{'fraction_non_alphanumeric': 0.026682528891910265, 'fraction_numerical': 0.006755608429639701, 'mean_word_length': 4.949696663296259, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Proposed Access Control-Based Privacy Preservation Model to Share Healthcare Data in Cloud

Healthcare data in cloud computing facilitates the treatment of patients efficiently by sharing information about personal health data between the healthcare providers for medical consultation. Furthermore, retaining the confidentiality of data and patients' identity is a another challenging task. This paper presents the concept of an access control-based (AC) privacy preservation model for the mutual authentication of users and data owners in the proposed digital system. The proposed model offers a high-security guarantee and high efficiency. The proposed digital system consists of four different entities, user, data owner, cloud server, and key generation center (KGC). This approach makes the system more robust and highly secure, which has been verified with multiple scenarios. Besides, the proposed model consisted of the setup phase, key generation phase, encryption phase, validation phase, access control phase, and data sharing phase. The setup phases are run by the data owner, which takes input as a security parameter and generates the system master key and security parameter. Then, in the key generation phase, the private key is generated by KGC and is stored in the cloud server. After that, the generated private key is encrypted. Then, the session key is generated by KGC and granted to the user and cloud server for storing, and then, the results are verified in the validation phase using validation messages. Finally, the data is shared with the user and decrypted at the user-end. The proposed model outperforms other methods with a maximal genuine data rate of 0.91.


INTRODUCTION
Cloud-enabled platforms are essential for delivering cost-effective health services with higher scalability and ubiquitous network access. Transferring Electronic Health Records (EHRs) to the cloud poses major threats to privacy and confidentiality [8]. Besides, there are several nonstandardized communication architectures used in previous works that cause semantic divergences,which reveals that healthcare providers are responsible for data confidentiality with appropriate access controls [9] [14].
Tampering is a challenge related to the confidentiality of personal health generated data ("PGD") during transmission through the wireless communication channels. The majority of the patients are concerned about the confidentiality of PGD in fear of unauthorized disclosure of data or illegitimate access to data [12] [10]. It is commonly recognized that cloud computing, as well as open standards, are the most significant keystones for streamlining healthcare for the health records maintaining, managing the diseases, collaboration with the peers, and data analysis. Enabling access to the healthcare ubiquitous helps to access the healthcare data anytime from anywhere, with reduced cost and time. Therefore, the effective enforcement of privacy and security is one of the key criteria of healthcare success in a cloud infrastructure [11] [13].
It is mandatory to guarantee privacy as well as security of the data for verifying the identity of the entity and creating the shared session key for the communication.
Several key agreements and authentication schemes are presented with their security issues in literature. In [16], a brief analysis of monitoring human conditions using wireless sensors is presented where the smart health system is utilized to join the human activities of wearable devices continuously. In [18], the anonymous health records deduction approach is devised to monitor people's health conditions. The ideal IoT-enabled medical system is introduced for collecting IoT-based data and transferring it to the required users in [17]. But, this method does not focus on data security and privacy in the health system. Consequently, the researchers developed two types of attribute-driven encryption mechanisms. In [15], abuse-free attribute enabled Access Control (AC) is developed for producing data security to the cloud users and authors present a very primitive idea for dealing with the AC system. In [20], the cipher-text policy system driven access control system was introduced, which enhanced the accountability of both the communicating parties. However, this scheme supported only a selective model for security. The number of communication messages is key, also increasing the overhead of the transmitting messages. In [19], the previous medical authentication protocol is designed for predicting the suffers from the smart card stolen attack.
This study aims to design the access control-based privacy preservation method to enable secure data sharing in cloud storage. The proposed AC-based privacy preservation model is composed of four entities, such as user, data owner, cloud server, and the KGC. Moreover, the developed model is enabled based on six phases, namely setup, key generation, encryption, validation, access control, and data sharing. In the setup phase, the user is registered in the cloud server based on the message to generate the master key and system security parameter in KGC. After that, the public key is identified in KGC, and followed by stored in the cloud server and the user. Then the data is encrypted to determine cipher-text and is stored in the cloud server. Once the encryption phase is completed, the session key is created in the access control phase and is saved in the cloud server. Consequently, the validation phase is done using two validation messages, and finally, the data is shared with the user, and the data is decrypted at the user side to maintain data privacy in the confidential health care data.
The remaining sections of the paper are arranged as follows: Section 2 explains the review of the existing access control-based privacy preservation method and its challenges. Section 3 elaborates on the proposed method for AC-based privacy preserved data sharing. Section 4 explains the result and discussion of the developed approach, and finally, the conclusion is made in section 5.

MOTIVATION
This section describes the review of various access controlbased privacy preservation methods along with their merits and demerits. It will motivate researchers to develop ACbased privacy preservation.

Literature survey
The eight classical strategies based on access controlbased privacy preservation along with its limitations, as described as follows -Yang Yang et al. [1] developed a secure system for devising the two-fold access control approach for emergency and normal conditions. In the typical application, the healthcare staff with attribute secret keys having data access privilege. Also, the historical medical data of patients were analyzed based on the password-enabled break glass access method. For storing the storage overhead in the big data, the secure deduplication technique was introduced for eliminating duplicate medical files with the same data that leads to encrypt with various access policies. The method needs a lot of storage space and produces inflexibility to the system. Bander A. Alzahrani et al. [2] developed patient healthcare monitoring and the authentication protocol for Wireless Body Area Networks (WBAN). This method was utilized to perform lightweight operations with few security loopholes. In addition, an authenticated key agreement protocol was introduced for WBAN. The method gets realtime patient status and the information but failed to explore the efficiencies and optimizations in the authentication protocol.
Bhawna Narwal and Amar Kumar Mohapatra [3] presented a secure energy-efficient-based mutual authentication and the key agreement (SEEMAKA) scheme for the WBAN topology. This method achieved the properties of desirable security with several security attacks based on bitwise XOR operations and fewer hash invocations for meeting less capable sensor nodes. Hence, the security was assessed based on sound informal analysis and Automated Validation of Internet Security Protocols and Applications (AVISPA). However, SEEMAKA and Burrows-Abadi-Needham (BAN) was introduced to identify the correctness of the developed model but leads to poor processing costs. Saurabh Rana and Dheerendra Mishra [4] presented ciphertext attribute-enabled encryption (CP-ABE) for providing encrypted data security. Here, the previous access policies were in cleartext form to access the encrypted sensitive data. Also, the small attribute universe was supported for restricting practical deployments of the method. Furthermore, efficient access control was devolved and designed for medical services. The method was unable to deal with the attribute anonymity to protect data privacy.

Challenges
The challenges confronted by the conventional strategies are deliberated below: • In [1], privacy-preserving smart IoT-enabled healthcare system is devised for ensuring patients' healthcare data securely. Because of security protection, the healthcare data is encrypted by various medical staff in the storage system. This cipher-text is outsourced to the public cloud that occupies the vast storage space simultaneously.
• The patient's privacy in the WBAN networks is challenging because of its mobility and openness.
The adversaries attempt to intrude on the privacy of the patients and initiate the other attacks [2].
• Despite potential benefits, the method in [3] is resource scanty with limited communication bandwidth, limited battery energy/power, low computational power, and circumscribed memory space. In addition, security and privacy leakage of transmitted physiological data in the open channel with infrastructure are some of the formidable challenges [3].
• The presence of continuous data is the main focus in the healthcare industry, which is suitable for patient treatment. Moreover, the accessibility and availability of the uninterrupted data are of concern even in user error or hardware failure [7].
• In [5], the biometric, password-based authentication approach for the WHSNs is devised for attaining privacy preservation in the cloud. However, the problem with the sensor nodes is that they are equipped with less battery power. Therefore, energy efficiency and security become major problems.

THE PROPOSED ACCESS CONTROL MECHANISM FOR PRIVACY PRESERVED DATA SHARING
This section presents the proposed access control-based privacy preservation model for data sharing using cloud infrastructure. This work designs a model for the mutual authentication of user and data owner in the system. However, the system consists of four different entities, such as user, data owner, cloud server, and Key generation center (KGC). The proposed access control-based privacy preservation model involves six different phases, namely setup phase, key generation phase, encryption phase, access control phase, validation phase, and data sharing phase. The setup phase is run by the data owner, which takes input as a security parameter and generates a system master key and public parameter. The next step is the key generation phase to generate private keys for attaining security. The key is used to encrypt and decrypt data whenever data is being encrypted or decrypted. In the encryption phase, the data are encrypted using the encryption algorithm by taking the shared file as input. It generates the cipher-text, file encryption key, and keyword set from the file, which is then validated and verified in the validation phase. The risk of unauthorized access to the cloud is minimized in the access control phase, and finally, data privacy is achieved in the data privacy phase. Figure 1 illustrates the schematic view of the proposed access control-based privacy preservation model for healthcare data sharing with cloud infrastructure.

Setup phase
The initial phase of the proposed access control-based privacy preserved data sharing is the setup phase. The setup phase is run by three entities, such as the user, cloud server, and the KGC. Initially, the user generates user-ID and the password and sends it to the cloud server. The cloud server received the user-ID and password from the user and saved them in the cloud server as and . After that, the cloud server generates the message using the and system security parameter .
However, the message generated by the user is expressed by, The user ID and system security parameters are concatenated and operated with the hash function. Then, the password is applied to perform the EX-OR function. Then, the resultant hashing and EXOR function is performed to determine . The message received by the user is given by, where the term refers to the hashing function and the user ID is denoted as the user password is indicated as , and the symbol refers to Ex-OR operation. If then, the registration request sends by the user to the cloud server is accepted in such a way that the user is registered with a cloud server. Then, the system generates the parameter securely and save and . Once the setup phase is completed, the key is generated.

Key generation phase
The second phase of the proposed model is the key generation phase. Here, the KGC generates the s public key of the user with the user attribute . Here, the user attribute value ranging from , which means . Besides, the KGC produced the private key of the user using the public key, system security parameter, and the user attribute. Thus, the generated private key is forwarded to the cloud server and user and save it .
However, the private key of the user, generated by the KGC is expressed as, The system security parameter that is stored in the KGC is then concatenated with the user attribute and is allowed to perform Ex-OR operation with the public key of the user. Then, the master key is modulated with the obtained output to form the private key of the user.

Encryption phase
The next phase in the proposed access control-based privacy preservation method is the encryption phase. Here, the entities, such as the data owner and cloud server, are used in the encryption phase. Here, the term is considered as the input data, which is encrypted in the encrypted phase by the data owner. The data encrypted by the data owner is denoted as , and the equation is given below, The input data is allowed to perform encryption function, and the security parameter is concatenated with the master key, and the resulted expression is applied to the hashing function. The output obtained from the hashing function and encrypted data is allowed for performing Ex-OR operation in order to encrypt data. Moreover, the data owner produces the cipher-text based on encrypted data and the private key of the user of the data owner.
The generated cipher-text by data owner is given by, The encrypted data is concatenated with the private key of the user and is given to the encryption function to generate the cipher-text . Once the encrypted data is identified by the data owner and is forwarded to the cloud server, so where it is stored as the . After that, the user begins to execute the access control phase.

Access control phase
In this phase, the access control is run by the three entities, such as user, cloud server, and KGC. Here, the data access query is determined through the hashing, and the concatenation operation were three parameters, like , and . Hence, it is done based on the following equation to generate , and is expressed as, Once the data access query is identified based on the following equation that is forwarded to the cloud server. Here, the cloud server tries to point out , and the equation is given below, The user ID of the cloud server is concatenated with the private key of the cloud server and is then forwarded to the hashing function. The output obtained from the hashing function is then applied to in order to generate . If from the cloud server, the user request is accepted, then the session key of the user is generated in the KGC entity. To generate , the master key, user attribute, and the public key of the user is required, and the equation is given below, The master key is concatenated with the user attribute and is fed to the hashing function. The resultant expression generated by the hashing function is concatenated with the public key of the user and is applied to the encrypted function in order to generate the session key of the user . Hence, the generated is subjected to the cloud server and user, which is saved . After performing the access control phase, the next step to be performed is the validation phase.

Validation phase
In the validation phase, the validation messages and are determined. Hence, through the parameters user ID , session key , and system security parameter .
Similarly, for the message, the validation message is followed based on user ID, saved the private key of the user, and the master key. Thus, the expression of the validation messages is given by, To identify the validation message , the user ID , session key , and system security parameters are concatenated and are applied to the hashing function. The output obtained from the hashing function is then modulated with the random number where the value of random number ranging from to , whereas for user ID, saved private key of a user , and the master key is concatenated, and hashing function is applied. Then the resultant expression is modulated with the master key.
After that, and are transformed into the cloud server to find out and . The and are identified based on the parameter, which is already received from the private channel of the user, and the equation is given by, (12) Once and are determined through the private channel, the matching is performed as , and . If both conditions are satisfied, the user is verified. Once the verification phase is carried out, the user begins to access the data and data sharing phase.

User data access and data sharing phase
Once the user is verified, the data is shared with the user. Here, the two entities, such as the cloud server and the user, are considered. The is determined in the user based on the decryption of , and the equation is given by, Then, the is identified based on the following equation, (14) The system security parameter and the master key are concatenated with the hashing function, and then the Ex- OR function is applied to . The output expression is decrypted to form . Table 1 illustrates the proposed access control flow for privacy preservation in the cloud infrastructure.

RESULTS AND DISCUSSION
The result of the proposed access control-based privacy preservation method is discussed with respect to memory usage and a genuine detection rate.

Experimental setup
The implementation of the developed model is carried out in the Python tool with windows 10 OS, 4GB RAM, and Intel I3 processor.

Dataset description
The experiment was performed based on the Swiss, Hungarian, and Cleveland dataset were taken from Heart disease dataset [21]. The Cleveland database was taken from the Cleveland Clinical Foundation contributed by David W. Aha. The Hungarian dataset was obtained from the Hungarian Institute of Cardiology. The Swiss dataset was obtained from the university hospital, Basel, Switzerland. The dataset comprises of 303 instances with 76 attributes. Among the 76 attributes available, 14 of them are used for most of the researches.

Performance metrics
The performance of the proposed access control-based privacy preservation method is employed for analyzing the methods includes memory usage and genuine detection rate.

Memory usage:
It is the system memory, which is utilized to measure the usage of memory for recording and to process the data.

Genuine detection rate:
It is utilized to measure the number of genuine users as compared to the total number of users.

Comparative Methods
The methods employed for the analysis include: Privacy preserving-based healthcare storage system [1], SEEMAKA [3], H-CLSC [6], and proposed access controlbased privacy preservation method. Figure 2 portrays the comparative analysis of the proposed access control-based privacy preservation method using the Hungarian dataset in terms of metrics. Figure 2(a) depicts the comparative analysis of memory usage by varying the key length. When the key length=64, the memory usage obtained by the existing privacy preservingbased healthcare storage system is 0.0639GB, SEEMAKA is 0.0638GB, H-CLSC is 0.06387GB, while the proposed access control-based privacy preservation method obtained lower memory usage of 0.06386GB, respectively. Figure 2(b) depicts the comparative analysis of the Genuine detection rate with respect to the key length.

a) Comparative analysis based on Hungarian dataset
When key length=64, the Genuine detection rate obtained by the existing privacy preserving-based healthcare storage system is 0.73, SEEMAKA is 0.82, H-CLSC is 0.85, while the proposed access control-based privacy preservation method obtained higher Genuine detection rate of 0.91, respectively.  Figure 4b) depicts the comparative analysis of the Genuine detection rate with respect to the key length. When key length=512, the Genuine detection rate obtained by the existing privacy preserving-based healthcare storage system is 0.79, SEEMAKA is 0.81, H-CLSC is 0.84, while the proposed access control-based privacy preservation method obtained higher Genuine detection rate of 0.89, respectively. Figure 4. Analysis of methods by varying the key length based on Swiss dataset a) memory usage, and b) Genuine detection rate  Table 2. Comparative analysis of memory usage and genuine detection. 0.0636GB obtained by the proposed access control-based privacy preservation method, whereas the existing privacy preserving-based healthcare storage system, SEEMAKA, and H-CLSC are 0.06378GB, 0.06374GB, and 0.06372GB based on Cleveland dataset. The performance of the proposed access control-based privacy preservation method, the maximal genuine detection rate of 0.91, is obtained by the Hungarian dataset.

CONCLUSION
In this study, a robust and effective privacy preservation approach, namely "access control-based privacy preservation model," has been proposed to improve data sharing in cloud infrastructure. The developed model involves six phases, such as setup, key generation, encryption, validation, access control, and data sharing. Also, the proposed access control-based privacy preservation model consists of four different entities, such as user, data owner, cloud server, and KGC. Each entity in data sharing performs its operations for sharing the data in the cloud by maintaining privacy.
The user, such as healthcare staff for the patient's friends, relatives registers to the medical institute to obtain secret keys. The cloud server is responsible for storing healthcare big data for numerous medical institutes and replies to the data access queries. The developed model attained minimal memory usage of 0.0636GB based on Cleveland dataset, and maximal genuine detection rate of 0.91 by considering Hungarian dataset. In future work, additional entities in the cloud will be included to explore the efficiency of existing methods further.

Table1. Proposed access control flow for privacy preservation in cloud
Phases User Data Owner Cloud server KGC

Setup phase
If , User is registered Generate system security parameter and .

Key generation
Generates and

Access control
If , User request is accepted. Generates

Data sharing
User access the data and decrypts.
Once user is verified, the data is shared to the user.