Enhancing Patient Data Privacy in Healthcare Networks Using RSA-Based Hybrid Encryption
Keywords:
Patient data privacy, RSA encryption, hybrid encryption, AES, healthcare networks, electronic health records, cybersecurityAbstract
The increasing adoption of electronic health records (EHRs) and interconnected healthcare networks has heightened concerns about patient data privacy, confidentiality, and secure information exchange. This study evaluates the effectiveness and computational performance of Rivest-Shamir-Adleman (RSA) encryption alongside Advanced Encryption Standard (AES), Elliptic Curve Cryptography (ECC), and ElGamal in securing patient data transmitted across healthcare networks. An experimental, simulation-based approach was adopted using Python and PyCryptodome to assess encryption and decryption times, CPU utilisation, memory consumption, throughput, security strength, and key management efficiency. A simulated dataset comprising 500 to 1,000 patient records was used to represent information exchange between a primary healthcare centre and a general hospital in Jalingo, Nigeria. The reported results showed that AES achieved the lowest encryption time of 8 ms and CPU utilisation of 15%, compared with RSA (12 ms; 70%), ECC (45 ms; 40%), and ElGamal (110 ms; 75%). RSA recorded a decryption time of 10 ms, while AES, ECC, and ElGamal recorded 14 ms, 60 ms, and 125 ms, respectively. The study further reported security strength scores of 98% for RSA, 95% for ECC, 88% for ElGamal, and 85% for AES. These findings indicate differences in computational requirements and performance among the evaluated algorithms. The study concludes that although RSA offers advantages for public-key operations and key protection, its computational requirements make it less suitable for bulk patient data encryption. Consequently, an RSA–AES hybrid encryption approach is recommended to combine RSA-based key protection with the computational efficiency of AES for securing healthcare information exchange.
References
1. Alotaibi, Y. K., & Federico, F. (2017). The impact of health information technology on patient safety. Saudi Medical Journal, 38(12), 1173–1180. https://doi.org/10.15537/smj.2017.12.20631
2. Barker, E. (2020). Recommendation for key management: Part 1, General (NIST Special Publication 800-57 Part 1, Revision 5). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-57pt1r5
3. Barker, E., Chen, L., Roginsky, A., Vassilev, A., & Davis, R. (2018). Recommendation for pair-wise key-establishment schemes using discrete logarithm cryptography (NIST Special Publication 800-56A, Revision 3). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-56Ar3
4. Barker, E., Chen, L., Roginsky, A., Vassilev, A., Davis, R., & Simon, S. (2019). Recommendation for pair-wise key-establishment using integer factorization cryptography (NIST Special Publication 800-56B, Revision 2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-56Br2
5. Barker, E., & Roginsky, A. (2019). Transitioning the use of cryptographic algorithms and key lengths (NIST Special Publication 800-131A, Revision 2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-131Ar2
6. Barker, E., Roginsky, A., & Davis, R. (2020). Recommendation for cryptographic key generation (NIST Special Publication 800-133, Revision 2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-133r2
7. Barnes, R., Bhargavan, K., Lipp, B., & Wood, C. A. (2022). Hybrid public key encryption (RFC 9180). Internet Research Task Force. https://doi.org/10.17487/RFC9180
8. Dworkin, M. (2007). Recommendation for block cipher modes of operation: Galois/Counter Mode (GCM) and GMAC (NIST Special Publication 800-38D). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-38D
9. Dworkin, M. (2012). Recommendation for block cipher modes of operation: Methods for key wrapping (NIST Special Publication 800-38F). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-38F
10. Fernández-Alemán, J. L., Carrión Señor, I., Oliver Lozoya, P. Á., & Toval, A. (2013). Security and privacy in electronic health records: A systematic literature review. Journal of Biomedical Informatics, 46(3), 541–562. https://doi.org/10.1016/j.jbi.2012.12.003
11. Kruse, C. S., Frederick, B., Jacobson, T., & Monticone, D. K. (2017). Cybersecurity in healthcare: A systematic review of modern threats and trends. Technology and Health Care, 25(1), 1–10. https://doi.org/10.3233/THC-161263
12. Kumar, M., Mukherjee, P., Verma, S., Kavita, Kaur, M., Singh, S., Kobielnik, M., Woźniak, M., Shafi, J., & Ijaz, M. F. (2022). BBNSF: Blockchain-based novel secure framework using RP²-RSA and ASR-ANN technique for IoT enabled healthcare systems. Sensors, 22(23), Article 9448. https://doi.org/10.3390/s22239448
13. Moriarty, K., Kaliski, B., Jonsson, J., & Rusch, A. (2016). PKCS #1: RSA cryptography specifications version 2.2 (RFC 8017). Internet Engineering Task Force. https://doi.org/10.17487/RFC8017
14. National Institute of Standards and Technology. (2023a). Advanced Encryption Standard (AES) (Federal Information Processing Standards Publication 197, Updated May 9, 2023). U.S. Department of Commerce. https://doi.org/10.6028/NIST.FIPS.197-upd1
15. National Institute of Standards and Technology. (2023b). Digital Signature Standard (DSS) (Federal Information Processing Standards Publication 186-5). U.S. Department of Commerce. https://doi.org/10.6028/NIST.FIPS.186-5
16. National Institute of Standards and Technology. (2024). Module-lattice-based key-encapsulation mechanism standard (Federal Information Processing Standards Publication 203). U.S. Department of Commerce. https://doi.org/10.6028/NIST.FIPS.203
17. Rescorla, E. (2018). The Transport Layer Security (TLS) protocol version 1.3 (RFC 8446). Internet Engineering Task Force. https://doi.org/10.17487/RFC8446
18. Rivest, R. L., Shamir, A., & Adleman, L. (1978). A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, 21(2), 120–126. https://doi.org/10.1145/359340.359342 Rogers, E. M. (2003). Diffusion of innovations (5th ed.). Free Press.
19. Rossetto, A. G. de M., Sega, C., & Leithardt, V. R. Q. (2022). An architecture for managing data privacy in healthcare with blockchain. Sensors, 22(21), Article 8292. https://doi.org/10.3390/s22218292
20. Ross, R., & Pillitteri, V. (2020). Security and privacy controls for information systems and organizations (NIST Special Publication 800-53, Revision 5). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-53r5
21. Stallings, W. (2023). Cryptography and network security: Principles and practice (8th ed., Global ed.). Pearson.
22. Thapa, C., & Camtepe, S. (2021). Precision health data: Requirements, challenges and existing techniques for data security and privacy. Computers in Biology and Medicine, 129, Article 104130. https://doi.org/10.1016/j.compbiomed.2020.104130
23. U.S. Department of Health and Human Services. (n.d.). Summary of the HIPAA Security Rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
24. Venkatesh, V., & Davis, F. D. (2000). A theoretical extension of the technology acceptance model: Four longitudinal field studies. Management Science, 46(2), 186–204. https://doi.org/10.1287/mnsc.46.2.186.11926
25. World Health Organization. (2021). Global strategy on digital health 2020–2025. World Health Organization. https://www.who.int/publications/i/item/9789240020924
