# Efficient and Secure Cross-Domain Sharing of Blockchain Electronic Medical Records Based on Edge Computing

Authors: Yage Cheng; Bei Gong; ZhiJuan Jia; YanYan Yang; Yuchu He; Xiaofei Zhang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

In this article, we analysed the problems of electronic medical records (EMRs) and found that the EMRs generated by different hospitals for the same patient are mutually independent and duplication and data sharing are difficult among hospitals. In order to solve this problem, this paper proposes an efficient and secure cross-domain sharing scheme of EMRs based on edge computing. The program allows the doctor to access the personal history EMRs through the patient’s authorization so that the doctor can understand the patient’s history of illness and, on this basis, generate a new medical record for the patient. Then, the doctor sends the EMRs to the edge server, and the server calculates the ciphertext and adds it to the patient’s personal medical record to complete the case update. Analysis shows that this solution can effectively prevent data tampering and forgery through blockchain and avoid privacy leakage problems in plaintext sharing by using searchable encryption and by relying on edge servers to solve nearby computing tasks and divert the computing capacity of cloud servers to improve efficiency. The security proof shows that the scheme satisfies the complex problem of the BDH assumption. Performance analysis shows that the scheme is feasible and efficient.


---

## Body

## 1. Introduction

With the rapid development of the Internet of Things and cloud computing, intelligent systems such as intelligent transportation and smart cities are gradually becoming a hot research topic nowadays [1–3]. At the same time, with the sharp increase in medical demand and the gradual intensification of refined hospital management, the development of the informatization of the medical system is also imperative. Compared with paper medical records, EMRs are related to each other, easy to store, more environmentally friendly, and efficient [4, 5]. It effectively solves the problems of paper medical records [3]. So, it is very popular in hospitals.However, with the rapid growth of EMRs, the problem of data islands in hospitals has become more prominent. When patients go to different hospitals, each hospital will generate a large amount of EMRs and store them in its own hospital independently, which cannot be shared among them. For doctors, it is impossible to understand the patient’s illness history in other hospitals. On this basis, doctors are prone to misdiagnosis and even cause significant problems such as medical malpractice. Moreover, it is also not conducive for the patients to master and understand their health status [5]. In addition, EMRs store the patient’s personal privacy information. If they are attacked, they will face security risks, such as privacy leaks [6].In recent years, blockchain technology has developed rapidly. Due to the characteristics of immutability, data integrity, and distributed storage, blockchain technology has been widely used in all walks of life [7–9]. Since blockchain technology can ensure privacy and security in the application of EMRs, many scholars have proposed solutions to the current problems of EMRs. Literature [10] proposed blockchain-based healthcare data gateway architecture, enabling the patients to control and share their EMRs easily and securely without violating privacy. It provides a new potential way to improve the intelligence of healthcare systems while keeping patient data private. Literature [11] proposed a blockchain-based EMRs data-sharing framework, using immutability, and built-in autonomy properties of the blockchain sufficiently address the access control challenges associated with sensitive data stored in the cloud. Literature [12] proposed an electronic medical care system based on blockchain, which builds an alliance chain among hospitals. Using the practical Byzantine fault-tolerant algorithm reduces the computational power and ensures the safety and stability of the system, and at the same time, it prevents data tampering and privacy leakage. Literature [13] proposes a framework for sharing medical system data services based on blockchain, which does not rely on a trusted third party and realizes safe storage and privacy protection. Literature [14] used attribute-based encryption and identity-based encryption to ensure data privacy and used blockchain techniques to ensure the integrity and traceability of the EMRs. The most significant advantage of blockchain-based EMRs is that users can securely share the EMRs among hospitals and other institutions. However, most of the existing research only discusses the security search and the data sharing without considering establishing system EMRs for individual patients.In fact, due to the limited storage space, many medical institutions and enterprises store data on cloud servers. However, with the continuous increase of cloud computing data security issues, it is imperative to upload encrypted data to the cloud server. However, it will face the problem of how to implement ciphertext search when data are shared. In this case, searchable encryption technology came into being [15–18]. It supports ciphertext search while ensuring the security of the data sharing, saving a lot of network and computing costs, and making full use of the enormous computing resources of cloud servers to search for keywords on ciphertexts. Therefore, many electronic medical record sharing schemes use searchable encryption technology to realize ciphertext sharing. Literature [19] proposed a blockchain-based searchable encryption scheme for EMRs. The solution stores the index of EMRs in the blockchain using the blockchain to ensure the integrity, tamper-proof, and traceability of the EMRs index and using searchable encryption to realize ciphertext sharing. Literature [20] constructs a framework based on the blockchain. It uses private chains and alliance chains, combined with searchable technology, to realize the safe search of EMRs while ensuring personal privacy and information security. Literature [21] proposed a blockchain-based secure and privacy-protected EMRs sharing protocol. The scheme mainly uses searchable encryption and proxy reencryption to realize data security, privacy preservation, and access control. Literature [22] combines private chain and consortium chain and uses searchable encryption technology to realize data sharing with significant storage overhead. Literature [23] uses ciphertext strategy attribute-based encryption to encrypt EMRs, and only users with the required attributes can access the data, which can achieve fine-grained access control. The above schemes solved privacy security and ciphertext search through searchable encryption technology but did not consider deduplication.In response to the above problems, we propose a personal EMRs system with deduplication based on edge server. The plan is to update the EMRs by the doctors in time through the patient’s authorization with deduplication and then complete data update. Moreover, it is through blockchain and searchable encryption to ensure data and personal privacy security, and the edge server can offload the computing tasks of cloud services to improve computing efficiency.


## 2. Prerequisite

### 2.1. Bilinearity

Definition 1.
SupposeG1 is the additive group, G2 is the multiplicative group, and the prime order is q. Define a bilinear operation e:G1×G1⟶G2 satisfying the following properties [24]:(1)
Bilinear: for anya,b∈Zq∗, there is ega,gb=eg,gab;(2)
Nondegeneracy: there areg1,g2∈G1 such that eg1,g2≠1;(3)
Computable: for anyg1,g2∈G1, eg1,g2 can be calculated.


### 2.2. Bilinear Diffie–Hellman Hypothesis

SupposeG1 is the additive group, G2 is the multiplicative group, and the prime order is q. Define a bilinear operation e:G1×G1⟶G2; g is the generator of group G1. Given a four-tuple g,ga,gb,gc, it is difficult to calculate eg,gabc∈G2.Suppose algorithmA is used to solve the BDH problem, and its advantage is defined as ε, if PrAg,ga,gb,gc=eg,gabc≥ε.At present, there is no effective algorithm to solve the BDH problem. Therefore, it can be assumed that the BDH problem is complex [24].


### 2.3. Public Key Encryption with Keyword Search (PEKS) Based on Bilinear Mapping

H1:0,1∗⟶G1 and H2:G2⟶0,1logp are two hash functions.(1)
KeyGenλ. Randomly select α∈Zp∗ and a generator g of group G1, and output sk=α,pk=gα;(2)
Indexpk,w. Randomly select r∈Zp∗ for the keyword w, Calculate t=eH1w,pkr∈G2 and output indexpk,w=gr,H2t;(3)
Trapdoorsk,w′. Using private key sk and keyword w to generate search trapdoor Tw′=H1w′α∈G1;(4)
Searchpk,Index,Tw′. Set indexpk,w=I1,I2; check if there is H2eTw′,I1=I1, and output the corresponding index if they are equal [24].


### 2.4. System Model

This paper aims to solve the difficulties in EMRs sharing among hospitals and the problems of isolated and repeated storage of cases. The program mainly uses blockchain and searchable encryption technology to ensure EMRs data and privacy security. The overall idea of the scheme is that when a patient sees a doctor, he first registers with the hospital, and the hospital makes an appointment for the patient. Then, the patient authorizes the doctor to generate EMRs and the doctor sends the EMRs and authorization guarantee to the edge server. The edge server encrypts the EMRs and retrieval information and uploads them to the cloud server and blockchain. When the patient goes to another hospital, the doctor needs to be authorized to visit the personal EMRs. Then, the doctor generates new EMRs after understanding the patient’s history of illness and sends them to the edge server. The edge server marks the repeated case and then adds the newly added case to the patient’s medical record to complete the case update.The main entities involved in the system are patients, doctors, hospitals, cloud servers, edge server, and blockchain. The system architecture is shown in Figure1.Figure 1
Cross-domain sharing scheme of EMRs.Definition 2.
The scheme is composed of the following algorithms:Initialization: generate system parameters;Key generation: generate the entity’s keys;Registration: the patient registers with the hospital; the hospital makes an appointment for the doctor.Authorization: the patient authorizes the doctor to generate EMRs.Generation and storage of electronic medical records: the doctor generates EMRs for the patient and sends them to the edge server. Then, the edge server calculates the ciphertext and index and uploads it;Access: the doctor views the patient’s previous EMRs. The doctor applies for an access request to the edge server and the edge server accesses the blockchain and cloud to obtain the information and then returns it to the doctor.Update: the doctor deletes duplicate EMRs and sends them to edge server; the edge server updates and uploads them to cloud storage and blockchain.


### 2.5. Security Model

We define the formalized security model of the proposed scheme by the following games.


### 2.6. Keyword Privacy Security Game

If there is no adversaryA who can infer the plaintext of the keywords from the ciphertext or trapdoor in probabilistic polynomial time, the privacy of the keywords can be guaranteed. Define the keywords privacy and security game as follows:(1)
Initialization: given the secure parameterλ, simulation challenger ℬ executes the initialization algorithm to generate par.(2)
Phase 1: adversaryA runs the trapdoor generation algorithm multiple times.(3)
Challenge: adversaryA randomly selects two keywords from the keyword space and sends them to the simulation challenger. The simulation challenger executes the trapdoor generation algorithm and then randomly selects a trapdoor and sends it to A.(4)
Guess: After adversaryA inquires n times for the different keywords, it analyzes and guesses. If the A can guess the trapdoor, then adversary A wins the game.


### 2.7. Proof of Bilinear Diffie–Hellman Hypothesis for Difficult Problems

If there is an adversaryA who can solve the solution with an advantage ελ in polynomial time, then the adversary A can solve the BDH difficult problem with an advantage ελ in polynomial time. Define the two-linear Diffie–Hellman hypothesis that the difficult problem specification is proved as follows:(1)
Initialization: given the groupG1, G2 and the mapping e:G1×G1⟶G2. Simulate challenger ℬ randomly generates a,b,c∈Zp∗ and sets g,x=ga,y=gb,z=gc.(2)
Phase 1: adversaryA runs the encryption algorithm multiple times.(3)
Challenge: the simulate challengerℬ randomly selects the plaintext m, requires that m is not queried in stage 1, generates the ciphertext Cm, and transmits the ciphertext to the adversary A.(4)
Guess: the adversaryA analyzes and decrypts the ciphertext Cm. If the adversary A can decrypt the ciphertext Cm and get the correct plaintext m, then the adversary A wins the game.(5)
Proof: if adversaryA can decrypt the ciphertext, adversary A can also solve the difficult problem of bilinear Diffie–Hellman assumption.


## 2.1. Bilinearity

Definition 1.
SupposeG1 is the additive group, G2 is the multiplicative group, and the prime order is q. Define a bilinear operation e:G1×G1⟶G2 satisfying the following properties [24]:(1)
Bilinear: for anya,b∈Zq∗, there is ega,gb=eg,gab;(2)
Nondegeneracy: there areg1,g2∈G1 such that eg1,g2≠1;(3)
Computable: for anyg1,g2∈G1, eg1,g2 can be calculated.


## 2.2. Bilinear Diffie–Hellman Hypothesis

SupposeG1 is the additive group, G2 is the multiplicative group, and the prime order is q. Define a bilinear operation e:G1×G1⟶G2; g is the generator of group G1. Given a four-tuple g,ga,gb,gc, it is difficult to calculate eg,gabc∈G2.Suppose algorithmA is used to solve the BDH problem, and its advantage is defined as ε, if PrAg,ga,gb,gc=eg,gabc≥ε.At present, there is no effective algorithm to solve the BDH problem. Therefore, it can be assumed that the BDH problem is complex [24].


## 2.3. Public Key Encryption with Keyword Search (PEKS) Based on Bilinear Mapping

H1:0,1∗⟶G1 and H2:G2⟶0,1logp are two hash functions.(1)
KeyGenλ. Randomly select α∈Zp∗ and a generator g of group G1, and output sk=α,pk=gα;(2)
Indexpk,w. Randomly select r∈Zp∗ for the keyword w, Calculate t=eH1w,pkr∈G2 and output indexpk,w=gr,H2t;(3)
Trapdoorsk,w′. Using private key sk and keyword w to generate search trapdoor Tw′=H1w′α∈G1;(4)
Searchpk,Index,Tw′. Set indexpk,w=I1,I2; check if there is H2eTw′,I1=I1, and output the corresponding index if they are equal [24].


## 2.4. System Model

This paper aims to solve the difficulties in EMRs sharing among hospitals and the problems of isolated and repeated storage of cases. The program mainly uses blockchain and searchable encryption technology to ensure EMRs data and privacy security. The overall idea of the scheme is that when a patient sees a doctor, he first registers with the hospital, and the hospital makes an appointment for the patient. Then, the patient authorizes the doctor to generate EMRs and the doctor sends the EMRs and authorization guarantee to the edge server. The edge server encrypts the EMRs and retrieval information and uploads them to the cloud server and blockchain. When the patient goes to another hospital, the doctor needs to be authorized to visit the personal EMRs. Then, the doctor generates new EMRs after understanding the patient’s history of illness and sends them to the edge server. The edge server marks the repeated case and then adds the newly added case to the patient’s medical record to complete the case update.The main entities involved in the system are patients, doctors, hospitals, cloud servers, edge server, and blockchain. The system architecture is shown in Figure1.Figure 1
Cross-domain sharing scheme of EMRs.Definition 2.
The scheme is composed of the following algorithms:Initialization: generate system parameters;Key generation: generate the entity’s keys;Registration: the patient registers with the hospital; the hospital makes an appointment for the doctor.Authorization: the patient authorizes the doctor to generate EMRs.Generation and storage of electronic medical records: the doctor generates EMRs for the patient and sends them to the edge server. Then, the edge server calculates the ciphertext and index and uploads it;Access: the doctor views the patient’s previous EMRs. The doctor applies for an access request to the edge server and the edge server accesses the blockchain and cloud to obtain the information and then returns it to the doctor.Update: the doctor deletes duplicate EMRs and sends them to edge server; the edge server updates and uploads them to cloud storage and blockchain.


## 2.5. Security Model

We define the formalized security model of the proposed scheme by the following games.


## 2.6. Keyword Privacy Security Game

If there is no adversaryA who can infer the plaintext of the keywords from the ciphertext or trapdoor in probabilistic polynomial time, the privacy of the keywords can be guaranteed. Define the keywords privacy and security game as follows:(1)
Initialization: given the secure parameterλ, simulation challenger ℬ executes the initialization algorithm to generate par.(2)
Phase 1: adversaryA runs the trapdoor generation algorithm multiple times.(3)
Challenge: adversaryA randomly selects two keywords from the keyword space and sends them to the simulation challenger. The simulation challenger executes the trapdoor generation algorithm and then randomly selects a trapdoor and sends it to A.(4)
Guess: After adversaryA inquires n times for the different keywords, it analyzes and guesses. If the A can guess the trapdoor, then adversary A wins the game.


## 2.7. Proof of Bilinear Diffie–Hellman Hypothesis for Difficult Problems

If there is an adversaryA who can solve the solution with an advantage ελ in polynomial time, then the adversary A can solve the BDH difficult problem with an advantage ελ in polynomial time. Define the two-linear Diffie–Hellman hypothesis that the difficult problem specification is proved as follows:(1)
Initialization: given the groupG1, G2 and the mapping e:G1×G1⟶G2. Simulate challenger ℬ randomly generates a,b,c∈Zp∗ and sets g,x=ga,y=gb,z=gc.(2)
Phase 1: adversaryA runs the encryption algorithm multiple times.(3)
Challenge: the simulate challengerℬ randomly selects the plaintext m, requires that m is not queried in stage 1, generates the ciphertext Cm, and transmits the ciphertext to the adversary A.(4)
Guess: the adversaryA analyzes and decrypts the ciphertext Cm. If the adversary A can decrypt the ciphertext Cm and get the correct plaintext m, then the adversary A wins the game.(5)
Proof: if adversaryA can decrypt the ciphertext, adversary A can also solve the difficult problem of bilinear Diffie–Hellman assumption.


## 3. The Proposed

The program mainly includes the following essential roles: patients, hospitals, doctors, cloud storage servers, edge server, and alliance chain. The description of symbols in the text is shown in Table1.Table 1
Symbol description.
SymbolsRolesPPatientℋHospitalDDoctorIDPThe patient’s identificationIDDThe doctor’s identificationCSCloud storage serverℬCAlliance blockchainℰSEdge server (local server of hospital)τTreatment keyAuxOther auxiliary informationDepDepartmentAppAppointment informationGuaAuthorization guaranteeCCiphertextTAccessAccess timekAccess keyaRepeat marktRepeat timeAAccessIIndexTTrapdoor


### 3.1. Initialization

The key generation center according to the security parameterλ generates the public parameter par=p,g,G1,G2,e,H1,H2, where G1 and G2 are the cyclic group of prime order p, the generator of group G1 is g, e satisfies G1×G1⟶G2, and H1:0,1∗⟶G1 and H2:G2⟶0,1logp are two hash functions.


### 3.2. Key Generation

The patientP randomly selects α∈Zp∗ and calculates h=gα, so the keys of P are skP=α,pkP=gα. Similarly, the doctors D1 and D2 randomly select β and γ and calculate d=gβ and f=gγ, so the keys of D1 and D2 are skD=β,pkD=gβ and skD2=γ,pkD2=gγ.


### 3.3. Registration

The patientP registers with the hospital ℋ1, and the ℋ1 stores the patient’s identification IDP, randomly selects the treatment key τ, and sends the encrypted EncpkP,τ to P. The hospital ℋ1 makes an appointment with the attending doctor D1 for the patient P and encrypts the appointment information App=IDD1‖Dep‖Aux with the τ and sends it to P. The patient uses τ to decrypt the App and obtains the doctor’s IDD1, department Dep, and other auxiliary information Aux. At the same time, the hospital ℋ1 sends τ to the attending doctor D1.


### 3.4. Authorization

The patientP authorizes the doctor D1 to generate EMRs. P generates an authorization guarantee Gua1=IDρ‖IDD1‖TAccess1‖k1‖τ, k1∈Zp∗, while signing it with the personal private key σGua1=sigskρ,Gua1 and encrypting it with the doctor’s public key C1=EncpkD1,Gua1‖σGua1, and then sends C1 to D1. The doctor D1 decrypts C1 with the personal private key skD1 to obtain the Gua1 and the signature σGua1, and then the doctor verifies the correctness of the authorization with the patient’s public key pkP.


### 3.5. Generation and Storage of Electronic Medical Records

When the verification is passed, the doctor generates EMRsm1 for P and sends them to edge server. The edge server calculates the ciphertext Cm1=H1k1m1 and then randomly selects u∈Zp∗ and calculates I1=gu, I2=H2r, I=I1,I2, where r=eH1IDP,pkDu. Finally, it uploads ACS=C1,IDD1,I,Cm1 to the cloud server and uploads AℬC=H1IDP,I1,I2,N to the blockchain, here N is the file number returned by the cloud server.


### 3.6. Access

WhenP registers and sees a doctor D2 in the hospital ℋ2, P first authorizes D2 to access his EMRs through the authorization guarantee Gua2=IDρ‖IDD2‖τ‖k1‖Taccess and encrypts it as C2=EncpkD2,Gua2‖σGua2, where σGua2=sigskρ,Gua2. The doctor D2 sends C2=EncpkD2,Gua2‖σGua2 to edge server, the edge server decrypts C2 with the personal private key skD2 to obtain the Gua2 and the signature σGua2 and then verifies the correctness of the authorization with the patient’s public key pkP.When the verification is passed, the edge server calculatesT=H1IDP′β∈G1 and sends A=Gua2,IDD2,T to the blockchain nodes. The blockchain nodes execute matching algorithms through H2eT,I1=I2 and return the corresponding file number N. The CS finds the corresponding ciphertext Cm1 through the file number N and returns it to edge server. The edge server sends it to the doctor D2. D2 views the patient’s history EMRs Cm1 by the access key k1 within the limited access time TAccess1.


### 3.7. Update

When the doctorD2 obtains the patient’s EMRs with the access key k1, he first understands the patient’s medical history through historical EMRs and generates a new EMRs m′ on this basis and sends them to edge server. Then, the edge server checks whether the new EMRs have duplicate data by comparing them with the historical EMRs. If there are duplicates, the edge server adds a mark a and a date t based on the historical EMRs and then encrypts the updated EMRs to ciphertext Encm2 with k2 and adds the newly EMRs to the patient’s personal EMRs system in order to complete the update of the EMRs.WhenP registers and sees a doctor Dn in the hospital ℋn, repeat the above process.


## 3.1. Initialization

The key generation center according to the security parameterλ generates the public parameter par=p,g,G1,G2,e,H1,H2, where G1 and G2 are the cyclic group of prime order p, the generator of group G1 is g, e satisfies G1×G1⟶G2, and H1:0,1∗⟶G1 and H2:G2⟶0,1logp are two hash functions.


## 3.2. Key Generation

The patientP randomly selects α∈Zp∗ and calculates h=gα, so the keys of P are skP=α,pkP=gα. Similarly, the doctors D1 and D2 randomly select β and γ and calculate d=gβ and f=gγ, so the keys of D1 and D2 are skD=β,pkD=gβ and skD2=γ,pkD2=gγ.


## 3.3. Registration

The patientP registers with the hospital ℋ1, and the ℋ1 stores the patient’s identification IDP, randomly selects the treatment key τ, and sends the encrypted EncpkP,τ to P. The hospital ℋ1 makes an appointment with the attending doctor D1 for the patient P and encrypts the appointment information App=IDD1‖Dep‖Aux with the τ and sends it to P. The patient uses τ to decrypt the App and obtains the doctor’s IDD1, department Dep, and other auxiliary information Aux. At the same time, the hospital ℋ1 sends τ to the attending doctor D1.


## 3.4. Authorization

The patientP authorizes the doctor D1 to generate EMRs. P generates an authorization guarantee Gua1=IDρ‖IDD1‖TAccess1‖k1‖τ, k1∈Zp∗, while signing it with the personal private key σGua1=sigskρ,Gua1 and encrypting it with the doctor’s public key C1=EncpkD1,Gua1‖σGua1, and then sends C1 to D1. The doctor D1 decrypts C1 with the personal private key skD1 to obtain the Gua1 and the signature σGua1, and then the doctor verifies the correctness of the authorization with the patient’s public key pkP.


## 3.5. Generation and Storage of Electronic Medical Records

When the verification is passed, the doctor generates EMRsm1 for P and sends them to edge server. The edge server calculates the ciphertext Cm1=H1k1m1 and then randomly selects u∈Zp∗ and calculates I1=gu, I2=H2r, I=I1,I2, where r=eH1IDP,pkDu. Finally, it uploads ACS=C1,IDD1,I,Cm1 to the cloud server and uploads AℬC=H1IDP,I1,I2,N to the blockchain, here N is the file number returned by the cloud server.


## 3.6. Access

WhenP registers and sees a doctor D2 in the hospital ℋ2, P first authorizes D2 to access his EMRs through the authorization guarantee Gua2=IDρ‖IDD2‖τ‖k1‖Taccess and encrypts it as C2=EncpkD2,Gua2‖σGua2, where σGua2=sigskρ,Gua2. The doctor D2 sends C2=EncpkD2,Gua2‖σGua2 to edge server, the edge server decrypts C2 with the personal private key skD2 to obtain the Gua2 and the signature σGua2 and then verifies the correctness of the authorization with the patient’s public key pkP.When the verification is passed, the edge server calculatesT=H1IDP′β∈G1 and sends A=Gua2,IDD2,T to the blockchain nodes. The blockchain nodes execute matching algorithms through H2eT,I1=I2 and return the corresponding file number N. The CS finds the corresponding ciphertext Cm1 through the file number N and returns it to edge server. The edge server sends it to the doctor D2. D2 views the patient’s history EMRs Cm1 by the access key k1 within the limited access time TAccess1.


## 3.7. Update

When the doctorD2 obtains the patient’s EMRs with the access key k1, he first understands the patient’s medical history through historical EMRs and generates a new EMRs m′ on this basis and sends them to edge server. Then, the edge server checks whether the new EMRs have duplicate data by comparing them with the historical EMRs. If there are duplicates, the edge server adds a mark a and a date t based on the historical EMRs and then encrypts the updated EMRs to ciphertext Encm2 with k2 and adds the newly EMRs to the patient’s personal EMRs system in order to complete the update of the EMRs.WhenP registers and sees a doctor Dn in the hospital ℋn, repeat the above process.


## 4. Analysis

### 4.1. Correctness

Theorem 1.
In the search phase, the blockchain nodes need to verify the identity of the visitor and secondly verify whether the trapdoor submitted by the edge server has corresponding index and other information, that is, needs to verify whether the equationH2eTCS,I1=I2 is established. If the equation holds, the corresponding index is returned for the doctor; otherwise, the visit is denied.Proof.
According to the above, we know(1)eT,I1=eH1IDP′β,gu,=eH1IDP′,guβ,=eH1IDP′,pkDu.
If(2)IDP′=IDP,then(3)eH1IDP′,pkDu=eH1IDP,pkDu=r.
So,(4)H2eT,I1=H2r=I2.
Through the proof, we can find that the verification equation is established, the ciphertext retrieval verification is successful, and the result is correct. So, it can retrieve the index information corresponding to the patient’s history EMRs, and the correctness of the scheme is verified.


### 4.2. Security

The scheme satisfies the difficult problem of the BDH assumption; the proof is as follows.Theorem 2.
Assuming that the BDH problem is difficult, the scheme is indistinguishable under adaptive chosen ciphertext attacks (IND-CCA2).SupposeH1:0,1∗⟶G1 and H2:0,1∗⟶Zp∗ are two random oracles; A is the adversary of the superior εk attack scheme. At any time, A can ask H1 or H2 and ask at most qH1 and qH2 times, respectively. Constructing the simulator ℬ can solve the BDH problem with at least the advantage of 2εk/eqH2 and the running time of OtimeA.Proof.
Suppose the simulatorℬ has known g,gx,gy,gzx,y,z∈Zp∗ and simulate the challenger, with A as the adversary, and the goal is to calculate D=eg,gxyz∈G2.
For simplicity, suppose (1)A will not initiate the same query to H1IDP twice, and (2) if A requests a trapdoor for keyword IDP, it has already asked H1IDP before.(1)
System establishment: the simulatorℬ builds the system, generates the safety parameter λ, runs the algorithm setup 1λ, obtains the safety parameter par=p,g,G1,G2,e,H1,H2, and generates the keys KC=skC,pkC and keeps the private key skC. The simulator chooses x,y,z∈Zp∗, setup g,u1=gx,u2=gy,u3=gz∈G1. The simulator challenger ℬ returns the parameters Par and the public key pkC to adversary A, and A asks the simulator ℬ with random oracles.(2)
H1 and H2 query: ℬ randomly chooses l∈1,⋯,qH1. l is the guess value of ℬ, and the l-th query to H1 corresponds to the final attack result of A. At any time, A can ask H1 or H2 and ask at most qH1 and qH2 times, respectively.(1)
InquireH1: ℬ creates an H1list, initially empty, and the element is wi,hi,ai. When A initiates the i-th query (set the query value as wi), ℬ responds as follows:Ifwi is already in the list H1list, ℬ takes out the 3-tuple wi,hi,ai and responds with H1wi=hi∈G1. Otherwise, ℬ chooses a random ai∈Zp and calculates as follows: if i=l, ℬ calculates hi=y⋅gai∈G1; otherwise, ℬ calculates hi=gai∈G1. Then, ℬ adds wi,hi,ai to H1list and responds to A with hi.(2)
InquireH2: similarly, ℬ creates a list H2list (initially empty) with element type ri,vi, A can query H2list at any time, and ℬ responds as follows:Ifsi is already in H2list, answer with H2ri=vi; otherwise, choose vi∈0,1n randomly, answer with H2ri=vi, and add ri,vi to H2list.(3)
Trapdoor query (at mostqH1 times): when A requests the trapdoor TCS corresponding to the keyword wi, let i satisfy w=wi, and wi represents the query value of the i-th query to H1. ℬ answers the query as follows:Ifi≠l, then there is a 3-tuple wi,hi,ai in H1list, calculate and return Ti=u1ai. If i=l, then interrupt.(4)
Challenge:A initiates a challenge. Suppose the keywords of A’s challenge are w0 and w1, and ℬ randomly selects J∈0,1logp and responds with C=u3,J.Note that this response implicitly definesH2eH1wb,u1z=J. In other words, J=H2eH1wb,u1z=H2eygab,gac=H2egab,gazazy+ab. According to this definition, C is a valid trapdoor for the keyword wb.(5)
Trapdoor query:A can continue to do trapdoor queries for the keyword wi; the only restriction is that wi≠w0,w1, and ℬ responds as before.(6)
Guess:A outputs the guess b′∈0,1, and ℬ randomly selects ri,vi from H2list and outputs r/eu1,u3ab as his guess of eg,gxyz, where ab is the value used in the challenge phase. This is because H2list contains a pair of ri,vi, where r=eH1wb,u1z=eg,gazy+ab. If ℬ chooses this pair from H2list, then r/eu1,u3ab=eg,gazy+ab. The advantage of ℬ choosing the correct result is 2ελ/eqH2, so the probability that ℬ breaks the security of the proposed scheme is PrAr/eu1,u3ab=eg,gazy+ab≥2ελ/eqH2.


### 4.3. Performance

By comparing Table2, we can find that all the above schemes are based on blockchain and realized access control and privacy protection functions. But none of the literatures [11, 20, 22, 23] can implement data deduplication. In addition, reference [11] did not use searchable encryption technology to realize ciphertext search, and reference [20] did not realize data sharing. Therefore, the function of this scheme is better.Table 2
Function comparison of different schemes.
FeaturesLiteraturesLiterature [11]Literature [20]Literature [22]Literature [23]This articleBlockchain√√√√√Access control√√√√√Privacy protection√√√√√SE×√√√√Data sharing√×√√√Deduplication××××√Nowadays, there are many researches on EMRs, but it still faces many problems to be solved urgently. For example, we are familiar with privacy protection, access control, and data-sharing issues. With the development of science and technology, more problems have been exposed between the increasing demand of people and the actual status of EMRs. For example, there are no systematic EMRs for patients, and the storage of patients’ EMRs is relatively scattered and unsystematic, which makes patients unable to understand personal health systematically. In addition, given the huge data storage and limited storage space of EMRs, deduplication is particularly important. Deduplication can effectively reduce storage consumption and improve storage efficiency. Therefore, it is also one of the urgent problems to be solved in EMRs. In response to the above problems, this article provides some solutions, as shown in the following.According to Table3, the plan allows the doctor to update the patient’s previous EMRs, so the EMRs system can store the latest medical record in time which ensures the timeliness of the data and realizes integrity and systematic of the patient’s EMRs data. Secondly, the deletion of duplicate data effectively improves storage efficiency and reduces storage overhead.Table 3
Problems and the solutions of existing EMRs.
TypesProblemsSolutionsSystematisms of personal EMRsLack of systematic EMRs for the individualsBy updating EMRs, establishing systematic personal EMRs for patientsPrivacy leaksThe personal EMRs information of patients is directly shared without encryption or is intercepted or forged by malicious attackers, etc. There is a risk of privacy leakage, and the privacy of patients cannot be guaranteedUsing SE technology to search ciphertexts to avoid privacy leakage, and using blockchain technology to ensure the immutability and integrity of dataStoreFor the same patient, the same EMRs from the different hospital is repeatedly stored, which makes the storage space consumption highDelete newly added duplicate data, only mark duplicate EMRs without repetitive storage, and add new cases to the original EMRsData sharingThe hospitals are relatively independent and have poor interaction. The EMRs of the same patient cannot be shared between hospitals in real time, and there is a problem of data islandsEstablish an alliance chain between the hospitals to realize real-time EMRs data sharingAccess control permissionsPatients are unaware of personal case sharing and have no access control authority to personal medical records. The hospital can view and share patient data at any time without the patient knowingOnly the doctors authorized by the patient can view and update the patient’s personal EMRs


### 4.4. Simulation

The operating system used in the simulation experiment in this article is Windows 10, Intel CPU i7-9750H, and MyEclipse 2015 CI. From the initialization, key generation, encryption, decryption, indexing, and trapdoor generation stages, the execution efficiency of the scheme is investigated. The initialization phase is the configuration of system parameters. The key generation stage is mainly used to generate participants’ personal keys. The encryption and decryption use symmetric encryption algorithms. Indexes and trapdoors are used for file query and retrieval. The program selected documents [22, 23] for comparison, and the selected documents were all EMRs sharing schemes based on the blockchain. The comparison results of each stage are shown in Figure 2.Figure 2
Comparison of the running time of each stage.It can be seen from Figure2 that the execution efficiency of this article is relatively higher than that of documents [22, 23], and documents [22] need to be improved in terms of efficiency. In the index generation stage, the cost of this article is slightly higher than literature [23], while other stages are lower than the comparative literature. This is because literature [23] does not require bilinear operation in the index generation stage, while the solution of this paper needs to perform the bilinear operation, which makes the efficiency relatively lower than literature [23]. In the encryption and decryption stages, literatures [22, 23] require complex operations with the high cost of bilinear pairing and modular idempotence. While this scheme only needs one hash and one inverse operation, computational efficiency is relatively high. In the trapdoor generation stage, the solution in this paper only needs to perform power operation and hash operation, which is more efficient than the comparative literature.In addition, to further verify the program’s performance, the program uses keywords as variables to compare the execution efficiency of the index, trapdoor generation, and search phrases. Figure3 is the execution time of the index generation phase, Figure 4 is the execution time of the trapdoor generation phase, and Figure 5 is the execution time of the retrieval phase.Figure 3
Comparison of index generation time.Figure 4
Comparison of trapdoor generation time.Figure 5
Comparison of retrieval time.It can be seen from Figures3–5 that with the increase of keywords, the running time of the trapdoor, indexing and retrieval phases in this article, and the comparative literature show an increasing trend. Literature [23] has a higher running time cost with the increase of keywords in the three stages. The running time cost of this article and the literature [22] is relatively consistent, and its execution efficiency is relatively low. Compared with literature [22], the keyword ciphertext matching of this scheme belongs to exact matching, while literature [22] belongs to fuzzy matching. So, the keyword matching result of this scheme is more accurate than literature [22].


## 4.1. Correctness

Theorem 1.
In the search phase, the blockchain nodes need to verify the identity of the visitor and secondly verify whether the trapdoor submitted by the edge server has corresponding index and other information, that is, needs to verify whether the equationH2eTCS,I1=I2 is established. If the equation holds, the corresponding index is returned for the doctor; otherwise, the visit is denied.Proof.
According to the above, we know(1)eT,I1=eH1IDP′β,gu,=eH1IDP′,guβ,=eH1IDP′,pkDu.
If(2)IDP′=IDP,then(3)eH1IDP′,pkDu=eH1IDP,pkDu=r.
So,(4)H2eT,I1=H2r=I2.
Through the proof, we can find that the verification equation is established, the ciphertext retrieval verification is successful, and the result is correct. So, it can retrieve the index information corresponding to the patient’s history EMRs, and the correctness of the scheme is verified.


## 4.2. Security

The scheme satisfies the difficult problem of the BDH assumption; the proof is as follows.Theorem 2.
Assuming that the BDH problem is difficult, the scheme is indistinguishable under adaptive chosen ciphertext attacks (IND-CCA2).SupposeH1:0,1∗⟶G1 and H2:0,1∗⟶Zp∗ are two random oracles; A is the adversary of the superior εk attack scheme. At any time, A can ask H1 or H2 and ask at most qH1 and qH2 times, respectively. Constructing the simulator ℬ can solve the BDH problem with at least the advantage of 2εk/eqH2 and the running time of OtimeA.Proof.
Suppose the simulatorℬ has known g,gx,gy,gzx,y,z∈Zp∗ and simulate the challenger, with A as the adversary, and the goal is to calculate D=eg,gxyz∈G2.
For simplicity, suppose (1)A will not initiate the same query to H1IDP twice, and (2) if A requests a trapdoor for keyword IDP, it has already asked H1IDP before.(1)
System establishment: the simulatorℬ builds the system, generates the safety parameter λ, runs the algorithm setup 1λ, obtains the safety parameter par=p,g,G1,G2,e,H1,H2, and generates the keys KC=skC,pkC and keeps the private key skC. The simulator chooses x,y,z∈Zp∗, setup g,u1=gx,u2=gy,u3=gz∈G1. The simulator challenger ℬ returns the parameters Par and the public key pkC to adversary A, and A asks the simulator ℬ with random oracles.(2)
H1 and H2 query: ℬ randomly chooses l∈1,⋯,qH1. l is the guess value of ℬ, and the l-th query to H1 corresponds to the final attack result of A. At any time, A can ask H1 or H2 and ask at most qH1 and qH2 times, respectively.(1)
InquireH1: ℬ creates an H1list, initially empty, and the element is wi,hi,ai. When A initiates the i-th query (set the query value as wi), ℬ responds as follows:Ifwi is already in the list H1list, ℬ takes out the 3-tuple wi,hi,ai and responds with H1wi=hi∈G1. Otherwise, ℬ chooses a random ai∈Zp and calculates as follows: if i=l, ℬ calculates hi=y⋅gai∈G1; otherwise, ℬ calculates hi=gai∈G1. Then, ℬ adds wi,hi,ai to H1list and responds to A with hi.(2)
InquireH2: similarly, ℬ creates a list H2list (initially empty) with element type ri,vi, A can query H2list at any time, and ℬ responds as follows:Ifsi is already in H2list, answer with H2ri=vi; otherwise, choose vi∈0,1n randomly, answer with H2ri=vi, and add ri,vi to H2list.(3)
Trapdoor query (at mostqH1 times): when A requests the trapdoor TCS corresponding to the keyword wi, let i satisfy w=wi, and wi represents the query value of the i-th query to H1. ℬ answers the query as follows:Ifi≠l, then there is a 3-tuple wi,hi,ai in H1list, calculate and return Ti=u1ai. If i=l, then interrupt.(4)
Challenge:A initiates a challenge. Suppose the keywords of A’s challenge are w0 and w1, and ℬ randomly selects J∈0,1logp and responds with C=u3,J.Note that this response implicitly definesH2eH1wb,u1z=J. In other words, J=H2eH1wb,u1z=H2eygab,gac=H2egab,gazazy+ab. According to this definition, C is a valid trapdoor for the keyword wb.(5)
Trapdoor query:A can continue to do trapdoor queries for the keyword wi; the only restriction is that wi≠w0,w1, and ℬ responds as before.(6)
Guess:A outputs the guess b′∈0,1, and ℬ randomly selects ri,vi from H2list and outputs r/eu1,u3ab as his guess of eg,gxyz, where ab is the value used in the challenge phase. This is because H2list contains a pair of ri,vi, where r=eH1wb,u1z=eg,gazy+ab. If ℬ chooses this pair from H2list, then r/eu1,u3ab=eg,gazy+ab. The advantage of ℬ choosing the correct result is 2ελ/eqH2, so the probability that ℬ breaks the security of the proposed scheme is PrAr/eu1,u3ab=eg,gazy+ab≥2ελ/eqH2.


## 4.3. Performance

By comparing Table2, we can find that all the above schemes are based on blockchain and realized access control and privacy protection functions. But none of the literatures [11, 20, 22, 23] can implement data deduplication. In addition, reference [11] did not use searchable encryption technology to realize ciphertext search, and reference [20] did not realize data sharing. Therefore, the function of this scheme is better.Table 2
Function comparison of different schemes.
FeaturesLiteraturesLiterature [11]Literature [20]Literature [22]Literature [23]This articleBlockchain√√√√√Access control√√√√√Privacy protection√√√√√SE×√√√√Data sharing√×√√√Deduplication××××√Nowadays, there are many researches on EMRs, but it still faces many problems to be solved urgently. For example, we are familiar with privacy protection, access control, and data-sharing issues. With the development of science and technology, more problems have been exposed between the increasing demand of people and the actual status of EMRs. For example, there are no systematic EMRs for patients, and the storage of patients’ EMRs is relatively scattered and unsystematic, which makes patients unable to understand personal health systematically. In addition, given the huge data storage and limited storage space of EMRs, deduplication is particularly important. Deduplication can effectively reduce storage consumption and improve storage efficiency. Therefore, it is also one of the urgent problems to be solved in EMRs. In response to the above problems, this article provides some solutions, as shown in the following.According to Table3, the plan allows the doctor to update the patient’s previous EMRs, so the EMRs system can store the latest medical record in time which ensures the timeliness of the data and realizes integrity and systematic of the patient’s EMRs data. Secondly, the deletion of duplicate data effectively improves storage efficiency and reduces storage overhead.Table 3
Problems and the solutions of existing EMRs.
TypesProblemsSolutionsSystematisms of personal EMRsLack of systematic EMRs for the individualsBy updating EMRs, establishing systematic personal EMRs for patientsPrivacy leaksThe personal EMRs information of patients is directly shared without encryption or is intercepted or forged by malicious attackers, etc. There is a risk of privacy leakage, and the privacy of patients cannot be guaranteedUsing SE technology to search ciphertexts to avoid privacy leakage, and using blockchain technology to ensure the immutability and integrity of dataStoreFor the same patient, the same EMRs from the different hospital is repeatedly stored, which makes the storage space consumption highDelete newly added duplicate data, only mark duplicate EMRs without repetitive storage, and add new cases to the original EMRsData sharingThe hospitals are relatively independent and have poor interaction. The EMRs of the same patient cannot be shared between hospitals in real time, and there is a problem of data islandsEstablish an alliance chain between the hospitals to realize real-time EMRs data sharingAccess control permissionsPatients are unaware of personal case sharing and have no access control authority to personal medical records. The hospital can view and share patient data at any time without the patient knowingOnly the doctors authorized by the patient can view and update the patient’s personal EMRs


## 4.4. Simulation

The operating system used in the simulation experiment in this article is Windows 10, Intel CPU i7-9750H, and MyEclipse 2015 CI. From the initialization, key generation, encryption, decryption, indexing, and trapdoor generation stages, the execution efficiency of the scheme is investigated. The initialization phase is the configuration of system parameters. The key generation stage is mainly used to generate participants’ personal keys. The encryption and decryption use symmetric encryption algorithms. Indexes and trapdoors are used for file query and retrieval. The program selected documents [22, 23] for comparison, and the selected documents were all EMRs sharing schemes based on the blockchain. The comparison results of each stage are shown in Figure 2.Figure 2
Comparison of the running time of each stage.It can be seen from Figure2 that the execution efficiency of this article is relatively higher than that of documents [22, 23], and documents [22] need to be improved in terms of efficiency. In the index generation stage, the cost of this article is slightly higher than literature [23], while other stages are lower than the comparative literature. This is because literature [23] does not require bilinear operation in the index generation stage, while the solution of this paper needs to perform the bilinear operation, which makes the efficiency relatively lower than literature [23]. In the encryption and decryption stages, literatures [22, 23] require complex operations with the high cost of bilinear pairing and modular idempotence. While this scheme only needs one hash and one inverse operation, computational efficiency is relatively high. In the trapdoor generation stage, the solution in this paper only needs to perform power operation and hash operation, which is more efficient than the comparative literature.In addition, to further verify the program’s performance, the program uses keywords as variables to compare the execution efficiency of the index, trapdoor generation, and search phrases. Figure3 is the execution time of the index generation phase, Figure 4 is the execution time of the trapdoor generation phase, and Figure 5 is the execution time of the retrieval phase.Figure 3
Comparison of index generation time.Figure 4
Comparison of trapdoor generation time.Figure 5
Comparison of retrieval time.It can be seen from Figures3–5 that with the increase of keywords, the running time of the trapdoor, indexing and retrieval phases in this article, and the comparative literature show an increasing trend. Literature [23] has a higher running time cost with the increase of keywords in the three stages. The running time cost of this article and the literature [22] is relatively consistent, and its execution efficiency is relatively low. Compared with literature [22], the keyword ciphertext matching of this scheme belongs to exact matching, while literature [22] belongs to fuzzy matching. So, the keyword matching result of this scheme is more accurate than literature [22].


## 5. Conclusions

This article proposes a cross-domain sharing of EMRs among different hospitals based on blockchain and edge computing, which solves the difficulty of EMRs data sharing among hospitals and the problem of isolated and duplicated storage. Through patient authorization, cross-domain secure sharing of EMRs is realized and making the patient’s personal EMRs more systematic and complete. The use of blockchain technology ensures that the data cannot be tampered with, and the use of searchable encryption ensures the security of EMRs and personal privacy. Edge servers offload the computing tasks of cloud services and improve computing efficiency. By analysis, it is found that the security of the scheme is proved based on the BDH assumption. Performance analysis and simulation experiments show that the computational complexity is relatively low and has high execution efficiency.



---

*Source: 7310771-2021-11-19.xml*