面向远程医疗信息系统的安全高效匿名认证协议

Secure and Efficient Authentication Scheme for Telecare Medical Information Systems with Anonymity

电子医疗记录的普及和远程医疗信息系统(Telecare Medical Information Systems,TMIS)的推广使异地病人获得相同的医疗服务,改善病人的就医体验。为保证病人隐私信息通过TMIS在公开网络传输时得到保护,认证协议已成为TMIS不可或缺的一部分。分析最近提出的面向TMIS的双因素认证协议的安全性,指出其在智能卡丢失的情况下无法抵抗离线字典攻击,同时未实现真正的匿名性。为克服上述安全缺陷,提出安全性增强的匿名双因素认证协议。安全性和性能分析表明,所提协议以较小的计算开销为代价,为TMIS提供更高的安全性保证,因此更适合在TMIS中部署。

The popularity of electronic medical records and the spread of telecare medical information systems(TMIS)have made it possible for off-site patients to have access to the same medical services,which greatly improves the patient's medical experience.To ensure that patient privacy information is protected as it is transmitted over the public network,the authentication protocol has become an integral part of TMIS.This paper analyzes the security of a recently proposed two-factor authentication protocol for TMIS,and points out that it cannot resist offline dictionary attacks in the case of smart card loss,and also does not achieve true anonymity.To overcome the above security flaws,a security-enhanced anonymous two-factor authentication protocol is proposed.Security and performance analysis show that the proposed protocol provides a higher security guarantee for TMIS,at the cost of smaller computational overhead.Thus,it is more suitable for deployment in TMIS.