Broadband Communications, Networks, and Systems. 10th EAI International Conference, Broadnets 2019, Xi’an, China, October 27-28, 2019, Proceedings

Research Article

Fine-Grained Access Control in mHealth with Hidden Policy and Traceability

Download
73 downloads
  • @INPROCEEDINGS{10.1007/978-3-030-36442-7_17,
        author={Qi Li and Yinghui Zhang and Tao Zhang},
        title={Fine-Grained Access Control in mHealth with Hidden Policy and Traceability},
        proceedings={Broadband Communications, Networks, and Systems. 10th EAI International Conference, Broadnets 2019, Xi’an, China, October 27-28, 2019, Proceedings},
        proceedings_a={BROADNETS},
        year={2019},
        month={12},
        keywords={CP-ABE Partially hidden policy Traceability Large universe Adaptive security},
        doi={10.1007/978-3-030-36442-7_17}
    }
    
  • Qi Li
    Yinghui Zhang
    Tao Zhang
    Year: 2019
    Fine-Grained Access Control in mHealth with Hidden Policy and Traceability
    BROADNETS
    Springer
    DOI: 10.1007/978-3-030-36442-7_17
Qi Li,*, Yinghui Zhang1, Tao Zhang2
  • 1: Xi’an University of Posts and Telecommunications
  • 2: Xidian University
*Contact email: liqics@njupt.edu.cn

Abstract

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is a well-received cryptographic primitive to securely share personal health records (PHRs) in mobile healthcare (mHealth). Nevertheless, traditional CP-ABE can not be directly deployed in mHealth. First, the attribute universe scale is bounded to the system security parameter and lack of scalability. Second, the sensitive data is encrypted, but the access policy is in the plaintext form. Last but not least, it is difficult to catch the malicious user who intentionally leaks his access privilege since that the same attributes mean the same access privilege. In this paper, we propose HTAC, a fine-grained access control scheme with partially hidden policy and white-box traceability. In HTAC, the system attribute universe is larger universe without any redundant restriction. Each attribute is described by an attribute name and an attribute value. The attribute value is embedded in the PHR ciphertext and the plaintext attribute name is clear in the access policy. Moreover, the malicious user who illegally leaks his (partial or modified) private key could be precisely traced. The security analysis and performance comparison demonstrate that HTAC is secure and practical for mHealth applications.