Analysis and Improvement of Patient Self-controllable Multi-level Privacy-preserving Cooperative Authentication Scheme

In 2014, a patient self-controllable multi-level privacy-preserving cooperative authentication scheme (PSMPA) was proposed for attempting to address the issue of data confidentiality and patients' identity privacy simultaneously when the personal healthcare record (PHR) is shared in the distributed m-healthcare cloud computing system. In this paper, we show the PSMPA scheme fails to achieve the two goals under the collusion attack. Furthermore, the scheme also suffers from forgery attack because of a awed design in the transcript simulation phase. In order to avoid the attacks, we propose an improved PHR sharing scheme by incorporating ciphertext policy attribute-based encryption (CP-ABE) and attribute-based signature (ABS) as a possible solution.