Abstract
The sharing of electronic health records (EHR) in cloud servers is an increasingly important development that can improve the efficiency of medical systems. However, there are several concerns focusing on the issues of security and privacy in EHR system. The EHR data contains the EHR owner’s sensitive personal information, if these data are obtained by a malicious user, it will not only cause the leakage of patient’s privacy, but also affect the doctor’s diagnosis. It is a very challenging problem for the EHR owner fully controls over own EHR data as well as preserves the privacy of himself. In this paper, we propose a new privacy-preserving access control (PPAC) scheme for EHR. To achieve fine-grained access control of the EHR data, we utilize the attribute-based signcryption (ABSC) mechanism to signcrypt data based on the access policy for the linear secret sharing schemes. Employing the cuckoo filter to hide the access policy, it could protect the EHR owner’s privacy information. In addition, the security analysis shows that the proposed scheme is provably secure under the decisional bilinear Diffie-Hellman exponent assumption and the computational Diffie-Hellman exponent assumption in the standard model. Furthermore, the performance analysis indicates that the proposed scheme achieves low costs of communication and computation compared with the related schemes, meanwhile preserves the EHR owner’s privacy. Therefore, the proposed scheme is better suited to EHR system.
Highlights
With the speedy growth of new-generation information techniques like the cloud computing and Internet of Things, and the uninterrupted improvement of living standards of people, the concept of smart city has got more attention
Cloud servers are in charge of storing ciphertext data that sent by the electronic health records (EHR) owner and granting access rights to EHR users
The construction of privacy-preserving access control (PPAC) scheme for EHR system is based on the CP-attribute-based signcryption (ABSC) scheme and the concrete CP-ABSC scheme is given based on the bilinear pairing, supporting the linear secret sharing schemes
Summary
With the speedy growth of new-generation information techniques like the cloud computing and Internet of Things, and the uninterrupted improvement of living standards of people, the concept of smart city has got more attention. The EHR owner defines the access policy to determine who is capable to obtain the EHR data and uploads them to the cloud servers after encrypting it using the access policy. The ciphertext could be decrypted if the attributes of the EHR user meet the access policy that is defined by the EHR owner Such as, the encryption access policy is “Alice” ∨ “XXX Hospital ∧ Oncologist”. ABE schemes [6,7,8,9] could provide secure access control for the EHR data in EHR system, they still suffer from a serious problem that the access policy may leak EHR owner’s privacy. The access policy will be send together with the ciphertext to EHR users in decryption phase, which may lead to the adversary gains owner’s related sensitive information from the access policy. It is more appropriate to design a PPAC scheme for EHR system using the ABSC technology
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have