# An Efficient Three-Party Authentication Scheme for Data Exchange in Medical Environment

Authors: Shin-Yan Chiou; Ching-Hsuan Lin
Journal: Security and Communication Networks
 (2018)

---

## Abstract

Compared with traditional paper medical records, electronic medical records have many advantages such as easy transmission, high efficiency, better accuracy, and easier storage. The further development and penetration of electronic medical records will raise increasingly critical transmitted-data accuracy and security issues. Previous studies have proposed a verifier-based three-party authentication scheme and to provide high efficiency and security, with low computation and transmission costs. However, this protocol fails to achieve anonymity, is vulnerable to tracking attacks, and is inefficient. In this paper, we propose a new authentication scheme which provides patient anonymity and resistance to tracking attacks, while reducing computation and communication costs. The proposed system is easier to implement and is more suitable for use in remote electronic medical record exchange systems.


---

## Body

## 1. Introduction

Aging societies experience increasing rates of chronic disease (e.g., heart disease, diabetes, cardiovascular diseases, and mental health issues) which must be frequently observed and monitored. Patients with such illnesses require periodic hospital- or clinic-based checkups, which can be inconvenient and stressful for elderly people. The digitization of medical measurement equipment (e.g., blood pressure monitors, blood glucose meters) allows for diagnostic information to be stored electronically and transmitted to remote locations for analysis and monitoring, enabling patients to avoid hospital visits while enabling their health care to closely monitor their status. Such electronic medical records (EMR) [1–3] has many advantages over conventional paper medical records, such as easy transmission, high efficiency, better accuracy, and ease of storage. However, their increased convenience raises significant security issues such as patient privacy and data integrity.Telecare medicine information systems (TMIS) [4–6] involve the transmission of remote digital medical information or health reports through the combination of computers, communication systems to provide patients, and medical institutions with a secure data transmission platform and allow them to obtain medical record or health reports securely and conveniently. However, there are many security issues such as patient privacy and data integrity. Many identification and authentication protocols have been proposed to protect patient privacy and information. TMIS with three-party authentication is a secure data transmission platform that allows an authentication server and two participants (a medical institution or doctor and a patient) to generate a session key and a secure channel to verify their identities and then exchange data securely.Lin and Lee [7] proposed a verifier-based three-party authentication scheme to provide high efficiency and security, along with low computation and transmission costs. However, this protocol fails to achieve anonymity and is vulnerable to tracking attacks. In addition, when authenticating a participant, it takes considerable time for the server to locate the verifiers, making the system difficult to implement. We thus propose a new authentication scheme which provides anonymity and resistance to tracking attacks, while reducing computation and communication costs. The proposed system is easier to implement and is more suitable for use in remote electronic medical record exchange systems.The remainder of this paper is organized as follows. Section2 reviews and analyzes verifier-based three-party authentication schemes without server public key including Lee et al.’s [8], Wang-Mo’s [9], Kwon et al.’s [10], and Lin-Lee’s [7] schemes. Section 3 introduces notations and security requirements for our scheme. Section 4 presents our proposed protocol, and the security analysis is given in Section 5. Section 6 provides a comparison of the proposed protocol and other related works. Finally, an implementation is described in Section 7 and a conclusion is drawn in Section 8.


## 2. Related Works

This section reviews four verifier-based three-party authentication schemes without server public key including Lee et al.’s [8], Wang-Mo’s [9], Kwon et al.’s [10], and Lin-Lee’s [7] schemes and analyzes the weaknesses of their schemes.


### 2.1. Review of Lee et al.’s Scheme

Lee et al. [8] proposed a verifier-based authentication scheme without server’s public key based on the Diffie-Hellman key exchange. Their scheme enables each client to only remember a memorable password. The normal procedure of their scheme is shown in Figure 1.Figure 1
The procedure of Lee et al.’s scheme.


#### 2.1.1. Initialization Phase

A clientA and a trusted authentication server AS share a verifier vA=gtAmod⁡p for a password πA, and a client B and AS share a verifiers vB=gtBmod⁡p for a password πB, where tA=h(A,AS,πA) and tB=h(A,AS,πB).


#### 2.1.2. Verification Phase

This phase allowsA and B to share a secret key confidentially via AS. The details of the execution steps are described as follows (Figure 1).(1)
A→B:A,B,XA: A chooses a random number a∈RZP∗, computes XA=gamod⁡p, and sends A,B,XA to B.(2)
B→A:B,XB and B→AS:A,XA,B,XB: B chooses a random number b∈RZP∗, computes XB=gbmod⁡p, and sends B,XB and A,XA,B,XB to A and AS, respectively.(3)
AS→A:XSA and AS→B:XSB: after receiving va and vb, AS chooses two random numbers c,d∈RZP∗, computes XSA=(vA)c⊕vAmod⁡p, XSB=(vB)d⊕vBmod⁡p, KSA=(XA)c=gacmod⁡p, and KSB=(XB)d=gbdmod⁡p, and sends XSA and XSB to A and B, respectively.(4)
A→AS:VAS and B→AS:VBS: A computes KAS=(XSA⊕vA)tA-1·a=gcamod⁡p and VAS=h(A,B,AS,XA,XB,XSA,KAS), sends VAS to AS, where tA=hA,AS,πA. B computes KBS=(XSB⊕vB)tB-1·b=gbdmod⁡p and VBS=h(B,A,AS,XB,XA,XSB,KBS), and sends VBS to AS, where tB=h(B,AS,πB).(5)
AS→A:VSA and AS→B:VSB: AS verifies whether VAS and VBS are valid. If they do, AS computes VSA=h(AS,A,XA,XB,KSA) and VSB=h(AS,B,XB,XA,KSB) and sends VSA and VSB to A and B, respectively.(6)
A verifies VSA and B verifies VSB.Finally,A possesses a session key KAB=(XB)a=gbamod⁡p and B possesses a session key KBA=(XA)b=gabmod⁡p.


#### 2.1.3. Weaknesses of Lee et al.’s Scheme

Wang and Mo [9] showed that the Lee et al.’s scheme [8] is not resistant to an impersonation attack if an attacker once has stolen A’s verifier vA.


### 2.2. Review of Wang-Mo’s Scheme

In order to withstand an impersonation attack of the Lee et al.’s scheme [8] under verifier-stolen situation, Wang and Mo [9] modified VAS as h(A,B,AS,XA,XB,(XSA⊕vA)tA-1=gc,KAS) and VBS as h(B,A,AS,XB,XA,(XSB⊕vB)tB-1=gd,KBS), respectively. Therefore, if both verifiers VAS and VBS are stole, an impersonation attack does not work without tA and tB.However, Lin and Lee [7] showed that the Wang and Mo’s scheme [9] do not realize key confirmation. If the transmitted EMRs or EHRs are encrypted by using an unconfirmed key, their integrity and confidentiality are unsure.


### 2.3. Review of Kwon et al.’s Scheme

This section reviews Kwon et al.’s scheme [10]. The normal procedure of their scheme is shown in Figure 2.Figure 2
The procedure of Kwon et al.’s scheme.


#### 2.3.1. Initialization Phase

A and AS share a verifier vA,1=gtAmod⁡p and vA,2=g2tAmod⁡p for a password πA, and B and AS share a verifiers vB,1=gtBmod⁡p and vB,2=g2tBmod⁡p for a password πB, where tA=h(A,AS,πA) and tB=h(A,AS,πB).


#### 2.3.2. Verification Phase

This phase allowsA and B to share a secret key confidentially via AS. The details of the execution steps are described as follows (Figure 2):(1)
A→B:A,B,AS: A broadcasts (A,B,AS).(2)
A→AS:A, XA and B→AS:B,XB: A chooses a random number xA∈RZP∗, computes XA=gxA·vA,2mod⁡p, and sends (A,XA) to AS. B chooses a random number xB∈RZP∗, computes XB=gxB·vB,2mod⁡p, and sends (B,XB) to AS.(3)
AS→A:AS,YA,ZA and AS→B:AS,YB,ZB: AS chooses random numbers yA,zA,yB,zB∈RZP∗, computes ZA=gzA·vA,2mod⁡p,  YA=gyA·vA,1zAmod⁡p,  ZB=gzB·vB,2mod⁡p and YB=gyB·vB,1zBmod⁡p, and sends (AS,YA,ZA) and (AS,YB,ZB) to A and B, respectively. Moreover, AS computes kA=(XA/vA,2)yAmod⁡p and kB=(XB/vB,2)yBmod⁡p.(4)
A→AS:τA,S and B→AS:τB,S: after receiving (AS,YA,ZA), A computes TA=(ZA/vA,2)H(A,AS,πA)mod⁡p, kA=(YA/TA)xAmod⁡p, and τA,S=MACkA(A,AS,XA,YA,ZA) and sends τA,S to AS. After receiving (AS,YB,ZB), B computes TB=(ZB/vB,2)H(B,AS,πB)mod⁡p, kB=(YB/TB)xBmod⁡p, and τB,S=MACkB(B,AS,XB,YB,ZB) and sends τB,S to AS.(5)
AS→A:SA,τS,A and AS→B:SB,τS,B: AS verifies whether τA,S and τB,S are correct. If so, AS chooses a random number xS∈RZP∗, computes SA=gxB·xSmod⁡p, SB=gxA·xSmod⁡p, τS,A=MACkA(A,AS,B,SA), and τS,B=MACkB(B,AS,A,SB), and sends (SA,τS,A) and (SB,τS,B) to A and B, respectively.(6)
A verifies τS,A and B verifies τS,B.Finally,A possesses a session key KA=(SA)xAmod⁡p and B possesses a session key KB=(SB)xBmod⁡p.


#### 2.3.3. Weaknesses of Kwon et al.’s Scheme

Lin and Lee [7] showed that the Kwon et al.’s scheme [10] do not realize key confirmation. If the transmitted EMRs or EHRs are encrypted by using an unconfirmed key, their integrity and confidentiality are unsure.


### 2.4. Review of Lin-Lee’s Scheme

This section reviews Lin-Lee’s scheme [7] (including the initialization and verification phases). The normal procedure of their scheme is shown in Figures 3 and 4.Figure 3
The normal procedure of Lin-Lee’s scheme.Figure 4
The procedure of Lin-Lee’s scheme.A and B represent two medical institutions, and AS stands for a trusted authentication server.


#### 2.4.1. Initialization Phase

As shown in steps(1) in Figure 3, A and B send their verifiers to AS via a secure and verified channel to register their verifiers. The details of the steps are as follows: A sends verifier vA=gtAmod⁡p to AS, and B sends verifier vB=gtBmod⁡p to AS, where tA=H(IDA,IDAS,πA) and tB=H(IDB,IDAS,πB).


#### 2.4.2. Verification Phase

AssumeA and B need to exchange EMR or EHR confidentially via authentication server AS. As shown in steps (2), (3), and (4) in Figure 3, A and B process a mutual authentication with AS and each other, perform a key agreement to obtain a session key, and exchange encrypted EMR or EHR encrypted by the session key. The details of the execution steps are described as follows:(1)
A→AS:IDA,IDB,XA: A chooses a random number a∈RZP∗, computes XA=gamod⁡p, and sends IDA, IDB, XA to AS.(2)
A→B:IDA,XA: A sends IDA and XA to B.(3)
AS→A:XSA,AS→B:XSB: AS chooses two random numbers c,d∈RZP∗, computes XSA=(vA)c⊕vAmod⁡p and XSB=(vB)d⊕vBmod⁡p, sends XSA to A, and sends XSB to B.(4)
B→AS:IDA,IDB,XB: B chooses a random number b∈RZP∗, computes XB=gbmod⁡p, and sends IDA, IDB, and XB to AS.(5)
AS: AS computes gc, gd, KSA=(XA)c=gacmod⁡p, and KSB=(XB)d=gbdmod⁡p.(6)
B→A:IDB,XB: B sends IDB, XB to A.(7)
A→AS:VAS: A computes gc=(XSA⊕vA)tA-1mod⁡p, uses gc and a to evaluate KAS=(gc)a=gcamod⁡p, VAS=h(IDA,IDB,IDAS,XA,XB,gc,KAS), KAB=(XB)a=gbamod⁡p, and μAB=h(IDA,IDB,XA,XB,KAB), and sends VAS to AS.(8)
B→AS:VBS: B computes gd=(XSB⊕vB)tB-1mod⁡p, uses gd and b to evaluate KBS=(gd)b=gdbmod⁡p, VBS=h(IDA,IDB,IDAS,XA,XB,gd,KBS), KBA=(XA)b=gabmod⁡p, and μAB=h(IDA,IDB,XA,XB,KAB), and sends VBS to AS.(9)
A→B:μAB: A sends μAB=h(IDA,IDB,XA,XB,KAB) to B.(10)
B authenticates A: B verifiers whether the values IDA,IDB,XA,XB,KAB in μAB are correct. If so, the identity of A is valid.(11)
B→A:μBA: B sends μBA=h(IDA,IDB,XA,XB,KBA) to A.(12)
A authenticates B: A verifiers whether the values IDA,IDB,XA,XB,KBA in μBA are correct. If so, the identity of B is valid.(13)
AS authenticates A, B: AS verifiers whether the equations VAS=h(IDA,IDB,IDAS,XA,XB,gc,KAS) and VBS=h(IDA,IDB,IDAS,XA,XB,gd,KBS) are hold. If so, the identities of A and B are valid.(14)
AS→A:VSA; AS→B:VSB: AS computes VSA=h(IDAS,IDA,XA,XB, KSA) and VSB=h(IDAS,IDB,XB,XA,KSB), sends VSA to A, and sends VSB to B.(15)
A authenticates AS: A verifiers whether VSA is correct. If so, the identity of AS is valid.(16)
B authenticates AS: B verifiers whether VSB is correct. If so, the identity of AS is valid.Finally,A possesses a session key SKAB=h(IDA,IDB,IDAS,KAB) and B possesses a session key SKBA=h(IDA,IDB,IDAS,KBA).


#### 2.4.3. Weaknesses of Lin-Lee’s Scheme

We find Lin-Lee’s scheme [7] has three drawbacks: (1) does not provide anonymity, (2) vulnerable to tracking attack, and (3) inefficiency.(1) Does Not Provide Anonymity. Medical institution A transmits data IDA and IDB to AS in the step (1) of verification phase, while medical institution B transmits the same data (IDA and IDB) to AS in the step (4) of verification phase. An attacker can obtain the identity (IDA and IDB) of both A and B by eavesdropping on the transmission; thus the scheme does not provide anonymity.(2) Vulnerable to Tracking Attack. The data IDA and IDB are transmitted in both step (1) and step (4) of verification phase. An adversary can track institutions A and B easily from the identity (IDA and IDB); thus the scheme is vulnerable to tracking attack.(3) Inefficiency. The scheme needs 16 exponentiations; therefore the computation cost of Lin-Lee’s scheme is inefficiency.


## 2.1. Review of Lee et al.’s Scheme

Lee et al. [8] proposed a verifier-based authentication scheme without server’s public key based on the Diffie-Hellman key exchange. Their scheme enables each client to only remember a memorable password. The normal procedure of their scheme is shown in Figure 1.Figure 1
The procedure of Lee et al.’s scheme.


### 2.1.1. Initialization Phase

A clientA and a trusted authentication server AS share a verifier vA=gtAmod⁡p for a password πA, and a client B and AS share a verifiers vB=gtBmod⁡p for a password πB, where tA=h(A,AS,πA) and tB=h(A,AS,πB).


### 2.1.2. Verification Phase

This phase allowsA and B to share a secret key confidentially via AS. The details of the execution steps are described as follows (Figure 1).(1)
A→B:A,B,XA: A chooses a random number a∈RZP∗, computes XA=gamod⁡p, and sends A,B,XA to B.(2)
B→A:B,XB and B→AS:A,XA,B,XB: B chooses a random number b∈RZP∗, computes XB=gbmod⁡p, and sends B,XB and A,XA,B,XB to A and AS, respectively.(3)
AS→A:XSA and AS→B:XSB: after receiving va and vb, AS chooses two random numbers c,d∈RZP∗, computes XSA=(vA)c⊕vAmod⁡p, XSB=(vB)d⊕vBmod⁡p, KSA=(XA)c=gacmod⁡p, and KSB=(XB)d=gbdmod⁡p, and sends XSA and XSB to A and B, respectively.(4)
A→AS:VAS and B→AS:VBS: A computes KAS=(XSA⊕vA)tA-1·a=gcamod⁡p and VAS=h(A,B,AS,XA,XB,XSA,KAS), sends VAS to AS, where tA=hA,AS,πA. B computes KBS=(XSB⊕vB)tB-1·b=gbdmod⁡p and VBS=h(B,A,AS,XB,XA,XSB,KBS), and sends VBS to AS, where tB=h(B,AS,πB).(5)
AS→A:VSA and AS→B:VSB: AS verifies whether VAS and VBS are valid. If they do, AS computes VSA=h(AS,A,XA,XB,KSA) and VSB=h(AS,B,XB,XA,KSB) and sends VSA and VSB to A and B, respectively.(6)
A verifies VSA and B verifies VSB.Finally,A possesses a session key KAB=(XB)a=gbamod⁡p and B possesses a session key KBA=(XA)b=gabmod⁡p.


### 2.1.3. Weaknesses of Lee et al.’s Scheme

Wang and Mo [9] showed that the Lee et al.’s scheme [8] is not resistant to an impersonation attack if an attacker once has stolen A’s verifier vA.


## 2.1.1. Initialization Phase

A clientA and a trusted authentication server AS share a verifier vA=gtAmod⁡p for a password πA, and a client B and AS share a verifiers vB=gtBmod⁡p for a password πB, where tA=h(A,AS,πA) and tB=h(A,AS,πB).


## 2.1.2. Verification Phase

This phase allowsA and B to share a secret key confidentially via AS. The details of the execution steps are described as follows (Figure 1).(1)
A→B:A,B,XA: A chooses a random number a∈RZP∗, computes XA=gamod⁡p, and sends A,B,XA to B.(2)
B→A:B,XB and B→AS:A,XA,B,XB: B chooses a random number b∈RZP∗, computes XB=gbmod⁡p, and sends B,XB and A,XA,B,XB to A and AS, respectively.(3)
AS→A:XSA and AS→B:XSB: after receiving va and vb, AS chooses two random numbers c,d∈RZP∗, computes XSA=(vA)c⊕vAmod⁡p, XSB=(vB)d⊕vBmod⁡p, KSA=(XA)c=gacmod⁡p, and KSB=(XB)d=gbdmod⁡p, and sends XSA and XSB to A and B, respectively.(4)
A→AS:VAS and B→AS:VBS: A computes KAS=(XSA⊕vA)tA-1·a=gcamod⁡p and VAS=h(A,B,AS,XA,XB,XSA,KAS), sends VAS to AS, where tA=hA,AS,πA. B computes KBS=(XSB⊕vB)tB-1·b=gbdmod⁡p and VBS=h(B,A,AS,XB,XA,XSB,KBS), and sends VBS to AS, where tB=h(B,AS,πB).(5)
AS→A:VSA and AS→B:VSB: AS verifies whether VAS and VBS are valid. If they do, AS computes VSA=h(AS,A,XA,XB,KSA) and VSB=h(AS,B,XB,XA,KSB) and sends VSA and VSB to A and B, respectively.(6)
A verifies VSA and B verifies VSB.Finally,A possesses a session key KAB=(XB)a=gbamod⁡p and B possesses a session key KBA=(XA)b=gabmod⁡p.


## 2.1.3. Weaknesses of Lee et al.’s Scheme

Wang and Mo [9] showed that the Lee et al.’s scheme [8] is not resistant to an impersonation attack if an attacker once has stolen A’s verifier vA.


## 2.2. Review of Wang-Mo’s Scheme

In order to withstand an impersonation attack of the Lee et al.’s scheme [8] under verifier-stolen situation, Wang and Mo [9] modified VAS as h(A,B,AS,XA,XB,(XSA⊕vA)tA-1=gc,KAS) and VBS as h(B,A,AS,XB,XA,(XSB⊕vB)tB-1=gd,KBS), respectively. Therefore, if both verifiers VAS and VBS are stole, an impersonation attack does not work without tA and tB.However, Lin and Lee [7] showed that the Wang and Mo’s scheme [9] do not realize key confirmation. If the transmitted EMRs or EHRs are encrypted by using an unconfirmed key, their integrity and confidentiality are unsure.


## 2.3. Review of Kwon et al.’s Scheme

This section reviews Kwon et al.’s scheme [10]. The normal procedure of their scheme is shown in Figure 2.Figure 2
The procedure of Kwon et al.’s scheme.


### 2.3.1. Initialization Phase

A and AS share a verifier vA,1=gtAmod⁡p and vA,2=g2tAmod⁡p for a password πA, and B and AS share a verifiers vB,1=gtBmod⁡p and vB,2=g2tBmod⁡p for a password πB, where tA=h(A,AS,πA) and tB=h(A,AS,πB).


### 2.3.2. Verification Phase

This phase allowsA and B to share a secret key confidentially via AS. The details of the execution steps are described as follows (Figure 2):(1)
A→B:A,B,AS: A broadcasts (A,B,AS).(2)
A→AS:A, XA and B→AS:B,XB: A chooses a random number xA∈RZP∗, computes XA=gxA·vA,2mod⁡p, and sends (A,XA) to AS. B chooses a random number xB∈RZP∗, computes XB=gxB·vB,2mod⁡p, and sends (B,XB) to AS.(3)
AS→A:AS,YA,ZA and AS→B:AS,YB,ZB: AS chooses random numbers yA,zA,yB,zB∈RZP∗, computes ZA=gzA·vA,2mod⁡p,  YA=gyA·vA,1zAmod⁡p,  ZB=gzB·vB,2mod⁡p and YB=gyB·vB,1zBmod⁡p, and sends (AS,YA,ZA) and (AS,YB,ZB) to A and B, respectively. Moreover, AS computes kA=(XA/vA,2)yAmod⁡p and kB=(XB/vB,2)yBmod⁡p.(4)
A→AS:τA,S and B→AS:τB,S: after receiving (AS,YA,ZA), A computes TA=(ZA/vA,2)H(A,AS,πA)mod⁡p, kA=(YA/TA)xAmod⁡p, and τA,S=MACkA(A,AS,XA,YA,ZA) and sends τA,S to AS. After receiving (AS,YB,ZB), B computes TB=(ZB/vB,2)H(B,AS,πB)mod⁡p, kB=(YB/TB)xBmod⁡p, and τB,S=MACkB(B,AS,XB,YB,ZB) and sends τB,S to AS.(5)
AS→A:SA,τS,A and AS→B:SB,τS,B: AS verifies whether τA,S and τB,S are correct. If so, AS chooses a random number xS∈RZP∗, computes SA=gxB·xSmod⁡p, SB=gxA·xSmod⁡p, τS,A=MACkA(A,AS,B,SA), and τS,B=MACkB(B,AS,A,SB), and sends (SA,τS,A) and (SB,τS,B) to A and B, respectively.(6)
A verifies τS,A and B verifies τS,B.Finally,A possesses a session key KA=(SA)xAmod⁡p and B possesses a session key KB=(SB)xBmod⁡p.


### 2.3.3. Weaknesses of Kwon et al.’s Scheme

Lin and Lee [7] showed that the Kwon et al.’s scheme [10] do not realize key confirmation. If the transmitted EMRs or EHRs are encrypted by using an unconfirmed key, their integrity and confidentiality are unsure.


## 2.3.1. Initialization Phase

A and AS share a verifier vA,1=gtAmod⁡p and vA,2=g2tAmod⁡p for a password πA, and B and AS share a verifiers vB,1=gtBmod⁡p and vB,2=g2tBmod⁡p for a password πB, where tA=h(A,AS,πA) and tB=h(A,AS,πB).


## 2.3.2. Verification Phase

This phase allowsA and B to share a secret key confidentially via AS. The details of the execution steps are described as follows (Figure 2):(1)
A→B:A,B,AS: A broadcasts (A,B,AS).(2)
A→AS:A, XA and B→AS:B,XB: A chooses a random number xA∈RZP∗, computes XA=gxA·vA,2mod⁡p, and sends (A,XA) to AS. B chooses a random number xB∈RZP∗, computes XB=gxB·vB,2mod⁡p, and sends (B,XB) to AS.(3)
AS→A:AS,YA,ZA and AS→B:AS,YB,ZB: AS chooses random numbers yA,zA,yB,zB∈RZP∗, computes ZA=gzA·vA,2mod⁡p,  YA=gyA·vA,1zAmod⁡p,  ZB=gzB·vB,2mod⁡p and YB=gyB·vB,1zBmod⁡p, and sends (AS,YA,ZA) and (AS,YB,ZB) to A and B, respectively. Moreover, AS computes kA=(XA/vA,2)yAmod⁡p and kB=(XB/vB,2)yBmod⁡p.(4)
A→AS:τA,S and B→AS:τB,S: after receiving (AS,YA,ZA), A computes TA=(ZA/vA,2)H(A,AS,πA)mod⁡p, kA=(YA/TA)xAmod⁡p, and τA,S=MACkA(A,AS,XA,YA,ZA) and sends τA,S to AS. After receiving (AS,YB,ZB), B computes TB=(ZB/vB,2)H(B,AS,πB)mod⁡p, kB=(YB/TB)xBmod⁡p, and τB,S=MACkB(B,AS,XB,YB,ZB) and sends τB,S to AS.(5)
AS→A:SA,τS,A and AS→B:SB,τS,B: AS verifies whether τA,S and τB,S are correct. If so, AS chooses a random number xS∈RZP∗, computes SA=gxB·xSmod⁡p, SB=gxA·xSmod⁡p, τS,A=MACkA(A,AS,B,SA), and τS,B=MACkB(B,AS,A,SB), and sends (SA,τS,A) and (SB,τS,B) to A and B, respectively.(6)
A verifies τS,A and B verifies τS,B.Finally,A possesses a session key KA=(SA)xAmod⁡p and B possesses a session key KB=(SB)xBmod⁡p.


## 2.3.3. Weaknesses of Kwon et al.’s Scheme

Lin and Lee [7] showed that the Kwon et al.’s scheme [10] do not realize key confirmation. If the transmitted EMRs or EHRs are encrypted by using an unconfirmed key, their integrity and confidentiality are unsure.


## 2.4. Review of Lin-Lee’s Scheme

This section reviews Lin-Lee’s scheme [7] (including the initialization and verification phases). The normal procedure of their scheme is shown in Figures 3 and 4.Figure 3
The normal procedure of Lin-Lee’s scheme.Figure 4
The procedure of Lin-Lee’s scheme.A and B represent two medical institutions, and AS stands for a trusted authentication server.


### 2.4.1. Initialization Phase

As shown in steps(1) in Figure 3, A and B send their verifiers to AS via a secure and verified channel to register their verifiers. The details of the steps are as follows: A sends verifier vA=gtAmod⁡p to AS, and B sends verifier vB=gtBmod⁡p to AS, where tA=H(IDA,IDAS,πA) and tB=H(IDB,IDAS,πB).


### 2.4.2. Verification Phase

AssumeA and B need to exchange EMR or EHR confidentially via authentication server AS. As shown in steps (2), (3), and (4) in Figure 3, A and B process a mutual authentication with AS and each other, perform a key agreement to obtain a session key, and exchange encrypted EMR or EHR encrypted by the session key. The details of the execution steps are described as follows:(1)
A→AS:IDA,IDB,XA: A chooses a random number a∈RZP∗, computes XA=gamod⁡p, and sends IDA, IDB, XA to AS.(2)
A→B:IDA,XA: A sends IDA and XA to B.(3)
AS→A:XSA,AS→B:XSB: AS chooses two random numbers c,d∈RZP∗, computes XSA=(vA)c⊕vAmod⁡p and XSB=(vB)d⊕vBmod⁡p, sends XSA to A, and sends XSB to B.(4)
B→AS:IDA,IDB,XB: B chooses a random number b∈RZP∗, computes XB=gbmod⁡p, and sends IDA, IDB, and XB to AS.(5)
AS: AS computes gc, gd, KSA=(XA)c=gacmod⁡p, and KSB=(XB)d=gbdmod⁡p.(6)
B→A:IDB,XB: B sends IDB, XB to A.(7)
A→AS:VAS: A computes gc=(XSA⊕vA)tA-1mod⁡p, uses gc and a to evaluate KAS=(gc)a=gcamod⁡p, VAS=h(IDA,IDB,IDAS,XA,XB,gc,KAS), KAB=(XB)a=gbamod⁡p, and μAB=h(IDA,IDB,XA,XB,KAB), and sends VAS to AS.(8)
B→AS:VBS: B computes gd=(XSB⊕vB)tB-1mod⁡p, uses gd and b to evaluate KBS=(gd)b=gdbmod⁡p, VBS=h(IDA,IDB,IDAS,XA,XB,gd,KBS), KBA=(XA)b=gabmod⁡p, and μAB=h(IDA,IDB,XA,XB,KAB), and sends VBS to AS.(9)
A→B:μAB: A sends μAB=h(IDA,IDB,XA,XB,KAB) to B.(10)
B authenticates A: B verifiers whether the values IDA,IDB,XA,XB,KAB in μAB are correct. If so, the identity of A is valid.(11)
B→A:μBA: B sends μBA=h(IDA,IDB,XA,XB,KBA) to A.(12)
A authenticates B: A verifiers whether the values IDA,IDB,XA,XB,KBA in μBA are correct. If so, the identity of B is valid.(13)
AS authenticates A, B: AS verifiers whether the equations VAS=h(IDA,IDB,IDAS,XA,XB,gc,KAS) and VBS=h(IDA,IDB,IDAS,XA,XB,gd,KBS) are hold. If so, the identities of A and B are valid.(14)
AS→A:VSA; AS→B:VSB: AS computes VSA=h(IDAS,IDA,XA,XB, KSA) and VSB=h(IDAS,IDB,XB,XA,KSB), sends VSA to A, and sends VSB to B.(15)
A authenticates AS: A verifiers whether VSA is correct. If so, the identity of AS is valid.(16)
B authenticates AS: B verifiers whether VSB is correct. If so, the identity of AS is valid.Finally,A possesses a session key SKAB=h(IDA,IDB,IDAS,KAB) and B possesses a session key SKBA=h(IDA,IDB,IDAS,KBA).


### 2.4.3. Weaknesses of Lin-Lee’s Scheme

We find Lin-Lee’s scheme [7] has three drawbacks: (1) does not provide anonymity, (2) vulnerable to tracking attack, and (3) inefficiency.(1) Does Not Provide Anonymity. Medical institution A transmits data IDA and IDB to AS in the step (1) of verification phase, while medical institution B transmits the same data (IDA and IDB) to AS in the step (4) of verification phase. An attacker can obtain the identity (IDA and IDB) of both A and B by eavesdropping on the transmission; thus the scheme does not provide anonymity.(2) Vulnerable to Tracking Attack. The data IDA and IDB are transmitted in both step (1) and step (4) of verification phase. An adversary can track institutions A and B easily from the identity (IDA and IDB); thus the scheme is vulnerable to tracking attack.(3) Inefficiency. The scheme needs 16 exponentiations; therefore the computation cost of Lin-Lee’s scheme is inefficiency.


## 2.4.1. Initialization Phase

As shown in steps(1) in Figure 3, A and B send their verifiers to AS via a secure and verified channel to register their verifiers. The details of the steps are as follows: A sends verifier vA=gtAmod⁡p to AS, and B sends verifier vB=gtBmod⁡p to AS, where tA=H(IDA,IDAS,πA) and tB=H(IDB,IDAS,πB).


## 2.4.2. Verification Phase

AssumeA and B need to exchange EMR or EHR confidentially via authentication server AS. As shown in steps (2), (3), and (4) in Figure 3, A and B process a mutual authentication with AS and each other, perform a key agreement to obtain a session key, and exchange encrypted EMR or EHR encrypted by the session key. The details of the execution steps are described as follows:(1)
A→AS:IDA,IDB,XA: A chooses a random number a∈RZP∗, computes XA=gamod⁡p, and sends IDA, IDB, XA to AS.(2)
A→B:IDA,XA: A sends IDA and XA to B.(3)
AS→A:XSA,AS→B:XSB: AS chooses two random numbers c,d∈RZP∗, computes XSA=(vA)c⊕vAmod⁡p and XSB=(vB)d⊕vBmod⁡p, sends XSA to A, and sends XSB to B.(4)
B→AS:IDA,IDB,XB: B chooses a random number b∈RZP∗, computes XB=gbmod⁡p, and sends IDA, IDB, and XB to AS.(5)
AS: AS computes gc, gd, KSA=(XA)c=gacmod⁡p, and KSB=(XB)d=gbdmod⁡p.(6)
B→A:IDB,XB: B sends IDB, XB to A.(7)
A→AS:VAS: A computes gc=(XSA⊕vA)tA-1mod⁡p, uses gc and a to evaluate KAS=(gc)a=gcamod⁡p, VAS=h(IDA,IDB,IDAS,XA,XB,gc,KAS), KAB=(XB)a=gbamod⁡p, and μAB=h(IDA,IDB,XA,XB,KAB), and sends VAS to AS.(8)
B→AS:VBS: B computes gd=(XSB⊕vB)tB-1mod⁡p, uses gd and b to evaluate KBS=(gd)b=gdbmod⁡p, VBS=h(IDA,IDB,IDAS,XA,XB,gd,KBS), KBA=(XA)b=gabmod⁡p, and μAB=h(IDA,IDB,XA,XB,KAB), and sends VBS to AS.(9)
A→B:μAB: A sends μAB=h(IDA,IDB,XA,XB,KAB) to B.(10)
B authenticates A: B verifiers whether the values IDA,IDB,XA,XB,KAB in μAB are correct. If so, the identity of A is valid.(11)
B→A:μBA: B sends μBA=h(IDA,IDB,XA,XB,KBA) to A.(12)
A authenticates B: A verifiers whether the values IDA,IDB,XA,XB,KBA in μBA are correct. If so, the identity of B is valid.(13)
AS authenticates A, B: AS verifiers whether the equations VAS=h(IDA,IDB,IDAS,XA,XB,gc,KAS) and VBS=h(IDA,IDB,IDAS,XA,XB,gd,KBS) are hold. If so, the identities of A and B are valid.(14)
AS→A:VSA; AS→B:VSB: AS computes VSA=h(IDAS,IDA,XA,XB, KSA) and VSB=h(IDAS,IDB,XB,XA,KSB), sends VSA to A, and sends VSB to B.(15)
A authenticates AS: A verifiers whether VSA is correct. If so, the identity of AS is valid.(16)
B authenticates AS: B verifiers whether VSB is correct. If so, the identity of AS is valid.Finally,A possesses a session key SKAB=h(IDA,IDB,IDAS,KAB) and B possesses a session key SKBA=h(IDA,IDB,IDAS,KBA).


## 2.4.3. Weaknesses of Lin-Lee’s Scheme

We find Lin-Lee’s scheme [7] has three drawbacks: (1) does not provide anonymity, (2) vulnerable to tracking attack, and (3) inefficiency.(1) Does Not Provide Anonymity. Medical institution A transmits data IDA and IDB to AS in the step (1) of verification phase, while medical institution B transmits the same data (IDA and IDB) to AS in the step (4) of verification phase. An attacker can obtain the identity (IDA and IDB) of both A and B by eavesdropping on the transmission; thus the scheme does not provide anonymity.(2) Vulnerable to Tracking Attack. The data IDA and IDB are transmitted in both step (1) and step (4) of verification phase. An adversary can track institutions A and B easily from the identity (IDA and IDB); thus the scheme is vulnerable to tracking attack.(3) Inefficiency. The scheme needs 16 exponentiations; therefore the computation cost of Lin-Lee’s scheme is inefficiency.


## 3. Preliminary

### 3.1. Notations

Notations section shows the notations used in our protocol, whereSIDX=h(IDX,πX,TX) is the pseudo ID of X, DUV is a data encrypted by V using symmetric key encryption algorithm and sent to U from V, and X, U, and V represent medical institutions A, B, or server S.


### 3.2. Attacker Model

In our scheme, we assume that the channels betweenA and S, B and S, and A and B are insecure. Any identity communicates with each other via an insecure public channel, offering adversaries opportunities to intercept. In the following, we present the assumptions of the attacker model [18–21].(1)
An adversary may eavesdrop on all communications between protocol actors over the public channel.(2)
An attacker can modify, delete, resend, and reroute the eavesdropped message.(3)
An attacker cannot be a legitimate server.(4)
The attacker knows the protocol description, which means the protocol is public.


### 3.3. Security Requirements

The security requirements of our proposed scheme are listed as follows:(1)
Data integrity: an adversary cannot alter the transmitted data without being detected.(2)
Anonymity: an adversary cannot know the identities of medical institutions through the eavesdropped data.(3)
Authenticity: any participant can authenticate other participants including the server.(4)
Medical record confidentiality: an adversary (including the server) cannot disclose any medical records.(5)
Medical record nonforgeability: an adversary cannot successfully forge electronic medical records.(6)
Resistance to asynchronous attacks: the system can process a successful authentication even if the data stored in participants’ database may be asynchronous when a session cannot be normally completed.(7)
Resistance to tracking attack: an adversary cannot trace the medical institutionA or B through the eavesdropped data.


## 3.1. Notations

Notations section shows the notations used in our protocol, whereSIDX=h(IDX,πX,TX) is the pseudo ID of X, DUV is a data encrypted by V using symmetric key encryption algorithm and sent to U from V, and X, U, and V represent medical institutions A, B, or server S.


## 3.2. Attacker Model

In our scheme, we assume that the channels betweenA and S, B and S, and A and B are insecure. Any identity communicates with each other via an insecure public channel, offering adversaries opportunities to intercept. In the following, we present the assumptions of the attacker model [18–21].(1)
An adversary may eavesdrop on all communications between protocol actors over the public channel.(2)
An attacker can modify, delete, resend, and reroute the eavesdropped message.(3)
An attacker cannot be a legitimate server.(4)
The attacker knows the protocol description, which means the protocol is public.


## 3.3. Security Requirements

The security requirements of our proposed scheme are listed as follows:(1)
Data integrity: an adversary cannot alter the transmitted data without being detected.(2)
Anonymity: an adversary cannot know the identities of medical institutions through the eavesdropped data.(3)
Authenticity: any participant can authenticate other participants including the server.(4)
Medical record confidentiality: an adversary (including the server) cannot disclose any medical records.(5)
Medical record nonforgeability: an adversary cannot successfully forge electronic medical records.(6)
Resistance to asynchronous attacks: the system can process a successful authentication even if the data stored in participants’ database may be asynchronous when a session cannot be normally completed.(7)
Resistance to tracking attack: an adversary cannot trace the medical institutionA or B through the eavesdropped data.


## 4. Proposed Scheme

In this section, we propose a new three-party authentication scheme to achieve the functional requirements outlined in Definition1 and the security goals outlined in Definition 2. The procedure of the proposed scheme is shown in Figure 5.Figure 5
Procedure of the proposed scheme.Definition 1 (functional requirements of our scheme).
Our scheme features three roles: medical institutionA, medical institution B, and authentication server S. Our scheme is functional if it provides that (1) A, B, and S can authenticate each other; (2) A and B can obtain a common session key; (3) A and B can exchange electronic medical records; (4) S is not required to have a public key; and (5) it is efficient to implement.Definition 2 (security requirements of our scheme).
Our scheme is secure if it achieves the following: (1) data integrity, (2) anonymity, (3) authenticity, (4) medical record confidentiality, (5) medical record nonforgeability, (6) resistance to asynchronous attacks, and (7) resistance to tracking attacks.


### 4.1. Initialization Phase

This phase establishes the required parameters.(1)
The system chooses one large prime numberp.(2)
The system chooses one primitive rootg modulo p.(3)
A and B each chooses a random number, respectively, xA and xB∈RZp-1∗ and, respectively, computes yA=gxAmod⁡p, yB=gxBmod⁡p.(4)
A and B, respectively, generate symmetric keys πA and πB and use them to register with S.(5)
A and B, respectively, compute SIDA=h(IDA,πA,0) and SIDB=h(IDB,πB,0).(6)
S stores IDX, πX, and SIDX=h(IDX,πX,0), where X=A or B.


### 4.2. Verification Phase

This phase presents the process of mutual authentication, key exchange, and data transmission amongA, B, and S.(1)
A→S:TA,DSA,SIDA: A obtains the current time TA, computes DSA=EπA(TA,IDB,yA), and sends TA, DSA, and SIDA to S.(2)
S authenticates A: S verifies whether Tth1<T(c)-TA<Tth2 holds, uses SIDA to find IDA, decrypts DSA via key πA to obtain TA′, IDB′, and yA′, and evaluates whether TA′ equals TA. If it is, the identity of A is authenticated.(3)
S updates BSIDA: S updates BSIDA←SIDA.(4)
S updates SIDA: S updates SIDA←h(IDA,πA,TA).(5)
S→B:TS,DBS: S obtains the current time TS, uses IDB′ to find πB, computes DBS=EπB(TS,yA′), and sends TS and DBS to B.(6)
B authenticates S: B verifies whether Tth1<T(c)-TS<Tth2 holds, decrypts DBS via key πB to obtain TS′ and yA′′, and evaluates whether TS equals TS′. If so, the identity of S is authenticated.(7)
B→S:DSB: B computes DSB=EπB(TS+1,yB) and sends DSB to S.(8)
S authenticates B: S decrypts DSB via key πB to obtain TS′+1 and yB′ and evaluates whether TS′+1 equals TS+1. If so, the identity of B is authenticated.(9)
S→A:DAS: S computes DAS=EπA(TA′+1,yB′,TS) and sends DAS to A.(10)
A authenticates S: A decrypts DAS via key πA to obtain TA′′+1, yB′′, and TS′′ and evaluates whether TA′′+1 equals TA+1. If so, the identity of S is authenticated. A then computes KAB=yB′′XAmod⁡p.(11)
A→B:DBA: A computes DBA=EKAB(TS′′+2,DataAB) and sends DBA to B.(12)
A updates SIDA: A updates SIDA←h(IDA,πA,TA).(13)
B authenticates A: B computes KBA=yA′′XBmod⁡p, decrypts DBA via key KBA to obtain TS′′′+2 and DataAB′, and evaluates whether TS′′′+2 equals TS+2. If so, the identity of A is authenticated, while the data DataAB′ is also obtained.(14)
B→A:DAB: B computes DAB=EKBA(TS+3,DataBA) and sends DAB to A.(15)
A authenticates B: A decrypts DAB via key KAB to obtain TS′′′′+3 and DataBA′ and evaluates whether TS′′′′+3 equals TS′′+3. If so, the identity of B is authenticated, while the data DataBA′ is also obtained.


## 4.1. Initialization Phase

This phase establishes the required parameters.(1)
The system chooses one large prime numberp.(2)
The system chooses one primitive rootg modulo p.(3)
A and B each chooses a random number, respectively, xA and xB∈RZp-1∗ and, respectively, computes yA=gxAmod⁡p, yB=gxBmod⁡p.(4)
A and B, respectively, generate symmetric keys πA and πB and use them to register with S.(5)
A and B, respectively, compute SIDA=h(IDA,πA,0) and SIDB=h(IDB,πB,0).(6)
S stores IDX, πX, and SIDX=h(IDX,πX,0), where X=A or B.


## 4.2. Verification Phase

This phase presents the process of mutual authentication, key exchange, and data transmission amongA, B, and S.(1)
A→S:TA,DSA,SIDA: A obtains the current time TA, computes DSA=EπA(TA,IDB,yA), and sends TA, DSA, and SIDA to S.(2)
S authenticates A: S verifies whether Tth1<T(c)-TA<Tth2 holds, uses SIDA to find IDA, decrypts DSA via key πA to obtain TA′, IDB′, and yA′, and evaluates whether TA′ equals TA. If it is, the identity of A is authenticated.(3)
S updates BSIDA: S updates BSIDA←SIDA.(4)
S updates SIDA: S updates SIDA←h(IDA,πA,TA).(5)
S→B:TS,DBS: S obtains the current time TS, uses IDB′ to find πB, computes DBS=EπB(TS,yA′), and sends TS and DBS to B.(6)
B authenticates S: B verifies whether Tth1<T(c)-TS<Tth2 holds, decrypts DBS via key πB to obtain TS′ and yA′′, and evaluates whether TS equals TS′. If so, the identity of S is authenticated.(7)
B→S:DSB: B computes DSB=EπB(TS+1,yB) and sends DSB to S.(8)
S authenticates B: S decrypts DSB via key πB to obtain TS′+1 and yB′ and evaluates whether TS′+1 equals TS+1. If so, the identity of B is authenticated.(9)
S→A:DAS: S computes DAS=EπA(TA′+1,yB′,TS) and sends DAS to A.(10)
A authenticates S: A decrypts DAS via key πA to obtain TA′′+1, yB′′, and TS′′ and evaluates whether TA′′+1 equals TA+1. If so, the identity of S is authenticated. A then computes KAB=yB′′XAmod⁡p.(11)
A→B:DBA: A computes DBA=EKAB(TS′′+2,DataAB) and sends DBA to B.(12)
A updates SIDA: A updates SIDA←h(IDA,πA,TA).(13)
B authenticates A: B computes KBA=yA′′XBmod⁡p, decrypts DBA via key KBA to obtain TS′′′+2 and DataAB′, and evaluates whether TS′′′+2 equals TS+2. If so, the identity of A is authenticated, while the data DataAB′ is also obtained.(14)
B→A:DAB: B computes DAB=EKBA(TS+3,DataBA) and sends DAB to A.(15)
A authenticates B: A decrypts DAB via key KAB to obtain TS′′′′+3 and DataBA′ and evaluates whether TS′′′′+3 equals TS′′+3. If so, the identity of B is authenticated, while the data DataBA′ is also obtained.


## 5. Security Analysis

In this section, we analyze our protocol according to the security requirements defined in Section3.3. The proof uses security reduction similar to that used in the random oracle model [22]. In other words, based on the security goal and attacker model, we prove that “if one claimed security property of our scheme is broken then oneatomic primitive is broken,” where the atomic primitive means some basic cryptographic algorithm or hard mathematical problem. Therefore, our scheme provides this claimed security property since the atomic primitive is assumed to be secure.


### 5.1. Data Integrity

If the transmitted dataDUV is altered, postdecryption verification will fail, thus ensuring data integrity. Theorem 4 proves the property of data integrity from Definition 3.Definition 3 (modified symmetric encryption problem).
Letx,y,y′∈Z,  c=Ekx,y, and c′=Ekx,y′, where y≠y′. If c′ and y′ can be evaluated from given x and c, then we say the modified symmetric encryption problem is solved (the probability of solving this problem is denoted as Pr(c′,y′∣x,c)=ε1).Theorem 4 (data integrity).
In our scheme, if an adversary can change(DataAB,DBA) to (DataAB′,DBA′) successfully, then the modified symmetric encryption problem can be solved.Proof.
In our scheme, assume an adversary tries to change(DataAB,DBA) to (DataAB′,DBA′) from eavesdropped TS and DBA. Let RO1 be a random oracle: input TS and DBA to output DataAB′ and DBA′ such that DKAB(DBA′)=(TS+2,DataAB′), where DBA′≠DBA (i.e., RO1(TS,DBA)⇒DataAB′,DBA′:DKAB(DBA′)=(TS+2,DataAB′)). In Definition 3, let kAB←k and  DataAB←y, and let TS←x-2,  DBA←c be input parameters of RO1 and obtain output DataAB′ and DBA′. Let y′←DataAB′ and c′←DBA′; then y′ is evaluated. Therefore, Pr(DataAB′,DBA′∣TS,DBA)≤Pr(c′,y′∣x,c)=ε1, which means the modified symmetric encryption problem can be solved if RO1 exists.


### 5.2. Anonymity

If the attacker wants to obtainIDA or IDB, he has to use SIDA or DSA to evaluate them. However, IDA cannot be evaluated from SIDA←h(IDA,πA,TA) because of the nonreversible one-way hash function. Moreover, evaluating IDB requires decrypting DSA=EπA(TA,IDB,yA) using the key πX, which is not obtained or evaluated through the eavesdropped data, therefore ensuring anonymity. Theorem 6 proves the property of data integrity from Definition 5.Definition 5 (modified hash problem).
Leta,b,c∈Z, and d=h(a,b,c). If a can be evaluated from given d and c, then we say the modified hash problem is solved (the probability of solving this problem is denoted as Pr(a∣d,c)=ε2).Theorem 6 (anonymity).
In our scheme, if an administrator can obtainIDA from SIDA and TA, then the modified hash problem can be solved.Proof.
In our scheme, assume an adversary tries to evaluateIDA from eavesdropped SIDA and TS. Let RO2 be a random oracle: input TS and SIDA to output IDA (i.e., RO2(TS,SIDA)⇒IDA). In Definition 5, let πA←b, and let TS←c and SIDA←d be input parameters of RO2 and obtain output IDA. Let a←IDA; then a is evaluated. Therefore, Pr(IDA∣SIDA,TS)≤Pr(a∣d,c)=ε2, which means the modified hash problem can be solved if RO2 exists.


### 5.3. Authenticity

Authenticating a participant requires evaluating whetherTX is equal to TX′. Although an adversary can create a new TX or obtain TX through the eavesdropped data, he cannot obtain πX or KUV to decrypt TX to achieve successful authentication, therefore ensuring authenticity. Theorem 8 proves the property of data integrity from Definition 7.Definition 7 (joint modified symmetric encryption problem).
Letai,b,c,di∈Z and di=Ek(ai,b,c), where i=1,2,…,n+1. If (an+1,dn+1) can be evaluated from given c and (aj,dj), then we say the joint modified symmetric encryption problem is solved, where j=1,2,…,n (the probability of solving this problem is denoted as Pran+1,dn+1∣c,aj,dj=ε3).Theorem 8 (authenticity).
In our scheme, ifDSA and TA can be forged, then the joint modified symmetric encryption problem can be solved.Proof.
In our scheme, assume an adversary tries to evaluateTA(n+1),DSA(n+1) to forge the identity of A from yA and eavesdropped (TA(i),DSA(i)),  i=1,2,…,n. Let RO3 be a random oracle: input TA(i),DSA(i),yA to output DSA(n+1),TA(n+1),  i=1,2,…,n (i.e., RO3((TA(i),DSA(i)),yA)⇒TA(n+1),DSA(n+1)). In Definition 7, let TA(i)←ai, DSA(i)←di, and yA←c be input parameters of RO3 and obtain output DSA(n+1),TA(n+1), i=1,2,…,n. Let dn+1←DSA(n+1) and  an+1←TA(n+1), and then (an+1,dn+1) are evaluated. Therefore, PrDSAn+1,TAn+1∣DSAi,TAi,yA≤Pran+1,dn+1∣c,aj,dj=ε3, which means the joint modified symmetric encryption problem can be solved if RO3 exists.


### 5.4. Medical Record Confidentiality

Obtaining medical records requires using the session keyKAB (or KBA) to decrypt DBA (or DAB), where the session key is generated from one’s own private key xA (or xB) and the public key yB (or yA) of the opposite side. An attacker can neither evaluate the private keys xA or xB, nor obtain the public keys yB or yA due to anonymity. Therefore, the scheme ensures medical record confidentiality. Theorem 10 proves the property of data integrity from Definition 9.Definition 9 (second modified symmetric problem).
Letx,y∈Z, and c=Ek(x,y). If y can be evaluated from given x and c, then we say the second modified symmetric problem is solved (the probability of solving this problem is denoted as Pr(y∣x,c)=ε4).Theorem 10 (medical record confidentiality).
In our scheme, if attacker can obtainDataAB, then the second modified symmetric problem can be solved.Proof.
In our scheme, assume an adversary tries to obtainDataAB from eavesdropped TS and DBA. Let RO4 be a random oracle: input TS and DBA to output DataAB (i.e., RO4(TS,DBA)⇒DataAB). In Definition 9, let TS←x and DBA←c be input parameters of RO4 and obtain output DataAB. Let y←DataAB, then y is evaluated. Therefore, Pr(DataAB∣TS,DBA)≤Pr(y∣x,c)=ε4, which means the second modified symmetric problem can be solved if RO4 exists.


### 5.5. Medical Record Nonforgeability

After decryptingDAB (or DBA), A (or B) have to authenticate each other via checking TS′′′′+3=?TS′′+3 (or TS′′′+2=?TS+2). If an attacker wants to forge a medical record DataBA (or DataAB), he/she has to evaluate the session key KAB (or KBA) to encrypt both DataBA and TS+3 (or both DataAB and TS′′+2). Since the attacker cannot evaluate the session key, our scheme provides medical record nonforgeability. Theorem 12 proves the property of data integrity from Definition 11.Definition 11 (second joint modified symmetric encryption problem).
Letxi,yi∈Z and ci=Ek(xi,yi),  i=1,2,…,n+1. If cn+1 can be evaluated from given xn+1 and (xj,cj),  j=1,2,…,n, then we say the second joint modified symmetric encryption problem is solved (the probability of solving this problem is denoted as Pr(cn+1∣(xj,cj),xn+1)=ε5).Theorem 12 (medical record nonforgeability).
In our scheme, ifDBA can be modified successfully, then the second joint modified symmetric encryption problem can be solved.Proof.
In our scheme, assume an adversary tries to forgeDBA(n+1) from TS(n+1) and eavesdropped (TS(i),DBA(i)),  i=1,2,…,n. Let RO5 be a random oracle: input TS(n+1) and (TS(i),DBA(i)) to output DBA(n+1) (i.e., RO5((TS(i),DBA(i)),TS(n+1))⇒DBA(n+1)). In Definition 11, let TS(i)←xi-2,  DBA(i)←ci and TS(n+1)←xn+1-2 be input parameters of RO5 and obtain output DBA(n+1). Let cn+1←DBA(n+1), then cn+1 is evaluated. Therefore, Pr(DBA(n+1)∣(TS(i),DBA(i)),TS(n+1))≤Pr(cn+1∣(xi,ci),xn+1)=ε5, which means the second joint modified symmetric encryption problem can be solved if RO5 exists.


### 5.6. Resistance to Asynchronous Attacks

If an attacker wants to block a communication to make an asynchronous attack, he/she can use the following methods to causeA andS to update SIDA asynchronously, causing the system fail in the future.(A)
BlockingA→S:TA,DSA,SIDA: if S does not receive the data sent from A, S does not update SIDA and BSIDA, nor does A update SIDA. Therefore, an asynchronous attack based on this blocking method will fail.(B)
BlockingS→A:DAS: if A does not receive the data sent from S, A will not update SIDA. In the next authentication session, S will use BSIDA to determine the information of IDA. Therefore, this blocking method is resisted.(C)
BlockingS→B or B→S: blocking S→B or B→S has the same result as blocking S→A:DAS which prevents asynchronous attacks.(D)
BlockingA→B or B→A: blocking A→B or B→A does not affect any update of SIDA.


### 5.7. Resistance to Tracking Attack

SinceSIDX←h(IDX,πX,TX) changes in each round and the relationship between the previous and current SIDX and TX cannot be found, where X=A or B, the scheme is resistant to tracking attacks. Theorem 14 proves the property of data integrity from Definition 13.Definition 13 (modified hash problem).
Letai,bi,ci∈Z,  di=h(ai,bi,ci),  i=1,2. If Equal(a1,a2) can be evaluated from given d1,d2,c1, and c2, then we say the modified hash problem is solved, where Equalx,y=1,ifx=y;0,otherwise (the probability of solving this problem is denoted as Pr(Equal(a1,a2)∣d1,d2,c1,c2)=ε6).Theorem 14 (resistance to tracking attack).
In our scheme, if attacker can evaluateEqual(IDA(i),IDA(j)), then the modified hash problem can be solved.Proof.
In our scheme, assume an adversary tries to evaluateEqual(IDA(i),IDA(j)) to track user A from eavesdropped SIDA(i), SIDA(j), TA(i), and TA(j). Let RO6 be a random oracle: input SIDA(i), SIDA(j), TA(i), and TA(j) to output Equal(IDA(i),IDA(j)) (i.e., RO6(SIDA(i),SIDA(j),TA(i),TA(j))⇒Equal(IDA(i),IDA(j))). In Definition 13, let SIDA(i)←di,  SIDA(j)←dj,  TA(i)←ci, and TA(j)←cj be input parameters of RO6 and obtain output Equal(IDA(i),IDA(j)). Let Equal(a1,a2)←Equal(IDA(i),IDA(j)), then Equal(a1,a2) is evaluated. Therefore, Pr(Equal(IDA(i),IDA(j))∣SIDA(i),SIDA(j),TA(i),TA(j))≤Pr(Equal(a1,a2)∣d1,d2,c1,c2)=ε6, which means the modified hash problem can be solved if RO6 exists.


## 5.1. Data Integrity

If the transmitted dataDUV is altered, postdecryption verification will fail, thus ensuring data integrity. Theorem 4 proves the property of data integrity from Definition 3.Definition 3 (modified symmetric encryption problem).
Letx,y,y′∈Z,  c=Ekx,y, and c′=Ekx,y′, where y≠y′. If c′ and y′ can be evaluated from given x and c, then we say the modified symmetric encryption problem is solved (the probability of solving this problem is denoted as Pr(c′,y′∣x,c)=ε1).Theorem 4 (data integrity).
In our scheme, if an adversary can change(DataAB,DBA) to (DataAB′,DBA′) successfully, then the modified symmetric encryption problem can be solved.Proof.
In our scheme, assume an adversary tries to change(DataAB,DBA) to (DataAB′,DBA′) from eavesdropped TS and DBA. Let RO1 be a random oracle: input TS and DBA to output DataAB′ and DBA′ such that DKAB(DBA′)=(TS+2,DataAB′), where DBA′≠DBA (i.e., RO1(TS,DBA)⇒DataAB′,DBA′:DKAB(DBA′)=(TS+2,DataAB′)). In Definition 3, let kAB←k and  DataAB←y, and let TS←x-2,  DBA←c be input parameters of RO1 and obtain output DataAB′ and DBA′. Let y′←DataAB′ and c′←DBA′; then y′ is evaluated. Therefore, Pr(DataAB′,DBA′∣TS,DBA)≤Pr(c′,y′∣x,c)=ε1, which means the modified symmetric encryption problem can be solved if RO1 exists.


## 5.2. Anonymity

If the attacker wants to obtainIDA or IDB, he has to use SIDA or DSA to evaluate them. However, IDA cannot be evaluated from SIDA←h(IDA,πA,TA) because of the nonreversible one-way hash function. Moreover, evaluating IDB requires decrypting DSA=EπA(TA,IDB,yA) using the key πX, which is not obtained or evaluated through the eavesdropped data, therefore ensuring anonymity. Theorem 6 proves the property of data integrity from Definition 5.Definition 5 (modified hash problem).
Leta,b,c∈Z, and d=h(a,b,c). If a can be evaluated from given d and c, then we say the modified hash problem is solved (the probability of solving this problem is denoted as Pr(a∣d,c)=ε2).Theorem 6 (anonymity).
In our scheme, if an administrator can obtainIDA from SIDA and TA, then the modified hash problem can be solved.Proof.
In our scheme, assume an adversary tries to evaluateIDA from eavesdropped SIDA and TS. Let RO2 be a random oracle: input TS and SIDA to output IDA (i.e., RO2(TS,SIDA)⇒IDA). In Definition 5, let πA←b, and let TS←c and SIDA←d be input parameters of RO2 and obtain output IDA. Let a←IDA; then a is evaluated. Therefore, Pr(IDA∣SIDA,TS)≤Pr(a∣d,c)=ε2, which means the modified hash problem can be solved if RO2 exists.


## 5.3. Authenticity

Authenticating a participant requires evaluating whetherTX is equal to TX′. Although an adversary can create a new TX or obtain TX through the eavesdropped data, he cannot obtain πX or KUV to decrypt TX to achieve successful authentication, therefore ensuring authenticity. Theorem 8 proves the property of data integrity from Definition 7.Definition 7 (joint modified symmetric encryption problem).
Letai,b,c,di∈Z and di=Ek(ai,b,c), where i=1,2,…,n+1. If (an+1,dn+1) can be evaluated from given c and (aj,dj), then we say the joint modified symmetric encryption problem is solved, where j=1,2,…,n (the probability of solving this problem is denoted as Pran+1,dn+1∣c,aj,dj=ε3).Theorem 8 (authenticity).
In our scheme, ifDSA and TA can be forged, then the joint modified symmetric encryption problem can be solved.Proof.
In our scheme, assume an adversary tries to evaluateTA(n+1),DSA(n+1) to forge the identity of A from yA and eavesdropped (TA(i),DSA(i)),  i=1,2,…,n. Let RO3 be a random oracle: input TA(i),DSA(i),yA to output DSA(n+1),TA(n+1),  i=1,2,…,n (i.e., RO3((TA(i),DSA(i)),yA)⇒TA(n+1),DSA(n+1)). In Definition 7, let TA(i)←ai, DSA(i)←di, and yA←c be input parameters of RO3 and obtain output DSA(n+1),TA(n+1), i=1,2,…,n. Let dn+1←DSA(n+1) and  an+1←TA(n+1), and then (an+1,dn+1) are evaluated. Therefore, PrDSAn+1,TAn+1∣DSAi,TAi,yA≤Pran+1,dn+1∣c,aj,dj=ε3, which means the joint modified symmetric encryption problem can be solved if RO3 exists.


## 5.4. Medical Record Confidentiality

Obtaining medical records requires using the session keyKAB (or KBA) to decrypt DBA (or DAB), where the session key is generated from one’s own private key xA (or xB) and the public key yB (or yA) of the opposite side. An attacker can neither evaluate the private keys xA or xB, nor obtain the public keys yB or yA due to anonymity. Therefore, the scheme ensures medical record confidentiality. Theorem 10 proves the property of data integrity from Definition 9.Definition 9 (second modified symmetric problem).
Letx,y∈Z, and c=Ek(x,y). If y can be evaluated from given x and c, then we say the second modified symmetric problem is solved (the probability of solving this problem is denoted as Pr(y∣x,c)=ε4).Theorem 10 (medical record confidentiality).
In our scheme, if attacker can obtainDataAB, then the second modified symmetric problem can be solved.Proof.
In our scheme, assume an adversary tries to obtainDataAB from eavesdropped TS and DBA. Let RO4 be a random oracle: input TS and DBA to output DataAB (i.e., RO4(TS,DBA)⇒DataAB). In Definition 9, let TS←x and DBA←c be input parameters of RO4 and obtain output DataAB. Let y←DataAB, then y is evaluated. Therefore, Pr(DataAB∣TS,DBA)≤Pr(y∣x,c)=ε4, which means the second modified symmetric problem can be solved if RO4 exists.


## 5.5. Medical Record Nonforgeability

After decryptingDAB (or DBA), A (or B) have to authenticate each other via checking TS′′′′+3=?TS′′+3 (or TS′′′+2=?TS+2). If an attacker wants to forge a medical record DataBA (or DataAB), he/she has to evaluate the session key KAB (or KBA) to encrypt both DataBA and TS+3 (or both DataAB and TS′′+2). Since the attacker cannot evaluate the session key, our scheme provides medical record nonforgeability. Theorem 12 proves the property of data integrity from Definition 11.Definition 11 (second joint modified symmetric encryption problem).
Letxi,yi∈Z and ci=Ek(xi,yi),  i=1,2,…,n+1. If cn+1 can be evaluated from given xn+1 and (xj,cj),  j=1,2,…,n, then we say the second joint modified symmetric encryption problem is solved (the probability of solving this problem is denoted as Pr(cn+1∣(xj,cj),xn+1)=ε5).Theorem 12 (medical record nonforgeability).
In our scheme, ifDBA can be modified successfully, then the second joint modified symmetric encryption problem can be solved.Proof.
In our scheme, assume an adversary tries to forgeDBA(n+1) from TS(n+1) and eavesdropped (TS(i),DBA(i)),  i=1,2,…,n. Let RO5 be a random oracle: input TS(n+1) and (TS(i),DBA(i)) to output DBA(n+1) (i.e., RO5((TS(i),DBA(i)),TS(n+1))⇒DBA(n+1)). In Definition 11, let TS(i)←xi-2,  DBA(i)←ci and TS(n+1)←xn+1-2 be input parameters of RO5 and obtain output DBA(n+1). Let cn+1←DBA(n+1), then cn+1 is evaluated. Therefore, Pr(DBA(n+1)∣(TS(i),DBA(i)),TS(n+1))≤Pr(cn+1∣(xi,ci),xn+1)=ε5, which means the second joint modified symmetric encryption problem can be solved if RO5 exists.


## 5.6. Resistance to Asynchronous Attacks

If an attacker wants to block a communication to make an asynchronous attack, he/she can use the following methods to causeA andS to update SIDA asynchronously, causing the system fail in the future.(A)
BlockingA→S:TA,DSA,SIDA: if S does not receive the data sent from A, S does not update SIDA and BSIDA, nor does A update SIDA. Therefore, an asynchronous attack based on this blocking method will fail.(B)
BlockingS→A:DAS: if A does not receive the data sent from S, A will not update SIDA. In the next authentication session, S will use BSIDA to determine the information of IDA. Therefore, this blocking method is resisted.(C)
BlockingS→B or B→S: blocking S→B or B→S has the same result as blocking S→A:DAS which prevents asynchronous attacks.(D)
BlockingA→B or B→A: blocking A→B or B→A does not affect any update of SIDA.


## 5.7. Resistance to Tracking Attack

SinceSIDX←h(IDX,πX,TX) changes in each round and the relationship between the previous and current SIDX and TX cannot be found, where X=A or B, the scheme is resistant to tracking attacks. Theorem 14 proves the property of data integrity from Definition 13.Definition 13 (modified hash problem).
Letai,bi,ci∈Z,  di=h(ai,bi,ci),  i=1,2. If Equal(a1,a2) can be evaluated from given d1,d2,c1, and c2, then we say the modified hash problem is solved, where Equalx,y=1,ifx=y;0,otherwise (the probability of solving this problem is denoted as Pr(Equal(a1,a2)∣d1,d2,c1,c2)=ε6).Theorem 14 (resistance to tracking attack).
In our scheme, if attacker can evaluateEqual(IDA(i),IDA(j)), then the modified hash problem can be solved.Proof.
In our scheme, assume an adversary tries to evaluateEqual(IDA(i),IDA(j)) to track user A from eavesdropped SIDA(i), SIDA(j), TA(i), and TA(j). Let RO6 be a random oracle: input SIDA(i), SIDA(j), TA(i), and TA(j) to output Equal(IDA(i),IDA(j)) (i.e., RO6(SIDA(i),SIDA(j),TA(i),TA(j))⇒Equal(IDA(i),IDA(j))). In Definition 13, let SIDA(i)←di,  SIDA(j)←dj,  TA(i)←ci, and TA(j)←cj be input parameters of RO6 and obtain output Equal(IDA(i),IDA(j)). Let Equal(a1,a2)←Equal(IDA(i),IDA(j)), then Equal(a1,a2) is evaluated. Therefore, Pr(Equal(IDA(i),IDA(j))∣SIDA(i),SIDA(j),TA(i),TA(j))≤Pr(Equal(a1,a2)∣d1,d2,c1,c2)=ε6, which means the modified hash problem can be solved if RO6 exists.


## 6. Comparison

This section compares the performance of our proposed method with previous verifier-based three-party authentication and key agreement (3PAKA) protocols without server public keys in terms of two aspects: computation and communication loadings (as shown in Table1) and system properties (as shown in Table 2). From Table 1, our scheme is superior to previous schemes in terms of computation and communication performance. Table 2 shows that, unlike other schemes, our proposed scheme provides anonymity and resistance to tracking attacks. Therefore, our scheme is superior to previous schemes in terms of security.Table 1
Comparison of computation and communication costs with verifier-based 3PAKA schemes without server public keys.
Lee et al.’s scheme [8]
Wang-Mo’s scheme [9]
Kwon et al.’s scheme [10]
Lin-Lee’s scheme [7]
Our scheme
A
B
S
A
B
S
A
B
S
A
B
S
A
B
S
Exponentiation
3
4
4
4
4
6
4
4
10
4
4
6
1
1
0
X-or
1
1
2
1
1
2
0
0
0
1
1
2
0
0
0
Multip./division
0
0
0
0
0
0
3
3
4
0
0
0
0
0
0
Random number
1
1
2
1
1
2
1
1
4
1
1
2
0
0
0
Hash
3
3
4
3
3
4
3
3
4
4
4
4
1
0
1
Encryption/decryption
0
0
0
0
0
0
0
0
0
0
0
0
4
4
2
Transmission messages
3
6
4
3
6
4
3
10
3
6
7
4
4
2
3
Transmission rounds
2
3
4
2
3
4
2
4
2
4
4
4
2
2
2Table 2
Security comparison with verifier-based 3PAKA schemes w/o server public keys.
Property
Lee et al.’sscheme [8]
Wang-Mo’sscheme [9]
Kwon et al. ’sscheme [10]
Lin-Lee’sscheme [7]
Our scheme
Resistance to password guessing attacks
✓
✓
✓
✓
✓
Resistance to verifier stolen attacks
✓
✓
✓
✓
Key confirmation
✓
✓
Resistance to impersonation attacks
✓
✓
Anonymity
✓
Resistance to tracking attacks
✓
Efficiency of implementation
✓Moreover, in Tables3 and 4, we compare our proposed method with previous RSA-based 3PAKA schemes in terms of computation and communication loadings and system properties. Our protocol is a secure scheme providing 3PAKA and data exchange in medical environment, and the computation and communication loadings for providing only 3PAKA (without data exchange) in our scheme are different (lesser). In Table 4, Chang et al.’s [11] and Tso’s [12] schemes do not support mutual authentication, and Deebak et al.’s scheme [14] requires clients to logon the system successfully before starting the 3PAKA protocol in each time. In the logon phase of Deebak et al.’s scheme [14], each IP multimedia system (IMS) client enters his/her credentials into the registration form to avail the multimedia services, like video, voice, and data, and subsequently, the IMS server executes some steps to verify whether the client authorization is success or not. Moreover, each client has to perform two hash and two XOR functions in the logon phase, and the server has to perform four inverse computations in the authentication phase. Furthermore, we also compare our proposed method with other recently published 3PAKA schemes in terms of computation and communication loadings (Table 5) and system properties (Table 6). The schemes [15, 16] are smart card based schemes and some of their security and efficiency are based on smart cards. The properties “resistance to verifier-stolen attacks” of the schemes [11–13, 17] are all “N/A” because they are password-based schemes without verifiers. From Tables 3–6, our scheme is superior to previous RSA-based and other recently published 3PAKA schemes in terms of security and computation and communication performance.Table 3
Comparison of computation and communication costs with RSA-based 3PAKA schemes.
Chang et al.’s scheme [11]
Tso’s scheme [12]
Farash  and  Attari’s scheme [13]
Deebak et al.’s scheme [14]
Our scheme
A
B
S
A
B
S
A
B
S
A
B
S
A
B
S
Exponentiation
3
2
3
3
3
4
3
2
2
1
1
2
1
1
0
X-or
1
1
2
0
0
4
0
0
0
2
2
2
0
0
0
Multip./division
0
0
0
0
0
0
2
2
0
0
0
0
0
0
0
Random number
1
1
2
1
1
2
1
1
2
0
0
0
0
0
0
Hash
4
2
4
4
2
4
4
3
5
6
6
4
0
0
1
Encryption/decryption
0
0
0
0
0
0
0
0
0
0
0
0
2
2
2
Transmission messages
8
5
5
8
5
6
5
3
9
3
6
10
3
1
3
Transmission rounds
3
1
2
3
1
2
2
1
3
1
1
2
1
1
2Table 4
Security comparison with RSA-based 3PAKA schemes.
Property
Chang et al.’s scheme [11]
Tso’s scheme [12]
Farash and Attari’s scheme [13]
Deebak et al.’s scheme [14]
Our scheme
Resistance to password guessing attacks
✓
✓
✓
✓
✓
Resistance to verifier stolen attacks
N/A
N/A
N/A
✓
✓
Key confirmation
✓
✓
✓
✓
✓
Resistance to impersonation attacks
✓
✓
✓
✓
✓
Anonymity
✓
Resistance to tracking attacks
✓
Efficiency of implementation
✓Table 5
Comparison of computation and communication costs with other 3PAKA schemes.
Chen et at.’s scheme [15]
Wang et al.’s scheme [16]
Farash et al.’s scheme [17]
Our scheme
A
B
S
A
B
S
A
B
S
A
B
S
Exponentiation
3
3
2
4
4
6
2
3
2
1
1
0
X-or
0
0
0
1
1
2
1
2
3
0
0
0
Multip./division
0
0
0
0
0
0
0
0
0
0
0
0
Random number
1
1
0
1
1
1
1
1
0
0
0
0
Hash
2
2
2
3
3
4
1
2
2
0
0
1
Encryption/decryption
0
0
0
2
2
3
0
0
0
2
2
2
Transmission messages
5
11
2
3
8
1
4
10
5
3
1
3
Transmission rounds
2
2
1
2
1
4
1
2
1
1
1
2Table 6
Security comparison with other 3PAKA schemes.
Property
Chen et at.’s scheme [15]
Wang et al.’s scheme [16]
Farash et at.’s scheme [17]
Our scheme
Resistance to password guessing attacks
✓
✓
✓
✓
Resistance to verifier stolen attacks
✓
✓
N/A
✓
Key confirmation
✓
✓
✓
✓
Resistance to impersonation attacks
✓
✓
✓
Anonymity
✓
✓
Resistance to tracking attacks
✓
✓
Efficiency of implementation
✓


## 7. Implementation

This section presents the implementation of our scheme in mobile phones (Android 4.1) and PCs (Windows 7). The mobile system is implemented on Google Nexus S with a 1 GHz processor and 512 MB RAM. The PC implementation used Windows 7 Professional with an Intel (R) core (TM) CPU i5-650 @3.2 Hz and 4 GB RAM. The serverS (Server 1) and the user B (Server 2) are implemented on Windows 7, while the user A (Telecare) is implemented on Android. The hash function used is SHA-256 [23] and the symmetric encryption algorithm is AES [24]. Figure 6 shows the scheme flow in terms of data transmission and Figure 7 shows the data transfer renderings.Figure 6
Application flowchart.Figure 7
Data transfer renderings.
(a)
Initial (on the endA)
(b)
Initial (on the endS)
(c)
Initial (on the endB)
(d)
Connected withS (on the end A)
(e)
Verification data received fromA (on the end S)
(f)
Verification data received fromS (on the end B)
(g)
Verification data received fromB (on the end S)
(h)
Verification data received fromS (on the end A)
(i)
(Verification) data received fromA (on the end B)
(j)
(Verification) data received fromB (on the end A)In our implementation, we assume that the system times of the serverS and the users A and B are synchronized. However, their system times are difficult to be synchronized. Fortunately, the experience in implementation shows that the system time difference between the server and the users is within miniseconds. By assuming the maximum system time difference between the clients and the server is 1000 miniseconds and the values Tc-TA and T(c)-TS are between 10 ms and 30 ms, we suggest to set Tth1 and Tth2 to −990 ms and 1030 ms, respectively (in real situation, the values T(c)-TA and Tc-TS are suggested to be measured again for much accuracy).


## 8. Conclusion

In this paper, we review Lin-Lee’s protocol and demonstrate its lack of anonymity and resistance to tracking attacks. We propose an enhanced three-party authentication scheme for use in telecare medicine information systems, which provides high standards of security issues and performance. The proposed scheme does not need server public keys, reduces computation costs, and resolves two significant security issues (anonymity and resistance to tracking attacks). Comparisons with other approaches show the proposed scheme provides improved security while incurring computational, communication, and transaction costs comparable to other methods.



---

*Source: 9146297-2018-01-02.xml*