Privacy-Preserving and Scalable Electronic Health Record Management Using Multi-Layer Merkle Trees and Zero-Knowledge Proofs

Abstract

The secure management of Electronic Health Records (EHRs) in a cloud environment poses many challenges, and guaranteeing the scalability of a secure solution to manage the huge amounts of data and its privacy remains an open problem. Although the existing encryption methods offer strong security, the widespread adoption of asymmetric-key protocols is limited because of the lack of computational efficiency compared with practical applications. That is, the efficiency of computational time required for an encryption or decryption step, and the privacy-preserving verification of the computation result, are not balanced due to the volume of the data. In order to overcome the drawbacks of existing encryption methods, we propose a novel approach to integrating Zero-Knowledge Proofs (ZKPs) with a Multi-Layer Merkle Tree (MLMT) to achieve a scalable, privacy-preserving, guarantee-of-integrity and publicly-verifiable solution for managing the EHR while ensuring patients’ privacy. It proposes the utilization of MLMT to build a hierarchical data verification structure for massive data, significantly improving the computational efficiency. It also employs ZKP to enable verifier to verify the validity of data without revealing any record information, which is vital for the data management in the healthcare sector. The authors compared the proposed model with existing approaches which adopt AES-256 encryption and typical Merkle Tree-based solutions and demonstrate its superior scalability and privacy-preserving ability while ensuring controllable computational overhead. The results demonstrate that ML MMT ZKP provides the best balance between privacy, integrity and scalability reaching lower overheads and shorter verification times than other traditional approaches. This work constitutes a step forward in the development of cryptographic solutions for EHRs and provides a framework for real-time verifiable information in the healthcare domain.