Electronically protected health information is held in computerized healthcare records that contain complete healthcare information and are easily shareable or retrieved by various health care providers via the Internet. The two most important concerns regarding their use involve the security of the Internet and the privacy of patients. To protect the privacy of patients, various regions of the world maintain privacy standards. These are set, for example, by the Health Insurance Portability and Accountability Act (HIPAA) in the United States and the General Data Protection Regulation (GDPR) in Europe. Most recently developed authenticated key agreement schemes for HIPAA and GDPR privacy/security involve modular exponential computations or scalar multiplications on elliptic curves to provide higher security, but they are computationally heavy and therefore costly to implement. Recent studies have shown that cryptosystems that use modular exponential computation and scalar multiplication on elliptic curves are less efficient than those based on Chebyshev chaotic maps. Therefore, this investigation develops a secure and efficient non-certificate-based authenticated key agreement scheme that uses lightweight operations, including Chebyshev chaotic maps and hash operations. The proposed scheme overcomes the limitations of alternative schemes, is computationally more efficient, and provides more functionality. The proposed scheme complies with the privacy principles of HIPAA and GDPR.

Background: The US government has enacted the Health Insurance Portability and Accountability Act (HIPAA), in which patient control over electronic protected health information is a major issue of concern. The two main goals of the Act are the privacy and security regulations in the HIPAA and the availability and confidentiality of electronic protected health information. The most recent authenticated key-agreement schemes for HIPAA privacy/security have been developed using time-consuming modular exponential computations or scalar multiplications on elliptic curves to provide higher security. However, these authenticated key-agreement schemes either have a heavy computational cost or suffer from authorization problems. Methods: Recent studies have demonstrated that cryptosystems using chaotic-map operations are more efficient than those that use modular exponential computations and scalar multiplications on elliptic curves. Additionally, enhanced Chebyshev polynomials exhibit the semigroup property and the commutative property. Hence, this paper develops a secure and efficient certificate-based authenticated key-agreement scheme for HIPAA privacy/security regulations by using extended chaotic maps. Results and Conclusions: This work develops a user-authentication and key-agreement scheme that solves security problems that afflict related schemes. This proposed key-agreement scheme depends on a certificate-management center to enable doctors, patients and authentication servers to realize mutual authentication through certificates and thereby reduce the number of rounds of communications that are required. The proposed scheme not only provides more security functions, but also has a lower computational cost than related schemes.