Advancing Personal Health Record Sharing with AES-driven Lightweight Policy Updates

Abstract

In response to the flexible and accessible nature of data outsourcing systems such as cloud computing, numerous healthcare providers have embraced electronic Personal Health Records (PHRs) to empower individual patients in managing their health data within a scalable and robust environment. However, PHRs contain profoundly private and sensitive information necessitating stringent protection measures. Moreover, PHR proprietors must possess both security and autonomy to formulate access rules for their offloaded data. Current commercial cloud platforms commonly provide conventional encryption techniques like symmetric or public key encryption to ensure data confidentiality. However, the existing encryption techniques have limitations when applied to data outsourcing situations. This is primarily because symmetric encryption entails complex key management, and public key encryption systems require substantial resources to maintain numerous copies of encrypted data. To address these challenges, our study introduces an innovative solution: an adaptable access policy update mechanism combined with a robust and precise access control approach for outsourced Personal Health Records (PHRs). Our proposed strategy leverages Proxy Re-Encryption (PRE) and Cipher Text Policy Attribute-Based Encryption (CP-ABE), which collectively mitigate these issues. This approach ensures security, flexibility, and efficient management of outsourced PHRs without the risk of plagiarism. This combination addresses the shortcomings of traditional methods and presents a more effective solution for safeguarding outsourced PHRs.In order to support complete policy change tracing, we additionally offer a policy versioning mechanism. Finally, we evaluated the strategy's performance to demonstrate its viability.