# A Chaotic-Map-Based Password-Authenticated Key Exchange Protocol for Telecare Medicine Information Systems

Authors: Yanrong Lu; Dawei Zhao
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Telecare medicine information systems (TMISs) provide e-health services such that patients can access medical resources conveniently and doctors can prescribe treatments rapidly. Authentication is an essential security requirement in TMISs. In particular, the growth of password-based remote patient authenticated key exchange combining extended chaotic maps has enhanced the level of secure communications for TMISs. Recently, Lee suggested an improved random-number-based password-authenticated key exchange (PAKE) using extended chaotic maps and synchronized-clock-based PAKE using extended chaotic maps on Guo and Zhang and Xiao et al.’s PAKE. Unfortunately, we found that the nonce-based scheme of Lee is insecure against known session-specific temporary information and server spoofing attacks. To cope with the aforementioned defects, this study aims to provide a new secure PAKE based on extended chaotic maps with more security functionalities for TMISs. Additionally, we show that the proposed scheme for TMISs provides high security along with low communication cost, computational cost, and a variety of security features.


---

## Body

## 1. Introduction

At present, the researches on the cloud assisted e-health are more and more in-depth. It facilitates health condition monitoring and improves efficiency for medical resources [1]. As one of the most popular applications of e-health care service, telecare medical information systems (TMISs) provide the medical or healthcare for those patients who are disabled or cannot attend hospital normally [2, 3]. With the openness of wireless environment, the security of TMISs is highlighted. How to authenticate the communication entities and thus securely transmit sensitive medical data related with patients is an urgent problem that needs to be researched and solved.Key exchange schemes aim at establishing a shared session key between two or more communicating entities. The shared session key is used in securing subsequent communication over an insecure channel. Therefore, the key challenge of designing such a scheme is how to securely and efficiently derive a session key that is only known to the communicated entities. Hitherto, a large number of related authenticated key agreement schemes have been presented with different structures such as pure password schemes, password schemes with smart cards, dynamic schemes, and dynamic schemes with smart cards.With the extremely studied and widely applied Chebyshev polynomials by the cryptographic research community, various password authenticated key exchange (PAKE) based on chaotic maps and related approaches have been developed recently [4–10]. Kocarev-Tasev [11] presented the first chaotic maps-based public key encryption scheme. Unfortunately, according to the periodicity of cosine function, the scheme of Kocarev-Tasev was demonstrated to be insecure by Bergamo et al. [12]. After that, Xiao et al. [13] suggested an authenticated key agreement scheme using chaotic map. Nevertheless, Alvarez [14] pointed out that the scheme of Xiao et al. could not withstand man-in-the-middle attack. Shortly after, Xiao et al. [15] introduced an enhanced PAKE to prevent the security threats. Guo-Chang [16] raised a smart card based PAKE using chaotic maps. Later, Lin [17] claimed that the Guo-Chang’s scheme might easily leak the identity of communicating user by intercepting the transmitted messages. In addition, Lin [17] also pointed that the session key could be derived by an adversary during the communication in the Guo-Chang’s scheme [16]. In order to negate these risks, Lin also developed an improved variant without sacrificing the efficiency.Recently, Guo and Zhang [18] identified that the drawbacks of Xiao et al.’s scheme [13] and found that Xiao et al.’s scheme failed to satisfy the requirements with the contributory nature of key agreement. Subsequently, Guo and Zhang developed their own improved version of the remote user PAKE. Recently, Lee [19] observed that both Xiao et al. [13] and Guo and Zhangs’ schemes [18] were unable to free from offline password guessing attack and achieve the session key security. As a counter measure to these sufferings, Lee developed two PAKE; that is, one uses random numbers, while the other uses timestamp. However, this study shows that Lee (the nonce based) fails to resist known session-specific temporary information and server spoofing attacks.The merits of this paper are as follows.(i)
Our proposed scheme demonstrates that Lee’s scheme has several drawbacks once the private information is leaked.(ii)
Our proposed scheme for TMISs withstands an unauthorized patient to deceive the service provided by the telecare medical server.(iii)
Our proposed scheme for TMISs satisfies high security along with a variety of attributes compared with Xiao et al. [13], Guo and Zhang [18], and Lee schemes. Extensive comparisons are conducted with related schemes to verify the performance of our schemes in terms of security and efficiency.The remainder of this paper is organized as follows. Section2 introduces preliminary knowledge of some Chebyshev chaotic maps that we use in our system. We describe Lee’s scheme in Section 3. In Section 4, we show that Lee’s scheme [19] is vulnerable to various attacks. The proposed scheme for TMISs is presented in detail in Section 5, followed by the security analysis in Section 6. In Section 7, we compare the performance and security of our scheme for TMISs with related schemes. Finally, Section 8 concludes the paper.


## 2. Preliminaries

This section lists the used definitions and defines Chebyshev chaotic maps and corresponding chaotic properties that are used in this paper [11, 12, 20–22].The Chebyshev polynomialTsx:−1,1⟶−1,1 is defined as follows:(1)Tsx=2xTs−1x−Ts−2x,where s be an integer with s≥2, x∈−1,1, T0x=1,T1x=x.The Chebyshev polynomial satisfies the semigroup property:(2)Tstx=TsTtx=TtTsx.Chaotic property:Whena>1, Chebyshev polynomial map Ts:−1,1⟶−1,1 of degree s is a chaotic map with invariant density f∗x=1/π21−x2 for Lyapunov exponent λ=lns>0.Quadratic residue assumption:Ify=x2modn has a solution, that is, ∃ a square root for y, then y is named as a quadratic residue modulo n. It is computationally unfeasible to derive x such that y=x2modn under the condition of not knowing the parameters p and q because of the factoring problem n=pq is NP-hard problem.


## 3. Review of Lee’s PAKE

Lee [19] presented two authentication schemes, which are based on nonce and timestamp, respectively. Without loss of generality, we briefly review the nonce based PAKE of Lee, which includes system initialization, authentication and key agreement phases.


### 3.1. System Initialization

Step 1: ServerB chooses two large primes p and q as its private keys.Step 2:B calculates n=pq.Step 3:B publishes h1:0,1∗⟶−∞,+∞, h2:0,1∗⟶0,1τ and n, where τ is the fixed size.


### 3.2. Authentication and Key Agreement

Step 1: UserA computes x=h1y,X1=y,pw2modn,TIDA=IDA⊕h2y,pw, and X2=h2TIDA,y,pw,Trx, where r and y are the random numbers. A then sends the message M1=TIDA,X1,X2,Trx to B.Step 2: Once receivingM1, B retrieves the four solutions yi,pwi0≤i≤3 from X1 by using the Chinese remainder theorem (CRT) and checks whether h2TIDA,yi,pwi,Trx=?X2. If successful, it means B has gotten the correct y′ and pw′. After that, B checks if pw′=?pw. If the equation is true, B derives IDA by computing TIDA⊕h2y′,pw′ and computes x=h1y′,sk=h2Trx,Tsx,TsTrx and AuthB=h2sk,pw,IDB,IDA. Next, B sends back M2=IDB,Tsx,AuthB to A.Step 3: When receivingM2, A computes sk=h2Trx,Tsx,TrTsx and AuthB′=h2sk,pw,IDB,IDA. Next, A checks whether AuthB′=?AuthB. If it holds, A computes AuthA=h2sk,IDA,IDB and sends M3=AuthA to B.Step 4: After receivingM3, B verifies whether h2sk,IDA,IDB is equal to the received AuthA. If it does not hold, B terminates the session; otherwise, A and B have a common session key sk=h2Trx,Tsx,Trsx.


## 3.1. System Initialization

Step 1: ServerB chooses two large primes p and q as its private keys.Step 2:B calculates n=pq.Step 3:B publishes h1:0,1∗⟶−∞,+∞, h2:0,1∗⟶0,1τ and n, where τ is the fixed size.


## 3.2. Authentication and Key Agreement

Step 1: UserA computes x=h1y,X1=y,pw2modn,TIDA=IDA⊕h2y,pw, and X2=h2TIDA,y,pw,Trx, where r and y are the random numbers. A then sends the message M1=TIDA,X1,X2,Trx to B.Step 2: Once receivingM1, B retrieves the four solutions yi,pwi0≤i≤3 from X1 by using the Chinese remainder theorem (CRT) and checks whether h2TIDA,yi,pwi,Trx=?X2. If successful, it means B has gotten the correct y′ and pw′. After that, B checks if pw′=?pw. If the equation is true, B derives IDA by computing TIDA⊕h2y′,pw′ and computes x=h1y′,sk=h2Trx,Tsx,TsTrx and AuthB=h2sk,pw,IDB,IDA. Next, B sends back M2=IDB,Tsx,AuthB to A.Step 3: When receivingM2, A computes sk=h2Trx,Tsx,TrTsx and AuthB′=h2sk,pw,IDB,IDA. Next, A checks whether AuthB′=?AuthB. If it holds, A computes AuthA=h2sk,IDA,IDB and sends M3=AuthA to B.Step 4: After receivingM3, B verifies whether h2sk,IDA,IDB is equal to the received AuthA. If it does not hold, B terminates the session; otherwise, A and B have a common session key sk=h2Trx,Tsx,Trsx.


## 4. Security Analysis on Lee’s Scheme

Lee [19] found some severe security pitfalls in Xiao et al. [13] and Guo and Zhang’s schemes [18, 21] and proposed new chaotic-based authenticated key schemes. It is claimed that their new scheme achieves many security attributes while being secure against general threats. In this part, however, we will demonstrate that Lee’s nonce based scheme [19] is actually vulnerable to known session-specific temporary information attack [23], which is one of the most important security properties that most of schemes shall attain. In addition, as the result of overlooking the server is a semitrusted party, this scheme is subject to server spoofing attack.


### 4.1. Known Session-Specific Temporary Information Attack

Assume the user’s session random numbery is corrupted by an adversary U. The scheme will suffer the following attack.Step 1:U guesses a candidate password pw∗ and checks whether h2TIDA,y,pw∗,Trx=?X2, where TIDA and Trx are intercepted information through the public channel by U. If the result is true, the correct password has been gotten. Otherwise, U continues to execute the aforementioned procedure until he succeeds.Step 2: OnceU successfully owns the user A’s password pw. There can be no real defense against attacks from U. First, U derives IDA by computing TIDA⊕y,pw and computes X1=y,pw2modn. Next, U sends the counterfeited message M1=TIDA,X1,X2,Tr∗h1y to the server B, where r∗ is the random number chosen by U.Step 3: When the serverB receives M1, it performs the scheme without any detection since all the verification information derived from the user “A.” Finally, the server B sends back the message M2=IDB,Tsh1y,AuthB to U who masquerades as a legal user A, where AuthB=h2IDB,IDA,pw,sk and sk=h2Tr∗h1y,Tsh1y,TsTr∗h1y.Step 4: After receiving the messageM2, U computes sk=h2Tr∗h1y,Tsh1y,Tr∗Tsh1y and verifies whether the equation hIDB,IDA,pw,sk is equal to the received AuthB. If the result is correct, U computes AuthA=h2IDB,IDA,sk and returns M3=AuthA to the server B.Step 5: Once receiving the messageM3, server B validates the correctness of the value AuthA. Then, server B accepts the communication request from user “A” and agrees on the session key sk as a “confidential” session key for concealing the following messages. In this way, the subsequent communication messages seem like plain text such that U could do whatever he wants. This shows that, in Lee’s scheme, U can use the unexpectedly disclosed session random number to successfully complete mutual authentication. This concludes that their scheme lacks strongly the SK-security, which is very essential in the security critical applications.


### 4.2. Server  Spoofing Attack

In Lee’s scheme, serverB masters the sensitive information pw of user A, which leads to a malicious spoofing attack because the legal but malicious server B could monitor the authentication process of user A and gather information related to user A and thus become an adversary. The malicious server B can forge the valid request message by performing the following procedures.Step 1: The malicious serverB can eavesdrop the message M1=TIDA,X1,X2,Tr∗h1y during authentication and key agreement phase corresponding to the legitimate user A. Then, B generates two random numbers r∗, y∗ and calculates x=h1y∗,Tr∗x,z=y∗,pw,X1=z2modn,TIDA=IDA∗⊕h2z and X2=h2TIDA,z,Tr∗x. Next, B sends an imitative message M1=TIDA,X1,X2,Tr∗x to server B.Step 2: When receivingM1, server B derives y′,pw′ from X1 by using the Chinese remainder theorem (CRT) and examines whether h2TIDA,y′,pw′,Tr∗x. Because the computed result equals the received X2, B will accept B’s request. Next, B derives IDA∗ by computing TIDA⊕h2y′,pw′ and checks whether pw′=?pw. If it holds, server B computes x=h1y′,Tsx,sk=h2Tr∗x,Tsx,TsTr∗x and AuthB=hsk,pw,IDB,IDA∗. At last, B sends the message M2=IDB,Tsx,AuthB to B who is masquerading as user A.Step 3: Once receivingM2, B computes h2sk,pw,IDB,IDA∗ and checks it with AuthB, where sk=h2Tr∗x,Tsx,TsTr∗x. If they are equivalent, B computes AuthA=h2sk,IDA∗,IDB and sends back M3=AuthA to server B.Step 4: When receivingM3, server B computes h2sk,IDA∗,IDB and compares it with M3. If they are equal, B authenticates B. In this regard, B and B share a common session key sk=h2Tr∗x,Tsx,TsTr∗x for securing communication. Therefore, a legal but malicious server can masquerade as a legal user to log into a remote server.The same flaw can be applied to the timestamp based scheme of Lee. Since they work on the same principle, only nonce-based scheme is analyzed above.


## 4.1. Known Session-Specific Temporary Information Attack

Assume the user’s session random numbery is corrupted by an adversary U. The scheme will suffer the following attack.Step 1:U guesses a candidate password pw∗ and checks whether h2TIDA,y,pw∗,Trx=?X2, where TIDA and Trx are intercepted information through the public channel by U. If the result is true, the correct password has been gotten. Otherwise, U continues to execute the aforementioned procedure until he succeeds.Step 2: OnceU successfully owns the user A’s password pw. There can be no real defense against attacks from U. First, U derives IDA by computing TIDA⊕y,pw and computes X1=y,pw2modn. Next, U sends the counterfeited message M1=TIDA,X1,X2,Tr∗h1y to the server B, where r∗ is the random number chosen by U.Step 3: When the serverB receives M1, it performs the scheme without any detection since all the verification information derived from the user “A.” Finally, the server B sends back the message M2=IDB,Tsh1y,AuthB to U who masquerades as a legal user A, where AuthB=h2IDB,IDA,pw,sk and sk=h2Tr∗h1y,Tsh1y,TsTr∗h1y.Step 4: After receiving the messageM2, U computes sk=h2Tr∗h1y,Tsh1y,Tr∗Tsh1y and verifies whether the equation hIDB,IDA,pw,sk is equal to the received AuthB. If the result is correct, U computes AuthA=h2IDB,IDA,sk and returns M3=AuthA to the server B.Step 5: Once receiving the messageM3, server B validates the correctness of the value AuthA. Then, server B accepts the communication request from user “A” and agrees on the session key sk as a “confidential” session key for concealing the following messages. In this way, the subsequent communication messages seem like plain text such that U could do whatever he wants. This shows that, in Lee’s scheme, U can use the unexpectedly disclosed session random number to successfully complete mutual authentication. This concludes that their scheme lacks strongly the SK-security, which is very essential in the security critical applications.


## 4.2. Server  Spoofing Attack

In Lee’s scheme, serverB masters the sensitive information pw of user A, which leads to a malicious spoofing attack because the legal but malicious server B could monitor the authentication process of user A and gather information related to user A and thus become an adversary. The malicious server B can forge the valid request message by performing the following procedures.Step 1: The malicious serverB can eavesdrop the message M1=TIDA,X1,X2,Tr∗h1y during authentication and key agreement phase corresponding to the legitimate user A. Then, B generates two random numbers r∗, y∗ and calculates x=h1y∗,Tr∗x,z=y∗,pw,X1=z2modn,TIDA=IDA∗⊕h2z and X2=h2TIDA,z,Tr∗x. Next, B sends an imitative message M1=TIDA,X1,X2,Tr∗x to server B.Step 2: When receivingM1, server B derives y′,pw′ from X1 by using the Chinese remainder theorem (CRT) and examines whether h2TIDA,y′,pw′,Tr∗x. Because the computed result equals the received X2, B will accept B’s request. Next, B derives IDA∗ by computing TIDA⊕h2y′,pw′ and checks whether pw′=?pw. If it holds, server B computes x=h1y′,Tsx,sk=h2Tr∗x,Tsx,TsTr∗x and AuthB=hsk,pw,IDB,IDA∗. At last, B sends the message M2=IDB,Tsx,AuthB to B who is masquerading as user A.Step 3: Once receivingM2, B computes h2sk,pw,IDB,IDA∗ and checks it with AuthB, where sk=h2Tr∗x,Tsx,TsTr∗x. If they are equivalent, B computes AuthA=h2sk,IDA∗,IDB and sends back M3=AuthA to server B.Step 4: When receivingM3, server B computes h2sk,IDA∗,IDB and compares it with M3. If they are equal, B authenticates B. In this regard, B and B share a common session key sk=h2Tr∗x,Tsx,TsTr∗x for securing communication. Therefore, a legal but malicious server can masquerade as a legal user to log into a remote server.The same flaw can be applied to the timestamp based scheme of Lee. Since they work on the same principle, only nonce-based scheme is analyzed above.


## 5. The Proposed PAKE Scheme for TMISs

To overcome the security pitfalls found in Lee’s scheme, we present efficient and secure PAKE using chaotic maps for TMISs. To achieve the patient anonymity and reduce the computation overhead at the patient’s side who may take mobile device, the proposed scheme leverages the encryption function to find a trade-off between the security and the cost. The proposed scheme has the following phases: system initialization phase, patient registration phase (Algorithm1), and authentication and key agreement phase (Algorithm 2).


### 5.1. System Initialization

Step 1: The telecare medical serverB chooses two large primes p and q as its private keys.Step 2:B calculates n=pq.Step 3:B publishes h:0,1∗⟶0,1τ and n, where τ is the fixed size.


### 5.2. Patient Registration

Step 1: PatientA computes hpw,ra and sends IDA,hpw,ra to the telecare medical server B over a private channel, where ra is a random nonce and pw is A’s password.Step 2: WhenB receives the message, B computes Apw=EKBhIDA,hpw,ra and stores Apw in its database, where KB is the secret key of B.Algorithm 1: Patient registration.
Input:pw,h,p,q,nOutput: StoreApw.(1)
Selectra,(2)
Computehpw,ra,(3)
Apw=EKBhIDA,hpw,ra.


### 5.3. Authentication and Key Agreement

Step 1:A computes x=hIDA,hpw,ra,z=IDA,r2modn,X1=hIDA,x,r and X2=ExTrx,z,X1, where r is a random nonce. Next, A transmits the messages M1=X2 to B.Step 2: Upon receiving the message,B first derives x=hIDA,hpw,ra by decrypting Apw and then retrieves Trx,z,X1 by decrypting X2. Subsequently, B solves z by CRT and verifies whether hIDA′,r′,x=?X1. If true, B computes X3=ETrxTsx,SIDB,hIDA′,r′ and sends M2=X3 to A.Step 3: On receiving the message,A retrieves Tsx,SIDB,hIDA′,r′ by decrypting X3, computes hIDA,r, and checks whether hIDA′,r′=?hIDA,r. If successful, A computes sk=hTux,Tsx,Tusx, X4=ETrxTux, and AuthA=hsk,Tux,Tsx. Next, A sends back M3=AuthA,X4 to B.Step 4: When receiving the message,B retrieves Tux by decrypting X4 with computed Trx. After that, B computes sk=hTsx,Tux,TsTux and checks whether hTsx,Tux,TsTux=?AuthA. If correct, B computes AuthB=hsk,Tsx,Tux,00 and sends M4=AuthB to A.Step 5:A verifies the correctness of the value AuthB. If not, A aborts the session. Otherwise, A and B share a common session key sk=hTsx,Tux,Tsux with each other.Algorithm 2: Authentication and Key agreement.
Input:IDA, pw, raOutput: true: success; false: failure1:  Generater,2:  Computex=hIDA,hpw.ra,y=IDA,r3:Z=y2modn, X1=hx,IDA,r,X2=EXTrx,z,X1.4:  TransmitM1=X2 to B.5:  DecryptApw⟶x=hIDA,hpw,ra,X2⟶Trx,z,X1.6:  Solvez by CRT, determinate IDA′,r′7:   ifhx,IDA′,r′=?X1 then8:  Generates,X3=ETrxTsx,SIDB,hIDA,r9:  TransmitX3 to Patient A.10:   DecryptX3⟶Tsx,SIDB,hIDA,r11:    ifhIDA,r=?hIDA′,r′ then12:    Generateu, sk=hTux,Tsx,Tusx13:X4=ETrxTux,IDA, AuthA=hsk,Tux,Tsx.14:    TransmitAuthA and X4 to B.15:    DecryptX4⟶Tux,IDA.16:sk=hTsx,Tux,TsTux.17:    ifhsk,Tsx,Tux=?AuthA then18:AuthB=hsk,Tsx,Tux,0019:  TransmitAuthB to M4=AuthB.20:     ifAuthB=?hsk,Tsx,Tux,00then21:     return true22:    else23:   return false24:  else25:  return false26:   else27:  return false28:  else29:  return false30: end if


## 5.1. System Initialization

Step 1: The telecare medical serverB chooses two large primes p and q as its private keys.Step 2:B calculates n=pq.Step 3:B publishes h:0,1∗⟶0,1τ and n, where τ is the fixed size.


## 5.2. Patient Registration

Step 1: PatientA computes hpw,ra and sends IDA,hpw,ra to the telecare medical server B over a private channel, where ra is a random nonce and pw is A’s password.Step 2: WhenB receives the message, B computes Apw=EKBhIDA,hpw,ra and stores Apw in its database, where KB is the secret key of B.Algorithm 1: Patient registration.
Input:pw,h,p,q,nOutput: StoreApw.(1)
Selectra,(2)
Computehpw,ra,(3)
Apw=EKBhIDA,hpw,ra.


## 5.3. Authentication and Key Agreement

Step 1:A computes x=hIDA,hpw,ra,z=IDA,r2modn,X1=hIDA,x,r and X2=ExTrx,z,X1, where r is a random nonce. Next, A transmits the messages M1=X2 to B.Step 2: Upon receiving the message,B first derives x=hIDA,hpw,ra by decrypting Apw and then retrieves Trx,z,X1 by decrypting X2. Subsequently, B solves z by CRT and verifies whether hIDA′,r′,x=?X1. If true, B computes X3=ETrxTsx,SIDB,hIDA′,r′ and sends M2=X3 to A.Step 3: On receiving the message,A retrieves Tsx,SIDB,hIDA′,r′ by decrypting X3, computes hIDA,r, and checks whether hIDA′,r′=?hIDA,r. If successful, A computes sk=hTux,Tsx,Tusx, X4=ETrxTux, and AuthA=hsk,Tux,Tsx. Next, A sends back M3=AuthA,X4 to B.Step 4: When receiving the message,B retrieves Tux by decrypting X4 with computed Trx. After that, B computes sk=hTsx,Tux,TsTux and checks whether hTsx,Tux,TsTux=?AuthA. If correct, B computes AuthB=hsk,Tsx,Tux,00 and sends M4=AuthB to A.Step 5:A verifies the correctness of the value AuthB. If not, A aborts the session. Otherwise, A and B share a common session key sk=hTsx,Tux,Tsux with each other.Algorithm 2: Authentication and Key agreement.
Input:IDA, pw, raOutput: true: success; false: failure1:  Generater,2:  Computex=hIDA,hpw.ra,y=IDA,r3:Z=y2modn, X1=hx,IDA,r,X2=EXTrx,z,X1.4:  TransmitM1=X2 to B.5:  DecryptApw⟶x=hIDA,hpw,ra,X2⟶Trx,z,X1.6:  Solvez by CRT, determinate IDA′,r′7:   ifhx,IDA′,r′=?X1 then8:  Generates,X3=ETrxTsx,SIDB,hIDA,r9:  TransmitX3 to Patient A.10:   DecryptX3⟶Tsx,SIDB,hIDA,r11:    ifhIDA,r=?hIDA′,r′ then12:    Generateu, sk=hTux,Tsx,Tusx13:X4=ETrxTux,IDA, AuthA=hsk,Tux,Tsx.14:    TransmitAuthA and X4 to B.15:    DecryptX4⟶Tux,IDA.16:sk=hTsx,Tux,TsTux.17:    ifhsk,Tsx,Tux=?AuthA then18:AuthB=hsk,Tsx,Tux,0019:  TransmitAuthB to M4=AuthB.20:     ifAuthB=?hsk,Tsx,Tux,00then21:     return true22:    else23:   return false24:  else25:  return false26:   else27:  return false28:  else29:  return false30: end if


## 6. Cryptanalysis of Our Enhancement

In this section, we provide an in-depth analysis on the security features of our enhanced remote user PAKE scheme for TMISs. We will show that the proposed scheme not only provides anonymity and mutual authentication and but could also withstand the aforementioned attacks.


### 6.1. Full Protection for Patient’s Identity

Obviously, the proposed scheme for TMISs provides patient anonymity because patientA’s identity IDA is not transmitted in plain-text via any messages traveling over insecure network. For one thing, IDA is protected by hash function as a symmetric key only known by the patient A and the corresponding telecare medical server B. The telecare medical server could not know the real identity even if it intends to decrypt the stored value or the legal telecare medical server’s private key is embezzled by an illegitimate patient or an illegitimate server to derive the hash value. The real identity IDA is concealed by the quadratic residue assumption. As we know, the assumption is secure for chosen-plaintext attack and the identity is always a short string which could not be known by the unauthorized third-party unless it is completely learnt. Besides, the random number r is not an uncertain number which is not easily guessed. All in all, the proposed scheme for TMISs can be categorized as one preserving the patient privacy.


### 6.2. Mutual Authentication Thwarting Man-in-the-Middle Attack

The mutual authentication between correspondents is a basic security features for a remote PAKE. Only on the basis of the trust, two unfamiliar participates, that is, the patient and the server, are able to establish the session key for securing the following communication messages. In the proposed scheme for TMISs, patientA is authenticated by the telecare medical server by verifying the validity of X1. This verification needs two indispensable conditions. One is the private key of the telecare medical server B to derive the hashed value including the identity IDA, the password pw, and the random number ra. Another are the two private values p and q, which are used to retrieve the plain-text identity IDA and the random number r. The telecare medical server is not able to examine the received message M1=X2 without the knowledge of the two secrets. In other words, not anyone could generate the valid message X2 unless they know all the private information, such as the identity IDA, the password pw, and even the random number ra of the registered patient, only known by the patient itself. Additionally, the message M3=AuthA,X4 further consolidates the authenticity of patient A since only the real patient knows the value Trx, which is employed to compute the authenticated messages. On the other side, following the previously mentioned discussion, only the legitimate telecare medical server retrieves the plain-text identity IDA, the random number r, and the value Trx, which are used for checking by patient A. Similarly, message M4=AuthB is utilized to further confirm the legitimacy of the telecare medical server. According to the previously mentioned analysis, the man-in-the-middle attack is not launched due to lack of personal information. Any forged messages could be detected by the receivers since they have the symmetric key which is unknown by any third party. This confirms that our PAKE scheme for TMISs achieves the property of mutual authentication and thus resists man-in-the middle attack.


### 6.3. Resistance to Known Session-Specific Temporary Information Attack

From Algorithm2, patient A and telecare medical server B use Trx to encrypt the session key SK=hTux,Tsx,Tusx, where x=hIDA,hpw,ra. Clearly, even if an adversary gets the temporary information r and ra, it is incapable of computing Tux without having the knowledge of either IDA or pw [19]. In this way, the proposed scheme for TMISs overcomes the drawbacks found in Lee’s scheme. Moreover, without revealing the identity pw of A to B, B authenticates A through decrypting A’s registered message Apw=EKBhIDA,hpw,ra. Thus, the proposed PAKE scheme for TMISs can withstand this type of attack.


### 6.4. Perfect Forward Session Key Secrecy

Even if the passwordpw of the patient A is lost, the session key is still secure since the password is not related with the computed session key. Actually, if the important values Tux and Tsx are compromised, an adversary could derive the correct u and s using the approach [12]. However, the adversary has no opportunity to get the two values unless they know user A’s private information, such as the identity IDA, password pw, and the random number ra or the private keys of the telecare medical server B, such as KB and two large primes p, q. Unfortunately, the patient anonymity has guaranteed that it is impossible for the adversary to obtain the patient’s personal information. As we know, the telecare medical server’s private keys are not easily exposed. These features along with the patient anonymity confirm forward secrecy and known-key secrecy capability of our PAKE scheme.


### 6.5. Resistance to Patient Impersonation Attack

Evidently, the most essential goal of a secure PAKE scheme is to withstand impersonation attack, which means an interception of the transmitted messages from both sides will not lead to the serious threats on the system. In the proposed PAKE scheme for TMISs, no adversaries are able to impersonate patientA by eavesdropping the communication messages, since the secret parameters including A’s identity IDA, password pw, and random number ra are unknown to the adversary. Additionally, it is computationally infeasible to find IDA and r from z=IDA,r2modn without the knowledge of p and q, where n=p∗q. Therefore, the proposed PAKE scheme for TMISs provides the resilience against patient impersonation attack.


### 6.6. Resistance to Telecare Medical Server Spoofing Attack

Suppose an adversary plans to impersonate the telecare medical serverB by eavesdropping the communication message: M1=X2=ExTrx,z,X1, where x=hIDA,hpw,ra,z=r,IDA2modn and X1=hx,IDA,r. They could not pass the authentication by patient A without knowing the telecare medical server B’s secret key KB. How easy will it be to get hold of patient A’s identity IDA and r without the help of the correct value x? Hence, the proposed PAKE scheme for TMISs can withstand telecare medical server spoofing attack.


### 6.7. Resistance to  Bergamo et al.’s Attack

The implementation of the Bergamo et al.’s attack [12] is based on the following facts: (i) Chebyshev polynomials can be alternatively defined as the cosine function, which leads to the same value due to the periodicity of the cosine function; (ii) Tux,Tsx, and x as the public keys are transmitted in an open channel, which can be intercepted by an adversary. However, in the proposed scheme for TMISs, patient A and the telecare medical server B transmitted the encrypted messages AuthA and AuthB over a public channel, where AuthA=hsk,Tux,Tsx,AuthA=hsk,Tsx,00,Tux, respectively. Without knowing Trx, no adversaries can decrypt the message X4 and thus they cannot recover Tux. Additionally, the value x=hIDA,hpw,ra is related with the patient A’s sensitive information, and adversaries are incapable of getting such sensitive information. Therefore, the proposed PAKE scheme for TMISs is free from Bergamo et al.’s attack [12].


### 6.8. Resistance to Replay Attack

With the purposing of free from replay attack, we use a random numberr which is only recovered by the telecare medical server S. If an adversary attempts to masquerade A by immediately replaying the previous authentication messages M1=X2 after eavesdropping, the telecare medical server S would obviously refuse the request because the invalid random number r will be detected by checking hx,IDA,r=?X1. Moreover, the patient also checks the random number which is sent from the telecare medical server to prevent the replay attack.


## 6.1. Full Protection for Patient’s Identity

Obviously, the proposed scheme for TMISs provides patient anonymity because patientA’s identity IDA is not transmitted in plain-text via any messages traveling over insecure network. For one thing, IDA is protected by hash function as a symmetric key only known by the patient A and the corresponding telecare medical server B. The telecare medical server could not know the real identity even if it intends to decrypt the stored value or the legal telecare medical server’s private key is embezzled by an illegitimate patient or an illegitimate server to derive the hash value. The real identity IDA is concealed by the quadratic residue assumption. As we know, the assumption is secure for chosen-plaintext attack and the identity is always a short string which could not be known by the unauthorized third-party unless it is completely learnt. Besides, the random number r is not an uncertain number which is not easily guessed. All in all, the proposed scheme for TMISs can be categorized as one preserving the patient privacy.


## 6.2. Mutual Authentication Thwarting Man-in-the-Middle Attack

The mutual authentication between correspondents is a basic security features for a remote PAKE. Only on the basis of the trust, two unfamiliar participates, that is, the patient and the server, are able to establish the session key for securing the following communication messages. In the proposed scheme for TMISs, patientA is authenticated by the telecare medical server by verifying the validity of X1. This verification needs two indispensable conditions. One is the private key of the telecare medical server B to derive the hashed value including the identity IDA, the password pw, and the random number ra. Another are the two private values p and q, which are used to retrieve the plain-text identity IDA and the random number r. The telecare medical server is not able to examine the received message M1=X2 without the knowledge of the two secrets. In other words, not anyone could generate the valid message X2 unless they know all the private information, such as the identity IDA, the password pw, and even the random number ra of the registered patient, only known by the patient itself. Additionally, the message M3=AuthA,X4 further consolidates the authenticity of patient A since only the real patient knows the value Trx, which is employed to compute the authenticated messages. On the other side, following the previously mentioned discussion, only the legitimate telecare medical server retrieves the plain-text identity IDA, the random number r, and the value Trx, which are used for checking by patient A. Similarly, message M4=AuthB is utilized to further confirm the legitimacy of the telecare medical server. According to the previously mentioned analysis, the man-in-the-middle attack is not launched due to lack of personal information. Any forged messages could be detected by the receivers since they have the symmetric key which is unknown by any third party. This confirms that our PAKE scheme for TMISs achieves the property of mutual authentication and thus resists man-in-the middle attack.


## 6.3. Resistance to Known Session-Specific Temporary Information Attack

From Algorithm2, patient A and telecare medical server B use Trx to encrypt the session key SK=hTux,Tsx,Tusx, where x=hIDA,hpw,ra. Clearly, even if an adversary gets the temporary information r and ra, it is incapable of computing Tux without having the knowledge of either IDA or pw [19]. In this way, the proposed scheme for TMISs overcomes the drawbacks found in Lee’s scheme. Moreover, without revealing the identity pw of A to B, B authenticates A through decrypting A’s registered message Apw=EKBhIDA,hpw,ra. Thus, the proposed PAKE scheme for TMISs can withstand this type of attack.


## 6.4. Perfect Forward Session Key Secrecy

Even if the passwordpw of the patient A is lost, the session key is still secure since the password is not related with the computed session key. Actually, if the important values Tux and Tsx are compromised, an adversary could derive the correct u and s using the approach [12]. However, the adversary has no opportunity to get the two values unless they know user A’s private information, such as the identity IDA, password pw, and the random number ra or the private keys of the telecare medical server B, such as KB and two large primes p, q. Unfortunately, the patient anonymity has guaranteed that it is impossible for the adversary to obtain the patient’s personal information. As we know, the telecare medical server’s private keys are not easily exposed. These features along with the patient anonymity confirm forward secrecy and known-key secrecy capability of our PAKE scheme.


## 6.5. Resistance to Patient Impersonation Attack

Evidently, the most essential goal of a secure PAKE scheme is to withstand impersonation attack, which means an interception of the transmitted messages from both sides will not lead to the serious threats on the system. In the proposed PAKE scheme for TMISs, no adversaries are able to impersonate patientA by eavesdropping the communication messages, since the secret parameters including A’s identity IDA, password pw, and random number ra are unknown to the adversary. Additionally, it is computationally infeasible to find IDA and r from z=IDA,r2modn without the knowledge of p and q, where n=p∗q. Therefore, the proposed PAKE scheme for TMISs provides the resilience against patient impersonation attack.


## 6.6. Resistance to Telecare Medical Server Spoofing Attack

Suppose an adversary plans to impersonate the telecare medical serverB by eavesdropping the communication message: M1=X2=ExTrx,z,X1, where x=hIDA,hpw,ra,z=r,IDA2modn and X1=hx,IDA,r. They could not pass the authentication by patient A without knowing the telecare medical server B’s secret key KB. How easy will it be to get hold of patient A’s identity IDA and r without the help of the correct value x? Hence, the proposed PAKE scheme for TMISs can withstand telecare medical server spoofing attack.


## 6.7. Resistance to  Bergamo et al.’s Attack

The implementation of the Bergamo et al.’s attack [12] is based on the following facts: (i) Chebyshev polynomials can be alternatively defined as the cosine function, which leads to the same value due to the periodicity of the cosine function; (ii) Tux,Tsx, and x as the public keys are transmitted in an open channel, which can be intercepted by an adversary. However, in the proposed scheme for TMISs, patient A and the telecare medical server B transmitted the encrypted messages AuthA and AuthB over a public channel, where AuthA=hsk,Tux,Tsx,AuthA=hsk,Tsx,00,Tux, respectively. Without knowing Trx, no adversaries can decrypt the message X4 and thus they cannot recover Tux. Additionally, the value x=hIDA,hpw,ra is related with the patient A’s sensitive information, and adversaries are incapable of getting such sensitive information. Therefore, the proposed PAKE scheme for TMISs is free from Bergamo et al.’s attack [12].


## 6.8. Resistance to Replay Attack

With the purposing of free from replay attack, we use a random numberr which is only recovered by the telecare medical server S. If an adversary attempts to masquerade A by immediately replaying the previous authentication messages M1=X2 after eavesdropping, the telecare medical server S would obviously refuse the request because the invalid random number r will be detected by checking hx,IDA,r=?X1. Moreover, the patient also checks the random number which is sent from the telecare medical server to prevent the replay attack.


## 7. Security Attributes and Performance Comparison

In the following section, we analyze the security attributes and the computational efficiency of the proposed PAKE scheme for TMISs and compare to Xiao et al. [15], Guo and Zhang [18], and Lee [19] since they are all based on chaotic-maps PAKE schemes. Table 1 shows the security attributes comparison among our presented scheme and other schemes [15, 18, 19]. Compared with other schemes, both Guo and Zhang and Xiao et al.’s schemes cannot achieve user anonymity and perfect forward session key secrecy. Furthermore, both of their schemes cannot withstand patient impersonation attack. In addition, Lee’s scheme fails to prevent known session-specific temporary information and server spoofing attacks.Table 1
Comparison of security attributes.
OursLee [19]Guo and Zhang [18]Xiao et al. [15]Provide anonymityYesYesNoNoProvide perfect forward session key secrecyYesYesNoNoProvide mutual authenticationYesYesYesYesResist man-in-the-middle attackYesYesYesYesResist replay attackYesYesYesYesResist known session-specific temporary information attackYesNo——Resist Bergamo et al.’s attackYesYesNoYesResist patient impersonation attackYesYesNoNoResist server spoofing attackYesNoYesNoTable2 lists the computational complexity comparison of our proposed PAKE scheme with other schemes, where Tc denotes the time of executing a Chebyshev polynomial computing; Th denotes the time of executing a hash operation; Ts denotes the time of executing a symmetric key encryption/decryption; Tsq denotes the time of executing a squaring; Tsr denotes the time of executing a squaring root solving. According to [15], the execution time for Ts is about 70 times than Tc, and Ts is almost equal to Th in software. Therefore, our proposed PAKE scheme consumes a slightly higher computation cost than others. We think it is worth slightly sacrificing the efficiency in the hope of guaranteeing a high level security for TMISs.Table 2
Comparison of computational cost.
OursLee [19]Guo and Zhang [18]Xiao et al. [15]User3Tc+7Th+3Ts+1Tsq2Tc+6Th+1Tsq2Tc+8Th2Tc+2ThServer2Tc+8Th+4Ts+1Tsr2Tc+9Th+1Tsr2Tc+10Th2Tc+2ThNo. of message communications4365


## 8. Conclusion

In this paper, we first reviewed Lee’s scheme and then demonstrated that Lee’s scheme is vulnerable to the known session-specific temporary information and server spoofing attacks. With the purpose of remedy of these security loopholes, we presented an improved PAKE scheme using extended chaotic maps for TMISs. We showed that our design is secure and provides more functionalities compared with the related schemes. Performance analysis showed the proposed PAKE scheme for TMISs is secure and efficient. In the future, we will further optimize the proposed scheme regarding security and performance using encryption and machine learning in order to apply to network structure to improve its availability.



---

*Source: 7568538-2021-11-30.xml*