Stereo storage structure assisted one-way anonymous auditing protocol in e-health system

1 Introduction

The development of society is inseparable from the advancement of science and technology. As the huge development of the internet industry and the rise of data applications such as artificial intelligence and big data spread throughout people’s lives, people begin to generally realize the importance of data. The world is gradually stepping into the era of data dominance, and all walks of life are generating data all the time. Due to the sheer amount of data that is ever increasing, traditional storage methods cannot meet the needs of the people anymore which leads to the emergence of cloud storage.

Cloud platform provides individuals and organizations with powerful storage services which brings great benefits as follows: (1) users only need to pay for the actual storage without worrying about insufficient storage resources; (2) with data hosted to cloud platform, local data will no longer be stored, which can reduce the purchase cost and energy consumption cost of storage equipment; (3) the maintenance of data storage can be left to cloud service providers (CSP) to save the cost of maintaining large amounts of data for users; (4) cloud data can form linkage with local data to make redundant backup to each other; and (5) users can easily access the data in the cloud through web interface or application.

While cloud storage has many advantages, there are also some security threats^[1,2]. On the one hand, the cloud infrastructure may suffer some inevitable hardware or software failures or external attacks that lead to data corruption could occur, but cloud server providers could deliberately hide the fact of data corruption for the sake of their business reputation. On the other hand, the outsourced data stored in the cloud might suffer from illegal behaviors from CSP for commercial benefits. What is more, the outsourcing of data results in users no longer physically owning the data, so users cannot even verify whether their data is complete, available, or secure.

Therefore, how to guarantee the data integrity and the privacy of users on the cloud server has become a key issue for cloud storage services. More data security issues are increasingly prominent such as whether the user data is securely stored or whether the user privacy is leaked and so on^[3-5]. When it comes to the electronic heath system, a physician records the information of patients’ medical treatment electronically through electronic health records which involves the collection, quality control, transmission, storage, statistics, and utilization of patient information. Obviously, it is difficult for traditional storage methods to screen and retrieve typical health records for medical statistics and scientific research. An electronic health system can not only retrieve all kinds of medical records quickly, but also make the previously laborious process of obtaining medical statistics become very simple and fast, providing first-hand data for scientific research and teaching. Nevertheless, such information often contains confidential and sensitive information, and the disclosure or falsification of such information may damage the reputation and property of patients.

In order to address these issues, considerable efforts have been made. Among existing proposals, great amounts of cloud data integrity auditing schemes based on privacy protection have been proposed^[6-9]. To verify whether the outsourced data remains intact, file owners or auditors can challenge the cloud server with low communication overheads and computation costs.

Motivation of this paper: Medical data include patients’ information such as admissions, discharges, transfers, e-health system patient records, diagnoses, treatments, medical images, economic/financial data, and so on. The quality, confidentiality, and integrity of medical data will affect the real-time, short-term, and long-term performance of the application. First, it will directly affect the daily management and treatment of patients. Second, the application of software and systems for obtaining information and decision support may be affected. Third, there are unknown impacts data storage failure may cause on medical research which can lead to irreparable consequences. At present, researchers have designed many protection schemes for data in the cloud. However, there is no complete data protection scheme specially designed for medical data.

2 Preliminaries

Necessary preliminaries mainly including some definitions and basic properties about bilinear pairing and one-way anonymous key agreement required for this paper are introduced in this section.

3 System model and data structure

3.1 System model

Stereo storage structure assisted one-way anonymous auditing scheme in e-health system involves four entities: key generation center, users, the third-party auditor, and cloud server. Figure 1 illustrates the relationship between those four entities.

Figure 1. The proposed system model

3.1.1 User

In our model, patients and physicians are considered as the two main electronic health system (EHS)-related personnel types. For instance, when a patient seeks a diagnosis through interview by a physician in EHS, the patient needs to inform the physician of his or her own information at first. To realize the privacy protection of the patient’s identity, our scheme will set up a false name for the patient based on the patient’s identity ID to interact with the physician. A physician needs to generate patients’ electronic health records (EHRs), which contains basic information about the physician and the patient as well as the patient’s medical data, and upload it to the cloud. Although physicians and patients are two different entities, their functional needs for data in the EHS are similar. Therefore, we consider the physicians and the patient as one object in this system. As user, both physicians and patients can access the relevant EHRs and validate the integrity of their data by authorizing the TPA.

3.1.2 Key generation center

The key generation center is a trusted party in e-health system responsible for setting system parameters and generating the corresponding privacy key based on the client’s identity and distributing it to the user.

3.1.3 Cloud server

It is supposed that the cloud server is a terminal that provides unlimited computing and storage capacity. Users can upload data through the cloud storage service and share it with other users. During the data integrity auditing process, Cloud server (CS) can respond to the challenges that users delegate to third-party auditor (TPA).

3.1.4 The TPA

TPA is a public verifier, which is assumed to be a terminal with unlimited computing and storage capability. TPA provides data auditing services and is entrusted by users to verify the integrity of cloud data.

3.3 Stereo storage structure

The novel stereo storage structure proposed in this paper is aimed to realize fast retrieval and query of data and assist the auditing protocol in the e-health system. As is shown in Figure 2, a three-dimensional storage structure is designed to store mass amounts of medical data from the users. Specifically, each plane of the three-dimensional structure on the left part of the figure contains a header file and a series of f diagnosis and treatment files of a certain physician corresponding to a certain patient. The header file contains the identity information of the physician and the patient, which is convenient for quick search of the file. Here, 1 ≤ f ≤ , and is the upper limit of file number of each plane in the stereo storage structure. And those medical files contained in one plane can be generated, shared with, and verified for integrity by both of the specific physician and the patient. In other words, all diagnosis and treatment files of a physician D_d for one of his/her patients P_P are stored in the same plane. For example, F_1,1,f represents the f-th files of the physician D₁ and the patient P₁, and F_1,2,f represents the f-th files of the physician D₁ and the patient P₂. In the same way, the patient P₂ can also consult with the physician D₂, during which a series of files will be generated. In this e-health system, we suppose the user set contains a set of physician D and a set of patient P, and the index of the physician and patient is d and p, respectively. Here, the f-th files of the physician D_d and the patient P_P is denoted as F_d,p,f, and the header file of this series of files in the same plane is represented as F_d,p. In addition, the f files corresponding to one of the planes are shown on the right in the figure, which together form a smaller three-dimensional storage structure. Each plane in the right picture represents a file. In order to better process the file data, we uniformly divide each file into n blocks and each block comprises s sectors. Each file and each plane of the stereo storage structure stores data as follows.

Figure 2. The presented data structure model

Furthermore, there are a warrant list of corresponding files in the header file of each plane in the structure for the auditing of the log information, which include the file origin, file type, and consistency of outsourced files. Based on this stereo storage structure, we can quickly search any user’s file and the corresponding data block fragments to assist one-way anonymous auditing protocol. Additionally, dynamic data updates are an important part of the auditing schemes. However, due to the particularity of medical data, changes in the data may cause irreversible effects on the medical data. Therefore, dynamic data updates in this paper need both patients’ and their attending physicians’ authorization; however, those updates will not change the division of the original file.

4 Security model

The following security model of the stereo storage structure assisted one-way anonymous auditing scheme is proposed by designing a series of games between an adversary and a challenger . Taking into account in our security model the fact that the cloud server may modify or remove the data in the cloud due to software and hardware failure or man-made destruction, we view the untrusted cloud server as an adversary and the user as a challenger . The formalized security model of the game is as follows:

(1) Setup. Once security parameter is inputted in the system, the challenger runs the system Setup algorithm, and generates the system public parameter PP and a master secret key msk. Then, the challenger sends the system public parameters PP to .

(2) Query. In this process, can spontaneously issue the following two queries to :

KeyGen Queries: At first, queries the secret key for the patient P_A and physician Q_B. Then, runs the KeyGen algorithm in the system to generate a secret key KAB and sends the secret key to .

Extract Queries: Then, in these queries, adaptively make queries of the signatures for the file M. After runs the KeyGen algorithm and gets the secret key, runs the Extract algorithm to generate the signatures of the file M. Next, sends the signatures of the file M to .

(3) Challenge. In this phase, plays the role of a prover to yield a valid proof and acts as a verifier to check out the correctness of the proof. The challenger samples a series of random numbers and sends the challenge to .

(4) Output. Once receiving the challenge from the challenger , the adversary generates corresponding proof P and feedback to . If this proof P can be verified by with a non-negligible probability, that is to say, this game ends and ultimately successful in the game above.

5 Our proposed scheme

Our proposed scheme is demonstrated in four phases in this section. Firstly, in the system setup phase, the KGC sets the system public parameters and a master secret key. Secondly, the KGC generates privacy keys for users and secret keys for auditing in the registration phase. Next, in the storage phase, users upload and update files to the cloud along with file warrants, authenticators, and tags. Finally, in the integrity verification phase, TPA is entrusted by the data owner to verify corresponding data integrity. Note that for simplicity, some primary notations used throughout the paper are summarized in Table 1. Moreover, the scheme is described in detail as follows:

Table 1

Main notations in the proposed scheme

Notation	Description
H1, H2, H3, H4	Four hash functions
msk	The master secret key
di	The secret key of user i
Pi	The pseudonym of user i
KAB	The session key of user A and B
KAB	The auditing secret key of user A and B
τ, {σi}	The file tag and set of block authenticators
Λ, VN, TN	The warrant, version number, and time stamp of outsourced files
χi,j	The i-th block j-th sector data of file

5.2 Registration: KeyGen

The KGC runs the KeyGen algorithm to yield a shared secret key for users with the msk and public parameter PP. The registration procedure consists of two phases: PrivacyKeyGen and SecretKeyGen.

(1) PrivacyKeyGen: First, the KGC generates and distributes the corresponding private key for every user who may be a patient or a consultant in e-healthy system. In detail, the KGC computes based on user’s identity as . Then, KGC calculates user privacy key as:

For example, KGC independently yields a private key for patient A, and a private key for the attending physician B. Then, the KGC sends to . After receiving the , user validates by calculating:

If the above equation is true, the user adopts the private key ; otherwise, the KGC fails to generate a valid privacy key.

(2) SecretKeyGen: To protect the identity of patient A, patient A randomly chooses a number , creates a pseudonym , and sends it instead of his or her actual identity to B. Then, A and B can calculate a session key , and this algorithm produces a secret key for auditing. The specific algorithm is as follows:

5.3 Storage: Extract

The storage procedure contains the following three phases: WarrantGen, AuthenticatorGen, and TagGen.

(1) WarrantGen: When user uploads or updates a new medical data, the corresponding file information will be updated. For confirming some additional information about the source, type, and consistency of the files outsourced to the cloud, the user generates a warrant which includes the pseudonym of A, the identity hash value of attending physician B, and medical file information such as file type filetype, version number , time stamp , etc. For example, Λ = P_A||Q_B||V_N||T_N||filetype. Here, the denotes the index of different medical files. Then, the following is calculated:

The patient A picks a random number , and generates an authorization:

Finally, the patient A sends the warrant pair to attending physician B. Then, the attending physician B validates the warrant pair by calculating:

If the above equation is true, the attending physician B accepts the authorization ; otherwise, the patient A fails to generate a valid warrant.

(2) AuthenticatorGen: Given a medical file F to be outsourced, the user first splits F into n blocks, and each contains s sectors: , where . For each file F, choose a random number , and for the i-th block, yield a block authenticator as follows:

(3) TagGen: A random name FID is chosen for a file from , and s random elements . Set τ₀ = Λ ||FID ||n ||u₁ || ... ||u_s ||g^tΛ ||g^t_ϑ. Then, the user generates file tag τ based on τ₀ and K_AB to guarantee the integrity of each distinct file information.

Hereafter, the user sends the file tag τ to the TPA. Besides, can be pre-computed and sent to TPA. In addition, the processed file that comprises , , , , and is uploaded to the CS and can be stored in the proposed stereo storage structure and removed from the user’s local side.

5.4 Integrity verification: Audit

The auditing procedure contains following three phases: Challenge, Response, and Verification. And the process of integrity verification is shown in Figure 3.

Figure 3. The process of integrity verification

(1) Challenge: First, the TPA confirms whether the file tag τ of outsourced file can pass the verification by retrieving τ from the CS and performing . If the file tag τ of outsourced file cannot pass the verification, then the auditing task will not be executed, and the protocol aborts; otherwise, the TPA will analyze τ₀ to acquire the total number n of outsourced file blocks. The TPA picks a random nonempty subset and a number of values at random, for each . Then, the TPA distributes the challenge set and corresponding file identifier to the CS. After that, the TPA can compute WP = e(H₄(Λ || FID ||i), in advance for the final verification.

(2) Response: CS locates to the corresponding file in the stereo storage structure upon receiving a challenge C and its file identifier from the TPA. Then, the CS computes and . After that, the CS sends to the TPA a proof P that consists of and corresponding authorization .

(3) Verification: Once receiving the proof P, with public system parameter and file tag τ, the TPA first verifies the validity of by demonstrating the equation (6), and then, verifies aggregate block authenticator as follows:

If the equation (9) is true, the challenged outsourced file in the cloud is verified as intact; otherwise, the challenged file is corrupted. In the above auditing process, TPA can also audit the details of the challenged file warrant. That is, the proof P, which will be fed back by CS, should contain more file details.

6 Security analysis

We analyzed the soundness of our scheme at first. That is, if all the entities are honest in this identity-based one-way anonymous e-health system, then the processed files and log warrants about medical data can be audited correctly. Then, we propose a simple security analysis for this scheme.

Theorem 1: In an appropriate registration process, the KGC is supposed to generate a correct privacy key for the user. In addition, the patient always produces a valid log warrant for his or her attending physician to render certain the authenticity of medical data. If the outsourced file in the cloud is not corrupted or tampered with, then the proof yielded by CS will be confirmed as valid.

Proof: As shown in Equation (2), we can confirm the correctness directly. Since patient A and the attending physician B have the shared auditing key, it follows that:

Therefore, Equation (6) holds.

Note that, for all and

It follows that:

Theorem 2: Here, we suppose that the signature algorithm is efficient and secure, and can generate file tags validly and correctly. And it is supposed that the Computational Diffie-Hellman (CDH) assumption holds in bilinear groups. The identity-based one-way anonymous scheme is secure against adaptive simulation. In detail, neither an untrusted cloud server nor the adversary can forge a valid proof to get through the verification of the auditor successfully if the data in the cloud is tampered with or corrupted.

Proof: We utilize the theory of knowledge proof and a series of security games to prove this theorem which can acquire the challenged data blocks in the aforementioned game. When the adversary interacts with the challenger and generates a valid proof P, adversary can successfully pass the verification for the challenged data blocks in the aforementioned game; there is a constructed knowledge extractor that can capture the challenged data blocks. It is assumed that the adversary can get through the TPA’s verification successfully without keeping the outsourced file integrity. Then, we can capture the whole challenged data blocks through the interaction between the constructed knowledge extractor and the proposed scheme.

Game 0: The challenger and the adversary behave in Game 0 in a manner similar to that described in Section 4. First, the challenger executes the preprocessing Setup algorithm to obtain the public parameter PP and a master secret key msk, and then sends PP to the adversary . Next, performs the KeyGen algorithm to obtain the secret key of user. Then, picks a list of data blocks and queries the signatures of them. According to the queries, executes the Extract algorithm to generate corresponding signatures for the data blocks and transmit these requested signatures to the . After that, sends a challenge to , and generates corresponding proof to . Finally, succeeds and the game aborts if the proof can get through the verification of successfully with non-negligible probability.

Game 1: This game is identical to Game 0 with one difference. The challenger keeps a list of query records about the requested signature of . If the adversary is able to yield a aggregate signature, which is valid under the verification of the challenger and is not generate by , the game aborts and the adversary succeeds.

Analysis: It is supposed that wins in the Game 1 with non-negligible probability. With this in mind, we can construct a simulator in our scheme to solve the CDH problem in bilinear groups. Given a group G with prime order , as input, the simulator is to generate by interacting with . The simulator acts like the challenger and runs as follows:

(1) The simulator randomly chooses an element , and yields the public parameters as , and the master secret key . Next, it randomly picks integers , and sets . There is a random oracle H₄. The simulator stores a list of queries in the game and responses to the challenger in a consistent manner by controlling the random oracle.

(2) When processing a file F, the simulator first yields a secret key for user as KAB by executing KeyGen algorithm. Hereafter, the simulator picks a random unique identifier for file F and a random element , and yields . For every data block , the simulator picks random values and sets:

Based on equation (10), we have:

In addition, the simulator computes the block authentication for file block x_i as σ_i = KAB . (H₄. From the perspective of , σ_i is computationally indistinguishable from the real value.

(3) With the constant interaction, the simulator sends the processed files to the adversary , which contains . Then, outputs a forgery with a non-negligible probability. Finally, if the adversary is succeed to pass the validation, but the aggregate authentication is unequal to the excepted aggregate authentication σ calculated by the simulator, then the game aborts.

According to the correctness of the proposed protocol, it is obvious that a correct proof can get through the verification successfully of the equation as follow:

Suppose the adversary forges a proof which is different from the correct proof. Next, compute the following equation:

It is obvious that , otherwise . Then, define a set , which means at least one element of is non-zero. After that, divide equation (13) by equation (12) and get the following equation:

It further implies:

Finally, we can get the value of as follow:

As long as the , the above equations are valid and can be structured to solve the CDH problem. The probability of solving the CDH problem is equal to the probability of , which is contradictory with the assumptions of the CDH problem. It means that if the adversary has a different probability of success in Game 0 versus Game 1, which is non-negligible, then the simulator can be constructed to solve the CDH problem.

Game 2: Game 2 is similar with Game 1, except the following difference. The challenger keeps interaction with the adversary and holds all the processed outsourced files that have been sent to . In the process of the proposed auditing protocol, if the aggregate authenticator yielded by is not equality to the aggregate authenticator of the challenged file blocks, then the game aborts and the adversary succeeds.

Analysis: Suppose the adversary wins in this Game with a non-negligible probability. Hereafter, a simulator is constructed to work out the Discrete algorithm (DL) problem if the adversary can succeed in this game. Given a group G with prime order q, as input, the target of the simulator is to yield α by interacting with , which satisfies . The simulator behaves like in Game 2, but with the following differences:

(1) Before processing a file F, the simulator first performs the KeyGen algorithm and yields a secret key for user as KAB. Then, following the process of the presented scheme in this paper, the simulator uses for each , where .

(2) The simulator keeps interacting with to execute the auditing protocol proposed in this paper. As described in Game 1, if the aggregate file sectors generated by the adversary is not equal to the aggregate file sectors of the challenged sectors, then the game aborts and the adversary succeeds. It is easy to know that for the reason that Game 1 is not aborted. Next, with this in mind, compared with equation (12) and equation (13), we can get the following equation:

It further indicates that:

In addition, set , which means at least one element of is non-zero. After that, compute:

Finally, the value of a is as follow:

As long as , the above equations are valid and can be structured to work out the DL problem. The probability of solving the DL problem is the same as the probability of , which is contradictory with the assumption of the DL problem. It means that if the adversary has a different probability of success in Game 1 and Game 2, which is non-negligible, then the simulator can be constructed to solve the DL problem. To summarize, the proposed one-way anonymous auditing protocol is secure and can be proven by uniting Game 0, Game 1, and Game 2.

7 Performance analysis

In this section, we first compare our scheme with the related schemes in terms of various characteristics. In Table 2, we can clearly conclude that our solution can better satisfy all the major characteristics.

Then, we give the numerical analysis of the computation overhead of the proposed stereo storage structure assisted one-way anonymous auditing protocol and then evaluate the performance of our scheme. In Table 3, we analyze and present the computation overhead of each algorithm respectively in the proposed scheme. Primarily, the following notations are defined to represent the various operations in the specific algorithms of each phase. The symbols , , and denote a multiplication operation, a exponentiation operation and a hashing operation in G, respectively. In this paper, H₁, H₂, and H₃ are not distinguished and all can be expressed as . Similarly, the symbols _T and _T are respectively expressed as a multiplication operation and a exponentiation operation in G_T. and _q are indicated as one addition operation and one multiplication operation in , respectively. And represents a bilinear pairing evaluation operation . Considering that both and are public system parameters in our protocol, then can be calculated in advance and viewed as a public value.

Table 3

Computational overhead of the proposed scheme

Phases	KGC	User (physician)	User (patient)	TPA	CS
Setup	2	/	/	/	/
KeyGen(a)	+	2 + + T	2 + + T	/	/
KeyGen(b)	/	+ +	+ 2 + q +	/	/
Extract(a)	/	3 + 2 + 2T + ℓ	2 + + (ℓ + 1)	/	/
Extract(b)	/	+ + (s + 1)	/	/	/
Audit(b)	/	/	/	/	n|I|q + n(|I| - 1) + (|I| - 1) + |I|
Audit(c)	/	/	/	(s + 1) + + (|I| - 1) + 3 + 3T + (s + 1) + T	/

KGC: Key generation center; TPA: third-party auditor; CS: cloud server

Therefore, the computation overhead of is not contained in Table 3. Furthermore, the symbols and are used to denote the signature and verification file tag processes. Hereafter, as shown in Table 3, Setup is a system preprocessing phase, which is performed by KGC and needs 2. In the algorithm of KeyGen(a), KGC needs + operations to generate a privacy key for user, and both the physician and the patient need 2 + + _T operations to verify the validity of the private key distributed by KGC. In the algorithm of KeyGen(b), the patient performs one operation and one _q operation more than the physician to generate a pseudonym. To process a medical file, patient firstly yields a warrant for the physician, which needs 2 + + (ℓ + 1) operations. Then, the physician verifies the validity of the warrant, which needs 3 + 2 + 2_T + ℓ operations. ℓ denotes the string length of warrant. The amount of file data blocks and sectors are expressed as n and s. After that, physician performs another + + (s + 1) operation to generate a block authenticator. After receiving a challenge from TPA, CS executes n |I| _q + n (|I| - 1)+ (|I| - 1) + |I| operations to yield a proof P, where the |I| is indicated as a set of non-empty challenge file randomly selected by TPA for auditing. Finally, TPA performs (s+ 1) + + (|I| - 1)+ 3 + 3_T + (s+ 1)+_T operations to verify data integrity in the cloud.

Figure 4 shows the computational cost of each entity in the proposed scheme for auditing an outsourced medical file with various numbers of data blocks. In this scheme, the time costs of TPA to prepare a challenge |I| is not taken into account, for TPA can sample a series of random elements by running offline. In the experiments, we set ℓ = 160 in this scheme and each file block consists of 160 sectors, which means that it has around 4 KB of size. Moreover, we compare the efficiency of processing a 1 MB file by set challenge data block as 20, 40, ..., 100, 200, respectively.

Figure 4. The computational cost of each entity in the proposed scheme

The simulation results of Figure 4 demonstrate that the computational cost of the user is independent of the number of data blocks in the file in carrying out the extraction algorithm. Specifically, this experiment of our scheme only considers the case that patients generate warrants for files, which can be verified by physicians and generate file tags for those files, so the calculation cost of physicians is slightly higher than that of patients, which is in line with the theoretical computational overhead analysis of the proposed scheme shown in Table 3. In addition, if it is necessary, the division of work between the physician and the patient is interchangeable during the file processing phase. After that, in the audit phase, TPA has transferred part of the calculate task to CS. Therefore, we can conclude that, as shown in Figure 4, with the increase of data blocks, the calculation cost of CS increases gradually.

8 Conclusion

In this paper, we proposed a stereo storage structure assisted one-way anonymous auditing protocol aiming the e-health system for the particularity of medical data. In our scheme, medical data can be reviewed, used and verified for integrity by relevant medical personnel and relevant patients. Besides, both the file origin and the file integrity of medical data in EHS can be verified. In addition, the proposed stereo storage structure can effectively assist the storage and quick search of various types of medical data. Both the security analyses and experimental results demonstrate that the proposed scheme in this paper is efficient and secure in the cloud.