Skip to main content
SpringerLink
Log in

Secure and privacy-preserving sharing of personal health records with multi-party pre-authorization verification

  • Published:
Wireless Networks Aims and scope Submit manuscript

Abstract

Wireless communications play an important role in ensuring ease of access to shared electronic health records (EHR) across health service providers which is essential and significant for prompt patients’ care, especially in cases of emergency medical conditions. With the need to support anytime, anywhere access to, potentially bandwidth hungry, medical records, electronic healthcare applications will continue to benefit from advanced wireless network technologies such as 5G and beyond. With sharing, it is crucial to provide patients with security and privacy guarantees, and allow them to certain control of access to their data. Existing solutions mostly assume that patients are available to authorize requests to access their EHR, which is impractical as the patient may be unconscious. This paper proposes a secure and privacy protecting protocol whereby the patient can pre-delegate the authorization for the access of his/her EHR. Our patient(user)-centric proposal combines Self-Sovereign Identity (SSI) concepts and model with Secure Multi-party Computation (SMPC) and Threshold Cryptography (TC) to enable secure identity and authorization verification. A block cipher encryption sharing approach is adopted for the threshold SMPC which extends the AES-GCM symmetric encryption model into a full-fledged cryptographic platform. Two mechanisms are implemented for the block cipher encryption, namely XOR and Cascade, and experiments are conducted to compare them. We conclude that the XOR mechanism can scale for larger thresholds, while Cascade performed better for a lower threshold (≤ 3). This paper also performs a threat analysis of the protocol and approach, and validates its correctness and complexity. We conclude that the approach can achieve the security and privacy protection of the patient’s personal EHR, as well as the autonomy of the patient to control the authorization for the access and sharing.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9

Similar content being viewed by others

References

  1. Zhang, J., Liu, H., & Ni, L. (2020). A secure energy-saving communication and encrypted storage model based on RC4 for EHR. IEEE Access, 8, 38995–39012.

    Article  Google Scholar 

  2. Liu, X., Lam, K. Y., Li, F., Zhao, J., Wang, L., & Durrani, T. S. (2021). Spectrum sharing for 6G integrated satellite-terrestrial communication networks based on NOMA and CR. IEEE Network Magazine, 35(4), 28–34.

    Article  Google Scholar 

  3. Li, F., Lam, K. Y., Chen, H. W., & Zhao, N. (2019). Spectral efficiency enhancement in satellite mobile communications: A game-theoretical approach. IEEE Wireless Communications, 27, 200–205.

    Article  Google Scholar 

  4. Li, F., Lam, K. Y., Zhao, N., Liu, X., Zhao, K., & Wang, L. (2018). Spectrum trading for satellite communication systems with dynamic bargaining. IEEE Transactions on Communications, 66(10), 4680–4693.

    Google Scholar 

  5. Wang, L., Lam, K.Y., Xiong, M., Li, F., Liu, X., and Wang, J., (2018) Spectrum pricing for cognitive radio networks with user's stochastic distribution. Wireless Networks, Springer US.

  6. Li, F., Lam, K. Y., & Wang, L. (2018). Power allocation in cognitive radio networks over Rayleigh-fading channels with hybrid intelligent algorithms. Wireless Networks, 24(7), 2397–2407.

    Article  Google Scholar 

  7. Chowdhury, M. Z., Shahjalal, M., Ahmed, S., & Jang, Y. M. (2020). 6G wireless communication systems: Applications, requirements, technologies, challenges, and research directions. IEEE Open Journal of the Communications Society, 1, 957–975.

    Article  Google Scholar 

  8. Rabieh, K., Akkaya, K., Karabiyik, U., and Qamruddin, J., (2018) A secure and cloud-based medical records access scheme for on-road emergencies. In Proceedings of 15th IEEE Annual Consumer Communications & Networking Conference (CCNC), pp. 1–8.

  9. Yi, X., Bouguettaya, A., Georgakopoulos, D., Song, A., & Willemson, J. (2016). Privacy protection for wireless medical sensor data. IEEE Transactions on Dependable and Secure Computing, 13(3), 369–380.

    Article  Google Scholar 

  10. S. Arsheen, and K. Ahmad, "SLR: A systematic literature review on blockchain applications in healthcare," In Proceedings of 2021 International Conference on Information Science and Communications Technologies (ICISCT), pp. 1–6, 2021.

  11. Tan, K.-L., Chi, C.-H., and Lam, K.-Y., (2022) Analysis of digital sovereignty and identity: From digitization to digitalization. arXiv preprint arXiv:2202.10069.

  12. Wang, F., and De Filippi, P., (2020) Self-sovereign identity in a globalized world: Credentials-based identity systems as a driver for economic inclusion. Frontiers in Blockchain, vol. 2.

  13. Zhao, X.-B., Lam, K.-Y., Chung, S.-L., Gu, M., and Sun, J.-G., (2004) Authorization mechanisms for virtual organizations in distributed computing systems. In Proceedings of Australasian Conference on Information Security and Privacy, pp. 414–426.

  14. Yong, J.-P., Lam, K.-Y., Chung, S.-L., Gu, M., and Sun, J.-G., (2004) Enhancing the scalability of the community authorization service for virtual organizations. In Proceedings of Advanced Workshop on Content Computing, pp. 182–193.

  15. Microsoft (2021) The STRIDE Threat Model," https://docs.microsoft.com/en-us/previous-versions/commerce-server/ee823878(v=cs.20)?redirectedfrom=MSDN.

  16. D. R. Group (2022) LINDDUN privacy engineering. https://www.linddun.org/.

  17. Guo, H., Li, W., Nejad, M., and Shen, C.-C., (2019) Access control for electronic health records with hybrid blockchain-edge architecture. In Proceedings of 2019 IEEE International Conference on Blockchain (Blockchain), pp. 44–51.

  18. Yue, X., Wang, H., Jin, D., Li, M., & Jiang, W. (2016). Healthcare data gateways: Found healthcare intelligence on blockchain with novel privacy risk control. Journal of Medical Systems, 40(10), 1–8.

    Article  Google Scholar 

  19. Liang, X., Zhao, J., Shetty, S., Liu, J., and Li, D., (2017) Integrating blockchain for data sharing and collaboration in mobile healthcare applications. In Proceedings of 2017 IEEE 28th annual international symposium on personal, indoor, and mobile radio communications (PIMRC), pp. 1–5.

  20. Xia, Q., Sifah, E. B., Asamoah, K. O., Gao, J., Du, X., & Guizani, M. (2017). MeDShare: Trust-less medical data sharing among cloud service providers via blockchain. IEEE Access, 5, 14757–14767.

    Article  Google Scholar 

  21. Rabieh, K., Akkaya, K., Karabiyik, U., and Qamruddin, J., (2018) A secure and cloud-based medical records access scheme for on-road emergencies. In Proceedings of 2018 15th IEEE Annual Consumer Communications & Networking Conference (CCNC), pp. 1–8.

  22. Zhang, J., Xue, N., & Huang, X. (2016). A secure system for pervasive social network-based healthcare. IEEE Access, 4, 9239–9250.

    Article  Google Scholar 

  23. Dubovitskaya, A., Novotny, P., Xu, Z., & Wang, F. (2020). Applications of blockchain technology for data-sharing in oncology: Results from a systematic literature review. Oncology, 98(6), 403–411.

    Article  Google Scholar 

  24. Guo, H., Li, W., Meamari, E., Shen, C.-C., and Nejad, M., (2020) Attribute-based multi-signature and encryption for EHR management: A blockchain-based solution. In Proceedings of 2020 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp. 1–5.

  25. Sun, Y., Zhang, R., Wang, X., Gao, K., and Liu, L., (2018) A decentralizing attribute-based signature for healthcare blockchain. In Proceedings of 2018 27th International conference on computer communication and networks (ICCCN), pp. 1–9.

  26. Vora, J., Italiya, P., Tanwar, S., Tyagi, S., Kumar, N., Obaidat, M. S., and Hsiao, K.-F., (2018) Ensuring privacy and security in e-health records. In Proceedings of 2018 International conference on computer, information and telecommunication systems (CITS), pp. 1–5.

  27. Guo, R., Shi, H., Zhao, Q., & Zheng, D. (2018). Secure attribute-based signature scheme with multiple authorities for blockchain in electronic health records systems. IEEE Access, 6, 11676–11686.

    Article  Google Scholar 

  28. Wang, H., & Song, Y. (2018). Secure cloud-based EHR system using attribute-based cryptosystem and blockchain. Journal of Medical Systems, 42(8), 1–9.

    Article  MathSciNet  Google Scholar 

  29. Chen, L., Lee, W.-K., Chang, C.-C., Choo, K.-K.R., & Zhang, N. (2019). Blockchain based searchable encryption for electronic health record sharing. Future Generation Computer Systems, 95, 420–429.

    Article  Google Scholar 

  30. Wang, Y., Zhang, A., Zhang, P., & Wang, H. (2019). Cloud-assisted EHR sharing with security and privacy preservation via consortium blockchain. IEEE Access, 7, 136704–136719.

    Article  Google Scholar 

  31. Benaloh, J., Chase, M., Horvitz, E., and Lauter, K., (2009) Patient controlled encryption: ensuring privacy of electronic medical records. In Proceedings of Proceedings of the 2009 ACM workshop on Cloud computing security, pp. 103–114.

  32. Liu, X., Zheng, Y., Yuan, X., and Yi, X., (2021) Towards secure and lightweight deep learning as a medical diagnostic service. In European Symposium on Research in Computer Security, pp. 519–541. Springer, Cham.

  33. Liu, X., and Yi, X., (2019) Privacy-preserving collaborative medical time series analysis based on dynamic time warping. In European Symposium on Research in Computer Security, pp. 439–460. Springer, Cham.

  34. Marwan, M., Kartit, A., and Ouahmane, H., (2016) Applying secure multi-party computation to improve collaboration in healthcare cloud. In Proceedings of Third International Conference on Systems of Collaboration (SysCo), 2016, pp. 1-6.

  35. Shen, B., Guo, J., & Yang, Y. (2019). MedChain: Efficient healthcare data sharing via blockchain. Applied Sciences, 9(6), 1207.

    Article  Google Scholar 

  36. Zhuang, Y., Sheets, L. R., Chen, Y.-W., Shae, Z.-Y., Tsai, J. J., & Shyu, C.-R. (2020). A patient-centric health information exchange framework using blockchain technology. IEEE Journal of Biomedical and Health Informatics, 24(8), 2169–2176.

    Article  Google Scholar 

  37. Blobel, B. (2004). Authorisation and access control for electronic health record systems. International Journal of Medical Informatics, 73(3), 251–257.

    Article  Google Scholar 

  38. Khan, M. F. F., and Sakamura, K., (2020) A distributed approach to delegation of access rights for electronic health records. In Proceedings of 2020 International Conference on Electronics, Information, and Communication (ICEIC), pp. 1–6.

  39. Joshi, M., Joshi, K. P., and Finin, T., (2019) Delegated authorization framework for EHR services using attribute based encryption. IEEE Transactions on Services Computing.

  40. Liang, X., Shetty, S., Zhao, J., Bowden, D., Li, D., and Liu, J., (2017) Towards decentralized accountability and self-sovereignty in healthcare systems. In Proceedings of International Conference on Information and Communications Security, pp. 387–398.

  41. Siqueira, A., Da Conceição, A. F., and Rocha, V., (2021) Blockchains and self-sovereign identities applied to healthcare solutions: A systematic review. arXiv preprint arXiv:2104.12298.

  42. W.-W. W. Consortium, “W3C DID Primer for Introduction, “ https://github.com/w3c-ccg/did-primer. 2021

  43. Ge, M., and Lam, K.-Y., (2009) Self-initialized distributed certificate authority for mobile ad hoc network. In Proceedings of International Conference on Information Security and Assurance, pp. 392–401.

  44. Dunphy, P., & Petitcolas, F. A. (2018). A first look at identity management schemes on the blockchain. IEEE Security & Privacy, 16(4), 20–29.

    Article  Google Scholar 

  45. Crépeau, C., Graaf, J. V. D., and Tapp, A., (1995) Committed oblivious transfer and private multi-party computation. In Proceedings of Annual International Cryptology Conference, pp. 110–123.

  46. Yi, X., Paulet, R., and Bertino, E., (2014) Homomorphic encryption. Homomorphic Encryption and Applications, pp. 27–46: Springer.

  47. Shamir, A. (1979). How to share a secret. Communications of the ACM, 22(11), 612–613.

    Article  MathSciNet  Google Scholar 

  48. Martin, K. M., Safavi-Naini, R., Wang, H., & Wild, P. R. (2005). Distributing the encryption and decryption of a block cipher. Designs, Codes and Cryptography, 36(3), 263–287.

    Article  MathSciNet  Google Scholar 

  49. Sudarsan, S. V., Schelén, O., and Bodin, U., (2020) A model for signatories in cyber-physical systems. In Proceedings of 2020 25th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA), pp. 15–21.

  50. Nuñez, D., Agudo, I., & Lopez, J. (2017). Proxy re-encryption: Analysis of constructions and its application to secure access delegation. Journal of Network and Computer Applications, 87, 193–209.

    Article  Google Scholar 

  51. McGrew, D., & Viega, J. (2004). The Galois/counter mode of operation (GCM). NIST Modes of Operation Process, 20, 0278–70.

    MATH  Google Scholar 

  52. Brandão, L. T., Mouha, N., and Vassilev, A., (2018) Threshold schemes for cryptographic primitives: challenges and opportunities in standardization and validation of threshold cryptography. National Institute of Standards and Technology.

  53. Brickell, E., Crescenzo, G. D., and Frankel, Y., (2000) Sharing block ciphers. In Proceedings of Australasian Conference on Information Security and Privacy, pp. 457–470.

  54. Maurer, U. M., & Massey, J. L. (1993). Cascade ciphers: The importance of being first. Journal of Cryptology, 6(1), 55–61.

    Article  Google Scholar 

Download references

Acknowledgements

This work was supported by the National Research Foundation, Singapore under its Strategic Capability Research Centres Funding Initiative.

Author information

Authors and Affiliations

  1. School of Computer Science and Engineering, Nanyang Technological University, Singapore, Singapore

    Kheng-Leong Tan & Kwok-Yan Lam

  2. Strategic Centre for Research in Privacy-Preserving Technologies and Systems, Nanyang Technological University, Singapore, Singapore

    Kheng-Leong Tan, Chi-Hung Chi & Kwok-Yan Lam

Authors
  1. Kheng-Leong Tan
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Chi-Hung Chi
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Kwok-Yan Lam
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Kheng-Leong Tan.

Ethics declarations

Conflict of interest

The authors have no competing interests to declare that are relevant to the content of this article.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Springer Nature or its licensor holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Tan, KL., Chi, CH. & Lam, KY. Secure and privacy-preserving sharing of personal health records with multi-party pre-authorization verification. Wireless Netw (2022). https://doi.org/10.1007/s11276-022-03114-6

Download citation

  • Accepted:

  • Published:

  • DOI: https://doi.org/10.1007/s11276-022-03114-6

Keywords

Search

Navigation