Blockchain-Aided Key-Escrow-Free Attribute-Based Encryption with Secure Deduplication in Healthcare Data Sharing

Consortium healthcare and clinical-research collaborations require fine-grained sharing of sensitive data while avoiding centralized key escrow and reducing storage costs caused by cross-institution duplicate uploads. However, most existing schemes either retain centralized master secret key generation or omit storage-layer deduplication, leading to key escrow risk or storage overhead. We present BA-KEF-ABE, a blockchain-aided, key-escrow-free ciphertext-policy attributebased encryption framework that integrates (i) decentralized and auditable key management, (ii) efficient outsourced decryption, and (iii) secure deduplication with ciphertext regeneration under evolving access policies. Our design uses a permissioned blockchain to coordinate key issuance, tracing, and revocation, where the master secret key is generated only in shared form via a PVSS-based distributed key generation protocol, enabling public verifiability of master key generation and removing reliance on a single authority. At the storage layer, a hybrid-cloud structure places encrypted files in the public cloud, while a minimally trusted private cloud performs tag-based duplicate detection and deduplication using trapdoors, without learning the file contents.