Journal of Medical Systems (2018) 42:250

https://doi.org/10.1007/s10916-018-1099-y

MOBILE & WIRELESS HEALTH

Privacy Protection for Point-of-Care Using Chaotic Maps-Based

Authentication and Key Agreement
Liping Zhang 1 & He Luo 1 & Lanchao Zhao 1 & Yixin Zhang 1

Received: 2 July 2018 / Accepted: 9 October 2018

# Springer Science+Business Media, LLC, part of Springer Nature 2018

Abstract
Recently, remote points-of-care as a novel medical model has emerged and received considerable attention due to its convenient
medical services such as efficient real-time monitoring and prompt information feedback. Although the points-of-care has more
attractive advantages compared with traditional health care systems, some important issues still require a serious consideration
such as privacy protection and the security of the transmitted biomedical signals. In this study, we propose a novel authentication
and key agreement mechanism that ensures privacy preservation and provides biomedical signals protection during the commu-
nication process by negotiating a shared key to encrypt/decrypt sensitive information. Chaotic maps are employed in our design
to achieve mutual authentication and key agreement for resource-constrained points-of-care, which also increases the efficiency
in comparison with those schemes designed by Elliptic Curve Cryptography or RSA. Furthermore, dynamic identities are
adopted in the proposed scheme to achieve user anonymity and user untraceability for the high-privacy-required points-of-care.
The security of the proposed scheme is proven via Real-or-Random model. The performance analysis shows that the proposed
scheme reduces computational overhead in comparison with the state-of-the-art schemes.

Keywords Privacy protection . Point-of-care . Chaotic maps . Authentication . Key agreement

Introduction terminal users such as caregivers and physicians. Through the

healthcare applications of the PoC, remote healthcare moni-
Recently, the points-of-care (PoC) as a new medical model toring in real-time is capable of providing many high-quality
has received a lot of attention for its convenient medical ser- services such as emergency response and continuous treat-
vices. Compared with traditional healthcare models, the PoC ment. Moreover, a PoC may offer a new approach towards
has many advantages such as supporting a comfortable inde- the diagnosis of rare illness based on patient’s health digits.
pendent living for elderly people, offering better flexibility in Due to its great potential, the PoC has attracted considerable
personal healthcare and maximizing healthcare resources uti- attention and some applications have come out of lab entering
lization with fewer expenses and time [1]. Basically, applica- market.
tions of the PoC are developed on a series of interconnected Since medical data is very sensitive, privacy protection
entities including a set of medical sensors and a smart home becomes a critical issue in the PoC. To preserve patients’
gateway. Medical sensors are planted in, on, or around pa- privacy on wireless channels, medical data should be well
tients’ body to collect physical data including heart rate, blood protected in case of suffering malicious attacks [2]. Thus, a
sugar value etc. Then these data are gathered to the smart well-designed authentication and key agreement scheme is
home gateway through wireless links and delivered to remote essential for the PoC which has high-security requirements
such as perfect forward secrecy, user anonymity and user
untraceability [3–6].
This article is part of the Topical Collection on Mobile & Wireless Health
Several authenticated key agreement schemes [7–21] for
the resource-constrained healthcare applications environment
* Lanchao Zhao
[email protected] have recently been successively proposed. In order to protect
patients’ medical data, Elliptic Curve Cryptography (ECC)
1
was adopted in Lee et al.’s encryption scheme for healthcare
School of Computer Science, China University of Geosciences,
Wuhan 430074, China
systems [7], while the scalar multiplication operations of an
 250 Page 2 of 13 J Med Syst (2018) 42:250

elliptic curve may consume large system resources. RSA Kumari et al. presented an authenticated key agreement scheme
cryptosystem was employed by Hou et al. to construct an for healthcare sensor systems using chaotic maps [20]. Their
authentication scheme for the Internet of Things (IoT) based scheme achieves mutual authentication and user anonymity
healthcare systems [8]. However, their scheme cannot achieve with low computational complexity. But, Kumari et al.’s
user anonymity and the computational overhead is still high. scheme [20] cannot resist known session specific temporary
To enhance the performance, chaotic maps was introduced by information attacks and doesn’t take user untraceability into
Li et al. to realize mutual authentication and key negotiation in consideration. For realizing user untraceability, Lee proposed
e-healthcare environments [9]. Although their scheme is more a temporal credential-based authenticated key agreement
efficient than RSA-based authentication schemes, it cannot scheme using extended chaotic maps [16]. Lee’s scheme en-
achieve perfect forward secrecy and suffers from off-line pass- hances the efficiency and realizes user untraceability, but it
word guessing attacks. Afterward, Yeh presented an IoT-based cannot withstand known session specific temporary informa-
healthcare system using the keyed-hash message authentica- tion attacks and denial-of-service (DoS) attacks.
tion code and ECC [10]. But, his scheme is vulnerable to Despite the fact that chaotic maps-based authentication
malicious multiple login requests and fails to provide user schemes enhance the performance efficiently, various security
anonymity. As the public-key cryptography-based schemes flaws occur in the existing schemes. How to design a light-
mentioned above are involved in high computational over- weight authentication scheme with user privacy protection by
head and have some security weaknesses, these schemes are using chaotic maps is still a challenging task. In this paper, we
not suitable for the resource-constrained PoC. employ chaotic maps technology to construct a lightweight
To reduce the computational costs and meet the low energy privacy-preserving authentication scheme for a resource-
requirements in PoC environments, He et al. presented a light- constrained PoC. To enhance the security, the Chebyshev cha-
weight authentication scheme using symmetric algorithms otic map as a lightweight public key method is introduced in
and hash functions [11]. Since only lightweight operations our design. Based on the extended chaotic map-based discrete
are required in the authentication process, their scheme re- logarithm problem and the extended chaotic map-based Diffie–
duces the computational costs significantly in comparison Hellman problem, we construct a secure authentication and key
with public-key cryptography-based authentication schemes. agreement scheme with user anonymity and user untraceability.
However, their scheme cannot achieve user anonymity and Furthermore, we have proved that our scheme is semantically
perfect forward secrecy. Gope et al. proposed an IoT-based secure under the Real-or-Radom Model. Security analysis dem-
modern healthcare system only using one-way hash functions onstrates that the proposed scheme can resist various attacks
to achieve low energy consumptions [12]. But their scheme and provides user privacy protection. On the other hand, the
doesn’t provide key negotiation and session key security. In usage of chaotic maps increases the efficiency of our proposed
order to enhance the security with low computational costs, scheme. The experimental results show that our authentication
Chang et al. [13] employed dynamic identities to realize au- scheme reduces the computational cost efficiently in compari-
thentication and key agreement with user anonymity. But, son with other related schemes.
perfect forward secrecy cannot be guaranteed in their scheme The rest of this paper is organized as follows:
[13]. Although the above schemes achieve good performance Section BPreliminaries^ reviews some preliminaries. In
by only using hash functions or symmetric encryption/ Section BThe proposed scheme^, the proposed scheme is de-
decryption algorithms, security pitfalls occur more frequently scribed in detail. The security of the proposed scheme is discussed
without the protection of asymmetric cryptosystems. in Section BSecurity analysis^. In Section BPerformance
In order to provide privacy protection with high efficiency, analysis^, the performance of the proposed scheme is analyzed
chaotic maps as a lightweight public key technique are in contrast to existing schemes. And the paper is concluded in
employed in designing an authentication scheme for healthcare Section BConclusions^.
application environments. Since the Chebyshev polynomial
computation is more efficient than the modular exponential
computation operation and the elliptic curve point multiplica- Preliminaries
tion operation, chaotic maps-based authentication schemes en-
hance the performance efficiently [14–17]. In 2012, Lai et al. In this section, we review the basic concepts of Chebyshev
proposed an anonymous authentication scheme using enhanced chaotic maps and the network model of PoC briefly.
Chebyshev polynomials based on its semigroup property [18].
However, Zhao et al. demonstrated that Lai et al.’s scheme [18] Chebyshev chaotic maps
was suffered from privileged insider attacks and off-line pass-
word-guessing attacks [19]. Although an improvement is pro- Chebyshev polynomial Tn (x): (−∞,+∞) → [−1, +1] defined as
posed by Lai et al., their scheme and Zhao et al.’s scheme are Tn (x) = (2xTn − 1(x) − Tn − 2(x)) mod p, where x∈(−∞,+∞), n is
both vulnerable to attacks on smart cards. Very recently, an integer, n ≥ 2, T0 (x) = 1, T1 (x) = x, and p is a large prime
J Med Syst (2018) 42:250 Page 3 of 13 250

number. The Chebyshev polynomial satisfies the semigroup trusted server is needed for securing the key negotiation process,
property: Tuv (x) = Tv (Tu (x)) = Tu (Tv (x)), where u, v ∈ N and x storing major authenticators and providing an accurate verifica-
∈ (−∞ + ∞). For more details, please refer to [21, 22]. tion. After the authentication through the trusted server, a shared
Property 1 (Semi-group property) For u, v ∈ N,Tu(Tv(x)) = session key will be generated and issued to the user and the
Tuv(x) = Tv(Tu(x))(mod N). medical server. Finally, the user and the targeted medical server
Property 2 (Chaotic map) When n > 1, Chebyshev polyno- can realize secure communication by encrypting the transmitted
mial map Tn(x): [−1, 1] → [−1, 1] of degree n is a chaotic map messages using the shared session key.
with its invariant density f ∗(x) = 1/(π(1 − x2)1/2), for positive
Lyapunov exponent ln n.
Property 3 (The minimal period of Chebyshev polynomial The proposed scheme
sequence) Period of Chebyshev polynomial sequence
(Tn(x)mod N)n ≥ 0 (n = 0, 1, 2,. ..) is d, if Tn + d(x) = Tn(x)mod In this section, the proposed scheme is depicted in detail by the
N. The minimal period of Chebyshev polynomial sequence following four phases: the initialization phase, the user registra-
dmin is a factor of its ordinary period d. tion phase, the login phase, the authentication and key agree-
ment phase. There are three participants in our proposed
Definition 1 Extended Chaotic Map-based Discrete Logarithm scheme for the PoC, i.e. the user Ui, the trusted server TS and
Problem (CMDLP): Given y and x, it is computationally in- the medical server MS. To clarify the proposed scheme, nota-
feasible to find an integer k such that Tk (x) = y within proba- tions and their denotations are summarized in Table 1.
bilistic polynomial time. The probability of the adversary A
being able to solve the CMDLP is defined as Pr[A(x, y) = k: k ∈
Zn*, y = Tk(x) mod n). Initialization phase

Definition 2 Extended Chaotic Map-based Diffie–Hellman In this phase, the trusted server TS calculates and publishes the
Problem (CMDHP): Given x, Tu(x), Tv(x), it is computation- related parameters of Chebyshev polynomials {x, Tk(x), p, T(·
ally infeasible to compute Tuv (x) = y within probabilistic poly- )}. And then the trusted server TS performs the following steps
nomial time. The probability of the adversary A being able to with the medical server MS through a secure communication
solve the CMDHP is defined as Pr[A(x, Tu(x), Tv(x)) = Tuv (x) channel as shown in Fig. 2.
mod n: u, v ∈ Zn*].
(1) The trusted server TS assigns a diverse identity for each
Network model medical server MS, say MSj for the j-th medical server.
Then each MS randomly selects a unique number r as its
There are three parties in the PoC network, namely the user, the secret key and computes MSr = Tr(x) mod p. After that,
trusted server and the medical server. The user could be doctors, the medical server sends the message {MSj, MSr} to the
patient’s relatives or the patient herself/himself with a smart trusted server TS.
terminal. The patient is equipped with many small biometrical (2) When the trusted server TS receives the transmitted mes-
sensors that are deployed around, wore on or implanted in her/ sage {MSj, MSr}, it computes a temporal credential
his body to monitor some vital biomedical signals such as ECG, TIDj = h(MSj||k) for the j-th medical server MSj. And then
EEG, and PPG. Then these data are transmitted through the the trusted server TS computes St = Tk(MSr) mod p and
patient’s smart terminal to the medical server. After receiving sends {TIDj, St} to each medical server.
and processing the biomedical data, the doctor and the patient’s (3) After each medical server receives the message {TIDj,
relative are able to achieve her/his current health state and his- St}, the medical server MSj stores the received message
torical healthcare records from the medical server. Since the in its memory. Meanwhile, the trusted server TS stores
messages are transmitted in open channel, the PoC is more the pair of identity MSj and MSr for each medical server
vulnerable to various attacks, let alone the sensitivity of the in its database.
biomedical data. Therefore, the establishment of the session
key between the user and the medical server is essential to
protect the communication and the sensitive data.
The trusted server is of vital importance to ensure that the User registration phase
authentication process takes place between multiple users and
multiple medical servers. As illustrated in Fig. 1, patients can When a user Ui wants to obtain the related information from
choose to visit more than one hospital remotely and get a com- the medical server, she/he needs to be authorized by trusted
prehensive diagnosis. In order to provide the mutual authentica- server TS by finishing the corresponding registration process.
tion and key agreement between a user and any medical server, a Fig. 3 describes the detailed steps about registration.
 250 Page 4 of 13 J Med Syst (2018) 42:250

Doctor

Medical server possessed

by a hospital

Patient
Trusted server

Examples of secure communitation

using a shared session key Medical server possessed
Relatives by a community clinic
Establishing the session key via the
trusted server

Fig. 1 The network model of the proposed scheme

(1) A user Ui chooses her/his identity IDi, the password pwi using the inputted identity and password. In the follow-
and then computes TPWi = Tpwi(x) mod p using the pub- ing steps, the smart card SC chooses the current
lic algorithm T(·). Afterward, she/he sends {IDi, TPWi} timestamp T1 and computes Qi = Pi ⊕ h(T1) and I4 =
to the trusted server TS through a secure channel. IDi ⊕ I’0 ⊕ h(T1). And then the user Ui selects a medical
(2) When the trusted server TS receives the message {IDi, server MSj that she/he wants to access and inputs the
TPWi}, it firstly computes I0 = Tk(TPWi) mod p and identity MSj into the smart card. After that, the smart card
KPWi = ID i ⊕ I 0 using its long-term private key k. SC computes SIDj = MSj ⊕ h(IDi||T1) as the temporal
Then, the trusted server TS chooses a random number identity of MSj. Next, the user Ui chooses a random in-
m and computes D1 = h(k||m), I1 = h(IDi||m), I2 = IDi ⊕ teger a and computes I5 = Ta(h(IDi||Pi)||MSj) mod p and
D1, I3 = Tk(I2) mod p. Finally, it stores {I0, I1, I3} in its Ia = I5 ⊕ I0. Finally, the user Ui sends the message {SIDj,
database and issues a smart card contained {KPWi, I1, h(· Qi, I1, I4, Ia, T1} to the trusted server TS via a public
)} to the corresponding user Ui. channel.
(3) After the user Ui receives the issued smart card, she/he
keeps it secret and makes a preparation for the login
phase.

Table 1 Notations and terminology

IDi The identity of the i-th user Ui

Login phase MSj The identity of the j-th medical server MS
pwi The password of the i-th user Ui
In order to enter into PoC and access the related information, a k The private key of the trusted server TS
registered user needs to make a login request. The login pro- r The secret key of medical server MS
cess is depicted in Fig. 4: p A large prime number
a, b, m, n Four high-entropy random integers
(1) A user Ui inserts her/his smart card into a card reader and T1~T6 The current timestamp
inputs the corresponding identity IDi and password pwi. h(·) A secure one-way hash function
Then, the smart card SC computes I0 = KPWi ⊕ IDi and ⊕ The exclusive-or operation
I0’ = Tpwi(Tk(x)) mod p using the public parameter Tk(x) || The concatenation operation
and algorithm T(·) and checks whether I0’ is equal to I0. If Tu(x) Chebyshev chaotic maps operation using the secret key u
successful, the smart card SC computes Pi = h(IDi||pwi)
J Med Syst (2018) 42:250 Page 5 of 13 250

Fig. 2 Initialization phase of the

proposed scheme

Authentication and key agreement phase I1new = h(IDi’||n). Finally, it computes I1new’ = h(IDi’) ⊕
I1new and sends the authentication message {I6, I7, I8, I9,
After receiving a login request from a user, the trusted server I1new’, T3} to the medical server MSj through a public
TS needs to transmit the related message to a medical server to channel.
negotiate a shared session key, which is used for protecting the (2) After receiving the message {I6, I7, I8, I9, I1new’, T3}, the
following communications between the user and the corre- medical server MSj firstly verifies whether the difference
sponding medical server. The following steps describe the between the current timestamp and T3 is beyond the time
authentication and key agreement process shown in Fig. 5. threshold value ΔT. If the difference is within the thresh-
old value, the medical server MSj computes Sg′ =
(1) When the trusted server TS receives the login request Tr(Tk(x)) by using its secret key r and public parameter
{SIDj, Qi, I1, I4, Ia, T1}, it checks whether (T2-T1) ≤ ΔT Tk(x). And then it checks whether the computed I9’ =
is legal, where T2 is the current timestamp. If valid, the h(Sg′||h(MSj)||T3) is equal to I9. If they are equal, the cor-
trusted server TS computes Pi’ = Qi ⊕ h(T1) and extracts responding medical server MSj extracts TIDj according
I0 from its database {I0, I1, I3} according to the received to Sg′ and then computes I5^ = I6 ⊕ TIDj’, Pi^ = I7 ⊕ I5^
I1. Then the trusted server TS computes IDi’ = I4 ⊕ I0 ⊕ and IDi^ = I8 ⊕ Pi^ ⊕ h(T3). In the following procedure,
h(T1), I5’ = Ia ⊕ I0, D1 = h(k||m) and I2’ = IDi’ ⊕ D1 by the medical server MSj chooses a random integer b and
using the matching random number m, which is stored calculates I10 = Tb(h(IDi^||Pi^)||MSj) mod p and Ib =
in the TS’s database in advance. Meanwhile, it examines I10 ⊕ h(IDi^||MSj). Afterwards, the corresponding medi-
whether I3’ = Tk(I2’) mod p is equal to the I3 stored in its cal server MSj computes the session key SK = Tb(I5^) =
database. If I3’ = I3, the trusted server TS considers the Tab(h(IDi^||Pi^)||MSj) mod p and the authentication mes-
user is legal and then computes MSj = SIDj ⊕ h(IDi’||T1) sage I11 = h(SK||h(IDi^)||T5). Eventually, the medical
to obtain the identity of the medical server. Next, the server MSj sends the message {Ib, I11, T5, I1new’} to the
trusted server TS uses the obtained identity MSj to extract user Ui in an open network environment.
MSr from its database and computes TIDj = h(MSj||k), (3) When receiving the message {Ib, I11, T5, I1new’}, the user
Sg = Tk(MSr) mod p, I6 = TIDj ⊕ I5’ and I7 = I5’ ⊕ Pi’. Ui checks the validity of T5. If illegal, the user Ui termi-
After that, the trusted server TS generates the current nates the session. Otherwise, the user Ui computes I10’ =
timestamp T3 and calculates I8 = Pi’ ⊕ IDi’ ⊕ h(T3) and Ib ⊕ h(IDi||MSj) and the session key SK = Ta(I10’) =
I9 = h(Sg||h(MSj)||T3). And then, the trusted server TS Tab(h(IDi||h(IDi||pwi)||MSj) mod p. and then it verifies
chooses a random integer n and replaces I 1 with whether I11’ = h(SK||h(IDi)||T5) is equal to I11. If not

Fig. 3 Registration phase of the

proposed scheme
 250 Page 6 of 13 J Med Syst (2018) 42:250

Fig. 4 Login phase of the

proposed scheme

equal, Ui ends the session immediately. Otherwise, the since there’s only one trusted server in the scheme. The set
trusted server TS and medical server MS are authenticat- P contains all the participants, which is a union of U, MS and
ed and the session key SK will be used for the following TS. Any instance p in set P is an oracle.
communication between a user Ui and a corresponding
medical server MS. In the end, the smart card SC replaces Adversary In this security model, the adversary A is a simula-
I1 with I1new by computing I1new = I1new’ ⊕ h(IDi). tion of malicious adversaries in the real world who run in
polynomial time. The ability of the adversary A is defined
by the following queries.

Execute(u i , TS, ms j ) This query mainly models the

Security analysis eavesdropping attacks. When the query Execute(ui, TS, msj)
is made, the adversary A will receive the transcript of the
In this section, we proved our proposed scheme can meet the transmitted messages among ui, TS, and msj.
security requirements of semantic security (i.e. Authentication
Key Exchange Security, AKE security) and mutual authenti- Send(P, M) This query mainly models various active attacks.
cation under Real-or-Random model. Moreover, we show that When an adversary askes the Send query, he firstly sends a
the proposed scheme can withstand various well-known and message m to a participant instance p. Then, the instance p
meet a series of security demands. generates the corresponding reply message and returns it to
the adversary according to our proposed scheme.
Security model
Corrupt(ui, pwi) When an adversary makes this query, ui’s
The security model of authentication key exchange protocol current password pwi is returned to the adversary. Therefore,
was first described by Bellare et al. [23], which includes the this query models the possibility of breaking the perfect for-
usage of the Random Oracle model in formal analysis. Our ward secrecy and ui’s freshness.
security model is based on one of its extended version called
Real-or-Random model [24] which has a provably stronger Test(ui/msj) This query models the attack on session key se-
definition towards semantic security. The main difference be- curity. When an adversary sends this query to an instance, it
tween it and the Random Oracle model lies in the queries pro- returns the session key or a random string to the adversary
vided for the adversaries. In Real-or-Random model, the adver- based on the value of an unbiased coin c. The coin c is flipped
saries are not allowed to ask a Corrupt query; instead, they can at the beginning of the Test(ui/msj) query. The instance returns
ask many Test queries until they get a satisfying result. The the invalid symbol ⊥ if no session key is defined. Otherwise, it
related definitions used in our proof are described as follows. returns the session key if the hidden value c = 1 or returns a
random string if c = 0. If the adversary askes many Test
Participants There are three types of participants in the pro- queries, the outputs should depend on the same value of c
posed scheme: the users, the medical servers and the trusted and the random string should be consistent.
server. Let U and MS be the set of users and the medical
servers respectively. The notation ui represents the instance i Hash(x, H(x)) This query is modeled by a random oracle, which
of a participant in U; and msj denotes the instance j of a par- mainly conducts a matching and comparison of the input value
ticipant in MS. The notation TS denotes the trusted server x. If x exists in the hash query list, the corresponding output
J Med Syst (2018) 42:250 Page 7 of 13 250

Fig. 5 Authentication and key

agreement phase of the proposed
scheme

value h(x) is returned when queried. If not, a random string r is been corrupted. The adversary A sends a series of queries to
returned and the tuple <x, r > is added to the hash query list. these two fresh oracles and each oracle returns the correspond-
Note that both of the participants and the adversary use the ing reply message to the adversary according to the queries
same random oracle to simulate the hash function. defined in our security model. In the end of each game, the
adversary A askes a Test query and provides a guessing the
Security definitions value c’. If c’ equals to the hidden value c, the adversary wins
the game. Otherwise, the proposed scheme succeeds in pro-
AKE security viding AKE security. The advantage that an adversary correct-
ly guesses the hidden value c is denoted as Advake(A), and the
AKE security [23, 24] mainly focuses on the session key se- definition is as below:
curity which means an adversary A cannot correctly distin-
guish the encrypted messages from a query oracle. In the Advake ðAÞ ¼ 2jPr½E −1=2j
execution of the scheme, the adversary interacts with two
fresh oracles ui and msj, which means ui and msj have never where E denotes the event that an adversary wins the game.
 250 Page 8 of 13 J Med Syst (2018) 42:250

The scheme is a secure authenticated key exchange scheme if probabilistic polynomial time, and the adversary Aake is de-
Advake(A) is negligible [13]. signed to break the session key security. Then, the adversary
obtains many related or trashy messages by accessing the
Mutual authentication queries (Execute query, Send query, Test query and Hash que-
ry) and then she/he will attempt to distinguish the session key
Mutual authentication [23, 24] requires all communication from various random strings. Before the start of the game,
entities are authenticated with each other in the same scheme. each query sets up the related parameters and forms the cor-
If an adversary A correctly forges the authenticators I0, I3, I9 responding syntax rules to determine what should be returned
and I11, the proposed scheme fails to provide mutual authen- to the adversary. At the end of the game, the adversary Aake
tication. The probability that an adversary successfully fakes strives to guess the secret bit c’. If c’ is equal to the hidden
those authenticator is denoted as Advma(A). If Advma(A) is value c, the adversary Aake wins the game.
negligible, the proposed scheme provides mutual authentica- Game G0: This game is executed to simulate the real attack
tion [13]. environment. All instances and related parameters are simu-
The Difference Lemma [25] is used in our series of games, lated. By the above definition, we get:
and the definition is denoted as below: Advake ðAake Þ ¼ 2jPr½E0 −1=2j ð1Þ

Lemma 1 (Difference Lemma) Let M, N and Q be events

defined in some possible probability distribution and suppose Game G1 This game is simulated like the Game G0 except for
that . In general, the event Q is neg- using a hash query to construct a session key between ui and
ligible. And then the Difference Lemma is described: msj. Game G1 and Game G0 are indistinguishable except the
collisions of Hash query list in game G1. Therefore, due to the
jPr½M −Pr½N j ≤ Pr½Q birthday paradox and the Lemma 1, we have:


jPr½E 1 −Pr½E 0 j≤ 2  qh 2 =2l ð2Þ
Security proof
Game G2 When the adversary intercepts the transmitted mes-
Session key security
sage, she/he is capable of acquiring Ia = I0 ⊕ Ta(h(IDi||Pi)||Sj)
mod p and Ib = h(IDi||Sj) ⊕ Tb(h(IDi||Pi)||Sj) mod p. In this
Theorem 1 Based on the above definitions, we claim that the
game, the adversary attempts to obtain the session key SK =
advantage that an adversary violates the AKE security of the
Tab(h(IDi||Pi)||Sj) mod p with the intercepted messages Ia and
proposed scheme is described as follows:
Ib. Hence, Game G2 and Game G1 are indistinguishable except


Advake ≤ qh 2 =2l−2 þ 4  AdvDLP þ 2  AdvDDH for solving the Chebyshev chaotic map-based Diffie-Hellman
problem. Based on the Lemma 1, we get:
where qh denotes the upper number of hash query list and l is a
secure parameter, AdvDLP denotes the advantage that an ad- jPr½E 3 −Pr½E 2 j≤ AdvDDH ðAddh Þ ð3Þ
versary breaks the extended chaotic map-based discrete loga-
rithm problem and AdvDDH denotes the advantage that an
Game G3 This game replaces a, b with two random integers
adversary solves the extended chaotic map-based Diffie-
respectively. To obtain the two integers a, b, the adversary
Hellman problem.
needs to break the extended Chebyshev chaotic map-based
discrete logarithm problem. Thus, Game G3 is indistinguish-
Proof The security proof of the proposed scheme adopts the
able with Game G2 except for settling the Chebyshev chaotic
method of the jurisdiction proof. The proof consists of a se-
map-based discrete logarithm problem. According to the
quence of games Gi, which starts at the real attack environ-
Lemma 1, we obtain:
ment (G0) and ends in the situation where the adversary has no
advantage (G3). In each game Gi, we define Ei as the event that

jPr½E 2 −Pr½E 1 j≤ 2  AdvDLP Adlp ð4Þ
an adversary wins the game Gi, and then gradually allow the
adversary to ask more queries to increase the advantage of
After the Game G3, all secret information and random
winning this game. Let Adlp denotes the advantage that an
numbers are independently generated and nothing about the
adversary breaks the extended chaotic map-based discrete log-
hidden value c is leaked. Therefore, we have:
arithm problem of the public-key cryptosystem within proba-
bilistic polynomial time, Addh denotes the advantage that a Pr½E3  ¼ 1=2 ð5Þ
DDH attacker solves the DDH complexity problem within
J Med Syst (2018) 42:250 Page 9 of 13 250

Finally, combine (1)–(5), we get the advantage that the indistinguishable except for solving the extended chaotic
adversary breaks the session key security of the proposed map-based discrete logarithm problem, from the Lemma 1,
scheme is: we obtain:




Advake ðAake Þ≤ qh 2 =2l−2 þ 4  AdvDLP Adlp þ 2 jPr½E 2 −Pr½E 1 j≤ 2  AdvDLP Adlp ð8Þ

 AdvDDH ðAddh Þ Game G3: This game transforms the previous game by
replacing the related authenticators I0, I3, I9, I11 with four
Thus, the proposed scheme provides session key security. random integers respectively. Similarly, Game G3 and Game
G2 are indistinguishable except collisions of a hash function in
Mutual authentication I9 and I11, and thus according to the birthday paradox and
Lemma 1, we have:
Theorem 2 Based on the definition of mutual authentication,

we denote the advantage that an adversary violates the mutual jPr½E 3 −Pr½E 2 j≤ 2  qh 2 =2l ð9Þ
authentication as Advma. If Advma is negligible, then the pro-
posed scheme provides mutual authentication. After the Game G3, it is evident that the probability that the
adversary Ama successfully guesses the hidden value c is equal
Proof The proof also consists of a series of games Gi, which to the probability that the adversary A1 guesses the value c
start at the simulation of an actual network environment in the correctly. Therefore, the adversary cannot verify the validity
PoC (G0) and end in the circumstance that the adversary has of the secret output information and distinguish whether the
no advantage (G3). In each game Gi, we define Ei as the event real secret key or a random string is returned successfully.
that the adversary wins the game Gi. Assume that the adver- That is, the adversary has no knowledge about the response
sary A1 attempts to compromise the long-term secret informa- string’s authenticity. Hence, we deduce:
tion (k, r and pwi), and the adversary Ama is assumed to break Pr½E3  ¼ 1=2 ð10Þ
mutual authentication of the proposed scheme. In addition,
Advsk denotes the advantage that an adversary compromises Finally, combine (6)–(10), we get the probability that an
the long-term secret information and AdvDLP is constructed as adversary violates the mutual authentication of our proposed
an adversary that breaks the extended chaotic map-based dis- scheme is:
crete logarithm problem. Then, an adversary Ama obtains

many related or useless messages by accessing the queries Advma ðAma Þ≤ 6  Advsk ðA1 Þ þ 4  AdvDLP Adlp þ qh 2 =2l−2
(Execute query, Send query, Test query and Hash query) and
Consider that the complexity of the birthday paradox and
attempts to distinguish the authenticators I0, I3, I9 and I11. If
the Chebyshev chaotic map-based discrete logarithm problem,
the adversary successfully distinguishes these authenticators,
l is a secure parameter, thus qh2/2l-2 and AdvDLP(Adlp) are
the adversary wins the game. Otherwise, the proposed scheme
negligible. In addition, breaking the long-term secret informa-
provides mutual authentication security.
tion in probabilistic polynomial time is also considered to be
Game G0: This game is executed in the real attack environ-
ignorable. Therefore, Advma(Ama) is negligible, that is, our
ment, in which the adversary guesses the authenticators with-
proposed scheme provides mutual authentication.
out querying any oracles. By the above definition, we have:
Advma ðAma Þ ¼ 2jPr½E0 −1=2j ð6Þ User anonymity

Game G1: This game is indistinguishable with Game G0 In the proposed scheme, the user’s identity is protected by a
except replacing the long-term secret information (k, r and secure hash function and some related XOR (exclusive or)
pwi) with three random numbers respectively. The adversary encryption operations. In the registration phase, the user’s
wins the game if she/he successfully guesses these substitutes, identity is protected by a high entropy random integer m and
thus, according to Lemma 1, we get: a secure hash function. In the login and authentication phase,
jPr½E 1 −Pr½E 0 j≤ 3  Advsk ðA1 Þ ð7Þ the user’s identity is protected either by XOR encryption op-
erations in I4 and I8, or by a secure hash function in Pi, SIDj,
Game G2: To increase the chance of winning this game, the I1new, I11 with some other additional information such as the
adversary replace a, b with two random integers respectively. user’s password pwi, the current timestamp T1 and the random
To get the accurate value of a and b from I5 = Ta(h(IDi||Pi)||Sj) integer n. Due to the one-way property of a secure hash func-
mod p and I10 = Tb(h(IDi||Pi)||Sj) mod p, the adversary needs to tion and XOR encryption operations, an adversary cannot ac-
solve the extended Chebyshev chaotic map-based discrete curately extract the user’s real identity. Therefore, the pro-
logarithm problem. Therefore, Game G2 and Game G1 are posed scheme provides user anonymity.
 250 Page 10 of 13 J Med Syst (2018) 42:250

Perfect forward secrecy user’s password pwi. Therefore, even if an adversary is a

privileged-insider of the trusted server or a system manager,
Perfect forward secrecy means that if long-term private keys she/he cannot obtain the user’s password unless she/he suc-
of one or more entities are compromised, the secrecy of pre- cessfully breaks the extended Chebyshev chaotic map-based
vious session keys established by honest entities is not affect- discrete logarithm problem. In the login and authentication
ed. In the proposed scheme, the generated session key is SK = phase, the user’s password is protected by a secure hash func-
Tab(h(IDi||h(IDi||pwi)||MSj) = Tb(I5) = Ta(I10) mod p. To com- tion in Pi = h(IDi||pwi), which results in that the adversary
promise the session key with the transmitted message, an ad- cannot extract the user’s password unless she/he violates the
versary needs to obtain all related components of the session irreversibility of hash function in probabilistic polynomial
key, such as long-term private keys pwi, k and r of several time and obtains the user’s real identity IDi. Thus, the pro-
entities. However, the adversary fails to break the session posed scheme resists privileged-insider attacks.
key since the proposed scheme provides user anonymity
based on the analysis in the subsection BUser anonymity^. Resistance to known session specific temporary information
Meanwhile, the secret information I5 and I10 are protected attacks
by a secure hash function, the users’ identities IDi and MSj.
Therefore, the adversary cannot extract correct messages to Known session specific temporary information attack means
compromise the session key. Furthermore, even if the adver- that the compromise of short-term secret information should
sary illegally obtains the related information IDi and MSj or I5 obtain the generated session key. When the related temporary
and I10, she/he still cannot compute the legal session key since integer a is leaked, an adversary cannot compute I5 = Ia ⊕ I0
she/he has no knowledge of the random integers a, b due to because she/he has no information about I0 without the user’s
the extended chaotic map-based discrete logarithm problem. password. Furthermore, according to the analysis in subsection
Thus, the proposed scheme provides perfect forward secrecy. BUser anonymity^, the adversary has no ability to compute
I10 = Ib ⊕ h(IDi||Sj) since she/he cannot obtain the user’s real
Resistance to stolen-verifier attacks identity. Therefore, the adversary cannot calculate the accurate
session key SK = Tb(I5) = Ta(I10) mod p because she/he has no
The stolen-verifier attack means an adversary who steals the knowledge of I5 and I10, namely, the proposed scheme resists
password-verifier from the server can use it directly to mas- known session specific temporary information attacks.
querade as a legitimate user in a user authentication process.
Assuming that the adversary obtains the verification list {(I0, Resistance to impersonation attacks
I1, I3)/(MSj, MSr)} and tries to pass the smart card’s verifica-
tion in the login phase. To pass the verification, she/he needs In the login phase, assume that an adversary sends the forged
to obtain the legal identity and corresponding password. But message {SIDj’, Qi’, I1’, I4’, Ia’, T1’} to the trusted server TS to
the user’s real identity and password are protected by a secure impersonate a user Ui, where T1’ is the current timestamp.
hash function with some random integers or an extended After the trusted server TS receives the transmitted message,
Chebyshev chaotic map-based discrete logarithm problem. it firstly checks the freshness of the timestamp T1’. If the
Thus the adversary cannot pass the verification of the smart timestamp T1’ is illegal, TS stops the current session. Then
card. Besides, even though the adversary passes the smart the trusted server TS extracts I0 according to the received
card’s verification by chance, she/he still fails to pass the message I1’. Even if I1’ is equal to I1, the adversary still cannot
TS’s verification since the proposed scheme adopts the dy- get the corresponding I0 since I1 = h(IDi||m) is a dynamic iden-
namic verification information I1 = h(IDi||n), namely, dynamic tity and is protected by a secure one-way hash function and a
I1 prevents the adversary from accurately locate the related varied random integer. Therefore, the adversary cannot pass
information I0 and then fails to get the legal authentication the verification of the trusted server because she/he cannot
message I3. Therefore, the proposed scheme resists stolen- obtain the valid verification message I3’ without the real iden-
verifier attacks. tity and corresponding I0, namely, the adversary cannot im-
personate a user Ui to cheat the trusted server TS.
Resistance to privileged-insider attacks In the authentication and key agreement phase, suppose the
adversary sends a faked message {I6’, I7’, I8’, I9’, I1new^, T3’} to
In the proposed scheme, the user’s password is protected ei- the medical server MSj to impersonate the trusted server TS,
ther by a secure hash function or by a complicated Chebyshev where I9’ = h(Sg′||h(MSj’)||T3’) and T3’ is the current timestamp.
chaotic map. Specifically speaking, in the registration phase, After receiving the transmitted message, MSj firstly checks the
the user’s password pwi is submitted to the trusted server in an freshness of the timestamp T3’. If the timestamp T3’ is illegal,
encrypted way TPWi = Tpwi(x). After the trusted server TS re- MSj ends the current session immediately. Moreover, an ad-
ceives the registration request, it has no knowledge of the versary cannot compute the actual authentication message Sg′
J Med Syst (2018) 42:250 Page 11 of 13 250

without the knowledge of long-term secret key k and r unless and Table 3. As shown in Table 2, the proposed scheme can
she/he breaks the extended chaotic map-based discrete loga- resist various known attacks and satisfy more security require-
rithm problem. Thus, an adversary cannot generate a legal I9 ments compared with other authenticated key agreement
to pass the authentication of the medical server and success- schemes [16, 20, 26–28].
fully impersonates the trusted server TS to fool the medical Y: The scheme resists the attack or provides the security
server MSj. property; N: The scheme does not resist the attack or does not
In order to impersonate the medical server MSj to cheat the provide the security feature.
user Ui, an adversary generates a forged message {I6’, I11’, T5’, In certain circumstances of PoC, sensor nodes embedded in
I1new^} and sends it to the user Ui. Nevertheless, an adversary the human body or placed in the body surface carry the vital
cannot successfully construct the related local parameters of the information of the user, such as the user’s identity, state and
session key since the proposed scheme provides user anonym- physical index, thus it is quite critical to protecting the user’s
ity and the password pwi is protected by the complexity of the sensitive information from being leaked. In addition, the enti-
extended chaotic map-based discrete logarithm problem. ties of PoC communicate with each other in an open channel,
Therefore, an adversary cannot successfully compute the accu- which requires the design of an authentication scheme should
rate session key SK, thereby fails to get the legal verification withstand various security threats and loopholes. Security
message I11’, i.e., an adversary cannot successfully impersonate guarantee and privacy protection are the two quite important
the medical server MSj to cheat the user Ui. In a conclusion, the points in the PoC. In Table 2, the aforementioned six schemes
proposed scheme withstands impersonation attacks. except the proposed scheme and Xiong et al.’s scheme [26]
cannot resist known session specific temporary information
Resistance to man-in-the-middle attacks attacks, which pose a serious threat to the negotiated session
key between the user and corresponding server. Besides, the
Based on the above analysis, we know that the mutual authen- related schemes [16, 26–28] are vulnerable to denial of service
tication among Ui, TS and MSj has been satisfied. Thus the attacks when many illegal users access the gateway node or
proposed scheme withstands man-in-the-middle attacks. registration center simultaneously. Furthermore, Xiong et al.’s
scheme [26] and Li et al.’s scheme [27] fail to provide user
Resistance to smart card theft attacks anonymity and user untraceability. Kumari et al.’s scheme
[20] cannot ensure user untraceability. These flaws will cause
If the smart card is stolen, an adversary can obtain all the a severe consequence that the user’s private information may
information {KPWi, I1, h(·)} stored in the smart card through be illegally used by a malicious attacker. Finally, Xiong et al.’s
side-channel attacks, and then attempts to enter the system by scheme [26] fails to provide session key security. Li et al.’s
using the information stored in the smart card. However, in the scheme [27] and Lee et al.’s scheme [29] cannot withstand
login process, the adversary has no ability to compute I0 = replay attacks. Compared with other related works [16, 20,
IDi ⊕ KPWi correctly without the knowledge of user’s identity 26–28], the proposed scheme successfully avoids the afore-
IDi according to the analysis in 4.3.3. Even if the adversary mentioned security drawbacks and provides more security
obtains the legal I0 and then tries to extract the user’s password attributions for the PoC.
pwi from the message I0 = Tpwi(Tk(x)), she/he will face the In the following, the computational cost of our proposed
extended chaotic map-based discrete logarithm problem. scheme and other related schemes [16, 20, 26–28] are com-
Thus the adversary cannot pass the validation of the smart pared to evaluate the performance of our scheme. Note that the
card. In addition, the adversary also cannot fabricate a legal time consuming of string concatenation and exclusive-or op-
identity to match with the corresponding password since she/ erations are negligible during the evaluating process. For the
he has no ability to extract the user’s real identity IDi from I1 = convenience of evaluating the computational cost, some nota-
h(IDi||m) according to the irreversibility of hash function. tions are defined as follows:
Therefore, an adversary cannot impersonate a legitimate user
Ts The time for executing a symmetric key encryption/ de-
to login into the e-health systems and exercise the same rights
cryption operation.
as a legal user, that is, the proposed scheme resists smart card
Th The time for executing a one-way hash function opera-
theft attacks.
tion.
Tc The time for executing a Chebyshev polynomial
computation.
Performance analysis
In particular, we only consider the login phase and the
This section analyzes the proposed scheme and other related authentication and key agreement phase because they are
schemes [16, 20, 26–28] in terms of functionality and compu- dominant operations in the execution process of the related
tational overhead, which are respectively described in Table 2 schemes. In our proposed scheme, three entities communicate
 250 Page 12 of 13 J Med Syst (2018) 42:250

Table 2 The functionality comparisons of related schemes

Security threats & features Xiong et al. [26] Li et al. [27] Lee et al. [28] Kumari et al. [20] Lee et al. [16] Our’s

Replay attacks Y N N Y Y Y
Impersonation attacks Y Y Y Y Y Y
Man-in-the-middle attacks Y Y Y Y Y Y
Password guessing attacks Y Y Y Y Y Y
Stolen-verifier attacks Y Y Y Y Y Y
Denial of service attacks N N N Y N Y
Many Logged-in Users’ attacks Y Y Y Y Y Y
Known session specific temporary information attacks Y N N N N Y
Smart card theft attack Y Y Y Y Y Y
Privileged-insider attack Y Y Y Y Y Y
User anonymity N N Y Y Y Y
User untraceability N N Y N Y Y
Mutual authentication Y Y Y Y Y Y
Session key security N Y Y Y Y Y
Perfect forward secrecy Y Y Y Y Y Y

with each other by a series of encryption/decryption and ver- executing a one-way hash function operation Th are approxi-
ification operations. In the login and authentication process, mate. Moreover, the time of executing a symmetric
the user Ui executes 6 one-way hash function operations and 3 encryption/decryption operation Ts is as nearly 18 times as
Chebyshev polynomial computations, which are primary to that of executing a one-way hash function operation Th [31].
the total computation cost at the user side. And the trusted Table 3 shows the total computational complexity of the pro-
server TS performs the related operations to verify the legality posed scheme is approximately 22Th + 8Tc. According to
of the received message and sends an authentication message Table 3, both Li et al.’s scheme [27] and Lee et al.’s scheme
to the corresponding medical server. To check the validity of [28] need to execute 6 symmetric encryption/decryption oper-
the transmitted message, the trusted server TS needs to com- ations, and Kumari et al.’s scheme [20] is required to perform
pute 3 one-way hash functions operations and 1 Chebyshev 4 symmetric computations. Compared with their schemes [20,
polynomial computation. Besides, the trusted server TS still 27, 28], the proposed scheme reduces the computational cost
needs to execute 6 one-way hash function operations and 1 efficiently by avoiding performing complex symmetric
Chebyshev polynomial computation to establish a reliable encryption/decryption operations. As shown in Table 3, the
connection with the corresponding medical server. Next, the proposed scheme is as efficient as Xiong et al.’s scheme [26]
corresponding medical server carries out 2 one-way hash and Lee et al.’s scheme [16]. However, Xiong et al.’s scheme
function operations and 1 Chebyshev polynomial computa- [26] is suffered from denial of service attacks and cannot pro-
tion to authenticate the trusted server and then executes 5 vide user anonymity and user untraceability. And Lee et al.’s
one-way hash function operations and 2 Chebyshev polyno- scheme [16] is vulnerable to denial of service attacks and
mial computations to negotiate a secure session key with the known session specific temporary information attacks.
user for the following communications. Therefore, the proposed scheme is more suitable for the
According to the research [17, 29, 30], the time of execut- resource-constrained PoC in terms of the computational com-
ing a Chebyshev polynomial computation Tc and the time of plexity and security requirements.

Table 3 The computation comparisons of related schemes

Entities & computation Related schemes

Xiong et al. [26] Li et al. [27] Lee et al. [28] Kumari et al. [20] Lee et al. [16] Ours

Ui /UA 8Th + 3Tc 5Th + 2Ts + 2Tc 5Th + Ts + 3Tc 5Th + 2Ts + 2Tc 3Th + 3Tc 6Th + 3Tc
SNj /UB 5Th + 2Tc 4Th + 2Ts + 2Tc 5Th + Ts + 3Tc 3Th + 2Tc 4Th + 2Tc 7Th + 3Tc
GWN/Server/RC 11Th + Tc 3Th + 2Ts 4Th + 4Ts + 2Tc 6Th + 2Ts 6Th + Tc 9Th + 2Tc
Total 24Th + 6Tc 12Th + 6Ts + 4Tc 14Th + 6Ts + 8Tc 14Th + 4Ts + 4Tc 13Th + 6Tc 22Th + 8Tc
J Med Syst (2018) 42:250 Page 13 of 13 250

Conclusions 11. He, D., Kumar, N., Chen, J., Lee, C. C., Chilamkurti, N., and Yeo,
S. S., Robust anonymous authentication protocol for health-care
applications using wireless medical sensor networks. Multimed.
In this paper, we propose a secure chaotic maps-based authen- Syst. 21(1):49–60, 2015.
tication and key agreement scheme with user privacy protection 12. Gope, P., and Hwang, T., BSN-care: A secure IoT-based modern
for the PoC. In the proposed scheme, the Chebyshev polyno- healthcare system using body sensor network. IEEE Sens. J. 16(5):
1368–1376, 2016.
mial combined with one-way hash functions are adopted to
13. Chang, I. P., Lee, T. F., Lin, T. H., and Liu, C. M., Enhanced two-
construct an authentication and key agreement scheme. The factor authentication and key agreement using dynamic identities in
proposed scheme realizes user anonymity and user wireless sensor networks. Sensors. 15(12):29841–29854, 2015.
untraceability during the mutual authentication and key agree- 14. Kocarev, L., and Tasev, Z., Public-key encryption based on
Chebyshev maps. Proc. Int. Sym. Circ. Syst. 3: III-28-III-31 2003.
ment by encrypting the user’s identity and eliminating all re-
15. Mason, J. C., and Handscomb, D. C., Chebyshev polynomials.
dundant variables. In addition, session key security and mutual Boca Raton: Chapman & Hall/CRC, 2003.
authentication of the proposed scheme are demonstrated via 16. Bergamo, P., D’Arco, P., Santis, A., and Kocarev, L., Security of
Real-or-Random Oracle model. Performance analysis shows public-key cryptosystems based on Chebyshev polynomials. IEEE
Trans. Circ. Syst. 52(7):1382–1393, 2004.
that the proposed scheme is a lightweight authentication
17. Lee, T., Provably secure anonymous single-sign-on authentication
scheme. Therefore, the proposed scheme achieves a delicate mechanisms using extended Chebyshev chaotic maps for distribut-
balance between the efficiency and security and is more suitable ed Computer networks. IEEE Syst. J. 1–8, 2015.
for the resource-constrained and high-privacy-required PoC. 18. Lai, H., Xiao, J., Li, L., and Yang, Y., Applying semigroup property
of enhanced Chebyshev polynomials to anonymous authentication
protocol, Math. Probl. Eng. 2012.
Funding Information This work was supported by the National Natural
19. Zhao, F., Gong, P., Li, S., Li, M., and Li, P., Cryptanalysis and
Science Foundation of China [grant numbers 61,303,237].
improvement of a three-party key agreement protocol using en-
hanced Chebyshev polynomials. Nonlinear Dyn. 74(1–2):419–
Compliance with Ethical Standards 427, 2013.
20. Kumari, S., Li, X., Wu, F., Das, A. K., Arshad, H., and Khan, M. K.,
Conflict of Interests The authors declare that we have no conflicts of A user friendly mutual authentication and key agreement scheme
interest. for wireless sensor networks using chaotic maps. Future Gen.
Comput. Syst. 63(C):56–75, 2016.
21. Lee, T. F., Efficient and secure temporal credential-based authenti-
Ethical Approval This article does not contain any studies with human
cated key agreement using extended chaotic maps for wireless sen-
participants or animals performed by any of the authors.
sor networks. Sensors. 15(7):14960–14980, 2015.
22. Zhang, L., Cryptanalysis of the public key encryption based on
multiple chaotic systems. Chaos Soliton Fract. 37(3):669–674,
References 2008.
23. Bellare, M., Pointcheval, D., and Rogaway, P., Authenticated key
exchange secure against dictionary attacks. Lect. Notes Comput.
1. Abuadbba, A., and Khalil, I., Walsh-Hadamard-Based 3-D stega-
Sci. 1807:139–155, 2000.
nography for protecting sensitive information in point-of-care.
24. Abdalla, M., Fouque, P. A., and Pointcheval, D., Password-based
IEEE Trans. Biomed. Eng. 64(9):2186–2195, 2017.
authenticated key exchange in the three-party setting in public key
2. Movassaghi, S., Abolhasan, M., Lipman, J., Smith, D., and
cryptography - PKC. Springer-Verlag Berlin 3386(2005):65–84,
Jamalipour, A., Wireless body area networks: A survey. IEEE
2005.
Commun. Surv. Tutor. 16(3):1658–1685, 2014.
25. Shoup, V., Sequences of games: A tool for taming complexity in
3. Chatzigiannakis, I., Vitaletti, A., and Pyrgelis, A., A privacy- security proofs, Manuscript, 2004. http://www.shoup.net (Accessed
preserving smart parking system using an IoT elliptic curve based 12 September 2016).
security platform. Comput. Commun. 89–90:165–177, 2016. 26. Xiong, H., Tao, J., and Chen, Y., A robust and anonymous two
4. Das, M. L., Two-factor user authentication scheme in wireless sen- factor authentication and key agreement protocol for telecare med-
sor networks. IEEE Trans. Wirel. Commun. 8:1086–1090, 2009. icine information systems. J. Med. Syst. 40(11):228, 2016.
5. Lee, C. I, and Chien, H. Y., An elliptic curve cryptography-based 27. Li, X., Niu, J., Kumari, S., Khan, M. K., Liao, J., and Liang, W.,
RFID authentication securing E-health system. Taylor & Francis, Design and analysis of a chaotic maps-based three-party authenti-
Inc. 2015. cated key agreement protocol. Nonlinear Dyn. 80(3):1209–1220,
6. Challa, S., et al., An efficient ECC-based provably secure three- 2015.
factor user authentication and key agreement protocol for wireless 28. Lee, C. C., Li, C. T., Chiu, S. T., and Lai, Y. M., A new three-party-
healthcare sensor networks. Comput. Electr. Eng. 2017. authenticated key agreement scheme based on chaotic maps with-
7. Lee, Y. S., Alasaarela, E., and Lee, H. J., An efficient encryption out password table. Nonlinear Dyn. 79(4):2485–2495, 2014.
scheme using elliptic curve cryptography (ECC) with symmetric 29. Xiao, D., Liao, X., and Deng, S., One-way hash function construc-
algorithm for healthcare system. Int. J. Sec. Appl. 8(3):63–70, 2014. tion based on the chaotic map with changeable-parameter. Chaos
8. Hou, J. L., and Yeh, K. H., Novel authentication schemes for IoT based Solitons Fract. 24(1):65–71, 2005.
healthcare systems. Int. J. Distrib. Sens. Netw. 2015(4):1–9, 2015. 30. Cheng, Z. Y., Liu, Y., Chang, C. C., and Chang, S. C.,
9. Li, C. T., Lee, C. C., Weng, C. Y., and Chen, S. J., A secure dynamic Authenticated RFID security mechanism based on chaotic maps.
identity and chaotic maps based user authentication and key agree- Sec. Commun. Netw. 6(2):247–256, 2013.
ment scheme for e-healthcare systems. J. Med. Syst. 40(11):233, 2016. 31. He, D., Zhang, Y., and Chen, J., Cryptanalysis and improvement of
10. Yeh, K. H., A secure iot-based healthcare system with body sensor an anonymous authentication protocol for wireless access networks.
networks. IEEE Access, 10288–10299, 2016. Wirel. Personal Commun. 74(2):229–243, 2014.