Commit-HABE: A Commitment-Based Auditable Attribute-Based Encryption for Blockchain-Based Medical Data Sharing Systems

Abstract

In blockchain-based medical data sharing systems, sensitive medical data such as electronic health records and diagnostic reports require secure sharing with fine-grained access control and accountable usage. Existing attribute-based encryption (ABE) schemes lack mechanisms for auditing data usage after decryption, leaving data misuse undetectable and unaccountable. To address this limitation, this paper proposes Commit-HABE, a commitment-based auditable ABE scheme. Users submit their attribute sets along with signed usage commitments prior to data access, which are immutably recorded on a consortium blockchain. In addition, a traceable watermark cryptographically linked to each commitment can be embedded into the decrypted data, enabling post-hoc leakage detection and attribution. Security analysis indicates that Commit-HABE achieves data confidentiality, commitment non-repudiation, and traceability. We implement Commit-HABE alongside three representative CP-ABE schemes and conduct a performance evaluation. Experimental results demonstrate that Commit-HABE reduces encryption time by up to 29.5% compared to existing schemes and maintains comparable decryption performance. The commitment overhead is negligible $(\approx 0.0016 \text{ms})$, watermark embedding scales linearly from 0.28 ms to 6.10 ms, and the blockchain system sustains 100% success under up to 100 queries per second.