# MedChain: Efficient Healthcare Data Sharing via Blockchain
## 5 Evaluations
### Security Analysis  
This section validates the security requirement fulfillment, including the analysis on attack resistance, privacy protection, and non-repudiation. Assume the users of the system never expose their private keys and secret keys to others. The encryption algorithm cannot be compromised and an adversary cannot recover the keys. In addition, the authorized requesters are assumed to be trustworthy. For example, related laws and regulations are enacted to restrain healthcare data secondary usage. To facilitate description, some conventions are made first. A message \(m\) sent from \(C\) to \(B\) is denoted by \(C\to B:\left\langle m,E_{SK_{C}}(m)\right\rangle\) where \(E_{SK_{C}}(m)\) represents the signature of the message signed with \(C\)'s private key. \(C(A)\) represents the scenario that \(C\) is disguised as \(A\). Let \(PK_{adv}\) and \(SK_{adv}\) be the public-private key pair of an adversary. _Resilient to Masquerade Attack_: An adversary may pretend to be a user to gain unauthorized access to a data inventory, a session, or a ledger. For example, an adversary \(C\) pretends to be patient \(A\) and sends \(PK_{A}\) to healthcare provider \(B\) for inventory creation for patient \(A\): \(C(A)\to B\): \((m=PK_{A}\), \(E_{SK_{C}}(m))\). This attack can be defeated by checking the message signature. In the above example, \(B\) can discover that \(D_{PK_{A}}\left(E_{SK_{adv}}(m)\right)\
eq m\) and ignore the inventory creation request. Figure 7: Key Management Scheme: Keys are stored in (**a**) key case, (**b**) inventory, and (**c**) session through encryption. _Resilient to Replay Attack_: An adversary may intercept the message sent from one party to another party and replay the message to access the information without authorization. There could be three cases of a replay attack to MedChain. Case 1. Assume an adversary \(C\) can intercept a message from a healthcare provider \(A\) to a patient \(B\) for accessing the inventory and the data on a directory service node \(D\). \[ \begin{array}{l}A\to C(B):\left\langle m=\left\langle InvID,E_{PK_{A}}(S_{ data})\right\rangle,E_{SK_{A}}(m)\right\rangle\\ C(B)\to D:\left\langle m=\left\langle InvID,E_{PK_{A}}(S_{data})\right\rangle,E_{SK_{A}}(m)\right\rangle\\ D\to C(B):\left\langle m^{\prime}=\left\langle InvID\right\rangle,E_{SK_{D}}(m ^{\prime})\right\rangle\end{array} \]  
With the \(InvID\), \(C\) can ery the information from the directory service. However, without \(SK_{A}\), \(C\) can neither learn the identity of \(B\) nor decrypts \(E_{PK_{A}}(S_{data})\) for accessing the inventory of \(B\) under the \(InvID\). Case 2. Assume an adversary \(C\) can successfully intercept an inventory update message from a healthcare provider \(A\) to a directory node \(B\) for tampering the inventory. \[ \begin{array}{l}A\to C(B):\left\langle m=\left\langle InvID,E_{SK_{ data}}(InvContent)\right\rangle,E_{SK_{A}}(m)\right\rangle\\ C(B)\to B:\left\langle m^{\prime}=\left\langle InvID,E_{PK_{A}}\left(InvContent^{ \prime}\right)\right\rangle,E_{SK_{A}}(m)\right\rangle\end{array} \]  
Since \(InvContent\
eq InvContent^{\prime}\), \(D_{PK_{A}}(E_{SK_{A}}(m))\
eq m^{\prime}\). Message authentication will fail on \(B\) and \(B\) will not approve the change on the inventory. The similar inference can be applied to the replay attack on session change and session removal. Case 3. Assume an adversary \(C\) can successfully intercept a session request message from a requester \(A\) to a directory node \(B\) for accessing the session. \[ \begin{array}{l}A\to C(B):\left\langle m=SID,E_{SK_{A}}(m)\right\rangle\\ C(B)\to B:\left\langle m=SID,E_{SK_{A}}(m)\right\rangle\\ B\to C(A):\left\langle m^{\prime},E_{SK_{A}}(m^{\prime}),\text{ }\text{ }\text{ where }m^{\prime} \right.\\ \left.\hskip 14.226378 pt=\left\{\left\langle E_{ksc}(Entry),E_{PK_{sp}}(K_{ scc}),E_{PK_{nq}}(K_{scc}),E_{PK_{pat}}(K_{scc})\right\rangle\right\} \right.\end{array}