Hindawi

Journal of Healthcare Engineering

Volume 2022, Article ID 1789996, 15 pages
https://doi.org/10.1155/2022/1789996

Review Article
Biometric Authentication for Intelligent and Privacy-Preserving
Healthcare Systems

Dhananjay Nigam ,1 Shilp Nirajbhai Patel ,1 P. M. Durai Raj Vincent ,2

Kathiravan Srinivasan ,1 and Sinouvassane Arunmozhi3
1
School of Computer Science and Engineering, Vellore Institute of Technology, Vellore, India
2
School of Information Technology and Engineering, Vellore Institute of Technology, Vellore, India
3
Department of Electronics and Communication Engineering, Manakula Vinayagar Institute of Technology, Puducherry, India

Correspondence should be addressed to Kathiravan Srinivasan; [email protected]

Received 11 January 2022; Revised 27 February 2022; Accepted 8 March 2022; Published 24 March 2022

Academic Editor: Sahfqat Ullah Khan

Copyright © 2022 Dhananjay Nigam et al. This is an open access article distributed under the Creative Commons Attribution
License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is
properly cited.

Secure identification is a critical system requirement for patients seeking health-related services. In the event of critical, aged, or
disabled patients who require frequent health treatments, quick and easy identification is vital. Researchers describe the notion of
the unprotected environment in this study, in which patients can receive health services from the hospital’s smart and intelligent
surroundings without the use of explicit equipment. Patients would interact directly with the environment and be identified
through it. We suggest a biometric-based authentication technique for the unprotected hospital environment that also safeguards
the patient’s identity privacy. Furthermore, we demonstrate that this authentication technique is resistant to many well-known
assaults, including insider attacks, replay attacks, and identity privacy. Doctors and other staff members showed enthusiastic
responses after installing 2-factor authentications, as it makes their workflow efficient and makes things easier for patients. It also
lets them focus on other factors rather than worrying about data security; hence, we need biometric authentication in intelligent
and privacy-preserving healthcare systems. The paper deals with two-factor biometric authentication, and despite the added
security, two-factor authentication adoption is said to be poor. It is due to a lack of awareness and difficulty to use and configure
two-factor authentication (2FA) into a particular application by some individuals who struggle with the concept of authentication
and its technology. Also, many 2FA methods in widespread use today have not been subjected to adequate usability testing.
Research focuses on the point that there is still a large section of people unaware of the use of biometric systems to protect their
online data. Researchers collected quantitative and qualitative data from 96 individuals during a two-week between-subjects
usability survey of some common and rarely used 2FA approaches. The survey allowed the researcher to investigate which
authentication methods are given higher priority and why, along with the relationship between different usage patterns and
perceived usability, and identify user misconceptions and insecure habits to determine ease of use. It was observed that the
biometric-based method was given the utmost preferability.

1. Introduction can be automatically identified based on their surroundings

and thus receive the appropriate services [1]. Electronic
Due to recent breakthroughs in Internet of things (IoT) and prescriptions for restricted medicines are heavily regulated
wireless sensor networks, there is a new digital paradigm and require a strong authentication system. Imprivata, a
shift. These technologies prove to be very useful, especially in healthcare company, developed a biometric-powered con-
the case of healthcare systems, thereby enhancing the well- firmation ID system that enables healthcare institutions to
being of people. With the help of this technology, the doctors meet their Drug Enforcement Administration criteria for
and the hospital staff can continuously monitor their pa- electronic prescriptions of restricted medicines. Ghana’s
tients without even being present with them. Elderly patients Health Ministry has already joined with Gavi to begin its
2 Journal of Healthcare Engineering

biometric-based national vaccination programs by the end user’s phone or steal a physical device to gain access to the
of 2021. account [7]. As a result, compromising an account protected
External devices such as laptops, cell phones, and tablets by a second authentication factor is far more difficult for a
can interact with the system; the user interface provided by remote attacker [8, 9]. However, these technologies still
these devices is pertinent. On the contrary, the wearable reside in an external gadget that might be stolen and hence
category is far better and more advanced than other devices. exploit the technology. So, we need a more transparent
The goal is to develop an intelligence technology in which technology such as biometric authentication, which stays
services are incorporated through sensors and are available with the user all the time and is very difficult to exploit.
when needed and disappear when not, removing the need Many biometric services are now under development
for the user to engage with the device. These cutting-edge and testing, to be widely used in a few years. Plastic cards will
technologies supply customers with a plethora of new op- soon be a thing of the past, and biometric scans will become
tions while also providing new revenue streams. Lightweight the norm. The publicity of biometrics appears to be a
security solutions are required to implement these devices concern. You have fingers, eyes, and a face, as everyone
because they include various sensitive resources. Figure 1 knows. On the other hand, open biometric data are only the
shows the architecture of a digital healthcare services. tip of the iceberg. Every imaginable attribute is being
Identifying a valid patient/user is a significant difficulty studied, from heart rate monitoring to implanting chips
in this type of unprotected setting. Traditional password- under your skin, as well as examining intraocular veins, the
based single-factor authentication systems are not suitable structure of your earlobes, and more.
and have some limitations. They are substantially weak when Two-factor authentication is a vast area, but this study
it comes to incorporating security in smart systems. As they focuses on biometric authentication: facial and speech
contain only a single factor, which consists of a pin or a recognition. The research is conducted because many people
password, it can be easily breached by brute-forcing or are unaware of the password-related risks and do not use
simply guessing the password. Hence, a more transparent 2FA for security. This hypothesis will be proved with the help
method such as biometric authentication should be incor- of a survey further in the paper. A two-week survey was done
porated, including face and speech recognition. using the Google Form, circulated among people using
The unique property of biometrics expands its use in different social platforms. The survey measures the aware-
authentication protocols. Some important advantages of ness of people from both technical and nontechnical
biometric keys are as follows: backgrounds and people from all age brackets. The partic-
ipants were from different parts of India. Researchers tried to
(i) A user cannot lose or forget the key
determine which of the following two-factor authentication
(ii) They are difficult to copy or forge methods were popular and easy to use. The study focuses on
(iii) They are tough to duplicate and transfer the following:
(iv) It cannot be guessed easily when compared to low- (i) Presents the increasing need for 2FA
entropy passwords (ii) Expounds the concept of biometric authentication
Password breaches, whether due to multiple password using face and speech recognition
database leaks or increasingly sophisticated phishing attacks, (iii) Explains the integration of this technology into
dramatically increase the risk of authentication credential intelligent and smart healthcare systems
vulnerability [2]. Worse, poor user password hygiene, such (iv) Presents diagrammatically the functioning of smart
as using passwords that are easily discovered such as birth wireless sensors integrated with biometric
dates, names, relatives’ names, and phone pins, or repeating authentication
them across several accounts, exacerbates these flaws [3].
Figure 2 depicts the healthcare IT topology for medical (v) Presents a survey analysis conducted in India, which
devices. gives insight into the awareness and usability of
Two-factor authentication (2FA), commonly known as biometrics
two-step verification or dual-factor authentication, is a se- The study covers a literature survey of various research
curity feature in which users must authenticate their identity articles and journals, survey analysis, scope: present scenario
using two different authentication factors [4]. 2FA is used to and future opportunities, open challenges, and future re-
protect a user’s credentials and the resources to which they search directions.
have access. Single-factor authentication (SFA), in which the
user provides only one factor (usually a password), provides
a lower level of security than 2FA [5]. 2FA gives the user a 1.1. Biometric Recognition. Humans normally identify be-
second factor that is either something they have (such as a tween persons using their faces, and recent advances in
hardware token or a phone) or something they are (referring computer vision capacity have enabled similar recognitions
to biometrics, such as facial recognition or fingerprint) [6]. It to be made automatically [10]. Face recognition algorithms
is the successor step after one has entered their credentials, used simple geometric models in the past, but they have
which corresponds to something they know (traditionally a evolved into a science of complex mathematical models and
password and a username), so even though an attacker steals representations throughout time, putting face and speech
or guesses a user’s password, they must compromise the recognition in the spotlight for verification and
Journal of Healthcare Engineering 3

Biometric
MPI
Technology
Patient Entry Patient Patient Nurse Patient Doctor
Registration See the
Vitals are
Doctor
important
Security Prevention
Techniques

Pharmacy Lab
Services

Mapping Biometrics
to MPI
Patient
Exit

Hospital
Information
System
Figure 1: Architecture of biometric authentication for digital healthcare services.

stream neural networks to aggregate data and build a cross

representation between high- and low-resolution images to
Medical Medical learn an appropriate feature mapping.
Wearable Embedded Significant investment is needed in biometrics for se-
Devices Devices curity. Machine learning and algorithms must be very ad-
Attributes: vanced to minimize biometric demographic bias. Some
Identifications biometric systems can face scanning issues if there is a slight
Location change, especially if the company is using retina scanning.
Sensing Hard biometrics consists of authentication using face, fin-
Connectivity gerprints, or signature. It is very easy nowadays to forge
Wearable
Stationary
Health another person’s fingerprint or signature. Getting a facial
Medical snapshot of a person is very easy, and by that way, face
Monitoring
Devices
Devices recognition can be easily breached. Soft biometrics include
voice recognition, eye color, and scars, which provide an-
cillary information but are not fully distinctive and per-
Figure 2: Healthcare IT topology for medical devices. manent [12].
Numerous symmetric key techniques have been pro-
identification [11]. The practice of comparing one biometric posed in the literature for smart card-based authentication
pattern to another to determine whether it should be on single-server and multi-server architectures. In addition
rejected or accepted is known as verification. Figure 3 shows to smart card-based authentication, the literature describes
the steps for authentication and verification. three-factor authentication techniques that involve bio-
metrics. However, biometric information integration is
2. Literature Review bound to be a fixed string and implemented similarly to
password introduction. These smart card-based procedures
Previous research has looked into using extremely low- can easily be transformed into the biometric form and vice
resolution photographs to accomplish activity recognition versa. Most of the suggested smart card-based and bio-
while maintaining anonymity. Low-resolution action rec- metric-based authentication methods are unsafe for well-
ognition based on the shape of the human head to guide known attacks such as stolen smart card attacks, replay
body position estimate is proposed in one paper (Privacy- attacks, user impersonation attacks, and insider attacks. A
Preserving Action Recognition for Smart Hospitals Using novel security system with identity privacy and untrace-
Low-Resolution Depth Images). Inverse super-resolution ability is offered. Fuzzy extractors, fuzzy vaults, and fuzzy
(ISR) employs a network that generates several low-reso- commitments, on the other hand, are commonly used to
lution recommendations and employs MCMC and entropy facilitate reusability and unlinkability in the practical inte-
measure techniques to find the best action recognition gration of biometric data. These techniques use a template
transformation. Two comparable approaches use two- and assistance data to retrieve the secret material.
4 Journal of Healthcare Engineering

Start

Register Login

Take the user’s username as Listen to User’s voice for

voice input UserID

Store the speech data Identified No Give error: Not found

user? Try again

YES
Capture about 30 images of the
Scan face, No Give error: Not found
face of new user
Fount? Try again

YES
Give the database password to
be associated with that face Pass the credentials to
Database connector

Associated voice and data and

store those datasets to disk Spawn a MYSQL shell

Figure 3: Flow of authentication.

Unfortunately, these approaches come at a considerable cost operation and stole large sums of money through unau-
in terms of complexity and performance. The use of a thorized and fraudulent transfers. By infesting malicious
pseudorandom number generator (PRNG) is proposed in software, they were able to get hold of the user’s system, and
“Identity Privacy-Preserving Biometric-Based Authentica- hence, they could even verify the two-factor tokens required
tion Scheme for Unprotected Healthcare Environment” to for the bank account. Hence, this study suggested a more
develop a safe and computationally efficient remote bio- transparent method so that users can easily verify themselves
metric authentication technique, which adds robust bio- and save themselves from different frauds. “Overview of
metric data security to a wide range of existing fingerprint recognition system” states that the fingerprint
authentication protocols. Because it protects templates and system will be unavailable to certain segments of the pop-
the user’s privacy, the technique is known as a blind bio- ulation. People who have lost fingers or hands would be
metric authentication protocol. The protocol is blind since it excluded, while older adults who are indulged in manual
does not display any information about the user other than labor for so many years may struggle to record worn prints
their identification. On the server side, it also employs a into a system. Many laptops do not support fingerprint
PRNG. recognition; hence, they cannot be used for online databases.
Many current 2FA approaches are being called into According to the “Five methods of usability of 2FA,”
question. Two-factor authentication enabled using one-time many users disliked hardware code generators; in fact, a few
password (OTP), or SMS has one major disadvantage. As people switched banks because the tokens were so difficult to
long as the device on which the OTP has been configured is use. We also found out that the most common 2FA methods
in possession, it is convenient, but sometimes when the used were email or SMS for financial or personal sites [14].
person does not have the device with him/her, although his According to another survey, these common methods have
account is secure, he is not able to log in or get access. It certain limitations. An attacker may pose as somebody while
becomes a matter of convenience and hence is not used speaking to the victim, somebody from a particular bank,
sometimes. For example, according to “Transparent two- and by taking advantage of the user’s distraction, which may
factor authentication” [13] paper, certain methods of 2FA get hold of the one-time password from that user [15, 16].
can be turned against a user’s system. One such case is when This way, the user might lose every penny he owns, further
McAfee and Guardian Analytics released a joint report titled affecting his/her business or professional life. According to
“Dissecting Operation High Roller.” It mentioned an in- one paper on cryptography known as “multifactor au-
ternational criminal group that used an automated thentication,” integrating credible and new solutions has
Journal of Healthcare Engineering 5

always been a huge hurdle for developers and managers. 2.1% (2 people) belonged to the age bracket of 5–15 and
User acceptance is low and a very serious part of adopting 31–45 years. This shows the targeted audience. People from
multifactor authentication. For example, a method known as age groups 5–15 are too young to understand the concept of
deoxyribonucleic acid (DNA) recognition has very high 2FA and use it properly. Due to the generation gap and
performance, universality, and uniqueness, but the accept- technical knowledge gap, not many people above the age of
ability rate is quite low, although it is not prone to spoof 40 use 2FA. Researchers did not circulate the Google Form
attacks and is an assuring method. On the other hand, this to the people who did not know about 2FA because some
study supports using face and speech recognition as a part of questions required knowing 2FA and authentication. That is
2FA. They suggest it is more transparent and easier to use why there are fewer people in this age group. Currently, the
and configure for people from almost every age bracket [17]. main users of 2FA are people from 16 to 30 years. This gap
There are different ways with the help of which can will fade away in a few years, and people above 30 years will
optimize this method and make it more and more secure also actively use 2FA. Figure 4 illustrates the survey query 1.
[18]. We can enable three-dimensional face recognition, i.e., Analysis 2: researchers found out that 35.8%, i.e., 34 of
by asking the user to move the head during the authenti- the 95 people, fall into indecision in the case of a password
cation process in a specific manner. User expressions can compromise. They are not aware of how to recover and
also be detected, making it less prone to any attacker or restore their account by changing their passwords so that the
breach. According to a survey done at Carnegie Mellon attacker may not control their account for too long. Figure 5
University [19], many people were satisfied and thought that depicts the survey query 2.
one-factor authentication is secure. The conclusion followed Analysis 3: 63.5%, i.e., 61 of the 96 people, use the same
in the paper deduces that two-factor authentication now has passwords everywhere. Hence, if one of their accounts gets
become a necessity, regardless of the petty limitations that compromised, it is very likely that other accounts will also
will be fixed in due time. Table 1 presents the list of existing get attacked, and they may lose a huge amount of sensitive
methods with their approaches and limitations. information. Even if your password is leaked, attackers still
need the 2nd factor to authenticate successfully. Using
3. Methodology biometric factors makes it difficult to steal face or speech
factors. Thus, the need for two-factor authentication is very
The researchers have opted for the empirical way of research high. Figure 6 portrays the survey query 3.
and are using the survey to prove the above hypothesis. The Analysis 4: participants selected multiple options. 68.1%
survey was conducted through Google Forms with 96 re- of people (64 people) prefer biometric authentication such as
sponses from different age groups and aspects of the society, face and speech recognition for security. One-time password
which gave the researcher a vivid idea of the hypothesis. The through SMS is the most common and used method.
survey was carried out for two weeks, and the participants However, it is observed that participants wanted to switch to
were from different professions and different parts of India. technologies such as face and speech recognition, which is
For those who did not know the meaning of 2FA, researchers more secure and not easily stolen or imitated. Researchers
explained the meaning and usage to get their views. They focus on “biometric 2FA for online database”; therefore, face
were asked to use a simple biometric 2FA to get a clear idea. and speech recognition is the most feasible options. OTP and
PIN codes are not biometric, and fingerprints are difficult to
4. Survey Analysis use for online databases on the laptop. Figure 7 shows the
survey query 4, and Figure 8 represents the survey query 5.
Researchers got thoughtful opinions on where exactly the Analysis 5: 23.2%, i.e., 22 of the 95 people, still think that
technology should be incorporated, which areas need im- a single authentication system is enough for the security of
mediate attention to this kind of technology, etc. Most their accounts. One reason for this could be that they find it
people voted in favor of the companies that handle finances difficult to carry hardware tokens everywhere to authenticate
and online payment systems using the 2FA system. Although themselves repeatedly, which is a tedious task. 58.9%, i.e., 56
many people know about two-factor authentication, more of the 95 people, think 2FA is the highest level of security,
people need to be aware of this technology as it will be which cannot be surpassed and is more than enough to
fruitful soon. secure their data, while 21.1% of people (20 people) want
This was an investigational study to see how people 2FA to be optimized and more factors should be added to
interpreted, adopted, and used 2FA. The researchers focused strengthen the security. Few people feel like multifactor is a
their efforts on gathering data that may be used to guide time-consuming process. Figure 9 illustrates the survey
future deployments and improve specific procedures. In query 6, and Figure 10 depicts the survey query 7.
particular, the researchers were interested in users’ im- Analysis 6: 84.9%, i.e., 79 of the 93 people, want to
pressions of 2FA and the factors that encourage and inhibit incorporate 2FA into online payment apps and other fi-
adoption. The survey was conducted through Google Form nancial consultancies operating online and where the ex-
with 96 responses, including people from all the age change of money is taking place. Figure 11 portrays the
brackets. In some questions, multiple-choice can be selected. survey query 8.
Analysis 1: the majority of the people, about 86.5%, i.e., Analysis 7: in the survey, researchers found that 60.3% of
83 of the 96 participants, belonged to the 16–30 age group. people (38 people) find 2FA easy to use. 7.9% of people (5
Less than 9.4% (9 people) were people above 45 years. Only people) reported it being difficult, out of which most people
6 Journal of Healthcare Engineering

Table 1: List of existing methods with their approaches and limitations.

Scheme Year Approach Limitations
[20] 2012 Asymmetric Forgery attacks are possible
[21] 2015 Cryptographic hash function Vulnerable to impersonation attacks and insider attacks
[22] 2012 Symmetric encryption User tracking attacks are possible
[23] 2016 Cryptographic hash function Experiencing issues with transmitting secrecy and revocability
[13] 2018 Fingerprint verification Fingerprints can also be stolen by capturing your prints without you knowing
Many people find it difficult to carry hardware tokens and may lose them
[18] 2015 Hardware tokens
sometimes
Bloom filter and format-preserving
[24] 2020 The primary downside is its probabilistic nature
encryption

Which age-group do you belong to? If your password is compromised, do you know what to do?
96 responses 95 responses

35.8%

9.4%

86.5%

64.2%

Yes
No
5-15 years 31-45 years
Figure 5: Survey query 2.
16-30 years above 45 years

Figure 4: Survey query 1.

additional operation steps are added [28]. The main barriers
to this technique are the data collecting and data storage
were above 45 years old. 14.3% of people (9 people) feel like it processes. There is a chance the platform will crash or get an
is unnecessary, and 17.5%, i.e., 11 of the 63 people, feel like it authentication problem. The possibility of technology du-
is very time-consuming and annoying. With this small-scale plication by other companies is a concern. New technologies
survey, researchers could figure out the qualitative and could put this platform and technology to the challenge.
quantitative aspects of two-factor authentication technology. After completing the password recovery process, many
From these data, researchers can undoubtedly infer that services will automatically log you into your account. When
although the preponderance of the people is aware of the you use social media to log in to your account, 2FA may be
technology and its logistics, there are still many people who ignored [29].
are entirely oblivious to the use of this technology. Figure 12 Patient records, data from clinical trials, radiological
represents the survey query 9. Table 2 presents the com- images, and genetic sequencing data are among the sources
parison results for privacy and security characteristic of the ever-increasing healthcare data. These data are pre-
features. dicted to have grown to a size of 25,000 petabytes by 2020.
Virtualization and cloud computing are two new technol-
5. Scope ogies that may acquire, manipulate, and store massive
amounts of data. Healthcare data management thus involves
5.1. Present Scenario. There are some limitations of this the issues of storage and retrieval of vast amounts and types
technology. It has been observed that two-factor authenti- of data and the integration and exchange of such data across
cation brings inconvenience to users when a physical entity numerous sites. Aside from that, the construction of a
is used as a second authentication factor, where many scalable system that provides continuous connectivity
Journal of Healthcare Engineering 7

Do you use similar passwords for multiple applications?

96 responses

36.5%

63.5%

Yes
No
Figure 6: Survey query 3.

Which kind of authentication method would you prefer?

94 responses

Cryptographic-based method 33 (35.1%)

Biometric-based method 64 (68.1%)

Smartcard with password based

37 (39.4%)
method

0 20 40 60 80
Figure 7: Survey query 4.

Which kind of authentication system would you prefer?

96 responses
Face Recognition 40 (41.7%)
Speech Recognition 18 (18.8%)
OTP authentication 54 (56.3%)
Security questions 20 (20.8%)
Pincode 30 (31.3%)
QR code 15 (15.6%)
Fingerprint 58 (60.4%)
Location 2 (2.1%)
0 20 40 60
Figure 8: Survey query 5.
8 Journal of Healthcare Engineering

Do you think one-factor authentication is secure enough? Would you consider two-factor authentication
95 responses when it comes to payment gateways?
93 responses

15.1%
76.8%

84.9%

23.2%

Yes
Yes
No
No
Figure 9: Survey query 6.
Figure 11: Survey query 8.

Which one do you prefer?

95 responses What was you perception after using 2FA ?
63 response

14.3%

21.1%
17.5%

58.9%

20%

60.3%

Signal-factor authentication
Two-factor authentication easy to use not needed

Multi-factor authentication difficult to use very much time taking

Figure 10: Survey query 7. Figure 12: Survey query 9.

between the healthcare management system and its users is

provide authentication. The fundamental motivation for
required [30].
implementing biometrics in the healthcare industry is to
ensure the privacy and security of patient records. Health
5.2. Case Study: Healthcare Facilities. In a case such as Insurance Portability and Accountability Act (HIPAA), the
healthcare data storage and retrieval, a biometric system can European Data Protection Directive, and the Australian
Journal of Healthcare Engineering 9

Table 2: Comparison results for privacy and security characteristic features.

Features [25] [26] [27] [10]
User anonymity Yes Yes No No
Mutual authentication Yes Yes Yes Yes
Off-line PW guessing attack Yes No No No
Impersonation attack Yes Yes Yes No
Replay attack Yes No No Yes
Provides formal security Yes Yes No No

Privacy Principles Act are examples of the international rules According to HealthTech, a company that deals with
that mandate a high level of security, sensitive data exchange, software requirements of healthcare facilities, doctors and
and access control [30]. other staff members showed enthusiastic response after the
“Two-factor authentication platform helps healthcare installation of 2-factor authentications as it makes their
institutions and health information networks secure remote workflow efficient and makes things easier for patients. It
access to confidential health information in a cost-effective also lets them focus on other factors rather than worrying
and scalable manner, without disrupting provider workflow” about data security. It saves money and time.
[31]. The security of patient data is legal and an ethical For example, many healthcare companies ask their
obligation of the medical sector. Complete security is dif- employees to strengthen their passwords, which may
ficult to achieve, especially in the medical domain, where sometimes be complicated. They also require users to change
disclosing information regarding the patient is a significant their passwords periodically to ensure the security of their
part of treating the patient. As dangers to the patient’s health sensitive data, which makes passwords hard to remember
data rise, suitable technical, administrative, and physical but very easy to lose. Based on studies by Microsoft, the
protection measures must be taken to protect the privacy of account becomes 99.9% less likely to be compromised or
protected health information (PHI). Hackers consistently attacked if you use MFA. Table 3 presents a summary of the
target user credentials to gain access to the healthcare system protocol, results, and key contributions from authentication
[32]. Figure 13 shows the functional platform for the and privacy-preserving healthcare systems. Table 4 presents
healthcare system. the details on the classification of healthcare apps for au-
According to the Protenus Breach Barometer, these types thentication and privacy-preserving healthcare systems.
of incidents compromised 3.8 million medical records in 2019. Table 5 shows the different types of attacks for authenti-
An increase in health data available electronically implies more cation and privacy-preserving healthcare systems.
risks. For example, it is usually these days for family members
and the provider’s office to share usernames and passwords. 6. Open Challenges: Authentication and
Employees may be given these personal credentials to gain
legitimate access. They are occasionally written down and
Privacy-Preserving Healthcare Systems
picked up by curious individuals. It may be guessed or detected Figure 15 illustrates the open challenges for authentication
by malicious software. This increased exposure has resulted in a and privacy-preserving healthcare systems. Some of the
significant increase in information leakage, theft of personal open challenges are as follows:
information, and numerous violations of HIPAA’s privacy and
security regulations [33]. Using a static password to prevent (i) If only one parameter is impacted, the accuracy of
unauthorized or unlawful access to your personal or sensitive the entire system will suffer
information is no longer deemed sufficient [34]. Also, there are (ii) Cost and technical complexity to implement
important data of healthcare departments such as information (iii) 2FA for many platforms can be circumvented
related to where particular medicine is kept and how many
(iv) Creating procedural delays in the system
doses can be harmful, or research information needed to be
protected at any cost. The leakage of such data can prove fatal (v) Susceptible to social engineering
and affect the masses. (vi) Access codes can be stolen; vulnerable to phishing
Two-factor authentication provides a higher level of attacks
security and reliability. According to “[31]” by William (vii) Poses advanced threats such as a 3D modeling of a
Braithwaite, it is accepted and understood widely that to face or finger
provide sufficient security to protect access of sensitive data
(viii) The influence of the technical issues is significant
and personal information of the patient, two-factor au-
thentication needs to be implemented. Allowing access only (ix) Usability issues in Google’s 2FA setup processes
after face and speech recognition verification will help keep
intruders from hacking or logging in and stealing important 7. Future Research Directions: Authentication
healthcare data. Keeping factors such as face detection and and Privacy-Preserving Healthcare Systems
speech verification prevent robots or other systems [7].
Figure 14 shows the healthcare data breach record in the past Face recognition (FR) is becoming a key study area due to
years. the wide range of applications in commercial and law
10 Journal of Healthcare Engineering

Health Data Authenticating

Management signature
System Biometric samples using
Authentication mobile devices
Health Security Agent
Data Manager
Store

Healthcare Cloud

Importing Data
into healthcare
cloud
Healthcare Center
Figure 13: Functional platform of the intelligent and privacy-preserving healthcare system.

HEALHCARE DATE BREACHES OF 500 OR MORE RECORDS

642

512

358 368
314 329
277 270
199 199 219

18

2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020
Figure 14: Healthcare data breach record.

Table 3: A summary of the protocol, results, and key contributions from authentication and privacy-preserving healthcare systems.
Reference Year Protocol Results Key contributions
They do not describe how a procedure is performed
Health screening for people Smart services do the whole
[1] 2019 but why, when, where, and by whom the care is
who have diabetes screening autonomously
given
Promotes public confidence in Provides a secure environment for people using the
[27] 2015 Security
healthcare services services
Decentralized privacy- Secures data transfers and
[35] 2019 preserving healthcare logging of data and storage on Security through blockchain
blockchain for IoT the blockchain
Tracks hospital supplies, medical
[36] 2017 Radiofrequency identification Privacy-preserving access controls
equipment, medications
The lightweight encryption algorithm is proposed to
Wireless medical sensor Sensitive patient information is
[12] 2013 secure communication between the sensor node and
network sent through the open air.
the Sharemind system.
Journal of Healthcare Engineering 11

Table 4: A classification of healthcare apps: authentication and privacy-preserving healthcare systems.

Category Common apps Description
Medicine delivery app Netmeds, PharmEasy, Medlife Delivery anywhere
Telenursing applications Practo Online doctor consultation
Medisafe Pill reminder, Bedside
Medicine reminders app Alerting with push notification
Reminders
Appointment scheduling apps AppointmentPlus, PatientPop Set online scheduler with doctor
Mindfulness, health, and Records your heart rate, water level, sugar level, and gives you a full
MyFitnessPal, Headspace
fitness apps report at the end
Educates patients about different diseases, what causes them, and
Patient health education apps CardioTech, Simply Sayin’
what are the symptoms

Table 5: Different types of attacks: authentication and privacy-preserving healthcare systems.

Reference Year Attacks Description
Dictionary and password
[37] 2012 Guessing the password from a password list
guessing attack
[38] 2013 Denial of service Denying service to the user by creating unnecessary traffic
[20] 2012 Impersonation attacks Impersonating to be someone and stealing information
[39] 2013 Patient anonymity violation Exploiting the hidden identity of the patient
The act of misrepresenting a communication from an unknown source as coming
[40] 2014 Spoofing
from a recognized, reliable source.
[22] 2012 Malware infusion Ingesting malware into the system so that it does not work properly
Capturing and listening to the information being passed from the sender to the
[23] 2016 Man in the middle
receiver and vice versa.
In each session, the patient uses the same identifier, leading to the disclosure of private
[21] 2015 Tracing attacks
information.

Based on only
one parameter,
if acquisition
affected, whole
accuracy will Cost and
Usability issues
degrade technical
in Google’s 2FA
complexity to
setup processes
implement

2FA for many

Influence of the
platforms can
technical issues
be
is significant
Open circumvented
Challenges

Poses advanced Creating

threats like a procedural
3D modelling of delays in the
a face or finger system

Access codes
Susceptible to
can be stolen;
social
Vulnerable to
engineering.
phishing attacks

Figure 15: Open challenges: authentication and privacy-preserving healthcare systems.

12 Journal of Healthcare Engineering

EHR
Medical Officer
Access Control List Access Control
(ACL)
(MOI)
List (ACL)

MO2
Mandatory Access
Control (MAC) Mandatory Access
Control (MAC)

Control List
Access

(ACL)
Control List
(ACL)

Access
Electronic Health
Server

MOI.....n
Authentication

ID/Proxy

PHARMACY
Service request

Authorization

Report

Doctor-Patient’s
Feedback Server
Patient

Figure 16: Operating model: authentication and privacy-preserving healthcare systems.

Research efforts
Utilizing Al and in improving the
using brain usability of 2FA Area of neural
signals to setup processes networks and
carryout user Big Data
authentication

Unique fingerprint
of the user-
Synergistic biometric
computer
systems couple all
interaction
three factor:
pattern, which is Future Research knowledge,
extremely difficult Directions biometrics, and
to replicate
ownership

The capability to
identity the users
Behavior-based
based on the way
biometrics based
they interact with
on muscular
computer
MFA sources to be memory
utilized: heart and
brain; attractive
area of ECG and EEG
analysis

Figure 17: Future research directions: authentication and privacy-preserving healthcare systems.
Journal of Healthcare Engineering 13

enforcement industries. Figure 16 represents the operating authentication, often known as 2FA, is a simple way for
model for authentication and privacy-preserving healthcare organizations to add an extra layer of security to user
systems. Object lighting, pose variation, expression varia- accounts.
tions, and facial disguises are all issues for traditional FR Many existing approaches are vulnerable to insider at-
approaches based on visible spectrum (VS). Unfortunately, tacks and off-line password guessing attacks, resulting in
these constraints reduce object identification and verifica- increased security risks and the inability to provide user
tion performance. Figure 17 shows the future research di- anonymity. Secure authentication is required to overcome
rections for authentication and privacy-preserving the problem of timely updating patient data in the medical
healthcare systems. The infrared spectrum (IRS) may be system. The discussion above makes us believe that the new
employed in human FR to circumvent these constraints. scheme meets the following requirements: smart health care
Some of the future research directions are as follows: is good. The Proposed Intelligent and Privacy-Preserving
Healthcare Systems scheme provides mutual authentication
(i) In India, preventing ATM fraud is a priority. It is
between patient and authentication server. The patient can
possible to construct a database of all ATM
also change their password freely without the help of the
cardholders in India with facial and speech rec-
registration server. Researchers have demonstrated that the
ognition technologies.
proposed scheme has more security features and a greater
(ii) It can also identify candidates during examinations security level than similar schemes.
such as the Civil Services Exam, SSC, IIT, MBBS, Some people still do not use 2FA, making them vul-
and others. nerable to security threats. The company’s responsibility is to
(iii) This technology can verify and track attendance at endeavor to make people aware of the process and benefits of
various government offices and businesses. 2FA and biometric systems.
A very recent example of the same is WhatsApp. They
(iv) It can also be implemented in bank lockers and
have started their end-to-end encryption; they have used
vaults for access control verification and authen-
various media platforms to spread awareness about the
tication of authentic users.
same and influence people to use it more as it is the safer
(v) More biometric authentication-enabled items, way, and this shall prevent them from various sorts of data
such as computers and cell phones, can be breaches. So, even now, if people are not technically aware
manufactured. of end-to-end encryption, they still know this will protect
(vi) Consumers’ growing security concerns result in their data. The same efforts are needed in the field of
increased demand for biometric services. biometric 2FA.
(vii) Research efforts in improving the usability of 2FA Biometric authentication is undoubtedly gaining pop-
setup processes. ularity and is commonly used by mobile users, but its
popularity has been restricted to phones only. People are
(viii) Area of neural networks and big data.
unaware of its usage on online databases, which is too
(ix) Synergistic biometric systems couple all three vulnerable to security breaches. It should be user-friendly,
factors: knowledge, biometrics, and ownership. with terms and conditions explained in a layman’s way and
(x) Behavior-based biometrics based on muscular the threats of not using it.
memory.
(xi) MFA sources to be utilized: heart and brain; at- Data Availability
tractive area of ECG and EEG analysis.
(xii) The capability to identify the users based on the The article’s original contributions generated for this study
way they interact with the computer. are included; further inquiries can be directed to the cor-
responding author.
(xiii) Unique fingerprint of the user-computer interac-
tion pattern, which is extremely difficult to
replicate. Conflicts of Interest
(xiv) Utilizing AI and using brain signals to carry out The authors declare that there are no conflicts of interest
user authentication. regarding the publication of this study.

8. Conclusions References
It is no surprise that various digital accounts have become a [1] S. Khatoon, S. M. M. Rahman, M. Alrubaian, and A. Alamri,
magnet for fraudsters because people spend so much of their “Privacy-preserved, provable secure, mutually authenticated
time on their phones and laptops. Malicious attacks on key agreement protocol for healthcare in a smart city envi-
governments, businesses, and individuals are becoming ronment,” IEEE Access, vol. 7, pp. 47962–47971, 2019.
[2] S. Pandey, T. Taffese, M. Huang, and M. D. Byrne, “Human
increasingly widespread. Moreover, there are no indicators
performance in google’s two-factor Authentication setup
that hacking, data breaches, or other forms of cybercrime process,” Proceedings of the Human Factors and Ergonomics
will slow down anytime soon. Fortunately, two-factor Society - Annual Meeting, vol. 63, no. 1, pp. 2221–2225, 2019.
14 Journal of Healthcare Engineering

[3] A. Abuarqoub, “D-FAP: dual-factor authentication protocol multi-medical server environment in TMIS,” Journal of
for mobile cloud-connected devices,” Journal of Sensor and Medical Systems, vol. 39, no. 9, p. 92, 2015.
Actuator Networks, vol. 9, no. 1, p. 1, 2020. [22] Z.-Y. Wu, Y.-C. Lee, F. Lai, H.-C. Lee, and Y. Chung, “A
[4] O. Persson and E. Wermelin, A Theoretical Proposal of Two- secure authentication scheme for telecare medicine infor-
Factor Authentication in Smartphones, 2017, http://www.bth.se. mation systems,” Journal of Medical Systems, vol. 36, no. 3,
[5] R. Bruzgiene and K. Jurgilas, “Securing remote access to pp. 1529–1535, 2012.
information systems of critical infrastructure using two-factor [23] M. Wazid, A. K. Das, S. Kumari, X. Li, and F. Wu, “Design of
authentication,” Electronics (Switzerland), vol. 10, no. 15, efficient and provably secure anonymity preserving three-
2021. factor user authentication and key agreement scheme for
[6] M. H. Barkadehi, M. Nilashi, O. Ibrahim, A. Zakeri Fardi, and TMIS,” Security and Communication Networks, vol. 9, no. 13,
S. Samad, “Authentication systems: a literature review and pp. 1983–2001, 2016.
classification,” Telematics and Informatics, vol. 35, no. Issue 5, [24] V. Bansal and S. Garg, “A cancelable biometric identification
pp. 1491–1511, 2018. scheme based on bloom filter and format-preserving en-
[7] M. K. Sharma and M. J. Nene, “Two-factor authentication cryption,” Journal of King Saud University - Computer and
using biometric-based quantum operations,” Security and Information Sciences, 2022.
Privacy, vol. 3, no. 3, 2020a, https://doi.org/10.1002/spy2.102. [25] A. Irshad, M. Sher, O. Nawaz, S. A. Chaudhry, I. Khan, and
[8] G. Ali, M. A. Dida, and A. E. Sam, “Two-factor authentication S. Kumari, “A secure and provable multi-server authenticated
scheme for mobile money: a review of threat models and key agreement for TMIS based on Amin et al. scheme,”
countermeasures,” Future Internet, vol. 12, no. Issue 10, Multimedia Tools and Applications, vol. 76, no. 15,
pp. 1–27, 2020. pp. 16463–16489, 2017.
[9] A. J. Mohammed and A. A. Yassin, “Efficient and flexible [26] R. Amin and G. P. Biswas, “An improved RSA based user
multi-factor authentication protocol based on fuzzy extractor authentication and Session key agreement protocol useable in
of administrator’s fingerprint and smart mobile device,” TMIS,” Journal of Medical Systems, vol. 39, no. 8, p. 79, 2015.
Cryptography, vol. 3, no. 3, pp. 1–222, 2019. [27] D. Giri, T. Maitra, R. Amin, and P. D. Srivastava, “An efficient
[10] A. Ometov, S. Bezzateev, N. Mäkitalo, S. Andreev, and robust RSA-based remote user authentication for telecare
T. Mikkonen, and Y. Koucheryavy, “Multi-factor authenti- medical information systems,” Journal of Medical Systems,
cation: a survey,” Cryptography, vol. 2, no. 1, pp. 1–31, 2018. vol. 39, no. 1, p. 145, 2015.
[11] U. Sharma, P. Tomar, S. S. Ali, N. Saxena, and R. S. Bhadoria, [28] Z. Siddiqui, O. Tayan, and M. Khurram Khan, “Security
“Optimized authentication system with high security and pri- analysis of smartphone and cloud computing authentication
vacy,” Electronics (Switzerland), vol. 10, no. 4, pp. 1–23, 2021. frameworks and protocols,” IEEE Access, vol. 6, pp. 34527–
[12] X. Yi, J. Willemson, and F. Nait-Abdesselam, “Privacy-pre- 34542, 2018.
serving wireless medical sensor network,” in Proceedings of the [29] M. K. Sharma and M. J. Nene, “Dual factor third-party
12th IEEE International Conference on Trust, Security and biometric-based authentication scheme using quantum one-
Privacy in Computing and Communications, TrustCom 2013, time passwords,” Security and Privacy, vol. 3, no. 6, 2020b.
pp. 118–125, 2013. [30] K. A. Shakil, F. J. Zareen, M. Alam, and S. Jabin, “BAM-
[13] J. Zhang, X. Tan, X. Wang, A. Yan, and Z. Qin, “T2FA: HealthCloud: a biometric authentication and data manage-
transparent two-factor Authentication,” IEEE Access, vol. 6, ment system for healthcare data in cloud,” Journal of King
pp. 32677–32686, 2018. Saud University - Computer and Information Sciences, vol. 32,
[14] S. Yu, K. Park, and Y. Park, “A secure lightweight three-factor no. 1, pp. 57–64, 2020.
authentication scheme for IoT in the cloud computing en- [31] W. R. Braithwaite, Why Two-Factor Authentication in
vironment,” Sensors, vol. 19, no. 16, 2019. Healthcare?, 2009, http://www.anakam.com.
[15] M. Obaidat, J. Brown, S. Obeidat, and M. Rawashdeh, “A [32] A. Acar, W. Liu, R. Beyah, K. Akkaya, and A. S. Uluagac, “A
hybrid dynamic encryption scheme for multi-factor verifi- privacy-preserving multi-factor authentication system,” Se-
cation: a novel paradigm for remote authentication,” Sensors, curity and Privacy, vol. 2, no. 5, 2019.
vol. 20, no. 15, pp. 1–32, 2020. [33] X. Yin, J. He, Y. Guo, D. Han, K. C. Li, and A. Castiglione, “An
[16] G. Xu, S. Qiu, H. Ahmad et al., “A multi-server two-factor efficient two-factor authentication scheme based on the
authentication scheme with un-traceability using elliptic Merkle tree,” Sensors, vol. 20, no. 20, pp. 1–19, 2020.
curve cryptography,” Sensors, vol. 18, no. 7, 2018. [34] H. Khalid, S. J. Hashim, S. M. S. Ahmad, F. Hashim, and
[17] K. David Biaru, University of Nairobi School of Computing and M. A. Chaudhary, “Selamat: a new secure and lightweight
Informatics A Model of Two-Factor Authentication Using multi-factor authentication scheme for cross-platform in-
Facial Recognition in Automated Teller Machines, 2014. dustrial IoT systems,” Sensors, vol. 21, no. 4, pp. 1–32, 2021.
[18] I.-P. Chang, T.-F. Lee, T.-H. Lin, and C.-M. Liu, “Enhanced [35] A. D. Dwivedi, G. Srivastava, S. Dhar, and R. Singh, “A
two-factor authentication and key agreement using dynamic decentralized privacy-preserving healthcare blockchain for
identities in wireless sensor networks,” Sensors, vol. 15, no. 12, IoT,” Sensors, vol. 19, no. 2, 2019.
pp. 29841–29854, 2015. [36] F. Rahman, M. Z. A. Bhuiyan, and S. I. Ahamed, “A privacy
[19] J. Colnago, S. Devlin, M. Oates et al., “It’s not actually that preserving framework for RFID based healthcare systems,”
horrible: Exploring Adoption of Two-Factor Authentication Future Generation Computer Systems, vol. 72, pp. 339–352, 2017.
at a University,” in Proceedings of the 2018 CHI Conference on [37] H.-M. Chen, J.-W. Lo, and C.-K. Yeh, “An efficient and secure
Human Factors in Computing Systems, pp. 1–11, 2018. dynamic ID-based authentication scheme for telecare medical
[20] Z. Zhu, “An efficient authentication scheme for telecare information systems,” Journal of Medical Systems, vol. 36,
medicine information systems,” Journal of Medical Systems, no. 6, pp. 3907–3915, 2012.
vol. 36, no. 6, pp. 3833–3838, 2012a. [38] H. Y. Lin, “On the security of a dynamic ID-based authen-
[21] A. K. Das, V. Odelu, and A. Goswami, “A secure and robust tication scheme for telecare medical information systems,”
user authenticated key agreement scheme for Hierarchical Journal of Medical Systems, vol. 37, no. 2, p. 9929, 2013.
Journal of Healthcare Engineering 15

[39] Q. Jiang, J. Ma, Z. Ma, and G. Li, “A privacy enhanced au-

thentication scheme for telecare medical information sys-
tems,” Journal of Medical Systems, vol. 37, no. 1, p. 9897, 2013.
[40] Q. Jiang, J. Ma, X. Lu, and Y. Tian, “Robust chaotic map-based
authentication and key agreement scheme with strong ano-
nymity for telecare medicine information systems,” Journal of
Medical Systems, vol. 38, no. 2, p. 12, 2014.