In recent years, due to the extensive application of cloud computing technology in data processing [1], cloud-based EHRs have developed rapidly and more patients have been able to control their own medical data. In the cloud-based EHRs system, Premarathne et al. [2] and Ramu [3] set the access control to allow patients to share their medical data with doctors in a controlled way. However, a cloud server is not a fully trusted third party. In the cloud storage environment, it is difficult to guarantee the security of EHRs [4].

In 2008, blockchain was first proposed by Nakamoto [5] as a part of cryptocurrency bitcoin. At present, the application of the blockchain technology in the medical field is widely concerned among blockchain researchers [6]. With the decentralized, tamper-proof, traceable and publicly available blockchain technology [7], many problems in the medical field can be solved. Roehrs et al. [8] and Gordon et al. [9] proposed the basic framework of blockchain-based EHRs. Omer et al. [10] and Badr et al. [11] protected sensitive data of patients with the encryption technology in blockchain-based EHRs. Chen et al. [12] proposed a blockchain-based searchable encryption scheme for EHRs, which allowed patients to control the access to their EHRs.

In addition to the encryption protection, the authenticity of EHRs should be considered in the sharing process of EHRs. Authentication is crucial in blockchain [13] and cannot be ignored in blockchain-based EHRs [14]. Considering the characteristics of blockchain, many researchers proposed distributed signature schemes for blockchain-based EHRs. Tang et al. [14] constructed an identity-based signature scheme with multiple authorities to verify the identity of the signer and ensure the authenticity of the EHRs. Guo et al. [15] and Sun et al. [16] designed an attribute-based signature scheme with multiple authorities, which allowed the signer to hide their identity information when signing. However, these signature schemes lacked confidentiality of EHRs.

In order to satisfy both confidentiality and authenticity, in 1997, Zheng [17] first proposed the idea of signcryption, which could simultaneously realize the functions of signing and encrypting plaintext messages. Then, Malone-Lee [18] put forward the first practical identity-based signcryption scheme. Although many researchers have proposed more secure and efficient identity-based signcryption schemes [19,20], these schemes have only considered the case that a message was sent to one receiver. In 2006, Duan et al. [21] first proposed a multi-receiver identity-based signcryption scheme to send the same message to multiple receivers. In their scheme, the sender was only required to perform one pairing computation and n scalar multiplication in the signcryption phase, and each receiver could verify the validity of the message. Since then, the identity-based signcryption scheme for multiple receivers have been significantly improved based on the consideration of the efficiency and security properties [22–24].

In all the above identity-based signcryption schemes, only one key generation center (KGC) generates secret keys for all users, and the users must trust KGC unconditionally. However, KGC can use the public identity of users in the system to calculate the user’s secret key. Therefore, it can forge the sender’s signcryption or decrypt the signcryption obtained by the receiver. In addition, KGC may face a single point of failure.

A centralized KGC will have security risks, and the signcryption scheme of patient’s medical data in the blockchain was seldom explored. To enable patients to share the EHRs safely in the blockchain, in this paper, we made the following contributions.

Firstly, the distributed key generation method [13] is introduced into a centralized identity-based signcryption (IBSC) scheme. For multiple receivers, an identity-based signcryption with multiple authorities (MA-IBSC) scheme is developed. N authorities randomly construct their own polynomials and all authorities cooperatively generate the master secret key of the system by secret sharing, and embed their own secret key into the user’s secret key. Therefore, the scheme can resist the collusion attack of N-1 corrupt authorities. In addition, after signing EHRs, the patient encrypts the EHRs with the identities of other users whom the patient wants to share the data with. Thus, only authorized receivers can decrypt and access the EHRs. In this way, the authenticity of EHRs is ensured by verifying the signer’s signature. Furthermore, in the signcryption process, identity information of receivers can be hidden and the relationships between the patient and receivers are not exposed in the blockchain.

Secondly, signcrypted EHRs are directly uploaded to the blockchain, other nodes cannot verify them. Based on some adjustments of the on-chain and off-chain storage model [13], the signcrypted EHRs are recommended to be stored in the patient’s own off-blockchain database, so that the patient can control the EHRs. Then the patient extracts the storage address, signs it with the private key, and uploads it to the blockchain. Other users (nodes) in the system can verify the validity of the given address based on the patient’s public key.

Thirdly, based on the assumptions of computational Diffie-Hellman (CDH) problem and Bilinear Computational Diffie-Hellman (BCDH) problem, it is proved that our proposed sigcryption scheme is secure in the random oracle model. In other words, the unforgeability and confidentiality of signcryption are realized. Furthermore, the performance of the scheme is evaluated based on the two indices of signcryption efficiency and signcryption attributes.

The remainder of this paper is organized as follows. Section 2 presents the preliminaries, including Lagrange interpolation, bilinear map, computational assumption, syntax and secure model of the signcryption scheme. In Section 3, the EHRs system model in blockchain is described in detail. Section 4 demonstrates the specific MA-IBSC scheme for multiple receivers. The security analysis and performance evaluation are provided in Section 5. Finally, the conclusion is drawn in Section 6.

For a polynomial f of degree n , given n+1 (xi,yi)(i=1,2,…,n+1) on f , we can uniquely determine a polynomial f(x)=∑i=1n⁡yi(∏1≤j≠i≤nx−xjxi−xj) .

Let p be a large prime number, G1 and G2 be two multiplicative cyclic groups of order p , and g be the generator of G1 . We say that e:G1×G1→G2 is not a bilinear map unless e satisfies the following properties:

The security of the MA-IBSC scheme for multiple receivers is mainly based on the assumptions of Computational Diffie-Hellman (CDH) problem and Bilinear Computational Diffie-Hellman (BCDH) problem.

1) Computational Diffie-Hellman (CDH) problem. After a,b∈Zp∗ are randomly selected, for the given g,ga,gb∈G1 , gab∈G1 is calculated. If there is no probabilistic polynomial time (PPT) adversary A to calculate gab∈G1 with the probability advantage that cannot be ignored, we call CDH in group G1 the assumption of the difficult problem.

2) Bilinear Computational Diffie-Hellman (BCDH) problem. After a,b,c∈Zp∗ are randomly selected, for the given g,ga,gb,gc∈G1 , e(g,g)abc∈G2 is calculated. If there is no probabilistic polynomial time (PPT) adversary A to calculate e(g,g)abc∈G2 with the probability advantage that cannot be ignored, we call BCDH in group G1 the assumption of the difficult problem.

The identity-based signcryption with multiple authorities (MA-IBSC) scheme for multiple receivers involves the following seven algorithms:

Global Setup: The EHRs server takes a security parameter λ as the input and then outputs system public parameters params .

Authority Setup: All authorities perform this algorithm interactively. They input public parameters params and their identity IDi , then generate their respective secret key skIDi , system master secret key s and master public key PK .

KeyGen: This algorithm is also cooperatively controlled by all authorities. They input the public parameters params , their respective secret key skIDi , and identity idi of a user, and then return secret key skidi to the user.

User-Sign: User idi takes public parameters params , his/her secret key skidi and message M as input to run this algorithm with, and then outputs the signature σi of M .

User-Encrypt: User idi usually executes this algorithm after the User-Sign algorithm. User idi inputs the public parameters params , the signature σi of M , and the public keys of the receivers, and then outputs the signcryption message SC of M .

Verify: To verify the signature σi of M , other users take the signer’s identity idi , M and σi as input to carry out this algorithm. If the signature σi is valid, it returns Accept , otherwise returns Reject .

Receiver-Decrypt: Only the receivers picked by the user can run the algorithm to decrypt SC . Any one of the receivers inputs public parameter params , SC , and the user’s secret key to the algorithm, and then obtains M and the sharer’s idi .

Definition 1 and Definition 2 respectively introduce the two security attributes of the adapted signcryption scheme: unforgeability and confidentiality.

Definition 1: Suppose F is a forger, ℧ is defined as the MA-IBSC scheme for multiple receivers. The game between F and Challenger C is described as follows:

Global Setup: Challenger C takes a security parameter λ as input, runs global setup algorithm, then generates params and transmits it to F.

Authority Setup: Challenger C runs authority setup algorithm to output secret key skIDi for each authority IDi , where i∈{1,2,…N} . Then Forger F outputs his/her target identity idi∗ .

Queries: Forger F performs the following four queries to Challenger C:

Forgery: Forger F finally outputs a new signcryption SC∗ and the public key pair (id1,skid1),(id2,skid2),…,(idn,skidn) of n receivers. If SC∗ is the signcryption of idi∗ to the message M and can be correctly decrypted and verified by receivers in set R={idl}l=1n , then SC∗ is a valid signcryption and F wins the game. The limitations here are described below. F cannot query the skidi∗ with identity idi∗ through the key generation query, and SC∗ cannot be generated by the User-Sign and User-Encrypt algorithm.

Definition 2: Suppose that A is an adversary, ℧ is defined as the MA-IBSC scheme for multiple receivers. The game between Adversary A and Challenger C is introduced as follows:

Global Setup: Challenger C takes a security parameter λ as input, runs global setup algorithm, and then generates params and transmits it to A.

Authority Setup: Challenger C runs authority setup algorithm to output secret key skIDi for each authority IDi , where i∈{1,2,…,N} . Adversary A outputs target identities idl∗ of n receivers, where l={1,2,…,n} .

Phase 1: Adversary A performs the following five queries to Challenger C:

Challenge: A outputs a target plaintext pair (M0,M1) and a private key skidi∗ . When Challenger C receives (M0,M1) and skidi∗ , C randomly selects a message Mβ , where β∈{0,1} , then generates the target signcryption SC∗ based on Mβ , skidi∗ and n target receivers idl∗ , where l={1,2,…,n} , and finally returns SC∗ to A.

Phase 2: A makes multiple queries as those in Phase 1. The limitations here are described below. A cannot ask skidl∗ of n target receivers idl∗ , where l={1,2,…,n} during the key generation query, and A cannot ask SC∗ during Receiver-Decrypt-and-Verify query.

Guess: In the end, A outputs its guess β′∈{0,1} and wins the game if β′=β .

There are three main roles in EHRs system in the blockchain: EHRs server, authority, and user.

EHRs Server: The EHRs server is mainly responsible for generating public parameters params in EHRS system initialization, and distributing corresponding identity for each authority and each user in the system.

Authority: The authorities include all medical departments: hospitals, pharmacies, health insurance companies, medical research institutes and so on. As the bookkeeping nodes in the blockchain, they package a set of transactions that are broadcast on the network and upload them to the new block created by them through the DPoS consensus mechanism.

User: As ordinary nodes in the blockchain, users primarily create new transactions and publish them to the network. Users include patients, medical workers and common people. Patients create their own EHRs after treatment, and then adopt MA-IBSC scheme to share their private EHRs with other designated users in the blockchain.

EHRs of patients are generally private data and cannot be directly uploaded to the blockchain for sharing. Therefore, we adopt the on-chain and off-chain storage mode and only upload the address of the stored EHRs to the blockchain. The EHRs are signcrypted and stored in the off-blockchain database of each node, and the decryption permission is set at the same time. This storage mode enables patient’s EHRs to be safely shared among the users that the patient designates.

As shown in Fig. 1, when a patient creates his/her own new EHRs after diagnosis or treatment, he/she uses his/her secret key and the public keys of users, whom he/she wants to share the data with, to signcrypt the EHRs, and stores the signcrypted data in his/her off-blockchain database. Then he/she signs the address of the stored EHRs and publishes it to the blockchain.

To guarantee that the EHRs shared by the patient and the storage address of the EHRs broadcast by the patient in the blockchain are real, it is necessary to perform authentication. Authentication is mainly performed by verifying the signature of the sharer. Based on the system model and EHRs storage mode, authentication can be mainly classified into the following two cases:

For the purposes of realizing the signcryption of EHRs and the two authentication cases, we describe the relationships between the system roles and the MA-IBSC scheme for multiple receivers below.

First, the EHRs server runs the Global Setup algorithm to generate the public parameters of the system. Next, each authority performs Authority Setup algorithm to produce its own secret key and then cooperates with other authorities to generate the master secret key and the master public key of the system. After that, with the identity of each user in the system, each authority runs the KenGen algorithm and jointly distribute the secret key to the user. After receiving the secret key, the patient uses User-Sign algorithm to sign his/her own EHRs, executes User-Encrypt algorithm immediately, encrypts the signed EHRs with the public keys of the receivers whom he/she wants to share the data with. In this way, the decryption permission is set for these designated receivers. After storing the signcrypted EHRs in the off-blockchain database, the patient executes the User-Sign algorithm again and broadcasts the signed storage address of EHRs. All other nodes (authorities or users) can verify the validity of the address given by the patient by executing the Verify algorithm. Then, for a period of time, the bookkeeping node packs the storage addresses of EHRs signed by some patients, and uploads them to a new block, which is connected by the hash value of the previous block to form a blockchain. The data structure of blockchain is shown in Fig. 2.

When other users want to access the patient’s EHRs, they retrieve the patient’s signcrypted data in the off-blockchain database through the storage address on the blockchain and then run the Receiver-Decrypt algorithm. Only receivers with the decryption permission set by the patient can decrypt the signcrypted EHRs with their secret keys, and then run the Verify algorithm to ensure that the real EHRs are obtained.

In this section, Theorem 1 and Theorem 2 respectively prove the unforgeability and confidentiality of signcryption.

The master secret key s is randomly generated by N authorities by the distributed key generation and no one knows the real value of s , so gs cannot be used as an instance of CDH problem. Here, we set PK=gas , where ga is a CDH instance. s is still generated by all authorities randomly and unknown to others, a and s are independent of each other. For any PPT adversary, even if he/she corrupts N−1 authorities, he/she cannot recover the value s . Therefore, for the PPT adversary, PK=gs∈G1 and PK=gas∈G1 are indistinguishable.

Theorem 1: In the random oracle model, if there is a probabilistic polynomial time (PPT) adversary F, who can win the Definition 1 game in Section 2.5 with a non-negligible advantage ε within time τ , then there is an algorithm C that can solve the CDH problem with the advantage ε′≥ε−QH2(QUS+QUE)2k within time τ′≈τ+QUEO(τ1) , where τ1 is the running time of e . (PPT adversary can make QS secret key quires, QK key generation quires, QUS user-sign quires, QUE user-encrypt quires and QH0 , QH1 , QH2 , QH3 hash function H0 , H1 , H2 , H3 quires at most).

Proof: The following shows how algorithm C uses F to solve the CDH problem with probability ε′ within time τ′ .

First, C gets an instance ⟨G1,G2,p,g,e,ga,gb⟩ of CDH problem, whose goal is to calculate gab∈G1 . C simulates a challenger to play the following game with F.

Global Setup: Challenger C executes global setup algorithm, inputs parameter λ , outputs public parameter params and sends it to F.

Authority Setup: C represents all authorities to run the authority setup algorithm and generate secret key skIDi for each authority IDi , where i∈{1,2,…N} , so only C knows the real value s of the master secret key. However, C sets the master secret key as a⋅s , and sets the public key as PK=gas . Because s and a⋅s are unknown to F, gs and gas are indistinguishable to F. Finally, C adds parameters {(IDi,Ai0)}i=1N and PK=gas to params . F can obtain params=⟨p,g,P1,e,G1,G2,H0,H1,H2,H3,N,{(IDi,Ai0)}i=1N,PK⟩ from C. After receiving the params , F outputs the target identity idi∗ .

H0 , H1 , H2 , and H3 are random oracle models controlled by C. The query results of H0 , H1 , H2 , and H3 are stored in H0−list , H1−list , H2−list , and H3−list respectively.

Queries: Forger F performs some queries to Challenger C:

- H0 queries: C enters an identity IDi or idi into H0 . If there is (IDi,xi) or (idi,xi) in the H0−list , returns xi , otherwise C performs the following steps:

1) Randomly selects an integer xi∈Zp∗ ;

2) Saves (IDi,xi) or (idi,xi) to H0−list ;

3) Returns xi .

- H1 queries: C enters an identity idi into H1 . If there is (idi,ki,pkidi) in the H1−list , returns pkidi , otherwise C performs the following steps:

1) Randomly selects an integer ki∈Zp∗ ;

2) If idi=idi∗ , (where idi∗ is C random guess of the identity that F will attack) calculates gkiP1 , otherwise calculates gki ;

3) Saves (idi,ki,pkidi) to H1−list ;

4) Returns pkidi .

- H2 queries: C enters an array (Mi,Xi) into H2 . If there is (Mi,Xi,hi) in the H2−list , returns hi , otherwise C performs the following steps:

1) Randomly selects an integer hi∈Zp∗ ;

2) Saves (Mi,Xi,hi) to H2−list ;

3) Returns hi .

- H3 queries: C enters an element Vi∈G2 into H3 . If there is (Vi,ρi) in the H3−list , returns ρi otherwise C performs the following steps:

1) Randomly selects a character string ρi∈{0,1}λ1+λ2 ;

2) Saves (Vi,ρi) to H3−list ;

3) Returns ρi .

- Secret key queries: F requests secret keys skIDi∈QS of authority IDi∈QS , where QS⊂{1,2,…,N} represents the index set of corrupt authorities. Because C generates the secret keys of all authorities , C can answer the queries from F.

- Key generation queries: F asks C about the secret key skidi of the identity idi . If idi=idi∗ , C does not answer this query and terminate the game. Otherwise, C looks for (idi,ki,pkidi) in H1−list , calculates skidi=(gki⋅P1)as , and then returns it to F.

- User-sign queries: F asks C for the signature σi of a tuple (idi,M) . If idi≠idi∗ , C will get the correct skidi from key generation queries, and then calculates the signature σi and transmits it to F. If idi=idi∗ , C cannot obtain skidi∗ from key generation queries to calculate the signature directly. However, C can answer F’s query through the following steps: 1) C randomly selects r′∈Zp∗ and calculates X′=gr′ . 2) C finds (M,X′,h′) in H2−list list and gets h′ . 3) C finds (idi,ki,pkidi) in H1−list (if it cannot be found, C chooses ki∈Zp∗ , then calculates pkidi=gkiP1 and stores (idi,ki,pkidi) in H1−list ). 4) C calculates W′=skidih′pkidir′=gki(as⋅h′+r′)P1r′ , and then gets σi=(X′,W′) and returns it to F.

- User-encrypt queries: To forge a signcryption, the query is executed after the user-sign query. When C receives the encryption query about (M,R,idi) , where idi=idi∗ and R represents a receiver set {idl}l=1n ( l represents the identity of receivers and n represents the number of receivers), C answers F through the following steps: 1) C calculates V′=e(PKr′,P1)=e(gas⋅r′,P1) , and then finds (V′,ρ′) in the H3−list . 2) C calculates Z′=ρ′⊕(idi||M) ; 3) C finds (idl,xl) in the H₀ – list, calculates yl=pkidlr′ and gets Ll , where l∈{1,2,…,n} . 4) C gets the signcryption SC and sends it to F.