# PiPatient Privacy Copyright Cloud Management
## 3 The Proposed Mechanism
### Secure Electronic Patient Record Storing, Sharing, and Updating Communication Phase  
This phase involves the stages of health medical privacy creation, sharing, and storage. In our iPPatient access control model, doctors or clinics have read and updated permissions, while authorized professionals have only read permissions. Only patients themselves can access the encrypted personal privacy of the cloud server. Additionally, all data stored in the cloud are also protected by the patient's private key. All decrypted data must be transmitted in a secure tunnel established through a key agreement. Below, we show six strategies in the iPPatient access control model and show the strategy diagram in Figure 3.  
1. The privacy of all patients is protected and stored in a cloud database via the patient's private key. 2. Anyone who wants to access patient privacy records must obtain the patient's authorization and obtain the records of the patient via patient downloading from the cloud database. 3. In the case of protecting the privacy of the cloud database, only patients can access via key agreement to establish a secure tunnel. After the tunnel is established, the transmitted data still need to be encrypted with the session key before it can be transmitted securely. 4. Doctors modify, update patient records, and send them to the patient via the session key. After the patient decrypts the updated patient records, s/he will use the personal private key to encrypt them, and then encrypt them with the session key to upload them to the cloud database server. Once the cloud data server receives and decodes them with the session key, it will update them to the patient records database. 5. Other authorized professionals excluding doctors can only read the patient records transmitted by the patient through the secure tunnel after they have been authenticated by the key agreement. They cannot modify or update patient records. 6. Our design for iPPatient is personally led and we want to establish a privacy sharing mechanism that is completely patient-led. Below, we introduce the steps we designed. First, we perform the three-party key agreement process in order to build a secure tunnel, and then decrypt, add, and modify the medical records in a secure tunnel. Stage 1. \(P_{i}\) imprints the biometric \(B_{i}\) and then deciphers his/her identity by \(ID_{Pi}=V_{i}\oplus\) H (\(B_{i}\)), deciphers \(R_{Pi}{}^{old}=ST_{i}\oplus ID_{Pi}\), \(NID_{Pi}=ID_{Pi}\oplus R_{Pi}{}^{new}\), and generates a new random number \(R_{Pi}{}^{new}\), \(M_{1}=R_{Pi}{}^{old}\oplus S_{i}\oplus R_{Pi}{}^{new}\). \(P_{i}\) then sends message [\(NID_{Pi}\), \(NID_{Dj}\), \(M_{1}\)] to the CA via a public channel. Figure 3: Our iPPatient access control model. Stage 2. After receiving the message from the \(P_{i}\), the CA deciphers \(R_{Pi}\)\({}^{new}\) = \(M_{1}\oplus\)h (\(T_{CA}\)), \(ID_{Pi}\) = \(NID_{Pi}\oplus R_{Pi}\)\({}^{new}\), and checks the patient identity \(ID_{Pi}\) from the CA's ID table. If the legal list cannot find the \(ID_{Pi}\), the request is terminated. Then, the CA calculates \(ID_{Dj}\) = \(NID_{Dj}\oplus R_{Pi}\)\({}^{new}\), computes \(M_{2}\) = \(R_{Pi}\)\({}^{new}\oplus\) h (\(ID_{e}\oplus T_{CA}\)), \(M_{3}\) = \(R_{Pi}\)\({}^{new}\oplus\) h (\(ID_{Dj}\oplus T_{CA}\)), and then sends a request of message and parameters tuple {\(NID_{Pi}\), \(NID_{Dj}\), \(M_{2}\)} to the EPRS through the public channel. Then, the CA sends {\(NID_{Pi}\), \(M_{3}\)} to the doctor \(D_{j}\) via a public channel. Stage 3. After receiving the message {\(NID_{Pi}\), \(NID_{Dj}\), \(M_{2}\)} from the CA, the EPRS computes \(R_{Pi}\)\({}^{new}\) = \(M_{2}\oplus\) EC, \(ID_{Pi}\) = \(NID_{Pi}\oplus R_{Pi}\)\({}^{new}\), and checks \(ID_{Pi}\) from the EPRS database. Then, the EPRS generates a random number \(R_{EPRS}\), generates secret token \(M_{4}\) = \(R_{Pi}\)\({}^{new}\oplus R_{EPRS}\), and then sends \(M_{4}\) to doctor \(D_{j}\) via a public channel. Stage 4.