Electronic medical records, one of the sensitive data, are stored in public or private cloud service providers. Cloud systems provide security with firewall and intrusion detection systems, and these systems ensure privacy with access control and end-to-end encryption. However, while sending data to the cloud system, attackers can capture the data with the help of Man in the Middle attacks and vulnerabilities of the storage systems. In the middleware architecture proposed in this study, access control protocol, key distributor and end-to-end hybrid encryption which are based on user roles were innovatively used to overcome security issues in data transmission. In this system, writing and updating requests are encrypted asymmetrically, and reading requests were encrypted symmetrically. This solution distinguishes the proposed method from previous studies. According to this solution the operating performance of the system is increased. In addition, the attacker cannot see the actual data in a cyber-attacks because the sensitive data is distributed to the users with their private keys. This result shows that the access, write and update of electronic medical records are performed with the principles of security and privacy.

[1] Ammar N., Malik Z., Bertino E., and Rezgui A., “XACML Policy Evaluation with Dynamic Context Handling,” IEEE Transactions on Knowledge and Data Engineering, vol. 27, no. 9, pp. 2575-2588, 2015.

[2] Balamurugan V. and Saravanan R., “Enhanced Intrusion Detection and Prevention System on Cloud Environment Using Hybrid Classification and OTS Generation,” Cluster Computing, vol. 22, no. 3, pp. 13027-13039, 2019.

[3] Ballard L., Kamara S., and Monrose F., “Achieving Efficient Conjunctive Keyword Searches Over Encrypted Data,” in Proceedings of International Conference on Information and Communications Security, Beijing, pp. 414-426, 2005.

[4] Dalkiran I. and Danişman K., “Artificial Neural Network Based Chaotic Generator for Cryptology,” Turkish Journal of Electrical Engineering and Computer Sciences, vol. 18, no. 2, pp. 225-240, 2010.

[5] Denis R. and Madhubala P., “Hybrid Data Encryption Model Integrating Multi-Objective Adaptive Genetic Algorithm for Secure Medical Data Communication Over Cloud-Based Healthcare Systems,” Multimedia Tools and Applications, vol. 80, no. 11, pp. 21165-21202, 2021.

[6] Dinur I., Keller N., and Klein O., “An Optimal Distributed Discrete Log Protocol with Applications to Homomorphic Secret Sharing,” in Proceedings of 38th International Cryptology Conference, Santa Barbara, pp. 213-242, 2018.

[7] Drozdowicz M., Ganzha M., and Paprzycki M., “Semantically Enriched Data Access Policies in Ehealth,” Journal of Medical Systems, vol. 40, no. 11, pp. 1-8, 2016.

[8] Dwork C., “Differential Privacy: A Survey of Results,” in Proceedings of International Conference on Theory and Applications of Models of Computation, Xi'an, pp. 1-19, 2008.

[9] Dwork C., McSherry F., Nissim K., and Smith A., “Calibrating Noise to Sensitivity in Private Data Analysis,” in Proceedings of Theory of Cryptography Conference, New York, pp. 265- 284, 2006.

[10] Elhoseny M., Ramírez-González G., Abu-Elnasr O., Shawkat S., Arunkumar N., and Farouk A., “Secure Medical Data Transmission Model for Iot-Based Healthcare Systems,” IEEE Access, vol. 6, pp. 20596-20608, 2018.

[11] Fan K., Wang S., Ren Y., Li H., and Yang Y., “Medblock: Efficient and Secure Medical Data Sharing Via Blockchain,” Journal of Medical Systems, vol. 42, no. 8, pp. 1-11, 2018.

[12] Floyd T., Grieco M., and Reid E., “Mining Hospital Data Breach Records: Cyber Threats to US Hospitals,” in Proceedings of IEEE Conference on Intelligence and Security Informatics, Tucson, pp. 43-48, 2016.

[13] Fontaine C. and Galand F., “A Survey of Homomorphic Encryption for Nonspecialists,” EURASIP Journal on Information Security, vol. 1, no. 013801, pp. 1-7, 2007.

[14] Jiang W., Xu H., Dong H., Jin H., and Liao X., “An Improved Security Framework for Web Service-Based Resources,” Turkish Journal of Electrical Engineering and Computer Sciences, vol. 24, no. 3, pp. 774-79, 2016.

[15] Jaidi F., Ayachi F., and Bouhoula A., “Advanced Analysis of the Integrity of Access Control Policies: The Specific Case of Databases,” The International Arab Journal of Information Technology, vol. 17, no. 5, pp. 808-815, 2020.

[16] Kanwal T., Anjum A., and Khan A., “Privacy Preservation in E-Health Cloud: Taxonomy, Privacy Requirements, Feasibility Analysis, and Opportunities,” Cluster Computing, vol. 24, no. 1, pp. 293-317, 2021.

[17] Kenthapadi K., Mironov I., Thakurta A., “Privacy-preserving Data Mining in Industry,” in Proceedings of the 12th ACM International Conference on Web Search and Data Mining, New York, pp. 840-841, 2019.

[18] Kenthapadi K., Mishra N., and Nissim K., “Simulatable Auditing,” in Proceedings of the 24th ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, Baltimore-Maryland, pp. 118-127, 2005.

[19] Khozaimi A., Putro S., and Yaqin A., ”Improve The Performance and Security of Medical Records using Fingerprint and Advance Encryption Standart,” in Proceedings of An Efficient Ensemble Architecture for Privacy and Security of Electronic Medical Records 279 International Conference on Health Informatics, Medical, Biological Engineering, and Pharmaceutical, Jakarta, pp. 285-290, 2020.

[20] Kleinberg J., Kumar R., Raghavan P., Rajagopalan S., and Tomkins A., “The Web as a Graph: Measurements, Models, and Methods,” in Proceedings of International Computing and Combinatorics Conference, Tokyo, pp. 1-17, 1999.

[21] Langenberg B., Pham H., and Steinwandt R., “Reducing The Cost of Implementing The Advanced Encryption Standard as A Quantum Circuit,” IEEE Transactions on Quantum Engineering, vol. 1, pp. 1-12, 2020.

[22] Li J., Yu Q., Zhang Y., and Shen J., “Key-Policy Attribute-Based Encryption Against Continual Auxiliary Input Leakage,” Information Sciences, vol. 470, pp.175-188, 2019.

[23] Liu L., Lai J., Deng R., and Li Y., “Ciphertext- Policy Attribute-Based Encryption with Partially Hidden Access Structure and its Application to Privacy-Preserving Electronic Medical Record System in Cloud Environment,” Security and Communication Networks, vol. 9, no. 18, pp. 4897-4913, 2016.

[24] Luo W. and Ma W., “Secure And Efficient Proxy Re-Encryption Scheme Based on Key- Homomorphic Constrained Prfs in Cloud Computing,” Cluster Computing, vol. 22, no. 2, pp. 541-551, 2019.

[25] Mahanta H. and Khan K., “Securing RSA Against Power Analysis Attacks Through Non- Uniform Exponent Partitioning with Randomization,” IET Information Security, vol. 12, no. 1, pp. 25-33, 2018.

[26] Marwan M., AlShahwan F., Sifou F., Ali K., and Ouahmane H., “Improving the Security of Cloud- based Medical Image Storage,” Engineering Letters, vol. 27, no. 1, pp. 175-193, 2019.

[27] McDermott D., Kamerer J., and Birk A., “Electronic Health Records: A Literature Review of Cyber Threats and Security Measures,” International Journal of Cyber Research and Education, vol. 1, no. 2, pp. 42-49, 2019.

[28] Mukti G. and Setiawan H., “Designing and Building Secure Electronic Medical Record Application by Applying AES-256 and RSA Digital Signature,” IOP Conference Series: Materials Science and Engineering, vol. 852, no. 1, pp. 0121482019, 2019.

[29] Osamor V. and Edosomwan I., “Employing Scrambled Alpha-Numeric Randomization and RSA Algorithm to Ensure Enhanced Encryption in Electronic Medical Records,” Informatics in Medicine Unlocked, vol. 25, pp. 100672, 2021.

[30] Ostrovsky R., Sahai A., and Waters B., “Attribute-Based Encryption with Non- Monotonic Access Structures,” in Proceedings of the 14th ACM Conference on Computer and Communications Security, Virginia, pp. 195-203, 2007.

[31] Prathap R., Mohanasundaram R., and Kumar P., “Design of EHR in Cloud with Security,” in Proceedings of Smart Intelligent Computing and Applications, Singapore, pp. 419-425, 2019.

[32] Pugazhenthi A. and Chitra D., “Secured and Memory Overhead Controlled Data Authentication Mechanism in Cloud Computing,” Cluster Computing, vol. 22, no. 6, pp. 13559-13567, 2019.

[33] Qian H., Li J., Zhang Y., and Han J., “Privacy- Preserving Personal Health Record Using Multi- Authority Attribute-Based Encryption with Revocation,” International Journal of Information Security, vol. 14, no. 6, pp. 487-497, 2015.

[34] Rezaeibagha F. and Mu Y., “Distributed Clinical Data Sharing Via Dynamic Access-Control Policy Transformation,” International Journal of Medical Informatics, vol. 89, pp. 25-31, 2016.

[35] Samkari H. and Gutub A., “Protecting Medical Records against Cybercrimes within Hajj Period by 3-layer Security,” Recent Trends in Information Technology and its Application, vol. 2, no. 3, pp. 1-21, 2018.

[36] Sánchez Y., Demurjian S., Baihan M., “A Service-Based RBAC and MAC Approach Incorporated into the FHIR Standard,” Digital Communications and Networks, vol. 5, no. 4, pp. 214-225, 2019.

[37] Shaqrah A. and Noor T., Data Analytics in Medicine: Concepts, Methodologies, Tools, and Applications, IGI Global, 2020.

[38] Sharma B., Sekharan C., and Zuo F., “Merkle- Tree Based Approach for Ensuring Integrity of Electronic Medical Records,” in Proceedings of 9th IEEE Annual Ubiquitous Computing, Electronics and Mobile Communication Conference, New York, pp. 983-987, 2018.

[39] Sharma K., Agrawal A., Pandey D., Khan R., and Dinkar S., “RSA Based Encryption Approach for Preserving Confidentiality of Big Data,” Journal of King Saud University-Computer and Information Sciences, 2019.

[40] Shen N., Bernier T., Sequeira L., Strauss J., Silver M., Carter-Langford A., and Wiljer D., “Understanding the Patient Privacy Perspective on Health Information Exchange: A Systematic Review,” International Journal of Medical Informatics, vol. 125, pp. 1-12, 2019.

[41] Singh N., Jangra A., Elamvazuthi I., Kashyap K., “Healthcare Data Privacy Measures To Cure and Care Cloud Uncertainties,” in Proceedings of International Conference on Signal Processing, Computing and Control, Solan, pp. 402-407, 2017. 280 The International Arab Journal of Information Technology, Vol. 19, No. 2, March 2022

[42] Song D., Wagner D., and Perrig A., “Practical Techniques for Searches on Encrypted Data,” in Proceedings of IEEE Symposium on Security and Privacy, Berkeley, pp. 44-55, 2000.

[43] Soni K. and Kumar S., “Comparison of RBAC and ABAC Security Models for Private Cloud,” in Proceedings of International Conference on Machine Learning, Big Data, Cloud and Parallel Computing, Faridabad, pp. 584-587, 2019.

[44] Tuncer T. and Avcı E., “Data Hiding Application with Gokturk Alphabet Based Visual Cryptography Method,” Journal of the Faculty of Engineering and Architecture of Gazi University, vol. 31, no. 3, pp. 781-789, 2016.

[45] Wang Q., Peng L., Xiong H., Sun J., and Qin Z., “Ciphertext-Policy Attribute-Based Encryption with Delegated Equality Test in Cloud Computing,” IEEE Access, vol. 6, pp. 760-771, 2017.

[46] Woźniak M., Graña M., and Corchado E., “A Survey of Multiple Classifier Systems as Hybrid Systems,” Information Fusion, vol. 16, pp. 3-17, 2014.

[47] Yang J., Li J., and Niu Y., “A Hybrid Solution For Privacy Preserving Medical Data Sharing in The Cloud Environment,” Future Generation Computer Systems, vol. 43, pp. 74-86, 2015.

[48] Yesmin T. and Carter M., “Valuation Framework for Automatic Privacy Auditing Tools for Hospital Data Breach Detections and an Application Case,” International Journal of Medical Informatics, pp. 104123, 2020.

[49] Yılmaz N. and Tarhan A., “A Two-Dimensional Method for Evaluating Maintainability and Reliability of Open Source Software,” Journal of the Faculty of Engineering and Architecture of Gazi University, vol. 34, no. 4, pp. 1807-1830, 2019.

[50] Zheng L., Zhang Y., Zhang R., Chen J., Cui M., and Song C., “An Improved Authentication Protocol in Telemedicine System,” in Proceedings of International Conference on Algorithms and Architectures for Parallel Processing, Guangzhou, pp. 177-184, 2018.