Privacy-preserving attribute-based access control model for XML-based electronic health record system

Kwangsoo Seol, Young Gab Kim, Euijong Lee, Young Duk Seo, Doo Kwon Baik

Research output: Contribution to journalArticlepeer-review

54 Citations (Scopus)


Cloud-based electronic health record (EHR) systems enable medical documents to be exchanged between medical institutions; this is expected to contribute to improvements in various medical services in the future. However, as the system architecture becomes more complicated, cloud-based EHR systems may introduce additional security threats when compared with the existing singular systems. Thus, patients may experience exposure of private data that they do not wish to disclose. In order to protect the privacy of patients, many approaches have been proposed to provide access control to patient documents when providing health services. However, most current systems do not support fine-grained access control or take into account additional security factors such as encryption and digital signatures. In this paper, we propose a cloud-based EHR model that performs attribute-based access control using extensible access control markup language. Our EHR model, focused on security, performs partial encryption and uses electronic signatures when a patient's document is sent to a document requester. We use XML encryption and XML digital signature technology. Our proposed model works efficiently by sending only the necessary information to the requesters who are authorized to treat the patient in question.

Original languageEnglish
Pages (from-to)9114-9128
Number of pages15
JournalIEEE Access
Publication statusPublished - 2018 Feb 2


  • Access control
  • data privacy
  • digital signature
  • encryption

ASJC Scopus subject areas

  • Computer Science(all)
  • Materials Science(all)
  • Engineering(all)


Dive into the research topics of 'Privacy-preserving attribute-based access control model for XML-based electronic health record system'. Together they form a unique fingerprint.

Cite this