{'fraction_non_alphanumeric': 0.03475863560192443, 'fraction_numerical': 0.008865344072652576, 'mean_word_length': 4.739993794601303, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Sharing and Privacy in PHRs: Efficient Policy Hiding and Update Attribute-based Encryption

Personal health records (PHRs) is an electronic medical system that enables patients to acquire, manage and share their health data. Nevertheless, data confidentiality and user privacy in PHRs have not been handled completely. As a fine-grained access control over health data, ciphertext-policy attribute-based encryption (CP-ABE) has an ability to guarantee data confidentiality. However, existing CP-ABE solutions for PHRs are facing some new challenges in access control, such as policy privacy disclosure and dynamic policy update. In terms of addressing these problems, we propose a privacy protection and dynamic share system (PPADS) based on CP-ABE for PHRs, which supports full policy hiding and flexible access control. In the system, attribute information of access policy is fully hidden by attribute bloom filter. Moreover, data user produces a transforming key for the PHRs Cloud to change access policy dynamically. Furthermore, relied on security analysis, PPADS is selectively secure under standard model. Finally, the performance comparisons and simulation results demonstrate that PPADS is suitable for PHRs.


Introduction
Personal health records (PHRs) [1] is a system that allows medical staffs and patients to retrieve PHR information in a timely way via any smart wearable devices (SWDs) [2]. As a major fundamental service, cloud storage [3] possessing powerful computation and data storage capabilities is very suitable for PHRs. Particularly in PHRs based on cloud storage, a patient only needs to upload her/his electronic health records to PHRs rather than submitting paper medical records. Whereas, PHRs still involves too much practical application concerns that have not been addressed.
Attribute-based encryption (ABE) [4] realized fine-grained access control was classified into CP-ABE [5] and key-policy attribute-based encryption (KP-ABE) [6]. Utilizing CP-ABE, which can well meet the security requirements in PHRs, patients can share their encrypted electronic health records embedded with an access policy with others. Medical staffs could decrypt correctly while her/his attribute sets were in accord with the access policy. Generally, a ciphertext of CP-ABE with a plaintext form of access structure involving user attribute can be accessed by anyone. Therefore, it is not suitable for PHRs. For example, a patient needs to consult with medical staff about medical records of a Psychiatry Department of Medical Institution 1 or 2. The patient can encrypt medical information with an access structure {[Department: ("Psychiatry")] AND [Medical Institution: ("1" OR "2")]} and upload it to PHRs Cloud (PHRC). Under the circumstance, anyone can access the ciphertext even if she or he can't decrypt it, but she or he can infer that the patient might suffer from a mental illness. Therefore, the privacy of the patient is violated and policy hiding plays a crucial role in CP-ABE. Policy hiding can be divided into two types: full hiding and partial hiding. Attribute in the access structure can be concealed in full hiding policy CP-ABE. But in a partial hiding access policy, only partial attribute information is hidden. Specifically, attribute includes two portions: attribute name and attribute value, and partial hiding simply conceals attribute value. Note that full hiding CP-ABE has a more adequate ability to ensure attribute privacy. As described in the previous example, located in a partial hiding scheme, an attacker can utilize the captured ciphertext to detect that the patient was in the fixed department of the hospital to seek medical advice, while it is impossible to acquire any information in a full hiding scheme.
To our knowledge, most of ABE schemes can encrypt message with static access policy, but the patient's medical record information needs to be modified at any time in PHRs. Traditionally speaking, the patient has to decrypt an original ciphertext to obtain plaintext, then encrypt plaintext with a new structure, and upload a new ciphertext to PHRC, which undoubtedly increases the computation cost and communication consumption. Therefore, it is meaningful to research on policy update that outsources a ciphertext update to PHRC.

Related Work
Nowadays, a growing number of people hope their health care will be protected prudently. The connection of IoT and cloud computing with PHRs is widely used, which will generate massive medical data. Since the data scale of medical IoT is huge, some traditional encryption technologies are difficult to manage and process them effectively. PHRs involving IoT and clouding computing were proposed in Xu et al. [7] and Namani et al. [8].
Nevertheless, above environment cannot refer to data confidentiality or privacy issues in PHRs. ABE, as a primitive, gives a positive solution of data confidentiality in PHRs. Sahai and Waters [4] introduced the ABE concept firstly. Along with the further improvement of ABE, there exists two basic types: KP-ABE [9] and CP-ABE [10]. Furthermore, according to the form of expression, access policy can be classified into the three types: AND-based [11], tree-based [9] and LSSS-based [12]. Additionally, many other efficient and functional ABE solutions have been put forward [13][14][15]. But these schemes cannot involve user privacy and dynamic update, and thus cannot been applied directly on PHRs.
To protect user attribute privacy, a sequence of privacy protection schemes have been presented [16,17]. Generally, policy hiding consists of two types: partial hiding and full hiding. The concept of partial hiding was presented by Nishide et al. [11], where the attribute value is hidden. To improve Nishide et al.'s scheme [11], Lai et al. [18] proposed a concrete construction supporting multi-valued attributes with wildcards. But their schemes only support AND-gate policy. Subsequently, an improved composite-order scheme with expressive LSSS was presented by Lai et al. [19]. Nonetheless, above schemes are limited for composite-order groups, since the size of composite-order group is bigger than prime order that guarantees an equivalent level of security. Later, Cui et al. [20] constructed an efficient scheme with partially hiding access policy based on linear secret sharing scheme (LSSS) in prime-order groups. Furthermore, attribute value is hidden by wildcards [21] and inner product encryption (IPE) [22]. To some extent, hiding attribute value can protect privacy, but attribute name can still reveal user information. Afterwards, Michalevsky et al. [23] utilized IPE and Khan et al. [24] took advantage of hidden vector encryption to guarantee a stronger privacy protection, but some shortcomings in efficiency and expressiveness were still existed. Hao et al. [25] constructed a full hiding attribute CP-ABE, but their scheme only possessed one specific functionality of policy hiding.
To decrease the computation burden and communication overhead, Sahai et al. [26] presented a method utilizing ciphertext authorization to update access structure, but restricted that a new policy was more restrained than previous structure. Later on, Yang et al. [27] presented a variety of policy update mechanisms for various access structures, where these structures could be converted into LSSS matrix. Then Zhang et al. [28] came up with a new policy update method, which was proved secure based on the standard model. However, they utilized the composite order groups. Later, Ying et al. [29] put forward a modified policy update for PHRs, where data owner needed to generate the update component and outsourced to PHRC. Whereas, it is possible to increase the amount of computation for data owner to some extent. Yuan [30] showed a fresh LSS matrix update algorithm, which was a novel way to update the policy, but had low efficiency.

Our Contributions
In this paper, we recommend PPADS to resolve both data confidentiality and user privacy in PHRs. In PPADS, we present a solution focused on policy hiding and policy update. The policy is fully hidden by hiding the whole attribute and the attribute is hidden by attribute bloom filter, which plays a role for locating row number of the LSSS matrix about the attribute and restoring the corresponding attribute mapping function. As far as policy update is concerned, the patient generates a transforming key and uploads it to PHRC, then PHRC updates the corresponding ciphertext with the transforming key. Our rigorous security proofs and performance comparisons indicate that PPADS is selectively secure. Thus, as shown below are our contributions: • In PPADS, the whole attribute in access policy can be hidden rather than attribute value, thus the ciphertext does not disclose any user privacy information. Then the attribute can be located and recovered by a fuzzy attribute location mechanism. Attribute-based Encryption • Furthermore, to support a flexible data sharing mechanism, the patient needs to update an old policy to a new one. Considering three scenarios, the patient brings out a transforming key and sends it to PHRC, and then PHRC can update the old corresponding ciphertext to the new ciphertext.
• Through comparing efficiency and functional diversification, the final result shows that PPADS can achieve a stronger privacy protection and smaller computing storage.

Organization
Our paper is distributed as below. We will describe the preliminary knowledge in Section 3. In Section, the detailed procedure of our system is proposed in Section 4. Finally, we provide a security proof and performance analysis comparisons in Section 5 and Section 6, then make a summary in Section 7.

Preliminaries
The definitions of bilinear pairing, decisional q -parallel bilinear Diffie-Hellman exponent (BDHE) problem, linear secret sharing scheme (LSSS), and Bloom filter are given in this part.

Bilinear Pairing
Note G and T G as two cyclic multiplicative groups with prime order p , and g can be regarded as a generator of G . A bilinear pairing is a map [12] : → , which satisfies the following characters: 2) Non-degeneracy: ( , ) 1  e g g .

3)
Computability: On the basis of ,  G uv , there has an ability to calculate ( , ) e u v .

Decisional q -BDHE Assumption
The decisional q -parallel BDHE problem is described as below. Given a group G with prime order p , where g is a generator of G . Furthermore, if an adversary is put

Linear Secret Sharing Scheme
A linear secret sharing scheme [12] is applied to a structure by (  can be reconstructed.

Bloom Filter
In 1970, Bloom [31] presented the concept of Bloom filter that is a sort of data structure for permitting membership querying and can be applied to make a judgment about whether a value belongs to a collection. Conveniently, A BF denotes a Bloom filter encoding for a set A .
Subsequently, in 2013, Dong et al. [32] proposed the garbled Bloom filter by introducing the XOR operation. Similarly, to add an element  xA to the filter, x is divided into k shares utilizing the XOR -based secret sharing scheme, which are set on the locations To inquire x , the relevant values in these positions are executed by the XOR operation. If the value recovered from the above values is equal to Furthermore, garbled Bloom filter is employed as a block to build attribute Bloom filter   h i  is taken up by an existed value. As shown in Fig. 1, the existing value will be reused, which sets Specifically, Algorithm 1 shows the detailed process of ABFBuild .

IND-CPA Security Model
To ensure the security of PPADS, our security model will be built on Sahai and Waters's model [4]. The concrete selective security model is built on an interactive game between a simulator ℬ and an adversary . In addition, the ciphertexts before and after updating are indistinguishable, then we merely consider the security before policy update. 2) Setup: ℬ executes the algorithm after obtaining * , and then returns PP to .
3) Phase 1: queries the attribute secret key connected to S .  CT and then uploads it to PHRC. In order to hide policy, the generated ciphertext is different from the common ciphertext in basic CP-ABE such as [14]. Specifically, the

Design Details of PPADS
where ,3 i C will be used to update ciphertext in the CTUpdate algorithm. That is to say, the difference between the generated ciphertext and the common ciphertext in CP-ABE is the component ,3  the row numbers will be generated and then perform the following algorithm.
Remarks. Notice that the returned row numbers are valid while user attributes are lying in the structure, and other row numbers of the rest of attributes are merely random values. Besides, it is worth noting that quite other attributes maybe regain an identical row number. In this case, it is generally impacted by the quantity of attributes belonged to and the size of access structure. 2) Step 2.    are reserved by the original encryption. On account of the above three cases, the transforming key can be regarded as:

    
In this formula, ji rr = is consistent with the original ciphertext.
b. If ( , ) ji Ι 2,M' in Case 2 holds, the updated ciphertext j C' is described as: c. If ( , ) ji Ι 3,M' in Case 3 holds, the j C' is described as: The ABFBulid algorithm is run again. The algorithm inputs the new policy, then outputs a new attribute bloom filter. Since DO has a new access policy, we can run the ABFBulid algorithm to get a new  T as a part of the update ciphertext.
In conclusion, the final ciphertext could be regarded as ) . ( ) ,

Analysis of Ciphertext Indistinguishability
While there not exists an index Phase 2. Phase 2 is identical to Phase 1.

Guess.
outputs a guess   . While else, ℬ gets back 0 that signifies Z is a random element. From the above interactive game, it is visible that the simulation of key queries and ciphertext performance was identical to the real system. Hence, we proved that PPADS is IND-CPA secure under the (decisional) q -parallel BDHE assumption.

Security Comparison
Security level.  [25] can provide a stronger privacy protection. In particular, the disclosure of access structure can lead to the theft of privacy information, since access structure existed in the form of plaintext. However, the full policy hiding mentioned in PPADS cannot obtain any sensitive information through access policy, which can guarantee higher security. In addition, Theorem 1 indicates that PPADS is selectively secure. Dynamic update can be realized in PPADS and [29,33]. Specifically, the difference is that their schemes adopted different update classification ways. However, all of them only implemented single functionality. Based on the above comparisons, PPADS possesses more powerful functionalities.

Performance Analysis
In the section, we contrast our system with other corresponding works [11,19,25,29,33]. Table 2 displays the specific symbol notations. We further give the storage cost as shown in Table 3. Note that an element length in each group , T GG is set to 512 bits. From Table 3, due to the characteristic of bloom filter, the size of ciphertext in PPADS is smaller contrasted with Lai et al.'s scheme [19]. Furthermore, since the classification of updating ciphertext is different from Ying et al.'s scheme [29], the size of transforming key and update ciphertext in PPADS is shorter. Table 4 shows the time complexity comparisons of each algorithm among these schemes. Since the time complexity of updating ciphertext is almost the same, we only compare the computation time of updating transforming key. The number of attributes in the system attribute universe Type3 We can draw an intuitive efficiency comparison graph based on Table 4, where M, E, P, and H denote a multiplication operation, an exponent operation, pairing operation, and hash operation, respectively. To evaluate the feasibility of PPADS for PHR system, some necessary experiments are conducted to measure time operation. These experiments are carried out by a laptop with an Intel configuration, CPU, TM i5-7500@3.40GHz, and 4GB RAM. We detect the efficiency of PPADS on the basis of Pairing-based Cryptography (PBC) library [34]. Since the encryption and decryption time are concerned factors to assess the efficiency of the system, we make a comparison of the computational time between PPADS and Lai et al.'s scheme [19]. Fig. 3 and Fig. 4 illustrate the comparison of encryption time and decryption time for policy hiding, respectively. Though the encryption and decryption time of both our system and Lai et al.'s scheme [19] increase along with the number of attributes, PPADS is more efficient since fewer pair operations are required.   [29]. In [29], since the time complexity of each type for transforming key is the same, we present only a curve comparison analysis. Table 4 presents the time complexity of Type 1 and Type 2 for transforming key do not increase along with the number of attributes in PPADS, while only Type 3 in PPADS and all types in Ying et al.'s scheme [29] require them. Generally, PPADS can achieve higher efficiency than Ying et al.'s scheme [29].
In summary, PPADS has the advantage of supporting expressive access structure, full policy hiding, and flexible policy update over the existing schemes. Therefore, PPADS is more applicable for data confidentiality and user privacy in PHRs. As depicted that the experimental results are coincident with the theory analysis, thus PPADS is feasible.

Conclusions
In this paper, we have feasibly addressed data confidentiality and user privacy in PHRs by recommending PPADS, which helps patients to attain medical assistance conveniently. The core building block of PPADS is a basic CP-ABE scheme that realizes full policy hiding and dynamic update simultaneously. In PPADS, the whole attribute can be hidden by an attribute bloom filter and the ciphertext can be updated by PHRC with a transforming key. Moreover, the system provides a specific security proof under decisional q -BDHE assumption.
Theoretical analysis and extensive experiment result demonstrate that PPADS has the advantage over other schemes. However, PPADS can only support small universe. Thus, our future work will pay more attention to how to set up a system with large universe effectively.  Furthermore, the proposed system from bilinear pairing cannot resist quantum computation, and thus post-quantum secure PPADS over lattice is on the list of things worth studying.