Received January 26, 2019, accepted March 4, 2019, date of publication March 13, 2019, date of current version

April 12, 2019.

Digital Object Identifier 10.1109/ACCESS.2019.2904300

An Efficient Authentication Scheme for

Blockchain-Based Electronic
Health Records
FEI TANG1,2 , SHUAI MA 1, YONG XIANG3 , (Senior Member, IEEE), AND CHANGLU LIN 4
1 College of Computer Science and Technology, Chongqing University of Posts and Telecommunications, Chongqing 400065, China
2 School of Cyber Security and Information Law, Chongqing University of Posts and Telecommunications, Chongqing 400065, China
3 School of Information Technology, Deakin University, Melbourne, VIC 3125, Australia
4 Key Laboratory of Network Security and Cryptography, Fujian Normal University, Fujian 350007, China

Corresponding author: Fei Tang ([email protected])

This work was supported in part by the National Key Research and Development Program of China under Grant 2017YFB0802300, in part
by the National Natural Science Foundation of China under Grant 61702067, Grant 61572132, and Grant U1705264, in part by the Natural
Science Foundation of Chongqing under Grant cstc2017jcyjAX0201, in part by the Science and Technology Research Project of the
Chongqing Municipal Education Commission under Grant KJ1600445, and in part by the Venture & Innovation Support Program for
Chongqing Overseas Returnees under Grant CX2018122.

ABSTRACT In traditional electronic health records (EHRs), medical-related information is generally

separately controlled by different hospitals and thus it leads to the inconvenience of information sharing.
Cloud-based EHRs solve the problem of information sharing in the traditional EHRs. However, cloud-
based EHRs suffer the centralized problem, i.e., cloud service center and key-generation center. This paper
works on creating a new EHRs paradigm which can help in dealing with the centralized problem of cloud-
based EHRs. Our solution is to make use of the emerging technology of blockchain to EHRs (denoted
as blockchain-based EHRs for convenience). First, we formally define the system model of blockchain-
based EHRs in the setting of consortium blockchain. In addition, the authentication issue is very important
for EHRs. However, existing authentication schemes for blockchain-based EHRs have their own weak points.
Therefore, in this paper, we also propose an authentication scheme for blockchain-based EHRs. Our proposal
is an identity-based signature scheme with multiple authorities which can resist collusion attack out of N
from N −1 authorities. Furthermore, our scheme is provably secure in the random oracle model and has more
efficient signing and verification algorithms than existing authentication schemes of blockchain-based EHRs.

INDEX TERMS Electronic health records, blockchain, identity-based signatures, multiple authorities.

I. INTRODUCTION for information storage and retrieval. In EHRs, all medical-

Traditional paper-based health records apparently are incon- related data are digitized and stored in the server of hospital.
venient for information interchange or sharing. The technol- Then, when a patient goes back to the hospital, he or the hos-
ogy of Electronic Health Records (EHRs) [7], [8], [19], [20] pital can search previous information, including names of the
provides a novel way to collect and manage health-related patient and doctor, time, diagnosis, and so on. As an important
information. EHRs are an information system which main- application in the medical field, EHRs have attracted wide
tains medical records in the process of patients’ treatment or attention. Many standards have been proposed [19], [20] for
health management. It contains various kinds of health infor- EHRs. In addition, many papers considered the security and
mation and realizes the summary or integration of different privacy issues in EHRs systems [7], [8], [19].
electronic medical information and satisfy the management However, there exists many problems in traditional EHRs.
needs of hospitals and related research institutions. EHRs are First of all, generally, medical-related data are independently
more convenient than traditional paper-based health records stored in different hospitals or research institutions since
they have their own independent database. Therefore, when
The associate editor coordinating the review of this manuscript and a patient transfers from a hospital to another one, he needs to
approving it for publication was Kim-Kwang Raymond Choo. obtain medical examinations once again. This obviously will
2169-3536 2019 IEEE. Translations and content mining are permitted for academic research only.
41678 Personal use is also permitted, but republication/redistribution requires IEEE permission. VOLUME 7, 2019
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

lead to waste of medical information resources and increase This paper works on creating a new EHRs paradigm which
patients’ body and financial burdens. Secondly, in EHRs can help in dealing with the problems in cloud-based EHRs.
systems, only the authorities, such as hospitals, have data. Our solution is to make use of the emerging technology of
Hence, if there is a dispute between hospital and patient, then blockchain which is derived from Bitcoin [15]. Generally
the hospital will always win since it can tamper the medical speaking, blockchain can be seem as a decentralized and
records or even delete them. It is not fair for patients. distributed database. There is authority in traditional net-
work architectures or application systems, such as KGC,
cloud service provider, and so on. The decentralized fea-
ture of blockchain gets rid of such dependence on author-
ity. Therefore, many people considered the applications of
blockchain in different types of real-world scenarios, includ-
ing EHRs, we call it blockchain-based EHRs. For example,
the works of [3], [4], and [24] designed a broad frame-
work for blockchain-based EHRs. Zhang et al. [23] and
Omar et al. [27] made use of encryption technology to protect
the confidentiality of the medical records. Xu et al. [22] focus
on the privacy issue of EHRs and designed a new framework
based on blockchain and homomorphic encryption.
Authentication is very important for blockchain-based
FIGURE 1. Cloud-based EHRs.
EHRs. It is different from the case of cryptocurrency which
In order to solve the problem of information sharing in the is anonymous and thus there is no authentication mechanism
traditional EHRs, researchers introduced the notion of could- for users, the data in blockchain-based EHRs must be authen-
based EHRs [11]–[14], [16], [21], [25]. The cloud-based ticated, such as diagnosis from doctors. However, there are
EHRs can be seem as an application of the could computing few works about such issue. Sun et al. [26] designed a decen-
technology in EHRs. In cloud-based EHRs systems, there still tralized attribute-based signature scheme for blockchain-
needs a cloud service provider who plays the role of authority. based EHRs. In their scheme, each authority agency is in
As shown in Figure 1, all medical-related data, from doc- charge of one or more attributes. That is to say, the different
tor, pharmacy, diagnostic laboratory, insurance center, and attributes of the user are issued by one or more authority
so on, will be uploaded to the cloud server. Then, users agencies. Therefore, the scheme of [26] is vulnerable to the
can search and download useful information from the could collusion attack of authorities. Guo et al. [6] also constructed
server. If several organizations share a same cloud server, an attribute-based signature scheme with multiple authorities
then they can share the data with a convenient way. Next, for blockchain-based EHRs. Their scheme can resist col-
when patients transfer from a hospital to another one, the new lusion attack out of N from N − 1 corrupted authorities.
hospital can obtain patients’ medical-related data from the However, in their scheme, each patient has a blockchain of
cloud and thus they have no need to, once again, get medical healthcare alone which is incompatible with the property of
examinations. Therefore, cloud-based EHRs solve the prob- blockchain.
lem of information sharing in the traditional EHRs. In addi-
tion, in cloud-based EHRs, all data are only maintained by the A. OUR MOTIVATIONS AND CONTRIBUTIONS
authority, i.e., cloud service provider, and thus the hospitals There are few works considered the authentication issue
and other organizations could tamper the medical-related data for blockchain-based EHRs where the scheme of [26] suf-
only when they collude with the authority. fers from the problem of collusion attack and the model
Cloud-based EHRs solve the problem of information shar- of [6] is incompatible with blockchain. In addition, both
ing, and make hospitals and other organizations cannot of [26] and [6] have not thought about the roles of the orga-
tamper the data by themselves. However, there also has nizations, such as hospitals, medical insurance companies,
some problems in the cloud-based EHRs. Firstly, if there scientific research institutions, pharmaceutical companies,
has dispute between hospital and patient, then the hospi- and so on, which is inappropriate in real-world applica-
tal can collude with the cloud service provider to tamper tion. Furthermore, the signing and verification costs of
or even delete the data. Therefore, as in many other kinds both schemes [6], [26] are high. However, as said before,
of cloud-based systems, we need to put our trust on the the authentication issue is very important for blockchain-
cloud server. Whereas, if the cloud server is attacked or it based EHRs. Therefore, in this work, we further consider this
is malicious, then patients’ privacy is a big problem. Sec- problem for blockchain-based EHRs. The main contributions
ondly, in identity-based and attribute-based cryptosystems for of this work are as follows:
cloud-based EHRs, e.g., [12], [21], [25], there is a key gen- • Firstly, as the roles of organizations of EHRs have
eration center (KGC) who is responsible for key generation not been considered in the models of [6] and [26],
for all users. Actually, it is well known that KGC knows all we re-define the model of blockchain-based EHRs.
users’ secret keys. Our model is defined in the setting of consortium

VOLUME 7, 2019 41679

 F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

blockchain [9], [10], which corresponds to the real-

world of EHRs.
• Secondly, the authentication efficiency is very important
for blockchain-based EHRs, especially when the amount
of data is large. Therefore, in this paper, we design
an efficient authentication scheme for blockchain-
based EHRs. Our proposal is an identity-based signature
scheme with multiple authorities (MA-IBS) which has
both efficient signing and verification algorithms and
can resist collusion attack.
• Finally, we prove the security of the proposed scheme,
in the random oracle model, under the computational
Diffie-Hellman assumption. Meanwhile, we evaluate FIGURE 2. Blockchain-based EHRs.
the performance of the scheme and compare it with
the existing two authentication schemes [6], [26] in
blockchain-based EHRs. chosen ECDSA and SHA-256 as the public parameters
for Bitcoin system. Moreover, the KGC in identity-
B. PAPER ORGANIZATION based and attribute-based cryptosystems of cloud-based
The rest of this paper is organized as follows. Section II EHRs [11], [12], knows all users’ secret key. But the
describes the formal definition of blockchain-based EHRs. server in blockchain-based EHRs does not having the
In Section III, we present some preliminaries including def- right to generate users’ secret keys.
inition of MA-IBS, security model, and the relationship • Level 1: contains hospitals and other organizations.
between MA-IBS and blockchain-based EHRs. The proposed These users correspond to the authorities in consortium
scheme is given in Section IV and security proof and perfor- blockchain. All data are uploaded and stored by all
mance evaluation are given in Section V. Finally, Section VI authorities separately. In addition, Level 1 users also
concludes this work. play the roles of key generation authorities and to gener-
ate Level 2 users’ secret keys. However, for consortium
II. MODEL OF BLOCKCHAIN-BASED EHR blockchain of EHRs, we require that no one can control
We divide the users of blockchain-based EHRs into three or obtain Level 2 users’ secret keys. This is very impor-
levels. The first level, denoted by Level 0, is the EHRs tant to understand the difference between cloud-based
server. The second level, denoted by Level 1, contains several EHRs and blockchain-based EHRs.
kinds of organizations, such as hospitals, medical insurance • Level 2: is composed of doctors, researchers, insurance
companies, scientific research institutions, pharmaceutical agents, and so on. These users correspond to the employ-
companies, and so on. The third level, denoted by Level 2 ees of Level 1 users, for example, doctor works for a
which corresponds to the employees of the Level 1 users, hospital. The responsibility of Level 2 users is to pro-
consists of doctors, researchers, patients, insurance agents, vide specific medical-related information. For example,
and so on. In blockchain-based EHRs systems, all medical- doctors give diagnosis, insurance agents sign insurance
related data will be distributed stored by all Level 1 users who policy, and so on.
can reach a consensus, for the authenticity of the shared data, Authentication is one of the most important problems
based on a specific mechanism. The responsibility of Level 2 for EHRs because we need to ensure the authenticity of
users are that generate medical-related information, such as medical records in consortium blockchain. Corresponding to
medical records from doctors, insurance policies from insur- the system model, authentication of blockchain-based EHRs
ance agent, and so on. The authenticity of such information contains the following two cases:
can be guaranteed by a proper authorization mechanism from • Case 1 (Authentication of Level 2): It means that the data
Level 1 users to their employees. given by Level 2 users need to authenticated by them.
We define the model, as shown in Figure 2, of blockchain- For example, we need to ensure the authenticity of a
based EHRs in the setting of consortium blockchain. diagnosis from some doctor.
• Level 0: is the EHRs server which is in charge of • Case 2 (Authentication of Level 1): This case is corre-
the generation of system parameters. EHRs server in sponding to the authenticity of block data given by Level
blockchain-based EHRs is different from that in the 1 users, i.e., authorities.
cloud-based EHRs. In cloud-based EHRs, the medical-
related data is stored only by the cloud service provider. III. DEFINITIONS
However, in blockchain-based EHRs, the only responsi- In this section, we give several definitions for our work,
bility of EHRs server is that choosing public parameters including the definition of MA-IBS, security model of
for all users. The existence of such a server is reasonable MA-IBS and relationship between MA-IBS and blockchain-
for blockchain systems, for example, Nakamoto [15] has based EHRs.

41680 VOLUME 7, 2019

F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

A. MA-IBS SKID1 , . . . , SKIDN for authorities whose identities are

The concept of identity-based signature (IBS) was intro- ID1 , . . . , IDN , respectively.
duced by Shamir [18]. Generally, an IBS scheme consists • Queries: Adversary A can make the following four
of four algorithms: System Setup algorithm produces public kinds of queries to C:
parameters for the other three algorithms and master secret – Master secret key queries: A issues a request for
key; Key Generation algorithm, which is executed by a some authorities IDi∈QM ⊂ {ID1 , . . . , IDN } for
key generation center, produces users’ signing key; Sign and their master secret key, where QM denotes the index
Verify algorithms are responsible for signing and verification set of the identities of corrupted authorities. For
of signatures, respectively. such a request, C transmits SKIDi∈QM to A.
As far as we know, there has no work considered IBS – Key generation queries: upon receiving an iden-
scheme in the setting of multiple authorities. However, in fact, tity idi , C then returns back a corresponding secret
it is very natural to define the notion of IBS with multiple key skidi to A. Let QK be the set of identities which
authorities (MA-IBS). In MA-IBS scheme, there has one were given to the key generation queries.
more algorithm, Authority Setup, to generate all authorities’ – User-sign queries: upon receiving a message mi and
master secret keys. To satisfy the requirements of blockchain- an identity idi , C then returns back a corresponding
based EHRs, we further adjust the definition. Our MA-IBS signature σi to A. Let QUS be the set of (mi , idi )
for blockchain-based EHRs contains the following seven which were given to the user-sign queries.
algorithms: – Authority-sign queries: upon receiving a message
• System Setup: The system setup algorithm is run by Mi and an identity IDi , C then returns back a cor-
EHRs server who takes as input a security parameter λ. responding signature δi to A. Let QAS be the set
Then it outputs system public parameters params. of (Mi , IDi ) where were given to the authority-sign
• Authority Setup: The authority setup algorithm is queries.
interactively executed by all authorities who take as • Forgery: Finally, adversary A outputs a tuple of forgery
inputs public parameters params and their identities (id ∗ , m∗ , σ ∗ ) or (ID∗ , M ∗ , δ ∗ ).
ID1 , . . . , IDN . Then they output their master secret keys We say that the adversary A wins the game if one of the
SKID1 , . . . . . . , SKIDN . following two cases holds:
• Key Generation: The key generation algorithm is also • Case 1: If the forgery is (id ∗ , m∗ , σ ∗ ), then User-
interactively executed by all authorities who take as
V ∗ , m∗ , σ ) = Accept QM 6 = [1, N ] id 6∈
∗ ∗ ∗
V V ∗
Verify(id
inputs the public parameters params, their master secret QK (m , id ) 6 ∈ QUS .
keys SKID1 , . . . . . . , SKIDN , and user’s identity idi . Then • Case 2: If the forgery is (ID∗ , M ∗ , δ ∗ ), then Authority-
they output user idi ’s secret key skidi . Verify(ID∗ , M ∗ , δ ∗ ) = Accept ID∗ 6 ∈ QM
V V
• User-Sign: This sign algorithm is run by signer idi who (M ∗ , ID∗ ) 6 ∈ QAS .
takes as inputs public parameters params, secret key skidi The advantage that A wins the above game is defined as
and message m. Then he outputs a signature σi . AdvUF−CMA
MA−IBS,A (λ).
• User-Verify: This verification algorithm can be publicly
executed by all users who take as inputs the signer’s Definition 1: We say that an MA-IBS scheme is (t, qH ,
identity idi , message m, and signature σi . Then it outputs qM , qK , qUS , qAS , )-unforgeable if, for any probabilistic
Accept if it is valid; Else, outputs Reject. polynomial time (PPT) adversary A, it’s advantage  is neg-
• Authority-Sign: This sign algorithm is run by an author- ligible, where it runs the game at most t in time, and makes at
ity IDi who takes as inputs public parameters params, its most qH hash function queries (in the random oracle model),
master secret key SKIDi and message M . Then it outputs qM master secret key generation queries, qK key generation
a signature δi . queries, qUS user-signing queries, and qAS authority-signing
• Authority-Verify: This verification algorithm can be queries, respectively.
publicly executed by anyone who takes as inputs iden-
tity IDi , message M , and a signature δi . Then it outputs C. MA-IBS FOR BLOCKCHAIN-BASED EHR
Accept if it is valid; Else, outputs Reject. We now describe the relationship between the concept of
adapted MA-IBS and the model of blockchain-based EHRs
B. SECURITY MODEL OF MA-IBS described in Section II.
The security model of the adapted MA-IBS is defined by the First, the Level 0 user, i.e., EHRs server, runs System
following game. Setup algorithm to produce the system public parameters.
• System Setup: Challenger C chooses a security param- Then, Level 1 users, i.e., authorities, interactively execute the
eter λ and runs the system setup algorithm to generate Authority Setup algorithm to generate their master secret
system public parameters params. Then, C gives params keys. In this phase, we require that authorities can reach
to adversary A. a consensus on the authenticity of all master secret keys,
• Authority Setup: Challenger C runs the author- although there has no trusted center. Next, Level 2 users can
ity setup algorithm to generate master secret keys obtain their signing key from Level 1 users who distributed

VOLUME 7, 2019 41681

 F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

and GT have the same big prime order p. We say that e :

G × G → GT is an admissible bilinear map if it satisfies the
following three properties:
1) Bilinearity: for all a, b ∈ Zp , e(ga , gb ) = e(g, g)a·b .
2) Non-degeneracy: there exists gc , gd ∈ G, for c, d ∈ Zp ,
such that e(gc , gb ) 6 = 1GT , where 1GT is the identity
element of group GT .
3) Computability: there is an efficient algorithm to
compute e(ga , gb ) ∈ GT for all a, b ∈ Zp .
The security of our MA-IBS scheme is based on the com-
plexity assumption of Computational Diffie-Hellman (CDH)
problem which means that given g, ga , gb ∈ G, where a and b
are randomly and independently chosen from Z∗p , there has no
FIGURE 3. Block of blockchain-based EHRs. PPT algorithm can compute gab ∈ G.

execute the Key Generation algorithm. Then, Level 2 users B. CONSTRUCTION

will produce some medical-related information, e.g., diag- In our MA-IBS scheme, N authorities have no need to be
nosis. To ensure the non-repudiation of such information, honest. Therefore, it satisfies the requirements of blockchain-
we require that Level 2 users run User-Sign algorithm to based EHRs. In fact, the scheme can tolerate at most N − 1
sign it. Finally, an authority collects the medical-related infor- corrupted authorities to launch collusion attack.
mation and signatures from Level 2 users to form a block. • System Setup: EHRs server takes as input a security
To ensure the authenticity of block, we require the authority parameter λ to establish system public parameters for
signs it by running Authority-Sign algorithm. As shown all users. First of all, it chooses two multiplicative cyclic
in Figure 3, the message M taken as input to this signing algo- groups G and GT with a big prime order p, and a bilinear
rithm consists of previous block hash, time stamp, Merkle map e : G × G → GT . Let g be a generator of
root of medical records, and identity of the authority. the group G. Next, it chooses two cryptographic hash
Note that there are some differences between blockchain- functions H : {0, 1}∗ → G and H1 : {0, 1}∗ → Z∗p ,
based EHRs and Bitcoin [15]. First of all, in Bitcoin system respectively. System parameters of the EHRs system are
which is based on public blockchain, to reach an agree- params = {G, GT , p, g, e, H , H1 , N }, where N is the
ment on a block, it requires the node who uploads the number of authorities.
block to find a random number to satisfy a specific require- • Authority Setup: In this algorithm, N authorities estab-
ment of hash function, i.e., Proof of Work (PoW). However, lish their master secret keys, SKID1 , . . . . . . , SKIDN .
in the blockchain-based EHRs which are based on consor- It consists of the following three phases:
tium blockchain, authorities sign the block, and thus the – Phase 1 (generation of parameter h ∈ G): All
authenticity of the block is always guaranteed. Therefore, authorities are working from the same system
in Bitcoin system, if someone wants to change or delete a parameters params and collaborating together to
block, it only needs to change or delete the block in over generate a verification parameter h ∈ G.
51% nodes’ blockchain, whereas it needs to change or delete 1) Each authority IDi chooses a random (N − 1)-
the block in all authorities’ blockchain in blockchain-based degree polynomial Hi (z) over Z∗p :
EHRs systems. In addition, for the consistency of the data Hi (z) = ci0 + ci1 z + · · · + ci(N −1) zN −1 .
of our consortium blockchain-based EHRs system, we can
make use of the Practical Byzantine Fault Tolerance (PBFT) Then, it computes and broadcasts Cik = gcik
protocol. (mod p) for k = 0, 1, . . . , N − 1. Next, it com-
putes some secret values tij = Hi (H1 (IDj ))
IV. THE PROPOSED SCHEME (mod p) for j = 1, . . . , N . Finally, it sends tij
We now construct an efficient MA-IBS scheme without hav- to IDj for j 6 = i.
?
ing a trusted authority for blockchain-based EHRs systems. 2) Each authority IDi verifies the equation gtji =
H1 (IDi )k holds or not. If it holds,
QN −1
In the beginning, we give the algebraic tool and complexity k=0 (Cjk )
assumption used in our scheme. then IDj is considered to be honest. Otherwise,
authority IDj will receive a complaint from IDi .
A. BILINEAR MAP AND COMPLEXITY ASSUMPTION Then, IDj needs to broadcast values tji so that it
In the construction of our MA-IBS scheme, we will make passes the verification.
use of bilinear map as the basic tool. Therefore, we briefly 3) After the above interactions, a randomQparam-
N
introduce the concept of bilinear map. eter h can be generated as h = i=1 Ci0
Let G and GT are two cyclic multiplicative groups, where (mod p). Note that h = g 10 c +···+c N 0 and the

G is generated by an element g, i.e, G =< g >. Groups G logarithm of g for h is unknown to everyone.

41682 VOLUME 7, 2019

F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

– Phase 2 (generation of master secret key): This – Phase 3 (generation of secret key): After receiving
phase contains the following steps. all partial secret keys. User idi computes his secret
1) Each authority IDi , for i = 1, . . . , N , randomly key as
chooses two (N − 1)-degree polynomials on Z∗p :
N
Y N
Y
Fi (x) = ai0 + ai1 x + · · · + ai(N −1) x N −1
, skidi = pskidi ,j = H (0||idi )aj0 = H (0||idi )s .
j=1 j=1
Fi0 (x) = bi0 + bi1 x + · · · + bi(N −1) x N −1 .
• User-Sign: To sign a message m ∈ {0, 1}∗ , user idi does
Then, it computes and broadcasts Bik =
the following three phases:
gaik hbik , for k = 0, 1, . . . , N − 1. In addition,
it also computes secret values sij = Fi (H1 (IDj )) – Phase 1: randomly choose an integer r ∈ Z∗p and
(mod p) and s0ij = Fi0 (H1 (IDj )) (mod p), for computes u = H (0||idi )r ∈ G.
j = 1, . . . , N . Finally, it sends sij and s0ij to IDj – Phase 2: compute t = H1 (m||u) ∈ Z∗p .
r+t
for j 6 = i. – Phase 3: compute v = skid i
∈ G.
2) Each authority IDi checks the equation gsji hsji =
0 ?
The signature on message m is σ = (u, v).
QN −1 k
H1 (IDi ) (mod p) holds or not. If it • User-Verify: One can verify the validity of a signature
k=0 (Bjk ) σ = (u, v) on a message m from signer idi .
holds, the secret sharing from IDj is valid; Oth-
erwise, IDi broadcasts a complaint against IDj . – Phase 1: compute t = H1 (m||u) ∈ Z∗p .
3) If authority IDj is complained, then it needs to – Phase 2: check the following equation holds or not
broadcast values (sij , s0ij ) that satisfy equation. ?
If the disclosed (sij , s0ij ) still does not match, IDj e(v, g) = e(u, y) · e(H (0||idi )t , y).
has to keep proving itself to be honest until the
If it holds, accept the signature; Else reject it.
equation is true.
4) Note that the master secret key that interactively • Authority-Sign: Before upload a block, denoted by M ,
established by N authorities is s =
PN to the chain, authority IDi needs to sign it as follows.
i=1 ai0 .
If there has less than N authorities are corrupted, – Compute δ = H (1||M )ai0 ∈ G.
then they cannot recover the value s. The master The signature on block data M is δ.
secret key of authority IDi is • Authority-Verify: Anyone can check the validity of a
signature δ on block data M from an authority IDi .
SKIDi = ai0 . – Check the following equation holds or not
– Phase 3 (generation of master public key): Accord- ?
e(δ, g) = e(H (1||M ), Ai0 ).
ing to the above two phases, each authority has
broadcasted values {Ai0 = gai0 }i∈[1,N ] which can be
If it holds, accept the signature; Else reject it.
verified publicly. Therefore, the master public key
can be computed as
C. CORRECTNESS
N N
Y Y PN 1) CORRECTNESS OF USERS’ SIGNATURES
y= Ai0 = gai0 = g i=1 ai0 = gs ∈ G. The correctness of the users’ signatures can be easily verified
i=1 i=1
by the following equation:
After the above three phases, each authority adds param-
eters y and {(IDi , Ai0 )}N
r+t
e(v, g) = e(skid , g)
i=1 to params. i

params := {G, GT , p, g, y, e, H , H1 , {(IDi , Ai0 )}N = e(H (0||idi )s·(r+t) , g)

i=1 }.
= e(H (0||idi )(r+t) , gs )
• Key Generation: When a user registers to the EHRs
system, it can obtain a secret key skidi from authorities. = e(H (0||idi )r , y) · e(H (idi )t , y)
– Phase 1 (generation of partial secret key): Each = e(u, y) · e(H (0||idi )t , y).
authority IDj computes a value pskidi ,j =
H (0||idi )aj0 and secretly transmits it to idi . 2) CORRECTNESS OF AUTHORITIES’ SIGNATURES
– Phase 2 (verification of partial secret key): After The correctness of the authorities’ signatures can be easily
receiving the partial secret key pskidi ,j from author- verified by the following equation:
ity IDj , user idi can verify its validity by check-
?
ing the equation e(pskidi ,j , g) = e(H (0||idi ), Aj0 ) e(δ, g) = e(H (1||M )ai0 , g)
holds or not. If it holds, then the partial secret key
= e(H (1||M ), gai0 )
is correct. Otherwise, the authority IDj needs to
retransmit the value that satisfies the equation. = e(H (1||M ), Ai0 ).

VOLUME 7, 2019 41683

 F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

D. BATCH VERIFICATION A. SECURITY PROOF

Based on the EHRs system architecture as presented in The proof is given in the random oracle model. As said
Section II, once a user receives a health related message from in Subsection III-B, adversary’s forgery has two possible
another user, for example, patient receives diagnostic report cases: User-Sign signatures and Authority-Sign signatures.
from a doctor, he needs to verify the signature to ensure the Challenger C needs to have different strategies to interact with
validity of the message. In addition, when authorities upload the adversary. C cannot know the adversary’s choice until the
EHRs information into the blockchain, they also need to game ends. Therefore, it randomly guesses adversary’s choice
verify the validity of all messages. We can make use of the in the beginning with a probability of 1/2.
technique of batch verification [1] to improve the efficiency
of verification. 1) CASE OF USER-SIGN SIGNATURE FORGERY
For the case of User-Sign signature forgery, the core tech-
1) VERIFY n SIGNATURES FROM A SAME SIGNER nique of our proposal is that taking distributed key genera-
In some cases in EHRs system, we need to verify many tion technique [5] to a centralized IBS scheme [2]. It seems
signatures from a same signer at once. For example, system that the security of our scheme directly holds based on the
server wants to verify the validity of insurance policies from securities of the two schemes. However, this statement is not
an agent during some time range. true. In the scheme of [2] which is based on the assumption of
Given n signatures on n messages, (mj , σj = (uj , vj )), CDH problem, the key of security proof is that the challenger
for j = 1, . . . , n, which were signed by a same signer idi , sets one element ga of the CDH instance as the master public
to verify their validity, we only need to check that the equation key y := ga . Then, it sets the another element gb of the
Yn ? Yn Pn CDH instance as H (idi∗ ) := gb . Finally, if the adversary
e( vj , g) = e( uj , y) · e(H (0||idi ) j=1 tj , y),
j=1 j=1 chooses idi∗ as his challenge identity and outputs a valid
where tj = H1 (mj ||uj ), holds or not. Correctness of the batch forgery, then the challenger can rewind the tape of random
verification is as follows: oracle H and recover gab which means that solving the CDH
Yn Yn r +t problem. However, in our proposed scheme, the master pub-
e( vj , g) = e( skidj i j , g)
j=1 j=1 lic key is y := gs , where s is randomly generated by N
Pn
= e(H (0||idi )s· j=1 (rj +tj ) , g) authorities and no one know it. Hence, in security proof,
Pn the challenger cannot set the master public key as y := ga ,
= e(H (0||idi ) j=1 (rj +tj ) , gs )
Pn Pn and thus cannot take advantage of the adversary’s forgery to
j=1 rj
, y) · e(H (0||idi ) j=1 tj , y)
= e(H (0||idi ) compute gab .
Yn Pn
= e( uj , y) · e(H (idi ) j=1 tj , y). To resolve the dilemma, we make use of the approach of
j=1 hybrid proof. We first define three games as follows:
• Game G0 : This game corresponds to the honest execu-
2) VERIFY n SIGNATURES FROM n SIGNERS
tion of the security game defined in Definition 1.
In some other cases of EHRs system, we need to verify many
• Game G1 : In this game, we set the master secret key as
signatures from many different signer at once. For example,
y := gas where a is the exponent of the CDH instance
some patient wants to verify the validity of diagnostic reports
and s is the master secret key randomly generated by all
from n different doctors.
authorities, respectively. No one knows a and s.
Given n signatures (σj = (uj , vj ) on n messages mj ,
• Game G2 : In this game, the master secret key also is
for j = 1, . . . , n, from n signers id1 , . . . , idnQ , respectively.
n y := gas where a is the exponent of the CDH instance.
These
Qn signatures are
Qn valid if and only if e( j=1 vj , g) = However, it is different than that in G1 , in this game,
e( j=1 uj , y) · e( j=1 H (idj ) , y), where tj = H1 (mj ||uj ).
t j
the challenger plays the role of all authorities and thus it
Correctness of the batch verification is as follows:
Yn knows the value s.
e( vj , g) Then we prove that the advantages of any PPT adversary
j=1
Yn r +t to attack our scheme in three games are identical and its
= e( sk j j , g) advantage in G2 is negligible. We have the following three
j=1 idj
Yn lemmas:
= e( H (0||idj )s·(rj +tj ) , g)
j=1 Lemma 1: There has no PPT adversary can distinguish G0
Yn
= e( H (0||idj )(rj +tj ) , gs ) and G1 if the distributed key generation technique is secure.
j=1 Lemma 2: There has no PPT adversary can distinguish
Yn Yn
= e( H (0||idj )rj , y) · e( H (0||idj )tj , y) G1 and G2 .
j=1 j=1
Yn Yn Lemma 3: The advantage of any PPT adversary A in game
= e( uj , y) · e( H (0||idj )tj , y). G2 is negligible.
j=1 j=1
The proofs of the above three lemmas are presented in
V. SECURITY AND PERFORMANCE Appendix. Finally, we can easily observe that the advantage
In this section, we prove the security of our MA-IBS scheme of the adversary A in game G0 is also negligible which is our
and evaluate its performance. expected result.

41684 VOLUME 7, 2019

F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

Theorem 1: The MA-IBS scheme for blockchain-based TABLE 1. Comparison of three authentication schemes for
blockchain-based EHRs.
EHRs is (t, qH , qH1 , qM , qK , qUS , qAS , )-unforgeable, for
the case of User-Sign signature forgery in the random oracle
model, assuming the CDH problem is hard.
The proof of this theorem is presented in Appendix.

2) CASE OF AUTHORITY-SIGN SIGNATURE FORGERY

If the adversary’s forgery is the case of Authority-Sign sig-
nature, then the proof is simpler than the case of User-Sign
signature. Firstly, challenger randomly guesses adversary’s
challenge point IDi∗ and sets its public key as ga . Then, in the
random oracle queries, challenger randomly chooses a point
Mi∗ as the adversary’s challenge and set it as gb . Finally, if the
adversary chooses IDi∗ and Mi∗ as his challenge and outputs
a valid forgery, then the challenger can rewind the tape of
random oracle H and recover gab which means that solving
the CDH problem.
Theorem 2: The MA-IBS scheme for blockchain-based
EHRs is (t, qH , qH1 , qM , qK , qUS , qAS , )-unforgeable, for
the case of Authority-Sign signature forgery in the random TABLE 2. Efficiency comparison between one-by-one verification
(denoted by 1-by-1 verification) and batch verification.
oracle model, assuming the CDH problem is hard.
The proof of this theorem is given in Appendix.

B. PERFORMANCE EVALUATION
We denote Tpar as the time to perform paring operations,
Tmtp as the map-to-point hash operations, Tmul as the mul-
tiplication operations in group GT , and Texp as the expo-
nentiation operations in group G, respectively. Because
these operations dominate the costs of signing and ver-
ification algorithms, we only consider these four opera-
tions and neglect the other operations such as hash function
H1 : {0, 1}∗ → Z∗p . Java Pairing-Based Cryptography
Library (JPBC) is used to measure the run times of the
above operations. We obtain the results: Tpar is 5.796 ms,
Tmtp is 1.293 ms, Tmul is 0.031 ms and Texp is 5.786 ms
within hardware platform of an Intel i7-8550U processor with
2.0 GHz clock frequency, 8 gigabytes memory and executed
in Windows 10 operating system.
We compare our scheme to the only two exiting two
authentication schemes [6], [26] for blockchain-based EHRs
with respect to signing cost, verification cost, communication
FIGURE 4. Time comparison of three types of verification.
cost, and whether the scheme can resist collusion attack.
The results are listed in Table 1, where t is the number
of users attributes and N is the number of the authori- of singer privacy based on attribute-based signatures. How-
ties and we assume that t = N = 5 in both schemes ever, this property is not mandatory for blockchain-based
schemes [6] and [26]. In addition, since the sizes of elements EHRs because, at most time, we need to know who will
in the chosen groups G and GT are 40 and 128 bytes, respec- be responsible for the medical-related data. For example,
tively. As shown in Table 1, our proposed authentication apparently, patients need to know the identity who gives him
scheme for blockchain-based EHRs has lower computation the diagnosis.
and communication costs compared to the only two existing As described in Subsection IV-D, our scheme supports
authentication schemes for blockchain-based EHRs. batch verification which can reduce the verification cost.
In Table 1, the signing cost of our scheme is refer to the We divide the batch verification into two cases, verify n signa-
User-Sign algorithm. In addition, our scheme also defines tures from a same signer (denoted by (1, n)-to-1 verification)
that authorities sign the block data, i.e., Authority-Sign algo- and verify n signatures from n signers (denoted by (n, n)-to-1
rithm, which needs Tmtp + Texp ≈ 7.079 ms each time. verification). Table 2 shows the comparison of efficiency
Furthermore, schemes of [6] and [26] have the property between the three types of verification.

VOLUME 7, 2019 41685

 F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

Combining with the run times of basic operations obtained PROOF OF LEMMA 3
above, we show the time cost of verification algorithm in In G2 , challenger plays the role of all authorities and thus it
Figure 4. According to the figure, we can easily observe that knows the value s. However, the challenger, in this game,
the batch verification can significantly reduce the verification sets the master public key as y := gas rather than gs that is
delay, especially verifying a large number of signatures. in the real world. Nevertheless, as proved in Lemma 2, this
cannot affect adversary’s advantage. We prove that if there
exists a PPT adversary A can break the security of our scheme
VI. CONCLUSION
with a non-negligible advantage (λ), then we can construct
In order to realize the authentication scheme of EHRs system
an efficient algorithm, i.e., challenger C, to solve the CDH
based on blockchain. We first formally define the EHRs
problem with a non-negligible probability  0 (λ).
system model in the setting of consortium blockchain. Then
Firstly, challenger C is given an instance (G, GT , p, g, e,
we design an identity-based signature scheme with multi-
ga , gb ) of CDH problem. The goal of C is to compute gab ∈ G.
ple authorities for the blockchain-based EHRs system. The
Then, C plays the following game with the adversary A.
scheme has efficient signing and verification algorithms.
• System Setup: Given a security parameter λ, C executes
the system setup algorithm on the behalf of the EHR
APPENDIX server as in the real world. The output of this phase is
PROOF OF LEMMA 1 the public parameters params. Then, C gives it to A.
The proof of lemma 1 is based on the security of the dis- • Authority Setup: C honestly runs the authority
tributed key generation technique [5] which requires that no setup algorithm on the behalf of all authorities
information on s can be learned by the adversary except for ID1 , . . . , IDN . The output of this phase is the master
that is implied by the group element y = gs ∈ G. The formal secret key SKID1 , . . . , SKIDN . A can obtain identities
definition is as follows which is a variant of the original ID1 , . . . , IDN . Note that, in such setting, C plays the
definition. roles of all authorities, and hence it knows the secret
Definition 2: For any PPT adversary A, there exists a PPT value s ∈ Z∗p . Then, C sets y := gas which means that
simulator S, such that on input a random element y ∈ G the implied master secret key is as. Note that this is
generated by g, produces an output distribution which is different from that in the real scheme, but according to
polynomially indistinguishable from A’s view of a run of the Lemma 2, it is indistinguishable to A. Finally, C adds
distributed key generation that ends with y as its public key parameters y and {Ai0 }i∈[1,N ] into params and gives
output, and even if A corrupts up to N − 1 authorities. params := {G, GT , p, g, y, e, H , H1 , {(IDi , Ai0 )}Ni=1 }
In G0 , master public key is y := gs produced by the securely to A, where H and H1 will be seem as the random oracles
distributed key generation. According to the above definition, in the following proof.
even if a PPT adversary A can corrupt N − 1 authorities • Queries: A makes the following queries to C:
which correspond to the participants in the distributed key – H random oracle: challenger C maintains a list L :=
generation, it also cannot distinguish between a real key and a {(i, idi , h0i ∈ G)} where
random value in the group G. Specifically, any PPT adversary (
cannot distinguish between y := gs ∈ G and y := gas ∈ G, 0 gb , if i = i∗
hi = k
where s is the real key produced by the distributed key g i , if i 6 = i∗
generation and a, which is independent of s, is the exponent
of ga from a CDH instance even we cannot recover the two and i∗ is randomly selected by C which denotes
exponents s and a. In other words, for any PPT adversary A, its guessing point that A will attack and ki is also
its advantages in G0 and G1 to break the MA-IBS scheme are randomly selected by C from Z∗p . If A’s query idi
G
identical, i.e., AdvA0 (λ) = AdvG 1 in the list L, then C gives h0i to A; Else, C randomly
A (λ).
selects an integer ki ∈ Z∗p , then gives h0i = gki ∈ G
to A and adds the item (i, idi , h0i ) into the list L.
PROOF OF LEMMA 2 – H1 random oracle: challenger C also maintains
The proof of this lemma is fairly straightforward. In both another list L1 := {(i, mi ||ui , h01i )} where h01i ∈ Z∗p
games G0 and G1 , the master public key is y := gas , where is randomly chosen by C. If A’s query mi ||ui in the
a is the exponent of the element ga from the CDH instance list L1 , then C gives h01i to A; Else, C randomly
and s is produced by the distributed key generation. Note selects an integer h01i ∈ Z∗p , then gives h01i to A and
that the two values a and s are independently and randomly adds the item (i, mi ||ui , h01i ) into the list L1 .
generated. Therefore, this thing that whether the challenger – Master secret key generation oracle: A issues a
knows s or not does not affect adversary’s view. That is to say, request for some corrupted authorities IDi∈QM ⊂
in two games, challenger knows s in G2 and does not know s {ID1 , . . . , IDN } for their master secret key, where
in G1 , adversary’s advantages to break our MA-IBS scheme QM denotes the index set of the identities of cor-
are identical, i.e., AdvG1 G2
A (λ) = AdvA (λ). rupted authorities. For such a request, C transmits

41686 VOLUME 7, 2019

F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

SKIDi∈QM to A. As described above, the master which is the desired solution of the given instance of CDH
secret keys were honestly generated by C alone, problem.
therefore it can answer such queries. According to the above proof, a successful simulation,
– Key generation oracle: A submits an identity idi to denoted by E, from C consists of three events:
C for its secret key skidi . If idi = idi∗ , then C cannot • E1 : in key generation oracle, A does not query idi∗ ’s
answer this query and thus has to abort the game. secret key.
Else, C returns back skidi = (ga )s·ki ∈ G, where ki • E2 : adversary A’s challenge identity is idi∗ .
is from the list L, to A. • E3 : challenger C successfully rewinds the random oracle
– User-Signing oracle: A submits a tuple (idi , mi ) to H1 for the forking lemma.
C for a signature σi . The request of A can be divided A successful simulation means that C can use A’s forgery to
into two cases: solve the CDH problem. In other words, the advantage of C
1) idi 6 = idi∗ : in such case, C firstly obtains a valid is AdvCDH
A = Pr[E] = Pr[E1 ] · Pr[E2 ] · Pr[E3 ] since the three
secret key skidi from the key generation oracle. events are mutually independent. Therefore, the advantage of
Then, it can compute the signature for the query C to solve the CDH problem is
(idi , mi ) as the real signer did in the real world. YqK qH − i 1 1 − e−1
2) idi = idi∗ : in such case, C cannot obtain a AdvCDHC = 0 > · · · .
i=1 qH qH qH1
valid secret key skidi∗ from the key genera-
tion oracle and thus it cannot directly compute PROOF OF THEOREM 1
the signature as above. However, C also can According to the three lemmas, we can see that the advan-
answer A’s request as follow: σi := (ui , vi ) = tages in three games G0 , G1 and G2 of a PPT adversary to break
0
(gei /(gb )h1i , (ga )ei ·s ) where h01i is from the H1 G
the scheme are identical, i.e., AdvA0 = AdvG 1 G2
A = AdvA .
random oracle and ei is randomly selected In addition, its advantage in G2 is negligible. Therefore,
from Z∗p . The correctness of the signature can G
its advantage in G0 , AdvA0 (λ), which corresponds to the
be verified as follows: real world of when using our MA-IBS scheme into the
e(ui , y) · e(H (idi )tj , y) blockchain-based EHRs system, is also negligible.
0 0 Let Texp be the time to perform exponentiation opera-
= e(gei /(gb )h1i , gas ) · e((gb )h1i , gas )
tions in group G. Assume that a (t, qH , qH1 , qM , qK , qS , )-
= e(gei , gas ) adversary successfully breaks this MA-IBS scheme.
= e(gei ·as , g) According to the proof of Lemma 3, then there exists efficient
= e(vi , g). algorithm C to solve the CDH problem with time t 0 ≈ t +
qH Texp + qK Texp + 2qS Texp + Tdkg , where Tdkg denotes the
• Forgery: A outputs a forgery (m∗ , σ ∗ = (u∗ , v∗ )) with time of C to simulate the distributed key generation algorithm.
identity id ∗ . We assume that A wins the game, that is to
say, the forgery satisfies all of the following conditions: PROOF OF THEOREM 2
1) QM 6 = [1, N ]; Challenger C is given an instance, (G, GT , p, g, e, ga , gb ),
2) Verify(id ∗ , m∗ , σ ∗ ) = Accept; of CDH problem and its target is to compute gab ∈ G. C plays
3) A does not make query for identity id ∗ in the key the following game with adversary A.
generation queries phase; • System Setup: C randomly chooses a security parame-
4) A does not make query for message m∗ and iden- ter λ and executes the system setup algorithm. Then it
tity id ∗ in the signing queries phase. outputs the public system parameters to A.
In addition, we assume that the advantage of A to win • Authority Setup: Next, C honestly executes the author-
the above game is . ity setup algorithm on the behalf of all authorities
After the end of the game, C checks that id ∗ =
? ID1 , . . . , IDN with the exception of SKIDi∗ := a even
idi∗ . If the equation does not holds, then C aborts the C does not know it, where i∗ is randomly chosen by
game and outputs ⊥. Otherwise, according to the forking C which denotes its guess of A’s challenge authority.
lemma [17], based on the valid signature (id ∗ , m∗ , u∗ , h∗1 ← Finally, C adds parameters y and {Ai0 }i∈[1,N ] , where
H1 (m∗ ||u∗ ), v∗ ), C also can obtain another valid signature Ai∗ 0 := ga , into params and gives it to A.
0 0 −1 • Queries: A makes the following queries to C:
(id ∗ , m∗ , u∗ , h∗1 ← H1 (m∗ ||u∗ ), v∗ ) with probability 1−e
qH ,
0
1 – H random oracle: challenger C maintains a list L :=
where h∗1 6 = h∗1 , by rewind the random oracle with the same {(i, Mi , h0i ∈ G)} where
input m∗ ||u∗ but different choices of H1 . ( 0
Finally, according to the assumption that C obtains two 0 gb , if i = i∗
hi = k 0
valid signatures from A, it can compute g i , if i 6 = i∗
v∗ s−1 ·(h∗ −h∗0 )−1 0
and i∗ is randomly selected by C which denotes
gab = ( 0)
1i 1i (mod p)
.
v∗ its guessing point that A will attack and ki is also

VOLUME 7, 2019 41687

 F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

randomly selected by C from Z∗p . If A’s query Mi the CDH problem is

in the list L, then C gives h0i to A; Else, C randomly YqM N −i YqAS N −i YqAS qH − i
selects an integer ki ∈ Z∗p , then gives h0i = gki ∈ G AdvCDH
C = 0 > ·( +
i=1 N i=1 N i=1 qH
to A and adds (i, Mi , h0i ) into the list L. YqAS (N − i)(qH − i) 1 1
– H1 random oracle: challenger C also maintains − )· · · .
i=1 N · qH N qH
another list L1 := {(i, mi ||ui , h01i )}. If A’s query in
the list L1 , then C gives h01i to A; Else, C randomly According to the above, there exists efficient algorithm C to
selects an integer h01i ∈ Z∗p , then gives it to A and solve the CDH problem with time t 0 ≈ t +qH Texp +qK Texp +
adds the item (i, mi ||ui , h01i ) into the list L1 . qS Texp + Tdkg .
– Master secret key generation oracle:A submits an
authorities IDi to C for its master secret key SKIDi . REFERENCES
If IDi = IDi∗ , then C cannot answer this query and [1] M. Bellare, J. A. Garay, and T. Rabin, ‘‘Fast batch verification for modu-
lar exponentiation and digital signatures,’’ in Advances in Cryptology—
thus has to abort the game. Else, C returns back the EUROCRYPT (Lecture Notes in Computer Science), vol. 1403. 1998,
real SKIDi to A. pp. 236–250.
– Key generation oracle: C knows the value of aj0 for [2] J. C. Cha and J. H. Cheon, ‘‘An identity-based signature from gap
Diffie-Hellman groups,’’ in Public Key Cryptography—PKC, vol. 2567.
j = 1, · · · , N and j 6 = i∗ and thus can compute 2003, pp. 18–30.
pskidi ,j = H (0||idi )aj0 . For pskidi ,i∗ , C does not know [3] G. G. Dagher, J. Mohler, M. Milojkovic, and P. B. Marella, ‘‘Ancile:
a, but it can retrieval the exponent of H (0||idi ) = Privacy-preserving framework for access control and interoperability of
electronic health records using blockchain technology,’’ Sustain. Cities
gki from the H random oracles and thus it also can Soc., vol. 39, pp. 283–297, May 2018.
a ki
compute pskidQ i ,i = (g ) . Finally, C sends skidi = [4] W. J. Gordon and C. Catalini, ‘‘Blockchain technology for healthcare:
∗
N
H (0||idi ) = i=1 pskidi ,j , for j = 1, · · · , N .
s Facilitating the transition to patient-driven interoperability,’’ Comput.
Structural Biotechnol. J., vol. 16, pp. 224–230, 2018.
– Authority-Signing oracle: A submits a message Mi [5] R. Gennaro, S. Jarecki, H. Krawczyk, and T. Rabin, ‘‘Secure dis-
to C for a signature σi . The request of A can be tributed key generation for discrete-log based cryptosystems,’’ in Advances
divided into two cases: in Cryptology—EUROCRYPT (Lecture Notes in Computer Science),
vol. 1592. 1999, pp. 295–310.
1) IDi 6 = IDi∗ : in such case, C firstly obtains a [6] R. Guo, H. Shi, Q. Zhao, and D. Zheng, ‘‘Secure attribute-based signa-
valid secret key SKIDi from the master secret ture scheme with multiple authorities for blockchain in electronic health
key generation oracle. Then, it can compute records systems,’’ IEEE Access, vol. 6, pp. 11676–11686, 2018.
[7] H. Li, Y. Dai, and X. Lin, ‘‘Efficient e-health data release with consistency
the signature for the query (IDi , Mi ) as the real guarantee under differential privacy,’’ in Proc. 17th Int. Conf. E-Health
signer did in the real world. Netw., Appl. Services (HealthCom), 2016, pp. 602–608.
2) IDi = IDi∗ : in such case, if A’s query Mi 6 = [8] H. van der Linden, D. Kalra, A. Hasman, and J. Talmon, ‘‘Inter-
organizational future proof EHR systems: A review of the security and
Mi∗0 , it can compute the signature for the query privacy related issues,’’ Int. J. Med. Inform., vol. 78, no. 3, pp. 141–160,
(IDi∗ , Mi ) as δi = (ga )ki . If Mi = Mi∗0 , then C 2009.
cannot answer this query and thus has to abort [9] J. Kang, R. Yu, X. Huang, S. Maharjan, Y. Zhang, and E. Hossain,
‘‘Enabling localized peer-to-peer electricity trading among plug-in hybrid
the game. electric vehicles using consortium blockchains,’’ IEEE Trans. Ind. Infor-
• Forgery: A outputs a forgery (M ∗ , σ ∗ ) with identity mat., vol. 13, no. 6, pp. 3154–3164, Dec. 2017.
ID∗ . We assume that A wins the game, that is to say, [10] I. C. Lin and T. C. Liao, ‘‘A survey of blockchain security issues and
challenges,’’ Int. J. Netw. Secur., vol. 19, no. 5, pp. 653–659, 2017.
the forgery satisfies all of the following conditions: [11] H. Lin, J. Shao, C. Zhang, and Y. Fang, ‘‘CAM: Cloud-assisted privacy
1) Verify(ID∗ , M ∗ , σ ∗ ) = Accept; preserving mobile health monitoring,’’ IEEE Trans. Inf. Forensics Security,
2) i∗ 6 ∈ QM ; vol. 8, no. 6, pp. 985–997, Jun. 2013.
[12] M. Li, S. Yu, Y. Zheng, K. Ren, and W. Lou, ‘‘Scalable and secure
3) A does not make query for message Mi∗0 and iden- sharing of personal health records in cloud computing using attribute-
tity IDi∗ in the signing queries phase. based encryption,’’ IEEE Trans. Parallel Distrib. Syst., vol. 24, no. 1,
In addition, we assume that the advantage of A to win pp. 131–143, Jan. 2013.
[13] H. Li, Y. Yang, Y. Dai, S. Yu, and Y. Xiang, ‘‘Achieving secure and efficient
the above game is AdvUF−CMA MA−IBS,A (λ) = . According to dynamic searchable symmetric encryption over medical cloud data,’’ IEEE
the above proof, a successful simulation, denoted by E, Trans. Cloud Comput., to be published.
from C consists of three events: [14] A. Mehmood, I. Natgunanathan, Y. Xiang, H. Poston, and Y. Zhang,
‘‘Anonymous authentication scheme for smart cloud based healthcare
– E1 : in master secret key generation oracle, A does applications,’’ IEEE Access, vol. 6, pp. 33552–33567, 2018.
not query IDi∗ ’s master secret key. [15] S. Nakamoto. Bitcoin: A Peer-to-Peer Electronic Cash System. Accessed:
– E2 : in signing oracle, A does not query (IDi∗ , Mi∗0 )’s 2008. [Online]. Available: https://bitcoin.org/bitcoin.pdf
[16] U. Premarathne et al., ‘‘Hybrid cryptographic access control for cloud-
signature. based EHR systems,’’ IEEE Cloud Comput., vol. 3, no. 4, pp. 58–64,
– E3 : adversary A’s challenge identity is IDi∗ and Aug. 2016.
message is Mi∗0 . [17] D. Pointcheval and J. Stern, ‘‘Security arguments for digital signatures and
blind signatures,’’ J. Cryptol., vol. 13, no. 3, pp. 361–396, 2000.
A successful simulation, apparently, means that C can use [18] A. Shamir, ‘‘Identity-based cryptosystems and signature schemes,’’ in
A’s forgery to solve the CDH problem. In other words, Advances in Cryptology, vol. 1984. Springe, 1985, pp. 47–53.
the advantage of C to solve the CDH problem is AdvCDH A = [19] Standards for Privacy of Individually Identifiable Health Information:
Final Rule, Standard 45 CFR Parts 160 and 164, Dec. 2000.
Pr[E] = Pr[E1 ]·Pr[E2 ]·Pr[E3 ] since the three events are [20] Standard Specification for Continuity of Care Record (CCR), Standard
mutually independent. Therefore, the advantage of C to solve ASTM E2369, 2005.

41688 VOLUME 7, 2019

F. Tang et al.: Efficient Authentication Scheme for Blockchain-Based EHRs

[21] H. Wang and Y. Song, ‘‘Secure cloud-based EHR system using attribute- SHUAI MA received the B.S. degree from the
based cryptosystem and blockchain,’’ J. Med. Syst., vol. 42, no. 8, p. 152, Hunan University of Technology, in 2016. He is
2018. currently pursuing the master’s degree with the
[22] W. Xu, L. Wu, and Y. Yan, ‘‘Privacy-preserving scheme of electronic health Chongqing University of Posts and Telecommu-
records based on blockchain and homomorphic encryption,’’ J. Comput. nications. His present research interest includes
Res. Develop., vol. 55, no. 10, pp. 2233–2243, 2018. blockchain technology and its applications.
[23] P. Zhang, J. White, D. C. Schmidt, G. Lenz, and S. T. Rosenboloom,
‘‘FHIRChain: Applying blockchain to securely and scalably share clinical
data,’’ Comput. Structural Biotechnol. J., vol. 16, pp. 267–278, 2018.
[24] A. Roehrs, C. A. da Costa, and R. da Rosa Righi, ‘‘OmniPHR:
A distributed architecture model to integrate personal health records,’’
J. Biomed. Inform., vol. 71, pp. 70–81, Jul. 2017. YONG XIANG (SM’12) received the Ph.D. degree
[25] K. Seol, Y.-G. Kim, E. Lee, Y.-D. Seo, and D.-K. Baik, ‘‘Privacy-
in electrical and electronic engineering from The
preserving attribute-based access control model for XML-based electronic
University of Melbourne, Australia. He is cur-
health record system,’’ IEEE Access, vol. 6, pp. 9114–9128, 2018.
[26] Y. Sun, R. Zhang, X. Wang, K. Gao, and L. Liu, ‘‘A decentralizing attribute- rently a Professor with the School of Informa-
based signature for healthcare blockchain,’’ in Proc. IEEE 27th Int. Conf. tion Technology, Deakin University, Australia. His
Comput. Commun. Netw. (ICCCN), Jul./Aug. 2018, pp. 1–9. research interests include information security and
[27] A. A. Omar, M. S. Rahman, A. Basu, and S. Kiyomoto, ‘‘MediBchain: privacy, signal and image processing, data ana-
A blockchain based privacy preserving platform for healthcare data,’’ lytics and machine intelligence, the Internet of
in Proc. Int. Conf. Secur., Privacy Anonymity Comput., Commun. Storage. Things, and blockchain. He has published four
Cham, Switzerland: Springer, 2017, pp. 534–543. monographs, over 110 refereed journal articles,
and numerous conference papers in these areas. He has served as the Pro-
gram Chair, TPC Chair, Symposium Chair, and Session Chair for a number
of international conferences. He is an Associate Editor of the IEEE SIGNAL
PROCESSING LETTERS and the IEEE ACCESS.

CHANGLU LIN received the B.S. and M.S.

degrees in mathematics from Fujian Normal Uni-
versity, China, in 2002 and 2005, respectively,
and the Ph.D. degree in information security from
FEI TANG received the Ph.D. degree in infor- the State Key Laboratory of Information Secu-
mation security from the Institute of Informa- rity, Graduate University of Chinese Academy of
tion Engineering, Chinese Academy of Sciences, Sciences, China, in 2010. He is currently with
in 2015. He is currently an Associate Profes- the College of Mathematics and Informatics, and
sor with the Chongqing University of Posts the Fujian Provincial Key Laboratory of Network
and Telecommunications. His research interests Security and Cryptology, Fujian Normal Univer-
include public-key cryptography, and blockchain sity. He is interested in cryptography and network security, and has conducted
technology and their applications. research in diverse areas, including secret sharing, multi-party computation,
and public key cryptography and their applications.

VOLUME 7, 2019 41689