PPoS-EHR: Attribute-based Access to Encrypted Health Records via Blockchain

Abstract

Protecting privacy, availability, and security of Electronic Health Records (EHRs) is of utmost importance in the modern digital health industry. Traditional centralized storage system has been under increasing security threats like illegal access, data tampering, cyber-attack and single point of failure. To address these problems, we present in this work a new blockchain-based system which combines Token-Based Authentication and Permissioned Pure Proof-of-Stake (PPoS) consensus model. The architecture authenticates the identity of participants using Decentralized Identifiers (DIDs) and generates cryptographic tokens providing limited access to EHRs that expire over time. These tokens, together with encrypted metadata and access logs are written on a permissioned block chain to provide transparency, traceability and finegrained access control. For data privacy concern, the real health record is off-chained saved with encryption by the ChaCha20-Poly1305 algorithm. The PPoS enforced on Algorand blockchain, provides an efficient, green consensus for the authorized healthcare nodes. It is compliant with HIPAA and GDPR, has excellent audit features and provides a highly available, emergency override access.