Revocable Attribute-Based Encryption with Efficient and Secure Verification in Smart Health Systems

A personal health record (PHR) system is a smart health system that serves patients and doctors. A PHR is usually stored in a cloud and managed by a semitrusted cloud provider. However, there is still a possibility of the exposure of personal health information to semitrusted parties and unauthorized users. To protect the privacy of patients and ensure that patients can control their PHRs, a patient-centric PHR sharing framework is proposed in this article. In this framework, all PHRs are protected with multiauthority attribute-based encryption before outsourcing, which solves the key hosting problem and achieves fine-grained access control to PHRs. Furthermore, an anonymous authentication between the cloud and the user is proposed to ensure data integrity on the cloud while not exposing the user's identity during authentication. The proposed authentication is issued from a new online-offline attribute-based signature. It can make the encrypted PHRs resist collusion attacks and not be forged during the period of sharing, which enhances patients' control of their PHRs. Online-offline and outsourcing decryption also reduces calculation costs and improves operational efficiency. Finally, comparisons are given based on numerical experiments.

Attribute-based encryption (ABE) is a cryptographic primitive that realizes fine-grained access control. Due to its attractive functionality, several systems based on ABE have been widely constructed so far. In such cryptographic systems, revocation functionality is indispensable in practice to handle withdrawal of users, secret key exposure, and others. While many ABE schemes with various functionalities have been proposed, only a few of these are revocable ABE (RABE). In this paper, we propose two generic constructions of RABE from ABE. Our first construction employs the pair encoding framework (Attrapadung, EUROCRYPT 2014), and combines identity-based revocation and ABE via the generic conjunctive conversion of Attrapadung and Yamada (CT-RSA 2015). Our second construction directly converts ABE to RABE when ABE supports Boolean formulae. Since our constructions preserve functionalities of the underlying ABE, we can instantiate various fully secure RABE schemes for the first time, e.g., supporting regular languages, with unbounded attribute size and policy structure, and with constant-size ciphertext and secret key.

The emerging cloud-based Internet of Things (IoT) paradigm enables IoT devices to directly upload their collected data to the remote cloud and allows data owners (DOs) to conveniently manage those data through cloud APIs, which has greatly reduced infrastructure investment and data management cost in many IoT applications. Considering that the outsourced data are out of the physical control of DOs and the cloud server (CS) cannot always be fully trusted, how to securely delete the unneeded sensitive data stored in cloud to prevent potential data leakage issues is a big challenge. Most of the existing solutions only support coarse-grained deletion and rely on the participation of the CS, so their flexibility and practicability are seriously restricted. In this article, based on an enhanced policy-based puncturable encryption (P-PUN-ENC) primitive, we propose a secure and fine-grained self-controlled outsourced data deletion scheme in cloud-based IoT. The main contribution of our scheme is that it enables DOs to precisely and permanently delete their outsourced IoT-driven data in a policy-based way without relying on the CS. To achieve this, we subtly utilize the logical relationship between the puncture policy and access policy, and design a policy transform method to convert the puncture process based on the puncture policies into the update process of access policies. Then, we utilize a key delegation technique in attribute-based encryption (ABE) to complete the corresponding key update operations. Additionally, to address the issue of growing key storage and decryption cost in P-PUN-ENC, we propose the outsourced policy-based puncturable encryption (OP-PUN-ENC) primitive by combining the key and decryption outsource technique with P-PUN-ENC. Comprehensive comparisons show that our proposed scheme can better meet the data deletion requirements in cloud-based IoT, and formal security proof and extensive simulation results demonstrate the reliability and efficiency of the proposed scheme.

With the popularity of Internet of Things (IoT) and cloud computing technologies, mobile healthcare (mHealth) can offer remote, accurate, and effective medical services for patients according to their personal health records (PHRs). However, data security and efficient access of the PHR should be addressed. Attribute-based encryption (ABE) is regarded as a well-received cryptographic mechanism to simultaneously realize fine-grained access control and data confidentiality in mHealth. Nevertheless, existing works are either constructed in the single-authority setting which may be a performance bottleneck, or lack of efficient user decryption. In this paper, we propose SEMAAC, a secure and efficient multi-authority access control system for IoT-enabled mHealth. In SEMAAC, there are multiple independently worked attribute authorities (AAs). A new entity could be an AA without re-building the system. To reduce the user decryption overhead, most decryption is executed in cloud server, which whereafter returns a partial decryption ciphertext (PDC). The AAs can help the user to check if the PDC is correctly computed. Additionally, a restricted user can delegate his/her key to someone to outsource the decryption and check the returned result, without exposing the plaintext PHR file. The proposed SEMAAC is proved to be adaptively secure in the standard model. The numerical analysis and extensive experiments illustrate the efficiency and advantage of our scheme.

This paper illustrates the process of data collection, notation layout, and agreement results for achieving healthcare. The first method is to demonstrate an autonomous virtual health assistant to interact between a doctor and patients via chat. And the second method is called Attribute-based encryption which has been used to securely share personal health records (PHRs) in the cloud. The patient data is frequently collected through PHR from various sources including hospitals. Where the collected PHR files are securely stored in the cloud. By this method Encryption and Decryption process can be reduced also proves the security of the proposed scheme based on ciphertext encryption and attribute-based encryption.

Personal health record (PHR) is an emerging patient-centric model of health information exchange, which is often outsourced to be stored at a third party, such as cloud providers. However, there have been wide privacy concerns as personal health information could be exposed to those third party servers and to unauthorized parties. To assure the patients' control over access to their own PHRs, it is a promising method to encrypt the PHRs before outsourcing. Yet, issues such as risks of privacy exposure, scalability in key management, flexible access, and efficient user revocation, have remained the most important challenges toward achieving fine-grained, cryptographically enforced data access control. In this paper, we propose a novel patient-centric framework and a suite of mechanisms for data access control to PHRs stored in semitrusted servers. To achieve fine-grained and scalable data access control for PHRs, we leverage attribute-based encryption (ABE) techniques to encrypt each patient's PHR file. Different from previous works in secure data outsourcing, we focus on the multiple data owner scenario, and divide the users in the PHR system into multiple security domains that greatly reduces the key management complexity for owners and users. A high degree of patient privacy is guaranteed simultaneously by exploiting multiauthority ABE. Our scheme also enables dynamic modification of access policies or file attributes, supports efficient on-demand user/attribute revocation and break-glass access under emergency scenarios. Extensive analytical and experimental results are presented which show the security, scalability, and efficiency of our proposed scheme.

Most data nowadays are stored in the cloud; therefore, cloud computing and its extension—fog computing—are the most in-demand services at the present time. Cloud and fog computing platforms are largely used by Internet of Things (IoT) applications where various mobile devices, end users, PCs, and smart objects are connected to each other via the internet. IoT applications are common in several application areas, such as healthcare, smart cities, industries, logistics, agriculture, and many more. Due to this, there is an increasing need for new security and privacy techniques, with attribute-based encryption (ABE) being the most effective among them. ABE provides fine-grained access control, enables secure storage of data on unreliable storage, and is flexible enough to be used in different systems. In this paper, we survey ABE schemes, their features, methodologies, benefits/drawbacks, attacks on ABE, and how ABE can be used with IoT and its applications. This survey reviews ABE models suitable for IoT platforms, taking into account the desired features and characteristics. We also discuss various performance indicators used for ABE and how they affect efficiency. Furthermore, some selected schemes are analyzed through simulation to compare their efficiency in terms of different performance indicators. As a result, we find that some schemes simultaneously perform well in one or two performance indicators, whereas none shines in all of them at once. The work will help researchers identify the characteristics of different ABE schemes quickly and recognize whether they are suitable for specific IoT applications. Future work that may be helpful for ABE is also discussed.

In recent years, there has been exponential growth in the Internet of Things (IoT) in various sectors, especially healthcare. The traditional healthcare sector has faced several challenges, such as poor health services, crowding and queuing at medical centers, and manual searches for or missing patient records; a smart health system is needed to overcome these challenges. This study presents the design and implementation of end-to-end IoT architecture, which is built by the integration of various open-source technologies. The pulse care system is implemented using Node.js and React.js, which offer features such as electronic health records (EHR), smart appointments, prescription documentation, and health monitoring. Additionally, various users (admin, patient, doctor, and pharmacist) communicate using a user-friendly graphical interface. In terms of a wearable device, it allows visualization of all the data generated by the sensors in real time (heart rate, body temperature, and blood oxygen). The ESP32 is used as a microcontroller that communicates via its built-in Wi-Fi with the MQTT Mosquitto broker. Standard IoT protocols, Message Queuing Telemetry Transport (MQTT) and Hypertext Transfer Protocol (HTTP), are used. The broker's performance is evaluated in terms of average latency at various QoS levels and with the increase in the number of concurrent users. The results of the experiment demonstrate how important it is to choose the appropriate QoS level based on the requirements of the application. Furthermore, the proposed system's data rate is roughly 3.07 kb/s, which is considered low and suitable for sending small data via any wireless method.

Attribute-based encryption (ABE) is a popular cryptographic technology to guarantee data security in the Internet of things (IoTs). However, the single attribute authorization in traditional ABE scheme is tasked with costly calculations, which will become a bottleneck in IoTs. Besides, access policy in a plaintext form may reveal personal information. In addition, data owners need to have flexibility to change access policy. In this paper, we propose a multi-authorization attribute encryption scheme that supports policy hiding, policy updating and ciphertext validation. In our scheme, the computational cost of ciphertext decryption is constant, which reduces computational overhead and storage usage. Security analyses prove that our scheme realizes the security in static security model and anti-collusion attack model. Finally, we demonstrate that the performance of the scheme is more efficient than previous ABE schemes.

This paper presents a novel access control scheme for personal health record(PHR) data in cloud computing. The scheme utilizes attribute-based encryption(ABE), hash function and symmetric encryption to realize a fine-grained, multi- privilege access control to PHR. The patients can share their PHR with medical staff from various departments with different privileges securely. The experimental results show the efficiency of our scheme in terms of running-time, communication cost and storage overhead.

Current tools for health management such as personal health records (PHR), mobile applications, and wearable devices rely on conventional interfaces such as keyboard and mouse with screens for reading information. More recently, Internet-of-things (IoT) voice-activated smart speakers and embedded Artificial Intelligence (AI) assistants have emerged that may provide an effective user interaction platform to support healthy aging, creating a hands-free, conversational way to access and share health related data. We conducted an exploratory study with nineteen older adults (65+) who chose to evaluate a smart speaker for a 2-month as part of a larger IoT feasibility study. Three interview sessions were conducted to gather attitudes towards this technology. Participants provided feedback on future improvements or desirable features for health maintenance. A content analysis was performed to extract common themes. In general, participants expressed a positive experience with the voice interface and discussed its potential as an integral tool for their home health management. Based on these findings, we propose a voice interaction smart home platform to support healthy aging. This platform provides an intuitive voice user interface to execute commands to access, record, and query data from IoT sensors, a PHR and a hospital EHR. For example, the voice interaction platform will help individuals to dynamically explore their own health data thus eliminating manual and tedious searching of PHR data. We demonstrate how this platform can potentially improve usability issues including difficulties navigating charts and entering or retrieving health data using conventional interfaces. Finally, we highlight ethical and technical considerations.

IoT-friendly, pre-computed and outsourced attribute based encryption

As more and more applications are deployed using the Internet of Things (IoT) technologies, the fragmentation of general purpose IoT technologies to target particular sectors with different requirements is becoming necessary. In this paper, we summarize the latest developments of application-specific IoTs (ASIoTs) (a term to conceptualize the development of IoTs targeted toward specific domains, communications mediums, and industry sectors) in eight representative studies (Internet of Battlefield Things (IoBT), Internet of Medical Things (IoMT), Internet of Animal Things (IoAT), Internet of Waste Things (IoWT), Internet of Underwater Things (IoUWT), Internet of Underground Things (IoUGT), Internet of Nano Things (IoNT), and Internet of Mobile Things (IoMobT) such as the Internet of Vehicles). The paper gives contributions to ASIoTs from three perspectives: First, we offer a basic classification taxonomy for ASIoTs and discuss various representative studies and applications which can be found in the literature; Second, we discuss a use case for a biometrics-based ASIoT (termed IoBioT) for illustration and experiments of face-based biometric recognition on IoBioT are also performed; and Third, we give discussions and future directions for ASIoTs. An objective of this paper is to spur researchers and facilitate the development of ASIoTs for the different user-defined domains, communication mediums, and technology constrained platforms.

Recent developments in cloud computing allow data to be securely shared between users. This can be used to improve the quality of life of patients and medical staff in the Internet of Medical Things (IoMT) environment. However, in the IoMT cloud environment, there are various security threats to the patient’s medical data. As a result, security features such as encryption of collected data and access control by legitimate users are essential. Many studies have been conducted on access control techniques using ciphertext-policy attribute-based encryption (CP-ABE), a form of attribute-based encryption, among various security technologies and studies are underway to apply them to the medical field. However, several problems persist. First, as the secret key does not identify the user, the user may maliciously distribute the secret key and such users cannot be tracked. Second, Attribute-Based Encryption (ABE) increases the size of the ciphertext depending on the number of attributes specified. This wastes cloud storage, and computational times are high when users decrypt. Such users must employ outsourcing servers. Third, a verification process is needed to prove that the results computed on the outsourcing server are properly computed. This paper focuses on the IoMT environment for a study of a CP-ABE-based medical data sharing system with key abuse prevention and verifiable outsourcing in a cloud environment. The proposed scheme can protect the privacy of user data stored in a cloud environment in the IoMT field, and if there is a problem with the secret key delegated by the user, it can trace a user who first delegated the key. This can prevent the key abuse problem. In addition, this scheme reduces the user’s burden when decoding ciphertext and calculates accurate results through a server that supports constant-sized ciphertext output and verifiable outsourcing technology. The goal of this paper is to propose a system that enables patients and medical staff to share medical data safely and efficiently in an IoMT environment.

The sharing of personal health records can help to improve the accuracy of the doctor's diagnosis and to promote the progress of medical research. Currently, to reduce the maintenance cost of data, personal health records are usually outsourced to a third party such as the cloud service provider. In this case, patients may lose direct control over their personal health records and the semi-trusted cloud service provider may tamper with or reveal personal health records. Therefore, ensuring the privacy and integrity of personal health records and realizing the fine-grained access control are crucial issues when personal health records are shared. As a distributed architecture with decentralized and tamper-proof features, blockchain provides a new way to protect the personal health records sharing system. In this paper, we propose a new personal health records sharing scheme with data integrity verifiable based on blockchain. Aiming at the problems of privacy disclosure, limited keyword search ability and loss of control rights in the process of personal health record sharing, the new scheme uses searchable symmetric encryption and attribute-based encryption techniques to achieve privacy protection, keyword search, and fine-grained access control. Compared with the existing similar schemes, the new scheme allows patients to distribute attribute private key for users, avoiding many security problems caused by the existing of attribute authority in the scheme. Furthermore, the new scheme uses blockchain to manage keys in the scheme, avoiding the single point failure problem of centralized key management. In particular, the new scheme stores the hash values of encrypted personal health records in blockchain, and the related index set is stored in smart contract, which can further improve the efficiency of data integrity verification. Finally, performance evaluation and security analysis indicate that our scheme is secure and feasible for practical use.