Towards a Novel Solution in the Security and Privacy of Medical Data
This article by Razvan Venter, Senior Certification Specialist at Secura , was published in SecurAware Magazine October 2019
The issues and limitations concerning the transfer, storage and usage of healthcare specific information have been of high interest for many years. Together with the continuous and high paced advances in the domain of cyber threats, the cybersecurity of this healthcare information becomes a clear point of concern. The issues are coming from multiple perspectives, which can equally lead to a compromise of highly sensitive, personal data. In the hand of malicious hackers, this data could subsequently become subject to ransomware scenarios, or even life endangering attacks.
Social engineering in a healthcare context
First of all, the healthcare domain is one of the most vulnerable to social engineering attacks. When it comes to personal health, patients are generally more than willing to share their sensitive information, in order to treat their medical issues. A simple phone call to a patient, while claiming to be a legitimate doctor for example, has a high chance of successfully extracting information which would otherwise be kept safely by the patients. At the same time, similar types of social engineering attacks could also target hospitals or clinics. By acting as a legitimate employee, easy access to internal databases of data can be granted. Click here to read more details about these types of real-life social engineering scenarios
Legacy technical solutions
At the same time, the technical solutions which are deployed for collection, storing or transferring highly sensitive medical data are, in many of the cases, outdated. Cybersecurity in the medical devices and systems domain is a relatively new focus area, and important medical devices regulatory bodies (such as the FDA or the EU) are only now beginning to keep a close eye on the state of the art concerning existing security features. Considering this, many of the medical devices, systems, or transfer/storage platforms deployed in hospitals or wore by patients have technical limitations in terms of their security. Practical attacks on implanted medical devices have been demonstrated , attacks on hospitals’ secure networks are common and the security of the data stored in the cloud relies solely on the measures implemented by the Cloud Service Provider (CSP) – which often has at most a self-declaration of security.
Where security succeeds, trust becomes an issue
Finally, imagine the situation in which no external security incidents can come by attacking the medical devices, systems or cloud platforms. Would that mean the perfect world in which the data is fully protected? Unfortunately, no, since the cloud-stored data is encrypted with a key fully in the control of the CSP. Therefore, the CSP can at any moment decrypt and access the stored data, without leaving any trace which the patient or doctors could detect. Trust in the CSP becomes an issue, especially in the light of the many abuses against information privacy laws and regulations .
Towards a novel solution in the security and privacy of medical data
The threats and practical limitations exposed above represented the incentives at the base of the ASCLEPIOS project. Under this project, the intention is to develop a platform based on which medical data can be securely collected from patients and stored in the cloud. To eliminate the issue of trust in the CSP, the keys used to encrypt the stored data will not be in the control of the provider, but will be generated by the patient him/herself. The patient will then upload to the cloud encrypted information, while the encryption key will be stored, in encrypted form, in a different trusted location. The encryption of the medical data in the cloud will follow the principles of Secure Searchable Encryption (SSE), thus allowing for the search in the encrypted data, without the need to decrypt it first.
In order to retrieve the encrypted medical data (by doctors or other legitimate users), the decryption key can be requested from the trusted location. Here use will be made of another novel concept, Attribute Based Encryption (ABE). Using ABE, the owner of the medical data will be empowered to decide who can access the encryption key, by defining a set of matching attributed. Examples of such attributes could be location, medical department, purpose of use, or the name of a specific doctor.
Finally, it is recognized that the research on medical data is a crucial element when it comes to the development of new treatments and solutions. Using the ASCLEPIOS platform, doctors which are allowed to get access to patients’ data can make this data (in the encrypted form) available to external third parties, for research purposes. Operation on encrypted data are possible through the use of Functional Encryption. The diagram below provides a visual representation of the ASCLEPIOS concepts and involved stakeholders.
The role of Secura
Secura will be, throughout the duration of the project, one of the main partners. Secura’s expertise, covering domains such as security, privacy and awareness will enable a unique position within the project, both supporting the development of the platform, as well as actively disseminating the results and raising awareness on the topics.
From a technical point of view, Secura’s experts will help in the development, design review, testing and finally validation of the proposed platform. At the same time, the GDPR compliance elements will be mainly supported by our involved project members. Finally, but equally important, Secura will actively hold security and privacy workshops, presenting the progress of the ASCLEPIOS developments, as well as raising awareness towards the criticality of securing medical data.
Workshop: Protecting vital assets, the art and science of working with medical data
Secura holds the frist ASCLEPIOS-project security awareness workshop on January 16th, 2020 in Amsterdam, the Netherlands. Join us to learn about the challenges of working with medical data. If you are in the healthcare, in IT security or a GDPR enthusiast, don't miss it. The workshop admission is free of charge, having a strong goal of bringing together both technical and non-technical personnel involved with medical data processing.
About the ASCLEPIOS project
Beginning of 2019 Secura officially launched its contribution within the ASCLEPIOS project. ASCLEPIOS (Advanced Secure Cloud Encrypted Platform for Internationally Orchestrated Solutions in Healthcare) aims to provide a novel platform for the secure and privacy enabled transfer and processing of sensitive healthcare data.
The ASCLEPIOS project is part of the European Union’s Horizon 2020 program, funded under grant agreement No. 826093, and will span over 3 years, with the end in December 2021. ASCLEPIOS puts together 11 partners from the domains of healthcare, research, industry and services, all having the goal of developing a novel, privacy and security enhanced solution for medical data processing. The progress of the project can be followed on https://www.asclepios-project.eu