Empowering Patients: A Blockchain Framework for Decentralized Healthcare Access Control

TL;DR

In a world where medical data is often locked in centralized silos, this paper introduces a decentralized framework using Ethereum smart contracts and Cloud storage. It gives patients total control over their Electronic Medical Records (EMRs) while ensuring that IoT healthcare devices can securely and efficiently share data with authorized hospitals without relying on a central authority.

The Problem: Centralization and the "Single Point of Failure"

In current smart healthcare setups, your medical history is usually stored in a centralized cloud managed by a single provider or a specific hospital. This has two massive downsides:

1. Security Risk: A single breach at the provider level exposes all patient data.
2. Lack of Ownership: Patients lose track of who accesses their sensitive EMRs and cannot easily revoke access once granted.

While blockchain is a natural fix for decentralization, it has a storage bottleneck. Storing massive EMR files directly on a blockchain is prohibitively expensive and slow.

Methodology: The Hybrid On-Chain/Off-Chain Architecture

The researchers propose a "Best of Both Worlds" approach:

• Off-Chain (Cloud): The actual EMR files are encrypted using Elliptic Curve Cryptography (ECC) and stored in the cloud.
• On-Chain (Blockchain): Only the reference hashes and access policies are stored on the Ethereum ledger.

The Four-Contract Security Guard

The system's heart consists of four specialized smart contracts:

1. Validation Contract (VC): Verifies the identity of users and hospitals.
2. GetAccess Contract (GAC): Matches requests against patient-defined agreement policies.
3. Grant Contract (GC): The "judge" that monitors for misconduct and issues temporary access tokens.
4. Revoke Contract (RC): Automatically terminates access if the time limit expires or if a user tries to "spam" the system with requests.

Figure 1: The overall architecture connecting Hospitals, Patients, and IoT devices via Blockchain and Cloud.

Why This Method Works: The Mathematical Shield

The authors didn't just use standard encryption; they employed Edwards-curve Digital Signature Algorithm (EdDSA) for authenticity and a dynamic penalty function.

If an entity makes too many frequent requests (more than the threshold within a minGap), the Grant Contract calculates a penalty "fine" (blocked time) using the formula: $extfine=(extbase{)}^n$ where $n$ is the number of prior misconducts. This exponential backoff effectively neutralizes brute-force access attempts.

Experimental Performance

The system was tested using a private Ethereum network across multiple devices (Lenovo/HP work-stations).

Key Metrics:

• Gas Consumption: Deploying the full suite of contracts costs roughly 5.7 million gas—a manageable figure for private or consortium chains.
• Computational Latency: As shown in the graphs, encryption and decryption times scale linearly with file size, ensuring that even large imaging files can be handled efficiently.
• Response Time: The "Access-request Response" latency remains superior to previous SOTA benchmarks like Medshare or HealthChain.

Figure 2: Deployment and execution latency vs. Number of Users.

Critical Insight & Future Outlook

The most impressive part of this work is the Access Revocation mechanism. Most blockchain systems struggle to "take back" data once shared. By using ephemeral (temporary) keys generated via ECDH, this framework ensures that even if a hospital has the file, they lose the ability to decrypt it once the smart contract-defined duration expires.

Limitations: The system still relies on a Cloud server for initial credential authentication. Integrating Decentralized Identifiers (DIDs) could be the final step to removing all third-party dependencies.

Conclusion

This framework moves us closer to a future where medical records are truly "patient-centric." It effectively uses blockchain as an immutable Access Control List while keeping the heavy data lifting in the cloud, proving that smart healthcare can be both secure and high-performing.