A secure heterogeneous mobile authentication and key agreement scheme for e-healthcare cloud systems

Area of Science:

• Cybersecurity
• Cloud Computing
• Healthcare Informatics

Background:

• E-healthcare cloud servers rely on Public Key Infrastructure (PKI) for secure resource access.
• Traditional authentication methods require cloud servers to manage password tables, increasing management burden and information leakage risks.
• Mobile users often use passwords and portable devices for cloud access, posing security challenges.

Purpose of the Study:

• To propose a secure heterogeneous mobile authentication and key agreement scheme for e-healthcare cloud systems.
• To eliminate the need for e-healthcare cloud servers to store password tables.
• To enhance user anonymity and reduce computational costs in authentication processes.

Main Methods:

• Developed a novel authentication scheme using a security token hardware and an offline updatable password.
• Classified the scheme under dynamic ID authentication techniques to preserve user anonymity.
• Formally proved the scheme's security for authenticated key exchange (AKE).
• Utilized the AVISPA tool for automatic security validation and analysis of potential attacks.

Main Results:

• The proposed scheme enables e-healthcare cloud servers to operate without storing password tables.
• Legitimate users authenticate using a security token and an offline password, without needing a private key.
• The scheme ensures user anonymity during authentication processes.
• Formal proofs confirm the scheme's AKE security and lower computational costs.

Conclusions:

• The developed scheme offers a secure and efficient solution for heterogeneous mobile authentication in e-healthcare cloud environments.
• It addresses the limitations of traditional methods by removing password table dependencies and enhancing user privacy.
• The use of AVISPA validates the protocol's robustness against potential security threats.