User-Centric and Privacy-Preserving Attribute-Based Authentication in Healthcare Systems Leveraging zk-SNARKs and Soulbound Tokens

Abstract

Digital health services for disease diagnosis, followup, and patient empowerment manage data that belongs to a special class of personal information, according to the General Data Protection Regulation (GDPR). For this reason, user authentication and access control are among the key security measures suggested for their protection. However, in the medical context, it is crucial to balance security and privacy support with timeliness and ease of access, which requires innovative solutions. This manuscript introduces an innovative approach leveraging Soulbound Tokens (SBTs) and Zero-Knowledge Proofs (ZKPs), particularly zk-SNARKs, to provide a privacy-aware mechanism for patient authentication in the medical domain. SBTs are utilized within an Attribute-Based Access Control (ABAC) model, ensuring that only eligible patients can access specific medical treatments. In a treatment-specific model, an SBT is issued for each diagnosis, allowing precise control but increasing management complexity. Alternatively, in a diagnosis-categorybased model, SBTs are grouped by diagnostic categories. This reduces the number of tokens and optimizes the space in the patient's wallet but sacrifices some precision in the information. Results demonstrate the timeliness of the proposed approach, with an average time of 6.82s for the release of an SBT and a maximum on-chain verification time of 15.04ms, showcasing their future adoption in a real-time environment, such as the medical context.