A Fine-Grained Access Control Scheme for Electronic Health Records Based on Roles and Attributes

Abstract

The electronic medical cloud system has shown its potential to improve the quality of medical care and personal life. At present, there are mainly two forms of access control to electronic medical cloud systems: role-based access control (RBAC) and attribute-based access control (ABAC). But RBAC cannot achieve fine-grained access control, and ABAC cannot achieve the role of RBAC to manage resource functions. This paper proposes a patient-centric access control model that combines RBAC and ABAC in response to this problem. We use the Linear Secret Sharing Scheme (LSSS) access control structure to implement attribute-based access control, and the Casbin access control framework to implement role-based access control. The patient first uses the ciphertext strategy attribute-based encryption algorithm (CP-ABE) on the client to encrypt the electronic health record (EHR), then the patient stores the encrypted EHR data in the cloud. When a data user wants to access patient EHR data, the cloud will determine whether the user role or user attribute meets the access request. After the request is passed, the user can obtain the ciphertext and the plaintext after two decryption steps. Finally, we conduct an extensive safety analysis and performance evaluation, which confirmed the effectiveness and efficiency of our program.