A Lightweight Authentication and Key Agreement Scheme for Telecare Medicine Information System

Abstract

With the advancement of Internet of Thing, the telecare medicine information system provides efficient and convenient healthcare services for patients. However, it has also spawned many privacy and security issues. Recently, Amin and Biswas pointed out that the scheme proposed by Giri et al. is vulnerable to offline password-guessing attacks and insider attacks and fails to protect user anonymity, and they proposed an improved scheme. Arshad and Rasoolzadegan pointed out that the scheme proposed by Amin and Biswas cannot withstand offline password-guessing attacks and replay attacks and cannot provide perfect forward secrecy. This article shows that the scheme proposed by Arshad and Rasoolzadegan does not allow changing one’s own password offline. Therefore, we propose a new scheme to solve this problem and improve efficiency and security.