Privacy-Preserving and Autonomous-Path Access Delegation for Mobile Cloud Healthcare Systems

Mobile cloud healthcare systems are gaining popularity due to their remote data collection through mobile devices and flexible data access through cloud services. The collected electronic health records (EHRs) are generally encrypted on mobile devices before being uploaded to the cloud, and accessed only by specific users. This incurs inconvenience when re-sharing EHRs with new receivers, especially in heterogeneous scenarios. Although cross-domain proxy re-encryption (CD-PRE) schemes have been studied to transform ciphertexts between different cryptosystems, they can neither support EHRs' controlled multi-hop delegation between trusted delegatees chosen by the delegator nor prevent EHRs' privacy inference through delegatees' information. To this end, we present CAP-PRE for mobile cloud healthcare systems, which is a multi-hop CD-PRE scheme that supports lightweight encryption and re-encryption key generation on mobile devices, as well as privacy-preserving and autonomous-path access delegation. In CAP-PRE, the delegator creates a delegation path that includes preferred delegatees, and generates corresponding re-encryption keys which enables the cloud server to convert the collected ciphertext to an inner product ciphertext for privacy-preserving EHR re-sharing and pass the access rights along the delegation path for controlled multi-hop delegation. We finally prove the security of CAP-PRE and show the better performance of CAP-PRE with extensive experiments.