Page 75 - 2023-Vol19-Issue2

71 |
user must be granted the proper access rights [4]. One of
the most straightforward and practical security solutions is
password-based authentication. Password-based authentica-
tion mechanisms are used in the healthcare system, e-business,
database management systems, and smart card applications.
Our method presents a feasible and verifiable patient EHR
fair exchange for health information systems. Patients must
not only delegate the transfer of their personal EHR from
their current hospital health information system to the hospi-
tal system of their choice but also retain their privacy [4]. Our analysis of the proposed scheme in terms of formal and in-
system ensures safe data storage and the secure transmission
of permitted information to a specified place. We propose a
high-level, realistic, and demonstrable patient EHR fair ex-
change model with key agreements for health information
systems. A patient can not only delegate the current hospital’s
health information systems to migrate their personal EHR to
the chosen hospital system but also maintain their privacy [5].
In India, EHR guidelines advocate for the safe sharing
of health information with minimal disclosure of personal
identification. The majority of identity-related breaches are
triggered by the leak of sensitive information associated with
identifiers, as well as the vast data collection and tracking
permitted by service providers [6]. The General Data Pro-
tection Regulation encourages entity-controlled identifiers
and limited information collection to preserve privacy. Many
countries have laws in place to protect patients’ privacy, such
as the Health Insurance Portability and Accountability Act
(HIPAA)in the United States. Confidentiality in telecare ser-
vices has become a key problem, especially how to ensure
patient data security and privacy while transmitting over a
public channel [7] [8]. User authentication is the first step in
ensuring that only authorized users have access to protected
data. Although password-based user authentication is the most
convenient approach, it is prone to numerous attacks and may
pose a threat to data security. Multifactor authentication is a
recommended strategy in which any user is granted access to
specified data after verifying two or more pieces of evidence
[9] [10] perform poorly or have serious security flaws in the
context of tele-health services. Our system stores data and
securely transfers approved information to defined places. In
this paper, we offer a safe technique for authenticating EHR
patients and the Healthcare Center Server using real mem-
ber IDs and verification codes. To provide robust security
while maintaining good performance. The proposed work
employs, based on multi-factor authentication, a lightweight
crypto-hash function for the generation of One-Time Pass-
words (OTP) and symmetric key encryption (CTR mode) and
an asymmetric key of homomorphic encryption Damgoard,
Geisler and Kroigaard (DGK) to offer strong security per-
formance. The primary goal of this research is to provide a
robust authentication mechanism to address difficulties iden-
Hamed & Yassin
tified in previous studies. In practice, the Scyther security
proof was utilized to show the strong security and resistance
of our strategy against hostile attacks. The suggested tech-
nique strikes a good compromise between security complexity
and performance, and it may be used in healthcare systems.
The remainder of the article is structured as follows. Sec-
tion 2 reviews the related work. Section 3 focuses on the
proposed scheme. Section 4 This section evaluates security
formal security analysis. Section 5 presents the performance
results. Finally, section 6 presents the conclusions.
II. RELATED WORK
A. Centralized Identity Management for Entity Authentica-
tion
As part of a centralized identity management system, a cen-
tralized identity distribution point (IDP) will be responsible
for issuing an identity (email ID, phone number, government
identification code, patient identification code), as well as
for maintaining the trust factor associated with those iden-
tities. Credential-based authentication is a well-established
initial line of defense in any identification scheme. As the pri-
vacy and security of patient data records are critical in EHRs,
credential-based protection is a relatively simple and adapt-
able first-hand solution that is able to identity theft, spoofing
attacks, data loss, and other types of privacy violations. It
is possible to add an extra layer of protection to the current
credentials-based authentication by including secondary fac-
tors such as OTP, captchas, patterns, or biometrics in addition
to the credentials-based authentication [11]. Many studies on
two-factor authentication [12] and three-factor authentication
[13] have been conducted for the purpose of validating medi-
cal records [12]. Although it adds an extra layer of protection,
multifactor authentication is vulnerable to attacks such as
identity theft, replay attacks, phishing attacks, and denial of
service attacks, among others. The authentication of entities
can be achieved by binding centralized identifiers to crypto-
graphically generated keys, signatures, and certificates with
the help of public key infrastructure (PKI).
B. Decentralized identity management for entity authenti-
cation
The whole concept of decentralization is founded on the basic
assumption that a transaction for the transfer of a commodity
or asset between two parties is accepted by the participating
nodes through the use of a consensus mechanism. This trans-
action is recorded in an immutable distributed ledger as part
of the transaction log. Blockchain is a practical distributed
ledger technology, and it was this protocol that introduced
the concept of decentralization into the settlement of finan-
cial transactions. Later, the framework was generalized in