Hybrid and Secure E-Health Data Sharing Architecture
253
store shares, is a collusion-safe. By collusion-safe we mean that if two or more
CSPs combine their keys, they cannot decrypt the data. Ten steps, illustrated
in Table 1, describe the storage phase.
When a DO wants to store an EHR, he calculates the digital signature of the
original EHR (R). Then the RSA is used to split the selected EHR into blocks and
encrypt them. Sequential execution of RSA needs a lot of calculation. Therefore,
we use the enhancement proposed in [6] where authors have parallelized the
process of encryption and decryption of a large number of data blocks. The
resulted file R
and H(R) are sent to HSDSA.
R
= E P KR (R)
(1)
When the framework receives R
and H(R), it generates a unique identifier ID R
corresponding to the file R
. This is used to guarantee the unlinkability between
DO and EHR. After that, HSDSA computes the hash of R
(H(R
)) and stores
ID R , H(R) and H(R
). Next the framework splits R
into m shares [S 1 , ... ,S m ],
performs the exclusive OR operation of each split of R
with H(R
).
[S
1 , ..., S
m ] = R
H(R
)
= [S 1 , ..., S m ]
H(R
)
= [S 1 ]
H(R
), .., [S m ]
H(R
)
(2)
[S
1 , ... ,S
m ] are the shares to be stored in independent CSPs. To securely
distribute the shares, we adopted Shamir’s secret sharing protocol. It represents
a so-called (t,n) threshold scheme with 1 ≤ t ≤ n. This mechanism permits the
distribution of a document among n parts in a way that reconstruction is possible
if at least t shares are present. Suppose a share S
i (for i i = 1 ... m), Shamir’s
secret sharing algorithm sets a i0 = S
i , chooses a i1 , ..., a it−1 at random, takes
distinct values x 1 , x 2 ,..., x m with m ≥ t-1 and computes the shares to distribute,
as follows:
⎧
⎨
⎩
S 1i = (x i , f 1 (x i ))
....
S mi = (x i , f m (x i ))
, for i = 1..n
In the proposed architecture, HSDSA selects m polynomials.
⎧
⎨
⎩
f 1 (x) = a 10 + a 11 x + a 12 x
2 + ... + a 1t−1 x
t−1
mod p
...
f m (x) = a m0 + a m1 x + a m2 x
2 + ... + a mt−1 x
t−1
mod p
Where
⎡
⎣
a 11 , ..., a 1t−1
...
a m1 , ..., a mt−1
⎤
⎦ ∈ Z
The HSDSA computes n shares S 1i , ..., S mi (i = 1, ..., n) and distributes
them to CSP 1 , ..., CSP n .
253
store shares, is a collusion-safe. By collusion-safe we mean that if two or more
CSPs combine their keys, they cannot decrypt the data. Ten steps, illustrated
in Table 1, describe the storage phase.
When a DO wants to store an EHR, he calculates the digital signature of the
original EHR (R). Then the RSA is used to split the selected EHR into blocks and
encrypt them. Sequential execution of RSA needs a lot of calculation. Therefore,
we use the enhancement proposed in [6] where authors have parallelized the
process of encryption and decryption of a large number of data blocks. The
resulted file R
and H(R) are sent to HSDSA.
R
= E P KR (R)
(1)
When the framework receives R
and H(R), it generates a unique identifier ID R
corresponding to the file R
. This is used to guarantee the unlinkability between
DO and EHR. After that, HSDSA computes the hash of R
(H(R
)) and stores
ID R , H(R) and H(R
). Next the framework splits R
into m shares [S 1 , ... ,S m ],
performs the exclusive OR operation of each split of R
with H(R
).
[S
1 , ..., S
m ] = R
H(R
)
= [S 1 , ..., S m ]
H(R
)
= [S 1 ]
H(R
), .., [S m ]
H(R
)
(2)
[S
1 , ... ,S
m ] are the shares to be stored in independent CSPs. To securely
distribute the shares, we adopted Shamir’s secret sharing protocol. It represents
a so-called (t,n) threshold scheme with 1 ≤ t ≤ n. This mechanism permits the
distribution of a document among n parts in a way that reconstruction is possible
if at least t shares are present. Suppose a share S
i (for i i = 1 ... m), Shamir’s
secret sharing algorithm sets a i0 = S
i , chooses a i1 , ..., a it−1 at random, takes
distinct values x 1 , x 2 ,..., x m with m ≥ t-1 and computes the shares to distribute,
as follows:
⎧
⎨
⎩
S 1i = (x i , f 1 (x i ))
....
S mi = (x i , f m (x i ))
, for i = 1..n
In the proposed architecture, HSDSA selects m polynomials.
⎧
⎨
⎩
f 1 (x) = a 10 + a 11 x + a 12 x
2 + ... + a 1t−1 x
t−1
mod p
...
f m (x) = a m0 + a m1 x + a m2 x
2 + ... + a mt−1 x
t−1
mod p
Where
⎡
⎣
a 11 , ..., a 1t−1
...
a m1 , ..., a mt−1
⎤
⎦ ∈ Z
The HSDSA computes n shares S 1i , ..., S mi (i = 1, ..., n) and distributes
them to CSP 1 , ..., CSP n .