Abstract
Keywords
Introduction
The rapid digitization of healthcare and the proliferation of Internet of Things (IoT) medical devices have enabled continuous patient monitoring and personalized care. However, these advancements have also resulted in the exponential growth of sensitive health data transmitted and stored in cloud infrastructure, raising serious concerns about privacy, cyberattacks, and unauthorized access.1,2 Although cloud platforms provide scalability and operational flexibility, they remain vulnerable to security breaches and lack sufficient mechanisms to guarantee privacy. 3
Conventional cryptographic schemes such as RSA and Paillier secure data during storage and transmission but do not allow computation on encrypted data, making them unsuitable for privacy-preserving analytics in cloud healthcare environments. 4 Blockchain technology provides transparency, immutability, and decentralized trust. Frameworks such as Hyperledger Fabric are particularly relevant to healthcare consortia owing to their modular architecture and permissioned access control.5,6 However, blockchain alone is unable to support the advanced functionalities required for healthcare data management, such as privacy-preserving computation and secure search over encrypted Personal Health Records (PHRs).7–10
Fully Homomorphic Encryption (FHE) addresses this limitation by enabling computation directly on encrypted data without decryption.11,12 Despite its potential, FHE still faces challenges such as high computational cost, ciphertext expansion, and noise growth, which hinder scalability in real-world healthcare applications.12,13 To complement FHE, Extended Secure Searchable Encryption (ESSE) enables keyword-based queries over encrypted datasets without revealing search terms,14,15 while Attribute-Based Signature (ABS) enforces fine-grained, role-based access control with strong guarantees of anonymity and unforgeability.16–18
Research gap
Existing healthcare blockchain frameworks primarily focus on data storage integrity and access management but fall short of enabling encrypted computation, secure multi-user query execution, and fine-grained decentralized access enforcement across distributed environments.19,20
Contributions
This study addresses these gaps in several ways. First, it introduces an integrated FHE–ESSE–ABS framework for secure healthcare data management within a Hyperledger Fabric-based architecture. Second, it develops a synthetic healthcare dataset of 1,000 anonymized records, modeled after the publicly available Cell-Phone Brain Tumour dataset (Kaggle), to simulate encrypted health workflows. Third, it implements the cryptographic modules in MATLAB and evaluates them using encryption latency, query throughput, access control accuracy, and overall efficiency. Finally, it demonstrates how the proposed system extends beyond existing blockchain healthcare solutions by supporting encrypted computation, privacy-preserving search, and decentralized access control.
By combining blockchain’s auditability with FHE-based computation, ESSE-driven secure search, and ABS-enabled access enforcement, the proposed framework provides a scalable and privacy-preserving architecture for encrypted healthcare data. This work demonstrates the feasibility of deploying advanced cryptographic methods in real-world health informatics and establishes a foundation for future research in secure cloud-based medical analytics.11,21,22
In this study, IoT and wearable devices are treated as conceptual data sources feeding encrypted health records. Their integration was not directly implemented in the simulations but was instead modeled through synthetic attributes designed to approximate real-world device data.
Literature review
Blockchain frameworks in healthcare
Blockchain technology has been extensively studied for the secure and decentralized management of healthcare data owing to its immutability, transparency, and auditability.23–25 Several frameworks have demonstrated its applicability to electronic health records. For instance, MedRec leveraged Ethereum smart contracts to manage records while ensuring patient-centered access. 26 Guardtime’s Keyless Signature Infrastructure was implemented for nationwide health record auditing in Estonia, 27 whereas OmniPHR utilized blockchain technology to achieve interoperable and unified patient record sharing across multiple healthcare providers. 28 More recently, Hyperledger Fabric–based prototypes have been developed for healthcare consortia, offering permissioned access control and modular scalability. 29 Despite these advancements, most existing frameworks focus primarily on storage integrity and interoperability while overlooking privacy-preserving computation and advanced cryptographic integration. This limitation directly motivates the objectives of the present study.
IoT and wearable devices in healthcare
IoT and wearable devices play a pivotal role in enabling continuous health monitoring, early disease diagnosis, and personalized medical interventions. 30 However, their constant connectivity exposes them to various security vulnerabilities, emphasizing the necessity of implementing robust encryption protocols to protect sensitive health data from unauthorized access and potential cyberattacks. 31
Secure searchable encryption (SSE) and homomorphic encryption
Secure Searchable Encryption (SSE) enables the retrieval of encrypted records without disclosing either the query content or the underlying data. 32 The Extended Multi-User ESSE model advances OXT-based protocols by effectively addressing persistent challenges such as key loss, user collusion, and unauthorized query inference. 33 In parallel, Fully Homomorphic Encryption (FHE) facilitates computation directly on encrypted data without decryption, offering robust privacy guarantees for sensitive healthcare analytics. 15 Recent developments have significantly reduced its computational overhead, thereby enhancing the practicality of FHE implementations within health informatics applications. 12
Cloud computing in healthcare
Cloud platforms provide scalable and efficient infrastructure for storing and managing medical data; however, they also introduce significant concerns related to access control, data sovereignty, and trust in third-party service providers. 21 Attribute-Based Signature (ABS) schemes mitigate these challenges by enabling decentralized and fine-grained access control while ensuring both anonymity and unforgeability.17,34 These capabilities closely align with the healthcare sector’s requirement for flexible, identity-independent access policies that preserve patient privacy and institutional autonomy. 18
Long-term health monitoring with cloud integration
Long-term health monitoring represents one of the most promising applications of cloud-integrated healthcare systems. 18 Previous studies have utilized Fully Homomorphic Encryption (FHE) to protect patient data throughout the stages of acquisition, transmission, and computation, thereby confirming its effectiveness and suitability for secure remote monitoring in clinical and telehealth environments.35, 36
Challenges in existing work
Despite significant progress, several challenges remain unresolved. Blockchain scalability continues to pose a bottleneck for managing large-scale healthcare datasets. 22 Internet of Things (IoT) devices further demand lightweight cryptographic techniques suitable for resource-constrained environments. 37 Moreover, Fully Homomorphic Encryption (FHE) still introduces considerable computational overhead, limiting its practical deployment in real-time healthcare systems. 13 Future research is anticipated to integrate blockchain with artificial intelligence (AI) and deep learning methods to enhance adaptability, scalability, and predictive capability in secure healthcare infrastructures. 38
Importance of the study
This study addresses enduring gaps in privacy-preserving Personal Health Record (PHR) management. In contrast to existing blockchain frameworks that primarily emphasize secure storage and interoperability, the proposed framework integrates Fully Homomorphic Encryption (FHE) for encrypted computation, Extended Secure Searchable Encryption (ESSE) for privacy-preserving data retrieval, and Attribute-Based Signature (ABS) for decentralized access control. Collectively, these mechanisms establish a robust and scalable architecture for the secure storage, retrieval, and analysis of encrypted medical data. 39
Aim
The aim of this study is to evaluate the privacy, performance, and scalability of a healthcare blockchain framework based on Fully Homomorphic Encryption (FHE) for the secure management of encrypted Personal Health Records (PHRs).
Objectives
This study aims to achieve several key objectives that collectively contribute to the development and validation of a secure, privacy-preserving healthcare blockchain framework. The first objective is to assess the computational efficiency, accuracy, and security of Fully Homomorphic Encryption (FHE) when applied to encrypted medical data, thereby determining its suitability for real-world healthcare analytics. The second objective focuses on designing and implementing an Extended Secure Searchable Encryption (ESSE) scheme that supports efficient, privacy-preserving keyword-based queries within a distributed cloud environment. A third objective involves integrating Attribute-Based Signature (ABS) mechanisms with both FHE and ESSE to enable decentralized, role-based access control with fine-grained policy enforcement.
Furthermore, the study seeks to validate the proposed framework using a synthetic healthcare dataset that simulates real-world encrypted Personal Health Record (PHR) workflows, ensuring empirical reproducibility. Finally, the research aims to examine the scalability and practical feasibility of deploying the integrated FHE–ESSE–ABS system in long-term, cloud-based health monitoring scenarios to assess its robustness under realistic operational conditions.
Methods
This study employs a sequential exploratory methodology that integrates conceptual framework development, cryptographic algorithm design, and simulation-based evaluation. Building upon a comprehensive foundation of existing literature, it ensures methodological transparency through detailed documentation of system design, dataset construction, and the implementation of the proposed cryptographic components.
Research framework and system overview
This study introduces a privacy-preserving healthcare blockchain framework that integrates three advanced cryptographic modules within a cloud-hosted architecture. The first component, Fully Homomorphic Encryption (FHE), enables computations to be performed directly on encrypted data without the need for decryption, thereby ensuring end-to-end confidentiality throughout the data processing lifecycle. The second component, Extended Secure Searchable Encryption (ESSE), supports privacy-preserving keyword-based search operations, allowing users to query encrypted datasets without revealing the content of their queries or the associated metadata. The third component, Attribute-Based Signature (ABS), provides decentralized, role-based access control with fine-grained authorization policies, ensuring that only credentialed users can access or manipulate encrypted healthcare records. Together, these modules form a cohesive and secure framework that supports encrypted computation, confidential data retrieval, and robust access control in distributed healthcare cloud environments.
These modules are embedded within a conceptual design based on the Hyperledger Fabric platform, chosen for its modular architecture, permissioned access, and suitability for healthcare consortia. While blockchain processes were modeled conceptually in Hyperledger Fabric, the cryptographic operations were implemented and simulated in MATLAB to evaluate system performance and operational feasibility.
As illustrated in Figure 1, the workflow begins with patient health data generated by mobile or IoT-enabled devices. The data are encrypted using the FHE module before being uploaded to a blockchain-integrated cloud. Authorized users may then issue encrypted keyword queries through the ESSE module, which conceals both the query terms and corresponding search results. Simultaneously, the ABS module verifies user credentials and enforces attribute-based access policies, ensuring that only authorized users can search, access, or perform computations on encrypted records. End-to-end workflow for privacy-preserving healthcare data management. 
All computations are executed directly on ciphertext, thereby preserving confidentiality throughout the entire data lifecycle. The encrypted outputs are returned to the requesting user, who decrypts the results locally. This integration of FHE, ESSE, and ABS guarantees end-to-end data confidentiality, privacy-preserving query execution, and decentralized access control. The process is further formalized in Algorithm 1, which specifies each operational step of the secure data management protocol.
Patient data generated by IoT or mobile devices is encrypted using Fully Homomorphic Encryption (FHE) and stored in a Hyperledger Fabric–based blockchain cloud. Encrypted keyword queries are executed through the Extended Secure Searchable Encryption (ESSE) engine, while the Attribute-Based Signature (ABS) module enforces decentralized, role-based access control. All computations are performed directly on ciphertext to preserve confidentiality and query privacy. Final results are returned in encrypted form and decrypted locally by authorized users.
Access to encrypted Personal Health Records (PHRs) is strictly regulated by the Attribute-Based Signature (ABS) module, which verifies user credentials against predefined policy rules before permitting any operation. By orchestrating the integration of Fully Homomorphic Encryption (FHE), Extended Secure Searchable Encryption (ESSE), and ABS within a modular, trust-based framework, the proposed protocol ensures scalability while maintaining privacy, accountability, and security. This design guarantees that patient records remain encrypted, searchable, and accessible only to authorized users, thereby preserving confidentiality and data integrity throughout the entire information lifecycle.
Dataset description and relevance
A structured dataset comprising 1,000 anonymized synthetic patient records was developed to simulate encrypted Personal Health Record (PHR) workflows. Each record included five medically relevant attributes: patient age, tumor diagnosis label, mobile phone usage duration, radiation exposure level, and risk classification. The average record size was approximately 1 KB, consistent with outpatient diagnostic data typically collected from wearable medical devices.
The dataset was generated in MATLAB and modeled after the publicly available Cell-Phone Brain Tumour dataset on Kaggle, 40 but was scaled and restructured to support encrypted computation and searchable query evaluation. This design enabled a dual-mode validation of the proposed cryptographic system. The Extended Secure Searchable Encryption (ESSE) module was utilized to assess the framework’s capability for keyword-based search, whereas the Fully Homomorphic Encryption (FHE) engine was used to evaluate its performance in executing numerical operations on encrypted data.
To approximate realistic PHR use cases, each dataset row was treated as an encrypted document block. Diagnostic labels were transformed into searchable keywords to facilitate secure querying through the ESSE module, while numerical attributes such as patient age and radiation exposure levels were processed using encrypted arithmetic operations within the FHE engine. By integrating both categorical and numerical data, the synthetic dataset established a controlled, reproducible, and ethically compliant testbed for evaluating system performance, accuracy, and privacy preservation. This approach avoided the ethical and regulatory challenges associated with using real patient data while maintaining fidelity to realistic healthcare scenarios.
Development of extended multi-user ESSE
Traditional searchable encryption schemes exhibit well-documented limitations in scalability and are susceptible to threats such as key leakage, user collusion, and access-pattern inference attacks.14,15 To mitigate these challenges, this study introduces an Extended Multi-User Secure Searchable Encryption (ESSE) protocol, derived from the Oblivious Cross-Tags (OXT) framework and adapted for decentralized, privacy-preserving healthcare environments.
The enhanced Extended Secure Searchable Encryption (ESSE) model was designed with three core capabilities. First, it supports encrypted keyword search, enabling users to perform secure queries across user-specific ciphertext blocks without revealing the query content or associated metadata. Second, it incorporates role-based authentication mechanisms that employ cryptographic credentials to ensure that only authorized users can execute search operations. Third, it implements inference-resistance techniques that leverage obfuscation strategies to mitigate index-pattern leakage, thereby preserving the confidentiality of both search terms and retrieval outcomes.
The protocol was implemented in MATLAB and evaluated using benchmark encrypted query datasets. Its performance was assessed using three primary metrics: (1) query correctness, which measures the accuracy of retrieved results; (2) throughput, defined as the number of secure queries processed per second; and (3) leakage resistance, which quantifies the system’s resilience against inference-based attacks. By integrating privacy-preserving cryptographic mechanisms with optimized query execution, the enhanced ESSE model demonstrates the feasibility and scalability of secure keyword searches in multi-user healthcare blockchain environments.
Implementation of FHE operations and evaluation
Summary of cryptographic implementation and evaluation settings.
As shown in Table 1, the reported metrics were derived from MATLAB R2023a simulations using a BFV-inspired Fully Homomorphic Encryption (FHE) scheme, an OXT-based Extended Secure Searchable Encryption (ESSE) model, and a dual-policy Attribute-Based Signature (ABS) mechanism. The encryption and computation times represent the average runtime required to process 1 KB encrypted records across five independent simulation runs. Accuracy denotes the percentage of correct decryptions observed under progressively increasing multiplicative depths. ESSE throughput was evaluated by executing 1,000 randomized encrypted queries, while the success rate corresponds to the proportion of correctly retrieved ciphertexts. ABS accuracy and the false-positive rate were measured by authenticating 500 simulated user requests generated under diverse attribute profiles.
Collectively, these quantitative results offer empirical validation of the feasibility and robustness of each cryptographic component within the proposed framework, replacing qualitative descriptions with reproducible, performance-driven evaluation criteria.
Cloud integration and ABS for fine-grained access control
The cloud computing environment, simulated in MATLAB, was integrated with an Attribute-Based Signature (ABS) mechanism to facilitate decentralized and privacy-preserving access control. The proposed ABS scheme employs a dual-policy model that combines attribute-matching logic with temporal validity constraints. This design ensures that access to encrypted Personal Health Records (PHRs) is granted exclusively to users who (i) possess valid cryptographic credentials and (ii) operate within an authorized time window.16–18
This integration enables the system to enforce fine-grained access policies, in which user permissions are derived from both role-based attributes (e.g., clinician, researcher, administrator) and context-aware conditions (e.g., time of access, authorization level). Notably, the ABS mechanism accomplishes this without disclosing sensitive identity information, thereby preserving user anonymity and maintaining compliance with privacy regulations.
By mitigating risks such as key misuse, impersonation, and unauthorized data exposure, the ABS module strengthens both the security and usability of distributed healthcare ecosystems. In doing so, ABS effectively complements the FHE and ESSE modules by ensuring that only properly authorized users can perform secure searches or encrypted computations on medical data, while maintaining full confidentiality and integrity across the data lifecycle.
Protocol development within Hyperledger Fabric
The system architecture was conceptually designed using the Hyperledger Fabric permissioned blockchain framework, selected for its modular structure, role-based access control, and suitability for consortium-oriented healthcare environments. Although a full-scale deployment was not performed, key architectural elements—such as smart contract logic, block transaction workflows, and chain code interactions—were simulated to evaluate the feasibility, security, and integrity of the proposed design.
The integration of the core cryptographic components—Fully Homomorphic Encryption (FHE), Extended Secure Searchable Encryption (ESSE), and Attribute-Based Signature (ABS)—was accomplished within a modular, trust-based framework. This configuration enables secure transaction validation, decentralized access enforcement, and interoperability across cryptographic and blockchain layers.
The conceptual simulation confirms that the proposed Hyperledger Fabric–based architecture can effectively manage secure, privacy-preserving, and auditable healthcare data exchange across distributed ecosystems, while maintaining computational efficiency, data confidentiality, and regulatory compliance.
Validation and simulation-based evaluation
The proposed cryptographic framework was validated through simulation experiments conducted in MATLAB R2022b on a Windows 10 platform equipped with an Intel® Core™ i7-12700H CPU and 16 GB RAM. To ensure statistical robustness, five independent runs were performed under varying noise budgets and access patterns.
System performance was evaluated using four primary indicators designed to measure both computational efficiency and security reliability. The first indicator, encryption latency, quantified the time required to encrypt individual data blocks within the simulated environment. The second, query throughput, assessed operational capacity, averaging 20 secure queries per second under the Extended Secure Searchable Encryption (ESSE) protocol. The third indicator, access-control accuracy, evaluated the effectiveness of the Attribute-Based Signature (ABS) module, achieving a 97% success rate in authenticating authorized users. The final indicator, the false-positive rate, measured at 0.002%, represented the proportion of unauthorized users incorrectly granted access—thereby reflecting the precision and trustworthiness of the proposed access-control mechanism. In this context, access-control accuracy denoted the proportion of legitimate users correctly authenticated, whereas the false-positive rate quantified erroneous access permissions.
Comparative Performance Analysis: FHE–ESSE–ABS Framework versus Traditional Encryption (RSA + AES + Keyword Masking).
Table 2 illustrates the trade-offs between the proposed FHE–ESSE–ABS framework and traditional RSA + AES with keyword masking. While the baseline approach achieves faster encryption (0.02 s vs 2.5 s) and higher query throughput (100 vs 20 queries per second), it lacks the ability to support encrypted computation, which is central to privacy-preserving analytics. Our framework achieves 92% accuracy in homomorphic operations, enabling secure arithmetic over encrypted health records. Search privacy is classified as “high” because ESSE conceals both query tokens and access patterns, in contrast to AES-based keyword masking, which may leak query frequency. Similarly, access control is considered “fine-grained” because ABS enforces role- and attribute-driven authorization with demonstrated 97% accuracy and a false positive rate of 0.002%, whereas RSA/AES are limited to single-key, identity-based access. These distinctions justify the qualitative labels in Table 2 and highlight the privacy and security benefits of the proposed approach despite its higher computational overhead.
Results
Fully homomorphic encryption (FHE) performance evaluation
The performance of the Fully Homomorphic Encryption (FHE) module was evaluated through MATLAB R2023a simulations employing customized polynomial arithmetic routines derived from the Brakerski/Fan-Vercauteren (BFV) scheme. The assessment focused on computational efficiency, decryption accuracy, and latency within the context of privacy-preserving healthcare data processing.
The experimental results revealed several key performance characteristics. The average encryption time was approximately 2.5 s per 1 KB Personal Health Record (PHR), while each encrypted arithmetic operation—encompassing both addition and multiplication—required around 4.8 s to execute. The decryption accuracy remained consistently high, achieving a 92% correctness rate across varying multiplicative depths, thereby confirming the reliability of computation under different workload conditions. Moreover, the system exhibited an operational latency of approximately 150 milliseconds per operation under low-noise simulation settings, underscoring its suitability for privacy-preserving computation in encrypted healthcare workflows.
Core performance metrics of the proposed privacy-preserving healthcare framework.
FHE security validation
The Fully Homomorphic Encryption (FHE) module underwent a comprehensive security evaluation to verify its ability to preserve data confidentiality, maintain computational integrity, and resist adversarial attacks. The validation process confirmed the system’s resilience against both known-plaintext and chosen-ciphertext attacks under simulated threat conditions.
The implementation consistently maintained data integrity, with all homomorphic computations decrypting accurately across multiple multiplicative depths. Furthermore, no leakage of intermediate plaintext information was detected during the encryption, computation, or decryption phases, confirming full confidentiality preservation throughout the cryptographic process.
These results collectively demonstrate the cryptographic robustness and operational reliability of the FHE module for secure healthcare data processing within cloud-based environments. Simulated adversarial analyses and ciphertext-pattern evaluations revealed no observable leakage vectors or access-pattern vulnerabilities within the tested configurations. Together, these findings confirm the cryptographic soundness and practical suitability of the FHE implementation for privacy-preserving computation in decentralized and security-critical healthcare systems.
Extended Secure Searchable Encryption (ESSE) evaluation
The Extended Secure Searchable Encryption (ESSE) module was evaluated to determine its effectiveness in enabling privacy-preserving, keyword-based search operations within a multi-user environment governed by attribute-based access constraints.
Performance results demonstrated
The performance evaluation of the Extended Secure Searchable Encryption (ESSE) module demonstrated its effectiveness in enabling privacy-preserving, keyword-based retrieval across encrypted healthcare datasets. The system achieved a query success rate of 85%, indicating a high level of accuracy in matching and retrieving encrypted ciphertexts. Furthermore, the implementation sustained an average query throughput of 20 secure queries per second under a single-threaded MATLAB simulation, confirming its computational efficiency under realistic operational conditions.
As summarized in Table 3, the ESSE protocol exhibited strong resistance to access-pattern leakage and index-inference attacks, validating its capability to preserve both data confidentiality and query privacy. Collectively, these findings affirm the efficiency, scalability, and robustness of the ESSE model for secure multi-user query processing within distributed healthcare blockchain systems.
Attribute-Based Signature (ABS) evaluation
The Attribute-Based Signature (ABS) module was evaluated to assess its effectiveness in enforcing decentralized, role-based access control across distributed healthcare environments. The evaluation focused on quantifying the module’s access validation accuracy, false positive rate, and overall reliability in managing multi-user authentication under diverse policy and attribute constraints.
ABS performance metrics
The Attribute-Based Signature (ABS) module was evaluated to determine its effectiveness in enforcing decentralized, role-based access control across distributed healthcare environments. The evaluation revealed an access validation accuracy of 97%, demonstrating a high success rate in authenticating authorized users, accompanied by a false positive rate of only 0.002%, which reflects strong resilience against unauthorized access attempts. These results confirm the robustness and reliability of the ABS mechanism in achieving scalable, fine-grained, and privacy-preserving access enforcement. By ensuring that only credentialed users possessing the appropriate attribute sets can access or manipulate encrypted Personal Health Records (PHRs), the ABS module significantly strengthens trust, accountability, and data confidentiality within multi-user healthcare systems.
Integrated protocol and cloud simulation
The fully integrated privacy-preserving protocol, incorporating Fully Homomorphic Encryption (FHE), Extended Secure Searchable Encryption (ESSE), and Attribute-Based Signature (ABS), was evaluated within a simulated cloud environment modeled on the Hyperledger Fabric permissioned blockchain framework. The primary objective of this evaluation was to assess the end-to-end performance, scalability, and security of the proposed architecture under healthcare-oriented workloads, thereby determining its feasibility for secure and efficient medical data management in distributed cloud infrastructures.
Experimental outcomes and integrated metrics
The integrated evaluation of the proposed privacy-preserving framework—incorporating Fully Homomorphic Encryption (FHE), Extended Secure Searchable Encryption (ESSE), and Attribute-Based Signature (ABS)—demonstrated consistent and well-balanced performance across all cryptographic modules. The FHE component achieved an average encryption time of approximately 2.5 s per record and a computation time of 4.8 s per encrypted operation, with a 92% decryption correctness rate maintained under controlled noise conditions. The ESSE module recorded a query success rate of 85% and sustained a throughput of 20 secure queries per second in MATLAB-based simulations. Likewise, the ABS mechanism attained a 97% authentication accuracy with an exceptionally low false positive rate of 0.002%, underscoring its reliability and precision in enforcing decentralized access control.
When evaluated as a fully integrated system, the framework achieved an overall operational efficiency of 94%, reflecting balanced trade-offs among encryption, search, and access control operations. These quantitative outcomes confirm the framework’s efficiency, scalability, and robustness, establishing its practical feasibility for privacy-preserving healthcare data management within blockchain-enabled cloud infrastructures.
System consistency across simulation runs
To assess the robustness and operational reliability of the proposed framework, ten independent simulation runs were conducted under diverse experimental conditions. These variations encompassed adjustments in ciphertext noise thresholds, input record sizes, access control policies, and user attribute configurations. The evaluation focused on four principal performance indicators: encryption latency, homomorphic operation time, data confidentiality, and access control accuracy.
Performance and security variability across simulation runs.
Furthermore, the Attribute-Based Signature (ABS) module consistently enforced predefined access control policies, accurately authenticating legitimate users while preventing unauthorized access in every configuration tested. These reproducible findings confirm that the integrated FHE–ESSE–ABS framework delivers stable performance, strong confidentiality guarantees, and reliable access enforcement across heterogeneous simulation environments. Collectively, the results underscore the framework’s suitability for dynamic, multi-user healthcare ecosystems requiring both scalability and security.
Deployment considerations and limitations
Although the proposed FHE–ESSE–ABS framework demonstrates strong security and functional performance within simulated environments, several practical challenges persist that may impede its direct deployment in real-world, cloud-based healthcare systems.
The first challenge concerns computational overhead, as the Fully Homomorphic Encryption (FHE) component introduces significant latency. Simulation results indicate that encrypting a single 1 KB record requires approximately 2.5 s, whereas each homomorphic computation consumes about 4.8 s. Such delays may restrict the framework’s applicability in time-critical healthcare settings, including emergency diagnostics and intensive care applications, where rapid data processing and low-latency computation are imperative.
A second limitation involves ciphertext expansion, since the FHE process generates encrypted outputs approximately five times larger than the corresponding plaintexts. This expansion increases both storage overhead and network transmission load, presenting scalability challenges in high-throughput or bandwidth-constrained environments.
Finally, the management of access control policies introduces additional complexity. Although the Attribute-Based Signature (ABS) module effectively enforces decentralized, role-based access control, it depends on secure attribute-token management and frequent policy updates to preserve accuracy and trust. These administrative requirements may complicate integration within federated or multi-institutional healthcare ecosystems, where governance structures, authorization hierarchies, and compliance standards often vary.
Future directions
To address the identified limitations and enhance the practical viability of the proposed FHE–ESSE–ABS framework, several strategic directions are recommended for future research.
First, lightweight cryptographic optimizations should be pursued to mitigate computational latency while preserving privacy guarantees. Hybrid cryptographic architectures that integrate leveled Fully Homomorphic Encryption (FHE) with symmetric encryption primitives can substantially reduce both encryption and computation time without compromising data confidentiality. Such hybridization offers a viable pathway toward balancing performance efficiency and cryptographic strength in privacy-sensitive healthcare applications.
Second, a comprehensive scalability analysis is necessary to assess the framework’s robustness under realistic operational conditions. This entails conducting stress tests across diverse configurations—varying user populations, concurrent encrypted query volumes, and heterogeneous workload distributions—to evaluate system responsiveness, fault tolerance, and operational reliability during simulated real-world deployments. These experiments would provide deeper insight into the framework’s adaptability and its ability to maintain stable performance on a scale.
Finally, incorporating parallel and accelerated computation techniques will be essential for improving runtime efficiency. The adoption of GPU-accelerated computation and multi-threaded processing pipelines could markedly enhance throughput, particularly when handling large-scale encrypted healthcare datasets. By distributing cryptographic workloads across multiple computational units, such optimization would enable near real-time performance in high-demand healthcare environments.
Collectively, these enhancements would advance the framework’s readiness for practical implementation in privacy-critical healthcare infrastructures. Despite current computational constraints, the proposed FHE–ESSE–ABS framework establishes a robust foundation for secure, scalable, and privacy-preserving healthcare analytics, particularly in applications where confidentiality, integrity, and regulatory compliance outweigh the need for strict real-time responsiveness.
Discussion
The experimental results confirm the viability of the proposed FHE–ESSE–ABS framework as a secure and comprehensive architecture for privacy-preserving healthcare data management in blockchain-enabled cloud environments. The integration of Fully Homomorphic Encryption (FHE) enables computation directly on encrypted data, thereby ensuring end-to-end confidentiality throughout the data lifecycle. In parallel, the Extended Secure Searchable Encryption (ESSE) module facilitates privacy-preserving keyword queries, while the Attribute-Based Signature (ABS) scheme enforces decentralized, role-based access control with fine-grained authorization.
When compared to traditional cryptographic schemes such as RSA and AES combined with keyword masking, the proposed framework demonstrates substantial advantages in data privacy, resilience to inference and access-pattern attacks, and the ability to perform secure computations on encrypted records. However, these benefits come with performance trade-offs. The measured encryption and computation latencies—approximately 2.5 s and 4.8 s per 1 KB record, respectively—are higher than those observed in conventional systems. Such latency may restrict the framework’s applicability in real-time or critical-care scenarios, including emergency diagnostics and intensive care monitoring.
Despite these computational overheads, the ABS module exhibited exceptional access control performance, achieving 97% authorization accuracy with a false positive rate of only 0.002%. These outcomes highlight the robustness of decentralized access control across heterogeneous user roles and multi-institutional healthcare networks. Although FHE introduces a ciphertext expansion of approximately five times the original plaintext size, the system maintained a practical query throughput of 20 encrypted searches per second, thereby validating its feasibility for moderate-scale healthcare workloads.
Overall, the proposed framework is best suited for scenarios where computational latency is not the primary constraint, and where confidentiality, auditability, and regulatory compliance are of paramount importance. Representative applications include medical record archiving, post-treatment analytics, privacy-aware telemedicine, patient-consented research data sharing, and the generation of auditable healthcare governance trails. Furthermore, advances in blockchain consensus mechanisms, such as symbiotic consensus for scalable and energy-efficient networks, 41 could further enhance the adaptability and sustainability of the proposed architecture in future deployments.
Limitations
Despite the encouraging results, several limitations must be acknowledged. First, although Internet of Things (IoT) and wearable devices were discussed as motivating sources of healthcare data, they were not directly implemented in this study. Instead, synthetic attributes—such as mobile usage duration and radiation exposure—were designed to emulate IoT-generated data without incorporating real-time wireless tracking vulnerabilities observed in systems such as WI Shield. 42
Second, the framework’s reliance on Fully Homomorphic Encryption (FHE) introduces considerable computational overhead, which may restrict its applicability in latency-sensitive clinical contexts, including emergency response and intensive care units (ICUs).
Third, the observed ciphertext expansion (approximately 5×) significantly increases both storage and bandwidth requirements, raising scalability concerns for large-scale healthcare deployments.
Fourth, while the Attribute-Based Signature (ABS) mechanism provides robust, decentralized access control, its practical implementation would necessitate continuous credential management and frequent policy synchronization—operational challenges that could be amplified in federated or multi-institutional healthcare ecosystems.
Furthermore, this study employed a synthetic dataset rather than real-world Electronic Health Records (EHRs). Although this approach effectively mitigated privacy concerns, it may not fully capture the heterogeneity, noise, and clinical complexity inherent in operational healthcare data.
Finally, bootstrapping was deliberately excluded from the FHE simulations to reduce implementation complexity, thereby limiting the assessment of long-term encrypted computations under continuous workloads.
Collectively, these limitations underscore the need for further optimization of cryptographic performance, validation using authentic healthcare datasets, and pilot-scale deployments in real-world clinical environments before the proposed framework can be adopted at scale.
Future research directions
To enhance the scalability, adaptability, and deployment readiness of the proposed FHE–ESSE–ABS framework for real-world healthcare applications, several key research directions are recommended. First, comprehensive scalability and resilience testing should be conducted to evaluate system performance under realistic production conditions. Stress testing with variable user loads, concurrent encrypted queries, and distributed blockchain nodes will provide deeper insights into the framework’s fault tolerance, throughput limitations, and cloud deployment feasibility. Furthermore, emerging 6G-enabled blockchain communication paradigms 43 and adaptive consensus control mechanisms 44 may substantially enhance scalability, privacy preservation, and trustworthiness across distributed environments.
Second, the exploration of hybrid cryptographic architecture represents a promising avenue for mitigating computational latency without compromising data confidentiality. Integrating leveled or partially homomorphic encryption schemes with lightweight symmetric-key primitives could achieve an optimal balance between performance and security. Additionally, adopting post-quantum secure searchable encryption approaches 45 would bolster long-term resilience against quantum-enabled adversaries, effectively future-proofing healthcare data systems.
Third, hardware acceleration presents a practical opportunity to improve efficiency. Implementing encryption, search, and access control modules on GPUs or FPGAs could significantly enhance system throughput and reduce latency. Such acceleration would be particularly beneficial for large-scale hospital infrastructures and high-frequency query environments, where computational demand is substantial.
Fourth, further validation using real-world datasets is crucial to assess the framework’s operational feasibility and regulatory compliance. Collaborations with healthcare institutions to access authentic Electronic Health Record (EHR) datasets would facilitate evaluations under realistic clinical conditions, including adherence to HIPAA and GDPR standards. Moreover, integrating age-dependent differential privacy techniques 46 could mitigate re-identification risks within sensitive demographic populations. Expanding empirical validation to include biomedical sequence data—such as genomic and proteomic datasets—using advanced models like SBSM-Pro 47 and single-cell transcriptomic analyses for gene regulatory network inference 48 would further demonstrate scalability and adaptability across diverse healthcare domains.
Finally, advancements in dynamic policy management within the ABS module are recommended. Supporting real-time modification of access control policies without re-encrypting existing data would enhance flexibility and governance in evolving clinical and research contexts. Parallel integration of intrusion detection systems employing ensemble classification and feature selection techniques 49 could further fortify the framework against adversarial attacks and insider threats, maintaining continuous security integrity during system operation.
Collectively, these research directions will advance the framework’s technological maturity and facilitate its transition from simulation to real-world implementation, ensuring compliance with the highest standards of privacy, scalability, and regulatory oversight. By addressing these areas, the proposed architecture can evolve into a deployable solution for secure, scalable, and privacy-compliant healthcare data management across multi-institutional cloud infrastructures. Furthermore, the integration of graph-based deep learning approaches 50 may enable enhanced predictive analytics and intelligent decision support, further expanding the framework’s potential in next-generation healthcare informatics.
Conclusion
This study proposed a unified cryptographic framework for secure and privacy-preserving healthcare data management within blockchain-enabled cloud infrastructures. By integrating Fully Homomorphic Encryption (FHE), Extended Multi-User Secure Searchable Encryption (ESSE), and Attribute-Based Signature (ABS), the proposed system enables encrypted computation, privacy-preserving search, and decentralized, fine-grained access control across distributed healthcare environments.
Simulation results confirmed the practicality and robustness of the proposed architecture under healthcare-oriented workloads. Specifically, the FHE module achieved an average encryption time of approximately 2.5 s and a computation time of 4.8 s per 1 KB record. The ESSE component sustained an 85% query success rate with a throughput of 20 secure queries per second, while the ABS mechanism enforced access control with 97% authentication accuracy and an exceptionally low false positive rate of 0.002%. Although FHE introduced a computational overhead and ciphertext expansion of approximately five times the plaintext size, the integrated framework maintained an overall operational efficiency of 94%, delivering consistent performance across heterogeneous simulation conditions.
Collectively, these findings validate the feasibility and security of deploying the FHE–ESSE–ABS framework in healthcare ecosystems where confidentiality, auditability, and query privacy are of critical importance. The framework establishes a solid foundation for future research on scalable and privacy-compliant medical data systems. Future extensions will focus on hardware acceleration, empirical validation using real-world Electronic Health Records (EHRs), and the incorporation of adaptive analytics and dynamic policy management to improve scalability, responsiveness, and resilience. Additionally, the direct integration of IoT and wearable device data streams into the blockchain layer will be explored to evaluate performance under real-time, continuous health monitoring scenarios.
Additional data and performance results are provided in the online Supplemental Material (available at https://doi.org/10.1177/14604582251394616).
Supplemental Material
Supplemental Material - Performance and security analysis of fully homomorphic encryption in cloud-based healthcare blockchain
Supplemental Material for Performance and security analysis of fully homomorphic encryption in cloud-based healthcare blockchain by Salah ElDin Zaher Olaymi in Health Informatics Journal.
Supplemental Material
Supplemental Material - Performance and security analysis of fully homomorphic encryption in cloud-based healthcare blockchain
Supplemental Material for Performance and security analysis of fully homomorphic encryption in cloud-based healthcare blockchain by Salah ElDin Zaher Olaymi in Health Informatics Journal.
Footnotes
Acknowledgments
Author contributions
Funding
Declaration of conflicting interests
Supplemental Material
References
Supplementary Material
Please find the following supplemental material available below.
For Open Access articles published under a Creative Commons License, all supplemental material carries the same license as the article it is associated with.
For non-Open Access articles published, all supplemental material carries a non-exclusive license, and permission requests for re-use of supplemental material or any part of supplemental material shall be sent directly to the copyright owner as specified in the copyright notice associated with the article.
