# Secure Outsourced Blockchain-Based Medical Data Sharing System Using Proxy Re-Encryption +
## 4 The Proposed Scheme
### System Model  
Figure 3 shows the model of the proposed system. The proposed medical data management system is composed of a user, server, proxy server, and third party. In addition, as shown in Figure 3, we assume that all systems except the proxy server are installed by an outsourcing blockchain company. In other words, the outsourcing company's role is to install and manage the blockchain and file server for the EHRs.  
All EHRs are stored in the server. Before being saved, the signature is attached to the EHR, the combined data are encrypted using a symmetric encryption scheme, and the symmetric key is encrypted using a public key encryption scheme. Figure 4a shows the encryption process. Because this system employs the PRE, we selected the second level of the PRE as the public key encryption scheme. To obtain the EHR, the symmetric key should be decrypted using PRE decryption (Section 4.3.4) or re-encryption (Section 4.3.5) and another PRE decryption (Section 4.3.6). Figure 3 shows the digital signature, encryption, decryption, and re-encryption processes. The detailed algorithms for encrypting, re-encrypting, and decrypting the symmetric key via PRE are provided in Section 4.3.  
In addition, when the EHR is stored, shared, and accessed, all of the log data for the EHRs are recorded in the distributed ledger of the blockchain. Moreover, information regarding participants that can access the EHR is stored in the distributed ledger. Because the blockchain guarantees the integrity of the entire managed data, no participants, except the system manager, can modify or delete the log data and access information.  
However, because these servers and blockchain systems are installed by an outsourcing company, all keys that include the private key can be managed by the company. This may be necessary, for example, if one of the important participants loses a private key and requests a key to access the stored data. However, if the outsourcing company abuses this privilege, sensitive data may be leaked even if they are encrypted and managed by the blockchain system, because the company has all the information.  
Figure 3: System model.  
To prevent this threat, we added a proxy server to the system. As shown in Figure 3, we installed a proxy server between the data server and end users. The aim of the proxy server is to re-encrypt the symmetric key. Originally, the symmetric key is retrieved by the system manager; however, after the proxy, it is reformed to a ciphertext that can be decrypted by the end user. In this regard, a re-encrypted key is input to the proxy.  
Figure 3(b) shows the re-encryption and decryption processes of the symmetric key. Originally, the symmetric key is encrypted with the manager's public key using the second-level encryption. When a user requests the healthcare data, the encrypted symmetric key is re-encrypted and modified to another ciphertext that can be decrypted with the user's private key using first-level decryption. Subsequently, the user retrieves the symmetric key with his/her private key and finally decrypts the data using the symmetric key.