Role‐based and time‐bound access and management of EHR data

Abstract

Security and privacy are widely recognized as important requirements for access and management of electronic health record (EHR) data. In this paper, we argue that EHR data need to be managed with customizable access control in both spatial and temporal dimensions. We present a role‐based and time‐bound access control (RBTBAC) model that provides more flexibility in both roles (spatial capability) and time (temporal capability) dimensions to control the access of sensitive data. Through algorithmic combination of role‐based access control and time‐bound key management, our RBTBAC model has two salient features. First, we have developed a privacy‐aware and dynamic key structure for role‐based privacy aware access and management of EHR data, focusing on the consistency of access authorization (including data and time interval) with the activated role of user. In addition to role‐based access, a path‐invisible EHR structure is built for preserving privacy of patients. Second, we have employed a time tree method for generating time granule values, offering fine granularity of time‐bound access authorization and control. Our initial experimental results show that tree‐like time structure can improve the performance of the key management scheme significantly, and RBTBAC model is more suitable than existing solutions for EHR data management because it offers high‐efficiency and better security and privacy. Copyright © 2013 John Wiley & Sons, Ltd.

Security and privacy preserving approaches in the eHealth clouds with disaster recovery plan

“…Another approach presented by Zhang et al [24] is a timebased approach. The approach is efficient in ensuring the privacy of the EHRs at the cloud storage and enhances the operation of key distribution between trusted parties.…”

A Comprehensive Survey and Analysis on Access Control Schemes in Cloud Environment

“…A role based access control system called RBTBAC (Role Based Time Bound Access Control) model is proposed for electronic health record datasets [33]. Every user has some role, which could be that of a doctor, patient or staff.…”

Security Model for Preserving Privacy over Encrypted Cloud Computing

“…Furthermore, the next important issue regarding the encryption as well as access control is known as key management as the mechanisms used for key management mechanisms may provide good access control to the data that are being outsourced on CSPs [4]. There are many methods suggested for exploiting the hierarchical together with other relationships taking place among several items of data so as to minimize the number of distributed keys and make key management more simple [4] [5] [7] [8] [11].…”

“…There are many methods suggested for exploiting the hierarchical together with other relationships taking place among several items of data so as to minimize the number of distributed keys and make key management more simple [4] [5] [7] [8] [11]. In other words, in the event of changing access control policies for these methods or approaches, the key distribution should be carried out once again in order to ascertain that authorized users are only allowed to access.…”

“…Several methods are mainly proposing to provide a precise protection of data privacy upon outsourcing storage on the Cloud Server Provider (CSP) [4]- [9] [11] [12] [13]. These methods use certain cryptographic mechanisms so as to enhance the policies used for access control.…”