Authentication in Selected Mobile Data Collection Systems: Current State, Challenges, Solutions and Gaps

Mobile data collection systems (MDCS) in the health sector are of great benefit to health care providers and community workers especially in low-resource settings. MDCS enable the extension and provision of health services closer to the community by enabling data collection and diagnosis without the patient being in a hospital setting. MDCS, however, face a number security challenges including authentication and authorization of users, secure communication between a mobile client and the server, and secure application deployment. This paper provides a criteria and guidelines for evaluating an authentication model for MDCS. The criteria encompass key authentication dimensions including proper local and remote authentication, password management and recovery especially with no Internet connectivity. We assess the authentication models using two reference systems that are widely used in low-resource settings, namely, District Health Information Software (DHIS 2) and mUzima. The findings reveal gaps in the authentication model of the reference systems including insecure authentication, insecure storage of user credentials on the mobile device and no proper automatic logouts, among others.