# A Privacy-Preserving Intelligent Medical Diagnosis System Based on Oblivious Keyword Search

Authors: Zhaowen Lin; Xinglin Xiao; Yi Sun; Yudong Zhang; Yan Ma
Journal: Mathematical Problems in Engineering
 (2017)

---

## Abstract

One of the concerns people have is how to get the diagnosis online without privacy being jeopardized. In this paper, we propose a privacy-preserving intelligent medical diagnosis system (IMDS), which can efficiently solve the problem. In IMDS, users submit their health examination parameters to the server in a protected form; this submitting process is based on Paillier cryptosystem and will not reveal any information about their data. And then the server retrieves the most likely disease (or multiple diseases) from the database and returns it to the users. In the above search process, we use the oblivious keyword search (OKS) as a basic framework, which makes the server maintain the computational ability but cannot learn any personal information over the data of users. Besides, this paper also provides a preprocessing method for data stored in the server, to make our protocol more efficient.


---

## Body

## 1. Introduction

Due to the increasing health consciousness, the intelligent medical diagnosis system has received immense popularity around the world. Nowadays, patients can get personalized online medical services based on the original health data submitted by themselves, without the need for doctors. That is, patients can obtain a reasonable diagnosis anytime and anywhere, as long as they have health data and are willing to transfer them to the server. People are getting more and more accustomed to convenience that is made possible by the IMDS. Moreover, this kind of intelligent medical service is inexpensive, which means, via popularizing IMDS, we can reduce the expenditure of public medical services. All the above shows that IMDS has a bright future and will be an essential part in the future life [1–3].However, the privacy disclosure issue has become a big obstacle for developing IMDS. Patients are afraid that their sensitive personal information may fall into wrong hands. In most cases, poor security mechanisms and weak safety awareness are main reasons for the information leakage. For example, in 2009, the AvMed Health Plans, a large nonprofit US health plans org, exposed the personal information of 200,000 subscribers and their dependents, as a result of the theft of two company laptops that contain sensitive information [4]. Types of divulged personal information include names, addresses, phone numbers, social security numbers, and protected health information. For this reason, designing a privacy-preserving IMDS, which can ensure the privacy of patients, is an urgent task. Besides, the security of the server also cannot be ignored. Currently, on this respect, various schemes have been proposed [5–7]. One example is [8]; it designs a privacy-preserving recommendation system using homomorphic encryption. This system allows patients to rate physicians based on their satisfaction, so that other patients can choose a popular physician via these ratings. Another paper that also describes a physicians recommendation system based on hybrid matrix factorization is raised by [9]. This paper applies text sentiment analysis to analyze patient comments that increase accuracy in grading physicians.In this paper, combining the additive homomorphic cryptosystem and the oblivious keyword search, we propose a privacy-preserving IMDS, and the security of data stored in server can also be ensured. Patients can get an effective and reasonable diagnosis in our system, after uploading their health examination data to the server. The diagnosis will tell the patient which parameters are not in the normal range, and which diseases he is likely to get. Moreover, our system contains a preprocessing phase to reduce the calculation amount of search.The rest of the paper is organized as follows. Section2 gives a brief overview of related works. In Section 3, we show the framework and notions. Section 4 provides the detailed description of our protocol. Section 5 analyzes the security of this system. In the end, Section 6 discusses the performance of this system and concludes the paper.


## 2. Preliminaries

### 2.1. Paillier Cryptosystem

In 1999, Paillier proposed a homomorphic public key cryptosystem called Paillier cryptosystem, which is a common encryption scheme used for data protection [10]. The homomorphic property of this cryptosystem means that people can get the sum of two plaintexts, according to decrypting the product of their corresponding ciphertexts. Besides, Paillier cryptosystem is a semantically secure cryptosystem, which means no information about the plaintext can be obtained from the according ciphertext. Therefore, calculations over ciphertexts in Paillier cryptosystem will not reveal any extra information. The Paillier cryptosystem is briefly described as follows.Letm be a message, p and q are two large prime numbers, n=pq,  g is a random integer, and r is a random number. The encryption of m is defined as(1)c=gm·rmmod⁡n2.The decryption of m is defined as(2)m=Lcλmod⁡n2·μmod⁡n,where L(u)=u-1/n,  μ=(L(gλmod⁡n2))-1mod⁡n, and λ=lcm(p-1,q-1).


### 2.2. Oblivious Keyword Search (OKS)

Oblivious keyword search (OKS) protocol was proposed by Wakaha Ogata and Kaoru Kurosawa in 2002; it is a secure keyword search scheme between two parties [10]. In an OKS protocol, there is a server S that maintains some secret data and a user U that is allowed to search for the data containing the keyword chosen by the user; this chosen keyword is secret to S. Next, we introduce an efficient k-out-of-n OKS protocol based on RSA blind signature (OKSkn protocol) as follows.In theOKSkn protocol, S stores data B1,…,Bn. Define(3)Bi=wi,ci,where Δ={w1,…,wn} is the set of keywords, wi∈Δ, and ci is the corresponding content.


#### 2.2.1. Submit Phase

S generates a public key (N,e) and a secret key d of RSA and then for i=1,…,n computes(4)Ki=Hwidmod⁡N,Ei=Gwi∥Ki∥i⊕0l∥Dci, where H is a hashing function and G is a pseudorandom generator. Then S send E1,…,En to U.


#### 2.2.2. Transfer Phase

At each transfer roundj, firstly, U choose a keyword wj∗ and a random element r to compute(5)Y=reHwj∗mod⁡N, and then U send Y to S. Secondly, S computes K′=Ydmod⁡N and sends it to U. U computes K=K′/r=H(wj∗)dmod⁡N. Finally, let J=∅; J is the set that stores the search results. For i=1,…,n,  U computes(6)ai∥bi=Ei⊕Gwj∗∥K∥i.If ai=0l, then U add (i,bi) to J.


### 2.3. Useful Tools

We introduce here two generic subprotocols from literatures [8, 11–13], which will be employed in our protocol, and all these protocols can be easily implemented by using the Scalar Product Protocol; it is a standard protocol mentioned in [13]. Moreover, let [a] denote an encrypted value of a. The subprotocols are described as follows:(1)
Bits(l,[a]): return [a]lB, which is an encryption of l least significant bits of the plaintext of [a]; that is, [a]lB=〈[a0,…,al-1]〉;(2)
Min([a1]lB,[a2]lB): return an encrypted bit [b], where b=1 iff a1≤a2.


## 2.1. Paillier Cryptosystem

In 1999, Paillier proposed a homomorphic public key cryptosystem called Paillier cryptosystem, which is a common encryption scheme used for data protection [10]. The homomorphic property of this cryptosystem means that people can get the sum of two plaintexts, according to decrypting the product of their corresponding ciphertexts. Besides, Paillier cryptosystem is a semantically secure cryptosystem, which means no information about the plaintext can be obtained from the according ciphertext. Therefore, calculations over ciphertexts in Paillier cryptosystem will not reveal any extra information. The Paillier cryptosystem is briefly described as follows.Letm be a message, p and q are two large prime numbers, n=pq,  g is a random integer, and r is a random number. The encryption of m is defined as(1)c=gm·rmmod⁡n2.The decryption of m is defined as(2)m=Lcλmod⁡n2·μmod⁡n,where L(u)=u-1/n,  μ=(L(gλmod⁡n2))-1mod⁡n, and λ=lcm(p-1,q-1).


## 2.2. Oblivious Keyword Search (OKS)

Oblivious keyword search (OKS) protocol was proposed by Wakaha Ogata and Kaoru Kurosawa in 2002; it is a secure keyword search scheme between two parties [10]. In an OKS protocol, there is a server S that maintains some secret data and a user U that is allowed to search for the data containing the keyword chosen by the user; this chosen keyword is secret to S. Next, we introduce an efficient k-out-of-n OKS protocol based on RSA blind signature (OKSkn protocol) as follows.In theOKSkn protocol, S stores data B1,…,Bn. Define(3)Bi=wi,ci,where Δ={w1,…,wn} is the set of keywords, wi∈Δ, and ci is the corresponding content.


### 2.2.1. Submit Phase

S generates a public key (N,e) and a secret key d of RSA and then for i=1,…,n computes(4)Ki=Hwidmod⁡N,Ei=Gwi∥Ki∥i⊕0l∥Dci, where H is a hashing function and G is a pseudorandom generator. Then S send E1,…,En to U.


### 2.2.2. Transfer Phase

At each transfer roundj, firstly, U choose a keyword wj∗ and a random element r to compute(5)Y=reHwj∗mod⁡N, and then U send Y to S. Secondly, S computes K′=Ydmod⁡N and sends it to U. U computes K=K′/r=H(wj∗)dmod⁡N. Finally, let J=∅; J is the set that stores the search results. For i=1,…,n,  U computes(6)ai∥bi=Ei⊕Gwj∗∥K∥i.If ai=0l, then U add (i,bi) to J.


## 2.2.1. Submit Phase

S generates a public key (N,e) and a secret key d of RSA and then for i=1,…,n computes(4)Ki=Hwidmod⁡N,Ei=Gwi∥Ki∥i⊕0l∥Dci, where H is a hashing function and G is a pseudorandom generator. Then S send E1,…,En to U.


## 2.2.2. Transfer Phase

At each transfer roundj, firstly, U choose a keyword wj∗ and a random element r to compute(5)Y=reHwj∗mod⁡N, and then U send Y to S. Secondly, S computes K′=Ydmod⁡N and sends it to U. U computes K=K′/r=H(wj∗)dmod⁡N. Finally, let J=∅; J is the set that stores the search results. For i=1,…,n,  U computes(6)ai∥bi=Ei⊕Gwj∗∥K∥i.If ai=0l, then U add (i,bi) to J.


## 2.3. Useful Tools

We introduce here two generic subprotocols from literatures [8, 11–13], which will be employed in our protocol, and all these protocols can be easily implemented by using the Scalar Product Protocol; it is a standard protocol mentioned in [13]. Moreover, let [a] denote an encrypted value of a. The subprotocols are described as follows:(1)
Bits(l,[a]): return [a]lB, which is an encryption of l least significant bits of the plaintext of [a]; that is, [a]lB=〈[a0,…,al-1]〉;(2)
Min([a1]lB,[a2]lB): return an encrypted bit [b], where b=1 iff a1≤a2.


## 3. The Framework

This section we develop the framework of our privacy-preserving IMDS. At the beginning, we describe two entities interacting with each other: the userU and the server S.In the field ofU, each U measures n private health examination parameters of his own body in advance, such as blood glucose, vital capacity, and vitamin content. U uploads those health data to S for getting health service. We denote n parameters that U measured as p1,…,pn and denote the corresponding measured value of p1,…,pn as rp1,…,rpn.In the aspect ofS, it stores a wide range of diseases d1,…,dh and generally more health examination parameters p1,…,pm than U, n≤m. Besides, we define vdi as the parameter vector of di∈{d1,…,dh}, which represents the relationship between the disease di and all kinds of parameters p1,…,pm stored in S. Suppose the jth bit of vdi is 1, which means when disease di occurs, the measured value of parameter pj will be smaller than the normal range. Similarly, 2 means pj will be larger than the normal range, and 0 means pj will in the normal range. Obviously, vdi has m bits. Thus, each pi∈{p1,…,pm} has the upper limit upi and the lower limit lpi to represent the normal range. In S, the above-mentioned di and vdi are represented by D1,…,Dh. Define(7)Di=di,vdi.Next we introduce our framework. It contains three phases: submit phase, preprocessing phase, and search phase. The submit phase builds on the Paillier cryptosystem.U firstly uploads his health examination data [rp1],…,[rpn] to S in the form of encryption, using a secret key generated by the Paillier cryptosystem. At the meantime, U directly tells S which parameters he has uploaded, namely, p1,…,pn. Then, S compares all {[rpi]}i∈[1,n] with [upi] and [lpi] to get the parameter vector [vu], which represents whether each health examination parameter of U is in the normal range. The generation procedure of vu is depicted in Figure 1. In addition, the comparison is completed by functions Bits and Min mentioned in Section 2. In this comparison, S has no knowledge of the uploaded data but maintains the computational ability. Finally, S returns [vu] to U in encrypted form.Figure 1
The structure of our intelligent medical diagnosis system.To facilitate the following search operation and make it faster, we propose a transform method in the preprocessing phase.S uses this method to split and reshape all vdi into the keywords set WP, and reorganizes D1,…,Dh to the new data structures B1,…,Bh∗, which are pairs of keyword and disease. After that, to prepare the oblivious keyword search (OKS) used in the search phase, S calculates E1,…,Eh∗ and sends them to U. E1,…,Eh∗ can be understood as the encrypted form of B1,…,Bh∗.In the search phase, we utilize the oblivious keyword search (OKS) to realize privacy-preserving search. Firstly,U constructs a set of keywords on the basis of vu and successively calculates Y for each keyword and sends them to S. We can also understand Y as the encrypted form of a keyword. Then, S computes K using Y and returns it to U. Next, U retrieves keywords constructed by vu in the E1,…,Eh∗ via (6) and thus gets their corresponding diseases. Finally, according to the search results, S finds the disease with the highest frequency as the diagnosis for U. The whole structure of our IMDS is depicted in Figure 2.Figure 2
The structure of our privacy-preserving intelligent medical diagnosis system.


## 4. Our Protocol

In this section, we detail the implementation of our protocol.


### 4.1. Submit Phase

The submit process is established on the Paillier cryptosystem; it is an additive homomorphic cryptosystem. First,U generates a secret key k and uses the public key encryption to distribute k to S. Then, for all rpi∈{rp1,…,rpn}, U sends the [rpi]lB to S using Bits. Similarly, S executes Bits to get [upi]lB and [lpi]lB. Next, Min can help S to compare [rpi]lB with [lpi]lB and [upi]lB. The comparison results will be transferred to U after being encrypted. According to these results, U constructs the parameter vector vu. We define the parameter vector vu of the user U as follows:(8)theith  bit  ofvu=0,lpi≤rpi≤upi1,rpi<lpi2,rpi>upi.The algorithm is shown in Algorithm1.Algorithm 1:Submission of health examination data.
Input: health examination data rp1,…,rpn, length parameter l
Output: user parameter vector vu
(1) U: executes [rpi]lB←Bits(l,[rpi])
(2) S: executes [upi]lB←Bits(l,[upi]) and [lpi]lB←Bits(l,[lpi])
(3) S: executes [m1]←Min([rpi]lB,[lpi]lB) and [m2]←Min([upi]lB,[rpi]lB)
(4) S: sends [m1] and [m2] to U
(5) U: decrypts [m1] and [m2], get m1 and m2
(6) if  m1==1  then
(7) executes the ith bit of vu←1
(8) else
(9) if  m2==1  then
(10) executes the ith bit of vu←2
(11) else
(12) executes the ith bit of vu←0
(13) end if
(14) end if
(15) return  vu


### 4.2. Preprocessing

To make following search process faster, dataD1,…,Dh stored in S need to be reorganized into a new structure. Let W={wi1,w12}i∈[1,m] be the set of keywords. Define(9)wi1=i∥1,wi2=i∥2,where i represents the mark number of pi. That is, a keyword is obtained by concatenating the mark number of a parameter with its values in vdi. We should note that only those abnormal parameters will be selected to create keywords. Now we define the new data structure as(10)Bj=wj,dj∗,where wj∈W and dj∗ is one of the diseases whose parameter vector v contains wj. The specific transformation method is described in Algorithm 2.Algorithm 2:Preprocessing of server data.
Input: D1,…,Dh, security parameter l, pseudo-random generator G, hash function H
Output: E1,…,Eh∗
(1) for  i∈[1,h]  do
(2) for  j∈[1,m]  do
(3) if the jth bit of vdi equals to 1 then
(4) create a new B=(wj1,di) and save it
(5) else
(6) if the jth bit of vdi equals to 2 then
(7) create a new B=(wj2,di) and save it
(8) end if
(9) end if
(10) end for
(11) end for
(12) generates a public key (N,e) and a secret key d of RSA, then publishes (N,e)
(13) for  k∈[1,h∗]  do
(14) compute Kk←Hwkdmod⁡N
(15) compute Ek←G(wk∥Kk∥k)⊕(0l∥dk∗)
(16) end for
(17) return  E1,…,Eh∗ to UNext,S generates a public key (N,e) and a secret key d of RSA and then only publishes (N,e). With the secret key d and the hash value of each wj∈W, S computes Ej and Kj. Finally, S outputs {Ej}j∈[1,h∗] to U, where h∗=2n. In addition, let l be a security parameter, G be a pseudorandom generator, and H be a hash function. The computational process is also described in Algorithm 2.


### 4.3. Transfer Phase

In the search phase,U successively finds out abnormal parameters by judging whether their values in vu equal 0 and constructs keywords for them. For example, if the ith bit of vu equals 0, then pi is a normal parameter for U; otherwise we say pi is an abnormal parameter. At each transfer round j, after choosing an abnormal parameter, U creates a keyword wj∗ by concatenating the mark number of chosen parameter with its values in vu. Then, U calculates Y and sends it to S, which is the encryption of wj∗. S returns the search result K′. According to decrypting K′, U retrieves keywords constructed by vu in the E1,…,Eh∗ via (6) and thus gets their corresponding diseases. We maintain these diseases in a list as suspected diseases at each transfer round and denote this list as J. When all abnormal parameters are traversed, we compute the frequency of occurrence of diseases in J, and output a diseases list Dmax that consists of diseases with the highest frequency as the final search result. The algorithm is described in Algorithm 3.Algorithm 3:Search for diagnosis results.
Input: user parameter vector vu, B1,…,Bh∗
Output: diseases list Dmax
(1) for  i∈[1,n]  do
(2) U: j←1
(3) if the ith bit of vu equals to 1 then
(4) execute wj∗←i∥1
(5) else
(6) if the ith bit of vu equals to 2 then
(7) execute wj∗←i∥2
(8) else
(9) continue
(10) end if
(11) end if
(12) chooses a random element r
(13) compute Y←reH(wj∗mod⁡N)
(14) send Y to S
(15) S: compute K′←Ydmod⁡N and send to U
(16) U: compute K←K′/r=Hwj∗dmod⁡N
(17) execute J←∅
(18) for  k∈[i,h∗]  do
(19) compute (ak∥bk)=Ek⊕G(wj∗∥K∥k)
(20) if  ak=0l  then
(21) U insert bk into J
(22) break
(23) end if
(24) end for
(25) j←j+1
(26) end for
(27) U: compute frequency of occurrence of diseases in the J, output a diseases list Dmax that consists of diseases with
the highest frequency.
(28) return  Dmax


## 4.1. Submit Phase

The submit process is established on the Paillier cryptosystem; it is an additive homomorphic cryptosystem. First,U generates a secret key k and uses the public key encryption to distribute k to S. Then, for all rpi∈{rp1,…,rpn}, U sends the [rpi]lB to S using Bits. Similarly, S executes Bits to get [upi]lB and [lpi]lB. Next, Min can help S to compare [rpi]lB with [lpi]lB and [upi]lB. The comparison results will be transferred to U after being encrypted. According to these results, U constructs the parameter vector vu. We define the parameter vector vu of the user U as follows:(8)theith  bit  ofvu=0,lpi≤rpi≤upi1,rpi<lpi2,rpi>upi.The algorithm is shown in Algorithm1.Algorithm 1:Submission of health examination data.
Input: health examination data rp1,…,rpn, length parameter l
Output: user parameter vector vu
(1) U: executes [rpi]lB←Bits(l,[rpi])
(2) S: executes [upi]lB←Bits(l,[upi]) and [lpi]lB←Bits(l,[lpi])
(3) S: executes [m1]←Min([rpi]lB,[lpi]lB) and [m2]←Min([upi]lB,[rpi]lB)
(4) S: sends [m1] and [m2] to U
(5) U: decrypts [m1] and [m2], get m1 and m2
(6) if  m1==1  then
(7) executes the ith bit of vu←1
(8) else
(9) if  m2==1  then
(10) executes the ith bit of vu←2
(11) else
(12) executes the ith bit of vu←0
(13) end if
(14) end if
(15) return  vu


## 4.2. Preprocessing

To make following search process faster, dataD1,…,Dh stored in S need to be reorganized into a new structure. Let W={wi1,w12}i∈[1,m] be the set of keywords. Define(9)wi1=i∥1,wi2=i∥2,where i represents the mark number of pi. That is, a keyword is obtained by concatenating the mark number of a parameter with its values in vdi. We should note that only those abnormal parameters will be selected to create keywords. Now we define the new data structure as(10)Bj=wj,dj∗,where wj∈W and dj∗ is one of the diseases whose parameter vector v contains wj. The specific transformation method is described in Algorithm 2.Algorithm 2:Preprocessing of server data.
Input: D1,…,Dh, security parameter l, pseudo-random generator G, hash function H
Output: E1,…,Eh∗
(1) for  i∈[1,h]  do
(2) for  j∈[1,m]  do
(3) if the jth bit of vdi equals to 1 then
(4) create a new B=(wj1,di) and save it
(5) else
(6) if the jth bit of vdi equals to 2 then
(7) create a new B=(wj2,di) and save it
(8) end if
(9) end if
(10) end for
(11) end for
(12) generates a public key (N,e) and a secret key d of RSA, then publishes (N,e)
(13) for  k∈[1,h∗]  do
(14) compute Kk←Hwkdmod⁡N
(15) compute Ek←G(wk∥Kk∥k)⊕(0l∥dk∗)
(16) end for
(17) return  E1,…,Eh∗ to UNext,S generates a public key (N,e) and a secret key d of RSA and then only publishes (N,e). With the secret key d and the hash value of each wj∈W, S computes Ej and Kj. Finally, S outputs {Ej}j∈[1,h∗] to U, where h∗=2n. In addition, let l be a security parameter, G be a pseudorandom generator, and H be a hash function. The computational process is also described in Algorithm 2.


## 4.3. Transfer Phase

In the search phase,U successively finds out abnormal parameters by judging whether their values in vu equal 0 and constructs keywords for them. For example, if the ith bit of vu equals 0, then pi is a normal parameter for U; otherwise we say pi is an abnormal parameter. At each transfer round j, after choosing an abnormal parameter, U creates a keyword wj∗ by concatenating the mark number of chosen parameter with its values in vu. Then, U calculates Y and sends it to S, which is the encryption of wj∗. S returns the search result K′. According to decrypting K′, U retrieves keywords constructed by vu in the E1,…,Eh∗ via (6) and thus gets their corresponding diseases. We maintain these diseases in a list as suspected diseases at each transfer round and denote this list as J. When all abnormal parameters are traversed, we compute the frequency of occurrence of diseases in J, and output a diseases list Dmax that consists of diseases with the highest frequency as the final search result. The algorithm is described in Algorithm 3.Algorithm 3:Search for diagnosis results.
Input: user parameter vector vu, B1,…,Bh∗
Output: diseases list Dmax
(1) for  i∈[1,n]  do
(2) U: j←1
(3) if the ith bit of vu equals to 1 then
(4) execute wj∗←i∥1
(5) else
(6) if the ith bit of vu equals to 2 then
(7) execute wj∗←i∥2
(8) else
(9) continue
(10) end if
(11) end if
(12) chooses a random element r
(13) compute Y←reH(wj∗mod⁡N)
(14) send Y to S
(15) S: compute K′←Ydmod⁡N and send to U
(16) U: compute K←K′/r=Hwj∗dmod⁡N
(17) execute J←∅
(18) for  k∈[i,h∗]  do
(19) compute (ak∥bk)=Ek⊕G(wj∗∥K∥k)
(20) if  ak=0l  then
(21) U insert bk into J
(22) break
(23) end if
(24) end for
(25) j←j+1
(26) end for
(27) U: compute frequency of occurrence of diseases in the J, output a diseases list Dmax that consists of diseases with
the highest frequency.
(28) return  Dmax


## 5. Safety Analysis

We present here the analysis of the security of our system.Lemma 1.
The problem of computingnth residue classes is believed to be computationally difficult.Lemma 2.
RSA known target inversion problem (RSA-KTI) is hard.Firstly, we discuss the security ofU. In the submit phase, {rpi}i∈[1,n], the health examination data of the patient U are these data that the attacker T wants to steel. However, the only message that T may get is ciphertext [rpi], which is encrypted by the private key k of U. The Paillier cryptosystem produces this k and it is the basis of this phase. If T wants to get the plaintext rpi without knowing private key, his task is, given a composite n and an integer z, deciding whether z is n-residue modulo n2 or not. By Lemma 1, we know that to complete this task is hard. Therefore, T can not get the plaintext rpi. In the search phase, U’s important and private data is wj∗, but S has no information on wj∗ because they are blinded in the RSA blind signature scheme.Next, we prove the security ofS, assuming attacker T is allowed to make at most t queries to S. At first, T behaves as if it were S. T generates and sends (N,e) to U. After that, T randomly chooses Ej and sends them to U. From Lemma 2, we could know it is hard for T to get the plaintext.


## 6. Conclusion

In this paper we propose a privacy-preserving intelligent medical diagnosis system and also discuss how privacy-preserving protocols can be used for protecting sensitive patient data in medical scenarios. This system applies two security protocols, Paillier cryptosystem and oblivious keyword search (OKS), to medical diagnosis, and it can be put into practice. Besides, our system also has following advantages:(1)
Previously mentioned information security requirements are achieved. That is, privacy of patient data and security of server get properly protected. Thus, server is blind to the personal information of patients; patients also know nothing about the data maintained in server.(2)
Our system reduces the calculation amount of search by adding the preprocessing phase. This phase can link each keywordw with the corresponding disease name d. Hence, we can directly get the d after w is retrieved instead of looking up for d in the database. In the search phase, system only needs to retrieve n submitted parameters instead of every parameter in the database, which also makes search phase more efficient.(3)
System is able to support multiple possible diseases instead of a single result for patients. When the submitted data are not enough to determine only one disease, system will show patients several results for reference.Therefore, our privacy-preserving intelligent medical diagnosis system is capable of providing efficient and reasonable diagnosis for patients. We view this work as a start of our follow-up work. There are still a lot of work to be done. In the future, we will focus on the research for multiuser and multiserver IMDS. It is necessary for developing a system that can simultaneously and securely provide service for users.



---

*Source: 8632183-2017-10-08.xml*