A blockchain-based keyword search scheme with dual authorization for electronic health record sharing. (May 2022)

• Record Type: Journal Article
• Authors: Yang, Xiaodong; Wang, Jiaqi; Xi, Wanting; Tian, Tian; Wang, Caifen
• Is Part Of: Journal of information security and applications. Volume 66(2022)
• Publication Date: 2022-05
• Subjects: Authority management -- Blockchain -- Certificateless cryptosystem -- Dual authorization -- Electronic health record; Computer security -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.jisa.2022.103154
• Languages: English
• ISSNs: 2214-2126

Abstract

Abstract: Electronic health record is an electronic file that records people's medical treatment and physical examination information in an all-around way which is an important branch of building a smart medical system. The sharing of electronic health records not only helps people use medical resources anytime and anywhere to deal with tricky physical conditions but also provides valuable and true reference materials for medical practitioners in related research. However, the current electronic health record sharing schemes have the problems of electronic health record data leakage, access authorization mechanism incomplete, inflexible operation of electronic health record data, low search efficiency, and untrustworthy cloud server provider. To solve these challenging problems, we propose a new blockchain-based keyword search scheme with dual authorization for electronic health record sharing. The certificateless cryptosystem avoids certificate management and key escrow. The construction of the authorization matrix realizes the dual authorization of the identities of users and the corresponding searchable departments. Also, the matrix can manage the access rights of users. The signal value of the ciphertext index can realize the authority management of ciphertext index. The ciphertext MAC verification code stored in the blockchain can verify the legality of ciphertext, and the smart contract is used to ensure fair transactions. Therefore, our scheme is more suitable for sharing confidential and sensitive electronic health records. The security proof concludes that the proposed scheme is indistinguishability under the keyword guessing attack. Besides, the result of performance analysis and comparison simulations show that the proposed scheme has higher performance than some related schemes. Graphical abstract: Highlights: Certificateless dual authorization. We use the certificateless cryptosystem to avoid certificate management and key escrow issues in the traditional cryptosystem. Authority management. We realize the authority management of the EHR owner to revoke or restore the user right. Fair transactions and ciphertext verification. We construct the verification algorithm in the smart contract based on blockchain to ensure fair transaction. Security and higher performance. The proposed scheme is indistinguishable under keyword guessing attack, and can resist the internal and external attacker.