# B-SSMD: A Fine-Grained Secure Sharing Scheme of Medical Data Based on Blockchain

Authors: Jialiang Yuan; Yan Ma; Wei Luo; Gang Han
Journal: Security and Communication Networks
 (2022)

---

## Abstract

The application of blockchain technology in the medical information system is gradually triggering profound changes, which has heterogeneous, cross-domain, and open network characteristics. However, today’s electronic medical systems fall short of ensuring the confidentiality and safe sharing of medical data, which poses serious threats to their authenticity and accuracy. Moreover, most of the current blockchain medical systems are under great transmission and storage pressure. Based on the aforementioned security and performance considerations, this paper proposes a fine-grained secure sharing scheme of medical data based on blockchain (B-SSMD). We design a three-chain model to store patient information, medical staff information, and medical records hierarchically. The integration of IPFS technology and the encryption algorithm ensures secure and efficient off-chain data storage. The user classification is realized by assigning attributes, and the attribute encryption technology is adopted for secondary encryption of the key and ciphertext path. Meanwhile, through hierarchical encryption, the risk of a system attack is greatly reduced. Our scheme not only solves the problems of low throughput and poor stability in the single chain model but also improves the data confidentiality and enables medical data to be managed more safely and efficiently in the sharing process. We provide the security and performance analysis and it is confirmed that our scheme has higher security and controllability.


---

## Body

## 1. Introduction

The development of artificial intelligence, big data, and blockchain technology has brought new opportunities and challenges to the medical data system [1]. With the continuous growth of electronic medical records, medical images, and other medical data, its security requirements are increasingly stringent. Compared with traditional big data, medical data has its own particularity. Medical records are not only highly sensitive personal information for clinical diagnosis and treatment but also affect the development of the whole medical industry. Electronic medical records (EMRs) sharing can help doctors obtain a previous medical history and examination data, which greatly reduces the treatment burden of patients and the waste of medical resources caused by repeated examinations. Therefore, medical record sharing is considered as a promising method to improve the quality of medical services. Meanwhile, the sharing model should have a privacy protection mechanism for medical data.The traditional centralized medical system and semitrusted cloud storage are difficult to achieve a balance between privacy protection and data sharing. The current information security issues in electronic medical systems are mainly to solve the secure collection, transmission, application, and sharing of information in a highly heterogeneous network environment [2]. As an emerging technology, blockchain is decentralized, traceable, and tamper-proof, ensuring data security and transparency that can be used for EMRs management in the medical field. In addition, blockchain can enable individuals to manage, access, and update their EMRs securely by authorizing specific entities, such as patients and medical departments [3]. However, problems such as data security and privacy protection still exist in the medical blockchain system. It is necessary to establish appropriate authentication, authorization, and privacy protection encryption mechanisms to ensure that authorized entities can access the correct patient data at the right time.Hence to ensure the secure sharing of the EMRs, in this paper, we propose a fine-grained secure sharing scheme of medical data based on blockchain (B-SSMD), which is privacy-preserving and data-decentralized. Blockchain can meet the demands in the medical data sharing process by hierarchical data storage, and it can guarantee the security and strict fine-grained data access. The data recorded on blockchain is tamper-resistant, synchronous, and light-loaded to achieve stability. In our proposal, the sensitive medical data is double encrypted and the ciphertext and its index path are stored and distributed to further improve the data confidentiality. In this way, patient privacy can be well protected from intruders, and data can be shared safely among different users. The main contributions are as follows:(i)
The three-chain fusion method enables the hierarchical storage of medical data, reducing the data security threats that exist in the previous simplex data storage method based on blockchain.(ii)
The InterPlanetary File System (IPFS) technology provides the underlying distributed data storage, with the role of secure and efficient off-chain data storage. The IPFS path is encrypted and stored on the consortium blockchain to reduce the on-chain storage burden.(iii)
The data sharing process P/MSISP provides more security and is more efficient for end users by integrating the three-chain model and IPFS for information storage, update, and sharing.(iv)
The Ciphertext-Policy Attribute-based Encryption (CP-ABE) is applied to encrypt the symmetric encryption key and the ciphertext path, in order to achieve more secure and flexible management of medical data, as well as fine-grained data access control.The remainder of this paper is organized as follows: in Section2, related work is presented. In Section 3, we briefly introduce some preliminaries. Section 4 shows the scheme framework and the implementation of B-SSMD in detail. Section 5 analyzes the security of B-SSMD. In Section 6, the performance analysis of the scheme is proposed. Finally, we conclude the paper in Section 7.


## 2. Related Work

Nowadays, medical information system plays an important role in patient health record management, patient data monitoring, etc. and has become an effective way to solve the shortage of medical resources. With the emergence of new technologies and new requirements, medical information systems have increasingly demanding requirements for data processing, sharing, and security protection capabilities. At present, studies have shown that cloud computing [4, 5] is a key technology to improve the medical system. Considering the privacy of user data, medical data stored in the cloud are encrypted, and there are a lot of data sharing scenarios in the cloud environment [6]. When medical data are stored in the cloud server, the key problem is how to prevent unauthorized users from illegally access and how to share data among authorized users efficiently [7, 8]. Li et al. [9] proposed a novel patient-centric framework and a suite of mechanisms for data access control to personal health records stored in semitrusted servers. The system divides the users into multiple security domains that reduces the key management complexity but requires the interaction among multiple attribute authorities and leaks attributes privacy in the access policy. Wang [10] presented a secure data sharing scheme built from bilinear pairings that provides the flexible utility of data while solving the privacy and security challenges for data sharing. Liang et al. [11] proposed a decentralized ABE scheme that can safely share cloud storage of personal health records (PHRs). In the two schemes above, the medical record files are encrypted with the public key using an encryption algorithm and stored in the cloud storage server. However, due to the higher requirements of cloud storage for data confidentiality, such schemes do not encrypt the key and ciphertext path, and thus the data confidentiality and security need to be further improved.With the explosive growth of medical data, the use of outsourced clouds to store sensitive information is vulnerable to many security threats [12, 13]. In order to store and manage massive amounts of medical data more efficiently and securely, the emergence of blockchain technology has a huge impact on the medical information system. Blockchain has the characteristics of multiparty maintenance, nontampering, and decentralized storage [14–17], and it can complement the security issues in cloud storage. For instance, by introducing blockchain, the problem of potential single point failure of the center authority can be solved to some extent. Meanwhile, blockchain enables patients to be regarded as the main entities and centers of an entire healthcare ecosystem [18–20]. Therefore, blockchain technology has brought new opportunities for the development of medical information system and related work has been studied. Liu et al. [21] proposed a blockchain-based privacy protection data sharing scheme for electronic medical records. In this scheme, they use a single consortium blockchain to reserve indexes of EMRs and achieve data sharing. Lee et al. [22] designed a blockchain-based data storage solution for telecare medical information systems. The social network information transfer protocol stores data using blockchain technology so that a data owner can authorize access to data by relevant users. Madine et al. [23] proposed a blockchain medical system that allows patients to control medical records. They integrate blockchain-based system with the IPFS and trusted reputations-based oracles to fetch, store, and retrieve PHRs. However, in the above schemes, the traditional single chain model is used, and thus the storage capacity of the blockchain is limited and the data storage and access methods on the traditional blockchain are relatively simple. For the blockchain with a single chain structure, all accounts, contracts, transactions, and other information are stored on one chain, which does not ensure privacy protection but also causes slow response due to a large amount of redundant data. The single-chain blockchain scheme has poor scalability, low throughput, and lacks a flexible and secure way to update, store, and share data. Therefore, a more effective blockchain network structure is needed to improve the security and efficiency of the system.In terms of storing and sharing EMRs, uploading patient medical data to all nodes in the blockchain network will increase the risk of medical data leakage, and problems such as data privacy protection and cloud storage data security access exist. For hospitals, the large amount of data stored in the third-party cloud is not reassuring [24–27]. To better achieve privacy protection in medical big data sharing across medical information systems, some research studies have been implemented. Wang et al. [28] presented a model for data access control and sharing using blockchain and used attribute-based encryption to control and share enterprise data. In this scheme, users are divided into two categories, and an access control policy tree is established according to the attributes of visitors. Alniamy and Bradley [29] proposed an architecture model by combining Hyperledger blockchain technology and Attribute-based Encryption scheme in a decentralized environment. In their work, all data access requests are processed through the blockchain and all permissions are assigned by data owner of the document. Wang et al. [30] proposed a decentralized secure cloud storage access control framework by using the Ethereum blockchain technology. The data owner can append an effective access period for the data user and store an access period time of information on the Ethereum blockchain. In the above-given blockchain based access control scheme, the user groups in the medical system are not specifically divided, and only the two major user principals, patients, and doctors, are the research objects. Hence, the schemes lack fine-grained security protection mechanism and cannot fully meet the needs of high granularity and high security of medical information system.Our paper takes aim at solving the above problems. In our scheme, we exploit three-chain blockchain structure to make the hierarchical stored medical data sharing process more secure and effective with a symmetric encryption key and IPFS path encrypted. The user group are fine-grained divided and their access strategies are designed in detail. The logics are implemented by chaincode, which is the smart contract in FISCO BCOS Caliper.


## 3. Preliminaries

In this section, we briefly review the relevant knowledge.


### 3.1. Blockchain

Recently, blockchain technology has attracted increasing attention. As an emerging technology, it has many application values in medical treatment because of the decentralized, transparent, and secure characteristics. Blockchain is essentially a distributed database technology. As shown in Figure1, each node on the blockchain includes two parts, a block header and a block body. It utilizes technologies such as distributed timestamp protocol, longest chain algorithm, and related encryption algorithms (such as SHA-256) to achieve a distributed consensus mechanism and user anonymity.Figure 1
Blockchain structure.Blockchains can be divided into public blockchains, private blockchains, and consortium blockchains. Anyone in the public blockchain can participate in the consensus process. The private blockchain is only open to individual person or entity. And, the consortium blockchain allows a number of authorized parties to participate in.In response to data security and patient privacy issues in medical information system, we adopt the form of consortium blockchain to build a secure information sharing system. Compared with public blockchains, it can control user nodes inside and outside the network through a flexible access mechanism for better privacy protection. In addition, it also has the advantages of lower cost, higher performance, and strong scalability.


### 3.2. CP-ABE

Attribute-based encryption (ABE) belongs to asymmetric encryption technology essentially, which can realize one-to-many data encryption communication [31]. The encryption schemes are divided into key policy attribute-based encryption (KP-ABE) and ciphertext policy attribute-based encryption (CP-ABE). The access control policy in KP-ABE is associated with the key, while the access policy in CP-ABE applied in this paper is associated with the ciphertext. The decryption policy is embedded in the ciphertext during encryption, and the user’s attributes are embedded in the private key when the key is generated. If and only if when the attribute set meets the attribute policy, the user can decrypt it. The CP-ABE scheme usually contains four algorithms as follows.


#### 3.2.1. Initialization

The initialization process generates the public parameterPk and the master key Mk by inputting the security parameter λ.(1)Setupλ⟶Pk,Mk.


#### 3.2.2. Private Key Generation

Takes the master keyMk and the attribute set S as input to output the user attribute private key Sk.(2)KeyGenMk,S⟶Sk.


#### 3.2.3. Encryption

Passes in the public parameterPk, access structure T, and plaintext M. Then the algorithm encrypts the plaintext M and generates the ciphertext C.(3)EncryptPk,T,M⟶C.


#### 3.2.4. Decryption

Inputs the public parametersPk, the ciphertext C and the user private key Sk. If the attributes contained in the user attribute private key Sk meet the access structure T contained in the ciphertext, the ciphertext C can be decrypted.(4)DecryptPk,C,Sk⟶M.


### 3.3. IPFS

The InterPlanetary File System (IPFS) is a persistent and distributed network transmission protocol for storing and sharing files. This file system can be accessed in a variety of ways, including FUSE and HTTP. When a file is uploaded to the IPFS system, the file and all the blocks in it will be given a unique fingerprint called cryptographic hash, which uniquely identifies the file uploaded to IPFS, so that the user can search via the hash string. When other nodes in the system have the same file, the encrypted hash can be applied to download the file from multiple nodes at the same time. IPFS has the following advantages.


#### 3.3.1. Fast Download Speed

It utilizes the BitTorrent protocol to make data transmission faster on the IPFS network.


#### 3.3.2. High Security

Its decentralized feature enables data storage more secure, and data files cannot be downloaded or uploaded due to a node failure.


#### 3.3.3. Low Redundancy

IPFS is a block storage model based on content addressing. Each file is clearly identified in the global namespace based on content addressing, reducing the redundancy of network storage.


### 3.4. Symbol Description

In Table1 lists the all notations that will be used in this paper.Table 1
Notations and their meanings.
NotationMeaningMMedical recordPPatientDDoctorHHospitalUUserIiIP Patient information, Id doctor informationwAccess control strategyTTimeCCiphertextTIPFS pathϑAttackerKKeyAAttribute


## 3.1. Blockchain

Recently, blockchain technology has attracted increasing attention. As an emerging technology, it has many application values in medical treatment because of the decentralized, transparent, and secure characteristics. Blockchain is essentially a distributed database technology. As shown in Figure1, each node on the blockchain includes two parts, a block header and a block body. It utilizes technologies such as distributed timestamp protocol, longest chain algorithm, and related encryption algorithms (such as SHA-256) to achieve a distributed consensus mechanism and user anonymity.Figure 1
Blockchain structure.Blockchains can be divided into public blockchains, private blockchains, and consortium blockchains. Anyone in the public blockchain can participate in the consensus process. The private blockchain is only open to individual person or entity. And, the consortium blockchain allows a number of authorized parties to participate in.In response to data security and patient privacy issues in medical information system, we adopt the form of consortium blockchain to build a secure information sharing system. Compared with public blockchains, it can control user nodes inside and outside the network through a flexible access mechanism for better privacy protection. In addition, it also has the advantages of lower cost, higher performance, and strong scalability.


## 3.2. CP-ABE

Attribute-based encryption (ABE) belongs to asymmetric encryption technology essentially, which can realize one-to-many data encryption communication [31]. The encryption schemes are divided into key policy attribute-based encryption (KP-ABE) and ciphertext policy attribute-based encryption (CP-ABE). The access control policy in KP-ABE is associated with the key, while the access policy in CP-ABE applied in this paper is associated with the ciphertext. The decryption policy is embedded in the ciphertext during encryption, and the user’s attributes are embedded in the private key when the key is generated. If and only if when the attribute set meets the attribute policy, the user can decrypt it. The CP-ABE scheme usually contains four algorithms as follows.


### 3.2.1. Initialization

The initialization process generates the public parameterPk and the master key Mk by inputting the security parameter λ.(1)Setupλ⟶Pk,Mk.


### 3.2.2. Private Key Generation

Takes the master keyMk and the attribute set S as input to output the user attribute private key Sk.(2)KeyGenMk,S⟶Sk.


### 3.2.3. Encryption

Passes in the public parameterPk, access structure T, and plaintext M. Then the algorithm encrypts the plaintext M and generates the ciphertext C.(3)EncryptPk,T,M⟶C.


### 3.2.4. Decryption

Inputs the public parametersPk, the ciphertext C and the user private key Sk. If the attributes contained in the user attribute private key Sk meet the access structure T contained in the ciphertext, the ciphertext C can be decrypted.(4)DecryptPk,C,Sk⟶M.


## 3.2.1. Initialization

The initialization process generates the public parameterPk and the master key Mk by inputting the security parameter λ.(1)Setupλ⟶Pk,Mk.


## 3.2.2. Private Key Generation

Takes the master keyMk and the attribute set S as input to output the user attribute private key Sk.(2)KeyGenMk,S⟶Sk.


## 3.2.3. Encryption

Passes in the public parameterPk, access structure T, and plaintext M. Then the algorithm encrypts the plaintext M and generates the ciphertext C.(3)EncryptPk,T,M⟶C.


## 3.2.4. Decryption

Inputs the public parametersPk, the ciphertext C and the user private key Sk. If the attributes contained in the user attribute private key Sk meet the access structure T contained in the ciphertext, the ciphertext C can be decrypted.(4)DecryptPk,C,Sk⟶M.


## 3.3. IPFS

The InterPlanetary File System (IPFS) is a persistent and distributed network transmission protocol for storing and sharing files. This file system can be accessed in a variety of ways, including FUSE and HTTP. When a file is uploaded to the IPFS system, the file and all the blocks in it will be given a unique fingerprint called cryptographic hash, which uniquely identifies the file uploaded to IPFS, so that the user can search via the hash string. When other nodes in the system have the same file, the encrypted hash can be applied to download the file from multiple nodes at the same time. IPFS has the following advantages.


### 3.3.1. Fast Download Speed

It utilizes the BitTorrent protocol to make data transmission faster on the IPFS network.


### 3.3.2. High Security

Its decentralized feature enables data storage more secure, and data files cannot be downloaded or uploaded due to a node failure.


### 3.3.3. Low Redundancy

IPFS is a block storage model based on content addressing. Each file is clearly identified in the global namespace based on content addressing, reducing the redundancy of network storage.


## 3.3.1. Fast Download Speed

It utilizes the BitTorrent protocol to make data transmission faster on the IPFS network.


## 3.3.2. High Security

Its decentralized feature enables data storage more secure, and data files cannot be downloaded or uploaded due to a node failure.


## 3.3.3. Low Redundancy

IPFS is a block storage model based on content addressing. Each file is clearly identified in the global namespace based on content addressing, reducing the redundancy of network storage.


## 3.4. Symbol Description

In Table1 lists the all notations that will be used in this paper.Table 1
Notations and their meanings.
NotationMeaningMMedical recordPPatientDDoctorHHospitalUUserIiIP Patient information, Id doctor informationwAccess control strategyTTimeCCiphertextTIPFS pathϑAttackerKKeyAAttribute


## 4. B-SSMD: Blockchain-Based Secure Sharing System of Medical Data

### 4.1. System Architecture

The B-SSMD system proposed in this paper is devised in a four-layer architecture, consisting of a storage layer, blockchain network layer, API layer, and application layer, as shown in Figure2. The function of each layer is described as follows.Figure 2
B-SSMD system architecture.


#### 4.1.1. Storage Layer

The system adopts the on-chain and off-chain hybrid storage scheme. The bottom layer uses IPFS distributed storage technology to store symmetrically encrypted data. The blockchain in the system is divided into three categories, patient information blockchain (PIB), medical staff information blockchain (MSIB), and medical record information blockchain (MRIB).


#### 4.1.2. Blockchain Network Layer

This layer is to perform the functions of the blockchain in the system and realize functions such as data update, status synchronization, and access control.


#### 4.1.3. API Layer

In this layer, by calling API, block broadcast transmission, etc., are realized.


#### 4.1.4. Application Layer

The function of this layer is to realize user registration, information retrieval, authority management, etc.


### 4.2. Three-Chain Model

The B-SSMD system proposed in this paper applies the PIB/MSIB/MRIB three-chain model to store patient information, medical staff information, and medical records in three different information blockchains. The system has a strict access mechanism. Only legal users who have passed the administrator’s security authentication are allowed to share and maintain blockchain node information and access system data. The data of the three information chains have considerable adhesion, and the system has strict access control strategies. Thus, it is difficult for attackers to invade the system. Since the encrypted data is classified and hierarchically stored in different blockchains, when an attacker attempts to crack all medical information of a user, all the data of the three blockchains must be acquired at the same time and decrypted. Since the three-chain model realizes the distributed storage of users’ medical information, and the system adopts strict access control strategies, hence obtaining data from three blockchains simultaneously is quite difficult. Additionally, in order to relieve the node load of the blockchain and further strengthen the system stability, the hash address of IPFS is stored on-chain and the encrypted data is stored off-chain in this scheme.The three-chain model of the system is shown in Figure3, and the implementation mechanism is as follows.Figure 3
B-SSMD three-chain model.


#### 4.2.1. Patient Information Blockchain (PIB)

Nodes in this blockchain record patient detailed informationIpIn,Is,Ia,IIDn,Itel, such as the patient’s name In, gender Is, age Ia, ID number IIDn, telephone number Itel, etc. PIB node information is associated with MRIB node information, that is, the medical records MMt,Ms,Md of a patient Pi in the hospital H1 are written and stored on MRIB by doctor D1. When Pi is transferred to hospital H2, the system should only query the medical information MMt,Ms,Md of Pi on the blockchain MRIBD2⟶M when the doctor D2 needs. The system grants the data access authority to relevant doctors according to the access control policy w to avoid node information leakage.


#### 4.2.2. Medical Staff Information Blockchain (MSIB)

MSIB records the detailed information of medical staffIdIn,Is,Ia,IIDn,Itel,Ih,Io,Ip,Ie. Similar to the patient information, it should also record the served hospital Ih, department Io, the level Ip and related evaluations Ie of doctors. The medical staff information is stored on-chain, and the patient Pi can quickly acquire the basic situation of the doctor Di by reading the information of DiMSIBpi⟶Id through system access control policy w. Meanwhile, patients can also evaluate the doctor’s treatment level and satisfaction as a reference for other users. Compared with traditional medical systems, this scheme can realize the two-way interaction of doctor-patient information and improve the flexibility of data access and processing.


#### 4.2.3. Medical Records Information Blockchain (MRIB)

It records the relevant medical record informationMMt,Ms,Md of the patient, mainly including the treatment time Mt, the treatment location Ms, the detailed treatment situation Md, etc. The medical record information is unilaterally written by the doctor Di. Since the MRIB node contains the patient’s important sensitive information related to life safety, the information released by Di should include the doctor’s digital signature M′=sigData‖M, so that this digital signature can ensure the nonrepudiation of the diagnosis information of doctors and hospitals when medical disputes occur.


### 4.3. System Scheme

In the B-SSMD system proposed in this paper, the medical data is processed by symmetric encryption, and the keyK is double-encrypted through CP-ABE. Finally, the obtained ciphertext group is stored off-chain in IPFS, and the returned index address, data ID, time, and other data are uploaded on the blockchain. Meanwhile, the scheme assigns authorities based on user attributes to realize fine-grained data access. The scheme achieves medical data security sharing through the following phases.


#### 4.3.1. Initialization

The security parameterλ is taken as input, the public parameter Pk and the master key Mk are generated by the Certificate Authority (CA) for secure storage.


#### 4.3.2. Identity Registration

A new userunew should register unique accounts at first, and the system administrator should verify the identity and qualification Verunew. When unew is successfully verified, the system automatically adds the user addUserui, so that unew becomes a legal user ui and obtains the corresponding attributes. When the user logs off, the administrator executes the user delete operation deleteUserui and deletes the user information and attributes. The system parameters are shown in Tables 2 and 3.Table 2
User attribute.
UserAttributeDoctorStaff ID, department B, level PPatientPatient ID, consultation department BTable 3
Parameter set.
SetMeaningUdDoctor user setUd=u1,u2…unUpPatient user setUp=u1,u2…unBDepartment setB=B1,B2…BnGDoctor level setG=1,2,3,4,5AdDoctor attribute setAd=DID,DB,DGApPatient attribute setAp=PID,PBThe system administrator judges whetherunew has been registered through comparing the legal user information to determine whether ui can join the system. The user addition operation addUserui is described as follows (see Algorithm 1).Algorithm 1:AddUserui.
(1)
if:unew∉Ud∨Up(2)
unew⟶ui(3)
U′=U∪ui(4)
else:(5)
User already existsWhenui proposes to log off, the system administrator executes the user deletion program deleteUserui as follows (see Algorithm 2).Algorithm 2:DeleteUserui.
(1)
if:ui∈Ud∨Up(2)
U′=U/ui(3)
else:(4)
User does not existAfterui has joined the system, the administrator should assign corresponding attributes. The user attribute assignment program assignAttributesui,ai is expressed as follows (see Algorithm 3).Algorithm 3:AssignAttributesui,ai.
(1)
if:ui∈Ud(2)
allowAssignAdtoui(3)
else if:ui∈Up(4)
allowAssignAptoui(5)
else:(6)
Unable to assign


#### 4.3.3. Key Distribution

The system performs the key distribution algorithmKeyGenMk,Ak, CA calculates the user’s private key Sk based on the registrant attribute set a∈Ak and sends it to the data visitor through a secure channel for storage. The process is as follows:(5)KeyGenMk,S⟶Sk⟶User.


#### 4.3.4. Data Encryption

The data owner (patient or doctor) provides the corresponding access control strategyw according to the visitor’s attributes, randomly generates a symmetric encryption key K to encrypt data C1=Enc1Data,K, and encrypts the key K through CP-ABE C2=Enc2Pk,K,w.


#### 4.3.5. Data Upload on Blockchain

The data owner stores the ciphertext groupC1,C2 off-chain in IPFS. The returned path L is encrypted through CP-ABE to obtain the path ciphertext CL=Enc2Pk,L,w, and relevant data such as CL and time T are uploaded onto the blockchain.


#### 4.3.6. Ciphertext Access

A legal visitor who meets the access control policyw can use the attribute key Sk to decrypt CL obtained on the blockchain according to the decrypted access path L=Dec2Pk,CL,Sk to retrieve and extract C1,C2 stored in IPFS. Through decrypting the extracted data C2 to acquire the symmetric key K=Dec2C2,Sk,Pk, the user can decrypt the shared data with the obtained key KData=Dec1C1,K.The access control strategywri,p in the scheme is specifically described as follows.The user’s information access authority on the three blockchains PIB, MSIB, and MRIB includes addi, delete d, change u, and check s. The system determines the access authority by judging the user attributes Ad,Ap, where the doctor-level attribute G is assigned to the hospital president G=5, director G=4, head nurse G=3, doctor G=2 and nurse G=1. The system must assure all entities/stakeholders (patient, doctor, hospital president, department director, head nurse, nurse, etc.) granular access to medical data at a role level.Strategy 1 Patient information blockchain (PIB). First, the system verifies the user’s attribute ID. If the user is a doctor uID⟶D, the authority will be assigned based on the doctor’s attribute level G. Among them, the president G=5 can view all patient information in emergency situations. The director, head nurse and nurses 3≤G<5∨G=1 can only view the patient information in this department Bi. The doctor G=2 can only view the received patient information. If the user is a patient uID⟶P, since the basic information of the patient is stored on PIB, only the patient user is assigned the authority to add, delete, modify, and check i,d,u,s the personal data (see Algorithm 4).Algorithm 4: Patient information strategy.
(1)
if:uID⟶D(2)
if:G=5(3)
allowAssignsofPIBalltoud(4)
if:3≤G<5∨G=1(5)
allowAssignsofPIBBitoud(6)
if:G=2(7)
allowAssignsofPIBupofudtoud(8)
else if:uID⟶P(9)
allowAssigni,d,u,sof PIB toup(10)
else:(11)
No permissionStrategy 2 Medical staff information blockchain (MSIB). First, the system verifies the user’s attribute ID. If the user is a doctor uID⟶D, the authority will be assigned based on the doctor’s attribute level G. Among them, the president G=5 can view the information of all medical staff in this hospital. The director and head nurse 3≤G<5 can only view the medical staff information in this department. The doctor and nurse 1≤G<3 can add, delete, modify, and check i,d,u,s the own information. A patient uID⟶P can query the information of relevant doctors and add evaluation (see Algorithm 5).Algorithm 5: Medical staff information strategy.
(1)
if:uID⟶D(2)
if:G=5(3)
allowAssignsofMSIBalltoud(4)
if:3≤G<5(5)
allowAssignsofMRIBBitoud(6)
if:1≤G<3(7)
allowAssigni,d,u,sof MSIB toud(8)
else if:uID⟶P(9)
allowAssigns,iofMSIBudofuptoud(10)
else:(11)
No permissionStrategy 3 Medical record information blockchain (MRIB). First, the system verifies the user’s attribute ID. If the user is a doctor uID⟶D, the authority will be assigned based on the doctor’s attribute level G. In MRIB, the president G=5 can view the medical records of all patients under emergency. The director, head nurse, and nurses 3≤G<5∨G=1 can only view the medical records of patients in this department Bi. The doctor G=2 can view and update the medical records of the received patients. A patient uID⟶P can only view the personal medical records (see Algorithm 6).Algorithm 6: Medical record information strategy.
(1)
if:uID⟶D(2)
if:pd=5(3)
allowAssignsofMRIBalltoud(4)
if:3≤G<5∨G=1(5)
allowAssignsofMRIBupofBitoud(6)
if:G=2(7)
allowAssigns,iofMRIBupofudtoud(8)
else if:uID⟶P(9)
allowAssignsof MRIB toud(10)
else:(11)
No permission


### 4.4. Information Sharing Process P/MSISP

The information sharing process in B-SSMD includes two parts. One is the Patient information sharing process (PISP). The scheme realizes the information sharing of medical records among patients and medical staff. In PISP, PIB, and MRIB are the subjects of data storage and update, medical staff are the data visitors. Another is the Medical staff information sharing process (MSISP), which realizes the information sharing between patients and medical staff. In MSISP, MSIB is used for data storage and update, and patients are the data visitors.The blockchain data access process consists of three steps, uploading user hash data on-chain, reading the node data on-chain, and updating the data on-chain. The scheme model is shown in Figure4, and the specific process is as follows.Figure 4
Information sharing process.


#### 4.4.1. Patient Information Sharing Process (PISP)

Patient information upload. The patient uploads the encrypted data and the encrypted key C1‖C2 to IPFS and obtains the access path L of the ciphertext. The user sends the information IDataID,PID,CL,w,T including the data DataID, the data owner (patient) PID, the access control strategy w, the path ciphertext CL, and the release time T on PIB. In order to identify the data source, the patient’s digital signature must be uploaded.(6)C1‖C2⟶IPFS,IDataID,PID,CL,w,T‖σpI⟶PIB.Medical staff access data on PIB/MRIB. The data visitor (doctor) D obtains the data path as ciphertext CL from PIB and MRIB, decrypts it to obtain the path L=Dec2Pk,CL,Sk and finds the encrypted data C1‖C2 in IPFS. Then, decrypt and read the key K=Dec2Pk,C2,Sk and acquire the data Datap=Dec1C1,K. For the patient’s first consultation, D should not access the information of the patient P on MRIB. For patients who have been transferred or visited multiple times, D can view the previous medical records M by accessing the information on MRIB, and the patient do not need to be checked again. The information access process can be expressed as follows:(7)PIBMRIB⟶L=Dec2Pk,CL,Sk⟶IPFS⟶C1‖C2⟶K=Dec2Pk,C2,Sk,Datap=Dec1C1,K.Medical staff update data on MRIB. After the data visitor (doctor) D reads the patient information, a new medical record M’ will be generated. At this time, D uploads the data and the encryption key C1‖C2 to IPFS. Then encrypt the obtained path to ciphertext CL, and the information IDatanewID,DoctorID,CL,w,T, including data DatanewID, the visitor DoctorID, the visit time T and access control strategy w, together with the doctor’s digital signature σdI, will be uploaded on the blockchain. The information update process is shown as follows:(8)C1‖C2⟶IPFS,IDatanewID,DoctorID,CL,w,T‖σdI⟶MRIB.


#### 4.4.2. Medical Staff Information Sharing Process (MSISP)

The information of medical staff is mainly used as the data sharing content and the information is obtained by users such as patients in this scheme.Medical staff upload information. The doctor uploads the encrypted data and encrypted key C1‖C2 to IPFS then stores the obtained information IDataID,DoctorID,CL,w,T including the encrypted path CL, data DataID, the data owner (doctor) DoctorID and time T on MSIB. In order to identify the data source, the doctor’s digital signature must be uploaded simultaneously.(9)C1‖C2⟶IPFS,IDataID,DoctorID,CL,w,T‖σdI⟶MSIB.Patient access data on MSIB. When the patient views relevant information of the doctor, the encrypted path CL in IPFS from MSIB should be obtained, and decrypt it L=Dec2Pk,CL,Sk. Then, retrieve the data C1‖C2 in IPFS and view the medical staff information after decryption.(10)MSIB⟶L=Dec2Pk,CL,Sk⟶IPFS⟶C1‖C2⟶K=Dec2Pk,C2,Sk,Datad=Dec1C1,K.Patient update data on MSIB. The patient can evaluate the medical staff, and the evaluation information, namely, the updated data Datadnew, should be uploaded on the blockchain. The patient stores the encrypted data and encrypted key C1‖C2 in IPFS. The obtained encrypted path CL and the information IDatanewID,PID,T,w,CL including data DatanewID, the data visitor PID, the visit time T and access control strategy w will be uploaded on the blockchain. In order to identify the source of the new data, the patient’s signature must be submitted.(11)C1‖C2⟶IPFS,IDatanewID,PID,T,w,CL‖σpI⟶MSIB.


## 4.1. System Architecture

The B-SSMD system proposed in this paper is devised in a four-layer architecture, consisting of a storage layer, blockchain network layer, API layer, and application layer, as shown in Figure2. The function of each layer is described as follows.Figure 2
B-SSMD system architecture.


### 4.1.1. Storage Layer

The system adopts the on-chain and off-chain hybrid storage scheme. The bottom layer uses IPFS distributed storage technology to store symmetrically encrypted data. The blockchain in the system is divided into three categories, patient information blockchain (PIB), medical staff information blockchain (MSIB), and medical record information blockchain (MRIB).


### 4.1.2. Blockchain Network Layer

This layer is to perform the functions of the blockchain in the system and realize functions such as data update, status synchronization, and access control.


### 4.1.3. API Layer

In this layer, by calling API, block broadcast transmission, etc., are realized.


### 4.1.4. Application Layer

The function of this layer is to realize user registration, information retrieval, authority management, etc.


## 4.1.1. Storage Layer

The system adopts the on-chain and off-chain hybrid storage scheme. The bottom layer uses IPFS distributed storage technology to store symmetrically encrypted data. The blockchain in the system is divided into three categories, patient information blockchain (PIB), medical staff information blockchain (MSIB), and medical record information blockchain (MRIB).


## 4.1.2. Blockchain Network Layer

This layer is to perform the functions of the blockchain in the system and realize functions such as data update, status synchronization, and access control.


## 4.1.3. API Layer

In this layer, by calling API, block broadcast transmission, etc., are realized.


## 4.1.4. Application Layer

The function of this layer is to realize user registration, information retrieval, authority management, etc.


## 4.2. Three-Chain Model

The B-SSMD system proposed in this paper applies the PIB/MSIB/MRIB three-chain model to store patient information, medical staff information, and medical records in three different information blockchains. The system has a strict access mechanism. Only legal users who have passed the administrator’s security authentication are allowed to share and maintain blockchain node information and access system data. The data of the three information chains have considerable adhesion, and the system has strict access control strategies. Thus, it is difficult for attackers to invade the system. Since the encrypted data is classified and hierarchically stored in different blockchains, when an attacker attempts to crack all medical information of a user, all the data of the three blockchains must be acquired at the same time and decrypted. Since the three-chain model realizes the distributed storage of users’ medical information, and the system adopts strict access control strategies, hence obtaining data from three blockchains simultaneously is quite difficult. Additionally, in order to relieve the node load of the blockchain and further strengthen the system stability, the hash address of IPFS is stored on-chain and the encrypted data is stored off-chain in this scheme.The three-chain model of the system is shown in Figure3, and the implementation mechanism is as follows.Figure 3
B-SSMD three-chain model.


### 4.2.1. Patient Information Blockchain (PIB)

Nodes in this blockchain record patient detailed informationIpIn,Is,Ia,IIDn,Itel, such as the patient’s name In, gender Is, age Ia, ID number IIDn, telephone number Itel, etc. PIB node information is associated with MRIB node information, that is, the medical records MMt,Ms,Md of a patient Pi in the hospital H1 are written and stored on MRIB by doctor D1. When Pi is transferred to hospital H2, the system should only query the medical information MMt,Ms,Md of Pi on the blockchain MRIBD2⟶M when the doctor D2 needs. The system grants the data access authority to relevant doctors according to the access control policy w to avoid node information leakage.


### 4.2.2. Medical Staff Information Blockchain (MSIB)

MSIB records the detailed information of medical staffIdIn,Is,Ia,IIDn,Itel,Ih,Io,Ip,Ie. Similar to the patient information, it should also record the served hospital Ih, department Io, the level Ip and related evaluations Ie of doctors. The medical staff information is stored on-chain, and the patient Pi can quickly acquire the basic situation of the doctor Di by reading the information of DiMSIBpi⟶Id through system access control policy w. Meanwhile, patients can also evaluate the doctor’s treatment level and satisfaction as a reference for other users. Compared with traditional medical systems, this scheme can realize the two-way interaction of doctor-patient information and improve the flexibility of data access and processing.


### 4.2.3. Medical Records Information Blockchain (MRIB)

It records the relevant medical record informationMMt,Ms,Md of the patient, mainly including the treatment time Mt, the treatment location Ms, the detailed treatment situation Md, etc. The medical record information is unilaterally written by the doctor Di. Since the MRIB node contains the patient’s important sensitive information related to life safety, the information released by Di should include the doctor’s digital signature M′=sigData‖M, so that this digital signature can ensure the nonrepudiation of the diagnosis information of doctors and hospitals when medical disputes occur.


## 4.2.1. Patient Information Blockchain (PIB)

Nodes in this blockchain record patient detailed informationIpIn,Is,Ia,IIDn,Itel, such as the patient’s name In, gender Is, age Ia, ID number IIDn, telephone number Itel, etc. PIB node information is associated with MRIB node information, that is, the medical records MMt,Ms,Md of a patient Pi in the hospital H1 are written and stored on MRIB by doctor D1. When Pi is transferred to hospital H2, the system should only query the medical information MMt,Ms,Md of Pi on the blockchain MRIBD2⟶M when the doctor D2 needs. The system grants the data access authority to relevant doctors according to the access control policy w to avoid node information leakage.


## 4.2.2. Medical Staff Information Blockchain (MSIB)

MSIB records the detailed information of medical staffIdIn,Is,Ia,IIDn,Itel,Ih,Io,Ip,Ie. Similar to the patient information, it should also record the served hospital Ih, department Io, the level Ip and related evaluations Ie of doctors. The medical staff information is stored on-chain, and the patient Pi can quickly acquire the basic situation of the doctor Di by reading the information of DiMSIBpi⟶Id through system access control policy w. Meanwhile, patients can also evaluate the doctor’s treatment level and satisfaction as a reference for other users. Compared with traditional medical systems, this scheme can realize the two-way interaction of doctor-patient information and improve the flexibility of data access and processing.


## 4.2.3. Medical Records Information Blockchain (MRIB)

It records the relevant medical record informationMMt,Ms,Md of the patient, mainly including the treatment time Mt, the treatment location Ms, the detailed treatment situation Md, etc. The medical record information is unilaterally written by the doctor Di. Since the MRIB node contains the patient’s important sensitive information related to life safety, the information released by Di should include the doctor’s digital signature M′=sigData‖M, so that this digital signature can ensure the nonrepudiation of the diagnosis information of doctors and hospitals when medical disputes occur.


## 4.3. System Scheme

In the B-SSMD system proposed in this paper, the medical data is processed by symmetric encryption, and the keyK is double-encrypted through CP-ABE. Finally, the obtained ciphertext group is stored off-chain in IPFS, and the returned index address, data ID, time, and other data are uploaded on the blockchain. Meanwhile, the scheme assigns authorities based on user attributes to realize fine-grained data access. The scheme achieves medical data security sharing through the following phases.


### 4.3.1. Initialization

The security parameterλ is taken as input, the public parameter Pk and the master key Mk are generated by the Certificate Authority (CA) for secure storage.


### 4.3.2. Identity Registration

A new userunew should register unique accounts at first, and the system administrator should verify the identity and qualification Verunew. When unew is successfully verified, the system automatically adds the user addUserui, so that unew becomes a legal user ui and obtains the corresponding attributes. When the user logs off, the administrator executes the user delete operation deleteUserui and deletes the user information and attributes. The system parameters are shown in Tables 2 and 3.Table 2
User attribute.
UserAttributeDoctorStaff ID, department B, level PPatientPatient ID, consultation department BTable 3
Parameter set.
SetMeaningUdDoctor user setUd=u1,u2…unUpPatient user setUp=u1,u2…unBDepartment setB=B1,B2…BnGDoctor level setG=1,2,3,4,5AdDoctor attribute setAd=DID,DB,DGApPatient attribute setAp=PID,PBThe system administrator judges whetherunew has been registered through comparing the legal user information to determine whether ui can join the system. The user addition operation addUserui is described as follows (see Algorithm 1).Algorithm 1:AddUserui.
(1)
if:unew∉Ud∨Up(2)
unew⟶ui(3)
U′=U∪ui(4)
else:(5)
User already existsWhenui proposes to log off, the system administrator executes the user deletion program deleteUserui as follows (see Algorithm 2).Algorithm 2:DeleteUserui.
(1)
if:ui∈Ud∨Up(2)
U′=U/ui(3)
else:(4)
User does not existAfterui has joined the system, the administrator should assign corresponding attributes. The user attribute assignment program assignAttributesui,ai is expressed as follows (see Algorithm 3).Algorithm 3:AssignAttributesui,ai.
(1)
if:ui∈Ud(2)
allowAssignAdtoui(3)
else if:ui∈Up(4)
allowAssignAptoui(5)
else:(6)
Unable to assign


### 4.3.3. Key Distribution

The system performs the key distribution algorithmKeyGenMk,Ak, CA calculates the user’s private key Sk based on the registrant attribute set a∈Ak and sends it to the data visitor through a secure channel for storage. The process is as follows:(5)KeyGenMk,S⟶Sk⟶User.


### 4.3.4. Data Encryption

The data owner (patient or doctor) provides the corresponding access control strategyw according to the visitor’s attributes, randomly generates a symmetric encryption key K to encrypt data C1=Enc1Data,K, and encrypts the key K through CP-ABE C2=Enc2Pk,K,w.


### 4.3.5. Data Upload on Blockchain

The data owner stores the ciphertext groupC1,C2 off-chain in IPFS. The returned path L is encrypted through CP-ABE to obtain the path ciphertext CL=Enc2Pk,L,w, and relevant data such as CL and time T are uploaded onto the blockchain.


### 4.3.6. Ciphertext Access

A legal visitor who meets the access control policyw can use the attribute key Sk to decrypt CL obtained on the blockchain according to the decrypted access path L=Dec2Pk,CL,Sk to retrieve and extract C1,C2 stored in IPFS. Through decrypting the extracted data C2 to acquire the symmetric key K=Dec2C2,Sk,Pk, the user can decrypt the shared data with the obtained key KData=Dec1C1,K.The access control strategywri,p in the scheme is specifically described as follows.The user’s information access authority on the three blockchains PIB, MSIB, and MRIB includes addi, delete d, change u, and check s. The system determines the access authority by judging the user attributes Ad,Ap, where the doctor-level attribute G is assigned to the hospital president G=5, director G=4, head nurse G=3, doctor G=2 and nurse G=1. The system must assure all entities/stakeholders (patient, doctor, hospital president, department director, head nurse, nurse, etc.) granular access to medical data at a role level.Strategy 1 Patient information blockchain (PIB). First, the system verifies the user’s attribute ID. If the user is a doctor uID⟶D, the authority will be assigned based on the doctor’s attribute level G. Among them, the president G=5 can view all patient information in emergency situations. The director, head nurse and nurses 3≤G<5∨G=1 can only view the patient information in this department Bi. The doctor G=2 can only view the received patient information. If the user is a patient uID⟶P, since the basic information of the patient is stored on PIB, only the patient user is assigned the authority to add, delete, modify, and check i,d,u,s the personal data (see Algorithm 4).Algorithm 4: Patient information strategy.
(1)
if:uID⟶D(2)
if:G=5(3)
allowAssignsofPIBalltoud(4)
if:3≤G<5∨G=1(5)
allowAssignsofPIBBitoud(6)
if:G=2(7)
allowAssignsofPIBupofudtoud(8)
else if:uID⟶P(9)
allowAssigni,d,u,sof PIB toup(10)
else:(11)
No permissionStrategy 2 Medical staff information blockchain (MSIB). First, the system verifies the user’s attribute ID. If the user is a doctor uID⟶D, the authority will be assigned based on the doctor’s attribute level G. Among them, the president G=5 can view the information of all medical staff in this hospital. The director and head nurse 3≤G<5 can only view the medical staff information in this department. The doctor and nurse 1≤G<3 can add, delete, modify, and check i,d,u,s the own information. A patient uID⟶P can query the information of relevant doctors and add evaluation (see Algorithm 5).Algorithm 5: Medical staff information strategy.
(1)
if:uID⟶D(2)
if:G=5(3)
allowAssignsofMSIBalltoud(4)
if:3≤G<5(5)
allowAssignsofMRIBBitoud(6)
if:1≤G<3(7)
allowAssigni,d,u,sof MSIB toud(8)
else if:uID⟶P(9)
allowAssigns,iofMSIBudofuptoud(10)
else:(11)
No permissionStrategy 3 Medical record information blockchain (MRIB). First, the system verifies the user’s attribute ID. If the user is a doctor uID⟶D, the authority will be assigned based on the doctor’s attribute level G. In MRIB, the president G=5 can view the medical records of all patients under emergency. The director, head nurse, and nurses 3≤G<5∨G=1 can only view the medical records of patients in this department Bi. The doctor G=2 can view and update the medical records of the received patients. A patient uID⟶P can only view the personal medical records (see Algorithm 6).Algorithm 6: Medical record information strategy.
(1)
if:uID⟶D(2)
if:pd=5(3)
allowAssignsofMRIBalltoud(4)
if:3≤G<5∨G=1(5)
allowAssignsofMRIBupofBitoud(6)
if:G=2(7)
allowAssigns,iofMRIBupofudtoud(8)
else if:uID⟶P(9)
allowAssignsof MRIB toud(10)
else:(11)
No permission


## 4.3.1. Initialization

The security parameterλ is taken as input, the public parameter Pk and the master key Mk are generated by the Certificate Authority (CA) for secure storage.


## 4.3.2. Identity Registration

A new userunew should register unique accounts at first, and the system administrator should verify the identity and qualification Verunew. When unew is successfully verified, the system automatically adds the user addUserui, so that unew becomes a legal user ui and obtains the corresponding attributes. When the user logs off, the administrator executes the user delete operation deleteUserui and deletes the user information and attributes. The system parameters are shown in Tables 2 and 3.Table 2
User attribute.
UserAttributeDoctorStaff ID, department B, level PPatientPatient ID, consultation department BTable 3
Parameter set.
SetMeaningUdDoctor user setUd=u1,u2…unUpPatient user setUp=u1,u2…unBDepartment setB=B1,B2…BnGDoctor level setG=1,2,3,4,5AdDoctor attribute setAd=DID,DB,DGApPatient attribute setAp=PID,PBThe system administrator judges whetherunew has been registered through comparing the legal user information to determine whether ui can join the system. The user addition operation addUserui is described as follows (see Algorithm 1).Algorithm 1:AddUserui.
(1)
if:unew∉Ud∨Up(2)
unew⟶ui(3)
U′=U∪ui(4)
else:(5)
User already existsWhenui proposes to log off, the system administrator executes the user deletion program deleteUserui as follows (see Algorithm 2).Algorithm 2:DeleteUserui.
(1)
if:ui∈Ud∨Up(2)
U′=U/ui(3)
else:(4)
User does not existAfterui has joined the system, the administrator should assign corresponding attributes. The user attribute assignment program assignAttributesui,ai is expressed as follows (see Algorithm 3).Algorithm 3:AssignAttributesui,ai.
(1)
if:ui∈Ud(2)
allowAssignAdtoui(3)
else if:ui∈Up(4)
allowAssignAptoui(5)
else:(6)
Unable to assign


## 4.3.3. Key Distribution

The system performs the key distribution algorithmKeyGenMk,Ak, CA calculates the user’s private key Sk based on the registrant attribute set a∈Ak and sends it to the data visitor through a secure channel for storage. The process is as follows:(5)KeyGenMk,S⟶Sk⟶User.


## 4.3.4. Data Encryption

The data owner (patient or doctor) provides the corresponding access control strategyw according to the visitor’s attributes, randomly generates a symmetric encryption key K to encrypt data C1=Enc1Data,K, and encrypts the key K through CP-ABE C2=Enc2Pk,K,w.


## 4.3.5. Data Upload on Blockchain

The data owner stores the ciphertext groupC1,C2 off-chain in IPFS. The returned path L is encrypted through CP-ABE to obtain the path ciphertext CL=Enc2Pk,L,w, and relevant data such as CL and time T are uploaded onto the blockchain.


## 4.3.6. Ciphertext Access

A legal visitor who meets the access control policyw can use the attribute key Sk to decrypt CL obtained on the blockchain according to the decrypted access path L=Dec2Pk,CL,Sk to retrieve and extract C1,C2 stored in IPFS. Through decrypting the extracted data C2 to acquire the symmetric key K=Dec2C2,Sk,Pk, the user can decrypt the shared data with the obtained key KData=Dec1C1,K.The access control strategywri,p in the scheme is specifically described as follows.The user’s information access authority on the three blockchains PIB, MSIB, and MRIB includes addi, delete d, change u, and check s. The system determines the access authority by judging the user attributes Ad,Ap, where the doctor-level attribute G is assigned to the hospital president G=5, director G=4, head nurse G=3, doctor G=2 and nurse G=1. The system must assure all entities/stakeholders (patient, doctor, hospital president, department director, head nurse, nurse, etc.) granular access to medical data at a role level.Strategy 1 Patient information blockchain (PIB). First, the system verifies the user’s attribute ID. If the user is a doctor uID⟶D, the authority will be assigned based on the doctor’s attribute level G. Among them, the president G=5 can view all patient information in emergency situations. The director, head nurse and nurses 3≤G<5∨G=1 can only view the patient information in this department Bi. The doctor G=2 can only view the received patient information. If the user is a patient uID⟶P, since the basic information of the patient is stored on PIB, only the patient user is assigned the authority to add, delete, modify, and check i,d,u,s the personal data (see Algorithm 4).Algorithm 4: Patient information strategy.
(1)
if:uID⟶D(2)
if:G=5(3)
allowAssignsofPIBalltoud(4)
if:3≤G<5∨G=1(5)
allowAssignsofPIBBitoud(6)
if:G=2(7)
allowAssignsofPIBupofudtoud(8)
else if:uID⟶P(9)
allowAssigni,d,u,sof PIB toup(10)
else:(11)
No permissionStrategy 2 Medical staff information blockchain (MSIB). First, the system verifies the user’s attribute ID. If the user is a doctor uID⟶D, the authority will be assigned based on the doctor’s attribute level G. Among them, the president G=5 can view the information of all medical staff in this hospital. The director and head nurse 3≤G<5 can only view the medical staff information in this department. The doctor and nurse 1≤G<3 can add, delete, modify, and check i,d,u,s the own information. A patient uID⟶P can query the information of relevant doctors and add evaluation (see Algorithm 5).Algorithm 5: Medical staff information strategy.
(1)
if:uID⟶D(2)
if:G=5(3)
allowAssignsofMSIBalltoud(4)
if:3≤G<5(5)
allowAssignsofMRIBBitoud(6)
if:1≤G<3(7)
allowAssigni,d,u,sof MSIB toud(8)
else if:uID⟶P(9)
allowAssigns,iofMSIBudofuptoud(10)
else:(11)
No permissionStrategy 3 Medical record information blockchain (MRIB). First, the system verifies the user’s attribute ID. If the user is a doctor uID⟶D, the authority will be assigned based on the doctor’s attribute level G. In MRIB, the president G=5 can view the medical records of all patients under emergency. The director, head nurse, and nurses 3≤G<5∨G=1 can only view the medical records of patients in this department Bi. The doctor G=2 can view and update the medical records of the received patients. A patient uID⟶P can only view the personal medical records (see Algorithm 6).Algorithm 6: Medical record information strategy.
(1)
if:uID⟶D(2)
if:pd=5(3)
allowAssignsofMRIBalltoud(4)
if:3≤G<5∨G=1(5)
allowAssignsofMRIBupofBitoud(6)
if:G=2(7)
allowAssigns,iofMRIBupofudtoud(8)
else if:uID⟶P(9)
allowAssignsof MRIB toud(10)
else:(11)
No permission


## 4.4. Information Sharing Process P/MSISP

The information sharing process in B-SSMD includes two parts. One is the Patient information sharing process (PISP). The scheme realizes the information sharing of medical records among patients and medical staff. In PISP, PIB, and MRIB are the subjects of data storage and update, medical staff are the data visitors. Another is the Medical staff information sharing process (MSISP), which realizes the information sharing between patients and medical staff. In MSISP, MSIB is used for data storage and update, and patients are the data visitors.The blockchain data access process consists of three steps, uploading user hash data on-chain, reading the node data on-chain, and updating the data on-chain. The scheme model is shown in Figure4, and the specific process is as follows.Figure 4
Information sharing process.


### 4.4.1. Patient Information Sharing Process (PISP)

Patient information upload. The patient uploads the encrypted data and the encrypted key C1‖C2 to IPFS and obtains the access path L of the ciphertext. The user sends the information IDataID,PID,CL,w,T including the data DataID, the data owner (patient) PID, the access control strategy w, the path ciphertext CL, and the release time T on PIB. In order to identify the data source, the patient’s digital signature must be uploaded.(6)C1‖C2⟶IPFS,IDataID,PID,CL,w,T‖σpI⟶PIB.Medical staff access data on PIB/MRIB. The data visitor (doctor) D obtains the data path as ciphertext CL from PIB and MRIB, decrypts it to obtain the path L=Dec2Pk,CL,Sk and finds the encrypted data C1‖C2 in IPFS. Then, decrypt and read the key K=Dec2Pk,C2,Sk and acquire the data Datap=Dec1C1,K. For the patient’s first consultation, D should not access the information of the patient P on MRIB. For patients who have been transferred or visited multiple times, D can view the previous medical records M by accessing the information on MRIB, and the patient do not need to be checked again. The information access process can be expressed as follows:(7)PIBMRIB⟶L=Dec2Pk,CL,Sk⟶IPFS⟶C1‖C2⟶K=Dec2Pk,C2,Sk,Datap=Dec1C1,K.Medical staff update data on MRIB. After the data visitor (doctor) D reads the patient information, a new medical record M’ will be generated. At this time, D uploads the data and the encryption key C1‖C2 to IPFS. Then encrypt the obtained path to ciphertext CL, and the information IDatanewID,DoctorID,CL,w,T, including data DatanewID, the visitor DoctorID, the visit time T and access control strategy w, together with the doctor’s digital signature σdI, will be uploaded on the blockchain. The information update process is shown as follows:(8)C1‖C2⟶IPFS,IDatanewID,DoctorID,CL,w,T‖σdI⟶MRIB.


### 4.4.2. Medical Staff Information Sharing Process (MSISP)

The information of medical staff is mainly used as the data sharing content and the information is obtained by users such as patients in this scheme.Medical staff upload information. The doctor uploads the encrypted data and encrypted key C1‖C2 to IPFS then stores the obtained information IDataID,DoctorID,CL,w,T including the encrypted path CL, data DataID, the data owner (doctor) DoctorID and time T on MSIB. In order to identify the data source, the doctor’s digital signature must be uploaded simultaneously.(9)C1‖C2⟶IPFS,IDataID,DoctorID,CL,w,T‖σdI⟶MSIB.Patient access data on MSIB. When the patient views relevant information of the doctor, the encrypted path CL in IPFS from MSIB should be obtained, and decrypt it L=Dec2Pk,CL,Sk. Then, retrieve the data C1‖C2 in IPFS and view the medical staff information after decryption.(10)MSIB⟶L=Dec2Pk,CL,Sk⟶IPFS⟶C1‖C2⟶K=Dec2Pk,C2,Sk,Datad=Dec1C1,K.Patient update data on MSIB. The patient can evaluate the medical staff, and the evaluation information, namely, the updated data Datadnew, should be uploaded on the blockchain. The patient stores the encrypted data and encrypted key C1‖C2 in IPFS. The obtained encrypted path CL and the information IDatanewID,PID,T,w,CL including data DatanewID, the data visitor PID, the visit time T and access control strategy w will be uploaded on the blockchain. In order to identify the source of the new data, the patient’s signature must be submitted.(11)C1‖C2⟶IPFS,IDatanewID,PID,T,w,CL‖σpI⟶MSIB.


## 4.4.1. Patient Information Sharing Process (PISP)

Patient information upload. The patient uploads the encrypted data and the encrypted key C1‖C2 to IPFS and obtains the access path L of the ciphertext. The user sends the information IDataID,PID,CL,w,T including the data DataID, the data owner (patient) PID, the access control strategy w, the path ciphertext CL, and the release time T on PIB. In order to identify the data source, the patient’s digital signature must be uploaded.(6)C1‖C2⟶IPFS,IDataID,PID,CL,w,T‖σpI⟶PIB.Medical staff access data on PIB/MRIB. The data visitor (doctor) D obtains the data path as ciphertext CL from PIB and MRIB, decrypts it to obtain the path L=Dec2Pk,CL,Sk and finds the encrypted data C1‖C2 in IPFS. Then, decrypt and read the key K=Dec2Pk,C2,Sk and acquire the data Datap=Dec1C1,K. For the patient’s first consultation, D should not access the information of the patient P on MRIB. For patients who have been transferred or visited multiple times, D can view the previous medical records M by accessing the information on MRIB, and the patient do not need to be checked again. The information access process can be expressed as follows:(7)PIBMRIB⟶L=Dec2Pk,CL,Sk⟶IPFS⟶C1‖C2⟶K=Dec2Pk,C2,Sk,Datap=Dec1C1,K.Medical staff update data on MRIB. After the data visitor (doctor) D reads the patient information, a new medical record M’ will be generated. At this time, D uploads the data and the encryption key C1‖C2 to IPFS. Then encrypt the obtained path to ciphertext CL, and the information IDatanewID,DoctorID,CL,w,T, including data DatanewID, the visitor DoctorID, the visit time T and access control strategy w, together with the doctor’s digital signature σdI, will be uploaded on the blockchain. The information update process is shown as follows:(8)C1‖C2⟶IPFS,IDatanewID,DoctorID,CL,w,T‖σdI⟶MRIB.


## 4.4.2. Medical Staff Information Sharing Process (MSISP)

The information of medical staff is mainly used as the data sharing content and the information is obtained by users such as patients in this scheme.Medical staff upload information. The doctor uploads the encrypted data and encrypted key C1‖C2 to IPFS then stores the obtained information IDataID,DoctorID,CL,w,T including the encrypted path CL, data DataID, the data owner (doctor) DoctorID and time T on MSIB. In order to identify the data source, the doctor’s digital signature must be uploaded simultaneously.(9)C1‖C2⟶IPFS,IDataID,DoctorID,CL,w,T‖σdI⟶MSIB.Patient access data on MSIB. When the patient views relevant information of the doctor, the encrypted path CL in IPFS from MSIB should be obtained, and decrypt it L=Dec2Pk,CL,Sk. Then, retrieve the data C1‖C2 in IPFS and view the medical staff information after decryption.(10)MSIB⟶L=Dec2Pk,CL,Sk⟶IPFS⟶C1‖C2⟶K=Dec2Pk,C2,Sk,Datad=Dec1C1,K.Patient update data on MSIB. The patient can evaluate the medical staff, and the evaluation information, namely, the updated data Datadnew, should be uploaded on the blockchain. The patient stores the encrypted data and encrypted key C1‖C2 in IPFS. The obtained encrypted path CL and the information IDatanewID,PID,T,w,CL including data DatanewID, the data visitor PID, the visit time T and access control strategy w will be uploaded on the blockchain. In order to identify the source of the new data, the patient’s signature must be submitted.(11)C1‖C2⟶IPFS,IDatanewID,PID,T,w,CL‖σpI⟶MSIB.


## 5. Security Analysis

The security of data storage and sharing is an important feature of B-SSMD. In this scheme, the access control strategy is strict and the encrypted data is hierarchically stored in the three blockchains. The processes from data storage to data sharing are all secure.


### 5.1. Data Privacy Preservation

In the user authority distribution strategy in section 4.3, the userU should satisfy the corresponding attribute relationship for data access. Assuming that the attacker ϑ is a gynecologist with the attributes Ad=DID,DB,DG, where DID=ϑID,DB=Bgynecology,DG=2. If ϑ intends to acquire the patient data of orthopedics, as the attribute Ad of ϑ does not satisfy the orthopedic doctor attribute, DB≠Borthopedics, the obtained path ciphertext CL from the blockchain, decrypted through the key Sk of ϑ, is invalid, that is, L≠Dec2Pk,CL,Sk. Therefore, the privacy property is ensured in B-SSMD, and the medical staff in the system cannot steal any data beyond the limit of authority.


### 5.2. Resistance to Single-Point-of-Failure Attacks

B-SSMD is built through three consortium blockchains PIB/MSIB/MRIB. Users on each blockchain do not need to trust each other before and thus any node cannot control the whole blockchain system. Since the patient dataDatap, the medical staff data Datad and medical record M are stored decentralized within the scheme rules, data between nodes are mutually independent, the attacker ϑ attacking one or some nodes will not cause the entire system paralyzed. Besides, the system uploads encrypted data to IPFS and blockchains, and the use of decentralized storage can resist single-point-of-failure attacks.


### 5.3. Resistance to Impersonation Attacks

The userU uses private key Sk to encrypt data C1=Enc1Data,K, C2=Enc2Pk,K,w, and store Data=C1‖C2 in IPFS. Assuming that the attacker ϑ steals the data at this time, since ϑ cannot decrypt C1 and C2, the user’s identity information will not be changed. The user U encrypts the IPFS address index CL=Enc2Pk,L,w, and uploads Data=IDataID,PID,CL,w,T on the blockchain. Assuming that the attacker ϑ is stealing data at this time, since ϑ cannot decrypt CL, the address index in IPFS cannot be queried, and user information cannot be obtained. ϑ does not have the ability to change user identity information. Thus, ϑ fails to perform an impersonation attack.


### 5.4. Resistance to Replay Attacks

The B-SSMD system uses the blockchain technology as the overall architecture, and the userU uploads the data of PIB/MSIB/MRIB including the access time T of U.If the attackerϑ obtains the information returned by the blockchain node and plans to launch a replay attack, the time T needs to be modified, whereas the data signature σi needs to be modified at the same time. Since the attacker ϑ cannot obtain a valid signature generated by a legal user, the system prevents replay attacks.If the system has successfully verified the user’s identityVerunew, assuming that the attacker ϑ steals the user identity information UID,UA returned by the system, obtains the data requested by the user request=Data1‖T′ at the same time, and pretends to be the user to send data Data1‖T′ to the system, when the system obtains two timestamps T,T′, it is judged that the time difference T−T′>ΔT indicating a replay attack exists in the system. Therefore, the proposed scheme can resist replay attacks.


### 5.5. Resistance to Malicious Tampering Attacks

A legal blockchain contains a large number of nodes. When data is uploaded to the blockchain, each node will back up the data. Meanwhile, due to the distributed storage performance of the blockchain ledger, a single node cannot modify data on the chain.Suppose a node in the blockchain system is an attackerϑ, when ϑ attacks, it needs to improve its own computing power so that the computing power can obtain more than 50% of the control right before the attack can succeed. Since the B-SSMD system proposed in this paper exploits the three-chain model, when a patient completes a visit, the system requires the patient and the medical personnel to update the three PIB/MSIB/MRIB blockchains respectively. It can be seen that the data update speed in the legal chain is very fast, so the attacker cannot get control. At the same time, as the hospital is an institution with strong credibility in the society, there is little possibility of a large-scale active attack on the blockchain system. Therefore, the system can resist malicious tampering attacks.


### 5.6. User Group Members Update

In Section4.3, the system administrator can add and delete users addUserui and deleteUserui. In the process of a new user applying to join the system, the administrator compares the system internal user set Ui=u1,u2…un, each legal user has a unique UiID, and the system administrator only needs to determine whether the new user UnewID corresponds to the internal legal user UiID. If UnewID≠UiID, the user identity meets the requirements for joining the system, otherwise the verification fails and the user cannot join the legal user group. When the user is deleted, if UnewID=UiID, the user identity meets the logout requirements, otherwise the verification fails and the user cannot be deleted.


## 5.1. Data Privacy Preservation

In the user authority distribution strategy in section 4.3, the userU should satisfy the corresponding attribute relationship for data access. Assuming that the attacker ϑ is a gynecologist with the attributes Ad=DID,DB,DG, where DID=ϑID,DB=Bgynecology,DG=2. If ϑ intends to acquire the patient data of orthopedics, as the attribute Ad of ϑ does not satisfy the orthopedic doctor attribute, DB≠Borthopedics, the obtained path ciphertext CL from the blockchain, decrypted through the key Sk of ϑ, is invalid, that is, L≠Dec2Pk,CL,Sk. Therefore, the privacy property is ensured in B-SSMD, and the medical staff in the system cannot steal any data beyond the limit of authority.


## 5.2. Resistance to Single-Point-of-Failure Attacks

B-SSMD is built through three consortium blockchains PIB/MSIB/MRIB. Users on each blockchain do not need to trust each other before and thus any node cannot control the whole blockchain system. Since the patient dataDatap, the medical staff data Datad and medical record M are stored decentralized within the scheme rules, data between nodes are mutually independent, the attacker ϑ attacking one or some nodes will not cause the entire system paralyzed. Besides, the system uploads encrypted data to IPFS and blockchains, and the use of decentralized storage can resist single-point-of-failure attacks.


## 5.3. Resistance to Impersonation Attacks

The userU uses private key Sk to encrypt data C1=Enc1Data,K, C2=Enc2Pk,K,w, and store Data=C1‖C2 in IPFS. Assuming that the attacker ϑ steals the data at this time, since ϑ cannot decrypt C1 and C2, the user’s identity information will not be changed. The user U encrypts the IPFS address index CL=Enc2Pk,L,w, and uploads Data=IDataID,PID,CL,w,T on the blockchain. Assuming that the attacker ϑ is stealing data at this time, since ϑ cannot decrypt CL, the address index in IPFS cannot be queried, and user information cannot be obtained. ϑ does not have the ability to change user identity information. Thus, ϑ fails to perform an impersonation attack.


## 5.4. Resistance to Replay Attacks

The B-SSMD system uses the blockchain technology as the overall architecture, and the userU uploads the data of PIB/MSIB/MRIB including the access time T of U.If the attackerϑ obtains the information returned by the blockchain node and plans to launch a replay attack, the time T needs to be modified, whereas the data signature σi needs to be modified at the same time. Since the attacker ϑ cannot obtain a valid signature generated by a legal user, the system prevents replay attacks.If the system has successfully verified the user’s identityVerunew, assuming that the attacker ϑ steals the user identity information UID,UA returned by the system, obtains the data requested by the user request=Data1‖T′ at the same time, and pretends to be the user to send data Data1‖T′ to the system, when the system obtains two timestamps T,T′, it is judged that the time difference T−T′>ΔT indicating a replay attack exists in the system. Therefore, the proposed scheme can resist replay attacks.


## 5.5. Resistance to Malicious Tampering Attacks

A legal blockchain contains a large number of nodes. When data is uploaded to the blockchain, each node will back up the data. Meanwhile, due to the distributed storage performance of the blockchain ledger, a single node cannot modify data on the chain.Suppose a node in the blockchain system is an attackerϑ, when ϑ attacks, it needs to improve its own computing power so that the computing power can obtain more than 50% of the control right before the attack can succeed. Since the B-SSMD system proposed in this paper exploits the three-chain model, when a patient completes a visit, the system requires the patient and the medical personnel to update the three PIB/MSIB/MRIB blockchains respectively. It can be seen that the data update speed in the legal chain is very fast, so the attacker cannot get control. At the same time, as the hospital is an institution with strong credibility in the society, there is little possibility of a large-scale active attack on the blockchain system. Therefore, the system can resist malicious tampering attacks.


## 5.6. User Group Members Update

In Section4.3, the system administrator can add and delete users addUserui and deleteUserui. In the process of a new user applying to join the system, the administrator compares the system internal user set Ui=u1,u2…un, each legal user has a unique UiID, and the system administrator only needs to determine whether the new user UnewID corresponds to the internal legal user UiID. If UnewID≠UiID, the user identity meets the requirements for joining the system, otherwise the verification fails and the user cannot join the legal user group. When the user is deleted, if UnewID=UiID, the user identity meets the logout requirements, otherwise the verification fails and the user cannot be deleted.


## 6. Performance Analysis

In this section, we give a performance evaluation of the system, with an emphasis on the probability of effective attacks and performance comparison. For running our experiments, we used a 2.3 GHz Quad-Core Intel Core i5 CPU, 8 Gb LPDDR3 RAM, and 512 Gb SSD hard disk drive.


### 6.1. System Ability to Attack Resistance

Suppose that the probability of an attackerϑ generating a node is pAC, and the probability of a legal blockchain generating a node is pBC, when the honest node BC generates z blocks, the probability of an effective attack is a Poisson distribution and the expectation is λ=z×pAC/pBc. The probability that ϑ generates k blocks is λk/k!e−λ. At this time, the number of blocks generated by ϑ behind the honest node is z−k and the probability that the length of AC exceeds that of BC is pAC/pBcz−k. Thus, the probability of an effective attack is(12)p=∑k=0∞λkk!e−λ×pACpBcz−k,k≤z,1,k>z,namely,(13)p=∑k=0zλke−λk!pACpBcz−k+∑k=z+1∞λke−λk!=1−∑k=0zλke−λk!1−pACpBcz−k.In this paper, we compare the proposed scheme with the related EMRs sharing schemes in Liu et al. [21] and Cao et al. [32] in terms of the ability to attack resistance. The scheme [21] adopts blockchain with single chain mode. Although it meets the characteristics of tamperability and anonymity, the probability of effective attacks is still high. An attacker ϑ only needs to damage one chain to attack the system effectively. The probability of an effective attack in the scheme [21] can be described as follows:(14)Pscheme15=p.The scheme [32] adopts a consortium blockchain to share sensitive data related to patient privacy while sharing the nonsensitive parts on the public blockchain. This scheme exploits a hybrid double-chain structure and is superior to the scheme [21] to some extent. The probability of an effective attack in the scheme [32] can be described as follows:(15)Pscheme16=p2.The B-SSMD system proposed in this paper applies the PIB/MSIB/MRIB three-chain model. The patient information, medical personnel information, and medical records are updated at the same time during the medical treatment process, and the node generation speed of the three chains is almost the same. Thus, the probability of an effective attack in our scheme decreases exponentially and the security performance is better than the scheme [21, 32]. The probability of an effective attack in this scheme can be described as follows:(16)PB−SSMD=p3.In the experiment, by setting the probabilitypAC as 0.1, 0.2, and 0.3, respectively, the probability PB−SSMD is tested to verify the higher security of our scheme. Meanwhile, by setting pAC=0.3, it is verified that the ability to attack resistance in our scheme is superior to that in the scheme [21, 32].As shown in Figure5, when pAC=0.1, the probability of the attacker’s effective attack is almost 0. As the probability pAC increases, when pAC reaches 0.3 and the number of nodes generated by the legal blockchain z>6, the probability of an effective attack is almost 0. In the actual medical system, the number of nodes generated by the blockchain far exceeds 6. Thus, it is almost impossible for ϑ to attack this system effectively.Figure 5
Probability of effective node attacks.In Figure6, when pAC=0.3 and the number of blocks generated by the legal chain is 1, the probability of effective attacks of our proposed scheme B-SSMD is about 0.2, while this probability of scheme [21] is about 0.7 and the probability in the scheme [32] also reaches about 0.4. With the increase of the number of blocks, the probability of effective attacks will be relatively reduced. In our scheme, when the number of blocks reaches about 5, the probability of an effective attack has approached 0, However, when the number of blocks generated in the scheme [21] reaches 10, there is still the possibility of being effectively attacked. And, in the scheme [32], when the number of blocks generated reaches 8, the probability of a successful attack approaches 0.Figure 6
Comparison of effective attack probability.It can be seen that the performance of attack resistance in the B-SSMD system has been greatly improved. Especially under the condition of huge data access amount in the current medical system, the update speed of blocks in the legal blockchain is relatively fast, so the probability of effective attacks in the practical application of this scheme is very low.


### 6.2. Block Efficiency and Throughput

Throughput is a measure of the system’s ability to deal with transactions per unit time, which is directly related to the system’s block efficiency and consensus mechanism [33]. In this paper, TPS (Transactions per second) is used to represent throughput, as shown in the following equation:(17)TPS=SumTransactionTime,where SumTransaction is the number of EMR information contained in a single block, and Time is the block generation time of a single block.In order to verify the throughput efficiency of our scheme, we build a blockchain network for the model simulation test. During the operation of the system model, the number of blocks for each consensus group is N, and all nodes are honest nodes. Our results in Table4 show that, as the number of nodes increases, the throughput decreases gradually. For example, when the number of nodes increases from 4 to 14, the throughput decreases from 996 TPS to 761 TPS. Also, the proposed model is about 142 times higher than the bitcoin network which uses the POS consensus mechanism, and about 13 times higher than the Ethernet network that using the POW consensus mechanism.Table 4
The throughput of B-SSMD.
Number of nodesTPS499669648927108851281214761Besides, we conduct a test on B-SSMD using FISCO BCOS as the blockchain platform of the system and use a docker container to simulate 4 nodes with Caliper tools to send requests using a smart contract to view data. The amount of data requests confirmed in the blockchain transaction pool within a fixed time is shown in Table5. It can be seen that the transaction amount can be stabilized above 96 transactions/s, indicating that the system can achieve its high-quality transaction processing capacity.Table 5
Number of data request confirmation.
Test duration/sData request confirmation amount100971720019230300290064003879450048493


### 6.3. Performance Comparison

As shown in Table6, by comparing with the blockchain-based medical data sharing schemes proposed in [21, 32, 34], it shows that the B-SSMD scheme adopts a three-chain distributed structure to reduce the burden on the mainchain, and the three-layer encryption and fine-grained access control improve the security of data sharing.Table 6
Scheme comparison.
SchemeMainchain pressureBlockchain structureSecurityDivision granularityEncryption modeLiu et al. [21]++Single+−Public keyCao et al. [32]+Hybrid double−−HashMalamas et al. [34]−Hierarchical++CP-ABEProposed scheme−Hybrid three++++Three-layerIn Table7 describes the security flaws of our scheme and other schemes, and it shows that most previously developed schemes do not have important security attributes. The proposed scheme not only resists possible attacks but also explains in detail overall operation and process. Therefore, compared with the schemes proposed in [21, 22, 32, 34], the B-SSMD in this paper has considerable advantages.Table 7
Security comparison.
SchemeLiu et al. [21]Cao et al. [32]Malamas et al. [34]Lee et al. [22]Proposed schemeResistance to single-point failure×××√√Resistance to impersonation××√√√Resistance to replay attacks×××√√Resistance to malicious tampering√√√√√User group members update××××√


## 6.1. System Ability to Attack Resistance

Suppose that the probability of an attackerϑ generating a node is pAC, and the probability of a legal blockchain generating a node is pBC, when the honest node BC generates z blocks, the probability of an effective attack is a Poisson distribution and the expectation is λ=z×pAC/pBc. The probability that ϑ generates k blocks is λk/k!e−λ. At this time, the number of blocks generated by ϑ behind the honest node is z−k and the probability that the length of AC exceeds that of BC is pAC/pBcz−k. Thus, the probability of an effective attack is(12)p=∑k=0∞λkk!e−λ×pACpBcz−k,k≤z,1,k>z,namely,(13)p=∑k=0zλke−λk!pACpBcz−k+∑k=z+1∞λke−λk!=1−∑k=0zλke−λk!1−pACpBcz−k.In this paper, we compare the proposed scheme with the related EMRs sharing schemes in Liu et al. [21] and Cao et al. [32] in terms of the ability to attack resistance. The scheme [21] adopts blockchain with single chain mode. Although it meets the characteristics of tamperability and anonymity, the probability of effective attacks is still high. An attacker ϑ only needs to damage one chain to attack the system effectively. The probability of an effective attack in the scheme [21] can be described as follows:(14)Pscheme15=p.The scheme [32] adopts a consortium blockchain to share sensitive data related to patient privacy while sharing the nonsensitive parts on the public blockchain. This scheme exploits a hybrid double-chain structure and is superior to the scheme [21] to some extent. The probability of an effective attack in the scheme [32] can be described as follows:(15)Pscheme16=p2.The B-SSMD system proposed in this paper applies the PIB/MSIB/MRIB three-chain model. The patient information, medical personnel information, and medical records are updated at the same time during the medical treatment process, and the node generation speed of the three chains is almost the same. Thus, the probability of an effective attack in our scheme decreases exponentially and the security performance is better than the scheme [21, 32]. The probability of an effective attack in this scheme can be described as follows:(16)PB−SSMD=p3.In the experiment, by setting the probabilitypAC as 0.1, 0.2, and 0.3, respectively, the probability PB−SSMD is tested to verify the higher security of our scheme. Meanwhile, by setting pAC=0.3, it is verified that the ability to attack resistance in our scheme is superior to that in the scheme [21, 32].As shown in Figure5, when pAC=0.1, the probability of the attacker’s effective attack is almost 0. As the probability pAC increases, when pAC reaches 0.3 and the number of nodes generated by the legal blockchain z>6, the probability of an effective attack is almost 0. In the actual medical system, the number of nodes generated by the blockchain far exceeds 6. Thus, it is almost impossible for ϑ to attack this system effectively.Figure 5
Probability of effective node attacks.In Figure6, when pAC=0.3 and the number of blocks generated by the legal chain is 1, the probability of effective attacks of our proposed scheme B-SSMD is about 0.2, while this probability of scheme [21] is about 0.7 and the probability in the scheme [32] also reaches about 0.4. With the increase of the number of blocks, the probability of effective attacks will be relatively reduced. In our scheme, when the number of blocks reaches about 5, the probability of an effective attack has approached 0, However, when the number of blocks generated in the scheme [21] reaches 10, there is still the possibility of being effectively attacked. And, in the scheme [32], when the number of blocks generated reaches 8, the probability of a successful attack approaches 0.Figure 6
Comparison of effective attack probability.It can be seen that the performance of attack resistance in the B-SSMD system has been greatly improved. Especially under the condition of huge data access amount in the current medical system, the update speed of blocks in the legal blockchain is relatively fast, so the probability of effective attacks in the practical application of this scheme is very low.


## 6.2. Block Efficiency and Throughput

Throughput is a measure of the system’s ability to deal with transactions per unit time, which is directly related to the system’s block efficiency and consensus mechanism [33]. In this paper, TPS (Transactions per second) is used to represent throughput, as shown in the following equation:(17)TPS=SumTransactionTime,where SumTransaction is the number of EMR information contained in a single block, and Time is the block generation time of a single block.In order to verify the throughput efficiency of our scheme, we build a blockchain network for the model simulation test. During the operation of the system model, the number of blocks for each consensus group is N, and all nodes are honest nodes. Our results in Table4 show that, as the number of nodes increases, the throughput decreases gradually. For example, when the number of nodes increases from 4 to 14, the throughput decreases from 996 TPS to 761 TPS. Also, the proposed model is about 142 times higher than the bitcoin network which uses the POS consensus mechanism, and about 13 times higher than the Ethernet network that using the POW consensus mechanism.Table 4
The throughput of B-SSMD.
Number of nodesTPS499669648927108851281214761Besides, we conduct a test on B-SSMD using FISCO BCOS as the blockchain platform of the system and use a docker container to simulate 4 nodes with Caliper tools to send requests using a smart contract to view data. The amount of data requests confirmed in the blockchain transaction pool within a fixed time is shown in Table5. It can be seen that the transaction amount can be stabilized above 96 transactions/s, indicating that the system can achieve its high-quality transaction processing capacity.Table 5
Number of data request confirmation.
Test duration/sData request confirmation amount100971720019230300290064003879450048493


## 6.3. Performance Comparison

As shown in Table6, by comparing with the blockchain-based medical data sharing schemes proposed in [21, 32, 34], it shows that the B-SSMD scheme adopts a three-chain distributed structure to reduce the burden on the mainchain, and the three-layer encryption and fine-grained access control improve the security of data sharing.Table 6
Scheme comparison.
SchemeMainchain pressureBlockchain structureSecurityDivision granularityEncryption modeLiu et al. [21]++Single+−Public keyCao et al. [32]+Hybrid double−−HashMalamas et al. [34]−Hierarchical++CP-ABEProposed scheme−Hybrid three++++Three-layerIn Table7 describes the security flaws of our scheme and other schemes, and it shows that most previously developed schemes do not have important security attributes. The proposed scheme not only resists possible attacks but also explains in detail overall operation and process. Therefore, compared with the schemes proposed in [21, 22, 32, 34], the B-SSMD in this paper has considerable advantages.Table 7
Security comparison.
SchemeLiu et al. [21]Cao et al. [32]Malamas et al. [34]Lee et al. [22]Proposed schemeResistance to single-point failure×××√√Resistance to impersonation××√√√Resistance to replay attacks×××√√Resistance to malicious tampering√√√√√User group members update××××√


## 7. Conclusion

We focus on the medical data sharing scheme based on blockchain and proposes the B-SSMD system scheme. Through integrating the three-chain model with IPFS technology, by adopting the method of storing data on-chain and index path off-chain, it realizes a high degree of distribution of data storage and solves the defects of the centralized storage in traditional medical systems. In addition, by utilizing the three-layer encryption and fine-grained access control, the P/MSISP data sharing process is proposed, which protects the user privacy and improves the data security. Finally, the security analyzes prove our scheme to be secure, and the simulation experiments demonstrate our scheme is feasible. For further research work, one possible improvement is the transferability of the B-SSMD system. Not only in medical environments, but in other scenarios, how to use the three-chain model to solve the problem of data sharing is work that we can explore in the future.



---

*Source: 2719951-2022-11-03.xml*