SRACS: Sanitizable and Revocable Access Control Scheme for Crowdsourcing Healthcare Against Malicious Requesters

Crowdsourcing healthcare brings new opportunities for processing and analyzing medical data and has become a significant auxiliary medical method. However, crowdsourcing tasks involve sensitive information, and privacy leakage concerns have severely hindered the promotion of crowdsourcing healthcare. More critically, malicious requesters driven by profit or other motives may disclose encryption keys used to encrypt tasks. Such actions further increase the risk of unauthorized access to sensitive tasks. To address this, we design a novel sanitizable and revocable access control scheme (SRACS). In SRACS, we introduce a sanitizer to transform encrypted tasks issued by requesters into the sanitized ciphertext so that unauthorized workers with corrupt encryption keys cannot access tasks. Considering the limited computing resources of participants, SRACS supports secure outsourced encryption and verifiable outsourced decryption, enabling participants to perform minimal operations to post or obtain tasks while ensuring the reliability of the encryption and decryption processes. Furthermore, requesters can update tasks by revoking workers' decryption permissions at the attribute level. SRACS has been shown to achieve selective security under the q-parallel BDHE assumption and ensure forward security. Experiment results show SRACS exhibits superior computational performance, making it better to deploy in resource-constrained crowdsourcing healthcare environments.