Secure Access for Healthcare Data in the Cloud Using Ciphertext-Policy Attribute-Based Encryption

Abstract

As more and more healthcare organizations adopt electronic health records (EHRs), the case for cloud data storage becomes compelling for deploying EHR systems: not only is it inexpensive but it also provides the flexible, wide-area mobile access increasingly needed in the modern world. However, before cloud-based EHR systems can become a reality, issues of data security, patient privacy, and overall performance must be addressed. As standard encryption (including symmetric key and public key) techniques for EHR encryption/decryption cause increased access control and performance overhead, this paper proposes the use of Ciphertext-Policy Attribute-Based Encryption (CPABE) to encrypt EHRs based on healthcare providers' attributes or credentials, to decrypt EHRs, they must possess the set of attributes needed for proper access. The design and usage of a cloud-based EHR system based on CP-ABE is motivated and presented, along with preliminary experiments to analyze the flexibility and scalability of the proposed approach.