[Paper Review] Blockchain-based Decentralized Identity Management for Healthcare Systems

Arnaf Aziz Torongo, Mohsen Toorani|arXiv (Cornell University)|Jul 30, 2023

Blockchain Technology Applications and Security4 citations

TL;DR

This paper proposes BDIMHS, a blockchain-based decentralized identity management system for healthcare using Hyperledger Indy and Aries to enable patient-controlled, verifiable credentials with selective disclosure and zero-knowledge proofs. The solution achieves strong security, privacy, and interoperability while demonstrating scalable performance in a proof-of-concept implementation with low latency and efficient resource utilization.

ABSTRACT

Blockchain-based decentralized identity management provides a promising solution to improve the security and privacy of healthcare systems and make them scalable. Traditional Identity Management Systems are centralized, which makes them single-point-of-failure, vulnerable to attacks and data breaches, and non-scalable. In contrast, decentralized identity management based on the blockchain can ensure secure and transparent access to patient data while preserving privacy. This approach enables patients to control their personal health data while granting permission for medical personnel to access specific information as needed. We propose a decentralized identity management system for healthcare systems named BDIMHS based on a permissioned blockchain with Hyperledger Indy and Hyperledger Aries. We develop further descriptions of required functionalities and provide high-level procedures for network initialization, enrollment, registration, issuance, verification and revocation functionalities. The proposed solution improves data security, privacy, immutability, interoperability, and patient autonomy by using selective disclosure, zero-knowledge proofs, Decentralized Identifiers, and Verifiable Credentials. Furthermore, we discuss the potential challenges associated with implementing this technology in healthcare and evaluate the performance and security of the proposed solution.

Motivation & Objective

• To address the security, privacy, and scalability limitations of centralized identity management systems in healthcare.
• To enable patient autonomy by allowing individuals to control their personal health data through self-sovereign identity (SSI).
• To ensure interoperability across healthcare entities using W3C-standardized Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs).
• To evaluate the performance, security, and resource efficiency of a permissioned blockchain-based identity solution in a real-world healthcare context.
• To provide a comprehensive implementation and analysis of a decentralized identity framework tailored for electronic health records and clinical workflows.

Proposed method

• The system is built on a permissioned blockchain using Hyperledger Indy and Hyperledger Aries to manage identity lifecycle operations such as network initialization, enrollment, registration, credential issuance, verification, and revocation.
• It leverages Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) to enable trustless, cryptographically verifiable identity assertions without centralized authorities.
• Selective disclosure and zero-knowledge proofs are implemented to protect privacy by allowing users to reveal only necessary information during authentication or access requests.
• The architecture supports a trust triangle among Issuer, Holder (patient), and Verifier (healthcare provider), ensuring end-to-end security and non-repudiation.
• A proof-of-concept (PoC) implementation is developed with agents representing government, patient, and hospital roles to simulate real-world identity flows.
• Performance is evaluated through load testing with varying request concurrency, measuring transaction time, throughput, and resource utilization (CPU and memory).

Experimental results

Research questions

• RQ1 How can a decentralized identity management system improve security and privacy in healthcare systems compared to traditional centralized models?
• RQ2 To what extent can a permissioned blockchain with Hyperledger Indy and Aries support scalable and efficient identity management for healthcare applications?
• RQ3 How do techniques like selective disclosure and zero-knowledge proofs enhance privacy in patient identity and data access workflows?
• RQ4 What are the performance characteristics—throughput, latency, and resource usage—of a decentralized identity system under realistic workloads in a healthcare setting?
• RQ5 How does the proposed system ensure interoperability across heterogeneous healthcare platforms using W3C standards?

Key findings

• The BDIMHS system achieved an average transaction time of 99ms for 1 request and 139ms for 100 concurrent requests during proof verification, with throughput ranging from 6.1 to 10.1 transactions per second.
• Throughput remained stable at around 6–7 transactions per second under high concurrency (100 requests), indicating good scalability for typical healthcare workloads.
• Standard deviation in transaction times increased with concurrency, particularly under 100 requests (136.4ms), indicating performance variability under load, likely due to containerized server resource constraints.
• CPU and memory usage remained optimal during read operations, with stable resource utilization observed throughout the identity lifecycle flow, demonstrating efficient system performance.
• The system successfully implemented standardized W3C-compliant DIDs and VCs, enabling seamless interoperability across different healthcare entities and agents.
• A heuristic STRIDE-based security analysis confirmed that BDIMHS mitigates common threats such as tampering, impersonation, and replay attacks, ensuring strong integrity and authentication guarantees.