Formal Analysis of an eHealth Protocol

Given the sensitive nature of health data, security and privacy of eHealth systems is of prime importance. Properties like secrecy, authentication, anonymity, and untraceability need to be satisfied. However, only satisfying these properties is not sufficient in case users can reveal private information to the adversary. For instance, a pharmaceutical company may bribe or coerce a pharmacist to reveal information which breaks a doctor’s privacy. Therefore, new privacy properties are required: enforced prescribing-privacy, independency of prescribing-privacy, and independency of enforced prescribing-privacy. In this paper, we identify and formalise these new properties. Moreover we take an eHealth protocol (DLVV08), which is proposed for practical use, as a case study, and study to what extent all these properties are satisfied by the DLVV08 protocol. Finally, we address found ambiguities and flaws and propose suggestions for fixing them.