A more secure anonymous user authentication scheme for the integrated EPR information system

Area of Science:

• Computer Science
• Information Security
• Healthcare Informatics

Background:

• Secure user mutual authentication is critical for integrated electronic patient record (EPR) systems.
• Existing password-based smart card schemes for EPR systems face security challenges.
• Lee et al. proposed a scheme claimed to resist network attacks, including lost smart card attacks.

Purpose of the Study:

• To reanalyze the security of Lee et al.'s proposed password-based authentication scheme for EPR systems.
• To identify vulnerabilities in the existing scheme, particularly against off-line password guessing and user impersonation attacks.
• To propose a novel, more secure authentication scheme for integrated EPR information systems.

Main Methods:

• Security analysis of Lee et al.'s scheme, focusing on compromised smart card scenarios.
• Development of a new authentication scheme utilizing quadratic residues.
• Comparative security evaluation of the proposed scheme against known attacks.

Main Results:

• Lee et al.'s scheme is vulnerable to off-line password guessing attacks if the smart card is compromised.
• The identified vulnerabilities lead to insecure user impersonation.
• The proposed quadratic residue-based scheme effectively resists various network attacks and provides user anonymity.

Conclusions:

• Lee et al.'s scheme is not secure for integrated EPR information systems due to identified password guessing vulnerabilities.
• The newly proposed quadratic residue-based authentication scheme offers enhanced security and user anonymity.
• The new scheme provides a more robust solution for secure authentication in EPR systems.