A Smart Contract-Driven Access Control Schemewith Integrity Checking for Electronic Health Records

Abstract

The application of healthcare systems has led to an explosive growth in personal electronic health records (EHRs). These EHRs are generated from different healthcare institutions and stored in cloud data centers, respectively. However, data owners lose the authority to control and track their private and sensitive EHRs. In fact, data owners cannot establish rules for EHRs exchanging and sharing, nor can they verify the integrity of EHRs stored in semi-trusted clouds. Hence, a individual-centric access control framework is required to realize data access control. In this study, we construct a data access control framework, which integrates the decentralized smart contracts and role-based access control (RBAC) to provide fine grained data access control services. Besides, this scheme allows data owners to define access control policies using JavaScript Object Notation (JSON) and further translate these policies into immutable blockchain transactions. Furthermore, we combine blockchain and bilinear mapping to design a data integrity verification system for users to check the integrity of their cloud stored EHRs. Finally, we analyze the security of this scheme and develop a prototype system to evaluate the performance. Both theoretical analysis and experiment results indicate that this scheme can realize fine-grained data access control and efficient data integrity verification