# PiPatient Privacy Copyright Cloud Management
## 3 The Proposed Mechanism
### Secure Electronic Patient Record Storing, Sharing, and Updating Communication Phase
After receiving the message {\(NID_{Pi}\), \(M_{3}\)} from the CA and \(M_{4}\) from the EPRS, \(D_{j}\) computes \(R_{Pi}\)\({}^{new}\) = \(M_{3}\oplus\) DC, \(ID_{Pi}\) = \(NID_{Pi}\)\({}^{new}\), generates a random number \(R_{D}\), computes \(R_{EPRS}\) = \(M_{4}\oplus\)\(R_{Pi}\)\({}^{new}\), \(M_{5}\) = \(R_{D}\oplus R_{EPRS}\), and then sends {\(M_{5}\), \(NID_{Pi}\)} to the CA and {\(M_{5}\)} to the EPRS via a public channel. Then, \(D_{j}\) owns the session key \(SK\) = h (\(R_{Pi}\)\({}^{new}\oplus R_{EPRS}\oplus R_{D}\)). Stage 5. The EPRS receives the message {\(M_{5}\)} from \(D_{j}\), computes \(R_{D}\) = \(M_{5}\oplus R_{EPRS}\), and then computes session key \(SK\) = h (\(R_{Pi}\)\({}^{new}\oplus R_{EPRS}\oplus R_{D}\)). Stage 6. The CA receives the message {\(M_{5}\), \(NID_{Pi}\)} from doctor \(D_{j}\) and then sends \(M_{5}\) to \(P_{i}\) by checking \(NID_{Pi}\). Stage 7. After receiving the message from the CA, \(P_{i}\) computes session key \(SK\) = h (\(R_{Pi}\)\({}^{new}\oplus M_{5}\)), updates secret tokens \(ST_{i}\) = \(ST_{i}\oplus R_{Pi}\)\({}^{new}\oplus R_{Pi}\)\({}^{old}\) and \(S_{i}\) = \(S_{i}\oplus R_{Pi}\)\({}^{new}\oplus R_{Pi}\)\({}^{old}\), and then finishes key agreement. After the key agreement process is done, the secure tunnel among \(P_{i}\), the EPRS, and \(D_{j}\) is established. The three roles can use the same one-time session key for secure communication. Next, the patient privacy history update process under the secure channel is detailed in Stage 8 to Stage 12. Stage 8. The EPRS uses the secret session key \(SK\) to encrypt the privacy record of the \(ID_{pi}\) patient, \(M_{6}\) = {E\({}_{SK}\) (E\({}_{K}\) (\(R_{i}\)))}, and then sends \(M_{6}\) to patient \(P_{i}\). Stage 9. \(P_{i}\) receives the encrypted electronic patient record {E\({}_{SK}\) (E\({}_{K}\) (\(R_{i}\)))} and decrypts E\({}_{SK}\) (E\({}_{K}\) (\(R_{i}\))) using session key \(SK\) to obtain E\({}_{K}\) (\(R_{i}\)). Then, \(P_{i}\) applies \(R_{Pi}\)\({}^{old}\) to decipher the original \(R_{i}\) = D\({}_{RP_{i}}\)\({}^{old}\) (E\({}_{K}\) (\(R_{i}\))) and then enciphers the original \(R_{i}\) with session key \(SK\) to message \(M_{7}\) = E\({}_{SK}\) (\(R_{i}\)). Then, \(P_{i}\) sends \(M_{7}\) to doctor \(D_{j}\). Stage 10. The doctor \(D_{j}\) receives the message \(M_{7}\) from \(P_{i}\) and deciphers the original record \(R_{i}\) using \(SK\), \(R_{i}\) = D\({}_{SK}\) (\(M_{7}\)). When the telehealth service is done, the doctor generates a new record \(R_{i}\)\({}^{new}\) and then enciphers the new record \(R_{i}\)\({}^{new}\) using session key \(SK\) to obtain message \(M_{8}\) = E\({}_{SK}\) (\(R_{i}\)\({}^{new}\)). Then, the doctor \(D_{j}\) sends encrypted privacy record \(M_{8}\) to \(P_{i}\). Stage 11. \(P_{i}\) receives the message from \(D_{j}\) and uses session key \(SK\) to obtain \(R_{i}\)\({}^{new}\) = D\({}_{SK}\) (\(M_{8}\)). Then, \(P_{i}\) enciphers himself the privacy record to obtain \(M_{9}\) = E\({}_{SK}\) (E\({}_{RP_{i}}\)\({}^{new}\) (\(R_{i}\)\({}^{new}\))) and sends \(M_{9}\) to the EPRS. Stage 12. The EPRS receives the message \(M_{9}\) from \(P_{i}\) and then computes \(M_{10}\) = D\({}_{SK}\) (\(M_{9}\)). The EPRS updates \(ID_{Pi}\)'s electronic patient record using \(M_{10}\) {E\({}_{RP_{i}}\)\({}^{new}\) (\(R_{i}\)\({}^{new}\))} and then finishes the data sharing and data update phase.