Computer Systems Science & Engineering
DOI:10.32604/csse.2021.014557
images

Article

A Secure Signcryption Scheme for Electronic Health Records Sharing in Blockchain

Xizi Peng1, Jinquan Zhang1,*, Shibin Zhang1, Wunan Wan1, Hao Chen1 and Jinyue Xia2

1School of Cybersecurity, Chengdu University of Information Technology, Chengdu, 610225, China
2International Business Machines Corporation (IBM), New York, 10041, NY, 212, USA
*Corresponding Author: Jinquan Zhang. Email: zhjqcom@163.com
Received: 28 September 2020; Accepted: 28 November 2020

Abstract: In the existing Electronic Health Records (EHRs), the medical information of patients is completely controlled by various medical institutions. As such, patients have no dominant power over their own EHRs. These personal data are not only inconvenient to access and share, but are also prone to cause privacy disclosure. The blockchain technology provides a new development direction in the medical field. Blockchain-based EHRs are characterized by decentralization, openness and non-tampering of records, which enable patients to better manage their own EHRs. In order to better protect the privacy of patients, only designated receivers can access EHRs, and receivers can authenticate the sharer to ensure that the EHRs are real and effective. In this study, we propose an identity-based signcryption scheme with multiple authorities for multiple receivers, which can resist N-1 collusion attacks among N authorities. In addition, the identity information of receivers is anonymous, so the relationship between them and the sharer is not disclosed. Under the random oracle model, it was proved that our scheme was secure and met the unforgeability and confidentiality requirements of signcryption. Moreover, we evaluated the performance of the scheme and found that it had the moderate signcryption efficiency and excellent signcryption attributes.

Keywords: Electronic health records; blockchain; identity-based signcryption; multiple authorities; multiple receivers

1  Introduction

Electronic Health Records (EHRs) are to digitize the paper-based health records, so that they can be stored, retrieved and accessed more conveniently and quickly in a network. However, some problems in the existing EHRs remain to be solved. Firstly, EHRs of patients are mainly stored on medical institutions sites, such as hospitals and clinics. Patients have the limited access to their personal medical data, while it is difficult to obtain such data from hospitals in real time, or to even share the data with family members and friends. In addition, medical workers in these institutions may access and disclose patients’ private medical data at will. Secondly, once a patient and a medical institution have any conflict or dispute, the latter can arbitrarily tamper with the EHRs of the patient, implicitly threatening the patient’s case. Thirdly, personal medical records are inherently confidential data and subject to personal privacy and security risks. As such, those records belong only to the corresponding individuals and only authorized users should be able to access relevant information. In order to solve the above problems, some researchers have made significant improvements in enabling patients to generate, manage and share their own EHRs, and ensure the privacy of their medical data.

1.1 Related Works

In recent years, due to the extensive application of cloud computing technology in data processing [1], cloud-based EHRs have developed rapidly and more patients have been able to control their own medical data. In the cloud-based EHRs system, Premarathne et al. [2] and Ramu [3] set the access control to allow patients to share their medical data with doctors in a controlled way. However, a cloud server is not a fully trusted third party. In the cloud storage environment, it is difficult to guarantee the security of EHRs [4].

In 2008, blockchain was first proposed by Nakamoto [5] as a part of cryptocurrency bitcoin. At present, the application of the blockchain technology in the medical field is widely concerned among blockchain researchers [6]. With the decentralized, tamper-proof, traceable and publicly available blockchain technology [7], many problems in the medical field can be solved. Roehrs et al. [8] and Gordon et al. [9] proposed the basic framework of blockchain-based EHRs. Omer et al. [10] and Badr et al. [11] protected sensitive data of patients with the encryption technology in blockchain-based EHRs. Chen et al. [12] proposed a blockchain-based searchable encryption scheme for EHRs, which allowed patients to control the access to their EHRs.

In addition to the encryption protection, the authenticity of EHRs should be considered in the sharing process of EHRs. Authentication is crucial in blockchain [13] and cannot be ignored in blockchain-based EHRs [14]. Considering the characteristics of blockchain, many researchers proposed distributed signature schemes for blockchain-based EHRs. Tang et al. [14] constructed an identity-based signature scheme with multiple authorities to verify the identity of the signer and ensure the authenticity of the EHRs. Guo et al. [15] and Sun et al. [16] designed an attribute-based signature scheme with multiple authorities, which allowed the signer to hide their identity information when signing. However, these signature schemes lacked confidentiality of EHRs.

In order to satisfy both confidentiality and authenticity, in 1997, Zheng [17] first proposed the idea of signcryption, which could simultaneously realize the functions of signing and encrypting plaintext messages. Then, Malone-Lee [18] put forward the first practical identity-based signcryption scheme. Although many researchers have proposed more secure and efficient identity-based signcryption schemes [19,20], these schemes have only considered the case that a message was sent to one receiver. In 2006, Duan et al. [21] first proposed a multi-receiver identity-based signcryption scheme to send the same message to multiple receivers. In their scheme, the sender was only required to perform one pairing computation and n scalar multiplication in the signcryption phase, and each receiver could verify the validity of the message. Since then, the identity-based signcryption scheme for multiple receivers have been significantly improved based on the consideration of the efficiency and security properties [22–24].

In all the above identity-based signcryption schemes, only one key generation center (KGC) generates secret keys for all users, and the users must trust KGC unconditionally. However, KGC can use the public identity of users in the system to calculate the user’s secret key. Therefore, it can forge the sender’s signcryption or decrypt the signcryption obtained by the receiver. In addition, KGC may face a single point of failure.

1.2 Our Contributions

A centralized KGC will have security risks, and the signcryption scheme of patient’s medical data in the blockchain was seldom explored. To enable patients to share the EHRs safely in the blockchain, in this paper, we made the following contributions.

Firstly, the distributed key generation method [13] is introduced into a centralized identity-based signcryption (IBSC) scheme. For multiple receivers, an identity-based signcryption with multiple authorities (MA-IBSC) scheme is developed. N authorities randomly construct their own polynomials and all authorities cooperatively generate the master secret key of the system by secret sharing, and embed their own secret key into the user’s secret key. Therefore, the scheme can resist the collusion attack of N-1 corrupt authorities. In addition, after signing EHRs, the patient encrypts the EHRs with the identities of other users whom the patient wants to share the data with. Thus, only authorized receivers can decrypt and access the EHRs. In this way, the authenticity of EHRs is ensured by verifying the signer’s signature. Furthermore, in the signcryption process, identity information of receivers can be hidden and the relationships between the patient and receivers are not exposed in the blockchain.

Secondly, signcrypted EHRs are directly uploaded to the blockchain, other nodes cannot verify them. Based on some adjustments of the on-chain and off-chain storage model [13], the signcrypted EHRs are recommended to be stored in the patient’s own off-blockchain database, so that the patient can control the EHRs. Then the patient extracts the storage address, signs it with the private key, and uploads it to the blockchain. Other users (nodes) in the system can verify the validity of the given address based on the patient’s public key.

Thirdly, based on the assumptions of computational Diffie-Hellman (CDH) problem and Bilinear Computational Diffie-Hellman (BCDH) problem, it is proved that our proposed sigcryption scheme is secure in the random oracle model. In other words, the unforgeability and confidentiality of signcryption are realized. Furthermore, the performance of the scheme is evaluated based on the two indices of signcryption efficiency and signcryption attributes.

The remainder of this paper is organized as follows. Section 2 presents the preliminaries, including Lagrange interpolation, bilinear map, computational assumption, syntax and secure model of the signcryption scheme. In Section 3, the EHRs system model in blockchain is described in detail. Section 4 demonstrates the specific MA-IBSC scheme for multiple receivers. The security analysis and performance evaluation are provided in Section 5. Finally, the conclusion is drawn in Section 6.

2  Preliminaries

2.1 Lagrange Interpolation

For a polynomial images of degree images, given images images on images, we can uniquely determine a polynomial images.

2.2 Bilinear Map

Let images be a large prime number, imagesand images be two multiplicative cyclic groups of order images, and images be the generator of images. We say that images is not a bilinear map unless images satisfies the following properties:

1.     Bilinearity: for all images and images, images;

2.    2) Non-degeneracy: there exists images, such that images. That is to say, mapping images will not map all element pairs in images to the identity element of images;

3.    Computability: for allimages, a valid algorithm can be used to calculate images.

2.3 Computational Assumption

The security of the MA-IBSC scheme for multiple receivers is mainly based on the assumptions of Computational Diffie-Hellman (CDH) problem and Bilinear Computational Diffie-Hellman (BCDH) problem.

1) Computational Diffie-Hellman (CDH) problem. After images are randomly selected, for the given images, images is calculated. If there is no probabilistic polynomial time (PPT) adversary A to calculate images with the probability advantage that cannot be ignored, we call CDH in group images the assumption of the difficult problem.

2) Bilinear Computational Diffie-Hellman (BCDH) problem. After images are randomly selected, for the given images, images is calculated. If there is no probabilistic polynomial time (PPT) adversary A to calculate images with the probability advantage that cannot be ignored, we call BCDH in group images the assumption of the difficult problem.

2.4 Syntax of the Signcryption Scheme

The identity-based signcryption with multiple authorities (MA-IBSC) scheme for multiple receivers involves the following seven algorithms:

Global Setup: The EHRs server takes a security parameter images as the input and then outputs system public parameters images.

Authority Setup: All authorities perform this algorithm interactively. They input public parameters images and their identity images, then generate their respective secret key images, system master secret key images and master public key images.

KeyGen: This algorithm is also cooperatively controlled by all authorities. They input the public parameters images, their respective secret key images, and identity images of a user, and then return secret key images to the user.

User-Sign: User images takes public parameters images, his/her secret key images and message images as input to run this algorithm with, and then outputs the signature images of images.

User-Encrypt: User images usually executes this algorithm after the User-Sign algorithm. User images inputs the public parameters images, the signature images of images, and the public keys of the receivers, and then outputs the signcryption message images of images.

Verify: To verify the signature images of images, other users take the signer’s identity images, images and images as input to carry out this algorithm. If the signatureimages is valid, it returns images, otherwise returns images.

Receiver-Decrypt: Only the receivers picked by the user can run the algorithm to decrypt images. Any one of the receivers inputs public parameter images, images, and the user’s secret key to the algorithm, and then obtains images and the sharer’s images.

2.5 Security Model

Definition 1 and Definition 2 respectively introduce the two security attributes of the adapted signcryption scheme: unforgeability and confidentiality.

Definition 1: Suppose F is a forger, ℧ is defined as the MA-IBSC scheme for multiple receivers. The game between F and Challenger C is described as follows:

Global Setup: Challenger C takes a security parameter images as input, runs global setup algorithm, then generates images and transmits it to F.

Authority Setup: Challenger C runs authority setup algorithm to output secret key images for each authority images, where images. Then Forger F outputs his/her target identity images.

Queries: Forger F performs the following four queries to Challenger C:

-    Secret key queries: F asks C for the secret key of some authorities images, where images represents the index set of corrupt authorities, and then Challenger C outputs images to F.

-    Key generation queries: When C receives the private key query about identity images, C runs the key generation algorithm and returns images to F.

-    User-sign queries: When C receives the signature query about message images and identity images, C returns images to F.

-    encrypt queries: To forge a signcryption, the user-encrypt query always follows user-sign query. When C receives the encryption query about images, where images represents the identity set of the receivers, namely, images, then C calculates signcryption images and returns it to F.

Forgery: Forger F finally outputs a new signcryption images and the public key pair images of images receivers. If images is the signcryption of images to the message images and can be correctly decrypted and verified by receivers in set images, then images is a valid signcryption and F wins the game. The limitations here are described below. F cannot query the images with identity images through the key generation query, and images cannot be generated by the User-Sign and User-Encrypt algorithm.

Definition 2: Suppose that A is an adversary, ℧ is defined as the MA-IBSC scheme for multiple receivers. The game between Adversary A and Challenger C is introduced as follows:

Global Setup: Challenger C takes a security parameter images as input, runs global setup algorithm, and then generates images and transmits it to A.

Authority Setup: Challenger C runs authority setup algorithm to output secret key images for each authority images, where images. Adversary A outputs target identities images of images receivers, where images.

Phase 1: Adversary A performs the following five queries to Challenger C:

-    Secret key queries: A asks C for the secret key of some authorities images, where images represents the index set of corrupt authorities, and then Challenger C outputs images to A.

-    Key generation queries: When C receives the private key query about identity images, C runs the key generation algorithm and returns images to A.

-    User-sign queries: When C receives the signature query about message images and identity images, where images is the user being attacked, then C returns images to A.

-    User-encrypt queries: The user-encrypt query always follows the user-sign query. When C receives the encryption query about images, where images represents the identity set of the receivers, namely images, then C calculates signcryption images and returns to A.

-    Receiver-Decrypt-and-Verify queries: When C receives the decryption and verify query together about images, where images, if images is a valid singcryption, then C decrypts it, verifies images, and returns images to A.

Challenge: A outputs a target plaintext pair images and a private key images. When Challenger C receives images and images, C randomly selects a message images, where images, then generates the target signcryption images based on images, images and images target receivers images, where images, and finally returns images to A.

Phase 2: A makes multiple queries as those in Phase 1. The limitations here are described below. A cannot ask images of images target receivers images, where images during the key generation query, and A cannot askimages during Receiver-Decrypt-and-Verify query.

Guess: In the end, A outputs its guess images and wins the game if images.

3  EHRs System Model in Blockchain

In this section, the EHRs system model in blockchain is introduced in detail. The model combines the EHRs system with the MA-IBSC scheme for multiple receivers, realizes the sharing of EHRs in the blockchain, and ensures the privacy and validity of EHRs. The system roles, EHRs storage mode, authentication cases, and the application of the signcryption scheme are introduced below.

3.1 System Roles

There are three main roles in EHRs system in the blockchain: EHRs server, authority, and user.

EHRs Server: The EHRs server is mainly responsible for generating public parameters images in EHRS system initialization, and distributing corresponding identity for each authority and each user in the system.

Authority: The authorities include all medical departments: hospitals, pharmacies, health insurance companies, medical research institutes and so on. As the bookkeeping nodes in the blockchain, they package a set of transactions that are broadcast on the network and upload them to the new block created by them through the DPoS consensus mechanism.

User: As ordinary nodes in the blockchain, users primarily create new transactions and publish them to the network. Users include patients, medical workers and common people. Patients create their own EHRs after treatment, and then adopt MA-IBSC scheme to share their private EHRs with other designated users in the blockchain.

3.2 EHRs Storage Mode

EHRs of patients are generally private data and cannot be directly uploaded to the blockchain for sharing. Therefore, we adopt the on-chain and off-chain storage mode and only upload the address of the stored EHRs to the blockchain. The EHRs are signcrypted and stored in the off-blockchain database of each node, and the decryption permission is set at the same time. This storage mode enables patient’s EHRs to be safely shared among the users that the patient designates.

As shown in Fig. 1, when a patient creates his/her own new EHRs after diagnosis or treatment, he/she uses his/her secret key and the public keys of users, whom he/she wants to share the data with, to signcrypt the EHRs, and stores the signcrypted data in his/her off-blockchain database. Then he/she signs the address of the stored EHRs and publishes it to the blockchain.

Figure 1: Storage Mode of EHRs in Blockchain

3.3 Authentication Cases

To guarantee that the EHRs shared by the patient and the storage address of the EHRs broadcast by the patient in the blockchain are real, it is necessary to perform authentication. Authentication is mainly performed by verifying the signature of the sharer. Based on the system model and EHRs storage mode, authentication can be mainly classified into the following two cases:

-    Case 1 (Signature Authentication): Only the address of the stored EHRs is uploaded to the blockchain. Therefore, the patient needs to sign it with his/her own secret key, and other users can verify the authenticity and validity of the address.

-    Case 2 (Signcryption Authentication): All users can retrieve the patient’s signcrypted EHRs with the address stored in the blockchain. However, only the users (such as doctors, family members, and friends) authorized by the patient can decrypt the EHRs with their secret key, and then verify the signature of the patient to ensure the authenticity of the patient’s identity and the EHRs.

3.4 Application of the Sigcryption Scheme

For the purposes of realizing the signcryption of EHRs and the two authentication cases, we describe the relationships between the system roles and the MA-IBSC scheme for multiple receivers below.

First, the EHRs server runs the Global Setup algorithm to generate the public parameters of the system. Next, each authority performs Authority Setup algorithm to produce its own secret key and then cooperates with other authorities to generate the master secret key and the master public key of the system. After that, with the identity of each user in the system, each authority runs the KenGen algorithm and jointly distribute the secret key to the user. After receiving the secret key, the patient uses User-Sign algorithm to sign his/her own EHRs, executes User-Encrypt algorithm immediately, encrypts the signed EHRs with the public keys of the receivers whom he/she wants to share the data with. In this way, the decryption permission is set for these designated receivers. After storing the signcrypted EHRs in the off-blockchain database, the patient executes the User-Sign algorithm again and broadcasts the signed storage address of EHRs. All other nodes (authorities or users) can verify the validity of the address given by the patient by executing the Verify algorithm. Then, for a period of time, the bookkeeping node packs the storage addresses of EHRs signed by some patients, and uploads them to a new block, which is connected by the hash value of the previous block to form a blockchain. The data structure of blockchain is shown in Fig. 2.

Figure 2: Data Structure of Blockchain in EHRs System

When other users want to access the patient’s EHRs, they retrieve the patient’s signcrypted data in the off-blockchain database through the storage address on the blockchain and then run the Receiver-Decrypt algorithm. Only receivers with the decryption permission set by the patient can decrypt the signcrypted EHRs with their secret keys, and then run the Verify algorithm to ensure that the real EHRs are obtained.

4  Proposed Signcryption Scheme

Based on the EHRs system of blockchain, we propose an identity-based signcryption with multiple authorities (MA-IBSC) scheme for multiple receivers. In the scheme, users are issued their secret keys from images authorities. In addition, a user can send the same signcryption information to multiple receivers. The anonymity of the receivers is realized by Lagrange interpolation.

The detailed MA-IBSC scheme for multiple receivers is introduced bellow:

Global Setup: The EHRs server chooses two suitable multiplicative cyclic groups images and images with a prime order images, equipped with a bilinear map images. Assuming that images is a random generator of images, an element images in images is randomly selected. There are four strong collision-resistant hash functions images, images, images, and images, where images and images represent the length of each user’s identity and the length of message, respectively. Suppose that there are images authorities in the system. The public parameters of the system are images.

Authority Setup: Each authority runs this algorithm with the input of public parameters images and identity images, where images. The two phases of generating master secret key images, master public key images and authority’s secret key images , where images, are described as follows:

- Phase 1 (generation of the master secret key of the system and the secret key of each authority):

1) First, each authority images randomly selects a polynomial images of images degree over images:

To hide the polynomial coefficients, images is calculated and broadcast, where images. Second, it calculates secret shares images, where images. Finally, it secretly sends images to images forimages.

2) After receiving the secret share images from images, each authority images verifies whether the equation images holds. If it holds, the secret share images is valid and the sender images is considered to be honest. If not, images broadcasts a complaint against images. Then, to prove its honesty, images needs to keep broadcasting the secret shares images until the equation holds.

3) After the above interactions, images authorities jointly generate the master secret key images. If the number of corrupt authorities is less than images, they cannot recover images. The secret key of each authority images is the constant term of its randomly selected polynomial, namely, images, where images.

- Phase 2 (generation of the master public key of system): In Phase 1, each authority has broadcast a publicly verifiable value images, where images. Thus, the master public key images is calculated as:

Finally, each authority adds parameters images and images to images, which is finally expressed as:

KeyGen: When a user with his/her identity images registers in the EHRs system of blockchain, he/she obtains his/her public key images and secret key images from images authorities. The process consists of the following three phases.

-    Phase 1 (generation of the public key and partial secret key): First, every authority images, where images, calculates the user’s public key images with his/her identity images, then calculates partial secret key images and secretly sends it to images.

-    Phase 2 (verification of the partial secret key): After receiving the images from authority images, imagesverifies whether the equation images holds. If it holds, the partial secret key is valid. If not, the authority images needs to transmit the partial secret key again until the equation holds.

-    Phase 3 (generation of the secret key): Through the above interactions, user images receives all partial secret keys from images authorities, and then calculates his/her secret key images as:

User-Sign: To sign a messageimages, user (mainly refers to the patient user in the system) images selects a random integer images, and then calculates images, images and images. The signature images of message images is images.

User-Encrypt: To complete the signcryption of images, this algorithm is usually used after the User-Sign algorithm. Encryption is mainly divided into the following six steps. First, user images calculates images, images. Second, he/she selects other users whom he/she wants to share message images with, counts the number images of these receivers, calculates images and images based on the identity images of the images receivers, where images, and then gets images sets of data: images,images, images ,images. Third, images degree polynomial images is constructed by Lagrange interpolation, so that images, where images. Fourth, for images, the user images calculates

After that, forimages, images is calculated. Finally, the signcryption of images is expressed as:

As you can see, the identity information of receivers is not directly displayed in the images.

Verify: To verify the validity of signature images from user images, first, other users calculate images, and then verify whether the equation images holds or not. If it holds, the signature from images is valid and it returns images. If not, it returns images.

Receiver-Decrypt: Only the receiver with identity images designated by sharer images has the right to decrypt the signcryption images and obtain message images. The receiver images takes images, images, his/her identity images and secret key images as inputs to run this algorithm. He/she first calculates images, images, and images and then gets the message images and the identity images of the signer through the following calculation:

Correctness:

1) The correctness of signature images from user images is derived from the following equation:

2) When images, message images of the user images can be obtained. For each images, there is images. According to Lagrange interpolation, we can calculate:

Thus, the correctness of decryption is derived from the following two equations:

and

5  Security Analysis and Performance Evaluation

5.1 Security Proof

In this section, Theorem 1 and Theorem 2 respectively prove the unforgeability and confidentiality of signcryption.

The master secret key images is randomly generated by images authorities by the distributed key generation and no one knows the real value of images, so images cannot be used as an instance of CDH problem. Here, we set images, whereimages is a CDH instance. images is still generated by all authorities randomly and unknown to others, images and images are independent of each other. For any PPT adversary, even if he/she corrupts images authorities, he/she cannot recover the value images. Therefore, for the PPT adversary, images and images are indistinguishable.

Theorem 1: In the random oracle model, if there is a probabilistic polynomial time (PPT) adversary F, who can win the Definition 1 game in Section 2.5 with a non-negligible advantage images within timeimages, then there is an algorithm C that can solve the CDH problem with the advantage images within time images, where images is the running time of images. (PPT adversary can make images secret key quires, images key generation quires, images user-sign quires, images user-encrypt quires and images,images,images, images hash function images, images, images,images quires at most).

Proof: The following shows how algorithm C uses F to solve the CDH problem with probability images within time images.

First, C gets an instance images of CDH problem, whose goal is to calculate images. C simulates a challenger to play the following game with F.

Global Setup: Challenger C executes global setup algorithm, inputs parameter images, outputs public parameter images and sends it to F.

Authority Setup: C represents all authorities to run the authority setup algorithm and generate secret key images for each authority images, where images, so only C knows the real value images of the master secret key. However, C sets the master secret key as images, and sets the public key as images. Because images and images are unknown to F, images and images are indistinguishable to F. Finally, C adds parameters images and images to images. F can obtain images from C. After receiving the images, F outputs the target identity images.

images, images, images, and images are random oracle models controlled by C. The query results of images, images, images, and images are stored in images, images, images, and images respectively.

Queries: Forger F performs some queries to Challenger C:

- images queries: C enters an identity images or images into images. If there is images or images in the images, returns images, otherwise C performs the following steps:

1) Randomly selects an integer images;

2) Saves images or images to images;

3) Returns images.

- images queries: C enters an identity images intoimages. If there is images in the images, returns images, otherwise C performs the following steps:

1) Randomly selects an integer images;

2) If images, (where images is C random guess of the identity that F will attack) calculates images, otherwise calculates images;

3) Saves images to images;

4) Returns images.

- images queries: C enters an array images into images. If there is images in the images, returns images, otherwise C performs the following steps:

1) Randomly selects an integer images;

2) Saves images to images;

3) Returns images.

- images queries: C enters an element images into images. If there is images in the images, returns images otherwise C performs the following steps:

1) Randomly selects a character string images;

2) Saves images to images;

3) Returns images.

- Secret key queries: F requests secret keys images of authority images, where images represents the index set of corrupt authorities. Because C generates the secret keys of all authorities , C can answer the queries from F.

- Key generation queries: F asks C about the secret key images of the identity images. If images, C does not answer this query and terminate the game. Otherwise, C looks for images in images, calculates images, and then returns it to F.

- User-sign queries: F asks C for the signature images of a tuple images. If images, C will get the correct images from key generation queries, and then calculates the signature images and transmits it to F. If images, C cannot obtain images from key generation queries to calculate the signature directly. However, C can answer F’s query through the following steps: 1) C randomly selects images and calculates images. 2) C finds images in images list and gets images. 3) C finds images in images (if it cannot be found, C chooses images, then calculates images and stores images in images). 4) C calculates images, and then gets images and returns it to F.

- User-encrypt queries: To forge a signcryption, the query is executed after the user-sign query. When C receives the encryption query about images, where images and images represents a receiver set images (images represents the identity of receivers and images represents the number of receivers), C answers F through the following steps: 1) C calculates images, and then finds images in the images. 2) C calculatesimages; 3) C finds images in the H0 – list, calculates images and gets images, where images. 4) C gets the signcryption images and sends it to F.

Forgery: F generates the target signcryption:

If the forgery is successful, the following equation holds:

Define images, then images. Therefore, we can get the solution of CDH problem images.

In the general signcryption query, as most imagesqueries are conducted, the probability that C fails to answer a signcryption query is not greater than images. Therefore, C can get the advantage images and images, where images is the running time of images. From the above proof and CDH problem, we can see that this scheme satisfies the unforgeability of signcryption.

Theorem 2: In the random oracle model, if there is a probabilistic polynomial time (PPT) adversary A, who can win the Definition 2 game in Section 2.5 with a non-negligible advantage images within timeimages, then there is an algorithm C that can solve the BCDH problem with the advantage images within time images, where images is the running time of images. (PPT adversary can make images secret key quires, images key generation quires, images user-sign quires, images user-encrypt quires, images receiver-decrypt-and-verify quires and images,images,images, and images hash function images, images, images, and images quires at most).

Proof: The following shows how algorithm C uses A to solve the BCDH problem with probability images within time images.

First, C gets an instance images of BCDH problem, whose goal is to calculate images. C simulates a challenger to play the following game with A.

Global Setup: Challenger C executes global setup algorithm, inputs parameter images, outputs public parameter images and sends it to F.

Authority Setup: C represents all authorities to run authority setup algorithm and generate secret key images for each authority images, where images. Similarly, C sets images instead of images, where images and images are indistinguishable to A. Finally, C adds parameters images and images to images. A can obtain images from C. After receiving the images, A outputs target identities images of images receivers, where images.

Phase 1: Adversary A performs the following five queries to Challenger C:

- Secret key queries: A requests secret keys images of authority images, where images represents the index set of corrupt authorities. Because C generates the secret keys of all authorities , C can answer the queries from A.

- Key generation queries: A asks C about the secret key images of the identity images. If images, where images, C does not answer this query and terminate the game. Otherwise, C looks for images in images, then calculates images, and returns it to A.

- User-sign queries: A asks C about the signature images of a tuple images, where images(images). C answers A through the following calculations: 1) C randomly selects images, calculates images, images, images, and gets images. 2) C finds images in images so that it does not appear in images. Otherwise, C reselects images, repeats the above calculation step, and then adds eligible images to images. 3) C gets images of images and returns it to A.

- User-encrypt queries: To form a complete signcryption, the query is executed after the user-sign query. When C receives the encryption query about images, where images and images represents a set of images receivers images, C answer A through the following steps: 1) C calculates images, and then finds images in the images. 2) C calculatesimages. 3) C finds images in the images, calculates images and gets images, where images. 4) C gets the signcryption images and sends it to A.

- Receiver-Decrypt-and-Verify queries: When C receives the decrypt-and-verify query about a signcryption images and an identity images, where images, C answers A through the following steps: 1) C finds images in the images and calculates images. 2) C finds images in the images, then calculates images and images, so C can obtain images. 3) C finds images in images and gets images. 4) C verifies that images holds. If it holds, images is a valid signcryption and images is returned to A.

Challenge: A selects a target plaintext pair images and identity images of the same signer and encryptor. When Challenger C receives images and images, C randomly selects a message images to signcrypt, where images. The signcryption calculation is as follows: 1) C finds images in images, where images, and then obtains their images. 2) C calculates images and gets images, where images. 3) C generates the target signcryption images, where images, images, images, images, and returns images to A.

Phase 2: A makes multiple queries as those in Phase 1. Note that A cannot ask images of images target receivers images, where images during the key generation query, or images during Receiver-Decrypt-and-Verify query.

Guess: In the end, A outputs its guess images. If images, C selects images from images and outputs images as the solution of BCDH problem.

Analysis: In User-sign and User-encrypt quires, since images, there is images, and images. Because images, where images, images can be calculated and the target signcryption can be realized.

During the challenge process, C sets images and images. After knowing images , C can get images, and then get images by Lagrange interpolation function. Therefore, images is the same as described in the actual attack process. If A’s guess is correct, A needs to ask the random oracle function images to get images, Therefore, we can get the solution of BCDH problem images.

In the attack phase, A performs images receiver-decrypt-and-verify quires. C selects images randomly from images to calculate images as the result of BCDH problem. Therefore, C can get the advantage images, and images, where images is the running time of images. From the above proof and BCDH problem, we can see that this scheme satisfies the confidentiality of signcryption.

5.2 Performance Evaluation

In this paper, we mainly evaluate the performance from signcryption efficiency and signcryption attributes.

In order to explore the signcryption efficiency, we mainly analyze its computing cost and communication traffic (i.e., length of signcryption). Tab. 1 shows the comparison results of the signcryption efficiency between the proposed scheme and prvious schemes.

Table 1: Comparison of the Signcryption Efficiency

images represents multiplication operation in images; images represents exponential operation in images; images represents logical operation; images represents bilinear operation in images; images represents the hash operation in the signature and encryption step; images represents the number of parameters; images represents the length of elements in images; images represents the length of identity information; images represents the length of plaintext message; images represents the number of receivers.

Tab. 2 shows the comparison results of signcryption attributes between the proposed scheme and previous schemes.

Table 2: Comparison of the Signcryption Attributes

Compared with previous schemes, the proposed scheme has less images length and relatively moderate communication traffic in terms of signcryption efficiency. In order to ensure that the identities of receivers are not exposed in the signcrypted message, our scheme uses Lagrange interpolation to realize the anonymity of receivers. Lagrange interpolation involves many multiplications and exponential operations, so it increases the computing cost and affects the efficiency. However, the Lagrange formula can be calculated before the signcryption, so the operation in the signcryption step can be greatly reduced.

In terms of signcryption attributes, the signcryption scheme proposed in this paper satisfies unforgeability and confidentiality under a random oracle model. Compared with other schemes, the proposed scheme is more suitable for multiple receivers and can guarantee the anonymity of receivers. Importantly, the distributed key generation is realized by multiple authorities and can resist collusion attacks.

6  Conclusion

In order to allow patients to control their own EHRs initiative and share EHRs safely in blockchain, in this paper, we introduced multiple authorities into the identity-based signcryption scheme, and constructed a detailed MA-IBSC scheme for multiple receivers. The MA-IBSC scheme can not only resist the collusion attack of at most N-1 corrupted authorities, but also share the same signcryption message with multiple designated receivers. At the same time, the identity information of these receivers is anonymous. Under the assumptions of CDH and BCDH, it is proved that the proposed scheme is secure, that is, it satisfies unforgeability and confidentiality of signcryption.

Funding Statement: This work was supported by the National Key Research and Development Project of China (Grant No. 2017YFB0802302), the Science and Technology Support Project of Sichuan Province (Grant Nos. 2016FZ0112, 2017GZ0314, and 2018GZ0204), the Academic and Technical Leaders Training Funding Support Projects of Sichuan Province (Grant No. 2016120080102643), the Application Foundation Project of Sichuan Province (Grant No. 2017JY0168), and the Science and Technology Project of Chengdu (Grant Nos. 2017-RK00-00103-ZF, and 2016-HM01-00217-SF).

Conflicts of Interest: The authors declare that they have no conflicts of interest to report regarding the present study.

References

 1.  L. Z. Xiong and Y. Q. Shi. (2018). “On the privacy-preserving outsourcing scheme of reversible data hiding over encrypted image data in cloud computing,” Computers, Materials & Continua, vol. 55, no. 3, pp. 523–539.

 2.  U. Premarathne, A. Abuadbba, L. Khalil, Z. Tari and A. Zomaya. (2016). “Hybrid cryptographic access control for cloud-based EHR systems,” IEEE Cloud Computing, vol. 3, no. 4, pp. 58–64.

 3.  G. Ramu. (2018). “A secure cloud framework to share EHRs using modified CP-ABE and the attribute bloom filter,” Education and Information Technologies, vol. 23, no. 5, pp. 2213–2233.

 4.  Z. Deng, Y. Ren, Y. Liu, X. Yin, Z. Shen et al. (2019). , “Blockchain-based trusted electronic records preservation in cloud storage,” Computers, Materials & Continua, vol. 58, no. 1, pp. 135–151.

 5.  S. Nakamoto. (2008). “Bitcoin: A peer-to-peer electronic cash system,” . [Online]. Available: https://nakamotoinstitute.org/bitcoin.

 6.  P. B. Nichol. (2016). “Blockchain applications for healthcare: Blockchain opportunities are changing healthcare globally-innovative leaders see the change,” . [Online]. Available: http://www.cio.com/article/3042603/innovation/blockchain-applications/for-healthcare.html.

 7.  M. Crosby and V. Kalyanaraman. (2015). Blockchain Technology: Beyond Bitcoin. Berkeley, USA: Applied Innovation Review, issue no. 2.

 8.  A. Roehrs, C. A. da Costa and R. da Rosa Righi. (2017). “OmniPHR: A distributed architecture model to integrate personal health records,” Journal of Biomedical Informatics, vol. 71, pp. 70–81.

 9.  W. J. Gordon and C. Catalini. (2018). “Blockchain technology for healthcare: Facilitating the transition to patient-driven interoperability,” Computational and Structural Biotechnology Journal, vol. 16, pp. 224–230.

10. A. A. Omar, S. Rahman, A. Basu and S. Kiyomoto. (2017). “MediBchain: A blockchain based privacy preserving platform for healthcare data,” in International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage, Cham, Switzerland: Springer, pp. 534–543.

11. S. Badr, I. Gomaa and E. Abd-Elrahman. (2018). “Multi-tier blockchain framework for IoT-EHRs system,” Procedia Computer Science, vol. 141, pp. 159–166.

12. L. X. Chen, W. K. Lee, C. C. Chang, K. K. R. Choo and N. Zhang. (2019). “Blockchain based searchable encryption for electronic health record sharing,” Future Generation Computer Systems, vol. 95, pp. 420–429.

13. X. Jiang, M. Z. Liu, C. Yang, Y. H. Liu and R. L. Wang. (2019). “A blockchain-based authentication protocol for WLAN mesh security access,” Computers, Materials & Continua, vol. 58, no. 1, pp. 45–59.

14. F. Tang, S. Ma, Y. Xiang and C. L. Lin. (2019). “An efficient authentication scheme for blockchain-based electronic health records,” IEEE Access, vol. 7, pp. 41678–41689.

15. R. Guo, H. Shi, Q. Zhao and D. Zheng. (2018). “Secure attribute-based signature scheme with multiple authorities for blockchain in electronic health records systems,” IEEE Access, vol. 6, pp. 11676–11686.

16. Y. Sun, R. Zhang, X. Wang, K. Gao and L. Liu. (2018). “A decentralizing attribute-based signature for healthcare blockchain,” in 27th International Conference on Computer Communication and Networks (ICCCNHangzhou, China, pp. 1–9.

17. Y. Zheng. (1997). “Digital signcryption or how to achieve cost (signature & encryption),” in CRYPTO '97: Proceedings of the 17th Annual International Cryptology Conference on Advances in Cryptology, B. S. Kaliski, CA, USA, Berlin, Heidelberg: Springer-Verlag, pp. 165–179.

18. J. Malone-Lee. (2002). “Identity-based signcryption,” in Cryptology ePrint Archive, Report 2002/098, . [Online]. Available: http://eprint.iacr.org/2002/098.pdf.

19. A. Karati and G. P. Biswas. (2016). “A practical identity based signcryption scheme from bilinear pairing,” in International Conference on Advances in Computing, Communications and Informatics, Jaipur, India, pp. 832–836.

20. C. X. Zhou, Y. Zhang and L. M. Wang. (2018). “A provable secure identity-based generalized proxy signcryption scheme,” International Journal of Network Security, vol. 20, no. 6, pp. 1183–1193.

21. S. Duan and Z. Cao. (2006). “Efficient and provably secure multi receiver identity based signcryption,” in Australasian Conference on Information Security & Privacy, Australia, pp. 195–206.

22. S. S. D. Selvi, S. S. Vivek and R. Srinivasan. (2009). “An efficient identity-based signcryption scheme for multiple receivers,” in Proceedings of the 4th International Workshop on Security: Advances in Information and Computer Security, Berlin: Springer, pp. 71–88.

23. B. Zhang and Q. L. Xu. (2010). “An ID-based anonymous signcryption scheme for multiple receivers secure in the standard model,” in Proceedings of the 2010 International Conference on Advances in Computer Science and Information Technology, Berlin: Springer, vol. 20, pp. 15–27.

24. X. Wang, J. Shu, W. Zheng, L. L. Liu and X. Fan. (2014). “New multi-receiver ID-based ring signcryption scheme,” in Unifying Electrical Engineering and Electronics Engineering. X. Song, VA, New York, USA: Springer, pp. 2251–2257.

images
This work is licensed under a Creative Commons Attribution 4.0 International License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.