# An Anonymous Authentication Protocol Based on Cloud for Telemedical Systems

Authors: Wenmin Li; Shuo Zhang; Qi Su; Qiaoyan Wen; Yang Chen
Journal: Wireless Communications and Mobile Computing
 (2018)

---

## Abstract

Telecare medical information systems (TMIS) enable patients to access healthcare delivery services conveniently. With the explosive development occurring in cloud computing and services, storage of personal medical and health information outsourcing to cloud infrastructure has been a potential alternative. However, this has entailed many considerable security and privacy issues. In order to address the security loopholes, we propose a promising solution satisfying the requirements of cloud computing scenarios for telemedical systems. The proposed scheme could provide both data confidentiality and message authenticity while preserving anonymity. Furthermore, the formal security proof demonstrates that the proposed scheme is resistant to various attacks. The performance comparisons show the proposal’s workability and it is well suited to adoption in telemedical services.


---

## Body

## 1. Introduction

With the explosion of cloud computing and services, there has been a growing trend to use the cloud for large-scale data storage and management. It is a new style of computing that offers dynamically scalable network services to external customers delivered over the Internet. Cloud computing provides a powerful underlying architecture for telemedicine, which is an emerging treatment mode for delivering appropriate healthcare services remotely. It facilitates medical practitioners and patients to establish communication over public networks and patients can acquire the medical services via electronic networks conveniently. This will significantly lower the social and economic expenses, while enhancing the medical quality and efficiency.Cloud computing introduces a new way for medical systems to store and manage medical data, which is complex task. As wearable devices are becoming more and more powerful, patients can obtain their health information timely. They also could upload and access their medical records to the cloud through mobile devices. This can help medical institutions to quickly obtain patients’ physical condition in urgent cases for proper medical diagnosis and treatment process. Any delay in the access to medical record at the time of emergency would cause severe errors, which profoundly affects patient’s therapeutic process. In the cloud based telecare medical information systems, the cloud database is responsible for storing patients’ critical medical data and updates it as the medical treatment availed by the patient. However, the storage of patients’ electronic medical records such as personal information, medical records, and physiological parameters in the medical server may result in the exposure of patients’ privacy. Cloud computing offers expansively developing prospects of new and better models of healthcare; it also raises some security issues due to new potential ways for data theft. And hence, safeguarding security and patients’ privacy in cloud based telecare medical information systems are very significant. Authentication mechanism is a prerequisite to verify the legality of all participants and tackle the illegal access in distributed systems, such as wireless interface systems [1, 2], multiple server architecture based systems [3], smart card based system [4], and mobile radio systems [5, 6]. Furthermore, the anonymous authentication could protect users anonymity and prevent the disclosure of private information [7, 8]. Therefore, a secure authentication protocol is a proper solution to provide security and privacy for TMIS [9–11]. Hitherto, authentication protocol for integration telemedical systems in cloud computing environment recently has drawn significant attention from academia [12–20].In 2012, Padhy et al. [12] introduced a cloud based model for rural healthcare systems. In 2013, Banerjee et al. [13] presented a new architecture for cloud based healthcare application to serve patients in emergency. Nevertheless, their scheme is unable to offer confidentiality of transmitted data. One year later, Chen et al. [14] proposed a medical data exchange protocol in cloud computing environment. In their scheme, patients and doctors could be convenient to access medical resources outsourced in the cloud. Unfortunately, their scheme could not resist impersonation attacks or provide patient anonymity. To fix the defects, a modification was developed in the same year [15]. In 2016, Chiou et al. [16] showed that their scheme still lacks privacy protection and message authentication. Then, the authors proposed a new privacy authentication scheme based on cloud for TMIS which provided a “real” and complete telemedicine system. However, in 2007, Mohit et al. [17], Cheng et al. [20], and Li et al. [18] identified Chiou et al.’s protocol that failed to preserve patients’ privacy and forward security and suffers from mobile device stolen attack, respectively. Meanwhile, Mohit et al. [17] and Cheng et al. [20] both presented an improved mechanism for cloud-assisted medical care systems. Recently, Li et al. [19] pointed out that Mohit et al.’s proposal also was susceptible to health report revelation and inspection report forgery attacks. In Cheng et al.’s scheme [20], the inputs of bilinear maps are generators in the corresponding cyclic groups, rather than random numbers of integer field Zq. This will bring about errors in the authentication process.In this paper, we design a telemedical information model based on cloud authentication which allows patients to remotely access medical services with privacy. Further, we discuss its security and prove that it can withstand various attacks. Compared with the state of the art, our scheme provides formal security proofs and achieves better efficiency in terms of computation cost. Performance and functionality analysis shows that it is more secure and practical for cloud based telemedicine system.The remaining of this paper is organized as follows. Section2 describes our robust cloud based authentication scheme for TMIS, together with formally proving its security in Section 3. Subsequently, we compare the performance with the previous schemes in Section 4. Finally, we draw the conclusions in Section 5.


## 2. The Proposed Scheme

In this section, we present an anonymous authentication scheme on the basis of cloud for medical environment. There are five participants in our scheme: including patientsP, healthcare center H, doctors D, cloud C, and sensors S. Healthcare center is trusted medical center. The cloud servers possess the jurisdiction to store patients’ medical data which can be accessed by patients and doctors remotely. Sensors can collect and measure the patient’s health information timely. In Figure 1, we depict the structure of the cloud based authentication system for TMIS simply.Figure 1
Structure of cloud based TMIS.Our scheme consists of four phases which are described as follows. In order to initialize this protocol, the key generation center (KGC) chooses a multiplication cyclic group G and a generator g∈G with order p, where p is a large prime number. Then KGC selects random numbers kx∈Zp (x={H,P,D,C}) and computes PKx=gkxmod⁡p. Finally, KGC issues the public key and secret key pairs (PKx,kx) to the participants.We list the used notations of the proposal as follows.(i)
IDx: the identity of x(ii)
mx: the health report of x(iii)
Datax: the health data of x(iv)
skxy: the session key shared between x and y(v)
PKx: the public key of x(vi)
kx: the secret key of x(vii)
Sigx: signature signed by x(viii)
Txi: the ith timestamp generated by x(ix)
G: a multiplicative cyclic group of prime order q(x)
g: the generator of G(xi)
h(·): a one-way hash function(xii)
⊕: exclusive-OR operation(xiii)
∥: string concatenation operation(xiv)
Ekey(M): encrypting M using symmetric encryption with key(xv)
Dkey(C): decrypting the ciphertext C with key(xvi)
Skey(M): signing M with secret key key(xvii)
Vkey(Sigx): verifying the signature Sigx


### 2.1. Healthcare Center Uploading Phase

As shown in steps 1.1 and 1.2 in Figure1, patient P makes a health inspection in the healthcare center H and H uploads the generated inspection record to the cloud server C. In Figure 2, we will further describe the authentication process of the phase.Figure 2
Healthcare center uploading phase.Step 1.
After generating the inspection report,H selects a random number tH and computes K1=gtH,  s1=PKCtH=gtHkC,  s2=h(PKCkH∥TH1)=h(gkCkH∥TH1),  C1=Es1(s2), where TH1 is the current timestamp. After that, it sends {IDH,C1,TH1,K1} to the cloud C.Step 2.
On receiving{IDH,C1,TH1,K1} from H, C checks the validity of TH1. If it is invalid, C aborts the received messages; otherwise, it computes s1′=K1kC=gtHkC and decrypts C1 to recover the values s2. Subsequently, C calculates s2′=h(PKHkC∥TH1) and compares it with the decrypted s2. If the equivalence holds, the legitimacy of H is assured. Then C generates a random number tC and acquires the timestamp TC1 to compute K2=gtC,  skHC=K1tC=gtCtH, and s3=h(PKHkC∥skHC∥TC1)=h(gkHkC∥skHC∥TC1). Finally, C transmits the authentication message {K2,s3,TC1} to H.Step 3.
Upon receiving the reply message,H checks the validity of TC1. If TH2-TC1≥△T, H terminates this phase; otherwise, it computes skHC=K2tH=gtCtH, s3′=h(PKCkH∥skHC∥TC1)=h(gkHkC∥skHC∥TC1) and compares s3′ with the received s3. If they are not equal, the uploading phase is given up by H; else, H signs P’s medical report mH=(IDP,DataH,TH) with its secret key: SigH=SkH(mH). Note that TH is the current timestamp when P makes health inspection. After that, H calculates C2=EPKPkH(mH,SigH)=EgkHkP(mH,SigH),  s4=EskHC(IDP,C2,s3) and uploads s4 to the cloud.Step 4.
On receivings4, C decrypts it with skHC to recover IDP,C2,s3′ and verifies whether s3′ is equal to s3 or not. If it is true, the healthcare center is authentic. After that, it verifies whether P is a new user or not. If P is a new user, C stores (IDP,C2) in a new storage space; else, it stores C2 in P’s database.


### 2.2. Patient Uploading Phase

As shown in steps 2.1 and 2.2 in Figure1, patient P collects health information mS measured by body sensors S and he could upload the health data to the cloud. In Figure 3, we will depict the detailed process.Figure 3
Patient uploading phase.Step 1.
WhenP’s mobile phone collects the measured information, then it generates the timestamp TP1 and a random number aP to compute K3=gaP,  s5=PKCaP=gaPkC,  s6=h(PKCkP∥TP1)=h(gkCkP∥TP1),  C3=Es5(IDP,s6). Subsequently, P transmits {C3,TP1,K3} to C.Step 2.
After receiving the messages,C verifies the freshness of TP1 by checking whether TC2-TP1≤△T or not. If it is valid, C decrypts C3 to obtain the values IDP and s6 with the computed s5′=K3kC=gaPkC. After that, C calculates s6′=h(PKPkC∥TP1) and verifies whether the equation s6′=s6 holds. If it does, P is legitimate user. Then C selects random numbers aC and computes K4=gaC,  skPC=K3aC=gaCaP and s7=h(PKPkC∥skPC∥TC3)=h(gkPkC∥skPC∥TC3), where TC3 is the acquired timestamp. Finally, C transmits the {K4,s7,C2,TC3} to patient P.Step 3.
On receiving response,P checks the validity of TC3. If TC3 is invalid, P terminates the procedure. If TC3 is fresh, P computes skPC=K4aP=gaCaP,  s7′=h(PKCkP∥skPC∥TC3)=h(gkPkC∥skHC∥TC3) and verifies s7 is valid by checking whether s7′=s7 holds. If so, P decrypts C2 with the computed PKHkP to recover mH=(IDP,DataH,TH) and SigH. Subsequently, he/she verifies the validity of H’s signature SigH. If SigH is valid, P chooses a random number sn and computes C4=EPKDsnkP(mH,mS,SigH)=EgsnkDkP(mH,mS,SigH), where mS=(IDP,DataS,TS) is the collected measured data. Note that TS is the current timestamp when the body sensors S monitor P’s physical condition. Then P calculates s8=EskPC(IDP,C4,s7) and uploads s8 to the C.Step 4.
On receiving the reply message,C decrypts s8 with skPC and obtains IDP,C4,s7′. After that, the cloud server verifies P’s validity by checking whether s7′ equals to s7 or not. If so, C stores C4 in P’s storage space to replace C2; otherwise, it resumes the procedure.


### 2.3. Treatment Phase

As shown in steps 3.1 and 3.2 in Figure1, D is appointed by P and obtains P’s identity IDP and appointment sequence value sn. Subsequently, D can download P’s inspection report and measured health information from C, and he/she also can upload the diagnosing records with his/her signature to C. The details of the execution steps are further illustrated in Figure 4.Figure 4
Treatment phase.Step 1.
D selects a random number bD and computes K5=gbD,  s9=PKCbD=gbDkC,  s10=h(PKCkD∥TD1)=h(gkCkD∥TD1),  C5=Es9(s10), where TD1 is the acquired current timestamp. Then D transmits {IDD,C5,TD1,K5} to the cloud C.Step 2.
After receiving messages fromD, C checks TC4-TD1?≤△T. If it is invalid, C terminates the phase; otherwise, it computes s9′=K5kC=gbDkC and decrypts C5 to obtain the values s10. Later, C verifies s10′=h(PKDkC∥TD1) with the decrypted s10 to confirm the legitimation of D. If they are equal, C generates random numbers bC and the timestamp TC5 and computes K6=gbC,  skCD=K5bC=gbCbD,  s11=h(PKDkC∥skCD∥TC5)=h(gkCkD∥skCD∥TC5). Finally, C sends {K6,s11,C4,TC5} to D.Step 3.
On receiving{K6,s11,C4,TC5}, D checks the freshness of TC5. If so, D computes skCD=K6bD=gbCbD,  s11′=h(PKCkD∥skCD∥TC5)=h(gkCkD∥skCD∥TC5) and compares s11′ with the received s11 to assure C’s authenticity. If they are not equal, the phase is terminated by himself/herself; otherwise, D uses the appointment sequence number sn to compute PKPsnkD and decrypts C4 with it to recover mH,mS,SigH. Subsequently, D verifies whether the signature SigH is valid or not by checking mH?=VPKH(SigH). If it is valid, D diagnoses P’s symptom on the basis of (mH,mS) and generates the diagnostic records mD=(IDP,DataD,TD), where TD is the timestamp when the doctor generates mD. After that, D uses his/her private key kD to sign mD: SigD=SkD(mD). Then, D calculates C6=EPKPsnkD(mH,mS,mD,SigD),  s12=EskCD(IDP,C6,s11) and sends s12 to the cloud.Step 4.
Upon receivings12, C decrypts it with skCD and obtains IDP,C6,s11′. Later, it checks s11′?=s11. If the equation holds, the validity of D is confirmed; otherwise, this phase fails. After that, C replaces C4 with C6 and stores it in P’s storage space.


### 2.4. Checking Report Phase

As shown in step 4.1 in Figure1, patient P can access the cloud to obtain the medical record via the mobile phone. In Figure 5, we depict the detailed process of the phase.Figure 5
Checking report phase.Step 1.
P generates the timestamp TP2 and a random number vP to compute K7=gvP,  s13=PKCvP=gvPkC,  s14=h(PKCkP∥TP2)=h(gkCkP∥TP2),  C7=Es13(IDP,s14). Then, P transmits the request {C7,TP2,K7} to the cloud C.Step 2.
C verifies the freshness of TP2 after receiving the request from P. If so, C decrypts C7 with computed s13′=K7kC=gvPkC and obtains the IDP,s14′. Subsequently, C calculates s14′=h(PKPkC∥TP2) and verifies s14′?=s14. If they are equal, C computes K8=gvC,  skPC′=K7vC=gvCvP and s15=h(PKPkC∥skPC′∥TC6)=h(gkPkC∥skPC′∥TC6), where vC and TC6 are generated random value and the acquired timestamp, respectively. After that, C sends the {K8,s15,C6,TC6} to P.Step 3.
On receiving response{K8,s15,C6,TC6}, P checks the validity of TC6. If TP3-TC6≥△T,  P aborts the session; otherwise, he/she calculates skPC′=K8vP=gvCvP,  s15′=h(PKCkP∥skPC′∥TC6)=h(gkPkC∥skPC′∥TC6) and verifies whether s15′=s15 holds. If yes, P computes (mH,mS,mD,SigD)=DPKDsnkP(C6) and he/she verifies whether mD?=VPKD(SigD). If so, P takes the diagnosis report of doctor D for the health information mH and mS. Finally, P calculates C8=EPKPcn(mH,mS,mD) and s16=EskPC′(IDP,C8,s15) and uploads s16 to the C, where cn is a pre-generated key to encrypt (mH,mS,mD). Note that cn is the pre-generated key for all the medical staff. If the patient P has an accident, they can decrypt C8 to obtain the health information and make treatment decisions.Step 4.
Upon receiving the replys16, C computes (IDP,C8,s15′)=DskPC′(s16) and verifies whether s15′ equals s15 or not. If s15′=s15, C stores C8 in P’s storage space to replace C6; otherwise, the phase is failed.


## 2.1. Healthcare Center Uploading Phase

As shown in steps 1.1 and 1.2 in Figure1, patient P makes a health inspection in the healthcare center H and H uploads the generated inspection record to the cloud server C. In Figure 2, we will further describe the authentication process of the phase.Figure 2
Healthcare center uploading phase.Step 1.
After generating the inspection report,H selects a random number tH and computes K1=gtH,  s1=PKCtH=gtHkC,  s2=h(PKCkH∥TH1)=h(gkCkH∥TH1),  C1=Es1(s2), where TH1 is the current timestamp. After that, it sends {IDH,C1,TH1,K1} to the cloud C.Step 2.
On receiving{IDH,C1,TH1,K1} from H, C checks the validity of TH1. If it is invalid, C aborts the received messages; otherwise, it computes s1′=K1kC=gtHkC and decrypts C1 to recover the values s2. Subsequently, C calculates s2′=h(PKHkC∥TH1) and compares it with the decrypted s2. If the equivalence holds, the legitimacy of H is assured. Then C generates a random number tC and acquires the timestamp TC1 to compute K2=gtC,  skHC=K1tC=gtCtH, and s3=h(PKHkC∥skHC∥TC1)=h(gkHkC∥skHC∥TC1). Finally, C transmits the authentication message {K2,s3,TC1} to H.Step 3.
Upon receiving the reply message,H checks the validity of TC1. If TH2-TC1≥△T, H terminates this phase; otherwise, it computes skHC=K2tH=gtCtH, s3′=h(PKCkH∥skHC∥TC1)=h(gkHkC∥skHC∥TC1) and compares s3′ with the received s3. If they are not equal, the uploading phase is given up by H; else, H signs P’s medical report mH=(IDP,DataH,TH) with its secret key: SigH=SkH(mH). Note that TH is the current timestamp when P makes health inspection. After that, H calculates C2=EPKPkH(mH,SigH)=EgkHkP(mH,SigH),  s4=EskHC(IDP,C2,s3) and uploads s4 to the cloud.Step 4.
On receivings4, C decrypts it with skHC to recover IDP,C2,s3′ and verifies whether s3′ is equal to s3 or not. If it is true, the healthcare center is authentic. After that, it verifies whether P is a new user or not. If P is a new user, C stores (IDP,C2) in a new storage space; else, it stores C2 in P’s database.


## 2.2. Patient Uploading Phase

As shown in steps 2.1 and 2.2 in Figure1, patient P collects health information mS measured by body sensors S and he could upload the health data to the cloud. In Figure 3, we will depict the detailed process.Figure 3
Patient uploading phase.Step 1.
WhenP’s mobile phone collects the measured information, then it generates the timestamp TP1 and a random number aP to compute K3=gaP,  s5=PKCaP=gaPkC,  s6=h(PKCkP∥TP1)=h(gkCkP∥TP1),  C3=Es5(IDP,s6). Subsequently, P transmits {C3,TP1,K3} to C.Step 2.
After receiving the messages,C verifies the freshness of TP1 by checking whether TC2-TP1≤△T or not. If it is valid, C decrypts C3 to obtain the values IDP and s6 with the computed s5′=K3kC=gaPkC. After that, C calculates s6′=h(PKPkC∥TP1) and verifies whether the equation s6′=s6 holds. If it does, P is legitimate user. Then C selects random numbers aC and computes K4=gaC,  skPC=K3aC=gaCaP and s7=h(PKPkC∥skPC∥TC3)=h(gkPkC∥skPC∥TC3), where TC3 is the acquired timestamp. Finally, C transmits the {K4,s7,C2,TC3} to patient P.Step 3.
On receiving response,P checks the validity of TC3. If TC3 is invalid, P terminates the procedure. If TC3 is fresh, P computes skPC=K4aP=gaCaP,  s7′=h(PKCkP∥skPC∥TC3)=h(gkPkC∥skHC∥TC3) and verifies s7 is valid by checking whether s7′=s7 holds. If so, P decrypts C2 with the computed PKHkP to recover mH=(IDP,DataH,TH) and SigH. Subsequently, he/she verifies the validity of H’s signature SigH. If SigH is valid, P chooses a random number sn and computes C4=EPKDsnkP(mH,mS,SigH)=EgsnkDkP(mH,mS,SigH), where mS=(IDP,DataS,TS) is the collected measured data. Note that TS is the current timestamp when the body sensors S monitor P’s physical condition. Then P calculates s8=EskPC(IDP,C4,s7) and uploads s8 to the C.Step 4.
On receiving the reply message,C decrypts s8 with skPC and obtains IDP,C4,s7′. After that, the cloud server verifies P’s validity by checking whether s7′ equals to s7 or not. If so, C stores C4 in P’s storage space to replace C2; otherwise, it resumes the procedure.


## 2.3. Treatment Phase

As shown in steps 3.1 and 3.2 in Figure1, D is appointed by P and obtains P’s identity IDP and appointment sequence value sn. Subsequently, D can download P’s inspection report and measured health information from C, and he/she also can upload the diagnosing records with his/her signature to C. The details of the execution steps are further illustrated in Figure 4.Figure 4
Treatment phase.Step 1.
D selects a random number bD and computes K5=gbD,  s9=PKCbD=gbDkC,  s10=h(PKCkD∥TD1)=h(gkCkD∥TD1),  C5=Es9(s10), where TD1 is the acquired current timestamp. Then D transmits {IDD,C5,TD1,K5} to the cloud C.Step 2.
After receiving messages fromD, C checks TC4-TD1?≤△T. If it is invalid, C terminates the phase; otherwise, it computes s9′=K5kC=gbDkC and decrypts C5 to obtain the values s10. Later, C verifies s10′=h(PKDkC∥TD1) with the decrypted s10 to confirm the legitimation of D. If they are equal, C generates random numbers bC and the timestamp TC5 and computes K6=gbC,  skCD=K5bC=gbCbD,  s11=h(PKDkC∥skCD∥TC5)=h(gkCkD∥skCD∥TC5). Finally, C sends {K6,s11,C4,TC5} to D.Step 3.
On receiving{K6,s11,C4,TC5}, D checks the freshness of TC5. If so, D computes skCD=K6bD=gbCbD,  s11′=h(PKCkD∥skCD∥TC5)=h(gkCkD∥skCD∥TC5) and compares s11′ with the received s11 to assure C’s authenticity. If they are not equal, the phase is terminated by himself/herself; otherwise, D uses the appointment sequence number sn to compute PKPsnkD and decrypts C4 with it to recover mH,mS,SigH. Subsequently, D verifies whether the signature SigH is valid or not by checking mH?=VPKH(SigH). If it is valid, D diagnoses P’s symptom on the basis of (mH,mS) and generates the diagnostic records mD=(IDP,DataD,TD), where TD is the timestamp when the doctor generates mD. After that, D uses his/her private key kD to sign mD: SigD=SkD(mD). Then, D calculates C6=EPKPsnkD(mH,mS,mD,SigD),  s12=EskCD(IDP,C6,s11) and sends s12 to the cloud.Step 4.
Upon receivings12, C decrypts it with skCD and obtains IDP,C6,s11′. Later, it checks s11′?=s11. If the equation holds, the validity of D is confirmed; otherwise, this phase fails. After that, C replaces C4 with C6 and stores it in P’s storage space.


## 2.4. Checking Report Phase

As shown in step 4.1 in Figure1, patient P can access the cloud to obtain the medical record via the mobile phone. In Figure 5, we depict the detailed process of the phase.Figure 5
Checking report phase.Step 1.
P generates the timestamp TP2 and a random number vP to compute K7=gvP,  s13=PKCvP=gvPkC,  s14=h(PKCkP∥TP2)=h(gkCkP∥TP2),  C7=Es13(IDP,s14). Then, P transmits the request {C7,TP2,K7} to the cloud C.Step 2.
C verifies the freshness of TP2 after receiving the request from P. If so, C decrypts C7 with computed s13′=K7kC=gvPkC and obtains the IDP,s14′. Subsequently, C calculates s14′=h(PKPkC∥TP2) and verifies s14′?=s14. If they are equal, C computes K8=gvC,  skPC′=K7vC=gvCvP and s15=h(PKPkC∥skPC′∥TC6)=h(gkPkC∥skPC′∥TC6), where vC and TC6 are generated random value and the acquired timestamp, respectively. After that, C sends the {K8,s15,C6,TC6} to P.Step 3.
On receiving response{K8,s15,C6,TC6}, P checks the validity of TC6. If TP3-TC6≥△T,  P aborts the session; otherwise, he/she calculates skPC′=K8vP=gvCvP,  s15′=h(PKCkP∥skPC′∥TC6)=h(gkPkC∥skPC′∥TC6) and verifies whether s15′=s15 holds. If yes, P computes (mH,mS,mD,SigD)=DPKDsnkP(C6) and he/she verifies whether mD?=VPKD(SigD). If so, P takes the diagnosis report of doctor D for the health information mH and mS. Finally, P calculates C8=EPKPcn(mH,mS,mD) and s16=EskPC′(IDP,C8,s15) and uploads s16 to the C, where cn is a pre-generated key to encrypt (mH,mS,mD). Note that cn is the pre-generated key for all the medical staff. If the patient P has an accident, they can decrypt C8 to obtain the health information and make treatment decisions.Step 4.
Upon receiving the replys16, C computes (IDP,C8,s15′)=DskPC′(s16) and verifies whether s15′ equals s15 or not. If s15′=s15, C stores C8 in P’s storage space to replace C6; otherwise, the phase is failed.


## 3. Security Proof

In this section, we will prove our scheme to be secure in standard model. We reduce the security of our authentication scheme to cryptography basic elements [21, 22]. At first, in order to achieve this goal, we will introduce the definitions of security, a structured security model, and the basic assumptions. Then we use all of them to prove the result.Definition 1 (semantic security).
For arbitrary security parameterN, if and only if any polynomial time adversary has a negligible advantage against the scheme, we say the scheme has semantic security.The definitions are inherited and modified from the methodology of Bellare, Pointcheval, and Rogaway [23] and the game-based structure [24] is used to prove this scheme achieving semantic security.Security Model.In the security model, the adversary plays a game with an oracle. The oracle runs the real protocol and answers the queries of adversary to simulate the real interaction of participants. After a range of queries, the adversary gets different capabilities. When the adversary finishes the training and obtains enough messages, oracle should answer the test query once. Finally, we judge if the adversary wins or loses by what the adversary gets. The adversary and the oracle are denoted by A and B, respectively.Init: before replying to queries ofA, B generates the system parameters including security parameter N, a multiplication cyclic group G, and a generator g∈G with order p, where p is a large prime number related N. Then B selects random numbers kx∈Zp and computes PKx=gkxmod⁡p for x∈{H,P,D,C}. We notice that in a complete system P and D are not unique. Then B prepares public key and secret key pairs denoted by (PKPi,kPi) and (PKDj,kDj) for Pi and Dj, where i∈[1,n] and j∈[1,m]. B marks up all P and D withvoid state. Then it maintains a list of SID recording simulated conversations. SIDPi,Dju represents the uth conversation involved Pi and Dj. Noticeably, any SID has avoid state before being invoked.After the init phase,A is allowed to make queries for simulating the real protocol.Corrupt(Pi):  B gives kPi back to A and marks up the state of Pi withcorrupted.Corrupt(Dj):  B gives kDj back to A and marks up the state of Dj withcorrupted.Reveal(SIDPi,Dju): this query simulates abuse of session keys sk.
(1)
If the state ofSIDPi,Dju isvoid, B executes a real conversation and gives sk (being used to encrypt m) to A. Then the result of SIDPi,Dju is changed intorevealed.(2)
Else, if the state ofSIDPi,Dju is notvoid, B answers A according to the conversation in the list and addsrevealed to its state.Execute(SIDPi,Dju): this query simulates the passive adversary.
(1)
When one or both ofPi and Di arecorrupted, B checks the state of SIDPi,Dju.
(a)
Ifvoid, B executes a real conversation, gives to A data transferred over the network, and changes the state of SIDPi,Dju intoexecuted.(b)
Else, if notvoid, B answers A using the conversation in the list and addsexecuted into its state.(2)
When neither ofPi and Di iscorrupted, B checks the state of SIDPi,Dju.
(a)
Ifvoid, B executes a real conversation, gives to A data transferred over the network, and changes the state of SIDPi,Dju intoexecuted.(b)
Else, if notvoid, B answers A using the conversation in the list and addsexecuted into its state.Send(Pi,Di,Message): this query simulates active attacks.
(1)
When one or both ofPi and Di arecorrupted, B executes a real conversation to answer A.
(a)
If message is verified successfully,B answers A as the real protocol and adds this conversation into list with sent state.(b)
Else,B outputs that A is refused.(2)
When neither ofPi and Di iscorrupted, B answers A as follows.
(a)
If message is verified successfully,B answers A as the real protocol and adds this conversation into list with sent state.(b)
Else,B outputs that A is refused.Test(m0,m1):  B chooses Pi and Dj whose both states arevoid. Then it randomly chooses a coin b and simulates a real conversation with inputting mb. A guesses the result of b.The complexity assumptions needed for proving security of our scheme are reviewed as follows:Assumption 2 (DDH).
LetG be a cyclic group with order p. g∈G is a generator and a,b∈Zp∗. It is difficult to judge if an element in G equals gab by just given ga and gb.We denote upper bound of adversaries’ advantage against DDH asϵDDH. So ϵDDH should be negligible if the assumption is right.Assumption 3 (hash).
There exists a secure irreversible hash function which achieves strong collision resistance.
We denote the advantage of adversaries against the hash function asϵhash. So ϵhash should be negligible if the assumption is right.Assumption 4 (signature).
There exists a secure digital signature scheme.
We denote advantage of adversaries against this signature scheme asϵsign. So ϵsign should be negligible if the assumption is right.Assumption 5 (encryption).
There is a symmetry encryption that achieves CPA security.
We denote advantage of adversaries against this encryption scheme asϵenc. So ϵenc should be negligible if the assumption is right.Proof.
A PPT adversaryA is attacking the protocol. We use a series of games to bound the advantage of A. The advantage of A in Game i is defined as(1)Advi=def2·PrAsucceedsinGamei-1.
The games used to bound the advantages ofA are listed in the following. We analyse the advantage difference in nearly games and bound them. In Game 0, it would be the real protocol.
Game 0. A interacts with the initial security model.
Game 1. In this game, we modifyExecute queries. When the states of Pi,Dj, and SID are all void, B simulates a real protocol but replaces s1,skHC,s5,skPC,s9,skDC,s13 and skPC′ with random numbers in G.
Lemma 1. |Adv0-Adv1|≤negl.
Proof. We just replace the sks of traditional DH protocol with random numbers. The advantage difference between two games is caused by DDH problem. And hence, Lemma 1 is proved by DDH assumption right.
Game 2. This game is based on Game 1 and we also modifyExecute queries. When the states of Pi,Dj, and SID are all void, B simulates a real protocol but replaces s2,s3,s6,s7,s10,s11,s14,s15 with uniform random numbers in the range of hash function.
Lemma 2. |Adv1-Adv2|≤negl.
Proof. We just replace the real hash results with random numbers. Without the knowledge of inputs, the probability that A can distinguish the real hash results and random numbers is less than the advantage of A that captures the hash. And hence, if the hash function is secure, the probability is negligible.
Game 3. This game is based on Game 2 and we modifyExecute queries. When the states of Pi,Dj, and SID are all void, B simulates a real protocol but replaces C1,C2,s4,C3,C4,s8,C5,C6,s12,C7,C8,s16 with uniform random numbers in the range of encryption.
Lemma 3. |Adv2-Adv3|≤negl.
Proof. We just replace the symmetric encryption results with random numbers. Without knowing inputs, the probability that A can distinguish the real encryption results and random numbers is less than the advantage of A that captures the CPA security symmetric encryption. Thereby, if the symmetric encryption is secure, the probability is negligible.
Game 4. This game is based on Game 3 and we modifySend queries. When the states of Pi and Dj are both void, B simulates a real protocol but replaces s1,skHC,s5,skPC,s9,skDC,s13 and skPC′ with random numbers in G.
Lemma 4. |Adv3-Adv4|≤negl.
Proof. We just replace the sks of traditional DH protocol with random numbers. The advantage difference between two games is caused by DDH problem. Therefore, Lemma 4 is proved by DDH assumption right.
Game 5. This game is based on Game 4 and we modifySend queries. When the states of Pi and Dj are both void, B simulates a real protocol but replaces s2,s3,s6,s7,s10,s11,s14,s15 with uniform random numbers in the range of hash function.
Lemma 5. |Adv4-Adv5|≤negl.
Proof. We just replace the real hash results with random numbers. Without knowing inputs, the probability that A can distinguish the real hash results and random numbers is less than the advantage of A that captures the hash. If the hash function is secure, the probability is negligible.
Game 6. This game is based on Game 5 and we also modifySend queries. When the states of Pi and Dj are both void, B simulates a real protocol but replaces C1,C2,s4,C3C4,s8,C5,C6,s12,C7,C8,s16 with uniform random numbers in the range of encryption.
Lemma 6. |Adv5-Adv6|≤negl.
Proof. We just replace the encryption results by random numbers. Without the knowledge of inputs, the probability that A can distinguish the real encryption results and random numbers is less than the advantage of A that captures the CPA security symmetric encryption. If the symmetric encryption is secure, the probability is negligible.
In Game 6, we notice thatPi and Dj of test query neither are corrupted. For any SID without being corrupted, theExecute andSend queries are all randomized. So in Game 6, the advantage of A is zero. So, we can compute the Adv0 as follows:(2)Adv0=Adv0-Adv6≤ϵDDH+ϵhash+ϵenc,which is a negligible value.


## 4. Performance and Functionality Analysis

Herein, we evaluate the performance and functionality of the proposed scheme and compare it with three related schemes for cloud based telemedicine systems, including Chen et al.’s scheme [15], Chiou et al.’s scheme [16], and Cheng et al.’s scheme [20].The comparisons on the key security properties among these systems are given in Table1. It is visible that our scheme could achieve all security properties and it is superior to the rest three related schemes. Chen et al.’s scheme [15] fails to provide anonymity and complete mutual authentication, while Chiou et al.’s scheme [16] could not achieve the complete mutual authentication. Furthermore, Cheng et al.’s scheme [20] could not preserve users’ privacy, complete mutual authentication, and confidentiality. Note that the proposed scheme offers important security features and it is better suitable for cloud based telemedicine environment.Table 1
Comparisons of properties.
Chen et al.’s [15] Chiou et al.’s [16] Cheng et al.’s [20] Ours Resistance of impersonation attack Yes Yes Yes Yes Prevention of replay attack Yes Yes Yes Yes Preserving patient privacy No Yes No Yes Complete mutual authentication No No No Yes Perfect forward secrecy Yes Yes Yes Yes Confidentiality Yes Yes No Yes Perfect backward secrecy Yes Yes Yes YesMeanwhile, we present the comparisons of efficiency in terms of computation loading among these schemes in Table2. Compared with the other three related schemes, the proposed scheme needs not perform the bilinear pairing and could provide more additional security features. Furthermore, our scheme achieves the provably security in the standard model.Table 2
Comparisons of computation loading.
Chen et al.’s [15] Chiou et al.’s [16] Cheng et al.’s [20] Ours HUP H T s+Ta+2Tm+2Tp+TE+3Th T s+2Tp+2TE+4Th 2Tp+2TE+4Th+Ts+Tm 5 T e + 2 T h + T s + 3 T E C 2 T m + 2 T p + T E + 3 T h T p + T E + 3 T h 3 T h + T p + T E 4 T e + 2 T h + 2 T E PUP P T s+Ta+2Tm+2Tp+2TE+3Th T s+3Tp+2TE+7Th 3Tp+2TE+6Th+Ts+Tm T s + 6 T e + 4 T E + 2 T h C 2 T m + 2 T p + T E + 3 T h T p + 4 T h T p + 5 T h 4 T e + 2 T E + 2 T h TP D 2Ts+2Tm+2Tp+3TE+3Th 2Ts+2Tp+2TE+4Th 2 T s + 2 T E + 2 T p + 5 T h 5Te+4TE+2Th+2Ts C 2Tm+2Tp+TE+3Th T p + 4 T h T p + 4 T h 4Te+2TE+2Th CP P N/A T s+Tp+2TE+4Th T s+Tp+2TE+4Th 6Te+4TE+2Th+Ts C N/A T p+4Th T p+4Th 4Te+2TE+2Th HUP: healthcare center uploading phase. PUP: patient uploading phase. TP: treatment phase. CP: checking report phase. T h: time consumption for executing a hash function. T E: time consumption for executing the symmetric encryption/decryption operation. T e: time consumption for executing a modular exponent operation. T p: time consumption for executing a bilinear pairing operation. T s: time consumption for executing/verifying a signature. T a: time consumption for executing an asymmetric encryption/decryption operation. T m: time consumption for executing a multiplication operation.More detailed efficiency comparisons are shown in Figures6 and 7. We implement the cloud of authentication schemes for cloud based telemedicine systems in Python 3.5.2 using an Intel(R) Core(TM) i5-4590 CPU @ 3.30GHZ with 3300MB RAM and Ubuntu 16.04 system. The simulations of platform for healthcare center, patients, and doctors are implemented in Python 3.5.2 using an Intel(R) Core(TM) i5-4590 CPU at 1.65GHZ with 1540MB RAM and Ubuntu 16.04 system. The one-way hash function used is SHA-256, and the symmetric encryption/decryption algorithm is advanced encryption standard. We use the ElGamal signature scheme and ElGamal encryption scheme with 1024-bit security parameter for digital signature algorithm and the asymmetric encryption/decryption algorithm, respectively. Moreover, the bilinear paring is simulated in two MNT asymmetric groups, “MNT224”.Figure 6
Cost time on cloud computing.Figure 7
Cost time on healthcare center, patients, doctors, and cloud.Figure6 shows the main cost on the cloud computing of interacting with multiple patients and doctors for authentication simultaneously. It demonstrates that our proposal costs less time for the cloud to authenticate doctors and patients. Figure 7 illustrates the main cost on healthcare center, patients, doctors, and cloud for one round authentication in healthcare center uploading phase, patient uploading phase, treatment phase, and checking report phase, respectively. From Figure 7 we can conclude that our scheme is the most efficient to finish one round mutual authentication.


## 5. Conclusion

In this article, we proposed an anonymous authentication scheme based on cloud for medical environment, which provided both data confidentiality and message authenticity. Subsequently, we stated that the proposed scheme was provably secure in the standard model. The comparisons with existing competitive protocols also observe that our scheme is suitable for the cloud based telecare medical information systems.



---

*Source: 8131367-2018-09-02.xml*