Published Paper Details:

Several healthcare providers use electronic personal health records (PHRs) to enable individual patients to handle their own health data in a resilient and scalable environment, thanks to the high flexibility and accessibility of data outsourcing environments like cloud computing. PHRs, on the other hand, contain highly sensitive information about which security and privacy concerns are paramount. Furthermore, PHR owners should be able to create their own access policy for their outsourced data in a flexible and secure manner. Existing commercial cloud platforms typically include symmetric or public key encryption as an optional feature to enable data secrecy for its tenants, in addition to the basic authentication feature. However, due to the significant key management overhead of symmetric encryption and the high maintenance cost of maintaining multiple copies of ciphertext for public key encryption solutions, such traditional encryption algorithms are not ideal for data outsourcing environments. In this research, we design and construct a secure and fine-grained access control mechanism for outsourced PHRs that includes lightweight access policy updates. The ciphertext policy attribute-based encryption (CP-ABE) and proxy re-encryption are the foundations of our proposed approach (PRE). We also provide a policy versioning approach to support full policy change tracing. Finally, we conducted a performance evaluation to show that the proposed strategy is effective.