Fine Grained Attribute Based Access Control of Healthcare Data

One of the biggest threats to the healthcare data stored by healthcare organizations comes from malicious insiders. The first layer of protection against such adversaries is access control, however if an adversary is able to bypass that then the data becomes exposed. In this paper we propose an access control method based on Hidden Vector Encryption. In our approach access control policies are written using attributes of entities. The Hidden Vector Encryption system then embeds the policies in the ciphertext such that it can be decrypted only when the relevant attributes are presented. This provides a higher level of access control where a malicious insider cannot decrypt data unless they possess the right attributes.