Securing Medical Data Exchange: A Decentralized Approach Based on the e-IPGPChain Framework

Exchange Data over multiple entities has increased recently in different sectors, due to the high digitalization expansion over various industries including Education, Financial Services, Commerce, and Healthcare sector. Health services have increased recently due to the expansion of viral and chronic diseases which raise medical requirements [1]. However, the Traditional e-health smart systems are revolutionizing the healthcare industry by providing medical services closer to end users based on multiple typical layers such as Edge Computing, Internet of Medical Things “IoMT” and Cloud computing technologies [1], which aim to manage medical records that are commonly known as Electronic Health Records “EHR”. The exponential increase of data over time puts an overload to the cloud networks for processing and storing data as well as difficult accessibility for various stakeholders, this results in serious performance, security, and privacy challenges due to its limited centralized built-in structure.

Indeed, the advancement skills of cyberattacks directly affect users’ personal medical data confidentiality. In fact, between 2009 and 2023, more than 5150 data breaches were reported to the U.S. Department of Health and Human Services Office for Civil Rights (OCR) [2] the occurred breaches resulted in an exposure of 382,262,109 healthcare records which represent 1.2x the population of the United States. According to Fortified Health Security’s report, the first half of 2023 indicated 295 breaches that impacted more than 36 million individuals [3], which led to increased data leakage, reputational and financial losses, and patient personal safety risks.

Based on the above occurrences, existing health monitoring systems become securely unsafe, lack privacy, and significantly degrade of quality of services [4] due to their network structure and insufficient security measures. This paved the way to adopt a decentralized approach for data storing and sharing services across multiple entities [5], such as Blockchain technology and distributed peer-to-peer (p2p) storage networks. Up to this point, the conventional systems revealed serious challenges in terms of confidentiality, Privacy, Availability, and Integrity related to sharing and storing personal medical data (EHR). Communicating data over the network uncovered the system’s component to several threats that can intensify into serious risks, such as the recent ransomware attacks [6]. Also, medical data grows intensively thanks to the IoMT devices, which offload the current system and reveal significant performance, availability, and security challenges detailed in the following main points:

Secure sharing workflow: the basic structure of healthcare monitoring systems exposes serious security risks due to the variety of deployed components. Additionally, limited access control policies and a lack of encryption techniques can make this environment susceptible to advanced cyberattacks, which can potentially affect users’ safety.

High availability: Health monitoring is an essential part of preventive care nowadays, particularly in case of emergency activities where the importance of the ability to access data for authorized entities at any time and from any place, while this is not properly satisfied on current approaches.

Data Integrity: Although existing healthcare monitoring systems have great features, they do not provide an efficient way to store, share, and verify health data ownership in a globally unified manner [7].

Bandwidth and Storage efficiency: The exponential increase of collected data places a heavy burden on the network resources, which affects the latency and storing capabilities to access medical data for actual structures.

Consistent data source: Ignoring signing data techniques leads to significant problems related to data tampering, Forgery, and Repudiation, which results in untrusted data exchange flow.

Deployment of emergent technologies helps to accomplish the objective of this paper to establish a fully secure decentralized e-health monitoring system, designed to address the common limitations listed above, the proposed solution, e-IPGPChain, integrates different technologies to overcome the existent solutions in terms of performance, security, and privacy measures across different stages. However, the use of the GPG-based Edwards-curve Digital Signature Algorithm “edDSA” employs keys shared features across the network to enable end-to-end encryption and digitally sign encrypted data, for effective confidentiality, integrity, and non-repudiation of collected data [8, 9], this technique enhances the trustworthiness of the data source, improves resource efficiency, and contributes to securing the overall data-sharing model.

Meanwhile, sharing data across multi-authorized participants involved the deployment of a private blockchain network leveraging the Hyperledger Fabric project based on RBAC (Role Based Access Control) policies, leveraging a logical workflow process ensured by specific developed Chaincode that contain a set of procedures to standardize sharing data over the blockchain network to the corresponding requester as listed from the work [10], in addition to using a private channel mechanism for extra access protection in a full collaborative medical environment. Therefore, the trend of preserving high data availability for the healthcare sector is important during monitoring phases, due to the critical medical information in case of emergencies also to provide a consistent data accessibility experience. Hence, the integration of IPFS along with the Edge Computing technology in our proposed approach provides an extra hybrid storing feature for medical data realizing the availability requirement as well as operating seamlessly with other components such as GPG-edDSA technique and Blockchain network for efficient and secure workflow as indicated and analyzed through a series of test cases focused on main e-health features. Furthermore, the STRIDE threat model was exploited to comprehensively evaluate the overall system from security and privacy perspectives which lead to identifying the security risks and their corresponding implemented mitigations.

In the remaining parts of this paper, Section 2 outlines the related works characterized by some limitations from existing contributions, while Section 3 unveils fundamental system notions to comprehend the overall proposed structure. Section 4 describes the deployment of the proposed e-IPGPChain. Section 5 discusses the evaluation outcomes in comparison to the current solutions and provides a comprehensive security analysis. This paper will highlight the main contribution and purposes in the last section while providing future perspectives for further contributions.

In this section, we will discuss the main technologies and approaches that have been employed in our proposed system to ensure a secure, performant, and private collaborating environment to share large amounts of medical data with external stakeholders, while still retaining full control over access and ensuring the total integrity of the exchanged data amongst all network stages.

3.1 Hyperledger Fabric (permissioned blockchain)

Hyperledger Fabric is a Private type of Blockchain technology, in 2015, the Linux Foundation initiated this framework which frequently has been used in various areas like finance, healthcare, supply chain, and manufacturing to build a standardized blockchain framework for business workflow [21]. This Permissioned network is based on a modular structure that offers exceptional identity management and access control features, in addition to providing a secure architecture based on a channel mechanism, making it appropriate for our framework e-IPGPChain to empower the secure sharing network of medical data across various authorized participants.

The Hyperledger Fabric technology is characterized by the following key features:

• Distributed Digital Ledger: maintains a shared, tamper-resistant ledger across multiple nodes [21].
• Smart Contract: also known as Chaincode for Hyperledger Fabric technology, defined to model the business logic that governs the behavior of the network.
• Permissioned Network: The ability to enable authorized members to access and control transactions over the network.
• Private Channels Technique: Provides an approach for nodes to collaborate privately and isolate traffic from non-authorized nodes, thereby offering transaction confidentiality.
• Consensus Algorithm: Ensure the validity of transactions over the network, Hyperledger technology uses several consensus mechanisms such as practical Byzantine Fault Tolerance (PBFT) and more.
• Membership Service Provider (MSP): Responsible for designing permissions, roles, and attributes for different network members that have been enabled from the Certificate Authority (CA) node.
• Modular Architecture: Allows the efficiency of personalization and integration with the existing systems and infrastructures.

Moreover, the Role-based Access Control (RBAC) related Chaincode scripting technique empowers network accessibility. It becomes more efficient by defining members’ roles and their assigned responsibilities and permissions [22] this is conducted to normalize the functional logic of grant access and perform certain operations in the Blockchain network. By integrating into the network, each member of the framework executes several phases, starting with establishing connectivity access. Therefore, the user submits a transaction proposal to the endorsing peers. Next, the endorsing peers simulate the transaction and return the endorsement results to the user, who then collects these endorsements and sends the transaction to the ordering service for building into a block, which is then broadcasted to all peers to be stored in their attached decentralized ledgers [5].

3.2 Peer-to-peer file management system (IPFS)

Distributed Storage is an advanced technology that provides a novel approach to enhancing digital storage capability and facilitating management and accessibility for individuals and businesses. For instance, IPFS [23] is an emergent technology that enables users to securely and efficiently store and share data without the need for central management entities. Thereby, it is characterized by its distributed structure based on peer-to-peer connectivity and content addressing mechanism, to identify the stored data and files on the overall network using a unique Content Identifier (CID) [24]. In addition, the IPFS structure is based on four main mechanisms for managing content known as Distributed Hash Table (DHT), Merkle DAG, Bitswap Protocol, and Self-Certifying File Systems (SFS) to store and retrieve files effectively, hence, ensuring data availability and increasing the redundancy, throughput, performance, and security [25].

Managing sensitive data over the IPFS includes using immutability, hashing, and content-addressing techniques to improve the storage capability of our solution alongside Edge Computing resources that complement the process. Data storage on an off-chain technology requires each user to be attached to the IPFS network, while the overall workflow started by splitting data into several fragments on multiple network peers to achieve the distributed approach, each with 256Kb maximum size, stored in an object format, that will be assembled into a Merkle DAG structure, a tree format topology, where the access to data is governed by a root hash ID that will be shared by the data owner for further phases [26]. This technology is intended to overcome the conventional client-server architecture by offering a more reliable, efficient, and secure method of preserving data along with advanced technologies to ensure a high continuity of exchanging critical data as employed for our proposed e-health system.

3.3 Encryption, decryption, and digital signature processes leveraging Edge Computing technology

In order to ensure data confidentiality and protect private information from unauthorized access and manipulation, encryption comes over to encipher data from its readable state using relevant algorithms. Therefore, the digital signature is a technique that uses mathematical algorithms to guarantee the Authentication, Integrity, and Non-repudiation of a series of data by attaching a distinctive signature to identify the source of data to contribute to enhancing the trustworthiness of data delivery [27]. The integration of the signature mechanism required the use of a lightweight tool combining both encryption and digital signature features.

Therefore, Pretty Good Privacy (PGP) [28] is an applicable tool that serves for encryption, decryption, compression, and digital signature of files and messages. It was created by Phil Zimmermann in 1991 and provides data confidentiality, integrity, and authentication by combining multi-cryptography techniques. GnuPG (GNU Privacy Guard or GPG) [29] is an open-source solution for PGP characterized by the same sequence logic of generation of the pair keys (Public/Private) assigned for each user which is adopted for the main cryptography operations of the proposed system. The public key is shared securely with corresponding members on the network, while the private one is kept secret. Each user employs its user-specific key directories, which represent a separate password-protected directory within the edge device's filesystem to store each user's GPG keys. This ensures that private keys remain isolated and protected from access by unauthorized entities.

Edge Computing is considered a closer resource gateway to the end user [1], which offers low latency, storage, and computing resources. This technology is exploited to enable the cryptographic tool GPG for conducting data processing operations, based on various supported cryptographic mechanisms and algorithms as listed in the Table 2. Accordingly, the adoption of the edDSA algorithm [30], particularly the ed25519 implementation scheme which uses SHA-512 (SHA-2 family of hash function), and Curve25519 make it suitable for our framework implementation due to its strong security and faster ability to provide further protection against tampering and forgery threats. The combination GPG-edDSA uses the cryptosystem mechanism based on ed25519, and AES schemes, for encryption, decryption, digital signature, and compression processes. Generated key pairs are engaged for ensuring the preprocessing of data by using the sender’s private key and the corresponding receiver's public key. This guarantees accurate data verification and secure decryption.

Table 2. GPG supported encryptions and signature algorithms [29]

This part of the paper represents our technical prototype that describes the proposed decentralized model e-IPGPChain, which practically discloses the procedures described in the sequence diagram above. This implantation demonstrates the integration of the proposed technologies that work in a collaborative environment to deliver high-quality and secure medical services. However, evaluating the e-IPGPChain model at the end of this section indicates the compelling advantages of adopting such a solution, from both performance and security aspects, while maintaining an open research perspective for further development.

5.1 Deployment strategy and configuration

The practical deployment of the proposed e-IPGPChain model relies on a combination of two Virtual machines, a physical computer, and different toolkits, as illustrated in Table 4 below. The Blockchain network was formed of one organization, four peers, and a unique Certificate Authority (CA) node leveraging the private features of the Hyperledger Fabric solution. The choice of this configuration is based on the tradeoff between Latency, Security, and Cost efficiency. Furthermore, the overall network makes use of software development and deployment tools including Docker, SDK tools, and others, contributing to building a robust blockchain network that embeds the attributes of Chaincodes, Channels, consensus algorithms, and Membership Service Providers, the entire network process is assisted by one VM to play the link role between the solution members.

The distributed storage is handled by IPFS on two designed machines to perform the sending and retrieving activities. Moreover, the network is characterized by: Patients, and Healthcare providers, using both physical and virtual machines, respectively. Therefore, preparing collected data requires the use of several toolkits, including Fabric SDK, IPFS client command lines, and the GPG-edDSA cryptographic tool. Each Patient profile integrates the edge devices using a unique session authentication mechanism characterized by a login and password, to enable the patient-personal directory where the corresponding private key and encrypted medical data are stored. However, The Fabric SDK [34] plays an essential role in creating end applications for executing authorized transactions over the blockchain network by leveraging some defined libraries such as the case for our framework, NodeJS. As a result, the final picture of the deployment strategy resides in making separate machines, A Physical one represents the Patient edge while a virtual machine depicts the healthcare provider edge zone, both machines integrate the Hyperledger Fabric network performed as a separate Virtual machine that ensures a secure link for sharing the CID of medical data in a protected collaborative environment.

Table 4. Technical deployment characteristics

5.2 E-IPGPChain comprehensive use cases

The proposed model relies on several scenarios to reveal the designed access control and cryptographic attributes to establish a resilient and safe sharing environment of medical records, considering security and accessibility approaches:

• Scenario 1: Demonstrates role-based access control (RBAC), by showing a patient, with either a valid or invalid assigned role trying to submit a data identifier (CID) within the Blockchain Network. Starting with registering and assigning roles procedures. In case a patient without a validated role sends the CID on the network peers return as an invalid operation, referring to RBAC policy Failure permission. Conversely, if the Patient with the convenient admin role, the network successfully validates and transmits the transaction CID within the peer's ledgers, the process results are illustrated in Figure 3 and Figure 4.

3.png

Figure 3. Failed submission transactions – patient side

4.png

Figure 4. Successful processed transactions - patient side

• Scenario 2: Illustrates the process for doctors retrieving data based on their permissions. Doctors have two permission types Granted or Denied, to retrieve the CID from the Blockchain network. For the granted decision, with the user's appropriate role, this enable him to retrieve data and proceed with the decryption steps seamlessly, while the access is rejected to retrieve data for unauthorized reasons from the network as depicted from the Figures 5 and 6 below.

5.png

Figure 5. Unauthorized access to data within the blockchain - doctor side

6.png

Figure 6. Allowed retrieve transaction of data's CID from the blockchain ledgers - doctor side

• Scenario 3: Covers data signature verification, ensuring that only valid, authenticated data is processed. Data after being encrypted, signed, and uploaded to IPFS. The requester can successfully verify and confirm the source of data as seen from Figure 7 and then proceed with the decryption and decompression steps through an exchanged key-based encryption mechanism. Otherwise, the Not verified status causes untrusted data as depicted in Figure 8, hence a failed decryption as a result.

7.png

Figure 7. Matched signature and successful decryption procedures

8.png

Figure 8. Failed verification and decryption procedures

5.3 Performance-driven evaluation related to e-IPGPChain

We enabled an effective evaluation for e-IPGPChain to verify the performance ability of different deployed technologies from multiple perspectives including Latency, Scalability, Storage efficiency, and benchmarking data process. The Hyperledger Foundation community [35] recommend several projects for decentralized projects, where Hyperledger caliper is a part of it. This solution is used to measure the performance of various types of Blockchain network technologies using many pre-build configurations [36]. Consequently, related to our deployment strategy we used this benchmarking tool to evaluate the performance of the system based on numerous indicators such as Throughput TPS (Transaction per second), Transaction latency, and resource utilization. In our case, conducting the system evaluation requires various benchmarking configurations, as highlighted in the following points:

• Latency: Denotes the complete time elapsed by a transaction from initiation to response [37].

• Implementation setup: our analysis of the Latency of incorporating sending Transactions at various durations, starting with 60, 120, 180, 240, 300, 360, 420, 480, 540, and 600 seconds, which provide insight into the system response capability at high load during scenarios case.
• Result Discussion: Figure 9 below reveals important metrics results related to the latency analytics. During all defined periods, the maximum latency achieved by transactions workload seems optimal regardless of the increase in transactions over time for an e-health system to deliver medical services at acceptable levels.

• Scalability: Assess the system’s capacity to effectively manage the intensive increase of data and users, particularly in the case of integrating IoMT technology while guaranteeing efficient service delivery [15].

• Implementation setup: we arranged the system to accommodate an increased number of transactions starting with 500 transactions, ending with 10000 Transactions submitted to the network at a linear rate starting with 15 Tps and finishing the process with 75 Tps. This use case incorporates the execution of three workers simultaneously. Therefore, another test scenario was performed to assess the system’s ability on multiple structure implementations, using a regular number of transactions of 2000 at a fixed throughput of 50 Tps, to experiment with the scalability of our framework in case of further extended deployment.

9.png

Figure 9. Latency evaluation with a related number of transactions over defined periods

• Results discussion: After conducting several benchmarking rounds, as previously detailed, the system still preserves optimal resource operation as indicated by the Figure 10 below at the increased workload. On the other side, sending the same quantity of transactions to different implemented structures reveals efficient output results, where the throughput preserves an admissible rate, that is realized in ten peer networks, 31.4 Transaction per second as shown from the Figure 11, while the average latency depicts reasonable results varying between 5.45 ms to 16.56 ms for a structure with 10 peers where the ideal response time for the health sector should be less than 200 ms to provide real-time medical services [38]. Consequently, the e-IPGPChain solution responds to the current and future growth of data volume which makes it a scalable structure for healthcare delivery services.

10.png

Figure 10. Blockchain efficiency with exponential increase of transaction numbers

• Storage efficiency: Maintain an optimal use of the system’s storage resources, resulting in consistent and extended access to medical data.

• Implementation setup and discussion: Adopting the Hybrid storage model incorporates Edge Computing and IPFS to help balance the storage resources, while including the GPG-related compression algorithms to reduce the size of collected data depending on various factors such as the type of data being compressed, the compression algorithm used, and the compression level specified [29].

11.png

Figure 11. Exploring latency and throughput evaluation with varying numbers of blockchain network peers

12.png

Figure 12. Medical data total time processing evaluations

• Data Process Evaluation: Managing related Data is the most important step to deliver secure healthcare services within optimal resource utilization, including encryption, digital signature, and verification.

• Implementation setup: The effectiveness of the cryptographic tool, GPG-edDSA is evident through a series of benchmarking tests targeting the total execution time of the Encryption and Signature procedures, in addition to the decryption and verification total process time. By leveraging performance evaluation tools to assess the processing time for different file sizes to conduct the cryptographic operations, the objective is to demonstrate the efficiency of the adopted solution algorithm.
• Results discussion: The results analysis from the figures below highlights the efficiency of the GPG-edDSA scheme over the widely used mechanisms including GPG-RSA and GPG-ECDSA by performing test cases using different file sizes. The time taken in data encryption and signature seems equitable with a small positive outperforming for GPG-edDSA, while for decryption and verification processes, the proposed tool proves how efficient and faster compared to others. The obtained results seen from Figure 12, contribute to the overall performance system and even enhance security and privacy with the latest advanced techniques.

5.4 Security assessment

5.4.1 Threat model-based STRIDE

Security Threat modeling is a technique to evaluate the system’s security aspect and help to reinforce the overall components from multiple threats' impact. Among all the modeling options, the Open Web Application Security Project (OWASP) provides an open-source tool used to indicate possible threats and select related countermeasures following visual model illustration and based on standard threat frameworks including STRIDE, LINDDUN, CIA, as described in Table 5 [39] playing an important role in classifying the risks and applying the countermeasures.

Table 5. OWASP threat frameworks overview

13.png

Figure 13. Threat model representation related to e-IPGPChain solution

To analyze our proposed solution, we employ the OWASP threat dragon tool. The process involves the contribution of multiple mechanisms encompassing the complete system’s components. Figure 13 describe the threat model following the STRIDE framework, demonstrating how the basic network structure can face multiple threats that impact the normal process of the healthcare monitoring system. However, the proposed e-IPGPChain came over to mitigate the uncovered threats according to the STRIDE standard focused on particular sections to address main security and privacy challenges related to medical data sharing workflow.

Following the deployment strategy, the threat model involves:

- Actors: Identifies the main system contributors as listed:

• Patients: Assigned to produce and handle medical data, responsible for storing and manipulating personal data.
• Healthcare Providers: Includes main health stakeholders authorized to access medical data, the scope of their roles defined based on the mission category they undertake.

• Assets:

• Medical Data: Represented as a sensitive vital sign indicator measuring patient health conditions.
• Patient Privacy: Identify the private attributes related to patients including personal information.
• System, data availability: Determines the system resiliency and accessibility under all consequences.
• Data Integrity: Preserving data unchanged along the sharing process with different stakeholders.
• User Accessibility: Describes the process of accessing systems and services with security directive mechanisms.

- Adversaries:

• Outside Threats: Represent health organizations, external users, and Individual cybercriminals. Inside Threats: These involve authorized users within the system who may have been compromised.
• Malicious campaigns: External network Ver/Viruses, System Bugs, vulnerable system components.

- Identifiable threats: According to the security STRIDE framework, it is possible to identify the potential threats that may affect the system's efficiency and privacy as resumed in the Table 6 above. The identification of threats based on the current Cybercriminal effects.

- Mitigation strategies: the emergent technologies implemented in e-IPGPChain solution can effectively mitigate various security and privacy issues for sharing medical data process. The deployed techniques can reduce the threats occurring as seen from Table 6.

1. Cyber risk evaluations

The integration of various technologies and external stakeholders exposed the system architecture and personal data to critical potential Cyber-attacks and security threats. Building the system model based on threat modeling approaches helps to minimize the security risk to systems by identifying the weak points simulated within a particular technology. Nowadays, Medical data is increasingly targeted by several cyber-criminal organizations [40], in order to violate the trust and patient privacy, financial fraud, disrupting clinical services and social impacts. Our proposed framework work was evaluated based on these common potential attack vectors:

- Man-in-the-middle attack:

The attacker tries to find a way between the data owner and the authorized requester to manipulate content for tampering and fraud. Our proposed framework employs robust authentication and authorization mechanisms using paired cryptographic keys exchanged safely through blockchain network based RBAC policies to successfully ensure data encryption and digital signature.

As a sample of the basic transaction of sending data between Patient X and Healthcare Provider Y. In advance, X uses Y’s public key to encrypt and digitally sign data eq (4). Y after receiving CID based on matched Role within the network, can retrieve data and uses X’s Public key to verify data and decrypt based on eq (9), (5). As a result, the attacker is unable to share public keys referring to strongly defined access control even if it prevents data decryption due to an incorrect private key.

- Distributed denial of service:

Adversaries attempt to make interesting services difficult or unable to access, by dumping the target systems such as edge devices, IPFS, and Blockchain networks with excessive requests, disrupting the availability of healthcare monitoring systems.

The scalable structure, duplicated network peers, and redundancy storage capability of our proposed solution can reduce DDoS impacts and continue the accessibility to medical data in critical situations, as demonstrated in the performance evaluation section with stressed test cases, the system still delivers full functionality with the best latency rate.

Table 6. e-IPGPChain security evaluation-based STRIDE Threat model related corresponding mitigations

- Replay attack:

An attacker can intercept and replay messages, which can pretend to be a legitimate user to other parties. In our scheme, a unique ID mechanism is attached for each transaction which can prevent such attacks.

For example, when a patient wants to send a transaction, each data has a unique <cid> that is attached to an incremental id index, as these IDs can be ordered to prevent misrepresentation of the transaction order. The recipient can verify the CID and check the incremental ID to ensure the transaction order is correct. This prevents replay attacks, as the attacker cannot reuse old CIDs due to the sequential ID index.

- Key management vulnerabilities:

The cryptographic key management process can be targeted by attackers to attempt to collect sensitive user keys for unauthorized access to manage paired keys.

Our approach establishes personal directories with secret GnuPG folders, as an example for Patient X, ~/.gnupg/private $-$ keys $-$v 1.d, where keys are safely stored. Additionally, the public key generation and encryption processes are ensured by the concerned owner, who is required to provide a predefined passphrase for each action. As a result, access control solutions for edge and blockchain technologies make it difficult for malicious actors to gain access and tamper with the protected key directories.