Secure medical data sharing with verifiable outsourced decryption and cryptographic reverse firewalls

In the current era of smart healthcare, patients’ electronic health records (EHR) are typically stored in the cloud. However, healthcare institutions require a patient-centric access control mechanism to securely share EHR and prevent information leaks. While attribute-based encryption (ABE) holds potential for EHR access control, it often faces risks such as single-point failures and lacks verifiability for outsourced decryption. Backdoor programs can also compromise system security, threatening patient privacy. To address these challenges, we extended Lewko et al.’s multi-authority ABE scheme to create an online/offline ciphertext policy attribute-based key encapsulation mechanism with verifiable outsourced decryption and cryptographic reverse firewalls (OO-CP-AB-KEM-OD-CRF). Building on this mechanism, we developed a multi-authority EHR access control system to prevent the exfiltration of sensitive information. Compared with similar schemes, the OO-CP-AB-KEM-OD-CRF scheme supports user authentication and verifiable outsourced decryption, providing resilience against insider threats. Both theoretical evaluation and empirical testing indicate that our scheme surpasses similar ones in functionality and security while maintaining comparable performance despite the additional security features.