Adaptive identity and session security architecture for mobile healthcare applications

Abstract

Mobile healthcare applications give patients access to prescriptions, appointments, clinical records, insurance information, and direct communication with providers, and that access carries information sensitive enough to demand stronger protection than a typical consumer application requires. At the same time, authentication that is too rigid works against the population it is meant to protect: repeated sign-in prompts, brittle recovery flows, and fixed session expiration discourage adoption and can delay care for patients who are already unwell, unfamiliar with the technology, or working from an unreliable connection. This article proposes an adaptive identity and session security architecture for mobile healthcare that treats protection and access as a single design problem rather than a tradeoff to be split down the middle. The architecture separates authentication, authorization, patient identity, device trust, and clinical consent into distinct governed layers; anchors native application authorization in OAuth 2.0 with Proof Key for Code Exchange; uses device-level biometrics to unlock, rather than replace, backend identity validation; stores credentials and tokens in hardware-backed encrypted storage; evaluates session risk on a continuous basis instead of only at login; and applies session policy that scales with the sensitivity of the operation a patient is attempting. This article draws on standards guidance from the Internet Engineering Task Force, the National Institute of Standards and Technology, OWASP, and the FIDO Alliance, as well as recent empirical and review literature on mobile healthcare security, biometric authentication, and zero trust architecture. Unlike prior frameworks that treat authentication, authorization, and session governance as separate controls, this article proposes an integrated six-component architecture where each component, identity separation, OAuth 2.0/PKCE authorization, biometric reauthentication, hardware-backed storage, continuous risk assessment, and operation-sensitive session governance, functions as a coordinated input into a single, continuously evaluated access decision. The contribution is the integration model itself: a governance structure designed to address the protection-access tension architecturally rather than through policy tradeoff. The architecture is proposed as a conceptual governance model; experimental validation of its performance claims remains as future work.