Cross-organisation data sharing is challenging because all the involved organisations must agree on ‘how’ and ‘why’ the data is processed. Due to a lack of transparency, the organisations need to trust that others comply with the agreements and regulations. We propose to exploit blockchain and smart contracts technologies to define an Attribute-Based Access Control System for cross-organisation medical records sharing, coined SmartAccess. SmartAccess offers joint agreement over access policies and dynamic access control besides blockchain transparency and auditability. We leverage the Attribute-Based Access Control model to implement smart contracts. We deploy and test them on a private and permissioned blockchain, transforming the access control process into a distributed smart contract execution. This paper proposes the SmartAccess system and its application in two healthcare use cases. We introduce the threat model and perform a security analysis of the system. To demonstrate the feasibility of our proposal, we implement a proof-of-concept of the smart contracts, written in Solidity language, with a size-efficient policy representation, and analyse the complexity and scalability of the contracts’ functions. Furthermore, we present performance results, measuring the latency and throughput of the transactions to execute the access control functions with different blockchain network consensus setups. We also compare the performance of the SmartAccess system against two open-source Solidity implementations of smart contract-based access control, Role-based Access Control and Access Control List. Finally, we discuss the strengths and drawbacks of our proposal. SmartAccess requires the overhead of a decentralised system, but the trade-off is transparency, regulation compliance and auditability for complex cross-organisation data sharing.@en

Research data sharing requires provision of adequate security. The requirements for data privacy are extremely demanding for medical data that is reused for research purposes. To address these requirements, the research institutions must implement adequate security measurements, and this demands large effort and costs to do it properly. The usage of adequate access controls and data encryption are key approaches to effectively protect research data confidentiality; however, the management of the encryption keys is challenging. There are novel mechanisms that can be explored for managing access to the encryption keys and encrypted files. These mechanisms guarantee that data are accessed by authorised users and that auditing is possible. In this paper we explore these mechanisms to implement a secure research medical data sharing system. In the proposed system, the research data are stored on a secure cloud system. The data are partitioned into subsets, each one encrypted with a unique key. After the authorisation process, researchers are given rights to use one or more of the keys and to selectively access and decrypt parts of the dataset. Our proposed solution offers automated fine-grain access control to research data, saving time and work usually made manually. Moreover, it maximises and fortifies users' trust in data sharing through secure clouds solutions. We present an initial evaluation and conclude with a discussion about the limitations, open research questions and future work around this challenging topic.

@en

For cross-sectoral sharing of health data, cloud services provide benefits regarding the availability of relevant information in critical situations. Nevertheless, storing electronic health records in the cloud may impact patient's privacy, since the cloud service provider might lack trustworthiness. Client-side cryptography mitigates the privacy risk by encrypting data in the user's computational environment before transmitting them to the cloud. However, client-side cryptography raises performance concerns. This paper investigates Web Assembly and JavaScript solutions that enable client-side cryptography in web applications and compares their performance against server-side cryptography. We contextualize the study within two healthcare web applications: a prototype for patient record sharing during acute stroke care and an application for sharing data in sleep medicine treatment. Our results show that JavaScript and Web Assembly libraries add more time to encryption and decryption than server-side cryptography. However, due to the concurrency introduced by simultaneous users, the performance of server-side cryptography is worse than client-side, taking longer times to attend to the demand and requiring a larger infrastructure to be effective. Moreover, the JavaScript library asmCrypto and Web Assembly approaches perform better than other libraries and are feasible candidates for application development.@en

Acute stroke care demands fast procedures and collaboration of different healthcare organisations and professionals. The development of cloud computing and the wide adoption of electronic health records (EHR) foster healthcare systems to improve data availability and potentially enhance acute-stroke care quality. However, the design of a secure and privacy-preserving EHR cloud-based application is challenging. This paper presents the leading security and privacy requirements for healthcare applications and contextualises each requirement in the acute stroke care use case. Moreover, we deploy the ASCLEPIOS eHealth Cloud-based framework to address each requirement in designing an EHR cloud-based application for data sharing during acute stroke care. Our initial prototype combines the ASCLEPIOS framework with a public cloud service infrastructure and a private signature scheme. The prototype meets the security and privacy requirements since it protects the EHR data against unauthorised access, data breaches, and data exposure on public cloud providers. Moreover, we present preliminary results and discussions about the usability and overhead of the ASCLEPIOS framework. @en

Electronic medical records (EMRs) are highly sensitive information shared among peers to keep up-to-date patient history. Providing security, privacy, and availability to these sensitive data is a challenge because, typically, after data publication the patient loses control over them. In this paper, we propose a blockchain-based approach to secure EMR for healthcare applications, where access control is patient-centric. Our proposal keeps encrypted EMRs in the blockchain, and the patient shares the decryption key only with healthcare professionals in which he/she trusts. Blockchain allows untrusted node, in a distributed peer-to-peer network to correctly and verifiably interact with each other, without any reliable intermediary. We investigate the scalability of our approach through simulations. Results show that it scales well since increasing the number of nodes in the network implies a linear increase in the size of the stored chain. Results also reveal that the time for inserting a new EMR in the blockchain remains low even when the number of nodes in the network increases.@en