Secure Access for Healthcare Data in the Cloud Using Ciphertext-Policy Attribute-Based Encryption

As more and more healthcare organizations adopt electronic health records (EHRs), the case for cloud data storage becomes compelling for deploying EHR systems: not only is it inexpensive but it also provides the flexible, wide-area mobile access increasingly needed in the modern world. However, before cloud-based EHR systems can become a reality, issues of data security, patient privacy, and overall performance must be addressed. As standard encryption (including symmetric key and public key) techniques for EHR encryption/decryption cause increased access control and performance overhead, this paper proposes the use of Ciphertext-Policy Attribute-Based Encryption (CPABE) to encrypt EHRs based on healthcare providers´ attributes or credentials, to decrypt EHRs, they must possess the set of attributes needed for proper access. The design and usage of a cloud-based EHR system based on CP-ABE is motivated and presented, along with preliminary experiments to analyze the flexibility and scalability of the proposed approach.