Abstract-The confidentiality of personal health records is a major prohlem when patients use commercial Web-based systems to store their health data. Traditional access control mechanisms have several limitations with respect to enforcing access control policies and ensuring data confidentiality. In particular, the data has to be stored on a central server locked by the access control mechanism, and the data owner loses control on the data from the moment when the data is sent to the server. Therefore, these mechanisms do not fulfill the requirements of data outsourcing scenarios where the third party storing the data should not have access to the plain data, and it is not trusted to enforce access policies. In this paper, we present a new variant of ciphertext-policy attribute-based encryption (CP-ABE) scheme which is used to enforce patient/organizational access control policies. In CP-ABE, the data is encrypted according to an access policy over a set of attributes. The access policy specifies which attributes a user needs to have in order to decrypt the encrypted data. Once the data is encrypted, it can be safely stored in an untrusted server such that everyone can download the encrypted data but only authorized users who satisfy the access policy can decrypt. The novelty of our construction is that attributes can be from two security domains: social domain (e.g. family, friends, or fellow patients) and professional domain (e.g. doctors or nurses).
In 2009, Ibraimi et al. REF present a novel CP-ABE scheme for safely managing and sharing the EHR data from an un-trusted web server, which is used to force organizational/patient access control policies and protect the data.
Secure management of personal health records by applying attribute-based encryption
Proceedings of the 6th International Workshop on Wearable, Micro, and Nano Technologies for Personalized Health
Proceedings of the 6th International Workshop on Wearable, Micro, and Nano Technologies for Personalized Health
Computer Science Business Mathematics