Cryptanalysis on the Mutual Authentication Schemes of Telecare Medical Information Systems

The Telecare Medical Information System (TMIS) is a technology that allows for remote health monitoring and other medical services. It is part of a wireless body area network (WBAN) and involves three key entities: the patient, the doctor, and the trusted TMIS server. However, the communication of sensitive patient data over an insecure channel in TMIS systems can compromise security, leaving it vulnerable to attacks such as masquerade, forgery, and session key compromise. Authentication methods are often employed as strategies to prevent unapproved access to data across vulnerable networks. The literature has proposed many smart card-based password authentication techniques for telecare medical information systems. Recently, Qiu et al. (2018) and Shamshad et al. (2022) proposed two TMIS authentication schemes, and they asserted that their schemes could withstand a variety of attacks. However, in this paper, we demonstrate that both Qiu et al. (2018) and Shamshad et al. (2022) schemes are still vulnerable to various attacks and prove that their schemes are not suitable for TMIS authentication.