A zero-trust security and trapdoor-based blind retrieval scheme for medical images in cloud storage
TL;DR
The proposed framework incorporates a thumbnail-based dual-track encryption and authentication protocol, enabling visual pre-screening of images without requiring full decryption while inherently intercepting malicious tampering, and comprehensively guarantees the robust confidentiality of outsourced medical images.
Abstract
The outsourced storage of massive medical images in cloud environments carries significant vulnerabilities regarding privacy leakage and data integrity. Existing solutions predominantly utilize conventional cryptography, which struggles to protect the large-area zero-value regions typical of medical images. Furthermore, the lack of high-speed ciphertext retrieval and verification mechanisms hinders the secure interaction of clinical data. To address these dilemmas, this paper proposes an end-to-end secure storage framework based on the zero-trust principle of ‘encrypt-before-outsourcing’. The framework incorporates a thumbnail-based dual-track encryption and authentication protocol, enabling visual pre-screening of images without requiring full decryption while inherently intercepting malicious tampering. At the foundational cryptographic layer, we propose a strongly coupled encryption scheme integrating a two-dimensional high-complexity chaotic map, ciphertext feedback chain scrambling, and hash-adaptive recursive diffusion. Leveraging SHA-256 to extract plaintext features, this scheme dynamically perturbs the chaotic parameters to drive a full-link feedback mechanism. This effectively circumvents the ‘diffusion failure’ induced by large-area zero-value regions, fundamentally thwarting known-plaintext attacks and chosen-plaintext attacks. For cloud interaction, the proposed framework integrates hash trapdoors and the hash-based message authentication code mechanism. This effectively decouples retrieval semantics from the target ciphertexts, thereby enabling O(1) ultra-fast blind search and strict integrity self-checking within the cloud. Experimental results demonstrate that the equivalent key space reaches 2256, and the information entropy approaches the theoretical maximum of 8. Additionally, the number of pixels change rate and unified average changing intensity metrics stabilize at approximately 99.6094% and 33.4635%, respectively. These findings comprehensively guarantee the robust confidentiality of outsourced medical images, providing highly reliable technical support for sharing sensitive clinical data in untrusted public clouds.