstly, by leveraging blockchain technology and PUFs, we design an efficient user authentication protocol with access control for the telehealth system.(ii)
Secondly, a comprehensive security analysis is given to show that the proposed protocol is provably secure and can satisfy the security requirements in the telehealth system.(iii)
Finally, we implement a prototype by smart contract based on Hyperledger Fabric. We analyze the performance to show that our scheme has less computation and communication costs than previously proposed protocols.


## 1.2. Organization of Our Paper

The paper is organized as follows: in section2, we discuss some related literature. In section 3, we introduce the preliminaries used in this paper. In sections 4 and 5, we present the details of the system framework and proposed authentication protocol for telecare service. In sections 6 and 7, we give provable security in the random oracle model and evaluate the performance of the proposed scheme. Finally, section 8 concludes this paper.


## 2. Related Work

To secure remote healthcare services, some authentication schemes have been proposed. Debiao et al. [11] proposed an improved scheme to overcome the weakness of Wu et al.’s scheme [12] for TMIS. Their scheme is more efficient and applies to low-power mobile devices. However, the scheme cannot resist the offline password attack. Kumari et al. [13] proposed an improved user authentication scheme for applications in TMIS. Chen et al. [14] proposed a medical data exchange protocol based on the cloud environment for medical advice. Patient inspection information can be protected by asymmetric encryption. However, the scheme cannot provide user anonymity and has heavy computation costs.Chiou et al. [15] resolved these security problems and provided a complete system implementation. Mohit et al. [4] reviewed Chiou et al.’s [15] protocol and found that it is susceptible to user anonymity and some attacks. They designed a lightweight authentication scheme in the cloud environment for TMIS. However, Kumar et al. [5] found that Mohit et al.’s [4] scheme is vulnerable to various attacks and cannot provide user anonymity and session key protection. They proposed an improved protocol for single-server architecture in TMIS but could not satisfy the perfect forward secrecy or multiserver environment.Multiserver authentication scheme was first proposed by [3] using a neural network. Because of the complexity of the neural network, lots of schemes [16–19] were proposed to improve the performance and enhance the security. Multiserver authentication scheme without online RC [20, 21] is suitable for various applications, which reduces the cost of trusted RC establishment and authentication communication.Recently, blockchain has become a research hotspot in telemedicine to ensure healthcare data security and to support data sharing. Liu et al. [22] proposed privacy-preserving mutual authentication in TMIS, which provides user anonymity and malicious users traceability if necessary. Yazdinejad et al. [23] designed a blockchain-based authentication scheme to reduce reauthentication across different hospitals, which can increase throughput and reduce time overhead for resource-limited devices. Li et al. [24] proposed a group authentication mechanism for authorized group members to access sensitive health records in the remote medical monitoring scene. Cheng et al. [25] designed a multiple identity authentication for a secure medical data sharing model based on blockchain to avoid over-reliance on a third party. Lin et al. [26] designed a transitively closed undirected graph authentication scheme for dynamic blockchain-based identity management systems, which is efficient for signers to update their certificates without signing again. Wang et al. [27] proposed a decentralized, secure, and lightweight certificateless signature (CLS) protocol by transforming the logic of KGC into smart contract code, which can resist key generation center compromised attacks and distributed denial of service (DDoS) attacks. Xiong et al. [28] presented ECDSA batch verification protocol in the blockchain-enabled Internet of Medical Things (IoMT) to enhance authentication efficiency and support identification algorithms for false signatures.Nevertheless, all of the above schemes have no consideration for integration authentication with access control to improve the system efficiency. The idea of the integration of user authentication and access control was first proposed by Harn and Lin [29] to avoid potential security problems between these two protection mechanisms. Later, some improved protocols [30–32] were designed to enhance security and implement a protection scheme in distributed systems. Recently, Lin et al. [33] presented a remote mutual authentication scheme with fine-grained access control based on blockchain for industry 4.0 deployment. Xiong et al. [34] proposed an integrated scheme for a mobile cloud environment (MCC) without the trusted party to store the access control list. However, the computational overhead is expensive for limited mobile devices in telemedicine services.Additionally, many PUF-based authentication schemes have been proposed for IoT systems, wireless sensor networks (WSNs), and so on. Since smart cards/devices are not tamper-resistant, some two-factor authentication schemes are susceptible to various physical attacks. To address the issues, PUFs are used as one of the authentication factors presented in some literature [35–38] to enhance the properties of lightweight authentication solutions.In this paper, we will construct a blockchain-based user authentication scheme for better efficiency and security, in which access control integration can enhance the authentication efficiency, and a physical unclonable function is applied to identify the devices against various attacks in the telehealth environment.


## 3. Preliminaries

### 3.1. Bilinear Pairings

Letp,q be large prime numbers. Let G1 be a cyclic additive group and G2 be a multiplicative group with the same order q. e:G1×G1⟶G2 denotes a bilinear map, where a generator P of G1 and a generator g=eP,P of G2, when the subsequent conditions meet.(i)
Bilinear: eaP,bQ=eP,Qab for all a,b∈Zq∗ and P,Q∈G1.(ii)
Nondegeneracy: there exists an element P∈G1 such that eP,P≠1G2.(iii)
Computability: given any two elements P,Q∈G1, it is efficient to compute eP,Q.The following mathematical problems are difficult, i.e., there is no polynomial algorithm to solve will be used in our proposed scheme.(i)
Discrete Logarithm (DL) Problem: given an element Z∈G1z∈G2, find α such that Z=αPz=gα.(ii)
Computational Diffie-Hellman (CDH) Problem: given two elements xP,yP∈G1gx,gy∈G2, where x,y∈Zq∗ are unknown, calculate xyP∈G1gxy∈G2.(iii)
Modified Bilinear Inverse Diffie-Hellman with k Value (k-mBIDH) Problem: given k elements a1,a2,…,ak∈Zq∗ and k+2 elements s^P,t^P,1/s^+a1P,1/s^+a2P,…,1/s^+akP∈G1, where s^,t^∈Zq∗ is unknown, calculate eP,Pt^/s^+a for any a∉a1,a2,…,ak.


### 3.2. Chinese Remainder Theorem (CRT)

Given N coprime integersm1,m2,…,mk, where gcdmi,mj=1 for i,j=1,2,…k and i≠j. For integer ai, there exists the following: (1)X≡a1modm1X≡a2modm2⋮.X≡akmodmkThe common solutionX can be computed as follows:(2)X≡∑i=1kMmi⋅ei⋅ai,where M=∏i=1kmi and M/mi⋅ei≡1modmi for i=1,2,…,k.


### 3.3. Physical Unclonable Function

The physical unclonable function is a one-way mapping from a challenge spaceℂ to a response space ℝ based on the unclonable characteristic of the underlying physical device. A set of challenge-response pairs (CRPs) is unique for each device, which can be used to identify the device. A PUF circuit must meet the properties below:(i)
Unpredictability: given any challenge C, the probability to evaluate the response ℛ of PUF is negligibly small without PUF instance.(ii)
Computability: given any challenge C, it is easy to evaluate the response ℛ for any PUF instance.(iii)
Uniqueness: for any two PUF1 and PUF2, given the same challenge C, the probability to evaluate the same response PUF1C=PUF2C is negligibly small.(iv)
One-way: given any ℛ∈ℝ, there exists no polynomial algorithm InversePUF: ℛ⟶C for any challenge C∈ℂ.


### 3.4. Fuzzy Extractor

The PUF circuit is susceptible to interference to generate the noisy response with low entropy, which may fail to authenticate the device. Fuzzy extractor has been developed to recover a reliable high-entropy response from a noisy response to enhance the security of authentication. Fuzzy extractor consists of the following two algorithms:(i)
Gen⋅: a probabilistic key generation algorithm κ,hd=GenR to generate the key κ and helper data hd.(ii)
Rec⋅: a deterministic reconstruction algorithm κ=RecR,hd to recover the key κ from a noisy response R′ and helper data hd, which the Hamming distance between the original response R and the noisy response R′ is at most d.


### 3.5. Blockchain and Smart Contract

Blockchain technology is an immutable and distributed data ledger consisting of an append-only sequence of blocks chained by the cryptographic hash function. Based on permission authorized to network nodes, blockchain platforms are divided into three types: private blockchain, consortium blockchain, and public blockchain. In the proposed scheme, Hyperledger Fabric is chosen to support the flexible transaction and Turing-complete smart contracts.The smart contract is an autoexecuted program deployed in the blockchain network, which can achieve complex functions, and it can be invoked by authorized nodes sending a legal transaction. The transaction is contained in the block after verification by the nodes. In our proposed scheme, we design the smart contract for registration information sharing between a trusted register center and multiple healthcare servers. The register center and servers can upload, query, and update the information by sending a transaction signed by its private key to invoke the smart contract. Users can query the information to ensure that their information can be authenticated by the whole network.


## 3.1. Bilinear Pairings

Letp,q be large prime numbers. Let G1 be a cyclic additive group and G2 be a multiplicative group with the same order q. e:G1×G1⟶G2 denotes a bilinear map, where a generator P of G1 and a generator g=eP,P of G2, when the subsequent conditions meet.(i)
Bilinear: eaP,bQ=eP,Qab for all a,b∈Zq∗ and P,Q∈G1.(ii)
Nondegeneracy: there exists an element P∈G1 such that eP,P≠1G2.(iii)
Computability: given any two elements P,Q∈G1, it is efficient to compute eP,Q.The following mathematical problems are difficult, i.e., there is no polynomial algorithm to solve will be used in our proposed scheme.(i)
Discrete Logarithm (DL) Problem: given an element Z∈G1z∈G2, find α such that Z=αPz=gα.(ii)
Computational Diffie-Hellman (CDH) Problem: given two elements xP,yP∈G1gx,gy∈G2, where x,y∈Zq∗ are unknown, calculate xyP∈G1gxy∈G2.(iii)
Modified Bilinear Inverse Diffie-Hellman with k Value (k-mBIDH) Problem: given k elements a1,a2,…,ak∈Zq∗ and k+2 elements s^P,t^P,1/s^+a1P,1/s^+a2P,…,1/s^+akP∈G1, where s^,t^∈Zq∗ is unknown, calculate eP,Pt^/s^+a for any a∉a1,a2,…,ak.


## 3.2. Chinese Remainder Theorem (CRT)

Given N coprime integersm1,m2,…,mk, where gcdmi,mj=1 for i,j=1,2,…k and i≠j. For integer ai, there exists the following: (1)X≡a1modm1X≡a2modm2⋮.X≡akmodmkThe common solutionX can be computed as follows:(2)X≡∑i=1kMmi⋅ei⋅ai,where M=∏i=1kmi and M/mi⋅ei≡1modmi for i=1,2,…,k.


## 3.3. Physical Unclonable Function

The physical unclonable function is a one-way mapping from a challenge spaceℂ to a response space ℝ based on the unclonable characteristic of the underlying physical device. A set of challenge-response pairs (CRPs) is unique for each device, which can be used to identify the device. A PUF circuit must meet the properties below:(i)
Unpredictability: given any challenge C, the probability to evaluate the response ℛ of PUF is negligibly small without PUF instance.(ii)
Computability: given any challenge C, it is easy to evaluate the response ℛ for any PUF instance.(iii)
Uniqueness: for any two PUF1 and PUF2, given the same challenge C, the probability to evaluate the same response PUF1C=PUF2C is negligibly small.(iv)
One-way: given any ℛ∈ℝ, there exists no polynomial algorithm InversePUF: ℛ⟶C for any challenge C∈ℂ.


## 3.4. Fuzzy Extractor

The PUF circuit is susceptible to interference to generate the noisy response with low entropy, which may fail to authenticate the device. Fuzzy extractor has been developed to recover a reliable high-entropy response from a noisy response to enhance the security of authentication. Fuzzy extractor consists of the following two algorithms:(i)
Gen⋅: a probabilistic key generation algorithm κ,hd=GenR to generate the key κ and helper data hd.(ii)
Rec⋅: a deterministic reconstruction algorithm κ=RecR,hd to recover the key κ from a noisy response R′ and helper data hd, which the Hamming distance between the original response R and the noisy response R′ is at most d.


## 3.5. Blockchain and Smart Contract

Blockchain technology is an immutable and distributed data ledger consisting of an append-only sequence of blocks chained by the cryptographic hash function. Based on permission authorized to network nodes, blockchain platforms are divided into three types: private blockchain, consortium blockchain, and public blockchain. In the proposed scheme, Hyperledger Fabric is chosen to support the flexible transaction and Turing-complete smart contracts.The smart contract is an autoexecuted program deployed in the blockchain network, which can achieve complex functions, and it can be invoked by authorized nodes sending a legal transaction. The transaction is contained in the block after verification by the nodes. In our proposed scheme, we design the smart contract for registration information sharing between a trusted register center and multiple healthcare servers. The register center and servers can upload, query, and update the information by sending a transaction signed by its private key to invoke the smart contract. Users can query the information to ensure that their information can be authenticated by the whole network.


## 4. System Framework and Security Model

### 4.1. Network Model

Figure2 describes the network model that consists of four types of entities in our proposed scheme, namely the trusted registration center (RC), the permissioned blockchain network (BC), the servers (hospital and medical institutions), and the mobile users (patients and healthcare servicers).(i)
RC: it is a trusted third party and is responsible for system initialization, user/server registration, and registration information recorded in the blockchain network. It generates a master private key and issues a private key of the user/server according to their identities. Besides, it also randomly generates a challenge and sends it to the user’s devices. The registration record and challenge-response pair will be uploaded in the permissioned blockchain.(ii)
BC: it acts as a trusted recorder for registration, sharing, and updating by the smart contract. The trusted RC and servers join as network nodes to maintain the permissioned blockchain network together.(iii)
Healthcare Servers: the servers provide data storage for patient health records from wearable devices and support remote healthcare services between the healthcare provider and patients at home.(iv)
Mobile Users: there are two types of mobile users: patients and healthcare providers. We assume that all the mobile devices are equipped with a PUF and fuzzy extractor. The output of the PUF is used as one of the authentication factors. Moreover, a fuzzy extractor has been employed to recover the noisy PUF. The mobile devices of patients can upload biomedical data collected by wearable devices to remote servers for personalized medical services after mutual authentication. The mobile devices of healthcare providers can get patient conditions and offer clinical diagnostics after authentication.Figure 2
System model for remote healthcare service.


### 4.2. Network Assumptions

Patients can enjoy remote medical service by off-chain subscription service that hospitals/medical institutions provide and generate the access control list representing patients’ service time. Healthcare providers should also get permission (e.g., read, write, delete) to operate the data to achieve diverse data sharing across different institutions.Each subscription service maps to a specific value according to the mapping rulesACSj predefined and will be stored in the blockchain by each server, which can be retrieved by any server to check the validity. The access control list is represented by ACL=S,R, where S=S1,S2,…,Sn,R=RS1,RS2,…,RSn, where RUiSj represents the access permission the user applies for in Si, as shown in Tables 1 and 2. The server predefines the mapping rules ACSj of access permission, as shown in Table 3, and sends it to the RC in the registration phase.Table 1
The access control list of patients.
SiS1S2S3…SnRUiSjOne monthOne monthThree months…Seven monthsTable 2
The access control list of healthcare providers.
SiS1S2S3…SnRUiSjReadRead writeDelete…ReadWriteDeleteTable 3
The mapping rules of access permission.
PermissionOne monthThree monthsFive monthsSeven monthsOnly readRead writeRead write deleteNumbers3457111317Following the research efforts [39], after mapping, RC calculates the common solution M of each user using CRT as follows:(3)M≡NumR1modNS1M≡NumR2modNS2⋮.M≡NumRkmodNSnIn the authentication phase, the specific access permission can be calculated by the common solution.(4)NumRi≡MmodNSi,then the server can check whether the user has been authorized or expired by equation (4).


### 4.3. Security Requirements

To ensure the security of the remote healthcare service, the proposed scheme should satisfy the following requirements [21, 34–36, 40]:Single registration: for convenience to users, the proposed scheme should provide single registration. Users only register with the trusted RC once before they can communicate with healthcare servers.No online registration center: the proposed scheme should achieve mutual authentication without RC to relieve the communication overhead and resist the single point of failure.Mutual authentication: to ensure that legal users and servers could access healthcare data, the proposed scheme should provide mutual authentication between Ui and Sj to verify the legality of each other.User anonymity: to preserve the privacy of users, the proposed scheme should protect user identity. Any adversary cannot extract the real identity from the intercepted message.Untraceability: for the better protection of user privacy, no potential adversary can trace the user’s activities and behavior patterns by analyzing the intercepted message.Session key agreement: the proposed scheme should generate the session key between the users and servers to encrypt the message in future communications.Perfect forward secrecy: the proposed scheme should provide perfect forward secrecy to ensure the security of messages in the previous sessions. No potential attackers can generate the session key of previous sessions even if they obtain the long-term private key of two participants.Two-factor security: the proposed scheme should provide two-factor security, i.e., password and mobile device embedded with PUF.Access control for data privacy: the healthcare service providers can provide personalized remote healthcare services that users subscribe to for a specific service time. In the meantime, healthcare providers can be authorized to access the data with different permissions for preserving data privacy.Resistance of various attacks: to resist known attacks existing in the service system, the proposed scheme should resist known attacks, including impersonation attacks, physical attacks, replay attacks, man-in-the-middle attacks, etc.


## 4.1. Network Model

Figure2 describes the network model that consists of four types of entities in our proposed scheme, namely the trusted registration center (RC), the permissioned blockchain network (BC), the servers (hospital and medical institutions), and the mobile users (patients and healthcare servicers).(i)
RC: it is a trusted third party and is responsible for system initialization, user/server registration, and registration information recorded in the blockchain network. It generates a master private key and issues a private key of the user/server according to their identities. Besides, it also randomly generates a challenge and sends it to the user’s devices. The registration record and challenge-response pair will be uploaded in the permissioned blockchain.(ii)
BC: it acts as a trusted recorder for registration, sharing, and updating by the smart contract. The trusted RC and servers join as network nodes to maintain the permissioned blockchain network together.(iii)
Healthcare Servers: the servers provide data storage for patient health records from wearable devices and support remote healthcare services between the healthcare provider and patients at home.(iv)
Mobile Users: there are two types of mobile users: patients and healthcare providers. We assume that all the mobile devices are equipped with a PUF and fuzzy extractor. The output of the PUF is used as one of the authentication factors. Moreover, a fuzzy extractor has been employed to recover the noisy PUF. The mobile devices of patients can upload biomedical data collected by wearable devices to remote servers for personalized medical services after mutual authentication. The mobile devices of healthcare providers can get patient conditions and offer clinical diagnostics after authentication.Figure 2
System model for remote healthcare service.


## 4.2. Network Assumptions

Patients can enjoy remote medical service by off-chain subscription service that hospitals/medical institutions provide and generate the access control list representing patients’ service time. Healthcare providers should also get permission (e.g., read, write, delete) to operate the data to achieve diverse data sharing across different institutions.Each subscription service maps to a specific value according to the mapping rulesACSj predefined and will be stored in the blockchain by each server, which can be retrieved by any server to check the validity. The access control list is represented by ACL=S,R, where S=S1,S2,…,Sn,R=RS1,RS2,…,RSn, where RUiSj represents the access permission the user applies for in Si, as shown in Tables 1 and 2. The server predefines the mapping rules ACSj of access permission, as shown in Table 3, and sends it to the RC in the registration phase.Table 1
The access control list of patients.
SiS1S2S3…SnRUiSjOne monthOne monthThree months…Seven monthsTable 2
The access control list of healthcare providers.
SiS1S2S3…SnRUiSjReadRead writeDelete…ReadWriteDeleteTable 3
The mapping rules of access permission.
PermissionOne monthThree monthsFive monthsSeven monthsOnly readRead writeRead write deleteNumbers3457111317Following the research efforts [39], after mapping, RC calculates the common solution M of each user using CRT as follows:(3)M≡NumR1modNS1M≡NumR2modNS2⋮.M≡NumRkmodNSnIn the authentication phase, the specific access permission can be calculated by the common solution.(4)NumRi≡MmodNSi,then the server can check whether the user has been authorized or expired by equation (4).


## 4.3. Security Requirements

To ensure the security of the remote healthcare service, the proposed scheme should satisfy the following requirements [21, 34–36, 40]:Single registration: for convenience to users, the proposed scheme should provide single registration. Users only register with the trusted RC once before they can communicate with healthcare servers.No online registration center: the proposed scheme should achieve mutual authentication without RC to relieve the communication overhead and resist the single point of failure.Mutual authentication: to ensure that legal users and servers could access healthcare data, the proposed scheme should provide mutual authentication between Ui and Sj to verify the legality of each other.User anonymity: to preserve the privacy of users, the proposed scheme should protect user identity. Any adversary cannot extract the real identity from the intercepted message.Untraceability: for the better protection of user privacy, no potential adversary can trace the user’s activities and behavior patterns by analyzing the intercepted message.Session key agreement: the proposed scheme should generate the session key between the users and servers to encrypt the message in future communications.Perfect forward secrecy: the proposed scheme should provide perfect forward secrecy to ensure the security of messages in the previous sessions. No potential attackers can generate the session key of previous sessions even if they obtain the long-term private key of two participants.Two-factor security: the proposed scheme should provide two-factor security, i.e., password and mobile device embedded with PUF.Access control for data privacy: the healthcare service providers can provide personalized remote healthcare services that users subscribe to for a specific service time. In the meantime, healthcare providers can be authorized to access the data with different permissions for preserving data privacy.Resistance of various attacks: to resist known attacks existing in the service system, the proposed scheme should resist known attacks, including impersonation attacks, physical attacks, replay attacks, man-in-the-middle attacks, etc.


## 5. The Proposed Scheme

We describe the proposed scheme in this section. The proposed scheme consists of seven phases: blockchain initialization, system setup phase, server registration phase, user registration phase, mutual authentication phase, password update phase, and access rights update phase.


### 5.1. Blockchain Initialization

RC establishes a consortium blockchain (e.g., Hyperledger Fabric) among RC and servers as network nodes to maintain the blockchain. The servers must register and enroll the identities as legitimate members to engage in the consensus process.In the meantime, the smart contract (SC) will be deployed in the blockchain network and can be invoked by transaction. Algorithms 1 and 2 show that the smart contract supports the upload and query of challenge-response pair (CRP) and access permission. In the subscription phase, the servers will upload the subscription service time (for patients) or service permission (for healthcare providers) into the blockchain, which can be validated when RC computes users’ common solution. In the registration phase, RC will randomly generate the challenge and then receive the response produced by user’s fuzzy extractor via a secure channel. The challenge-response pair will be stored in the ledger to share with servers in the authentication process.Algorithm 1: Subscription service contract.
function uploadSubs(hi, IDSj, RUiSj)IDij=hi‖IDSjif userExists IDij  = = falseexpiretime = time.Now().Month() +RUiSjservice = Service \{IDij, RUiSj, expiretime\}return putState(IDij, service)elsereturn Errorf(“the user has already exists”)function querySubs(hi, IDSj)IDij=hi‖IDSjerr, result = getStateIDijif (err = = null)return resultelsereturn errfunction updateSubs(hi, RUiSj)IDij=hi‖IDSjif userExists IDij  = = trueexpiretime = time.Now().Month() +RUiSjservice = Service \{IDij, RUiSj, expiretime\}return putState(IDij, RUiSj)elsereturn Errorf(“the user does not exist”)Algorithm 2: Challenge-response pair contract.
function uploadCRP(hi, Ci, κiP, Ri, ts)if userExists hi  = = falsestatus = ‘valid’ts  = time.Now()user = User \{hi, Ci, κiP, Ri, ts, status\}return putState(hi, user)elsereturn Errorf(“the user has already exists”)function queryCRP hierr, result = getStatehiif (err = = null && result.getStatus() = = ‘valid’)return resultelse if (result.getStatus() ! = “valid”)return Errorf(“the CRP of user has been expired”)return errfunction updateCRP(hi, Ci, κiP, Ri)if userExists hi  = = truestatus = ‘valid’ts  = time.Now()user = User \{hi, Ci, κiP, Ri, ts, status\}return putState(hi, user)elsereturn Errorf(“the user does not exist”)


### 5.2. System Setup Phase

In this phase, the trusted RC generates system parameters and selects the master private key.(1)
RC selects additive groupG1 and multiplicative group G2 with the same prime order q and a bilinear pairing e:G1×G1⟶G2. RC also chooses a generator P of G1 and then computes g=eP,P of G2.(2)
RC randomly choosess∈Zq∗ as the master private key and calculates its public key Ppub=sP.(3)
RC selects seven secure hash functionsh0:0,1∗⟶0,1l0, h1:0,1∗×G1⟶Zq∗, h1′:0,1∗⟶Zq∗, h2:0,1∗×0,1∗×G1×0,1∗×G1×0,1∗⟶0,1∗, h3:G2⟶0,1∗, h4:0,1∗×G1×0,1∗⟶Zq∗, h5:0,1∗×0,1∗×0,1∗×0,1∗G1×G1×G1×0,1∗⟶0,1∗, h6:G1×G1×G1×G1×0,1∗×0,1∗×0,1∗⟶Zq∗(4)
RC publishes system parametersparams=G1,G2,P,e,q,g,Ppub,h0,h1,h1′,h2,h3,h4,h5,h6 and keeps s securely.


### 5.3. Server Registration Phase

As shown in Figure3, the server Sj registers with the RC to obtain its long-term private key through a secure channel. The steps below will be executed between Sj and RC.(1)
The serverSj selects its IDSj and predefines the access control mapping rules ACSj. Then, Sj transmits them to RC.(2)
RC computesDSj=1/s+h1′IDSj⋅P, selects a coprime integer NSj, and sends DSj,NSj to Sj. RC stores Sj,NSj,ACSj securely.(3)
After receiving,Sj keeps DSj,NSj secretly.Figure 3
Server registration.


### 5.4. User Registration Phase

There are two types of mobile users in this scheme, including patients (remote service subscribers) and healthcare providers (remote service providers). The following steps will be executed by mobile users to register with RC, as shown in Figure4.(1)
The mobile userUi selects an identity IDi and a password PWi and generates a nonce ni. After subscription service, the access control list ACLi=Sj,RUi and Pi=h0IDi‖PWi‖ni will be sent to RC through a secure channel.(2)
After receiving the request, RC computes the common solutionM using CRT according to the access control list of user RUi=RUiS1,RUiS2,…,RUiSn, mapping rules ACS1,ACS2,…,ACSn, and N=NS1,NS2,…,NSn by equation (3). After that, RC generates a random number ri∈Zq∗, Ri=riP, and calculates Di=ri+shimodq using hi=h1IDi‖M‖Ri and its master private key. RC also generates a random challenge Ci and sends it to Ui.(3)
After receiving the challengeCi, Ui extracts the outputs of the PUF γi=PUFCi and then obtains the secret key κi and helper data hd from FE.Genγi using a fuzzy extractor. After that, Ui sends κi, hd to RC for authentication in future.(4)
RC computesτi=Ci‖hd‖Di‖M‖Ri‖hi⊕Pi, σi=h2Ci‖hd‖Di‖M‖Ri‖hi‖Pi, and κiP and then uploads the “challenge-response” pair Ci,κiP,Ri in the blockchain to share with the servers (healthcare providers), where ts denotes the service start time as shown in Algorithm 2. After that, RC sends τi,σi to Ui and stores the user registration table IDi,Pi,ACLi in the blockchain.(5)
Ui stores τi,σi,ni in the secure memory.Figure 4
Mobile user registration.


### 5.5. Authentication Phase

As depicted in Figure5, the user Ui authenticates with the server Sj, and then a common session key SK is generated for secure communications.(1)
Ui inputs his identity IDi and password PWi. His/Her mobile device computes Pi=h0IDi‖PWi‖ni,Ci‖hd‖Di‖M‖Ri‖hi=τi⊕Pi,σi′=h2Ci‖hd‖Di‖M‖Ri‖hi‖Pi and then checks whether the equation σi′=σi holds. If not, it terminates the request. Otherwise, the device extracts the PUF output γi′=PUFCi and κi=Recγi′,hd using a fuzzy extractor. After that, it chooses a random number x∈Zq∗ and calculates X′=gx,X=xP,U1=xPpub+h1′IDSjP,N=h3X′⊕IDi‖M‖hi‖X,w=h4N‖U1‖κi‖Tus‖U2=Di+xw+κi, where Tus denotes the current timestamp. Ui sends N,U1,U2,w,Tus to Sj via a public channel.(2)
On receiving the message,Sj first checks whether the timestamp is fresh. If not, Sj rejects the session. Otherwise, Sj computes X′=eU1,DSj by its secret key and IDi‖M‖hi‖X=N⊕h3X′. Sj invokes the smart contract to get Ci,κiP,Ri,ts,status by input parameters hi. After that, Sj checks whether the equation U2P=Ri+hiPpub+wX+κiP holds. If not, Sj fails to authenticate Ui. Otherwise, Sj calculates RUiSj≡MmodNSj to check whether the access control permission has expired by the equation RUiSj>te−ts, where te denotes current time. If expired/not authorized, Sj terminates the request. Otherwise, Sj selects a random number y∈Zq∗, computes Y=yP,K=yX,Vj=h5IDi‖IDSj‖M‖RUiSj‖X‖Y‖K‖Tsu, and sets the session key SK=h6X′‖X‖Y‖K‖IDi‖IDSj‖M, where Tsu is the current timestamp. Then, Sj sends Y,Vj,Tsu to Ui. Note that the server can obtain X′ and validate the user identity from the two following equations:(5)eU1,DSj=exPpub+h1′IDSjP,1s+h1′IDSjP=exsP+h1′IDSjP,1s+h1′IDSjP=eP,Pxs+h1′IDSj⋅1s+h1′IDSj=eP,Px=gx=X′U2P=Di+xw+κiP=DiP+xwP+κiP=ri+shiP+wX+κiP=Ri+hiPpub+wX+κiP.(3)
After receiving the message,Ui first checks whether Tsu is fresh. If not, Ui terminates the session. Otherwise, Ui computes K=xY,Vj′=h5IDi‖IDSj‖M‖RUiSj‖X‖Y‖K‖Tsu to check whether Vj′ and Vj are equal. If not, Ui aborts the session. Otherwise, Ui calculates the session key SK=h6X′‖X‖Y‖K‖IDi‖IDSj‖M.Figure 5
Mutual authentication.


### 5.6. Password Update Phase

IfUi wants to update the password, the following steps are executed between Ui and his/her mobile device:(1)
Ui inputs IDi, old PWi, and new PWi∗ into the mobile device.(2)
The mobile device computesPi=h0IDi‖PWi‖ni,Ci‖hd‖Di‖M‖Ri‖hi=τi⊕Pi,σi′=h2Ci‖hd‖Di‖M‖Ri‖hi‖Pi and checks whether σi′=σi holds. If not, the mobile device rejects the request. Otherwise, the mobile device calculates Pi∗=h0IDi‖PWi∗‖ni,τi∗=Ci‖hd‖Di‖M‖Ri‖hi⊕Pi∗,σi∗=h2Ci‖hd‖Di‖M‖Ri‖hi‖Pi∗. Then, the mobile device replaces τi,σi with τi∗,σi∗.


### 5.7. Access Rights Update Phase

Ui must update the access control list and send a new ACLi∗ to the RC after the renewal of subscription. The steps will be carried out between Ui and RC.(1)
Ui generates a new access control list ACLi∗ and sends IDi,Pi,ACLi∗ to RC via a secure channel.(2)
After receiving the message, RC obtains the old access control listACLi from the user registration table by the index IDi and updates ACLi. Then, RC computes the new common solution M′ using CRT. After that, RC regenerates ri′∈Zq∗,hi′=h1IDi‖M′‖Ri′,Di′=ri′+shi′modq,τi′=Ci‖hd‖Di′‖M′‖Ri′‖hi′⊕Pi,σi′=h2Ci‖hd‖Di′‖M′‖Ri′‖hi′‖Pi and sends τi′,σi′ to Ui. Finally, RC updates the user registration table IDi,Pi,ACLi∗.


## 5.1. Blockchain Initialization

RC establishes a consortium blockchain (e.g., Hyperledger Fabric) among RC and servers as network nodes to maintain the blockchain. The servers must register and enroll the identities as legitimate members to engage in the consensus process.In the meantime, the smart contract (SC) will be deployed in the blockchain network and can be invoked by transaction. Algorithms 1 and 2 show that the smart contract supports the upload and query of challenge-response pair (CRP) and access permission. In the subscription phase, the servers will upload the subscription service time (for patients) or service permission (for healthcare providers) into the blockchain, which can be validated when RC computes users’ common solution. In the registration phase, RC will randomly generate the challenge and then receive the response produced by user’s fuzzy extractor via a secure channel. The challenge-response pair will be stored in the ledger to share with servers in the authentication process.Algorithm 1: Subscription service contract.
function uploadSubs(hi, IDSj, RUiSj)IDij=hi‖IDSjif userExists IDij  = = falseexpiretime = time.Now().Month() +RUiSjservice = Service \{IDij, RUiSj, expiretime\}return putState(IDij, service)elsereturn Errorf(“the user has already exists”)function querySubs(hi, IDSj)IDij=hi‖IDSjerr, result = getStateIDijif (err = = null)return resultelsereturn errfunction updateSubs(hi, RUiSj)IDij=hi‖IDSjif userExists IDij  = = trueexpiretime = time.Now().Month() +RUiSjservice = Service \{IDij, RUiSj, expiretime\}return putState(IDij, RUiSj)elsereturn Errorf(“the user does not exist”)Algorithm 2: Challenge-response pair contract.
function uploadCRP(hi, Ci, κiP, Ri, ts)if userExists hi  = = falsestatus = ‘valid’ts  = time.Now()user = User \{hi, Ci, κiP, Ri, ts, status\}return putState(hi, user)elsereturn Errorf(“the user has already exists”)function queryCRP hierr, result = getStatehiif (err = = null && result.getStatus() = = ‘valid’)return resultelse if (result.getStatus() ! = “valid”)return Errorf(“the CRP of user has been expired”)return errfunction updateCRP(hi, Ci, κiP, Ri)if userExists hi  = = truestatus = ‘valid’ts  = time.Now()user = User \{hi, Ci, κiP, Ri, ts, status\}return putState(hi, user)elsereturn Errorf(“the user does not exist”)


## 5.2. System Setup Phase

In this phase, the trusted RC generates system parameters and selects the master private key.(1)
RC selects additive groupG1 and multiplicative group G2 with the same prime order q and a bilinear pairing e:G1×G1⟶G2. RC also chooses a generator P of G1 and then computes g=eP,P of G2.(2)
RC randomly choosess∈Zq∗ as the master private key and calculates its public key Ppub=sP.(3)
RC selects seven secure hash functionsh0:0,1∗⟶0,1l0, h1:0,1∗×G1⟶Zq∗, h1′:0,1∗⟶Zq∗, h2:0,1∗×0,1∗×G1×0,1∗×G1×0,1∗⟶0,1∗, h3:G2⟶0,1∗, h4:0,1∗×G1×0,1∗⟶Zq∗, h5:0,1∗×0,1∗×0,1∗×0,1∗G1×G1×G1×0,1∗⟶0,1∗, h6:G1×G1×G1×G1×0,1∗×0,1∗×0,1∗⟶Zq∗(4)
RC publishes system parametersparams=G1,G2,P,e,q,g,Ppub,h0,h1,h1′,h2,h3,h4,h5,h6 and keeps s securely.


## 5.3. Server Registration Phase

As shown in Figure3, the server Sj registers with the RC to obtain its long-term private key through a secure channel. The steps below will be executed between Sj and RC.(1)
The serverSj selects its IDSj and predefines the access control mapping rules ACSj. Then, Sj transmits them to RC.(2)
RC computesDSj=1/s+h1′IDSj⋅P, selects a coprime integer NSj, and sends DSj,NSj to Sj. RC stores Sj,NSj,ACSj securely.(3)
After receiving,Sj keeps DSj,NSj secretly.Figure 3
Server registration.


## 5.4. User Registration Phase

There are two types of mobile users in this scheme, including patients (remote service subscribers) and healthcare providers (remote service providers). The following steps will be executed by mobile users to register with RC, as shown in Figure4.(1)
The mobile userUi selects an identity IDi and a password PWi and generates a nonce ni. After subscription service, the access control list ACLi=Sj,RUi and Pi=h0IDi‖PWi‖ni will be sent to RC through a secure channel.(2)
After receiving the request, RC computes the common solutionM using CRT according to the access control list of user RUi=RUiS1,RUiS2,…,RUiSn, mapping rules ACS1,ACS2,…,ACSn, and N=NS1,NS2,…,NSn by equation (3). After that, RC generates a random number ri∈Zq∗, Ri=riP, and calculates Di=ri+shimodq using hi=h1IDi‖M‖Ri and its master private key. RC also generates a random challenge Ci and sends it to Ui.(3)
After receiving the challengeCi, Ui extracts the outputs of the PUF γi=PUFCi and then obtains the secret key κi and helper data hd from FE.Genγi using a fuzzy extractor. After that, Ui sends κi, hd to RC for authentication in future.(4)
RC computesτi=Ci‖hd‖Di‖M‖Ri‖hi⊕Pi, σi=h2Ci‖hd‖Di‖M‖Ri‖hi‖Pi, and κiP and then uploads the “challenge-response” pair Ci,κiP,Ri in the blockchain to share with the servers (healthcare providers), where ts denotes the service start time as shown in Algorithm 2. After that, RC sends τi,σi to Ui and stores the user registration table IDi,Pi,ACLi in the blockchain.(5)
Ui stores τi,σi,ni in the secure memory.Figure 4
Mobile user registration.


## 5.5. Authentication Phase

As depicted in Figure5, the user Ui authenticates with the server Sj, and then a common session key SK is generated for secure communications.(1)
Ui inputs his identity IDi and password PWi. His/Her mobile device computes Pi=h0IDi‖PWi‖ni,Ci‖hd‖Di‖M‖Ri‖hi=τi⊕Pi,σi′=h2Ci‖hd‖Di‖M‖Ri‖hi‖Pi and then checks whether the equation σi′=σi holds. If not, it terminates the request. Otherwise, the device extracts the PUF output γi′=PUFCi and κi=Recγi′,hd using a fuzzy extractor. After that, it chooses a random number x∈Zq∗ and calculates X′=gx,X=xP,U1=xPpub+h1′IDSjP,N=h3X′⊕IDi‖M‖hi‖X,w=h4N‖U1‖κi‖Tus‖U2=Di+xw+κi, where Tus denotes the current timestamp. Ui sends N,U1,U2,w,Tus to Sj via a public channel.(2)
On receiving the message,Sj first checks whether the timestamp is fresh. If not, Sj rejects the session. Otherwise, Sj computes X′=eU1,DSj by its secret key and IDi‖M‖hi‖X=N⊕h3X′. Sj invokes the smart contract to get Ci,κiP,Ri,ts,status by input parameters hi. After that, Sj checks whether the equation U2P=Ri+hiPpub+wX+κiP holds. If not, Sj fails to authenticate Ui. Otherwise, Sj calculates RUiSj≡MmodNSj to check whether the access control permission has expired by the equation RUiSj>te−ts, where te denotes current time. If expired/not authorized, Sj terminates the request. Otherwise, Sj selects a random number y∈Zq∗, computes Y=yP,K=yX,Vj=h5IDi‖IDSj‖M‖RUiSj‖X‖Y‖K‖Tsu, and sets the session key SK=h6X′‖X‖Y‖K‖IDi‖IDSj‖M, where Tsu is the current timestamp. Then, Sj sends Y,Vj,Tsu to Ui. Note that the server can obtain X′ and validate the user identity from the two following equations:(5)eU1,DSj=exPpub+h1′IDSjP,1s+h1′IDSjP=exsP+h1′IDSjP,1s+h1′IDSjP=eP,Pxs+h1′IDSj⋅1s+h1′IDSj=eP,Px=gx=X′U2P=Di+xw+κiP=DiP+xwP+κiP=ri+shiP+wX+κiP=Ri+hiPpub+wX+κiP.(3)
After receiving the message,Ui first checks whether Tsu is fresh. If not, Ui terminates the session. Otherwise, Ui computes K=xY,Vj′=h5IDi‖IDSj‖M‖RUiSj‖X‖Y‖K‖Tsu to check whether Vj′ and Vj are equal. If not, Ui aborts the session. Otherwise, Ui calculates the session key SK=h6X′‖X‖Y‖K‖IDi‖IDSj‖M.Figure 5
Mutual authentication.


## 5.6. Password Update Phase

IfUi wants to update the password, the following steps are executed between Ui and his/her mobile device:(1)
Ui inputs IDi, old PWi, and new PWi∗ into the mobile device.(2)
The mobile device computesPi=h0IDi‖PWi‖ni,Ci‖hd‖Di‖M‖Ri‖hi=τi⊕Pi,σi′=h2Ci‖hd‖Di‖M‖Ri‖hi‖Pi and checks whether σi′=σi holds. If not, the mobile device rejects the request. Otherwise, the mobile device calculates Pi∗=h0IDi‖PWi∗‖ni,τi∗=Ci‖hd‖Di‖M‖Ri‖hi⊕Pi∗,σi∗=h2Ci‖hd‖Di‖M‖Ri‖hi‖Pi∗. Then, the mobile device replaces τi,σi with τi∗,σi∗.


## 5.7. Access Rights Update Phase

Ui must update the access control list and send a new ACLi∗ to the RC after the renewal of subscription. The steps will be carried out between Ui and RC.(1)
Ui generates a new access control list ACLi∗ and sends IDi,Pi,ACLi∗ to RC via a secure channel.(2)
After receiving the message, RC obtains the old access control listACLi from the user registration table by the index IDi and updates ACLi. Then, RC computes the new common solution M′ using CRT. After that, RC regenerates ri′∈Zq∗,hi′=h1IDi‖M′‖Ri′,Di′=ri′+shi′modq,τi′=Ci‖hd‖Di′‖M′‖Ri′‖hi′⊕Pi,σi′=h2Ci‖hd‖Di′‖M′‖Ri′‖hi′‖Pi and sends τi′,σi′ to Ui. Finally, RC updates the user registration table IDi,Pi,ACLi∗.


## 6. Security Analysis

We will demonstrate that the proposed scheme is provably secure under the random oracle model and satisfy the security requirements mentioned in Section4.3.


### 6.1. Security Model

We define the formal security model for the proposed scheme through a game played between an adversaryA and a challenger C. Let ΠPi denote the ith instance of the participant P, where P∈Ui,Sj denotes two participants: the mobile user and the server who are involved in the execution of the proposed scheme. In the game, A can initiate a series of queries to C, which can answer them as follows:(i)
him: when A sends a message m, C first checks whether m is in the hash-list Lhi. If so, return the value. Otherwise, C generates a random number ri∈Zq∗ and stores mi,ri in the hash-list Lhi. After that, return ri to A.(ii)
ExtractUserID (IDUi): when A sends a query with the user’s Ui identity IDUi, C generates a private key and stores IDUi,di in the user-list LUi.(iii)
ExtractServerID (IDSj): when A sends a query with the server’s Sj identity IDSj, C generates a private key and stores IDSj,dj in the server-list LSj.(iv)
Send (ΠPi,mi): when A sends a query with a message mi, C responds with the result by executing the proposed scheme. A can start the proposed scheme by sending ΠPi,START.(v)
Reveal (ΠPi): when A sends this query, C returns the session key of the ith instance.(vi)
Corrupt (ΠP): when A sends this query with the participant P∈Ui,Sj identity, C returns the corresponding private key.(vii)
Test (ΠPi): A can send this query only once. Upon receiving the query, C flips a coin c∈0,1. If c=1, C returns the session key of ith instance. Otherwise, C selects a random number and returns it.After executing the aforementioned queries,A output the guess c′ in the test query phase. If c′=c, we say A breaks the semantic security of the proposed scheme. The advantage that A violates the authenticated key agreement (AKA) of this scheme Γ is denoted by AdvΓAKA=2Prc′=c−1.Definition 1.
(AKA-security): we say an authentication schemeΓ is AKA-security if AdvΓAKA=2Prc′=c−1 is negligible for any polynomial adversary A.
LetEU−S and ES−U denote the events A that can violate U−to−S authentication by forging a login message and S−to−U authentication by forging a response message, respectively. The advantage that A violates the mutual authentication of this scheme Γ is denoted by AdvΓMA=PrEU−S+PrES−U.Definition 2.
(MA-security): we say an authentication schemeΓ is MA-security if AdvΓMA=PrEU−S+PrES−U is negligible for any polynomial adversary A.


### 6.2. Provable Security

We will prove that our proposed scheme is MA-security and AKA-security in the security model above.Lemma 1.
No polynomial adversary can forge a legal login message if the DL problem is difficult.Proof.
suppose the adversaryA can output a legal login message with non-negligible probability ε, then the challenger C can solve the DL problem with non-negligible advantage.
Given a DL instanceP,θ=τP, the task of C is to compute τ, where τ∈Zq∗ is unknown to C. C generates a random number τ^∈Zq∗, sets Ppub←θ,P^pub=τ^P, and sends the system parameters params=G1,G2,P,e,q,Ppub,P^pub,h0,h1,h1′,h2,h3,h4,h5,h6 to A. C will maintain seven hash-lists Lhi (i = 0, 1, 2, 3, 4, 5, 6), a mobile user list LUi, and a server list LSj. C randomly chooses a user’s identity IDUi∗ as the challenge identity and answers A’s queries as follows:(i)
him: C maintains the lists Lhi, which are initially empty. C, firstly, checks whether mi,ri exists in Lhi. If it does, C returns ri to A. Otherwise, C generates a random number ri, stores mi,ri in Lhi, and returns ri to A.(ii)
ExtractUserID (IDUi): C maintains the mobile user list LUi, which is initially empty. C, firstly, checks whether IDUi,Ri,di,κi exists in LUi. If it does, C returns IDUi to A. Otherwise, C executes the following steps:(a)
IfIDUi≠IDUi∗, C randomly selects rUi,h1Ui∈Zq∗, and a random number κi as the output of fuzzy extractor. C computes RUi=rUiP−hUiPpub. Otherwise, C sets di←rUi and stores IDUi,Ri,di,κi and IDUi,RUi,h1Ui in LUi and Lh1, respectively, and returns IDUi to A.(b)
IfIDUi=IDUi∗, C generates two random numbers rUi∗,h1Ui∗∈Zq∗, computes RUi∗=rUi∗P, sets dUi∗←⊥, selects a random number κ∗ as the output of fuzzy extractor, stores IDUi∗,RUi∗,⊥,κ∗ and IDUi∗,RUi∗,h1Ui∗ in LUi and Lh1, respectively, and returns IDUi∗ to A.(iii)
ExtractServerID (IDSj): C maintains the server list LSj, which is initially empty. C, firstly, checks whether IDSj,dj is in LSj. If it does, C returns IDSj to A. Otherwise, C selects ej∈Zq∗, computes dj=1/τ^+ejP, stores IDSj,dj and IDSj,ej in LSj and Lh1, respectively, and then returns IDSj to A.(iv)
Send (ΠPi,mi): A can send the following queries:(a)
SendUit,START: when A sends this query, C, firstly, checks if IDUi=IDUi∗ holds. If it does, C aborts the game. Otherwise, C checks whether IDUi exists in LUi. If not, C executes the ExtractUserID IDUi query. After that, with the private key di, C generates a random number x∈Zq∗ and calculates X′=gx,X=xP,U1,U2,N,ω as described. C stores IDUi,IDSj,t,x,X,M,RUiSj in LUiSj and returns U1,U2,N,ω to A.(b)
SendSjl,N,U1,U2,ω,Tus: when A sends this query, C checks whether IDSj exists in LSj. If not, C executes the ExtractServerID IDSj. After that, with the private key dj, C computes X′=eU1,dj and extracts IDUi‖M‖hi‖X=N⊕h3X′. C obtains hi,κi from LUi, verifies if U2P=Ri+hiPpub+ωX+κiP holds. If not, C rejects the message. Otherwise, C generates a random number y∈Zq∗, computes Y,Vj,Tsu as described, and returns it to A. If IDUi=IDUi∗, then A successfully forges a legal login message.(c)
SendUit,Y,Vj,Tsu: upon receiving this message, C checks if Vj′=Vj holds with IDUi,IDSj,t,x,X,M,RUiSj in LUiSj. If not, C rejects the message. Otherwise, C authenticates A.(v)
Reveal (ΠPi): upon receiving this message, C returns the session key SK if SK is accepted. Otherwise, C returns ‘⊥’ to A.(vi)
Corrupt (ΠP): upon receiving the identity IDUi (or IDSj), C looks up LUi (or LSj) and returns di (or dj) to A.(vii)
Test (ΠPi): C generates a random number with the same length of session key and returns it to A.
SupposeA forges a legal login message with IDUi=IDUi∗. By applying forking lemma, A can generate another legal login message U2 with the same input of the simulation and different hash oracle queries. Then, we can get the following equations:(6)U2P=Ri∗+hi∗Ppub+ωX+κi∗P,(7)U2′P=Ri∗+hi∗Ppub+ωX+κi∗P.
Based on equations (7) and (8), we have the following:(8)U2−U2′P=Ri∗+hi∗Ppub+ωX+κi∗P−Ri∗+hi∗Ppub+ωX+κi∗P=hi∗−hi∗Ppub=hi∗−hi∗τP.
By equations (8), U2−U2′hi∗−hi∗−1modq is the answer of DL problem. The advantage that C solves the DL problem is given below. Firstly, some events are defined as follows:(i)
E1: the simulation does not abort in any Send query.(ii)
E2: A successfully forges a legal message.(iii)
E3: IDUi=IDUi∗.
Letqh1 and qs denote the number of h1 queries and Send queries. Then, we have the following equations:(9)PrE1=1−1qs+1qsPrE2|E1⩾εPrE3|E2∧E1⩾1qh1.
By equation (9), the advantage that C solves the DL problem is as follows:(10)ϵ=PrE3∧E2∧E1=PrE3|E2∧E1⋅PrE2||E1⋅PrE1⩾1−1qs+1qs1qh1⋅ε.
Thus,C can solve the DL problem with non-negligible probability ϵ by playing the game with A. It contradicts with the difficulty of DL problem. We conclude that no polynomial adversary can forge a legal login message with non-negligible probability.Lemma 2.
No polynomial adversary can forge a legal response message if thek-mBIDH Problem is difficult.Proof.
suppose the adversaryA can forge a legal response message with non-negligible probability ε, then the challenger C can solve the k-mBIDH problem with non-negligible advantage. Given a k-mBIDH instance, P,Ppub=sP,ιP,e1,e2,…,ek∈Zq∗,1/s+e1P,1/s+e2P,…,1/s+ekP∈G1, the task of C is to compute eP,Pι/s+e∗, where s,ι are unknown to C and e∗∉e1,e2,…,ek. C sends the system parameters params=G1,G2,q,e,g,P,Ppub,h0,h1,h1′,h2,h3,h4,h5,h6 to A. C will maintain seven hash-lists Lhi (i = 0, 1, 2, 3, 4, 5, 6), a mobile user list LUi, and a server list LSj. C chooses a random identity IDSj∗ as the challenge identity.
hi (i = 0, 1, 2, 3, 4, 6), Reveal, Corrupt, and Test query are the same as those in the simulation of Lemma 1. h5, Extract, and Send query are executed as follows:(i)
ExtractServerID (IDSj): C maintains the server list LSj, which is initially empty. C, firstly, checks whether IDSj,ej is in LSj. If it is, C returns IDSj to A. Otherwise, C executes the following steps:(a)
IfIDSj≠IDSj∗, C selects ej∈e1,e2,…,ek and dj=1/s+ejP. C stores IDSj,dj and IDSj,ej in LSj and Lh1′, respectively, and returns IDSj to A.(b)
IfIDSj=IDSj∗, C sets h1′IDSj=e∗, stores IDSj,⊥ and IDSj,e∗ in LSj and Lh1′, respectively, and returns IDSj to A.(ii)
ExtractUserID (IDUi): C maintains the mobile user list LUi, which is initially empty. C, firstly, checks whether IDUi,RUi,di,κi exists in LUi. If it does, C returns IDUi to A. Otherwise, C randomly selects rUi,h1Ui∈Zq∗ and computes RUi=rUiP−h1UiPpub. C sets di←rUi and generates a random number κi as the output of fuzzy extractor. C stores IDUi,RUi,di,κi and IDUi,RUi,h1Ui in LUi and Lh1, respectively, and returns IDUi to A.(iii)
Send (ΠPi,mi): A can send the following queries:(a)
SendUit,START: If Ui’s partner is Sj∗, C sets U1=ιP and calculates U2,N,ω as described. Otherwise, C looks up IDUi,RUi,h1Ui from Lh1 and generates a legal login message as described.(b)
SendSjl,N,U1,U2,ω,Tus: When A sends this query, C checks whether IDSj=IDSj∗ holds. If it does, C aborts the game. Otherwise, C behaves the operations as described.(c)
SendUit,Y,Vj,Tsu: Upon receiving this message, C checks if V′=Vj holds.
If not,C rejects the message. Otherwise, C authenticates A. If IDSj=IDSj∗, it means that A successfully forges a legal response message.
SupposeA forges a legal response message with IDSj=IDSj∗. In the game, A must send Vj=h5IDi,IDSj,M,RUiSj,X,Y,K,Tsu query after recovering IDUi‖M‖h1Ui‖X=N⊕h3X′. Thus, A must have executed the h3 query with the message X′. We have the following:(11)X′=eU1,dj∗=eιP,1s+e∗P=eP,Pι/s+e∗
The advantage thatC solves the k-mBIDH Problem is given below. Some events are defined as follows:(i)
E1: the simulation does not abort.(ii)
E2: A successfully forges a legal response message.(iii)
E3: IDSj=IDSj∗.(iv)
E4: C selects a correct tuple from Lh3.
Letqh1, qh3, and qs denote the number of h1,h3 query and Send query. Then, we have the following equations:(12)PrE1=1−1qs+1qsPrE2|E1⩾εPrE3|E2∧E1⩾1qh1PrE4|E3∧E2∧E1⩾1qh3.
By equation (12), the advantage that C solves the k-mBIDH Problem is as follows:(13)ϵ=PrE4∧E3∧E2∧E1=PrE4|E3∧E2∧E1⋅PrE3|E2∧E1⋅PrE2|E1⋅PrE1⩾1−1qs+1qs1qh11qh3⋅ε.
Thus,C can solve the k-mBIDH problem with non-negligible probability ϵ by playing the game with A. It contradicts with the hardness of k-mBIDH problem. We conclude that no polynomial adversary can forge a legal response message with non-negligible probability.Theorem 1.
The proposed scheme is MA-security if the DL problem andk-mBIDH problem are hard.Proof.
Lemma1 and 2 demonstrate that no polynomial adversary can forge a legal login message or response message if the DL problem and k-mBIDH problem are hard. In other words, the mobile user Ui and the server Sj can authenticate each other. Therefore, the proposed scheme is MA-security.Theorem 2.
The proposed scheme is AKA-security if CDH problem is hard.Proof.
supposeA can guess b correctly with non-negligible probability ε in the Test query, then C can solve the CDH problem with non-negligible probability. Some events are defined as follows:(i)
Eb: A guesses the value of b correctly.(ii)
ETU: A makes the Test query to the user.(iii)
ETS: A makes the Test query to the server.(iv)
EUS: A forges a legal login message between the user and server.
Since the probability thatA can guess the value of b correctly is at least 1/2, then we have PrEb⩾ε/2. We can get the equations as follows:(14)ε2⩽PrEb=PrEb∧ETU+PrEb∧ETS∧EUS+PrEb∧ETS∧¬EUS⩽PrEb∧ETU+PrEUS+PrEb∧ETS∧¬EUS.
Then,(15)PrEb∧ETU+PrEb∧ETS∧¬EUS⩾ε2−PrEUS.
The eventETS∧¬EUS and ETU are equal. We can get the following:(16)2PrEb∧ETU⩾ε2−PrEUS.
Then, the advantage thatC solves the CDH problem is as follows:(17)ϵ=PrEb∧ETU⩾ε4−PrEUS2.
The eventEb∧ETU means that A impersonates the user and has K=xY, which is the solution of CDH problem. According to Lemma 1, PrEUS is negligible. Then, we can get PrEb∧ETU, which is non-negligible because ε is non-negligible. It means that C can solve the CDH problem with non-negligible probability ϵ by playing the game with A. It contradicts the difficulty of CDH problem. We conclude that no polynomial adversary can guess b correctly, and the proposed scheme is AKA-security.


### 6.3. Security Requirement Analysis

We also show that the proposed scheme satisfies the security requirements described in Section4.3.Single registration: According to the description of the proposed scheme, the trusted RC generates the registration information for users. Then, users can be authenticated by other healthcare service providers.No online registration center: According to the specification of the proposed scheme, RC is not involved in the mutual authentication.Mutual authentication: According to the proof of Lemma 1 and Lemma 2, we know that no polynomial adversary can forge a legal login message and response message. Thus, the user Ui and the server Sj can authenticate each other by the received message.User anonymity: Based on the description of the proposed scheme, the user identity IDUi is hidden in the login message N,U1,U2,ω,Tus, where N=h3X′⊕IDUi‖M‖hi‖X. An adversary can extract IDUi only if he/she can get X′=eU1,DSj after solving the k-mBIDH problem. Besides, the registration recorded in the blockchain is hidden by the hash function hi=h1IDi‖M‖Ri.Untraceability: In the proposed scheme, random x is generated in each new session to compute a new login message N,U1,U2,ω,Tus, where X′=gx,X=xP,U1=xPK+h1IDSjP,N=h3X′⊕IDUi‖M‖hi‖X,ω=h4N,U1,κi,Tus,U2=DUi+xw+κi. Because of the randomness of x, the adversary cannot find any relation among these login messages of different sessions and thus cannot trace the users’ behavior.Session key agreement: Based on the description of the proposed scheme, the user and the server will generate a session key SK=h6X′‖X‖Y‖Kij‖IDi‖IDSj for future secure communications. We know that no adversary can compute xyP from xP and yP since the CDH problem is hard.Perfect forward secrecy: Assume that there is an adversary who gets the long-term private key of the user and the server and intercepts the exchange message of previous sessions. Then, the adversary cannot compute Kij=xyP in SK=h6X′‖X‖Y‖Kij‖IDi‖IDSj even if he gets X and Y from U1,N,Y,Vj since the CDH problem is hard. Therefore, the adversary cannot generate previous session keys even if he knows both private keys of the user and server.Two-factor security with PUF: Assume that an adversary steals the mobile device and extracts the data ni,Pi,τi,σi by a side channel attack. He can guess the password PWi, however, he cannot verify the correctness of the password without knowing the identity IDUi. He cannot get the response output of PUF without Ci. Moreover, the adversary cannot be authenticated in his mobile device because of the uncloneability of PUF even if he knows the password. Thus, our proposed scheme can satisfy the two-factor security.Access control for data privacy: The proposed scheme provides access control in the authentication process. The common solution M can be used to determine the access permission NumRi. The server can determine the access permission of the user efficiently without any other access control list to make data disclosure minimum. Besides, the common solution is associated with the RC’s private key s, which means no adversary can forge the access permission message.Resistance of various attacks: To resist known attacks existing in the service system, the proposed scheme should resist known attacks.(i)
Insider attack: An insider in the system only knows user identity IDi but cannot verify the password or private key without ni,Pi. Thus, the proposed scheme can resist an insider attack.(ii)
Stolen card attack: An adversary gets the user’s smart card and extracts the data ni,Pi,τi,σi. However, he cannot verify the password without the user’s identity. Therefore, the proposed scheme can withstand the stolen card attack.(iii)
Offline password guessing attack: An adversary gets the user’s smart card and extracts the data ni,Pi,τi,σi. However, he cannot verify the password without the user’s identity. Therefore, the proposed scheme can resist the offline password guessing attack.(iv)
Replay attack: According to the description of the proposed scheme, we use the timestamp to check the freshness. Besides, the user and the server will generate new random numbers x,y∈Zq∗ in each session. Both of them can find the replay of a message by the validity of the received message.(v)
User impersonation attack: Based on the proof of Lemma 1, we show that no adversary can forge a legal login message without the user’s private key. The server can check the validity of the login message.(vi)
Server impersonation attack: Based on the proof of Lemma 2, we show that no adversary can forge a legal response message without server’s private key. The user can check the validity of the response message Vj since the server will extract X′,X using its private key.(vii)
Man-in-the-middle attack: According to Theorem 1, we conclude that our proposed scheme provides mutual authentication, which means no adversary can forge a legal message without knowing the private keys.(viii)
Physical attack: No adversary can recreate the same PUF to authenticate the device since PUFs are almost impossible to clone. Besides, the response R and helper data hd are kept a secret, and only Ci,gκ is stored in the blockchain, which can resist the modeling attack.


### 6.4. Security Comparisons

We now compare our proposed scheme with other prior related schemes, namely those of Xiong et al. [34], Jia et al. [21], and Son et al. [6]. As shown in Table 4, [6, 21, 34] cannot provide two-factor security, in which PUF serves as one of the authentication factors. [21] cannot support access control in the authentication process. All of them cannot resist physical attacks and others. Therefore, our scheme can satisfy all the listed security requirements and have better security.Table 4
Security comparison.
Security requirements[34][21][6]OursSingle registration✓✓✓✓No online registration center✓✓✓✓Mutual authentication✓✓✓✓User anonymity✓✓✓✓Untraceability✓✓✓✓Session key agreement✓✓✓✓Perfect forward secrecy✓✓✓✓Two-factor security with PUF×××✓Access control✓×✓✓Resistance of known attacks×××✓


## 6.1. Security Model

We define the formal security model for the proposed scheme through a game played between an adversaryA and a challenger C. Let ΠPi denote the ith instance of the participant P, where P∈Ui,Sj denotes two participants: the mobile user and the server who are involved in the execution of the proposed scheme. In the game, A can initiate a series of queries to C, which can answer them as follows:(i)
him: when A sends a message m, C first checks whether m is in the hash-list Lhi. If so, return the value. Otherwise, C generates a random number ri∈Zq∗ and stores mi,ri in the hash-list Lhi. After that, return ri to A.(ii)
ExtractUserID (IDUi): when A sends a query with the user’s Ui identity IDUi, C generates a private key and stores IDUi,di in the user-list LUi.(iii)
ExtractServerID (IDSj): when A sends a query with the server’s Sj identity IDSj, C generates a private key and stores IDSj,dj in the server-list LSj.(iv)
Send (ΠPi,mi): when A sends a query with a message mi, C responds with the result by executing the proposed scheme. A can start the proposed scheme by sending ΠPi,START.(v)
Reveal (ΠPi): when A sends this query, C returns the session key of the ith instance.(vi)
Corrupt (ΠP): when A sends this query with the participant P∈Ui,Sj identity, C returns the corresponding private key.(vii)
Test (ΠPi): A can send this query only once. Upon receiving the query, C flips a coin c∈0,1. If c=1, C returns the session key of ith instance. Otherwise, C selects a random number and returns it.After executing the aforementioned queries,A output the guess c′ in the test query phase. If c′=c, we say A breaks the semantic security of the proposed scheme. The advantage that A violates the authenticated key agreement (AKA) of this scheme Γ is denoted by AdvΓAKA=2Prc′=c−1.Definition 1.
(AKA-security): we say an authentication schemeΓ is AKA-security if AdvΓAKA=2Prc′=c−1 is negligible for any polynomial adversary A.
LetEU−S and ES−U denote the events A that can violate U−to−S authentication by forging a login message and S−to−U authentication by forging a response message, respectively. The advantage that A violates the mutual authentication of this scheme Γ is denoted by AdvΓMA=PrEU−S+PrES−U.Definition 2.
(MA-security): we say an authentication schemeΓ is MA-security if AdvΓMA=PrEU−S+PrES−U is negligible for any polynomial adversary A.


## 6.2. Provable Security

We will prove that our proposed scheme is MA-security and AKA-security in the security model above.Lemma 1.
No polynomial adversary can forge a legal login message if the DL problem is difficult.Proof.
suppose the adversaryA can output a legal login message with non-negligible probability ε, then the challenger C can solve the DL problem with non-negligible advantage.
Given a DL instanceP,θ=τP, the task of C is to compute τ, where τ∈Zq∗ is unknown to C. C generates a random number τ^∈Zq∗, sets Ppub←θ,P^pub=τ^P, and sends the system parameters params=G1,G2,P,e,q,Ppub,P^pub,h0,h1,h1′,h2,h3,h4,h5,h6 to A. C will maintain seven hash-lists Lhi (i = 0, 1, 2, 3, 4, 5, 6), a mobile user list LUi, and a server list LSj. C randomly chooses a user’s identity IDUi∗ as the challenge identity and answers A’s queries as follows:(i)
him: C maintains the lists Lhi, which are initially empty. C, firstly, checks whether mi,ri exists in Lhi. If it does, C returns ri to A. Otherwise, C generates a random number ri, stores mi,ri in Lhi, and returns ri to A.(ii)
ExtractUserID (IDUi): C maintains the mobile user list LUi, which is initially empty. C, firstly, checks whether IDUi,Ri,di,κi exists in LUi. If it does, C returns IDUi to A. Otherwise, C executes the following steps:(a)
IfIDUi≠IDUi∗, C randomly selects rUi,h1Ui∈Zq∗, and a random number κi as the output of fuzzy extractor. C computes RUi=rUiP−hUiPpub. Otherwise, C sets di←rUi and stores IDUi,Ri,di,κi and IDUi,RUi,h1Ui in LUi and Lh1, respectively, and returns IDUi to A.(b)
IfIDUi=IDUi∗, C generates two random numbers rUi∗,h1Ui∗∈Zq∗, computes RUi∗=rUi∗P, sets dUi∗←⊥, selects a random number κ∗ as the output of fuzzy extractor, stores IDUi∗,RUi∗,⊥,κ∗ and IDUi∗,RUi∗,h1Ui∗ in LUi and Lh1, respectively, and returns IDUi∗ to A.(iii)
ExtractServerID (IDSj): C maintains the server list LSj, which is initially empty. C, firstly, checks whether IDSj,dj is in LSj. If it does, C returns IDSj to A. Otherwise, C selects ej∈Zq∗, computes dj=1/τ^+ejP, stores IDSj,dj and IDSj,ej in LSj and Lh1, respectively, and then returns IDSj to A.(iv)
Send (ΠPi,mi): A can send the following queries:(a)
SendUit,START: when A sends this query, C, firstly, checks if IDUi=IDUi∗ holds. If it does, C aborts the game. Otherwise, C checks whether IDUi exists in LUi. If not, C executes the ExtractUserID IDUi query. After that, with the private key di, C generates a random number x∈Zq∗ and calculates X′=gx,X=xP,U1,U2,N,ω as described. C stores IDUi,IDSj,t,x,X,M,RUiSj in LUiSj and returns U1,U2,N,ω to A.(b)
SendSjl,N,U1,U2,ω,Tus: when A sends this query, C checks whether IDSj exists in LSj. If not, C executes the ExtractServerID IDSj. After that, with the private key dj, C computes X′=eU1,dj and extracts IDUi‖M‖hi‖X=N⊕h3X′. C obtains hi,κi from LUi, verifies if U2P=Ri+hiPpub+ωX+κiP holds. If not, C rejects the message. Otherwise, C generates a random number y∈Zq∗, computes Y,Vj,Tsu as described, and returns it to A. If IDUi=IDUi∗, then A successfully forges a legal login message.(c)
SendUit,Y,Vj,Tsu: upon receiving this message, C checks if Vj′=Vj holds with IDUi,IDSj,t,x,X,M,RUiSj in LUiSj. If not, C rejects the message. Otherwise, C authenticates A.(v)
Reveal (ΠPi): upon receiving this message, C returns the session key SK if SK is accepted. Otherwise, C returns ‘⊥’ to A.(vi)
Corrupt (ΠP): upon receiving the identity IDUi (or IDSj), C looks up LUi (or LSj) and returns di (or dj) to A.(vii)
Test (ΠPi): C generates a random number with the same length of session key and returns it to A.
SupposeA forges a legal login message with IDUi=IDUi∗. By applying forking lemma, A can generate another legal login message U2 with the same input of the simulation and different hash oracle queries. Then, we can get the following equations:(6)U2P=Ri∗+hi∗Ppub+ωX+κi∗P,(7)U2′P=Ri∗+hi∗Ppub+ωX+κi∗P.
Based on equations (7) and (8), we have the following:(8)U2−U2′P=Ri∗+hi∗Ppub+ωX+κi∗P−Ri∗+hi∗Ppub+ωX+κi∗P=hi∗−hi∗Ppub=hi∗−hi∗τP.
By equations (8), U2−U2′hi∗−hi∗−1modq is the answer of DL problem. The advantage that C solves the DL problem is given below. Firstly, some events are defined as follows:(i)
E1: the simulation does not abort in any Send query.(ii)
E2: A successfully forges a legal message.(iii)
E3: IDUi=IDUi∗.
Letqh1 and qs denote the number of h1 queries and Send queries. Then, we have the following equations:(9)PrE1=1−1qs+1qsPrE2|E1⩾εPrE3|E2∧E1⩾1qh1.
By equation (9), the advantage that C solves the DL problem is as follows:(10)ϵ=PrE3∧E2∧E1=PrE3|E2∧E1⋅PrE2||E1⋅PrE1⩾1−1qs+1qs1qh1⋅ε.
Thus,C can solve the DL problem with non-negligible probability ϵ by playing the game with A. It contradicts with the difficulty of DL problem. We conclude that no polynomial adversary can forge a legal login message with non-negligible probability.Lemma 2.
No polynomial adversary can forge a legal response message if thek-mBIDH Problem is difficult.Proof.
suppose the adversaryA can forge a legal response message with non-negligible probability ε, then the challenger C can solve the k-mBIDH problem with non-negligible advantage. Given a k-mBIDH instance, P,Ppub=sP,ιP,e1,e2,…,ek∈Zq∗,1/s+e1P,1/s+e2P,…,1/s+ekP∈G1, the task of C is to compute eP,Pι/s+e∗, where s,ι are unknown to C and e∗∉e1,e2,…,ek. C sends the system parameters params=G1,G2,q,e,g,P,Ppub,h0,h1,h1′,h2,h3,h4,h5,h6 to A. C will maintain seven hash-lists Lhi (i = 0, 1, 2, 3, 4, 5, 6), a mobile user list LUi, and a server list LSj. C chooses a random identity IDSj∗ as the challenge identity.
hi (i = 0, 1, 2, 3, 4, 6), Reveal, Corrupt, and Test query are the same as those in the simulation of Lemma 1. h5, Extract, and Send query are executed as follows:(i)
ExtractServerID (IDSj): C maintains the server list LSj, which is initially empty. C, firstly, checks whether IDSj,ej is in LSj. If it is, C returns IDSj to A. Otherwise, C executes the following steps:(a)
IfIDSj≠IDSj∗, C selects ej∈e1,e2,…,ek and dj=1/s+ejP. C stores IDSj,dj and IDSj,ej in LSj and Lh1′, respectively, and returns IDSj to A.(b)
IfIDSj=IDSj∗, C sets h1′IDSj=e∗, stores IDSj,⊥ and IDSj,e∗ in LSj and Lh1′, respectively, and returns IDSj to A.(ii)
ExtractUserID (IDUi): C maintains the mobile user list LUi, which is initially empty. C, firstly, checks whether IDUi,RUi,di,κi exists in LUi. If it does, C returns IDUi to A. Otherwise, C randomly selects rUi,h1Ui∈Zq∗ and computes RUi=rUiP−h1UiPpub. C sets di←rUi and generates a random number κi as the output of fuzzy extractor. C stores IDUi,RUi,di,κi and IDUi,RUi,h1Ui in LUi and Lh1, respectively, and returns IDUi to A.(iii)
Send (ΠPi,mi): A can send the following queries:(a)
SendUit,START: If Ui’s partner is Sj∗, C sets U1=ιP and calculates U2,N,ω as described. Otherwise, C looks up IDUi,RUi,h1Ui from Lh1 and generates a legal login message as described.(b)
SendSjl,N,U1,U2,ω,Tus: When A sends this query, C checks whether IDSj=IDSj∗ holds. If it does, C aborts the game. Otherwise, C behaves the operations as described.(c)
SendUit,Y,Vj,Tsu: Upon receiving this message, C checks if V′=Vj holds.
If not,C rejects the message. Otherwise, C authenticates A. If IDSj=IDSj∗, it means that A successfully forges a legal response message.
SupposeA forges a legal response message with IDSj=IDSj∗. In the game, A must send Vj=h5IDi,IDSj,M,RUiSj,X,Y,K,Tsu query after recovering IDUi‖M‖h1Ui‖X=N⊕h3X′. Thus, A must have executed the h3 query with the message X′. We have the following:(11)X′=eU1,dj∗=eιP,1s+e∗P=eP,Pι/s+e∗
The advantage thatC solves the k-mBIDH Problem is given below. Some events are defined as follows:(i)
E1: the simulation does not abort.(ii)
E2: A successfully forges a legal response message.(iii)
E3: IDSj=IDSj∗.(iv)
E4: C selects a correct tuple from Lh3.
Letqh1, qh3, and qs denote the number of h1,h3 query and Send query. Then, we have the following equations:(12)PrE1=1−1qs+1qsPrE2|E1⩾εPrE3|E2∧E1⩾1qh1PrE4|E3∧E2∧E1⩾1qh3.
By equation (12), the advantage that C solves the k-mBIDH Problem is as follows:(13)ϵ=PrE4∧E3∧E2∧E1=PrE4|E3∧E2∧E1⋅PrE3|E2∧E1⋅PrE2|E1⋅PrE1⩾1−1qs+1qs1qh11qh3⋅ε.
Thus,C can solve the k-mBIDH problem with non-negligible probability ϵ by playing the game with A. It contradicts with the hardness of k-mBIDH problem. We conclude that no polynomial adversary can forge a legal response message with non-negligible probability.Theorem 1.
The proposed scheme is MA-security if the DL problem andk-mBIDH problem are hard.Proof.
Lemma1 and 2 demonstrate that no polynomial adversary can forge a legal login message or response message if the DL problem and k-mBIDH problem are hard. In other words, the mobile user Ui and the server Sj can authenticate each other. Therefore, the proposed scheme is MA-security.Theorem 2.
The proposed scheme is AKA-security if CDH problem is hard.Proof.
supposeA can guess b correctly with non-negligible probability ε in the Test query, then C can solve the CDH problem with non-negligible probability. Some events are defined as follows:(i)
Eb: A guesses the value of b correctly.(ii)
ETU: A makes the Test query to the user.(iii)
ETS: A makes the Test query to the server.(iv)
EUS: A forges a legal login message between the user and server.
Since the probability thatA can guess the value of b correctly is at least 1/2, then we have PrEb⩾ε/2. We can get the equations as follows:(14)ε2⩽PrEb=PrEb∧ETU+PrEb∧ETS∧EUS+PrEb∧ETS∧¬EUS⩽PrEb∧ETU+PrEUS+PrEb∧ETS∧¬EUS.
Then,(15)PrEb∧ETU+PrEb∧ETS∧¬EUS⩾ε2−PrEUS.
The eventETS∧¬EUS and ETU are equal. We can get the following:(16)2PrEb∧ETU⩾ε2−PrEUS.
Then, the advantage thatC solves the CDH problem is as follows:(17)ϵ=PrEb∧ETU⩾ε4−PrEUS2.
The eventEb∧ETU means that A impersonates the user and has K=xY, which is the solution of CDH problem. According to Lemma 1, PrEUS is negligible. Then, we can get PrEb∧ETU, which is non-negligible because ε is non-negligible. It means that C can solve the CDH problem with non-negligible probability ϵ by playing the game with A. It contradicts the difficulty of CDH problem. We conclude that no polynomial adversary can guess b correctly, and the proposed scheme is AKA-security.


## 6.3. Security Requirement Analysis

We also show that the proposed scheme satisfies the security requirements described in Section4.3.Single registration: According to the description of the proposed scheme, the trusted RC generates the registration information for users. Then, users can be authenticated by other healthcare service providers.No online registration center: According to the specification of the proposed scheme, RC is not involved in the mutual authentication.Mutual authentication: According to the proof of Lemma 1 and Lemma 2, we know that no polynomial adversary can forge a legal login message and response message. Thus, the user Ui and the server Sj can authenticate each other by the received message.User anonymity: Based on the description of the proposed scheme, the user identity IDUi is hidden in the login message N,U1,U2,ω,Tus, where N=h3X′⊕IDUi‖M‖hi‖X. An adversary can extract IDUi only if he/she can get X′=eU1,DSj after solving the k-mBIDH problem. Besides, the registration recorded in the blockchain is hidden by the hash function hi=h1IDi‖M‖Ri.Untraceability: In the proposed scheme, random x is generated in each new session to compute a new login message N,U1,U2,ω,Tus, where X′=gx,X=xP,U1=xPK+h1IDSjP,N=h3X′⊕IDUi‖M‖hi‖X,ω=h4N,U1,κi,Tus,U2=DUi+xw+κi. Because of the randomness of x, the adversary cannot find any relation among these login messages of different sessions and thus cannot trace the users’ behavior.Session key agreement: Based on the description of the proposed scheme, the user and the server will generate a session key SK=h6X′‖X‖Y‖Kij‖IDi‖IDSj for future secure communications. We know that no adversary can compute xyP from xP and yP since the CDH problem is hard.Perfect forward secrecy: Assume that there is an adversary who gets the long-term private key of the user and the server and intercepts the exchange message of previous sessions. Then, the adversary cannot compute Kij=xyP in SK=h6X′‖X‖Y‖Kij‖IDi‖IDSj even if he gets X and Y from U1,N,Y,Vj since the CDH problem is hard. Therefore, the adversary cannot generate previous session keys even if he knows both private keys of the user and server.Two-factor security with PUF: Assume that an adversary steals the mobile device and extracts the data ni,Pi,τi,σi by a side channel attack. He can guess the password PWi, however, he cannot verify the correctness of the password without knowing the identity IDUi. He cannot get the response output of PUF without Ci. Moreover, the adversary cannot be authenticated in his mobile device because of the uncloneability of PUF even if he knows the password. Thus, our proposed scheme can satisfy the two-factor security.Access control for data privacy: The proposed scheme provides access control in the authentication process. The common solution M can be used to determine the access permission NumRi. The server can determine the access permission of the user efficiently without any other access control list to make data disclosure minimum. Besides, the common solution is associated with the RC’s private key s, which means no adversary can forge the access permission message.Resistance of various attacks: To resist known attacks existing in the service system, the proposed scheme should resist known attacks.(i)
Insider attack: An insider in the system only knows user identity IDi but cannot verify the password or private key without ni,Pi. Thus, the proposed scheme can resist an insider attack.(ii)
Stolen card attack: An adversary gets the user’s smart card and extracts the data ni,Pi,τi,σi. However, he cannot verify the password without the user’s identity. Therefore, the proposed scheme can withstand the stolen card attack.(iii)
Offline password guessing attack: An adversary gets the user’s smart card and extracts the data ni,Pi,τi,σi. However, he cannot verify the password without the user’s identity. Therefore, the proposed scheme can resist the offline password guessing attack.(iv)
Replay attack: According to the description of the proposed scheme, we use the timestamp to check the freshness. Besides, the user and the server will generate new random numbers x,y∈Zq∗ in each session. Both of them can find the replay of a message by the validity of the received message.(v)
User impersonation attack: Based on the proof of Lemma 1, we show that no adversary can forge a legal login message without the user’s private key. The server can check the validity of the login message.(vi)
Server impersonation attack: Based on the proof of Lemma 2, we show that no adversary can forge a legal response message without server’s private key. The user can check the validity of the response message Vj since the server will extract X′,X using its private key.(vii)
Man-in-the-middle attack: According to Theorem 1, we conclude that our proposed scheme provides mutual authentication, which means no adversary can forge a legal message without knowing the private keys.(viii)
Physical attack: No adversary can recreate the same PUF to authenticate the device since PUFs are almost impossible to clone. Besides, the response R and helper data hd are kept a secret, and only Ci,gκ is stored in the blockchain, which can resist the modeling attack.


## 6.4. Security Comparisons

We now compare our proposed scheme with other prior related schemes, namely those of Xiong et al. [34], Jia et al. [21], and Son et al. [6]. As shown in Table 4, [6, 21, 34] cannot provide two-factor security, in which PUF serves as one of the authentication factors. [21] cannot support access control in the authentication process. All of them cannot resist physical attacks and others. Therefore, our scheme can satisfy all the listed security requirements and have better security.Table 4
Security comparison.
Security requirements[34][21][6]OursSingle registration✓✓✓✓No online registration center✓✓✓✓Mutual authentication✓✓✓✓User anonymity✓✓✓✓Untraceability✓✓✓✓Session key agreement✓✓✓✓Perfect forward secrecy✓✓✓✓Two-factor security with PUF×××✓Access control✓×✓✓Resistance of known attacks×××✓


## 7. Performance Analysis

In this section, we discuss the computational and communication costs of the proposed scheme and other related schemes [6, 21, 34, 37].We will directly use the parameters of Jia et al. [21] scheme for the comparison in Table 5. We do not consider the execution time of registration phases, since they are executed only once. We also focus on the communication costs in the registration phase. The size of the element in G1, G2, and Zq is 1024, 1024, and 160 bits, respectively, denoted by G1,G2,Zq. Suppose the output length of the hash function H and user’s identity ID is 256 bits. The length of the timestamp T and common solution is 32 bits.Table 5
Running time of basic operation.
DescriptionAlibaba cloudGoogle nexusTGbBilinear pairing5.27548.66TGmScalar multiplication1.9719.919TaPoint multiplication0.0120.118ThHash function0.0090.089TeModular exponentiation0.3393.328The summary of computation and communication costs is shown in Tables6, 7 and Figures 6, 7. The proposed scheme has a lower computation cost compared to that in the scheme [6, 34] on the mobile users’ side and [6, 21] on the server side. Besides, the proposed protocol has lower communication costs compared to those in [21]. Though the scheme [6, 34] has lower communication costs than ours, our scheme can be more efficient and meet more desirable security requirements.Table 6
Computation costs comparison (ms).
SchemeComputation costs(User)Computation costs(Server)[34]2TGm + TGa + Te + TGb +8 TGh≈ 92.6562TGm + TGa + TGb +5 Th≈ 9.272[21]4TGm + Te +5 Th≈ 83.449Tb +5 TGm +3 TGa +5 Th≈ 15.206[6]5TGm +8 Th≈ 100.3072TGb +5 TGm +5 Th≈ 20.445Ours4TGm + Te +7 Th + Ta≈ 83.745TGb +4 TGm +3 Th +3 Ta≈ 13.218Table 7
Communication costs comparison.
SchemeCommunication costsLength/bits[34]2G +3 H2816[21]4G +2 Zq +2 H + ID4736[6]3G +2 H +2 T3648Ours3G + Zq +3 H + ID +2 T4320Figure 6
Computation costs comparison.Figure 7
Communication costs comparison.We implement a software prototype based on Hyperledger Fabric 2.0 on a single machine running an Intel(R) Core(TM) i7-8700 CPU @ 3.20 GHz, 8 GB RAM, and Ubuntu 18.04 for 64 bits operations system. We deploy a test network that consists of three peer organizations and a single orderer organization with three ordering nodes in a single channel to simulate the healthcare provider servicers in certain areas. The block size is 100 transactions in a batch and the block timeout is 2s to wait before creating a batch. The raft consensus algorithm is used for agreement on the consistence of transactions across the network. The smart contracts written in Go are deployed over the network, which is shown in Algorithm 1 and 2. All transactions of uploading, query, and update are driven via Hyperledger Fabric gateway to evaluate the throughput (TPS) and latency as shown in Figures8 and 9. The performance demonstrates that the maximum throughput is 310 TPS for uploading the transactions and 600 TPS for query and update. The average latency for all transactions increases as increased in the total transactions. There are lots of factors that will affect the performance of the framework, such as the choices of ledger database, endorsement policy, network configuration parameters, and so on.Figure 8
Transactions per second in the blockchain.Figure 9
Latency for all transactions in the blockchain.


## 8. Conclusion

In this paper, we proposed a user authentication scheme with access control based on CRT for multiserver architectures, which not only secures sensitive health data transmission but enhances data privacy. The highlight of our protocol is that the decent integration of blockchain and PUF can achieve secure data sharing across medical institutions and identify each device for further security in the telehealth environment. Security analysis shows that our proposed scheme meets all of the desirable requirements above. Moreover, the performance analysis demonstrated that this protocol has lower communication and computation costs.Future research will focus on more flexible access control updates and the improvement of computational and communication efficiency for resource-limited devices. We will also explore a privacy-preserving data sharing mechanism based on the blockchain and the improvement of blockchain performance. In addition, there is no doubt that a centralized registration center is convenient and available but our protocol is susceptible to some common security flaws, such as single point of failure, distributed denial of service (DDoS) attacks, and register center compromised attacks. Decentralized blockchain technology to mitigate central registration center problems is also a significant direction.



---

*Source: 6735003-2022-03-30.xml*