Design for a secure interoperable cloud-based Personal Health Record service

CloudCom 2012 - Proceedings: 2012 4th IEEE International Conference on Cloud Computing Technology and Science

Volumn , Issue , 2012, Pages 472-479

  Hsieh, George ^a   Chen, Rong Jaye ^b  

^a NORFOLK STATE UNIVERSITY   (United States)

^b NATIONAL CHIAO TUNG UNIVERSITY   (Taiwan)

Author keywords

attribute based encryption; cloud computing; information security; personal health record; XML based security standards

Indexed keywords

ATTRIBUTE-BASED ENCRYPTIONS; BROAD SPECTRUM; CIPHERTEXT-POLICY ATTRIBUTE-BASED ENCRYPTIONS; CLOUD-BASED; CONTINUITY OF CARES; ELECTRONIC MEDICAL RECORD; EXTENSIBLE ACCESS CONTROL MARKUP LANGUAGES; KEYWORD SEARCH; OPEN STANDARDS; PERSONAL HEALTH RECORD; PRIVACY AND TRUSTS; PRIVACY PRESERVING; PUBLIC-KEY ENCRYPTION; SECURITY STANDARDS; SELF PROTECTING; XML ENCRYPTION; XML KEY MANAGEMENT SPECIFICATIONS; XML SIGNATURE;

ACCESS CONTROL; CLOUD COMPUTING; MEDICAL COMPUTING; PUBLIC KEY CRYPTOGRAPHY; SEARCH ENGINES; SECURITY OF DATA; XML;

INTEROPERABILITY;

EID: 84874244030     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CloudCom.2012.6427582     Document Type: Conference Paper

References (40)

1. J. A. Akinyele, C. U. Lehmann, M. D. Green, M. W. Pagano, Z. N. Peterson and A. D. Rubin, "Self-Protecting Electronic Medical Records Using Attribute-Based Encryption," Cryptology ePrint Archive, 2010. http://eprint.iacr.org/2010/565.pdf
2. J. A. Akinyele, M. W. Pagano, M. D. Green, C. U. Lehmann, Z. N. Peterson and A. D. Rubin, "Securing Electronic Medical Records Using Attribute-Based Encryption On Mobile Devices," Proc. 1st ACM Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM '11), 2011, pp. 75-86.
3. The ONC-Coordinated Federal Health IT Strategic Plan: 2008-2012, U. S. Department of Health & Human Services, http://healthit.hhs.gov/portal/ server.pt/gateway/PTARGS-0-10731-848083-0-0-18/HITStrategicPlan508.pdf.
4. Personal Health Records, National Institute of Health, http://www.nlm.nih.gov/medlineplus/personalhealthrecords.html.
5. What is a Personal Health Record (PHR)?, http://www.myphr.com/StartaPHR/ what-is-a-phr.aspx.
6. K.-T. Win, W. Susilo and Y. Mu, "Personal Health Record Systems and Their Security Protection," J. Med Syst, vol. 30, pp. 309-35, 2006.
7. L. S. Liu, P. C. Shih and G. R. Hayes, "Barriers to the Adoption and Use of Personal Health Record Systems," Proc. iConference 2011, 2011.
8. Roundtable: Personal Health Records-Understanding the Evolving Landscape, U. S. Department of Health & Human Service, 2010, http://healthit.hhs.gov/ portal/server.pt/gateway/PTARGS-0-0-7733-3169-20790-43/http%3B/wcipubcontent/ publish/onc/public-communities/-content/files/1 20310-onc-editedc.pdf.
9. M. Li, C. Yu, K. Ren and W. Lou, "Securing Personal Health Records in Cloud Computing: Patient-centric and Fine-grained Data Access Control in Multi-owner Settings," Proc. 6th Int'l ICST Conf. on Security and Privacy in Communication Networks, 2010, pp. 89-106.
10. F.-K. Tseng and R.-J. Chen, "Enabling Searchable Dynamic Data Management for Group Collaboration in Cloud Storages," Proc. 2012 Int'l Conf. on Security and Management (SAM'12), 2012.
11. R. Zhang and L. Liu, "Security Models and Requirements for Healthcare Application Clouds," Proc. 2010 IEEE 3rd Int'l Conf. on Cloud Computing, 2010, pp. 268-275.
12. B. Alhaqbani and C. Fidge, "Access Control Requirements for Processing Electronic Health Records," Proc. 2007 Int'l Conf. on Business Process Management (BPM'07), 2007. pp. 371-382.
13. J. Benaloh, M. Chase, E. Horvitz and K. Lauter, "Patient Controlled Encryption: Ensuring Privacy of Electronic Medical Records," Proc. 2009 ACM Cloud Computing Security Workshop (CCSW '09), 2009, pp. 103-114.
14. R. H. Dolin, L. Alschuler, C. Beebe, P. V. Boyer, D. Essin, E. Kimber et al., "The HL7 Clinical Document Architecture, Release 2," J. Am Med Inform Assoc., vol. 13(1), Jan.-Feb. 2006, pp. 30-39.
15. ASTM E2369-05e2 Standard Specification for Continuity of Care Record (CCR), http://www.astm.org/Standards/E2369.htm.
16. C 32-HITSP Summary Documents Using HL7 Continuity of Care Document (CCD) Component, http://www.hitsp.org/ConstructSet-Details.aspx? &PrefixAl pha=4&PrefixNumeric=32.
17. G. Hsieh, "Towards Self-Protecting Security for e-Health CDA Documents," Proc. 2011 Int'l Conf. on Security and Management (SAM'11), 2011, pp. 637-643.
18. E. Bertino, I. D. Martino, F. Paci and A. C. Squicciarini, Security for Web Services and Service-Oriented Architectures, Springer-Verlag, 2010.
19. eXtensible Access Control Markup Language (XACML) Version 2.0, OASIS Standard, 1 Feb 2005, http://docs.oasisopen.org/xacml/2.0/access-control-xacml- 2.0-core-specos.pdf.
20. XML Encryption Syntax and Processing, W3C Recommendation 10 Dec. 2002, http://www.w3.org/TR/xmlenc-core/.
21. XML Signature Syntax and Processing (Second Edition), W3C Recommendation 10 June 2008, http://www.w3.org/TR/xmldsig-core/.
22. XML Key Management Specification (XKMS 2.0) Version 2.0, W3C Recommendation 28 June 2005, http://www.w3.org/TR/xkms2/.
23. A. Sahai and B. Waters, "Fuzzy identity-based encryption," Proc. EUROCRYPT 2005, Cryptology ePrint Archive, http://www.iacr.org/archive/ eurocrypt2005/34940457/34940 457.pdf.
24. V. Goyal, O. Pandey, A. Sahai and B. Waters, "Attribute-Based Encryption for Fine-Grained Access Control of Encrypted Data," Proc. 13th ACM Conf. on Computer and Communications Security, 2006, pp. 89-98.
25. J. Bethencourt, A. Sahai and B. Waters, "Ciphertext-Policy Attribute-Based Encryption," in 2007 IEEE Symposium on Security and Privacy, 2007.
26. B. Waters, "Ciphertext-Policy Attribute-Based Encryption: An Expressive, Efficient, and Provably Secure Realization," Proc. 14th Int'l Conf. on Practice and Theory in Public Key Cryptography (PKC'11), 2011, pp. 53-70.
27. S. Alshehri, S. Radziszowski and R. K. Raj, "Designing a Secure Cloud-Based EHR System using Ciphertext-Policy Attribute-Based Encryption," Proc. DMC 2012, in progress.
28. D. X. Song, D. Wagner and A. Perring, "Practical Techniques for Searches on Encrypted Data," Proc. 2000 IEEE Symp. on Security and Privacy, 2000, pp. 44-55.
29. D. Boneh, G. Di Crescenzo, R. Ostrovsky and G. Persiano, "Public Key Encryption with Keyword Search," EUROCRYPT 2004, Cryptology ePrint Archive, http://eprint.iacr.org/2005/191.pdf.
30. L. Fang, W. Susilo, C. Ge and J. Wang, "A Secure Channel Free Public Key Encryption with Keyword Search Scheme without Random Oracle," Proc. 8th Int'l Conf. on Cryptology and Network Security (CANS'09), 2009, pp. 248-258.
31. U. Hengartner and P. Steenkiste, "Exploiting Hierarchical Identity-Based Encryption for Access Control to Pervasive Computing Information," Proc. 1st Int'l Conf. on Security and Privacy for Emerging Areas in Communications Networks (SECURECOMM'05), 2005, pp. 384-396.
32. S. Narayan, M. Gagne and R. Safavi-Naini, "Privacy Preserving EHR System Using Attribute-based Infrastructure," Proc. 2010 ACM Cloud Computing Security Workshop (CCSW'10), 2010, pp. 47-52.
33. N. Attrapadung and H. Imai, "Conjunctive Broadcast and Attribute-Based Encryption," Proc. 3rd Int'l Conf. on Pairing-Based Cryptography (Pairing'09), 2009, pp. 248-265.
34. Sun's XACML Implementation, http://sunxacml.sourceforge.net/.
35. Apache XML Security for Java, http://santuario.apache.org/javaindex.html.
36. Open XKMS, http://sourceforge.net/projects/xkms/.
37. K. D. Mandl, W. W. Simons, W. C. Crawford and J. M. Abbett, "Indivo: a personally controlled health record for health information exchange and communication," BMC Medical Informatics and Decision Making, vol. 7, no. 25, 2007.
38. MDHT Tools For CDA, https://www.projects.openhealthtools.org/sf/projects/ mdht/.
39. PBC Library, Stanford University, http://crypto.stanford.edu/pbc/.
40. The Java Pairing Based Cryptography Library (jPBC), http://gas.dia.unisa. it/projects/jpbc/.