Certificateless Broadcast Encryption with Authorization Suitable for Storing Personal Health Records

• Published in: Computer journal Vol. 67; no. 2; pp. 617 - 631
• Main Authors: Chen, Zhiwei, Deng, Lunzhi, Ruan, Yu, Feng, Shuai, Wang, Tao, Wang, Bo
• Format: Journal Article
• Language: English
• Published: Oxford University Press 17.02.2024
• Subjects: authorization; certificateless cryptography; broadcast encryption; privacy-preserving; personal health records (PHR)
• ISSN: 0010-4620; 1460-2067
• DOI: 10.1093/comjnl/bxad004

Cloud medical treatment provides real-time data sharing in a cost-effective method, making it more practical to create, collect and manage vast amounts of personal health records (PHR) of patients. However, health information is considered highly sensitive. How to securely store and dynamically process massive patients’ PHR data in a public cloud environment has become one of the most important challenges. Therefore, we introduce a novel solution to the problems of privacy exposure, data security and flexible access of storage modules in medical systems. In this paper, we present a privacy-preserving certificateless broadcast encryption with authorization for the PHR system, which is the best approach to effectively solve the above problems and avoid key escrow. In our work, users (patients) outsource their encrypted data to the cloud server and reallocate data accessing rights of recipients through an authorization set, sharing with a group of authorized receivers (doctors) in a secure and efficient manner. In addition, it is shown to be capable of achieving both plaintext confidentiality and receiver anonymity under the random oracle model. Moreover, the experimental evaluation shows that the proposed scheme enjoys low computational and communication overhead, indicating the feasibility and practicality of the scheme.