Telecare medical information systems are developed to establish an online convenient communication platform for patients and medical staff to exchange healthcare related services. Being installed on Internet, these systems are prone to different security and privacy threats, which may result in leakage of sensitive health-related data and privacy compromise of the patients. Hence, a major challenge is to establish a secure communication channel between the patients and medical servers, where parties are mutually authenticated and a session key is agreed upon and shared between them for further information exchange. Recently, Ostad-Sharif et al. presented an ECCbased anonymous authentication and key agreement method for healthcare applications. In this article, we first prove that Ostadsharif et al.’s scheme is vulnerable to key compromise password guessing attacks and key compromise impersonation attacks. Then, we propose a secure and efficient authentication and key agreement scheme for telecare medical information systems which can provide mutual authentication and perfect forward secrecy, and resists against key compromise password guessing attacks, key compromise impersonation attacks, insider attacks, and replay attacks. The security of the proposed scheme is also proved formally with the Scyther tool.

Keywords