TPM-based adaptive access control scheme with break-glass support for healthcare systems

• Propose TPM-AACS, a novel scheme that supports both normal and emergency access modes for encrypted medical data. • Combine TPM authentication with the break-glass mechanism to achieve hardware-based trusted authentication. • Optimize the break-glass key generation and recovery algorithms to achieve low-latency access in emergency situations. • Design the scheme based on the TPM 2.0 specification, enabling rapid deployment on existing platforms equipped with TPM. Medical data access control faces an inherent conflict between privacy protection and emergency accessibility: Attribute-Based Encryption (ABE) can protect privacy, but cannot support timely access to critical medical data in emergency scenarios due to its expensive computation cost. Existing break-glass solutions, though supporting emergency authorization, generally overlook the trustworthiness of decryption devices, leading to potential key exposure on unverified terminals and introducing leakage risks. To address these challenges, this paper proposes an adaptive access control scheme based on the Trusted Platform Module (TPM), called TPM-AACS, which supports two modes for accessing encrypted medical files. In normal mode, the system enforces strict access control through both TPM-based device authentication and ABE-based attribute authentication. In break-glass mode (i.e., during emergencies), it enables the TPM hardware root of trust to implement a controlled and secure local key recovery mechanism, thereby temporarily bypassing the strict access control enforced in normal mode. Considering the limited computation and storage capability of TPM, we optimize the break-glass key generation and recovery procedures to ensure low-latency emergency access while protecting privacy. We reduce the security of our scheme to well-known complexity assumptions and conduct experiment to evaluate its efficiency. The experimental results demonstrate that the decryption time in break-glass mode is approximately 9ms, which is even faster than the outsourced decryption in normal mode and satisfies the timeliness requirements of emergency medical scenarios.