Introduction

With comprehensive employment of the mobile networks, TMISs enable telecare which builds a convenient bridge between patients at home and the remote server a reality. In such system, patients without leaving home can access the same medical services as at hospital. TMISs provide greatly facilitate for some patients who are inconvenient to go to hospital, which saves a lot of the patients’ expenses and time. The problem is that the patients’ sensitive information may be eavesdropped by an illegal entity due to the unreliable communication channel. Therefore, a feasible authentication mechanism [1–5] is essential needed to ensure security and integrity of transmitting data for TMISs.

In 2009, Wu et al. [6] presented an authenticated key exchange scheme for TMISs and declared their scheme was more efficient compared with the previous schemes for TMISs by adding a precomputation step. However, He et al.[7] identified that the scheme was susceptible to internal and masquerade attacks. Then, He et al. introduced a more secure authentication scheme to conquer these flaws. Later, Wei et al.[8] pointed out that both Wu et al. and He et al.’s schemes were prone to suffer from off-line password guessing attack. An improved scheme with more security was designed by Wei et al. But Zhu et al. [9] discovered that Wei et al.’s scheme was still insecure against off-line password guessing attack. In order to eliminate such pitfall, Zhu et al. further proposed an enhancement based on Wei et al.’s scheme using RSA [10]. In 2013, Wu et al. [11] pointed out that Jiang et al.’s scheme [12] had some security drawbacks and proposed a new authentication scheme for TMIS. Unfortunately, Wen et al. [13] observed that Wu et al.’s scheme did not provide patient anonymity and failed to resist server spoofing and off-line password guessing attacks. In order to erase these drawbacks, Wen et al. proposed their modified scheme based on Wu et al.’s scheme. Lately, other researchers also proposed their authentication and key agreement schemes for TMISs [14–16]. All in all, above schemes aim to achieve two factor authentication.

Lately, research in two factor based authenticated key exchange schemes employing biometric have attracted a lot of well-deserved attention. In comparison to password, biometrics keys have many advantages [17], such as cannot be lost or forgotten, copied or shared, hard to be forged or distributed and cannot be guessed easily. Many biometric based authentication schemes combine password and smart card were appeared [18–23], and were becoming one of the most widely adopted authentication mechanisms. Awasthi et al. [24] presented a biometric authentication nonce based scheme for TMISs. However, Mishra et al.[25] observed that Awasthi et al.’s scheme was vulnerable to off-line password guessing attack and did not provide efficient password change option. Soon after that Tan et al.[26] found that Awasthi et al.’s scheme did not resist reflection attack and did not achieve three factor security and user anonymity. To remedy the weaknesses of Awasthi et al.’s scheme, Tan et al. presented a three factor authentication scheme and claimed that their scheme was secure against various attacks. Recently, Arshad et al.[27] pointed out that Tan et al.’s scheme did not withstand denial-of service and replay attacks. They then presented an improved elliptic curve cryptosystem (ECC)-based [28, 29] scheme to prevent the flaws.

In this paper, we briefly review Arshad et al.’s scheme. We demonstrate Arshad et al.’s scheme fails to protect against off-line password guessing attack. Additionally, we show that in case the adversary succeeded in getting identity and password of an arbitrary user, he can impersonate any user of the system. Furthermore, we put forward a biometric based authentication scheme for TMISs to cope with the loopholes of Arshad et al.’s scheme. The proposed scheme also employs lower computational operations such as ECC and hash function to lower its computational cost. Besides, we adopt BAN logic [30] to demonstrate the completeness of the enhanced scheme. Moreover, we present the security and performance analyses to show that our enhanced scheme satisfies more security properties and less computational cost compared with previously proposed schemes.

The rest of this paper is organized as follows. Section “Review of Arshad et al.’s scheme” and Section “Weaknesses of Arshad et al.’s scheme”review and security analysis of Arshad et al.’s scheme, respectively. Section “Proposed scheme” and Section “Analysis security” show our proposed scheme and analyze its security. Section “Functionality and performance comparisons” depicts the functionality and performance comparison among the proposed scheme and other related ones. Section “Conclusion” is a brief conclusion.

Review of Arshad et al.’s scheme

This section briefly reviews Arshad et al.’s biometric based password authentication scheme for TMISs. Their scheme contains three phases: registration, authentication and password change. Notations that will be used throughout the paper are listed in Table 1.

Table 1 Notations
Full size table

Registration

  1. (1)

    U selects his identity I D i , password P W i , a random number N C and imprints his biometric B i . Then, he computes M P W i = P W i ⊕ N C , M B i = B i ⊕ N C and submits {I D i , M P W i , M B i } to S.

  2. (2)

    S verifies whether I D i is in his database or not. If I D i is not found, S calculates A I D i = h 2(x||I D i ), V i = M P W i ⊕ M B i ⊕ I D i = P W i ⊕ B i ⊕ I D i , and W i = h 1(M B i ) ⊕ h 1(M P W i ) ⊕ I D i ⊕ A I D i . Furthermore, S chooses a random number N S and computes R i = x ⊕ N S , and M I D i = I D i ⊕ h 1(N S ). After that, S keeps I D i in his database and the information {V i , W i , R i , M I D i , τ, d(⋅), E, n, P, Y, h 1(⋅), h 2(⋅)} into a smart card S C i .

  3. (3)

    U stores N C into S C i . Now, S C i contains {N C , V i , W i , R i , M I D i , τ, d(⋅), E, n, P, Y, h 1(⋅), h 2(⋅)}

Authentication

  1. (1)

    U inserts S C i into a smart card reader, inputs I D i , and P W i , and imprints biometric \(B_{i}^{\ast }\) at the sensor. Then, S C i computes B i = V i ⊕ P W i ⊕ I D i and verifies whether the equation \(d(B_{i}, B_{i}^{ast}) < \tau \) holds or not. If holds, S C i computes A I D i = h 1(B i ⊕ N C ) ⊕ h 1(P W i ⊕ N C ) ⊕ I D i ⊕ W i , selects a random number d C and continues to compute R C = A I D i d C P = h 2(x||I D i )d C P, and V 1 = h 1(I D i ||R C ||A I D i ||T C ), and sends a message REQUEST {R C , T C , V 1, M I D i , R i } to S, where T C is the current time.

  2. (2)

    When receiving the message, S checks whether the transmission delay is within the allowed time interval Δ T. If T S −T C < Δ T, S computes N S = x ⊕ R i , derives I D i by computing M I D i ⊕ h 1(N S ), and checks whether I D i exists in database or not. If exists, S checks whether h 1(I D i ||R C ||h 2(x||I D i )||T C ) = ?V 1. If holds, S selects a random number d S and computes Q S = d S P and K 1 = h 2(x||I D i )−1 d S R C = d S d C P. Furthermore, S chooses a random number \(N_{S}^{New}\) and computes \(R_{i}^{\ast }=h_{1}(K_{1})\oplus x \oplus N_{S}^{New},\ MID_{i}^{\ast } = h_{1}(K_{1})\oplus ID_{i} \oplus h(N_{S}^{New})\), and \(V_{2}= h_{1}(MID_{i}^{\ast }||Q_{S}||K_{1}||R_{i}^{\ast }||ID_{i})\). Finally, S sends the message CHALLENGE \(\{Q_{S},\ V_{2},\ MID_{i}^{\ast },\ R_{i}^{\ast }\}\) to U.

  3. (3)

    After receiving the message, U computes K 2 = d C Q S = d C d S P and checks whether \(h_{1}(MID_{i}^{\ast }||Q_{S}||K_{2}||R_{i}^{\ast }||ID_{i})\stackrel {?}=V_{2}\). If the equation is true, U computes \(MID_{i}^{New}=MID_{i}^{\ast }\oplus h_{1}(K_{2}) ID_{i} \oplus h_{1}(N_{S}^{New})\), and \(R_{i}^{New} =R_{i}^{\ast } \oplus h_{1}(K_{2}) x \oplus N_{S}^{New}\). Then, U updates the values of M I D i and R i with the values of \(MID_{i}^{New} \)and \(R_{i}^{New}\), respectively. Finally, U computes V 3 = h 1(K 2||Q S ||I D i ), and the shared session key S K = h 1(I D i ||Q S ||K 2), and sends a message RESPONSE {V 3} to S.

  4. (4)

    After receiving the message, S checks whether h 1(K 1||Q S ||I D i ) = ?V 3. If equal, S accepts the shared session key SK as S K = h 1(I D i ||Q S ||K 1).

Password change

U inserts S C i into the card reader, inputs identity I D i , password P W i and imprints his biometric \(B_{i}^{\ast }\) at the sensor. S C i computes B i = V i ⊕ P W i ⊕ I D i and checks whether the equation \(d(B_{i}, B_{i}^{\ast }) < \tau \) holds or not. If holds, U keys a new password \(PW_{i}^{New}\) and imprints a new personal biometric \(B_{i}^{New}\). Then, S C i computes \(V_{i}^{new}\) and \(W_{i}^{New}\) as follows:

\(V_{i}^{New}=PW_{i}^{New}\oplus B_{i}^{New}\oplus PW_{i}\oplus B_{i}\oplus V_{i}= PW_{i}^{New}\oplus B_{i}^{New}\oplus ID_{i}\)

\(W_{i}^{New} =h_{1}(B_{i}^{New}\oplus N_{C}) \oplus h_{1}(PW_{i}^{New}\oplus N_{C})\oplus ID_{i}\oplus AID_{i}\) and updates S C i ’s memory V i , W i by \(V_{i}^{New},\ W_{i}^{New}\).

Weaknesses of Arshad et al.’s scheme

This section shows that Arshad et al.’s scheme [27] has two security drawbacks, which are discussed in the following subsections. The following attacks are based on the assumptions that a malicious attacker \(\mathcal {A}\) has completely monitor over the communication channel connecting U and S in login and authentication phase. So \(\mathcal {A}\) can eavesdrop, modify, insert, or delete any message transmitted via public channel [31].

Not withstanding the off-line password guessing attack

The password and identity are low entropy [32, 33]. Therefore, \(\mathcal {A}\) can guess a password \(PW^{\prime }_{i}\) and an identity I D i with the help of achieving values [34, 35] {V i , W i , R i , M I D i , τ, d(⋅), E, n, P, Y, h 1(⋅), h 2(⋅)} from the medical device and {R C , T C , V 1, M I D i , R i } from the login request message as follows:

  1. (1)

    \(\mathcal {A}\) guesses \(PW^{\prime }_{i}\) and \(ID^{\prime }_{i}\) and computes \(AID^{\prime }_{i}=h_{1}(V_{i}\oplus ID^{\prime }_{i}\oplus PW^{\prime }_{i}\oplus N_{C})\oplus h_{2}(PW^{\prime }_{i}\oplus N_{C})\oplus ID^{\prime }_{i}\oplus W_{i}\), \(V^{\prime }_{1}=h_{1}(ID^{\prime }_{i}||R_{C}||AID^{\prime }_{i}||T_{C})\). Then, \(\mathcal {A}\) checks \(V^{\prime }_{1}\stackrel {?}=V_{1}\).

  2. (2)

    If the verification succeeds, considers \(ID^{\prime }_{i}\) and \(PW^{\prime }_{i}\) as the user’s identity and password. Otherwise, he repeats (1).

If \(\mathcal {A}\) successfully guesses the identity and the password of the patient, it will result into another attack. The detail of the attack is discussed as the next subsection.

Not withstanding the user impersonation attack

As described in the previous subsection, \(\mathcal {A}\) can read [34, 35] the information {V i , W i , R i , M I D i , τ, d(⋅), E, n, P, Y, h 1(⋅), h 2(⋅)} stored in the smart card. After successfully guessing the password P W i and I D i , \(\mathcal {A}\) can launch a user impersonation attack with the eavesdropped message {R C , T C , V 1, M I D i , R i } in the following:

  1. (1)

    \(\mathcal {A}\) generates a random number \(d^{\prime }_{C}\) and computes \(R^{\prime }_{C}=AID_{i}d^{\prime }_{C}P, V^{\prime }_{1}=h_{1}(ID_{i}||R^{\prime }_{C}||ADI_{i}||T^{\prime }_{C})\). After that, he sends the REQUEST message \(\{R^{\prime }_{C},\ T^{\prime }_{C}, V^{\prime }_{1},\ MID_{i}, R_{i}\}\) to S, where \(T^{\prime }_{C}\) is the current timestamp.

  2. (2)

    After checking the freshness of \(T^{\prime }_{C}\), S derives N S and I D i and verifies \(h_{1}(ID_{i}||R^{\prime }_{C}||h_{2}(x||ID_{i})||T^{\prime }_{C})\stackrel {?}=V_{1}\). Obviously, the equation will be held due to the true identity. S then continues to perform the original scheme without any detected. Finally, S delivers the CHALLENGE message \(\{Q_{S},\ V_{2},\ MID_{i}^{\ast },\ R_{i}^{\ast }\}\) to \(\mathcal {A}\).

  3. (3)

    \(\mathcal {A}\) imitates what the patient were doing and computes V 3 and sends it to S, where \(V_{3}=h_{1}(d^{\prime }_{C}Q_{S}||Q_{S}||ID_{i})\). When receiving the value V 3, \(\mathcal {A}\) will surely pass through S. As a result, S negotiates the session key \(SK=h_{1}(ID_{i}||Q_{S}||d^{\prime }_{C}Q_{S})\) with \(\mathcal {A}\) who masquerades as the legal patient.

Proposed scheme

This section presents a slight modification scheme to remedy the weaknesses of Arshad et al.’s scheme. The proposed scheme aims to propose an efficient improvement on Arshad et al.’s scheme to overcome the weaknesses of their scheme, while also retaining the original merits of their scheme. In the proposed scheme, in order to resist the off-line password guessing attack, we employ biometrics to conceal password. And we adopt Biohashing to protect biometrics of patients, which can resolve high false rejection and hence decrease denial of service access probability [36, 37]. And biohashing is very efficient and lightweight as compared to modular exponentiation and elliptic curve point multiplication [38, 39]. The proposed scheme also contains three phases: registration, login and authentication and password updating (Fig. 1).

Fig. 1
figure 1

Registration and authentication phase of the enhanced scheme

Full size image

Registration

  1. (1)

    The patient U inputs his biometric B i , identity I D i and password P W i . Then, U calculates M P i = P W i ⊕ H(B i ) and submits {I D i , M P i } to the server S.

  2. (2)

    When receiving the message, S computes A I D i = I D i ⊕ h 2(x), V i = h 1(I D i ||M P i ) and issues a smart card S C i which contains the information {A I D i , V i , h 1(⋅), h 2(⋅), H(⋅)} to U.

Login and Authentication

  1. (1)

    U inserts S C i into a card reader and keys his identity I D i , password P W i and biometric B i . S C i computes h 1(I D i ||P W i ⊕ H(B i )) and verifies whether it is equal to the value V 1. If true, U passes through the verification. Then, S C i selects a random number d u and computes K = h 1(I D i ||I D i ⊕ A I D i ), M 1 = K ⊕ d u P, M 2 = h 1(I D i ||T 1||d u P), and transmits {M 1, M 2, A I D i , T 1} to S.

  2. (2)

    When receiving the login request, S first examines whether |T 1−T c | < Δ T, where T c is the current timestamp of the S. If holds, S uses his private key x to derive I D i by computing M 1 ⊕ h 2(x), he then computes d u P = K ⊕ M 1 and checks h(I D i ||T 1||d u P) = ?M 2. If correct, S then generates a random number d s and computes M 3 = K ⊕ d s P, S K = d s d u P, M 4 = h 1(K||T 2||S K||d u P), where T 2 is the current timestamp. At last, S sends the message {M 3, M 4, T 2} to U.

  3. (3)

    Upon receiving the message, U first checks the freshness of T 2. Then, U retrieves d s P by computing M 3 ⊕ K and computes \(SK=d_{u}d_{s}P,\ M^{\prime }_{4}=h_{1}(K||d_{u}P||SK||T_{2})\) to verify whether \(M^{\prime }_{4}\) is equal to the received M 4. If holds, U computes M 5 = h 1(K||d s P||S K||T 3) and then sends the message {M 5, T 3} to S, where T 3 is the current timestamp.

  4. (4)

    After receiving {M 5, T 3}, S verifies whether |T 3−T c | < Δ T and \(M^{\prime }_{5}=h_{1}(K||d_{s}P||SK||T_{3})\stackrel {?}=M_{5}\). If both conditions hold, S authenticates U and accepts SK as the session key for further operations.

Password change

If U doubts his password may be leaked, he can alter the old password to a new one as follows. U inserts his S C i into the device and submits his I D i , P W i and B i . Then S C i verifies whether h 1(I D i ||P W ⊕ H(B i )) = ?V i . If valid, U inputs a new password P W new, S C i calculates \(V_{i}^{new}=h_{1}(ID_{i}||PW^{new}\oplus H(B_{i}))\) then replaces V i with \(V_{i}^{new}\).

Analysis security

This section conducts a cryptanalysis of the enhanced scheme both through Burrows-Abadi-Needham (BAN) logic [30] and security features.

Proofing scheme with BAN logic

BAN logic [30] is a set of rules for defining and analyzing information exchange schemes (Table 2). It helps its users determine whether exchanged information is trustworthy, secured against eavesdropping, or both. It has been highly successful in analyzing the security of authentication schemes. We first introduce some notations and logical postulates of BAN logic used in our scheme.

  1. (1)

    BAN logical postulates

    1. a.

      Message-meaning rule: \(\frac {A|\equiv A\stackrel {K}\leftrightarrow B, A\triangleleft \{X\}\text {} _{K}}{A|\equiv | B\sim X}\): if A believes that K is shared by A and B, and sees X encrypted with K, then A believes that B once said X.

    2. b.

      Nonce-verification rule: \(\frac {A|\equiv \#X, A |\equiv B|\sim X}{A|\equiv B|\equiv X}\): if A believes that X could have been uttered only recently and that B once said X, then A believes that B believes X.

    3. c.

      The belief rule: \(\frac {A|\equiv X,\ A|\equiv Y}{A|\equiv (X,\ Y)}\): if A believes X and Y, then A believes (X, Y).

    4. d.

      Fresh conjuncatenation rule: \(\frac {A|\equiv \#X}{A|\equiv \#(X,\ Y)}\): if A believes freshness of X, B believes freshness of (X, Y).

    5. e.

      Jurisdiction rule: \(\frac {A|\equiv B\Rightarrow X,\ A |\equiv B|\equiv X}{A|\equiv X}\): if A believes that B has jurisdiction over X and A trusts B on the truth of X, then A believes X.

  2. (2)

    Idealized scheme

    U::

    < d u P > U ↔ K S , < I D i > h2(x), (I D i , d u P, T 1),(U ↔ S K S, d s P, T 3) U ↔ K S

    S::

    < d s P > U ↔ K S , (U ↔ S K S, d u P, T 2) U ↔ K S

  3. (3)

    Establishment of security goals

    g 1.:

    S| ≡ U| ≡ U ↔ S K S

    g 2.:

    S| ≡ U ↔ S K S

    g 3.:

    U| ≡ S| ≡ U ↔ S K S

    g 4.:

    U| ≡ U ↔ S K S

  4. (4)

    Initiative premises

    p 1.:

    U| ≡ #d u

    p 2.:

    S| ≡ #d s

    p 3.:

    U| ≡ U ↔ K S

    p 4.:

    S| ≡ U ↔ K S

    p 5.:

    \( U|\equiv S\Rightarrow (U\stackrel {SK}\longleftrightarrow S)\)

    p 6.:

    \( S|\equiv U\Rightarrow (U\stackrel {SK}\longleftrightarrow S)\)

  5. (5)

    Scheme analysis

    a 1.:

    Since p 3 and U ⊲ (U ↔ S K S, d u P, T 2) U ↔ K S , by the message-meaning rule, we get: U| ≡ S|∼(U ↔ S K S, d u P, T 2).

    a 2.:

    Since p 1 and a 1, by the fresh conjuncatenation and nonce-verification rules, we get: U| ≡ S| ≡ (U ↔ S K S, d u P, T 2).

    g 1.:

    Since a 2, by the belief rule, we get: U| ≡ S| ≡ U ↔ S K S.

    g 2.:

    Since p 5 and g 1, by the jurisdiction rule, we get: U| ≡ U ↔ S K S.

    a 3.:

    Since p 4 and S ⊲ (U ↔ S K S, d s P, T 3) U ↔ K S , by the message-meaning rule, we get: S| ≡ U|∼(U ↔ S K S, d s P, T 3).

    a 4.:

    Since p 2 and a 3, by the fresh conjuncatenation and nonce-verification rules, we get: S| ≡ U| ≡ (U ↔ S K S, d s P, T 3).

    g 3.:

    Since a 4, by the belief rule, we get: S| ≡ U| ≡ (U ↔ S K S, d s P, T 3).

    g 4.:

    Since g 3 and p 6, by the jurisdiction rule, we get: S| ≡ U ↔ S K S.

Table 2 BAN logic notations
Full size table

Security analysis

This section shows the enhanced scheme has the ability to endure different security attacks including the aforementioned attacks found in Arshad et al.’s scheme. The following attacks are based on the assumptions that a malicious attacker \(\mathcal {A}\) has completely control the whole communication channel connecting the patients and the telecare server in login and authentication phase. So \(\mathcal {A}\) can eavesdrop, modify, insert, or delete any message transmitted via public channel [31].

User anonymity

The patient’s identity I D i is concealed all the transmitted messages and is protected by one-way hash functions. If \(\mathcal {A}\) attempts to derive I D i , he needs to know the server’s private key x or the random numbers generated by U and S. Obviously, this values are secret only known by U and S. Therefore, it is impossible to track the patient who is involved in the authentication session.

Insider attack

The patient registers to S by presenting P W i ⊕ H(B i ) instead of plaintext P W i . Since B i is unknown to the insider, it will be difficult to retrieve P W i from P W i ⊕ H(B i ). Therefore, a privileged insider S cannot attain the plain-text password and hence he cannot pretend the patient to login other telecare servers.

Off-line password guessing attack

Assume that \(\mathcal {A}\) reads [34, 35] the information {V i , A I D i } stored in the smart card and tries to guess a password in an off-line manner. To verify the correctness of password, \(\mathcal {A}\) needs to know patients’s I D i and biometric B i at the same time. To obtain I D i from A I D i , the telecare server’s private key x is needed. Since \(\mathcal {A}\) cannot know the biometric B i and x which is only with U and S, respectively, it is hard for \(\mathcal {A}\) to plot an off-line password guessing attack with smart card.

Impersonation attack

\(\mathcal {A}\) does not impersonate a legal patient to server since he cannot generate a valid login request {M 1, M 2, A I D i , T 1} without the knowledge of U’s identity I D i and S’s private key x. Both the two values I D i and x are unknown to \(\mathcal {A}\). Similarly, \(\mathcal {A}\) cannot impersonate as a server to cheat a legal patient without knowledge of x. Only when \(\mathcal {A}\) knows x he will derive I D i from intercepted messages. But x is the secret key of S, \(\mathcal {A}\) cannot know. In a word, it is infeasible for \(\mathcal {A}\) to launch an impersonation attack.

The session key perfect forward secrecy

Even if the patient’s password P W i and server’s private key x are compromised by \(\mathcal {A}\), the session key SK for the previous sessions is still kept unrevealed. On the one hand, the password P W i and server’s private key x are not utilized for computing the session key. On the other hand, it is impractical to compute S K = d u d s P without knowledge of d u and d s . As a result, the enhanced scheme achieves the session key perfect forward secrecy.

Mutual authentication

U validates S’s message {A I D i , M 1, M 2, T 1} by checking whether the timestamp T 1 and the condition \(M^{\prime }_{2}= M_{2}\) are valid. S validates U’s message {M 3, M 4, T 2} by checking whether the timestamp T 2 and the condition \(M^{\prime }_{2}= M_{2}\) hold.

Replay attack

Assume that \(\mathcal {A}\) intends to resend the old message {M 1, M 2, A I D i , T 1} to login to S. The attack will be immediately detected by S by verifying the freshness of T 1. Besides, S will also discover the forged message by verifying the correctness of the value M 2 = h 1(I D i ||d u P||T 1). Therefore, it is impossible for \(\mathcal {A}\) to plot the replay attack.

Modification attack

Both the patient’s identity I D i and the server’s private key x are hidden in all the transmitted messages. Any forged messages will be examined by U or S. It seems impossible for \(\mathcal {A}\) to intercept the transmitted messages and hence modify them without knowledge of the two values.

Functionality and performance comparisons

In this section, we compare the functionality and performance analyses of the enhanced scheme with the previous related schemes [13, 24, 26, 27]. Table 3 shows that the enhanced scheme is more secure than other related schemes. In the performance comparison, define pm, m, inv, s, F, e and h be the time for performing an elliptic curve point multiplication, a modular multiplication, a modular inversion, a symmetric encryption/decryption, a pseudo-random function, a modular exponentiation and a one-way hash function. From Table 4 we can see that the overall computational cost for the enhanced scheme is less computationally costly than those of schemes [13, 24, 26, 27].

Table 3 Functionality comparison
Full size table
Table 4 Performance comparison
Full size table

Conclusion

We have discussed the security of Arshad et al.’s scheme and discovered that their scheme was vulnerable to off-line password guessing attack which leads to an adversary could impersonate as a legal user to access any services provided by telecare server. We employ hash function, ECC nonce and biometric based authenticated key exchange scheme as the primitives to improve the security and efficiency of Arshad et al.’s scheme. The enhanced scheme not only satisfies many security features but also has the lowest computational cost among other related schemes.