Telecare medical information systems are becoming more and more popular due to the provision of delivering health services including remote access to health profile for doctors, staff and patients. Since these systems are installed entirely on Internet, they are faced with different security and privacy threats. So, an important challenge is the establishment of a secure key agreement and authentication procedure between the medical servers and patients. Recently, an ECC-based authentication and key agreement scheme for telecare medical systems in smart city has been proposed by Khatoon et.al. In this paper, at first, we descriptively analyse Khatoon et al.’s protocol and demonstrate that it is vulnerable against to known-sessionspecific temporary information attack and cannot satisfy perfect forward secrecy. Next, we propose a provably secure and efficient authentication and key agreement protocol using Elliptic Curve Cryptography (ECC). The security of the proposed scheme is informally analysed and it is proved that it can satisfy perfect forward secrecy and resist known attacks such as user/server impersonation attack. The protocol is also simulated and its security is formally analyzed using Scyther tool. The results show its robustness against different types of attacks.

Keywords