# MB-BC: Drug Traceability System Based on Multibranched Blockchain Structure

Authors: Xudong Tan; Zerui Kang; Fan Wei; Chenhao Gao; Zhaoying Wei; Haiping Huang
Journal: Wireless Communications and Mobile Computing
 (2022)

---

## Abstract

The establishment of a complete drug traceability system is essentially important for public drug security and the business of pharmaceutical companies which is aimed at tracking where the drug has gone along the drug supply chain. Traditional centralized server-client technical solutions have been far from satisfaction for their bad performances in data authenticity, privacy, system resilience, and flexibility. In this paper, we propose a drug traceability scheme called MB-BC, which realizes the security and traceability of drug data through a novel multibranched blockchain scheme. Different from the characteristics of transparency of traditional blockchains, MB-BC realizes fine-grained access control of data between all levels in the system, which improves the security and privacy of data. MB-BC has further improved the existing consensus mechanism, strengthened the supervision of pharmaceutical companies, and further improved the safety and robustness of the system. Furthermore, the system combines data access strategies with smart contracts; each branch chain can also issue its smart contract to provide personalized services. Finally, security and performance evaluations show that the solution is advantageous in terms of data security, system robustness, supervisibility, and traceability, as well as efficient in terms of blockchain throughput, data query time, and blockchain consensus consumptions, compared with other typical approaches.


---

## Body

## 1. Introduction

The fact that a large number of people involving children die from counterfeit medicines every year is gradually affecting the credibility of the government and medical institutions due to the improvement of counterfeit technology [1, 2]. How to achieve effective drug supervision still remains challenging for the government.Drug supervision contains a series of supervisory processes that regulate the development, production, transportation, and purchase of drugs [3]. In 2013, the United States signed the Drug Supply Chain Security Act of the United States (DSCSA) [4] requiring the establishment of an operational electronic information system to identify and trace prescription drugs distributed in the United States. Using technologies such as big data and the Internet of Things (IoT), China has achieved rapid development in drug traceability systems. Pharmaceutical companies usually establish their traceability systems or use third-party traceability systems such as “Ali Health” to identify, read, record, and upload drug data to their respective center databases through technical means such as barcodes and RFID [5]. By scanning the traceable source code on the drug packaging, consumers can quickly identify the authenticity of the drug. The gradual improvement of the traceability system has made a great contribution to the safety of drug supervision.However, there are still a series of problems hindering the development of a drug traceability system [6]. First of all, the most important thing as a traceability system is the authenticity of the drug data in the system. The centralized data storage will still have the problem of artificial data tampering [7, 8]. There may be a series of illegal operations such as modifying the expiration date, production date, and other key information of the drug to conceal the truth of the fake drug. In addition, the privacy protection of pharmaceutical companies on third-party platforms is also a major problem in the development of drug traceability systems [9]. Generally speaking, the data of each pharmaceutical company should be kept confidential.The emergence of blockchain provides us with a good solution to the above problems. Blockchain technique combines modern cryptography, point to point communication, and distributed consensus protocol [10, 11]; these techniques will eventually form a blockchain framework. In recent years, many scholars have been absorbed in the drug traceability and supervision system based on blockchain architecture [12, 13]. However, most of the current blockchains are achieved based on Ethereum [14] or Fabric platforms [15], and they usually have been limited to the common block structure, for example, the single-chain structure, which may frequently lead to a series of problems such as fork and system failure [16]. In addition, the low efficiency of the current consensus mechanism is another important reason why the traditional blockchain system is difficult to be widely used [17, 18].In this paper, an improved blockchain structure-based drug traceability system called MB-BC will be proposed, to achieve the safe traceability of drug data and improve the supervision efficiency of pharmaceutical enterprises. MB-BC inherits the advantages of a traditional blockchain traceability system and overcomes the defects mentioned above. Specifically, the contributions of this paper are summarized as follows:(i)
Based on the characteristics of the drug supply chain and the actual scenario, a drug traceability system model MB-BC is designed, which adopts a new hybrid blockchain structure of main chain and branch chain to realize the supervision of multiple drug enterprise nodes and improve the traceability efficiency of the system(ii)
Our proposal combines ciphertext policy attribute-based encryption (CP-ABE) technology with smart contracts to achieve fine-grained access for users at all levels and ensure data privacy security(iii)
In MB-BC, each branch chain can publish its own smart contract, which can effectively prevent attacks caused by smart contract vulnerabilities. In addition, an improved DPoS consensus mechanism in our proposal can also effectively prevent the concentration of power to a certain person through the review mechanismThe rest of this paper is organized as follows. In Section2, we present related works. The preliminaries are introduced in Section 3. In Section 4, the system model and security model are presented. In Section 5, we propose a multibranch blockchain system model and introduce the on-chain operation of this model. The access control model based on CP-ABE and smart contract is given in Section 6. In Section 7, we analyze the security of the proposed scheme and evaluate its performance. Finally, we conclude this paper in Section 8.


## 2. Related Work

In the intelligent medicine scenarios of IoT, how to ensure the security of supply chain data and realize the tracking and monitoring of the medical data is a hot topic of research [19–22]. In 2008, Bitcoin was born, the concept of blockchain was derived from it, and its decentralization, data traceability, and nontampering characteristics [23, 24] provide feasible solutions for a series of security problems in the supply chain. For example, Tian [25] established an agricultural product supply chain traceability system based on radio frequency identification technology and blockchain technology. The system covers the entire process of data collection and information management in each link of the agricultural product supply chain and realizes the quality and safety monitoring and traceability management of agricultural products “from farm to fork.” Even if the relevant technology could also be extended to the drug supply chain, the drug manufacturing supply chain is different from the general production supply chain [26] because of higher requirements for traceability, securit,y and privacy.In terms of traceability and supervision of the drug supply chain, according to DSCSA, Sinclair et al. [27] focused on the development of blockchain prototype solutions, from the perspective of the drug supply chain security law, explored and used Hyperledger Composer to build a simple drug traceability platform. Jamil et al. [28] also proposed a blockchain-based supply chain to establish trusted medical records for drugs and patients. This solution not only showed the feasibility of building traceability of blockchain platforms but also introduced a smart contract on this basis, which allows patients to check drug information within a limited time. Similarly, B. Alangot and Achuthan [29] also put forward a model for storing drug records called “trace and track.” It combines the framework of the Internet of Things with the blockchain, introduces trust into trustless interactions between stakeholders, and combats counterfeit drugs. Mettler [30] discussed Hyperledger, a research network across industries involving Cisco, Accenture, Intel, IBM, Block Stream, and Bloomberg, and recently launched the Counterfeit Medicines Project where the timestamp in the blockchain is used to attach to the produced medicines to verify the production date of the drug. During the quality monitoring of the above scenario, using blockchain technology, it is possible to detect the source of the product and the transfer between entities, and everyone can join and use it.In terms of data security and privacy protection, Alzahrani and Bulusu [31] proposed a new supply chain structure called “block-supply” using blockchain and NFC technology, and aiming at medical application, it introduced a corresponding consistency protocol to improve the security of the system model. However, it does not consider the case that the validation leader is malicious and will cooperate with other malicious nodes in this scheme. Huang et al. [32] proposed a blockchain-based solution called “Drugledger.” The privacy and security of drug data are ensured by decomposing the service provider into separate entities. To prevent the occurrence of counterfeit drugs, fraudulent customers, and other behaviors, Bocek et al. [33] introduced another blockchain-based medical supply chain, which uses IoT devices and blockchain to monitor drug temperature and data security while reducing the operating costs of the drug supply chain.To sum up, the drug traceability literature based on blockchain now realizes the traceability and nontampering of drug data. However, it cannot be ignored that most of the literature has not explored the structure of the blockchain itself to adapt to the drug supply chain. The conventional single-chain structure is the root cause of the low efficiency of the blockchain, especially in the drug traceability system. A large number of pharmaceutical companies continue to upload drug production data, which is a huge challenge to the efficiency and scalability of the blockchain system. In addition, for a large number of different entities in the system, how to achieve fine-grained access control, provide personalized services, and ensure data security and privacy within the blockchain is also one of the important reasons that hinder the development of the blockchain drug traceability system. The above challenging issues will become the concerns of this paper.


## 3. Preliminaries

In this section, we provide some background knowledge needed in this paper, including bilinear pairing, blockchain technology, ciphertext policy attribute-based encryption (CP-ABE) [34], and Delegated Proof of Stake (DPoS) [35] consensus mechanism.


### 3.1. Bilinear Pairing

An important application of bilinear pairing in cryptography is the construction of short signatures. In the so-called bilinear pair, letG1,G2, andGTbe three-cycle groups with the same ordernandG1,G2, andGTbe multiplicative groups. A bilinear map G×G⟶GT has the following properties:
(1)
Bilinearity:eg1a,g2b=eg1,g2ab for g1∈G1, g2∈G2, and a,b∈Zq(2)
Nondegeneracy: for eachg1∈G1/1, there exists g2∈G2andeg1,g2≠1(3)
Computability: there exists an efficiently computable algorithm for computing


### 3.2. Blockchain Technology

Blockchain technology, which originated from the famous Bitcoin virtual currency, has now been separated from Bitcoin as a separate technology. In essence, it is a distributed ledger database maintained by multiple participants, which combines technical features such as cryptography, consensus mechanism, and smart contracts [36], and has decentralized credibility, immutability, transparent data traceability, etc. features. Blockchain consists of three basic concepts:
(1)
Transaction: refers to an operation on the ledger in the blockchain network, and the state of the ledger changes once(2)
Block: it is about packaging all transaction data within a period and generating a new block by the consensus mechanism. Each block is divided into a block header and a block body. The block header contains the hash value of the previous block, which is used to connect to the previous block, and also includes the timestamp and the hash value of the block body. The block body mainly contains transaction data organized in the form of a Merkle tree(3)
Chain: a data chain consisting of a series of blocks containing a large number of transactions


### 3.3. Ciphertext Policy Attribute-Based Encryption (CP-ABE)

In 2006, a new cryptographic primitive CP-ABE was proposed, which provides attribute-based access control. By using CP-ABE, users can specify access policies for data encryption based on logical expressions of user attributes before uploading to a third-party database. The key agency will assign corresponding user attributes as the user’s identity according to the different users. CP-ABE guarantees that only users whose attributes satisfy logical expressions can decrypt data and achieve fine-grained access control. The general CP-ABE algorithm consists of four basic steps:(1)
Setup. Generate master keyMK and public parameter PK(2)
CT=EncryptPK,M,T. Use PK, access structure T, and encrypted data plaintext M to generate encrypted ciphertext CT(3)
SK=KeyGenMK,A. Use MK and the user attribute set A to generate the user’s private key SK(4)
M=DecryptCT,SK. Use the private key SK to decrypt the ciphertext CT to obtain the plaintext M


### 3.4. Delegated Proof of Stake (DPoS)

DPoS is designed to solve the performance problems of the PoW [37] algorithm and the risk problems caused by a small number of nodes holding a large number of shares that may appear in the later stage of the PoS [38] algorithm. In the DPoS algorithm, the PoS share mechanism is retained, and a method similar to the voting mechanism of the board of directors in modern enterprises is adopted [39]. Nodes use the shares they hold to vote for a small number of nodes called witnesses, and these witness nodes will act for the rest of the nodes to complete block generation and verification. By reducing the requirements for the number of confirmations, the DPoS algorithm greatly improves the speed of transactions and the blocks produced by the witnesses will be verified by subsequent witnesses. The advantage of this is that other ordinary equity nodes do not need to spend additional resources to verify each transaction. Stakeholders can vote for nodes they trust. After the system selects the witness node; if any node has doubts about the witness node, they can choose to exit.


## 3.1. Bilinear Pairing

An important application of bilinear pairing in cryptography is the construction of short signatures. In the so-called bilinear pair, letG1,G2, andGTbe three-cycle groups with the same ordernandG1,G2, andGTbe multiplicative groups. A bilinear map G×G⟶GT has the following properties:
(1)
Bilinearity:eg1a,g2b=eg1,g2ab for g1∈G1, g2∈G2, and a,b∈Zq(2)
Nondegeneracy: for eachg1∈G1/1, there exists g2∈G2andeg1,g2≠1(3)
Computability: there exists an efficiently computable algorithm for computing


## 3.2. Blockchain Technology

Blockchain technology, which originated from the famous Bitcoin virtual currency, has now been separated from Bitcoin as a separate technology. In essence, it is a distributed ledger database maintained by multiple participants, which combines technical features such as cryptography, consensus mechanism, and smart contracts [36], and has decentralized credibility, immutability, transparent data traceability, etc. features. Blockchain consists of three basic concepts:
(1)
Transaction: refers to an operation on the ledger in the blockchain network, and the state of the ledger changes once(2)
Block: it is about packaging all transaction data within a period and generating a new block by the consensus mechanism. Each block is divided into a block header and a block body. The block header contains the hash value of the previous block, which is used to connect to the previous block, and also includes the timestamp and the hash value of the block body. The block body mainly contains transaction data organized in the form of a Merkle tree(3)
Chain: a data chain consisting of a series of blocks containing a large number of transactions


## 3.3. Ciphertext Policy Attribute-Based Encryption (CP-ABE)

In 2006, a new cryptographic primitive CP-ABE was proposed, which provides attribute-based access control. By using CP-ABE, users can specify access policies for data encryption based on logical expressions of user attributes before uploading to a third-party database. The key agency will assign corresponding user attributes as the user’s identity according to the different users. CP-ABE guarantees that only users whose attributes satisfy logical expressions can decrypt data and achieve fine-grained access control. The general CP-ABE algorithm consists of four basic steps:(1)
Setup. Generate master keyMK and public parameter PK(2)
CT=EncryptPK,M,T. Use PK, access structure T, and encrypted data plaintext M to generate encrypted ciphertext CT(3)
SK=KeyGenMK,A. Use MK and the user attribute set A to generate the user’s private key SK(4)
M=DecryptCT,SK. Use the private key SK to decrypt the ciphertext CT to obtain the plaintext M


## 3.4. Delegated Proof of Stake (DPoS)

DPoS is designed to solve the performance problems of the PoW [37] algorithm and the risk problems caused by a small number of nodes holding a large number of shares that may appear in the later stage of the PoS [38] algorithm. In the DPoS algorithm, the PoS share mechanism is retained, and a method similar to the voting mechanism of the board of directors in modern enterprises is adopted [39]. Nodes use the shares they hold to vote for a small number of nodes called witnesses, and these witness nodes will act for the rest of the nodes to complete block generation and verification. By reducing the requirements for the number of confirmations, the DPoS algorithm greatly improves the speed of transactions and the blocks produced by the witnesses will be verified by subsequent witnesses. The advantage of this is that other ordinary equity nodes do not need to spend additional resources to verify each transaction. Stakeholders can vote for nodes they trust. After the system selects the witness node; if any node has doubts about the witness node, they can choose to exit.


## 4. Problem Statement and Model

### 4.1. System Model

As can be seen in Figure1, the drug traceability system involves four entities: Food and Drug Administration (DA), pharmaceutical companies (PH), drug sellers (S), and the patients (P).Figure 1
System model.DA: the Food and Drug Administration is a trusted third-party organization managed by the government. As a government agency, DA is the generator of the main chain block and responsible for the supervision and management of system nodes. Also, it is responsible for system initialization and assistance department node registration work.PH: pharmaceutical company, uniquely identified by PH, is the main data generator of the traceability system, and all drug data of PH will be packaged and added to the corresponding branch chain. According to the different functions, each company is classified into general department node or leader department node and only one leader department node exists in the branch chain.S: drug seller, uniquely identified by S. The main drug sellers here include hospitals and pharmacies. They both buy medicines from PH and sell medicines to patients. So, they can flexibly join the corresponding branch chain.P: patients, uniquely identified by P, can purchase medicines from a licensed drug seller S and trace the authenticity of the drugs through the drug code on the package.At a higher level, the operation process of the drug traceability system based on MB-BC is as follows. First, PH presents the relevant legal operation certificate to DA and reports the relevant information of the company, and DA grants the authority and generates a block on the system main chain for the company. And then, the various departments under it will also register as general nodes in the system, generate drug production data, and upload it to the blockchain system after a consensus mechanism. Under this system model, the operations between companies are independent, and personalized smart contracts can be issued on their respective branch chains without interfering with each other. The data on the chain can be traced and cannot be tampered with. At the same time, CP-ABE and smart contracts are used to ensure data privacy and security and avoid unfair competition among pharmaceutical companies.


### 4.2. Security Model

In the MB-BC system model, DA is completely trustworthy. As a government agency, it is responsible for maintaining the stability of the drug market and supervising drug data. The pharmaceutical companies and drug sellers are semitrusted. Drug production data is the core secret of PH. In the face of all kinds of interest temptations, some pharmaceutical companies may perform a series of illegal operations, such as stealing production data from other pharmaceutical companies and colluding attacks. In a worse situation, some pharmaceutical company nodes may damage the system, such as block generation errors and issuing smart contracts with vulnerabilities.


## 4.1. System Model

As can be seen in Figure1, the drug traceability system involves four entities: Food and Drug Administration (DA), pharmaceutical companies (PH), drug sellers (S), and the patients (P).Figure 1
System model.DA: the Food and Drug Administration is a trusted third-party organization managed by the government. As a government agency, DA is the generator of the main chain block and responsible for the supervision and management of system nodes. Also, it is responsible for system initialization and assistance department node registration work.PH: pharmaceutical company, uniquely identified by PH, is the main data generator of the traceability system, and all drug data of PH will be packaged and added to the corresponding branch chain. According to the different functions, each company is classified into general department node or leader department node and only one leader department node exists in the branch chain.S: drug seller, uniquely identified by S. The main drug sellers here include hospitals and pharmacies. They both buy medicines from PH and sell medicines to patients. So, they can flexibly join the corresponding branch chain.P: patients, uniquely identified by P, can purchase medicines from a licensed drug seller S and trace the authenticity of the drugs through the drug code on the package.At a higher level, the operation process of the drug traceability system based on MB-BC is as follows. First, PH presents the relevant legal operation certificate to DA and reports the relevant information of the company, and DA grants the authority and generates a block on the system main chain for the company. And then, the various departments under it will also register as general nodes in the system, generate drug production data, and upload it to the blockchain system after a consensus mechanism. Under this system model, the operations between companies are independent, and personalized smart contracts can be issued on their respective branch chains without interfering with each other. The data on the chain can be traced and cannot be tampered with. At the same time, CP-ABE and smart contracts are used to ensure data privacy and security and avoid unfair competition among pharmaceutical companies.


## 4.2. Security Model

In the MB-BC system model, DA is completely trustworthy. As a government agency, it is responsible for maintaining the stability of the drug market and supervising drug data. The pharmaceutical companies and drug sellers are semitrusted. Drug production data is the core secret of PH. In the face of all kinds of interest temptations, some pharmaceutical companies may perform a series of illegal operations, such as stealing production data from other pharmaceutical companies and colluding attacks. In a worse situation, some pharmaceutical company nodes may damage the system, such as block generation errors and issuing smart contracts with vulnerabilities.


## 5. Multibranch Blockchain (MB-BC) System and Solution

In this section, we propose the MB-BC structure and introduce the characteristics of the MB-BC, including main chain generation, data upload, smart contract, and consensus mechanisms.


### 5.1. System Setup

DA selects the groupG1 and G2, where the order of G1 is q and g is the generator of G1. Then, DA defines a bilinear mapping: G1×G1⟶G2 and select two hashes: H1:0,1∗⟶G1∗ and H2:0,1256. DA randomly select α,β,r∈Zp∗, where Zp∗∈1,2⋯p−1 and generates the system public key MPK=h=gβ,f=g1/β,eg,gα, and the system master secret key is MSK=r,β,gα,. DA will broadcast MPK to the entire blockchain network. To simplify the description, the meaning of some special characters is shown as Table 1.Table 1
Common notation description.
NotationsDescriptionsqOrder of the groupG1gGenerator of the groupG1α, β, r, rj, sSecret value randomly generated by DAMx∈i,transDm,transDsPlaintext data of drug data or registration informationTransTransaction packaged by dataskx,x∈m,sThe private key of the nodes in the blockchain systempkx,x∈m,sThe public key of the nodes in the blockchain systemIDx,x∈d,sUnique ID of the nodes in the blockchain systemPTAccess policy tree of CP-ABENNodes in the access policy treeAAttributes of the access policy treexThe number of child nodes ofN in the access policy treeKNThe threshold value of each nodeNyThe number of nodes in the access policy treeC~,C,CiEncrypted ciphertext set of CP-ABED,Dj,Dj∗Decryption key set of CP-ABE


### 5.2. Main Chain Generation

Suppose that a pharmaceutical companyPHA wants to join the traceability system; first, the leader department Dm of PHA needs to register through the platform, that is, fill in various registration information in the system and record it as mm1,mm2⋯mmn; among them, mm1,mm2⋯mmn are the plaintext of registration information. After the review of DA is passed, the company’s registration information is packaged into several transactions MtransDm=Transm1,Transm2⋯Transmn, where Transmn=mmk,mmk+1⋯mmn, then put MtransDm into the transaction buffer to wait for upload to the blockchain.DA generates a unique numberIDd∈0,1∗ for PHA and a key pair for the identity authentication of the leadership department and calculates SIDd=H1IDd∈G1∗, the private key skm=r∗SIDd, and the public key pkm=gskm. The public key pkm is broadcast to the entire network by DA, and the private key is kept by Dm.After completing the above steps, a new main chain block is generated forPHA. As shown in Figure 2, the block includes a block header and a block body. The block header contains 4 bytes of the version number, 4-byte timestamp, 32-byte previous block hash, 4-byte organization number IDd, 32-byte Merkle root, and 4 bytes of branched-chain distinction. The block body is the Merkle tree composed of PH’s registration information MtransDm. After the generation is completed, DA will broadcast the updated main chain to the entire network, and the rest of the nodes will update the blockchain after verification. In addition, similar to the general blockchain system, we will initially allocate 10 virtual currencies for PHA, which is called PHgas in this scheme. Through PHgas, functions such as executing smart contracts can be completed.Figure 2
Multibranch block structure.In addition to the only leader departmentDm, the rest such as production workshops and research and development departments are collectively referred to as general departments, denoted as Ds1,Ds2,⋯,Dsn. After the registration is completed by Dm, general node Dsn will package the registration information MtransDs=Transs1,Transs2,⋯,Transsn, the number of the company IDd, and the signature of the leader department which is defined as Signm=H1MtransDsskm sends them to DA. DA verifies the authenticity of the signature by calculating eSignm,g=eH1MtransDs,pkm. If the equation holds, the verification is successful, and the node obtains the attributes IDsn∈0,1∗ and associates IDsn with IDd, which means that the node is a subordinate department of PHA. Finally, DA generates the identity authentication key pair sksn,pksn for Dsn; among them, the private key is sksn=r∗H1IDsn and the public key is pksn=gskn


### 5.3. Data Upload

After the registration is completed,Dsn becomes a general node in the blockchain system and can upload “transactions” (i.e., drug production data) to the blockchain. Every time a piece of production data is generated, the data is packaged into a “transaction,” which is recorded as Trans=CT,Tokendrug,IDd,σe. The structure of the “transaction” is shown in Figure 3. Each piece of “transaction” contains the following content: CT is encrypted production data, which can be used for drug identification and retrospective use. Tokendrug is a specific type of drug, to distinguish subsequent lookups. IDd is the number of the PH to which it belongs for witness classification. σe=H2CT,Tokendrug,IDd is the hash fingerprint of the first three to ensure that the transaction is not tampered with during transmission.Figure 3
The structure of the “transaction.”The general node sends the Trans and the signatureSigns=H1Transsksnto the network together. After the consensus witness node receives this message, it verifies the Signs and judges whether eSigns,g=eH1Trans,pksn is established. If the equation holds, the verification is successful.The witness node accepts the Trans, sorts it according to the company numberIDd in the “transaction,” puts it into the data buffer, and waits for packaging. When the transaction in the data buffer reaches a certain number, the current witness node packs the classified transactions and adds them to the corresponding branch chain. The remaining witness nodes verify the current witness node’s decision and judge whether there is a classification error. After the verification is passed, the branch chain block is generated successfully and broadcast to the entire network for the update. The above process involves the workflow of the consensus mechanism, and the specific steps will be given in detail in Section 5.4.


### 5.4. Smart Contract

We use a smart contract called policy tree update contract to automatically update the access policy tree required for attribute-based encryption. The updated access policy tree is also recorded in the blockchain to ensure that it cannot be tampered with. If the leader department of pharmaceutical company needs to update the access strategy tree, it can be achieved through this smart contract. The major work of the access policy tree update contract is formally described in Algorithm1.Algorithm 1: Policy tree update contract.
Input: New policy tree PT, New policy tree’s address DataplacePT, Signature of PT SignPTOutput:TransPT1:initialize: Set α=H1PT, times=0, Labeltrans=policytree2:ifSignT,g=eα,pkmthen3:Verifysucess;4:Payer⟵IDd;5:ifBalanceid≥gapthen6:  Input paymeent password Pw;7:while Pw is not true and time ≤3 do8:   time++;9:end while10:if time≤3 then11:TreeplacePT⟵DataplacePT;12:else return Account lock;13:end if14:else return Insufficient balance;15:end if16:end if17:fp⟵H2α18:TransPT⟵TreeplacePT,fp,IDd,Labeltrans19:returnTransPTAs shown in the algorithm, some departments or drug sellers join or leave the system, the pharmaceutical company expects to update the access policy tree privileges, and then, the smart contract needs to be invoked by the leader nodeDm. The leader node Dm needs to take the latest access policy tree PT∈0,1∗, the storage address DateplacePT and PT′s signature SignPT as input to generate TransPT containing the updated access policy tree. Then, it proceeds to the initialization stage, where time is the times that the password can be entered during the payment period, and Labeltrans is the label of TransPT output by the algorithm (Line 1). After the initialization is completed, the signature of the leader node Dm needs to be verified to ensure that Dm is the executor of the contract (Lines 2-4). If the verification is passed, it will start to updating the policy tree. If the current executor’s account balance is larger than the PHgas consumed by the transaction, the user needs to enter the account password (Lines 5-9). If the user enters the password correctly within three times, the smart contract will replace the previously stored policy tree address in the previous transaction with the updated DateplacePT, calculate the hash fp of the DateplacePT, and finally output the updated TransPT (Lines 10-19). The previous access strategy tree address of the system will be changed to DateplacePT after successful payment, and the latest strategy tree will be packaged into transaction TransPT to be recorded in the chain.In addition, it needs to be emphasized that smart contracts are set up under each branch chain; it means each PH can release its smart contracts under its branch chains, such as pharmacy authorization contracts and medical dividend smart contracts. By publishing personalized smart contracts, companies can adjust their business models according to the company status, so that the system is more practical. At the same time, these smart contracts are only valid under the branch chain, avoiding attacks against smart contract vulnerabilities similar to the DAO [40] incident.


### 5.5. Consensus Mechanisms

We choose the DPoS as the consensus mechanism of our system. In the consensus phase of this scheme, three types of role nodes are involved: ordinary node, candidate node, and witness node. Ordinary nodes are general department nodes and have the right to vote. The candidate nodes are selected from all the leader department nodes of pharmaceutical companies through voting. According to our scoring review mechanism, the weight of each node is calculated and ranked. The top-ranked nodes become witness nodes, and the rest are candidate nodes. Specific steps are as follows:Voting stage: assume that the number of pharmaceutical companies in the whole network is Nm; that is, there are also Nm leader nodes, and NT witness nodes need to be selected. Meanwhile, to prevent a large number of malicious nodes, NT candidate nodes need to be selected. Except for the leader nodes, the rest of the general nodes vote according to their wishes.Witness election stage: Algorithm 2 shows the witness node election method. The algorithm finally outputs two node sets R1 and R2, where R1 is the witness node set and R2 is the candidate node set. At the beginning, the system initializes the number of votes for the election node Votei=0,i∈0,Nm and counts their true votes (Lines 1-6). At the same time, to vote more fairly, weights are added to the algorithm to calculate the final votes. The weight mainly has Terror and Countph. There are two considerations. Terror represent the number of failures or errors in generating blocks when the node is used as a witness node, and Terror=0 is set by default. Countph is the breadth of voting sources. Simply put, it is the number of PHs that you get the votes from. For example, if the remaining preconditions are the same, node A received 80 votes from only one PH, Countph=1, and node B received a total of 40 votes, but these 40 votes came from three different PH, Countph=3, and the final number of valid votes of VB is greater than that of VA. This can effectively prevent collusive voting between pharmaceutical companies and improve the fairness of voting. The smart contract calculates and sorts the final votes based on the weight (Lines 7-11). Among them, Weighti=Countph/rd+Terror, rd can be adjusted by DA as a threshold. According to the voting ranking, the first NT nodes are elected as witness nodes and the next NT nodes are candidates (Lines 12-14).Algorithm 2: Witness node election method.
Input: S(set of nodes), Nm(number of leading nodes), Nm(number of general nodes), NT(number of witness nodes)Output:R1(set of witness nodes), R2(set of alternate nodes)1:initialize: Set Votei=02:fori=1 to Nmdo3:forj=1 to Nsndo4:Votei⟵Votei+Caculatej;5:end for6:returnVotei7:Weighti⟵floatcaculateWeightTerror,Countph;8:RealVotei⟵IntWeighti∗Votei;9:end for10:returnRealVotei11:Nxset⟵quickSortRealVotei;12:R1⟵Nxsetx∈0,NT−1;13:R2⟵Nxsetx∈NT,2NT−1;14:return R1,R2Witness work stage: witness nodes generate blocks in sequence as required, and the generated blocks are verified by other witness nodes. According to DPoS, after the block is verified by 2/3NT+1 other witnesses, the block will be added to the blockchain. If the verification is successful, the current block generating node will receive a certain PHgas reward, and the remaining verification nodes will also receive a little PHgas reward. If there is a failure or error in block creation, the DA will review this behavior. The Terror of the witness node will be increased by one if it is a malicious behavior or an error can be avoided, and it will be included in the weight in the next cycle of elections.


## 5.1. System Setup

DA selects the groupG1 and G2, where the order of G1 is q and g is the generator of G1. Then, DA defines a bilinear mapping: G1×G1⟶G2 and select two hashes: H1:0,1∗⟶G1∗ and H2:0,1256. DA randomly select α,β,r∈Zp∗, where Zp∗∈1,2⋯p−1 and generates the system public key MPK=h=gβ,f=g1/β,eg,gα, and the system master secret key is MSK=r,β,gα,. DA will broadcast MPK to the entire blockchain network. To simplify the description, the meaning of some special characters is shown as Table 1.Table 1
Common notation description.
NotationsDescriptionsqOrder of the groupG1gGenerator of the groupG1α, β, r, rj, sSecret value randomly generated by DAMx∈i,transDm,transDsPlaintext data of drug data or registration informationTransTransaction packaged by dataskx,x∈m,sThe private key of the nodes in the blockchain systempkx,x∈m,sThe public key of the nodes in the blockchain systemIDx,x∈d,sUnique ID of the nodes in the blockchain systemPTAccess policy tree of CP-ABENNodes in the access policy treeAAttributes of the access policy treexThe number of child nodes ofN in the access policy treeKNThe threshold value of each nodeNyThe number of nodes in the access policy treeC~,C,CiEncrypted ciphertext set of CP-ABED,Dj,Dj∗Decryption key set of CP-ABE


## 5.2. Main Chain Generation

Suppose that a pharmaceutical companyPHA wants to join the traceability system; first, the leader department Dm of PHA needs to register through the platform, that is, fill in various registration information in the system and record it as mm1,mm2⋯mmn; among them, mm1,mm2⋯mmn are the plaintext of registration information. After the review of DA is passed, the company’s registration information is packaged into several transactions MtransDm=Transm1,Transm2⋯Transmn, where Transmn=mmk,mmk+1⋯mmn, then put MtransDm into the transaction buffer to wait for upload to the blockchain.DA generates a unique numberIDd∈0,1∗ for PHA and a key pair for the identity authentication of the leadership department and calculates SIDd=H1IDd∈G1∗, the private key skm=r∗SIDd, and the public key pkm=gskm. The public key pkm is broadcast to the entire network by DA, and the private key is kept by Dm.After completing the above steps, a new main chain block is generated forPHA. As shown in Figure 2, the block includes a block header and a block body. The block header contains 4 bytes of the version number, 4-byte timestamp, 32-byte previous block hash, 4-byte organization number IDd, 32-byte Merkle root, and 4 bytes of branched-chain distinction. The block body is the Merkle tree composed of PH’s registration information MtransDm. After the generation is completed, DA will broadcast the updated main chain to the entire network, and the rest of the nodes will update the blockchain after verification. In addition, similar to the general blockchain system, we will initially allocate 10 virtual currencies for PHA, which is called PHgas in this scheme. Through PHgas, functions such as executing smart contracts can be completed.Figure 2
Multibranch block structure.In addition to the only leader departmentDm, the rest such as production workshops and research and development departments are collectively referred to as general departments, denoted as Ds1,Ds2,⋯,Dsn. After the registration is completed by Dm, general node Dsn will package the registration information MtransDs=Transs1,Transs2,⋯,Transsn, the number of the company IDd, and the signature of the leader department which is defined as Signm=H1MtransDsskm sends them to DA. DA verifies the authenticity of the signature by calculating eSignm,g=eH1MtransDs,pkm. If the equation holds, the verification is successful, and the node obtains the attributes IDsn∈0,1∗ and associates IDsn with IDd, which means that the node is a subordinate department of PHA. Finally, DA generates the identity authentication key pair sksn,pksn for Dsn; among them, the private key is sksn=r∗H1IDsn and the public key is pksn=gskn


## 5.3. Data Upload

After the registration is completed,Dsn becomes a general node in the blockchain system and can upload “transactions” (i.e., drug production data) to the blockchain. Every time a piece of production data is generated, the data is packaged into a “transaction,” which is recorded as Trans=CT,Tokendrug,IDd,σe. The structure of the “transaction” is shown in Figure 3. Each piece of “transaction” contains the following content: CT is encrypted production data, which can be used for drug identification and retrospective use. Tokendrug is a specific type of drug, to distinguish subsequent lookups. IDd is the number of the PH to which it belongs for witness classification. σe=H2CT,Tokendrug,IDd is the hash fingerprint of the first three to ensure that the transaction is not tampered with during transmission.Figure 3
The structure of the “transaction.”The general node sends the Trans and the signatureSigns=H1Transsksnto the network together. After the consensus witness node receives this message, it verifies the Signs and judges whether eSigns,g=eH1Trans,pksn is established. If the equation holds, the verification is successful.The witness node accepts the Trans, sorts it according to the company numberIDd in the “transaction,” puts it into the data buffer, and waits for packaging. When the transaction in the data buffer reaches a certain number, the current witness node packs the classified transactions and adds them to the corresponding branch chain. The remaining witness nodes verify the current witness node’s decision and judge whether there is a classification error. After the verification is passed, the branch chain block is generated successfully and broadcast to the entire network for the update. The above process involves the workflow of the consensus mechanism, and the specific steps will be given in detail in Section 5.4.


## 5.4. Smart Contract

We use a smart contract called policy tree update contract to automatically update the access policy tree required for attribute-based encryption. The updated access policy tree is also recorded in the blockchain to ensure that it cannot be tampered with. If the leader department of pharmaceutical company needs to update the access strategy tree, it can be achieved through this smart contract. The major work of the access policy tree update contract is formally described in Algorithm1.Algorithm 1: Policy tree update contract.
Input: New policy tree PT, New policy tree’s address DataplacePT, Signature of PT SignPTOutput:TransPT1:initialize: Set α=H1PT, times=0, Labeltrans=policytree2:ifSignT,g=eα,pkmthen3:Verifysucess;4:Payer⟵IDd;5:ifBalanceid≥gapthen6:  Input paymeent password Pw;7:while Pw is not true and time ≤3 do8:   time++;9:end while10:if time≤3 then11:TreeplacePT⟵DataplacePT;12:else return Account lock;13:end if14:else return Insufficient balance;15:end if16:end if17:fp⟵H2α18:TransPT⟵TreeplacePT,fp,IDd,Labeltrans19:returnTransPTAs shown in the algorithm, some departments or drug sellers join or leave the system, the pharmaceutical company expects to update the access policy tree privileges, and then, the smart contract needs to be invoked by the leader nodeDm. The leader node Dm needs to take the latest access policy tree PT∈0,1∗, the storage address DateplacePT and PT′s signature SignPT as input to generate TransPT containing the updated access policy tree. Then, it proceeds to the initialization stage, where time is the times that the password can be entered during the payment period, and Labeltrans is the label of TransPT output by the algorithm (Line 1). After the initialization is completed, the signature of the leader node Dm needs to be verified to ensure that Dm is the executor of the contract (Lines 2-4). If the verification is passed, it will start to updating the policy tree. If the current executor’s account balance is larger than the PHgas consumed by the transaction, the user needs to enter the account password (Lines 5-9). If the user enters the password correctly within three times, the smart contract will replace the previously stored policy tree address in the previous transaction with the updated DateplacePT, calculate the hash fp of the DateplacePT, and finally output the updated TransPT (Lines 10-19). The previous access strategy tree address of the system will be changed to DateplacePT after successful payment, and the latest strategy tree will be packaged into transaction TransPT to be recorded in the chain.In addition, it needs to be emphasized that smart contracts are set up under each branch chain; it means each PH can release its smart contracts under its branch chains, such as pharmacy authorization contracts and medical dividend smart contracts. By publishing personalized smart contracts, companies can adjust their business models according to the company status, so that the system is more practical. At the same time, these smart contracts are only valid under the branch chain, avoiding attacks against smart contract vulnerabilities similar to the DAO [40] incident.


## 5.5. Consensus Mechanisms

We choose the DPoS as the consensus mechanism of our system. In the consensus phase of this scheme, three types of role nodes are involved: ordinary node, candidate node, and witness node. Ordinary nodes are general department nodes and have the right to vote. The candidate nodes are selected from all the leader department nodes of pharmaceutical companies through voting. According to our scoring review mechanism, the weight of each node is calculated and ranked. The top-ranked nodes become witness nodes, and the rest are candidate nodes. Specific steps are as follows:Voting stage: assume that the number of pharmaceutical companies in the whole network is Nm; that is, there are also Nm leader nodes, and NT witness nodes need to be selected. Meanwhile, to prevent a large number of malicious nodes, NT candidate nodes need to be selected. Except for the leader nodes, the rest of the general nodes vote according to their wishes.Witness election stage: Algorithm 2 shows the witness node election method. The algorithm finally outputs two node sets R1 and R2, where R1 is the witness node set and R2 is the candidate node set. At the beginning, the system initializes the number of votes for the election node Votei=0,i∈0,Nm and counts their true votes (Lines 1-6). At the same time, to vote more fairly, weights are added to the algorithm to calculate the final votes. The weight mainly has Terror and Countph. There are two considerations. Terror represent the number of failures or errors in generating blocks when the node is used as a witness node, and Terror=0 is set by default. Countph is the breadth of voting sources. Simply put, it is the number of PHs that you get the votes from. For example, if the remaining preconditions are the same, node A received 80 votes from only one PH, Countph=1, and node B received a total of 40 votes, but these 40 votes came from three different PH, Countph=3, and the final number of valid votes of VB is greater than that of VA. This can effectively prevent collusive voting between pharmaceutical companies and improve the fairness of voting. The smart contract calculates and sorts the final votes based on the weight (Lines 7-11). Among them, Weighti=Countph/rd+Terror, rd can be adjusted by DA as a threshold. According to the voting ranking, the first NT nodes are elected as witness nodes and the next NT nodes are candidates (Lines 12-14).Algorithm 2: Witness node election method.
Input: S(set of nodes), Nm(number of leading nodes), Nm(number of general nodes), NT(number of witness nodes)Output:R1(set of witness nodes), R2(set of alternate nodes)1:initialize: Set Votei=02:fori=1 to Nmdo3:forj=1 to Nsndo4:Votei⟵Votei+Caculatej;5:end for6:returnVotei7:Weighti⟵floatcaculateWeightTerror,Countph;8:RealVotei⟵IntWeighti∗Votei;9:end for10:returnRealVotei11:Nxset⟵quickSortRealVotei;12:R1⟵Nxsetx∈0,NT−1;13:R2⟵Nxsetx∈NT,2NT−1;14:return R1,R2Witness work stage: witness nodes generate blocks in sequence as required, and the generated blocks are verified by other witness nodes. According to DPoS, after the block is verified by 2/3NT+1 other witnesses, the block will be added to the blockchain. If the verification is successful, the current block generating node will receive a certain PHgas reward, and the remaining verification nodes will also receive a little PHgas reward. If there is a failure or error in block creation, the DA will review this behavior. The Terror of the witness node will be increased by one if it is a malicious behavior or an error can be avoided, and it will be included in the weight in the next cycle of elections.


## 6. Data Access Security

### 6.1. Access Policy Initialization

The leader department of the pharmaceutical company generates an initial access policy tree according to the actual situation, and the access policy tree structure is shown in Figure4. The access policy tree mainly has two functions “And” and “Or.” If the function implemented by the node is “And” and the number of child nodes is x, the applicant must meet the attributes of x child nodes to successfully execute the decryption algorithm of this layer. If the function implemented by the node is “Or,” the applicant only needs to meet the attributes of one of the child nodes to execute the decryption algorithm of this layer. Taking this access policy tree in Figure 4 as an example, the applicant accesses the access policy tree and observes it from bottom to top. In the beginning, the applicant must satisfy the attribute set Aconsumer,Afirst or AIDd,Aeffective; among them, the attribute set Aconsumer,AFirst means that consumers who use drugs for the first time meet the requirements, and attribute set AIDd,Aeffective means that the valid identity of the applicant must be the department associated with the IDd.Figure 4
Initial access policy tree.


### 6.2. Access Policy Storage

Assuming that the drug sellerSA and PHA have reached a cooperation, SA become a node in the PHA’s branch chain after the registration is completed, DA will assign the attribute ASA∈0,1∗ to SA, and Dm will update the structure of the access policy tree according to the attribute ASA . After that, the leader node Dm needs to update and save the new access policy tree PT∈0,1∗; Dm first saves the access policy tree locally and executes the access policy tree update smart contract mentioned in Section 5. According to Algorithm 1, TransPT=TreeplacePT,α,IDd,LabelPT will be uploaded to the blockchain to ensure that PT and the storage address TreeplacePT are not tampered with.


### 6.3. Data Encryption Stage

Dsn is a general node under PHA and is responsible for drug production. Mi is a piece of production data, and the storage address is DateplaceMi. Dsn inputs the data hash value H2Mi and DateplaceMi as the message plaintext, and DA will execute the CP-ABE encryption algorithm as follows:
(1)
DA backtracks the branch chain ofPHA and finds the latest transaction with LabelPT. Dsn gets the TransPT and verifies whether the PHA’s ID is correct and then obtains the access policy tree PTget∈0,1∗ according to the TreeplacePT and verifies that α=H1PTget; if the verification is successful, it means the access policy tree under TreeplacePT is valid and usable(2)
DA makes thePHA’s access policy tree PTA=PTget; among them, PTA’s attribute set is Ap and node set N=N1,N2,N3⋯Ny, kN is the threshold value of each node N, and then, arbitrarily select a k-degree polynomial qN, where k=kN−1; DA randomly select s∈Zp, where s is the secret value(3)
DA setqroot0=s to generate qN0=qparentNindexN recursively according to the access policy tree, where parentN is the parent node of node N and indexN is the subscript of N under the tree rooted at parentN. Dsn obtains the ciphertext: CT=C~=Mi∗eg,gαs,C=hs,∀i∈Ap:Ci=gqi0,Ci∗=H1attiqi0, where α,s,h,g have been given in the system setup step, and Ap is a set of attributes containing all attributes. The function atti is defined only if i is a leaf node and denotes the attribute associated with the leaf node i in the tree. Finally, Dsn packages it into TransCT=CT,H2CT,PTget and uploads it to the blockchain


### 6.4. Data Decryption Stage

In the decryption stage, the data applicant may be a patient who purchases the drug or a node under thePH. If the applicant is patient P, it will be registered by scanning the drug package, and the system will automatically generate a temporary attribute set Au=consumer,firstfor the patient; in the second case, the node will directly apply for the private key from DA through its attributes. The specific decryption steps to obtain the private key are as follows:
(1)
DA generates a private key for the data applicant. For each attribute in the applicant attribute setAu, DA chooses rj∈zp∗ and calculates the applicant’s private key as SKu=D=gα+r/β,∀j∈Au:Dj=grH1jrj,Dj∗=grj(2)
According to theTokendrug,IDd requested by the data applicant, the system will first lock the corresponding branch chain according to the IDd and then obtain all relevant drug data ciphertexts in the branch chain according to theTokendrug(3)
The CP-ABE decryption algorithm is executed to decrypt the ciphertext CT: letn=attri, for the leaf node i in the access policy tree and the decryption algorithm DecryptCT,D,xi=eDi,Cn/Di∗,Cn∗=eg,grqx0. For the nonleaf node i of the access policy tree, the decryption algorithm calculates DecryptCT,D,xi==eg,grs. According to the above principles and algorithms, the access policy tree is traversed from bottom to top, and the plaintext Mi=C~/eC,D/eg,grs is finally obtained(4)
Finally, the timestamp and the plaintext production data are combined with specific traceability information for consumers to verify the authenticity of the drug. If the data applicant is a patient, to prevent the second use of the drug packaging, the attributefirstwill be deleted after the first use is completed


## 6.1. Access Policy Initialization

The leader department of the pharmaceutical company generates an initial access policy tree according to the actual situation, and the access policy tree structure is shown in Figure4. The access policy tree mainly has two functions “And” and “Or.” If the function implemented by the node is “And” and the number of child nodes is x, the applicant must meet the attributes of x child nodes to successfully execute the decryption algorithm of this layer. If the function implemented by the node is “Or,” the applicant only needs to meet the attributes of one of the child nodes to execute the decryption algorithm of this layer. Taking this access policy tree in Figure 4 as an example, the applicant accesses the access policy tree and observes it from bottom to top. In the beginning, the applicant must satisfy the attribute set Aconsumer,Afirst or AIDd,Aeffective; among them, the attribute set Aconsumer,AFirst means that consumers who use drugs for the first time meet the requirements, and attribute set AIDd,Aeffective means that the valid identity of the applicant must be the department associated with the IDd.Figure 4
Initial access policy tree.


## 6.2. Access Policy Storage

Assuming that the drug sellerSA and PHA have reached a cooperation, SA become a node in the PHA’s branch chain after the registration is completed, DA will assign the attribute ASA∈0,1∗ to SA, and Dm will update the structure of the access policy tree according to the attribute ASA . After that, the leader node Dm needs to update and save the new access policy tree PT∈0,1∗; Dm first saves the access policy tree locally and executes the access policy tree update smart contract mentioned in Section 5. According to Algorithm 1, TransPT=TreeplacePT,α,IDd,LabelPT will be uploaded to the blockchain to ensure that PT and the storage address TreeplacePT are not tampered with.


## 6.3. Data Encryption Stage

Dsn is a general node under PHA and is responsible for drug production. Mi is a piece of production data, and the storage address is DateplaceMi. Dsn inputs the data hash value H2Mi and DateplaceMi as the message plaintext, and DA will execute the CP-ABE encryption algorithm as follows:
(1)
DA backtracks the branch chain ofPHA and finds the latest transaction with LabelPT. Dsn gets the TransPT and verifies whether the PHA’s ID is correct and then obtains the access policy tree PTget∈0,1∗ according to the TreeplacePT and verifies that α=H1PTget; if the verification is successful, it means the access policy tree under TreeplacePT is valid and usable(2)
DA makes thePHA’s access policy tree PTA=PTget; among them, PTA’s attribute set is Ap and node set N=N1,N2,N3⋯Ny, kN is the threshold value of each node N, and then, arbitrarily select a k-degree polynomial qN, where k=kN−1; DA randomly select s∈Zp, where s is the secret value(3)
DA setqroot0=s to generate qN0=qparentNindexN recursively according to the access policy tree, where parentN is the parent node of node N and indexN is the subscript of N under the tree rooted at parentN. Dsn obtains the ciphertext: CT=C~=Mi∗eg,gαs,C=hs,∀i∈Ap:Ci=gqi0,Ci∗=H1attiqi0, where α,s,h,g have been given in the system setup step, and Ap is a set of attributes containing all attributes. The function atti is defined only if i is a leaf node and denotes the attribute associated with the leaf node i in the tree. Finally, Dsn packages it into TransCT=CT,H2CT,PTget and uploads it to the blockchain


## 6.4. Data Decryption Stage

In the decryption stage, the data applicant may be a patient who purchases the drug or a node under thePH. If the applicant is patient P, it will be registered by scanning the drug package, and the system will automatically generate a temporary attribute set Au=consumer,firstfor the patient; in the second case, the node will directly apply for the private key from DA through its attributes. The specific decryption steps to obtain the private key are as follows:
(1)
DA generates a private key for the data applicant. For each attribute in the applicant attribute setAu, DA chooses rj∈zp∗ and calculates the applicant’s private key as SKu=D=gα+r/β,∀j∈Au:Dj=grH1jrj,Dj∗=grj(2)
According to theTokendrug,IDd requested by the data applicant, the system will first lock the corresponding branch chain according to the IDd and then obtain all relevant drug data ciphertexts in the branch chain according to theTokendrug(3)
The CP-ABE decryption algorithm is executed to decrypt the ciphertext CT: letn=attri, for the leaf node i in the access policy tree and the decryption algorithm DecryptCT,D,xi=eDi,Cn/Di∗,Cn∗=eg,grqx0. For the nonleaf node i of the access policy tree, the decryption algorithm calculates DecryptCT,D,xi==eg,grs. According to the above principles and algorithms, the access policy tree is traversed from bottom to top, and the plaintext Mi=C~/eC,D/eg,grs is finally obtained(4)
Finally, the timestamp and the plaintext production data are combined with specific traceability information for consumers to verify the authenticity of the drug. If the data applicant is a patient, to prevent the second use of the drug packaging, the attributefirstwill be deleted after the first use is completed


## 7. Scheme Analysis

In this section, we perform a security analysis of our scheme with existing schemes in terms of four aspects: data security, system robustness, supervisibility, and traceability. We also compare the blockchain throughput, data query time, and blockchain consensus consumption of our approach in terms of performance. The security analysis and performance evaluation show that our scheme is secure and efficient.


### 7.1. Security Analysis

The security of the system will be analyzed. Blockchain and attribute-based encryption provide a strong security guarantee for the system. Compared with the latest solutions in Table2, our scheme has the advantages of decentralization, data privacy and security, and supervisability. Also, our proposal designs consensus mechanisms and smart contracts to strengthen the safety supervision and system robustness. In summary, the system has the following security features:
(1)
Anticollision attack: our scheme can effectively prevent collision attacks among different users. Specifically, for the secret value s of attribute-based encryption, the decryption operation DecryptCT,D,xi==eg,grs does not directly derive the secret value, thereby preventing other users from conducting collision attacks and stealing drug production data(2)
Access policy tree security: our scheme can effectively prevent the attribute secret key access policy tree from being tampered with or replaced. Assuming that there is a node of PHA is untrustworthy, it will try to change the access policy tree so that they can obtain the secret key and steal the drug data of other PHs. There may be two types of attacks against access policy trees. The first is access policy tree address tampering. In our scheme, the address of the access policy tree Treeplacenew is stored in the blockchain and according to the characteristics of the blockchain, the adversary cannot change the address of the access policy tree to another address; the second is to directly change the structure of the access policy tree. When the general node applies for the secret key, the system will find the access policy tree information PackTreeplacenew,fpT in the blockchain, obtain the Ta of the access policy tree saved under the Treeplacenew, and verify and calculate the equation H2H1Ta=fpT. Any change to the access policy tree must result in the equation being broken, thereby ensuring that the access policy tree will not be modified(3)
Nonrepudiation: in response to problematic data, the corresponding department node of the PH cannot repudiate. The witness node verifies the signature of the node before receiving the “transaction.” In addition, the structural characteristics of the blockchain ensure that the “transaction” cannot be tampered with after being on the chain. When the subsequent administration doubts about the production data, the pharmaceutical company cannot deny itTable 2
Comparison of drug traceability schemes.
ProposalArchitectureData confidentialitySmart contractRobustnessSupervisabilityTraceabilitySinclair et al. [27]Blockchain-based××××√Huang Y. et al. [32]Blockchain-based×××√√Jamil et al. [28]Blockchain-based×√××√Qi et al. [5]Centralized√×√×√OursMB-BC-based√√√√√In addition, as a distributed system with a large number of network nodes, system robustness is also one of the indicators of system security. Let us analyze the robustness of the system with some attacks:(a)
DAO attack: the DAO attack takes advantage of the fact that a smart contract cannot be changed once it is released and is not controlled by any outside entity. Once a loophole in the smart contract is discovered, it will be attacked. Our schema model can effectively resist DAO attacks. In this scheme, it is assumed that the general nodes of PH are untrustworthy, and they may use the smart contract vulnerability to carry out DAO attacks. Faced with this situation, different from the general blockchain system, each operation of the blockchain node will be attached with its verification signature, to avoid the problem of anonymous operation without accountability. On the other hand, all smart contracts are released on the branch chain. Once loopholes appear, the most serious case will only cause the branch chain of PH to stop operating. After abnormal detection, the system will scrap the branch chain and regenerate a branch chain for pH on the main chain. The branched chain will be restored to the state before the smart contract was issued, avoiding the collapse of the whole blockchain system(b)
Concentration of rights: for both PoS and DPoS, since the witness node is elected, the rights and interests tend to be concentrated in the hands of a few people. In the common DPoS mechanism, the final witness nodes are always those few nodes, which greatly affects the stability of the blockchain system. In this scheme, we have added a review mechanism into the consensus mechanism. In addition to voting, the hard work of the voted node and the source of votes will be counted into the voting proportion. This strategy enhances the fairness of consensus voting and can effectively prevent the problem of concentration of rights


### 7.2. Performance Evaluation

We simulate patientP and pharmaceutical companies PH with Java clients on a laptop with 2.40 GHz Intel(R) Core i5 processors and 8 GB memory. At the same time, we use Java language, choose Spring Boot 2.2.1 for the framework and Postman as the testing tool, and use sockets to implement p2p. The network simply builds a new blockchain structure with the main chain and branch chains. Furthermore, we wrote the smart contract in the proposal on the Ethereum platform using solidity language (a smart contract language). The smart contract was deployed on the blockchain through Truffle platform.First, we verify the feasibility of the system. We have set up three pharmaceutical companiesPHA, PHB, and PHC in the blockchain network, and each pharmaceutical company has a leader node and a general node; the size of each “transaction” is about 1 kb. Table 3 shows the initial registration time of each node in the system. It can be seen from Table 3 that the registration time is very short. The registration time of the general node is slightly longer than that of the leader node. This is mainly because compared with the registration information verification of the leader node, the work was manually reviewed by the system and was not included in the total time. Table 3 shows that the registration time of each node is within the normal range, which is feasible.Table 3
Registration time.
OperationsInvolved entitiesTime (ms)Leader department A registrationLD A/DA46.7Leader department B registrationLD B/DA46.2Leader department C registrationLD C/DA46.7General department A registrationDepartment A/DA/LD A57.8General department B registrationDepartment B/DA/LD B59.1General department C registrationDepartment C/DA/LD C57.7The size of the blockchain system is also one of the important indicators of system feasibility. Therefore, we tested the size of the blockchain. After the registration is completed, one main chain and three branch chains will be generated according to the scheme; we test the size of the blockchain under general nodeA. From the test results in Figure 5, as the number of transactions increases, the change in block size is very small. This is because node A does not need to save the blocks of the remaining branch chains and it only needs to save the branch chain hash after the update is completed. Therefore, the block size saved by node A has no obvious changes. According to the data in Figure 5, taking a general drug shelf life of three years as an example, assuming that PH generates a transaction every three seconds and the assembly line works for 12 hours a day, we can calculate that the data stored on the blockchain will not exceed 15 GB. For modern databases, it is completely acceptable. Therefore, from the perspective of block size, our scheme is completely feasible, too.Figure 5
The size of the blockchain system.In addition, we also tested the throughput of the system in Figure6. It can be seen from the figure that our system has enough throughput to handle a large number of transactions.Figure 6
Throughput of the blockchain system.The query time of data in the blockchain is one of the important indicators of the efficiency of the traceability system. As a large number of pharmaceutical companies are involved, here, we simulated the data query efficiency and compared it with the existing solutions. Among them, Sinclair et al.’s [27] scheme is based on the ordinary blockchain traceability system, and Jamil et al.’s [28] scheme improves the blockchain on the basis of the traceability system. All transactions in the experiment belong to the PH randomly, and to prevent extreme situations from happening, the number of transactions of each PH will not exceed one-third of the total number of transactions in the system.It can be seen from the result that compared with the other two schemes, with the number of transactions in the blockchain increases, the query time will become longer, and the backtracking time of our scheme is much shorter than that of the other two schemes. This is because, in our scheme, we can quickly locate the branch chain where the data is located for backtracking based on the identifier in the “transaction.” In addition, from the four pictures in Figure7 as a whole, with the increase in the number of pharmaceutical companies, the query time of our scheme is more stable than the general blockchain system and will hardly be affected. Therefore, this solution has certain advantages in query time efficiency.Figure 7
Query time of the drug data.
(a)
PH=100(b)
PH=200(c)
PH=300(d)
PH=400Also, the main time cost for the blockchain system is in the consensus phase. We compared the consensus time consumption in this solution with the other two schemes. We carried the consensus algorithms in scheme [27] and scheme [28] into this system model and operated them independently, and the results obtained are shown in Figure 8.Figure 8
Consensus cost of the blockchain system.It can be clearly seen from the figure that the efficiency advantage of this solution is more obvious when faced with a large number of transactions. For the scenario of a drug traceability platform that exists in a large number of pharmaceutical companies, the transaction volume in the system is huge, so it fits this scenario very well.As shown in Figure9, changes in the number of PH will also affect consensus cost. The reason can be that when there are too many PHs and the transaction volume is small, the block generation conditions are not met, which leads to a decrease in the efficiency of block generation. When the number of transactions increases, the consensus consumption will stabilize. When the number of PH increases, the system can still operate stably and has little impact on consensus consumption, which can meet system requirements perfectly.Figure 9
Consensus cost of the blockchain system.


## 7.1. Security Analysis

The security of the system will be analyzed. Blockchain and attribute-based encryption provide a strong security guarantee for the system. Compared with the latest solutions in Table2, our scheme has the advantages of decentralization, data privacy and security, and supervisability. Also, our proposal designs consensus mechanisms and smart contracts to strengthen the safety supervision and system robustness. In summary, the system has the following security features:
(1)
Anticollision attack: our scheme can effectively prevent collision attacks among different users. Specifically, for the secret value s of attribute-based encryption, the decryption operation DecryptCT,D,xi==eg,grs does not directly derive the secret value, thereby preventing other users from conducting collision attacks and stealing drug production data(2)
Access policy tree security: our scheme can effectively prevent the attribute secret key access policy tree from being tampered with or replaced. Assuming that there is a node of PHA is untrustworthy, it will try to change the access policy tree so that they can obtain the secret key and steal the drug data of other PHs. There may be two types of attacks against access policy trees. The first is access policy tree address tampering. In our scheme, the address of the access policy tree Treeplacenew is stored in the blockchain and according to the characteristics of the blockchain, the adversary cannot change the address of the access policy tree to another address; the second is to directly change the structure of the access policy tree. When the general node applies for the secret key, the system will find the access policy tree information PackTreeplacenew,fpT in the blockchain, obtain the Ta of the access policy tree saved under the Treeplacenew, and verify and calculate the equation H2H1Ta=fpT. Any change to the access policy tree must result in the equation being broken, thereby ensuring that the access policy tree will not be modified(3)
Nonrepudiation: in response to problematic data, the corresponding department node of the PH cannot repudiate. The witness node verifies the signature of the node before receiving the “transaction.” In addition, the structural characteristics of the blockchain ensure that the “transaction” cannot be tampered with after being on the chain. When the subsequent administration doubts about the production data, the pharmaceutical company cannot deny itTable 2
Comparison of drug traceability schemes.
ProposalArchitectureData confidentialitySmart contractRobustnessSupervisabilityTraceabilitySinclair et al. [27]Blockchain-based××××√Huang Y. et al. [32]Blockchain-based×××√√Jamil et al. [28]Blockchain-based×√××√Qi et al. [5]Centralized√×√×√OursMB-BC-based√√√√√In addition, as a distributed system with a large number of network nodes, system robustness is also one of the indicators of system security. Let us analyze the robustness of the system with some attacks:(a)
DAO attack: the DAO attack takes advantage of the fact that a smart contract cannot be changed once it is released and is not controlled by any outside entity. Once a loophole in the smart contract is discovered, it will be attacked. Our schema model can effectively resist DAO attacks. In this scheme, it is assumed that the general nodes of PH are untrustworthy, and they may use the smart contract vulnerability to carry out DAO attacks. Faced with this situation, different from the general blockchain system, each operation of the blockchain node will be attached with its verification signature, to avoid the problem of anonymous operation without accountability. On the other hand, all smart contracts are released on the branch chain. Once loopholes appear, the most serious case will only cause the branch chain of PH to stop operating. After abnormal detection, the system will scrap the branch chain and regenerate a branch chain for pH on the main chain. The branched chain will be restored to the state before the smart contract was issued, avoiding the collapse of the whole blockchain system(b)
Concentration of rights: for both PoS and DPoS, since the witness node is elected, the rights and interests tend to be concentrated in the hands of a few people. In the common DPoS mechanism, the final witness nodes are always those few nodes, which greatly affects the stability of the blockchain system. In this scheme, we have added a review mechanism into the consensus mechanism. In addition to voting, the hard work of the voted node and the source of votes will be counted into the voting proportion. This strategy enhances the fairness of consensus voting and can effectively prevent the problem of concentration of rights


## 7.2. Performance Evaluation

We simulate patientP and pharmaceutical companies PH with Java clients on a laptop with 2.40 GHz Intel(R) Core i5 processors and 8 GB memory. At the same time, we use Java language, choose Spring Boot 2.2.1 for the framework and Postman as the testing tool, and use sockets to implement p2p. The network simply builds a new blockchain structure with the main chain and branch chains. Furthermore, we wrote the smart contract in the proposal on the Ethereum platform using solidity language (a smart contract language). The smart contract was deployed on the blockchain through Truffle platform.First, we verify the feasibility of the system. We have set up three pharmaceutical companiesPHA, PHB, and PHC in the blockchain network, and each pharmaceutical company has a leader node and a general node; the size of each “transaction” is about 1 kb. Table 3 shows the initial registration time of each node in the system. It can be seen from Table 3 that the registration time is very short. The registration time of the general node is slightly longer than that of the leader node. This is mainly because compared with the registration information verification of the leader node, the work was manually reviewed by the system and was not included in the total time. Table 3 shows that the registration time of each node is within the normal range, which is feasible.Table 3
Registration time.
OperationsInvolved entitiesTime (ms)Leader department A registrationLD A/DA46.7Leader department B registrationLD B/DA46.2Leader department C registrationLD C/DA46.7General department A registrationDepartment A/DA/LD A57.8General department B registrationDepartment B/DA/LD B59.1General department C registrationDepartment C/DA/LD C57.7The size of the blockchain system is also one of the important indicators of system feasibility. Therefore, we tested the size of the blockchain. After the registration is completed, one main chain and three branch chains will be generated according to the scheme; we test the size of the blockchain under general nodeA. From the test results in Figure 5, as the number of transactions increases, the change in block size is very small. This is because node A does not need to save the blocks of the remaining branch chains and it only needs to save the branch chain hash after the update is completed. Therefore, the block size saved by node A has no obvious changes. According to the data in Figure 5, taking a general drug shelf life of three years as an example, assuming that PH generates a transaction every three seconds and the assembly line works for 12 hours a day, we can calculate that the data stored on the blockchain will not exceed 15 GB. For modern databases, it is completely acceptable. Therefore, from the perspective of block size, our scheme is completely feasible, too.Figure 5
The size of the blockchain system.In addition, we also tested the throughput of the system in Figure6. It can be seen from the figure that our system has enough throughput to handle a large number of transactions.Figure 6
Throughput of the blockchain system.The query time of data in the blockchain is one of the important indicators of the efficiency of the traceability system. As a large number of pharmaceutical companies are involved, here, we simulated the data query efficiency and compared it with the existing solutions. Among them, Sinclair et al.’s [27] scheme is based on the ordinary blockchain traceability system, and Jamil et al.’s [28] scheme improves the blockchain on the basis of the traceability system. All transactions in the experiment belong to the PH randomly, and to prevent extreme situations from happening, the number of transactions of each PH will not exceed one-third of the total number of transactions in the system.It can be seen from the result that compared with the other two schemes, with the number of transactions in the blockchain increases, the query time will become longer, and the backtracking time of our scheme is much shorter than that of the other two schemes. This is because, in our scheme, we can quickly locate the branch chain where the data is located for backtracking based on the identifier in the “transaction.” In addition, from the four pictures in Figure7 as a whole, with the increase in the number of pharmaceutical companies, the query time of our scheme is more stable than the general blockchain system and will hardly be affected. Therefore, this solution has certain advantages in query time efficiency.Figure 7
Query time of the drug data.
(a)
PH=100(b)
PH=200(c)
PH=300(d)
PH=400Also, the main time cost for the blockchain system is in the consensus phase. We compared the consensus time consumption in this solution with the other two schemes. We carried the consensus algorithms in scheme [27] and scheme [28] into this system model and operated them independently, and the results obtained are shown in Figure 8.Figure 8
Consensus cost of the blockchain system.It can be clearly seen from the figure that the efficiency advantage of this solution is more obvious when faced with a large number of transactions. For the scenario of a drug traceability platform that exists in a large number of pharmaceutical companies, the transaction volume in the system is huge, so it fits this scenario very well.As shown in Figure9, changes in the number of PH will also affect consensus cost. The reason can be that when there are too many PHs and the transaction volume is small, the block generation conditions are not met, which leads to a decrease in the efficiency of block generation. When the number of transactions increases, the consensus consumption will stabilize. When the number of PH increases, the system can still operate stably and has little impact on consensus consumption, which can meet system requirements perfectly.Figure 9
Consensus cost of the blockchain system.


## 8. Conclusion

In this paper, we proposed a multibranch blockchain (MC-BC) drug traceability and supervision system scheme. MC-BC separated the pharmaceutical companies through branch chains. The structure of the main chain and branch chains was not only conducive to departmental regulatory review but could also greatly reduce the traceability time of drug data. In addition, in this model, we made improvements to DPoS to meet the needs of the drug supply chain by adding review and punishment mechanisms. At the same time, we adopted the combination of CP-ABE technology and smart contracts to realize the privacy of drug data and provided fine-grained access control rights in real time. Meanwhile, experiments and performance evaluations were conducted to prove that our scheme is efficient and feasible.For future work, we will further improve the trust mechanism and reward mechanism of the blockchain system and expand the existing system functions.



---

*Source: 5163003-2022-07-25.xml*