## 5 Methodology
### Design of Privacy-Preserving, Patient-Centric Health Record Access Control
#### 5.4.2 Algorithm
the user-centric application without changing the existing HRS system, and they will be able to interact with our proposed system. Additionally, users such as doctors can use it without creating other accounts. The anchor peer (orderer node) is essential because every peer node in the network contacts it to confirm the presence and get the updates in the network. The endorsement policy assigns that a desired number of peers must sign every transaction before being listed in the ledger, which means the transaction is validated by the peers. We defined multiple endorsement policies such as transactions coming from a patient for a new appointment, the doctor to access the health record, healthcare personnel to access or update the health record, and a family member to give access in emergency cases. Additionally, the endorsement policy invokes the validated system chaincode (VSCC), which is automatically initiated when the transaction reaches the peer and checks for the transaction source and if the transaction is signed by the desired number of entities and the correct number of endorsements. The certification authority (CA) is used to verify the owners in the blockchain network, make secure network communication by generating the SSL certificate and private and public keys for all peers, and provide access to add peers. All client messages are ciphered using cryptographic keys to provide reliability. Additionally, all data transferred from a client or user are digitally signed by the user's private key, which is encrypted by the public key of the receiver user, which means the confidentiality and integrity of data are preserved with privacy. #### 6.1.3 Patient's Perspective (Stakeholder)

When users or clients in a blockchain network perform an action in the form of a transaction, such as taking an appointment, a transaction is initiated. That is verified via the endorsers and goes to the orderer node. Once the orderer node receives the number of the transaction, a block is created according to the configured size of the block. Finally, the block's hash is generated and stored on the ledger via the consensus protocol. Thus, in the case of RAFT, the block is given to the leader node of the network. The leader synchronizes the hash in the ledger. Initially, the patient who generated the transaction is validated (by ensuring that he/she has an active account). The patient's selected slot is also verified (whether the specific time is available or not). Once the patient is approved for the appointment, he/she can mention the health record to healthcare personnel. #### 6.1.4 Healthcare Personnel Perspective (Stakeholder)

After the patient books an appointment with a specific doctor, he/she will have to choose the number of times the same doctor accesses his health record during the pre-selected period. The doctor will then be able to access the health record. This will be done by creating a transaction in the form of a set access policy to the doctor. That is verified via the endorsers and goes to the orderer node. Thus, the block is created, and the block's hash is generated and stored on the ledger via the consensus protocol. When the doctor accesses the policy, that will be validated through our UCON model. As mentioned in the background, the UCON model describes a user's session in three phases: pre-, ongoing, and post-access. Once the doctor receives access via a blockchain transaction within a specific time frame, it will be in the access stage. It will be allowed, and the UCON monitor module checks the permission and provides real-time/continuous access control. The access will be revoked when the time window ends. Traditionally, access-control models are static in the blockchain network, so once permission has been granted, there is no way to revoke access. Thus, this type of access is not available in a traditional blockchain system, and we have created a small means to implement UCON, which is dynamic access control. The patient will be able to give specific access to his health record in this case.