# A Privacy-Preserving Data Transmission Scheme Based on Oblivious Transfer and Blockchain Technology in the Smart Healthcare

Authors: Huijie Yang; Jian Shen; Junqing Lu; Tianqi Zhou; Xueya Xia; Sai Ji
Journal: Security and Communication Networks
 (2021)

---

## Abstract

With the development of the Internet of Things and the demand for telemedicine, the smart healthcare system has attracted much attention in recent years. As a platform for medical data interaction, the smart healthcare system is demanded to ensure the privacy of both the receiver and the sender, as well as the security of data transmission. In this paper, we propose a privacy-preserving data transmission scheme where both secure ciphertext conversion and malicious users identification are supported. In particular, theOTmn protocol is introduced to guarantee the two-way privacy of communication parties. Meanwhile, we adopt proxy reencryption algorithm to support secure ciphertext conversion so as to ensure the confidentiality of data in many-to-many communication pattern. In addition, by taking advantage of the concept of blockchain technology, a novel OTmn protocol is proposed to prevent data from being tampered with and effectively identify malicious users. Theoretical and experimental analyses indicate that the proposed scheme is practical for smart healthcare with high security and efficiency.


---

## Body

## 1. Introduction

With the extension of average life expectancy and people’s increasing demand for health, the demand for smart healthcare systems such as telemedicine and e-health system is more and more urgent [1–3]. The smart healthcare system is an IoT health system composed of cloud computing, smart wearable devices, an expert system based on artificial intelligence, and so on [4–6]. The deep learning technology and data mining technology also promote the development of smart healthcare system [7, 8], which is convenient for doctors to quickly diagnose diseases and formulate medical plans and to ensure that everyone can get adequate medical resources [9]. In addition, some scholars introduce blockchain technology into the smart healthcare environment [10–12]. They utilize the characteristics of blockchain such as decentralization and antitampering to design the smart healthcare schemes. Those schemes can realize data sharing and ensure the confidentiality and correctness of the data. During the research, scholars discovered that there were two security challenges in the process of medical data transmission [13, 14]: The first is how to ensure the confidentiality of medical data during the interaction; that is, malicious users cannot obtain or tamper with the data. The second is how to realize the two-way privacy protection between the server and the client side. Therefore, we need to discuss and solve the above two security challenges in this paper.Consider the following situation: the patient who suffers from many diseases goes to different specialist hospitals for treatment, and so many medical records are stored by different servers of hospitals that are not connected in the same network. That is, it is difficult for doctors to obtain the data across the different networks. To settle the mentioned problem, we suppose that all the data are stored in the same server. However, all data in this server are returned to the doctor when he employs the oblivious transfer (OT) protocol to request the data, which leads to the high communication overhead. Thus, we assume that all data are stored in the distributed server, and the users, hospitals, and also servers are all in the smart healthcare system, where the patients’ records can be accessed by the departments’ doctors from the different hospitals. In fact, the stored data are susceptible to collusion or tampering because of the semitrusted server. The confidentiality of stored data cannot be ensured when users employ those data. Additionally, a user employs the amount of data to request it from the server, which can try to understand the corresponding relationship between the sequence number and the stored data. Some researchers utilize the oblivious random access memory (ORAM) protocol [15] to hide that relationship [16, 17]. Meanwhile, it is only applied to some simple systems due to its complex ORAM structure and the great increase in cost overheads. Thus, how to ensure that the server makes users know the data without knowing the serial number is one of the main contents of our scheme. Moreover, the public keys of the distributed servers are different for users owing to those servers which belonged to different hospitals. In view of the above, the data in such servers can be comprehended by users, which exposes the privacy of stored data. Then, some data are attacked by malicious users to focus on, in accordance with that private information. What is more, the authorities of the user can be faked or tampered with by the revoked or malicious users who can collude the data.Motivation of This Paper. As is mentioned above, the existing data transmission schemes are not suitable for the smart healthcare environment. Therefore, our goals are to protect user privacy and guarantee the security of data transmission based on OT and blockchain technology under the smart healthcare environment. To accomplish this goal, the three following crucial issues should be considered for us. First, the confidentiality of data should be assured during the process of data transmission. The medical data are related to the life safety of patients; once they are tampered with or faked, this will endanger the lives of patients and put the hospital in financial compensation. Second, while guaranteeing that a piece of accessed data is not known by the server, the other data in it cannot be learned by the user. In addition, the stored data in such servers cannot be figured out. In case of reveal, the privacy of stored data may be leaked out. Finally, the revoked or malicious users who try to collude should be discerned by the group manager. They will go beyond their authority to access data or modify medical data, leading to medical accidents in the hospital.


### 1.1. Main Contributions

We design a privacy-preserving scheme for data transmission based on oblivious transfer and blockchain technology in the smart healthcare environment which is to resolve the above issues. The main contributions are as follows:(1)
A novelOTmn protocol supporting two-way privacy-preserving and distributed servers is proposed. Suppose that u1 data is stored in multiple servers. Once a doctor requires u1 data, he needs to employ many private keys of servers to decrypt those ciphertexts. In that way, the privacy of servers where the data is stored will be exposed. By applying this novel OTmn protocol, a doctor can decrypt all the ciphertexts with only his key. In other words, this protocol not only queries data quickly but also protects the privacy of servers and doctors. In addition, the proposed OTmn protocol can efficiently support the access control of users and many-to-many data transmission pattern.(2)
A secure data transmission scheme supporting collusion resistance and to prevent data from being tampered with is proposed. Our scheme is a data secure transmission protocol based on blockchain technology and OT technology. We utilize the characteristics of blockchain structure to store the user’s identity in blocks and then form three lists, namely, patient identity list, doctor identity list, and revocation user list. Therefore, our protocol can effectively verify revocation or malicious users and resist their collusion attacks. Meanwhile, in terms of the hash value in blockchain, malicious users cannot modify the data.(3)
Data confidentiality is guaranteed and the computation of our scheme is effectively reduced. We analyze and prove the security of the proposed scheme. We provide a performance comparison betweenOTmn protocol and other OTnk protocols through a theoretical performance analysis and an experimental analysis.


### 1.2. Related Work

Oblivious transfer (OT) has gradually become an important research direction in the field of multiparty computation (MPC). At present, according to the total amount of data and the number of choices, the research of OT protocol is mainly divided into four categories: classical oblivious transfer protocol [18], 1-out-of-2 oblivious transfer OT21 protocol [19], 1-out-of-n oblivious transfer OTn1 protocol [20], and k-out-of-n oblivious transfer OTnk protocol [21].OTn1 protocol was proposed by Brassard et al. [20] firstly in 1986; they invoked OT21 protocol n times to implement OTn1 protocol. On the basis of the above, Gertner et al. [22] firstly achieved a distributed version of OTn1 protocol with information-theoretic security and sublinear communication complexity. In 2001, Naor et al. [23] described a novel OTn1 protocol, which improved the efficiency of multiple invocations of OT applications. In 2004, Tzeng [24] designed a secure and efficient OTn1 protocol under the assumption of the decisional Diffie-Hellman problem. After that, based on the above, an adaptive k-out-of-n oblivious transfer scheme was proposed by Chu and Tzeng [25], which allowed the receiver to choose the messages one by one adaptively. In 2015, the simplest and most efficient protocol for OTn1 protocol was presented by Chou et al. [26] and it could resist some active attacks. Then, in 2007, Hauck et al. [27] proposed an OTn1 protocol under the CDH assumption, which was built on ideas from the CO protocol. In 2020, Wang et al. [28] presented an OTn1 protocol and the Private Set Intersection (PSI) protocol to protect user privacy in the case of VANET feature matching.OTnk protocol was proposed by Bellare et al. [21] firstly in 1989, where a receiver could select and receive multiple ciphertexts at one time. Naor et al. [29] described a novel construction for OTnk protocol which is more efficient than k repetitions of OTn1 protocol. Then, the classical and universal OTnk protocol was designed by Naor et al. [23]. In 2005, an OTnk protocol with adaptive queries was proposed by Naro et al. [30], and it was considerably more efficient than k repetitions of OTn1 protocol. After that, Chu et al. [31] proposed several two-round OTnk protocols under the decisional Diffie-Hellman problem, in which a receiver sent Ok data to a sender and he returned On data. In 2010, a secure and low-bandwidth-consumption OTnk scheme based on bilinear pairings was proposed by Chen et al. [32]. A novel OTnk protocol for private information retrieval which was more suitable for smart cities was presented by Lou et al. [33]. In 2018, Lai el al. [34] proposed an OTnk scheme with the least communication cost, which preserved a sender’s security and the privacy of a receiver’s choice.What is more, some researchers have integrated OT technology into blockchain scheme in order to solve the problem of easy exposure of private data in the blockchain. In 2017, Hsiao et al. [35] combined the advantages and properties of blockchain and secret sharing scheme, Paillier’s homomorphic encryption, and oblivious transfer to construct a decentralized e-voting system. This scheme could protect the anonymity of voter’s identity, the privacy of data transmission, and verifiability of ballots during the billing phase. In 2019, Tso et al. [36] proposed the decentralized electronic voting and bidding systems based on a blockchain and smart contract, which uses cryptographic techniques such as oblivious transfer and homomorphic encryptions to improve privacy protection. Then, in 2021, Li et al. [37] presented a fair scheme for big data exchanging that allows buyers and sellers to autonomously and fairly complete transactions, without involving any third-party middle person. This scheme employed OT technology to preserve the privacy of transactions.


### 1.3. Organization

The structure of the paper is organized as follows. Some preliminaries in cryptographic are presented in Section2. The system model, design goals, and threat model are described in Section 3. The proposed scheme is introduced in detail in Section 4. The security and performance analyses are provided in Sections 5 and 6, respectively. Section 7 concludes this paper and our work.


## 1.1. Main Contributions

We design a privacy-preserving scheme for data transmission based on oblivious transfer and blockchain technology in the smart healthcare environment which is to resolve the above issues. The main contributions are as follows:(1)
A novelOTmn protocol supporting two-way privacy-preserving and distributed servers is proposed. Suppose that u1 data is stored in multiple servers. Once a doctor requires u1 data, he needs to employ many private keys of servers to decrypt those ciphertexts. In that way, the privacy of servers where the data is stored will be exposed. By applying this novel OTmn protocol, a doctor can decrypt all the ciphertexts with only his key. In other words, this protocol not only queries data quickly but also protects the privacy of servers and doctors. In addition, the proposed OTmn protocol can efficiently support the access control of users and many-to-many data transmission pattern.(2)
A secure data transmission scheme supporting collusion resistance and to prevent data from being tampered with is proposed. Our scheme is a data secure transmission protocol based on blockchain technology and OT technology. We utilize the characteristics of blockchain structure to store the user’s identity in blocks and then form three lists, namely, patient identity list, doctor identity list, and revocation user list. Therefore, our protocol can effectively verify revocation or malicious users and resist their collusion attacks. Meanwhile, in terms of the hash value in blockchain, malicious users cannot modify the data.(3)
Data confidentiality is guaranteed and the computation of our scheme is effectively reduced. We analyze and prove the security of the proposed scheme. We provide a performance comparison betweenOTmn protocol and other OTnk protocols through a theoretical performance analysis and an experimental analysis.


## 1.2. Related Work

Oblivious transfer (OT) has gradually become an important research direction in the field of multiparty computation (MPC). At present, according to the total amount of data and the number of choices, the research of OT protocol is mainly divided into four categories: classical oblivious transfer protocol [18], 1-out-of-2 oblivious transfer OT21 protocol [19], 1-out-of-n oblivious transfer OTn1 protocol [20], and k-out-of-n oblivious transfer OTnk protocol [21].OTn1 protocol was proposed by Brassard et al. [20] firstly in 1986; they invoked OT21 protocol n times to implement OTn1 protocol. On the basis of the above, Gertner et al. [22] firstly achieved a distributed version of OTn1 protocol with information-theoretic security and sublinear communication complexity. In 2001, Naor et al. [23] described a novel OTn1 protocol, which improved the efficiency of multiple invocations of OT applications. In 2004, Tzeng [24] designed a secure and efficient OTn1 protocol under the assumption of the decisional Diffie-Hellman problem. After that, based on the above, an adaptive k-out-of-n oblivious transfer scheme was proposed by Chu and Tzeng [25], which allowed the receiver to choose the messages one by one adaptively. In 2015, the simplest and most efficient protocol for OTn1 protocol was presented by Chou et al. [26] and it could resist some active attacks. Then, in 2007, Hauck et al. [27] proposed an OTn1 protocol under the CDH assumption, which was built on ideas from the CO protocol. In 2020, Wang et al. [28] presented an OTn1 protocol and the Private Set Intersection (PSI) protocol to protect user privacy in the case of VANET feature matching.OTnk protocol was proposed by Bellare et al. [21] firstly in 1989, where a receiver could select and receive multiple ciphertexts at one time. Naor et al. [29] described a novel construction for OTnk protocol which is more efficient than k repetitions of OTn1 protocol. Then, the classical and universal OTnk protocol was designed by Naor et al. [23]. In 2005, an OTnk protocol with adaptive queries was proposed by Naro et al. [30], and it was considerably more efficient than k repetitions of OTn1 protocol. After that, Chu et al. [31] proposed several two-round OTnk protocols under the decisional Diffie-Hellman problem, in which a receiver sent Ok data to a sender and he returned On data. In 2010, a secure and low-bandwidth-consumption OTnk scheme based on bilinear pairings was proposed by Chen et al. [32]. A novel OTnk protocol for private information retrieval which was more suitable for smart cities was presented by Lou et al. [33]. In 2018, Lai el al. [34] proposed an OTnk scheme with the least communication cost, which preserved a sender’s security and the privacy of a receiver’s choice.What is more, some researchers have integrated OT technology into blockchain scheme in order to solve the problem of easy exposure of private data in the blockchain. In 2017, Hsiao et al. [35] combined the advantages and properties of blockchain and secret sharing scheme, Paillier’s homomorphic encryption, and oblivious transfer to construct a decentralized e-voting system. This scheme could protect the anonymity of voter’s identity, the privacy of data transmission, and verifiability of ballots during the billing phase. In 2019, Tso et al. [36] proposed the decentralized electronic voting and bidding systems based on a blockchain and smart contract, which uses cryptographic techniques such as oblivious transfer and homomorphic encryptions to improve privacy protection. Then, in 2021, Li et al. [37] presented a fair scheme for big data exchanging that allows buyers and sellers to autonomously and fairly complete transactions, without involving any third-party middle person. This scheme employed OT technology to preserve the privacy of transactions.


## 1.3. Organization

The structure of the paper is organized as follows. Some preliminaries in cryptographic are presented in Section2. The system model, design goals, and threat model are described in Section 3. The proposed scheme is introduced in detail in Section 4. The security and performance analyses are provided in Sections 5 and 6, respectively. Section 7 concludes this paper and our work.


## 2. Preliminaries

### 2.1. Proxy Reencryption Technology

We adopt the key-private proxy reencryption scheme which was proposed by Ateniese et al. [38]. This algorithm applies proxy reencryption technology to achieve ciphertext conversion, which converts a ciphertext ma of ua to a ciphertext mb of ub. The specific design of this scheme is as follows.(i)
Step 1.Setup1k⟶par: This is the initialization phase for generating parameters. Input security parameter 1k and then the public parameters par are output by this algorithm.(ii)
Step 2.KeyGenpar⟶pk,sk: This algorithm is applied to generate the public-private key pair for users. Public parameter par is input, and then the key pair pk,sk is produced for users.(iii)
Step 3.Encpar,pka,m⟶ma: This algorithm is employed to encrypt the message via a public key pka from ua. pka and message m are input, and then an original ciphertext ma is produced by this algorithm.(iv)
Step 4.Re−KeyGenpar,ska,pkb⟶rka⟶b: This algorithm generates the conversion key, which realizes the transformation from ma to mb. A private key ska of ua and a public key pkb of ub (a≠b) are provided, and the conversion key rka⟶b is output. This phase is crucial for reencryption data.(v)
Step 5.Re−Encpar,rka⟶b,ma⟶mb: To gain the transfer message mb, this algorithm utilizes the conversion key rka⟶b to reencrypt a message ma. Input A reencryption key and an original ciphertext are input, and then a reencryption ciphertext mb from a to b is output.(vi)
Step 6.Decpar,ska,ma⟶m: Finally, a private key ska and a ciphertext ma are provided; this algorithm can compute a plaintext m.


### 2.2. Oblivious Transfer Protocols

The concept of OT was first proposed by Rabin [18] in 1981. In Rabin’s protocol, the sender only wanted the receiver to get the message he chooses, and the receiver did not want the sender to know about other messages, which guaranteed the privacy of both parties. Then, the 1-out-of-2 data transmission protocol under the semihonest model through three public key cryptography operations was implemented by Naro and Pinkas [23]. The steps of OT12 protocol are as follows:(i)
Setup: The system generates two prime ordersq and p, where q|p−1 holds. Gp is a p-order subgroup of ℤp∗; and the system sets g as the generator of ℤp∗.(ii)
Input: The sender inputsX0,X1, and receiver inputs r.(iii)
Output: The receiver outputsXr.(a)
Step 1. The sender generates a random numberC and a, computes ga and Ca, and broadcasts C.(b)
Step 2. The receiver generates a random numberk1≤k≤q; and two public keys pkr and pk1−r are generated, where pkr=gk and pk1−r=C/gk hold. Then, the number pk0 is sent to the sender.(c)
Step 3. The sender calculatespk0a and pk1a=Ca/pk0a. At the same time, he encrypts the data X0,X1, respectively. The equations are as follows:(1)E0=ga,hashpk0a⊕x0,E1=ga,hashpk1a⊕x1.(d)
Step 4. The receiver computeshashpkra=hashgak and xr; that is,(2)Er=hashpkra,r⊕xr⊕hashpkra,r.The concept ofOTkn protocol is presented as follows. The sender encrypts the n secret messages M0,M1,…,Mn−1 and sends them to the receiver; and the receiver can only recover k of them:(3)Mα1,Mα1,…,Mαk,where α1,…,αk∈ℤp∗ holds. However, the receiver cannot determine which Mα1, Mα1,…,Mαk from M0,M1,…,Mn−1 are required.


### 2.3. Blockchain Technology

Blockchain is a kind of ledger technology that is jointly maintained by multiple parties, can achieve consistent data storage, is difficult to tamper with, and prevents denial [39, 40]. It has also become a distributed ledger technology. The blockchain is classified into the permissioned blockchain and the unlicensed blockchain according to whether the system has the node access mechanism. The fabric is employed in our paper, which belongs to the consortium Blockchain and is also the first distributed system of blockchain with an access mechanism [41]. Fabric is a modular, extensible, general-purpose blockchain with an access mechanism that supports the execution of distributed applications written in standard programming languages. The key components of fabric are as follows [42].(i)
Peers: There are four kinds of peers in Fabric.(a)
Committing peer: Each peer in the channel is the committing peer. It receives the generated transaction block, obtains the block structure, and verifies the legitimacy of the block structure.(b)
Endorsing peer: The client application must use its smart contract to complete the verification of the transaction, simulate the operation of the transaction, and generate a transaction response containing a digital signature.(c)
Leader peer: When the channel has multiple peers, the leader peer is responsible for distributing transactions from the ordering peer to other committing peers.(d)
Anchor peer: It helps to communicate with peers in other organizations.(ii)
Channel: The channel includes many authorized users, and each user can belong to different channels.(iii)
Consensus mechanism: It is defined as the comprehensive verification of the correctness of the blockchain transaction. It includes the SOLO, Kafka, PBFT, and SBFT.


## 2.1. Proxy Reencryption Technology

We adopt the key-private proxy reencryption scheme which was proposed by Ateniese et al. [38]. This algorithm applies proxy reencryption technology to achieve ciphertext conversion, which converts a ciphertext ma of ua to a ciphertext mb of ub. The specific design of this scheme is as follows.(i)
Step 1.Setup1k⟶par: This is the initialization phase for generating parameters. Input security parameter 1k and then the public parameters par are output by this algorithm.(ii)
Step 2.KeyGenpar⟶pk,sk: This algorithm is applied to generate the public-private key pair for users. Public parameter par is input, and then the key pair pk,sk is produced for users.(iii)
Step 3.Encpar,pka,m⟶ma: This algorithm is employed to encrypt the message via a public key pka from ua. pka and message m are input, and then an original ciphertext ma is produced by this algorithm.(iv)
Step 4.Re−KeyGenpar,ska,pkb⟶rka⟶b: This algorithm generates the conversion key, which realizes the transformation from ma to mb. A private key ska of ua and a public key pkb of ub (a≠b) are provided, and the conversion key rka⟶b is output. This phase is crucial for reencryption data.(v)
Step 5.Re−Encpar,rka⟶b,ma⟶mb: To gain the transfer message mb, this algorithm utilizes the conversion key rka⟶b to reencrypt a message ma. Input A reencryption key and an original ciphertext are input, and then a reencryption ciphertext mb from a to b is output.(vi)
Step 6.Decpar,ska,ma⟶m: Finally, a private key ska and a ciphertext ma are provided; this algorithm can compute a plaintext m.


## 2.2. Oblivious Transfer Protocols

The concept of OT was first proposed by Rabin [18] in 1981. In Rabin’s protocol, the sender only wanted the receiver to get the message he chooses, and the receiver did not want the sender to know about other messages, which guaranteed the privacy of both parties. Then, the 1-out-of-2 data transmission protocol under the semihonest model through three public key cryptography operations was implemented by Naro and Pinkas [23]. The steps of OT12 protocol are as follows:(i)
Setup: The system generates two prime ordersq and p, where q|p−1 holds. Gp is a p-order subgroup of ℤp∗; and the system sets g as the generator of ℤp∗.(ii)
Input: The sender inputsX0,X1, and receiver inputs r.(iii)
Output: The receiver outputsXr.(a)
Step 1. The sender generates a random numberC and a, computes ga and Ca, and broadcasts C.(b)
Step 2. The receiver generates a random numberk1≤k≤q; and two public keys pkr and pk1−r are generated, where pkr=gk and pk1−r=C/gk hold. Then, the number pk0 is sent to the sender.(c)
Step 3. The sender calculatespk0a and pk1a=Ca/pk0a. At the same time, he encrypts the data X0,X1, respectively. The equations are as follows:(1)E0=ga,hashpk0a⊕x0,E1=ga,hashpk1a⊕x1.(d)
Step 4. The receiver computeshashpkra=hashgak and xr; that is,(2)Er=hashpkra,r⊕xr⊕hashpkra,r.The concept ofOTkn protocol is presented as follows. The sender encrypts the n secret messages M0,M1,…,Mn−1 and sends them to the receiver; and the receiver can only recover k of them:(3)Mα1,Mα1,…,Mαk,where α1,…,αk∈ℤp∗ holds. However, the receiver cannot determine which Mα1, Mα1,…,Mαk from M0,M1,…,Mn−1 are required.


## 2.3. Blockchain Technology

Blockchain is a kind of ledger technology that is jointly maintained by multiple parties, can achieve consistent data storage, is difficult to tamper with, and prevents denial [39, 40]. It has also become a distributed ledger technology. The blockchain is classified into the permissioned blockchain and the unlicensed blockchain according to whether the system has the node access mechanism. The fabric is employed in our paper, which belongs to the consortium Blockchain and is also the first distributed system of blockchain with an access mechanism [41]. Fabric is a modular, extensible, general-purpose blockchain with an access mechanism that supports the execution of distributed applications written in standard programming languages. The key components of fabric are as follows [42].(i)
Peers: There are four kinds of peers in Fabric.(a)
Committing peer: Each peer in the channel is the committing peer. It receives the generated transaction block, obtains the block structure, and verifies the legitimacy of the block structure.(b)
Endorsing peer: The client application must use its smart contract to complete the verification of the transaction, simulate the operation of the transaction, and generate a transaction response containing a digital signature.(c)
Leader peer: When the channel has multiple peers, the leader peer is responsible for distributing transactions from the ordering peer to other committing peers.(d)
Anchor peer: It helps to communicate with peers in other organizations.(ii)
Channel: The channel includes many authorized users, and each user can belong to different channels.(iii)
Consensus mechanism: It is defined as the comprehensive verification of the correctness of the blockchain transaction. It includes the SOLO, Kafka, PBFT, and SBFT.


## 3. Problem Statement

### 3.1. System Model

Our proposed scheme can be utilized to securely transfer data and also realize the privacy-preserving of the clients and servers. On the one hand, the private information of client side is protected. That is, a user has permission in virtue of the data’s serial number to access data, yet he does not know which server the data is stored in. On the other hand, the private information of servers is protected. That is, a user only can obtain the requested data, and the other data are cannot be learned. This scheme is mainly designed in accordance with the actual situation of the smart healthcare environment. Both doctors and other healthcare workers look forward to acquiring treatment records about a patient in all hospitals as soon as possible. Moreover, the confidentiality of data can be ensured in our scheme, in which a user employs his private key to decrypt the stored data in servers rather than private keys of servers. In addition, this scheme also resists collusion attacks by revoked or malicious users. The system model contains three entities, doctors/ patients (client side), a proxy (blockchain), and servers. Figure1 shows a system model of the proposed scheme.Figure 1
The system model of our scheme.A patient cures his diseases in different hospitals or in the same hospitals. In general, the data is stored in the nearest server, which is a server of the current hospital. This means that if a patient has seen a disease in different hospitals, multiple servers (different hospitals) store the patient’s data. Our scheme implements a many-to-many model with users and servers. Firstly, doctors and patients register their identities with the blockchain. The blockchain generates a list of user identities and a list of revoked users so that it can verify their identities. Secondly, a doctor uses the private key of user to encrypt the medical records and then uploads them to a server of his hospital. When a patient goes to a hospital to treat his heart disease, his doctor of this department can gain his past medical records in servers. Thirdly, a doctor sends a request to blockchain for obtaining a patient’s records. The blockchain verifies and checks his identity. If yes, the ciphertext encrypted with the patient’s key needs to be converted into ciphertext which can be decrypted by doctors. The patient and blockchain run the encryption phase to complete the transformation of ciphertext. Fourthly, the blockchain transmits a request which includes some serial numbers of data to servers. Only servers that store the corresponding data respond to that request. Finally, the OT protocol is implemented between the doctor and the server to transmit and decrypt the request data.


### 3.2. Threat Model

In this section, the security goals and the security models forOTmn are provided.Definition 1.
A secure and privacy-preservingOTmn protocol should satisfy the following requirements:(1)
TheOTmn protocol should protect the privacy of servers; namely, the users cannot obtain data from the server other than what they requested.(2)
TheOTmn protocol should protect the privacy of users; namely, the servers cannot figure out what data the users access.
The security model for server privacy of theOTmn protocol is described as follows. In this model, adversary A plays the role of users and challenger C plays the role of servers (the servers are trusted). The advantage of A to break the server privacy is defined as follows:(4)AdvA=PrAwins.(i)
Setup: The system generates system parameters and sends the private keys to the blockchain. Then the blockchain generates several necessary parameters for servers. AdversaryA chooses j data that it can access and chooses the corresponding aj from ℤp∗. Adversary A outputs its target tt∉j. Then, the blockchain sends corresponding Dj to adversary A and the servers send all ciphertexts ci.(ii)
Hash Query: AdversaryA can query the hash value via this oracle. It takes as input information and outputs hash value.(iii)
Decrypt Query: AdversaryA can query plaintext mi of ciphertext ci but not ciphertext ct.(iv)
Decrypt: AdversaryA outputs plaintext mt. If mt is right, adversary A breaks the server privacy of the OTmn protocol.
The security model for user privacy of theOTmn protocol is described as follows. In this model, adversary A plays the role of servers and the challenger plays the role of users (the users are trusted). The advantage of A to break the server privacy is defined as follows:(5)AdvA=PrAwins−12.(i)
Setup: The system generates system parameters and sends the private keys to the blockchain. Then the blockchain generates several necessary parameters for adversaryA. The users choose j data that they can access and choose corresponding aj from ℤp∗. Then, the blockchain sends corresponding Dj to the users and the servers sends all ciphertexts ci. Adversary A outputs its target t0,t1t0,t1∈j.(ii)
Hash Query: AdversaryA can query the hash value via this oracle. It takes as input information and outputs hash value.(iii)
Challenge: The user selectsb←R0,1 and outputs Atb and Dtb.(iv)
Guess: AdversaryA outputs b∗. If b=b∗, A wins.


## 3.1. System Model

Our proposed scheme can be utilized to securely transfer data and also realize the privacy-preserving of the clients and servers. On the one hand, the private information of client side is protected. That is, a user has permission in virtue of the data’s serial number to access data, yet he does not know which server the data is stored in. On the other hand, the private information of servers is protected. That is, a user only can obtain the requested data, and the other data are cannot be learned. This scheme is mainly designed in accordance with the actual situation of the smart healthcare environment. Both doctors and other healthcare workers look forward to acquiring treatment records about a patient in all hospitals as soon as possible. Moreover, the confidentiality of data can be ensured in our scheme, in which a user employs his private key to decrypt the stored data in servers rather than private keys of servers. In addition, this scheme also resists collusion attacks by revoked or malicious users. The system model contains three entities, doctors/ patients (client side), a proxy (blockchain), and servers. Figure1 shows a system model of the proposed scheme.Figure 1
The system model of our scheme.A patient cures his diseases in different hospitals or in the same hospitals. In general, the data is stored in the nearest server, which is a server of the current hospital. This means that if a patient has seen a disease in different hospitals, multiple servers (different hospitals) store the patient’s data. Our scheme implements a many-to-many model with users and servers. Firstly, doctors and patients register their identities with the blockchain. The blockchain generates a list of user identities and a list of revoked users so that it can verify their identities. Secondly, a doctor uses the private key of user to encrypt the medical records and then uploads them to a server of his hospital. When a patient goes to a hospital to treat his heart disease, his doctor of this department can gain his past medical records in servers. Thirdly, a doctor sends a request to blockchain for obtaining a patient’s records. The blockchain verifies and checks his identity. If yes, the ciphertext encrypted with the patient’s key needs to be converted into ciphertext which can be decrypted by doctors. The patient and blockchain run the encryption phase to complete the transformation of ciphertext. Fourthly, the blockchain transmits a request which includes some serial numbers of data to servers. Only servers that store the corresponding data respond to that request. Finally, the OT protocol is implemented between the doctor and the server to transmit and decrypt the request data.


## 3.2. Threat Model

In this section, the security goals and the security models forOTmn are provided.Definition 1.
A secure and privacy-preservingOTmn protocol should satisfy the following requirements:(1)
TheOTmn protocol should protect the privacy of servers; namely, the users cannot obtain data from the server other than what they requested.(2)
TheOTmn protocol should protect the privacy of users; namely, the servers cannot figure out what data the users access.
The security model for server privacy of theOTmn protocol is described as follows. In this model, adversary A plays the role of users and challenger C plays the role of servers (the servers are trusted). The advantage of A to break the server privacy is defined as follows:(4)AdvA=PrAwins.(i)
Setup: The system generates system parameters and sends the private keys to the blockchain. Then the blockchain generates several necessary parameters for servers. AdversaryA chooses j data that it can access and chooses the corresponding aj from ℤp∗. Adversary A outputs its target tt∉j. Then, the blockchain sends corresponding Dj to adversary A and the servers send all ciphertexts ci.(ii)
Hash Query: AdversaryA can query the hash value via this oracle. It takes as input information and outputs hash value.(iii)
Decrypt Query: AdversaryA can query plaintext mi of ciphertext ci but not ciphertext ct.(iv)
Decrypt: AdversaryA outputs plaintext mt. If mt is right, adversary A breaks the server privacy of the OTmn protocol.
The security model for user privacy of theOTmn protocol is described as follows. In this model, adversary A plays the role of servers and the challenger plays the role of users (the users are trusted). The advantage of A to break the server privacy is defined as follows:(5)AdvA=PrAwins−12.(i)
Setup: The system generates system parameters and sends the private keys to the blockchain. Then the blockchain generates several necessary parameters for adversaryA. The users choose j data that they can access and choose corresponding aj from ℤp∗. Then, the blockchain sends corresponding Dj to the users and the servers sends all ciphertexts ci. Adversary A outputs its target t0,t1t0,t1∈j.(ii)
Hash Query: AdversaryA can query the hash value via this oracle. It takes as input information and outputs hash value.(iii)
Challenge: The user selectsb←R0,1 and outputs Atb and Dtb.(iv)
Guess: AdversaryA outputs b∗. If b=b∗, A wins.


## 4. The Proposed Scheme

The proposed scheme is presented in detail in this section. Our scheme can be divided into four parts, in which the initialization phase is introduced in Section4.1, the user registration phase is described in Section 4.2, the encryption phase is stated in Section 4.3, and the data access phase and OTmn protocol phase among three roles are illustrated in Sections 4.4 and 4.5, respectively.In the smart healthcare system, in the face of complex diseases, the attending doctor will conduct multidepartment consultations or cross-hospital consultations, which are more common. In addition, a patient can treat diseases in different hospitals, a hospital has its own servers, and the users who have access permission can request the data of servers in the smart healthcare system. In our scheme, to protect the two-way privacy of the server and user, the data are allocated to the nearest server randomly, which obeys the principle of proximity; that is, the user with permission can store the data in which the server is near. We show the main idea of the system by giving an example. A patient suffers from high blood pressure, heart disease, and toothache. When he goes to the dental clinic, the doctor not only needs to diagnose his teeth but also prescribes medicine or prepares for surgery based on his other medical history. At this moment, an attending doctor verifies his permission to request all the data about that patient. The requests can be sent to the determined server which has stored the data of that patient. Then, to protect the privacy information, only the determined server delivers all its data to the requester by using the designedOTmn protocol. This protocol guarantees that the server does not have idea about the accessed data, and the user cannot obtain the extra data and figure out the source of data. For instance, if the sequence number 5 is requested from the user, he sends the requirement to all the servers in the smart healthcare system. Only sever Sy that has the data about that patient responds to the request. More comprehensively, assume that the sequence number d is accessed; the user sends the requests to servers S1,S2,…,Sy (the needed data are in servers Sa and Sb). At last, servers Sa and Sb have the opportunity to communicate with the user. In the meantime, blockchain technology is merged into our scheme, which maintains the attributes list and stops user attributes from being tampered with. Correspondence between symbols and definitions is shown in Table 1.Table 1
Correspondence between symbols and definitions.
SymbolsDefinitionnThe serial number of datapid,didThe identity of the patients and doctorsδmData with serial numberm requested by the userkyThe employed key of server in OT protocolky′The stored server subkey of proxy in OT protocolwnThe hash value of the serial numberskp,pkpThe public-private key pairs of patientsskd,pkdThe public-private key pairs of doctorsrkp⟶dThe transform key from patient to doctorβThe attribute sets of all the usersun=an,bn,…,znThe set of each attribute of the usertagmiThe tag for each piece of data


### 4.1. Initialization Phase

We hypothesize that there arey distributed servers, and the users with permission to manipulate data (e.g., the doctor, nurse, and healthcare worker) have n data, and each piece of data has the same bits.Input the security parameters, and then the system randomly selects the number k1,k2,…,ky,k1′,k2′,…,ky′∈ℤp∗, where the formal k1+k1′=κ (κ∈ℤp∗) holds, server Si possesses ki, and κ,k1′,…ky′ is stored in the blockchain. Set G=<g>,GT as the multiplicative cyclic groups, with bilinear mapping e:G×G⟶GT, randomly choose generator g1∈G, and compute α=eg,g1. Set the hash functions h1:0,1n⟶G and h2:0,1n⟶0,1l, where l is the fixed value.We initialize the device of proxy based on the blockchain. The security parameters is input; the blockchain computes the formulas f=gκ and wi=h1i, where i represents the label of the patient’s medical data. Then, the blockchain computes R1i=wik1′,…,Ryi=wiky′ and the following finite sets are satisfied, where 0<i<n+1 and i∈ℤp∗ hold. f is sent to the user. Then R1,R2,…,Ry are sent to servers S1,S2,…,Sy orderly.(6)S1:R1=w1k1′,w2k1′,…,wnk1′,⋮Sy:Ry=w1ky′,w2ky′,…,wnky′.The symbols and the corresponding meanings are shown in Table1.


### 4.2. User Registration Phase

We integrate blockchain technology into user registration phase to maintain the identity lists about users. The data is requested via proxy, while the blockchain inquires and verifies the user’s identity in accordance with his tag. Only through the verification can theOTmn protocol be executed to transmit the data. There are five functions of blockchain in our scheme; they are described briefly as follows:(i)
The committing peer generates and maintains blocks for users.(ii)
The identity of required users is verified.(iii)
The endorsing peer verifies the legality of updated identities; if the transaction is legal, the peer simulates to perform the smart contract. Then, it sends the updated lists to users.(iv)
The attributes are prevented from being faked through utilizing the structural characteristics of the block.(v)
The revoked and malicious users are distinguished to preclude them from colluding the data.The user registration phase contains the four following steps to accomplish the registration:(i)
Step 1. The key generation center (KGC) choosesxp,1,xp,2←Rℤp∗ as the patient’s private key skp=xp,1,xp,2 and computes the patient’s public key pkp=pkp,1=αxp,1,pkp,2=gxp,2. Then, it sends skp,pkp to the patient through the secure channel.(ii)
Step 2. The key generation center (KGC) choosesxd,1,xd,2←Rℤp∗ as the doctor’s private key skd=xd,1,xd,2 and computes the doctor’s public key pkd=pkd,1=αxd,1,pkd,2=gxd,2. Then, it sends skd,pkd to the doctor through the secure channel.(iii)
Step 3. KGC insertspkp,pid into the patient list and inserts pkd,did into the doctor list. Then KGC sends the above lists to the blockchain via the smart contract.


### 4.3. Encryption Phase

After the doctor diagnoses the patient, he records the medical data on the computer. Subsequently, the encryption algorithm will be executed on the data.(i)
Step 1.Verifydid,pkd,skd: The doctor chooses r1,r2←Rℤp∗, computes Committ1=αr1 and Committ2=gr2, c=h0did‖pkd‖Committ1‖Committ2, and computes responses R1=r1+c×xd,1 and R2=r2+c×xd,2. Then, the doctor sends Πproof=Committ1,Committ2,c,R1,R2 and did,pkd to the blockchain. Once the blockchain obtains Πproof,did,pkd, it computes c=h0did‖pkd‖Committ1‖Committ2 and checks whether αR1=?Committ1⋅pkd,1c and gR2=?Committ2⋅pkd,2c. If the above equation holds, the blockchain checks whether the tuple did,pkd belongs to the doctors list. If yes, the verification process is completed. Then, the doctor can upload data.(ii)
Step 2.GenTagmkw,pid,dep: In order to facilitate users to accurately access data, the data needs to be classified in the light of departments and patients. Generate a tag tagmi=GenTagmkw,pid,dep corresponding to the departments dep and patients pid, and add it to m. The advantage of this is that the doctor can accurately acquire all the data about a certain department of this patient, and some invalid data are automatically removed, where the communication overhead of gained data by the OT protocol is reduced.(iii)
Step 3.Encryptm,pkp,tagmi=ctp: The doctor encrypts data m of patient, which employs the patent’s public key pkp and encryption (Enc) algorithm from KP−PRE scheme [38]. Then, upload the ciphertext to the server.


### 4.4. Data Access Phase

(i)
Step 1. When doctordid sees a patient pid, he sends pid and pkd to the blockchain, along with the proof Πdid=Committ1,Committ2,c,R1,R2, where Committ1=αr1,Committ2=gr2, r1,r2←Rℤp∗,c=h0did‖pkd‖Committ1‖Committ2, R1=r1+c×xd,1, and R2=r2+c×xd,2.(ii)
Step 2. The blockchain computesc=h0did‖pkd‖Committ1‖Committ2 and checks whether αR1=?Committ1⋅pkd,1c and gR2=?Committ2⋅pkd,2c. If the above equation holds, the blockchain checks whether the tuple did,pkd belongs to the doctors list. If yes, the blockchain executes the next step.(iii)
Step 3. The blockchain sendspkd to patient pid. The patient computes transform key tkp⟶d via Re−KeyGenskp,pkd in the KP−PRE scheme and sends it to the blockchain.(iv)
Step 4. The blockchain sendstkp⟶d and pid to all servers. The servers transform ciphertext m of patient pid, namely, compute ctd←KP−PRE.ReEnctkp⟶d,ctp.


### 4.5.OTmn Protocol Phase

Assume that doctordid treats pid’s heart disease; he sends a data request which includes all the serial numbers of data from different hospitals about this patient’s heart treatment records to servers. Suppose that the doctor needs to require the data with the serial number sn=δ1,δ2,…,δm, and those data are stored in servers S1,…, Si,…,Sn. The steps of the OTmn algorithm are shown in Figure 2.(i)
Step 1. The doctor (client side) transmits requestsn to the blockchain side. Then, server Si responds and executes the following steps.(ii)
Step 2. The client side selects parametersaj∈ℤp∗ randomly and computes all parameters Aj of serial number of data; that is, Aj=wjgaj, where 0<j<m+1j∈ℤp∗ holds and parameters w1,…,wm are calculated previously. Then, (Aj,ga) is sent to the blockchain.(iii)
Step 3. The blockchain side computesDj=Ajκ and ϵ′=gak1′,gak2′,…,gaky′ and sends ϵi′ to server Si. Then, it delivers Dj and f to the client side.(iv)
Step 4. The server side computes all the ciphertexts of itsci=ctd,i⊕h2wikyRyyi′‖gakyϵy′ and transmits ci to the client side.(v)
Step 5. Only ifδi∈sn meets, the formulas Yj=Dj/faj‖fa and ctd,j=cj⊕h2Yj can be computed. After that, the ciphertexts of requested data sn are calculated.(vi)
Step 6.Decryptctd,j,skd=mj. The doctor employs his key skd to decrypt the above ciphertext. Finally, the doctor obtains all the heart disease records about that patient.Figure 2
The steps of theOTmn algorithm.


## 4.1. Initialization Phase

We hypothesize that there arey distributed servers, and the users with permission to manipulate data (e.g., the doctor, nurse, and healthcare worker) have n data, and each piece of data has the same bits.Input the security parameters, and then the system randomly selects the number k1,k2,…,ky,k1′,k2′,…,ky′∈ℤp∗, where the formal k1+k1′=κ (κ∈ℤp∗) holds, server Si possesses ki, and κ,k1′,…ky′ is stored in the blockchain. Set G=<g>,GT as the multiplicative cyclic groups, with bilinear mapping e:G×G⟶GT, randomly choose generator g1∈G, and compute α=eg,g1. Set the hash functions h1:0,1n⟶G and h2:0,1n⟶0,1l, where l is the fixed value.We initialize the device of proxy based on the blockchain. The security parameters is input; the blockchain computes the formulas f=gκ and wi=h1i, where i represents the label of the patient’s medical data. Then, the blockchain computes R1i=wik1′,…,Ryi=wiky′ and the following finite sets are satisfied, where 0<i<n+1 and i∈ℤp∗ hold. f is sent to the user. Then R1,R2,…,Ry are sent to servers S1,S2,…,Sy orderly.(6)S1:R1=w1k1′,w2k1′,…,wnk1′,⋮Sy:Ry=w1ky′,w2ky′,…,wnky′.The symbols and the corresponding meanings are shown in Table1.


## 4.2. User Registration Phase

We integrate blockchain technology into user registration phase to maintain the identity lists about users. The data is requested via proxy, while the blockchain inquires and verifies the user’s identity in accordance with his tag. Only through the verification can theOTmn protocol be executed to transmit the data. There are five functions of blockchain in our scheme; they are described briefly as follows:(i)
The committing peer generates and maintains blocks for users.(ii)
The identity of required users is verified.(iii)
The endorsing peer verifies the legality of updated identities; if the transaction is legal, the peer simulates to perform the smart contract. Then, it sends the updated lists to users.(iv)
The attributes are prevented from being faked through utilizing the structural characteristics of the block.(v)
The revoked and malicious users are distinguished to preclude them from colluding the data.The user registration phase contains the four following steps to accomplish the registration:(i)
Step 1. The key generation center (KGC) choosesxp,1,xp,2←Rℤp∗ as the patient’s private key skp=xp,1,xp,2 and computes the patient’s public key pkp=pkp,1=αxp,1,pkp,2=gxp,2. Then, it sends skp,pkp to the patient through the secure channel.(ii)
Step 2. The key generation center (KGC) choosesxd,1,xd,2←Rℤp∗ as the doctor’s private key skd=xd,1,xd,2 and computes the doctor’s public key pkd=pkd,1=αxd,1,pkd,2=gxd,2. Then, it sends skd,pkd to the doctor through the secure channel.(iii)
Step 3. KGC insertspkp,pid into the patient list and inserts pkd,did into the doctor list. Then KGC sends the above lists to the blockchain via the smart contract.


## 4.3. Encryption Phase

After the doctor diagnoses the patient, he records the medical data on the computer. Subsequently, the encryption algorithm will be executed on the data.(i)
Step 1.Verifydid,pkd,skd: The doctor chooses r1,r2←Rℤp∗, computes Committ1=αr1 and Committ2=gr2, c=h0did‖pkd‖Committ1‖Committ2, and computes responses R1=r1+c×xd,1 and R2=r2+c×xd,2. Then, the doctor sends Πproof=Committ1,Committ2,c,R1,R2 and did,pkd to the blockchain. Once the blockchain obtains Πproof,did,pkd, it computes c=h0did‖pkd‖Committ1‖Committ2 and checks whether αR1=?Committ1⋅pkd,1c and gR2=?Committ2⋅pkd,2c. If the above equation holds, the blockchain checks whether the tuple did,pkd belongs to the doctors list. If yes, the verification process is completed. Then, the doctor can upload data.(ii)
Step 2.GenTagmkw,pid,dep: In order to facilitate users to accurately access data, the data needs to be classified in the light of departments and patients. Generate a tag tagmi=GenTagmkw,pid,dep corresponding to the departments dep and patients pid, and add it to m. The advantage of this is that the doctor can accurately acquire all the data about a certain department of this patient, and some invalid data are automatically removed, where the communication overhead of gained data by the OT protocol is reduced.(iii)
Step 3.Encryptm,pkp,tagmi=ctp: The doctor encrypts data m of patient, which employs the patent’s public key pkp and encryption (Enc) algorithm from KP−PRE scheme [38]. Then, upload the ciphertext to the server.


## 4.4. Data Access Phase

(i)
Step 1. When doctordid sees a patient pid, he sends pid and pkd to the blockchain, along with the proof Πdid=Committ1,Committ2,c,R1,R2, where Committ1=αr1,Committ2=gr2, r1,r2←Rℤp∗,c=h0did‖pkd‖Committ1‖Committ2, R1=r1+c×xd,1, and R2=r2+c×xd,2.(ii)
Step 2. The blockchain computesc=h0did‖pkd‖Committ1‖Committ2 and checks whether αR1=?Committ1⋅pkd,1c and gR2=?Committ2⋅pkd,2c. If the above equation holds, the blockchain checks whether the tuple did,pkd belongs to the doctors list. If yes, the blockchain executes the next step.(iii)
Step 3. The blockchain sendspkd to patient pid. The patient computes transform key tkp⟶d via Re−KeyGenskp,pkd in the KP−PRE scheme and sends it to the blockchain.(iv)
Step 4. The blockchain sendstkp⟶d and pid to all servers. The servers transform ciphertext m of patient pid, namely, compute ctd←KP−PRE.ReEnctkp⟶d,ctp.


## 4.5.OTmn Protocol Phase

Assume that doctordid treats pid’s heart disease; he sends a data request which includes all the serial numbers of data from different hospitals about this patient’s heart treatment records to servers. Suppose that the doctor needs to require the data with the serial number sn=δ1,δ2,…,δm, and those data are stored in servers S1,…, Si,…,Sn. The steps of the OTmn algorithm are shown in Figure 2.(i)
Step 1. The doctor (client side) transmits requestsn to the blockchain side. Then, server Si responds and executes the following steps.(ii)
Step 2. The client side selects parametersaj∈ℤp∗ randomly and computes all parameters Aj of serial number of data; that is, Aj=wjgaj, where 0<j<m+1j∈ℤp∗ holds and parameters w1,…,wm are calculated previously. Then, (Aj,ga) is sent to the blockchain.(iii)
Step 3. The blockchain side computesDj=Ajκ and ϵ′=gak1′,gak2′,…,gaky′ and sends ϵi′ to server Si. Then, it delivers Dj and f to the client side.(iv)
Step 4. The server side computes all the ciphertexts of itsci=ctd,i⊕h2wikyRyyi′‖gakyϵy′ and transmits ci to the client side.(v)
Step 5. Only ifδi∈sn meets, the formulas Yj=Dj/faj‖fa and ctd,j=cj⊕h2Yj can be computed. After that, the ciphertexts of requested data sn are calculated.(vi)
Step 6.Decryptctd,j,skd=mj. The doctor employs his key skd to decrypt the above ciphertext. Finally, the doctor obtains all the heart disease records about that patient.Figure 2
The steps of theOTmn algorithm.


## 5. Security Analysis

Theorem 1.
The proposedOTmn is server privacy, if the CDH assumption holds. Assume that any probability polynomial time adversary A can break the server privacy of the scheme; it can be utilized to solve CDH problem. The definition of CDH problem is that, given a tuple G,g,gα,gβ where α,β←Rℤp∗, the adversary should compute gαβ.(i)
Setup: In this phase, after challengerC obtains the CDH tuple G,g,gα,gβ where α,β←Rℤp∗, it sets k=α and f=gα. Then, it generates other system parameters to complete the setup of the whole scheme.(ii)
Query: In the hash query phase, adversaryA queries the value of wi. Challenger C sets(7)wi=gβiβi←Rℤp∗,i≠t,gβ,i=t.and outputswi to adversary A. In the Decrypt query phase, adversary A cannot query the plaintext of ciphertext ct.(iii)
Decrypt: AdversaryA outputs plaintext mt′. If mt′=mt, A wins this game.Proof:.
Ifmt is right, it means that A can compute Yt=wtk‖fa, where wtk=gαβ. Therefore, challenger C can utilize the adversary to output the solution wtk=gαβ of the CDH problem. In conclusion, if A wins, challenger C can output gαβ to solve the CDH problem. We can obtain that AdvAserver privacy≤AdvACDH.Theorem 2.
The proposedOTmn is user privacy, if the DDH assumption holds. Assume that any probability polynomial time adversary A can break the user privacy of the scheme; it can be utilized to solve DDH problem. The definition of DDH problem is that, given a tuple G,g,gα,gβ,Z where α,β←Rℤp∗, Z=gαβ, or Z←RG, the adversary should decide whether Z=gαβ.(i)
Setup: In this phase, after challengerC obtains the DDH tuple G,g,gα,gβ,Z where α,β←Rℤp∗ and Z←RG or Z=gαβ, it sets k=β and f=gβ. Then, it generates other system parameters to complete the setup of the whole scheme.(ii)
Query: In this phase, adversaryA queries the value of wi, and challenger C guesses the targets of adversary A, t0 and t1. Then, it sets(8)wi=g−atb+α=g−atb⋅gα,atb←Rℤp∗,i=t0∨i=t1,gai,ai←Rℤp∗,i≠t0∧i≠t1,and outputswi to adversary A.(iii)
Challenge: ChallengerC chooses b←R0,1 and sets Atb=gα and Dtb=Z.(iv)
Guess: AdversaryA outputs b∗. If b∗=b, challenger C outputs p=1 (i.e., Z=gαβ). Otherwise, C outputs p=0 (i.e., Z←RG).Proof:.
We assume that the probability of challengerC obtaining Z=gαβ is 1/2 and the probability of obtaining Z←RG is also 1/2. We assume that the advantage of A winning is ϵ and denote by E challenger C solving the DDH problem. It is easily deduced that Prp=1|Z=gαβ=1/2+ϵ and Prp=0|Z←RG=1/2Pr. Therefore, we can get AdvDDH=PrCwins−1/2=Prp=1|Z=gαβ×1/2+Prp=0|Z←RG×1/2−1/2=1/2+ϵ×1/2+1/2×1/2−1/2=ϵ/2. So, ϵ=2×AdvDDH. Since the DDH assumption holds, it is difficult for A to decide whether Z=?gαβ. Therefore, adversary A’s advantage to break the user privacy is negligible.Theorem 3.
Any revoked user cannot tamper with the data or his identity. Malicious or revoked users cannot get through the verification at our scheme. Meanwhile, if they attempt to request data, then they would be identified via the scheme. Therefore, the malicious or revoked users do not obtain the permission to request the data.Proof:.
Firstly, the user needs to get through the identity authentication at the data access phase. Whether this formulaCommittui⋅pkd,uic, gR=?Committur⋅pkd,urc is satisfied is checked. In general, a malicious user’s commitment value cannot meet the calculation formula, and he would be judged as an invalid user by scheme. Secondly, even if a malicious user tries to modify his identity, the list of user identities is stored in the blockchain. That is, the modified identity cannot satisfy the formula Hash256dui=Hash256dur. Then, that malicious user would be judged as an invalid user.
OTmm ensures the two-way privacy of communication parties, and the proxy reencryption algorithm is secure. Therefore, the confidentiality of data can be protected by our proposed scheme.


## 6. Performance

In this section, we first analyze the proposed scheme and provide a simplified comparison in Table2. Then, an experimental evaluation of the proposed scheme is presented.Table 2
Computational cost comparison.
EntitiesRegistration phaseEncryption phaseData access phaseOTmn phaseKGCnd+npTE1+TET———Client—2TE1+3TET+Th4TE1+3TET+Th+Tpnj3TE1+TET+ThBlockchain—2TE1+2TET+Th2TE1+2TET+ThTE1nj+nyServers——nc2Tp+2TETnc2TE1+ThTx: XOR operation; Te: Weil operation; Th: hash operation; TE1: power operation in G1; and TET: power operation in GT. nd: the number of doctors registered; np: the number of patients registered; nc: the number of patient ciphertexts; ny: the number of servers; nj: the number of j.


### 6.1. Performance Analysis

In our scheme, most of computation cost comes from the XOR operation, hash operation, Weil operation, power operation inG1, and power operation in GT, which are denoted as Tx, Th, Te, TE1, and TET. In Table 2, nd presents the number of doctors registered, np describes the number of patients registered, nc is the number of patient ciphertexts, ny illustrates the number of servers, and nj states the number of j.In registration phase, KGC generates the public-private key pairs for doctors and patients, and it costs computation overheadnd+npTE1+TET. In encryption phase, blockchain verifies and checks the identities of client via lists to discern malicious or revoked users, which costs 4TE1+2TET+Th computation overhead. Also, this phase is applied to encrypt the plaintext by using private key of patients, which defends the data confidentiality and costs 2TE1+TET computation overhead. In data access phase, the ciphertext encrypted with the user’s key should be converted into the ciphertext encrypted with the doctor’s key, which costs 3TE1+TET+Tp computation overhead. Moreover, this phase is also not involved in the general OT protocol, mainly to hide the access path of the server. In the OTmn phase, it realizes the privacy-preserving of clients and servers.


### 6.2. Performance Evaluation

We simulate our proposed scheme employing the C language with PBC library (pbc-0.5.14) and GMP library (GMP-6.1.2) to evaluate theOTmn protocol. All simulations are implemented on a desktop computer with the following features: (1) CPU: Intel(R) Core(TM) i5-9500 CPU @ 3.00 GHz 3.00 GHz; (2) random access memory: 8.0 GB; (3) OS: Ubuntu 14.04 over VMware workstation full 12.5.2; (4) system type: 64-bit.We provide the computation comparison between doctors and patients in theOTmn protocol in Figure 3. The X-axis describes the number of j requested by doctors. The Y-axis represents the time cost to perform the OTmn protocol in doctor side and patient side. As shown in Figure 3, the time cost of doctors is higher than that of patients. The patient only needs to assist the blockchain to complete the transformation of the ciphertext. However, doctors need to participate in all the OTmn protocols and calculate the transmission ciphertext of j data. Meanwhile, if the length of the ciphertext is fixed, the cost of transforming the ciphertext is roughly the same. Therefore, the patient’s expenditure at this phase is approximately straight.Figure 3
The computation comparison between doctors and patients inOTmn.We provide the computation comparison of client side, blockchain, and servers in Figure4. In order to make the comparison more obvious, the three entities are put in Figures 4 and 5. The computational overhead of the client side and blockchain is described in Figure 4; the X-axis represents the number of j and assumes that the number of servers is 10. For the server side, the X-axis represents the number of patient ciphertexts in Figure 5. As shown in the figures, we find that the overhead of the client is much higher than that of other entities. The proposed OTmn protocol is an interactive protocol, which requires interaction between client side and servers to complete data transmission. At the meantime, this protocol uses the many-to-many data transmission pattern.Figure 4
The computation comparison of the client side and blockchain inOTmn.Figure 5
The computation comparison of the servers inOTmn.


## 6.1. Performance Analysis

In our scheme, most of computation cost comes from the XOR operation, hash operation, Weil operation, power operation inG1, and power operation in GT, which are denoted as Tx, Th, Te, TE1, and TET. In Table 2, nd presents the number of doctors registered, np describes the number of patients registered, nc is the number of patient ciphertexts, ny illustrates the number of servers, and nj states the number of j.In registration phase, KGC generates the public-private key pairs for doctors and patients, and it costs computation overheadnd+npTE1+TET. In encryption phase, blockchain verifies and checks the identities of client via lists to discern malicious or revoked users, which costs 4TE1+2TET+Th computation overhead. Also, this phase is applied to encrypt the plaintext by using private key of patients, which defends the data confidentiality and costs 2TE1+TET computation overhead. In data access phase, the ciphertext encrypted with the user’s key should be converted into the ciphertext encrypted with the doctor’s key, which costs 3TE1+TET+Tp computation overhead. Moreover, this phase is also not involved in the general OT protocol, mainly to hide the access path of the server. In the OTmn phase, it realizes the privacy-preserving of clients and servers.


## 6.2. Performance Evaluation

We simulate our proposed scheme employing the C language with PBC library (pbc-0.5.14) and GMP library (GMP-6.1.2) to evaluate theOTmn protocol. All simulations are implemented on a desktop computer with the following features: (1) CPU: Intel(R) Core(TM) i5-9500 CPU @ 3.00 GHz 3.00 GHz; (2) random access memory: 8.0 GB; (3) OS: Ubuntu 14.04 over VMware workstation full 12.5.2; (4) system type: 64-bit.We provide the computation comparison between doctors and patients in theOTmn protocol in Figure 3. The X-axis describes the number of j requested by doctors. The Y-axis represents the time cost to perform the OTmn protocol in doctor side and patient side. As shown in Figure 3, the time cost of doctors is higher than that of patients. The patient only needs to assist the blockchain to complete the transformation of the ciphertext. However, doctors need to participate in all the OTmn protocols and calculate the transmission ciphertext of j data. Meanwhile, if the length of the ciphertext is fixed, the cost of transforming the ciphertext is roughly the same. Therefore, the patient’s expenditure at this phase is approximately straight.Figure 3
The computation comparison between doctors and patients inOTmn.We provide the computation comparison of client side, blockchain, and servers in Figure4. In order to make the comparison more obvious, the three entities are put in Figures 4 and 5. The computational overhead of the client side and blockchain is described in Figure 4; the X-axis represents the number of j and assumes that the number of servers is 10. For the server side, the X-axis represents the number of patient ciphertexts in Figure 5. As shown in the figures, we find that the overhead of the client is much higher than that of other entities. The proposed OTmn protocol is an interactive protocol, which requires interaction between client side and servers to complete data transmission. At the meantime, this protocol uses the many-to-many data transmission pattern.Figure 4
The computation comparison of the client side and blockchain inOTmn.Figure 5
The computation comparison of the servers inOTmn.


## 7. Conclusion

In this paper, a privacy-preserving data transmission scheme based on the oblivious transfer and blockchain technology in the smart healthcare system is proposed. Based on the proxy reencryption technology, the proposedOTmn protocol can implement the ciphertext conversion to ensure the privacy of servers. Meantime, the two-way privacy between the client side and servers is guaranteed via the proposed OTmn protocol, which also ensures the security and efficiency of data transmission. By taking advantage of blockchain technology, the proposed scheme can prevent data from being tampered with and effectively identify malicious users. After analyzing the protocol security, the confidentiality of data and security of our scheme are proved. Finally, the results of performance evaluation and experimental comparison can be considered as a validation of our protocol, making it substantially more convincing.



---

*Source: 5781354-2021-09-03.xml*