Ensuring Access Control in Cloud Provisioned Healthcare Systems

Abstract

An important issue in cloud provisioned multi-tenant healthcare systems is the access control, which focuses on the protection of information against unauthorized access. As different tenants including hospitals, clinics, insurance companies, and pharmacies access the system, sensitive information should be provided only to authorized users and tenants. In this thesis, we first analyze the requirements of access control for healthcare multitenant cloud systems. Then, we propose to adapt Task-Role Based Access Control with constraints such as least privilege, separation of duty, delegation of tasks, and spatial and temporal access. We utilize the Ciphertext Attribute Based Encryption scheme for the data encryption in the cloud so that fine grained encryption access control is ensured. We also protect password security by using the Message Digest 5 algorithm along with salt value. Finally, we implement a Nevada Healthcare System in the Amazon cloud.