Skip to main page content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Access keys NCBI Homepage MyNCBI Homepage Main Content Main Navigation
. 2022 Oct 14;24(10):e37978.
doi: 10.2196/37978.

Secure Collaborative Platform for Health Care Research in an Open Environment: Perspective on Accountability in Access Control

Giluk Kang  1 , Young-Gab Kim  1
Affiliations

Secure Collaborative Platform for Health Care Research in an Open Environment: Perspective on Accountability in Access Control

Giluk Kang et al. J Med Internet Res. .

Abstract

Background: With the recent use of IT in health care, a variety of eHealth data are increasingly being collected and stored by national health agencies. As these eHealth data can advance the modern health care system and make it smarter, many researchers want to use these data in their studies. However, using eHealth data brings about privacy and security concerns. The analytical environment that supports health care research must also consider many requirements. For these reasons, countries generally provide research platforms for health care, but some data providers (eg, patients) are still concerned about the security and privacy of their eHealth data. Thus, a more secure platform for health care research that guarantees the utility of eHealth data while focusing on its security and privacy is needed.

Objective: This study aims to implement a research platform for health care called the health care big data platform (HBDP), which is more secure than previous health care research platforms. The HBDP uses attribute-based encryption to achieve fine-grained access control and encryption of stored eHealth data in an open environment. Moreover, in the HBDP, platform administrators can perform the appropriate follow-up (eg, block illegal users) and monitoring through a private blockchain. In other words, the HBDP supports accountability in access control.

Methods: We first identified potential security threats in the health care domain. We then defined the security requirements to minimize the identified threats. In particular, the requirements were defined based on the security solutions used in existing health care research platforms. We then proposed the HBDP, which meets defined security requirements (ie, access control, encryption of stored eHealth data, and accountability). Finally, we implemented the HBDP to prove its feasibility.

Results: This study carried out case studies for illegal user detection via the implemented HBDP based on specific scenarios related to the threats. As a result, the platform detected illegal users appropriately via the security agent. Furthermore, in the empirical evaluation of massive data encryption (eg, 100,000 rows with 3 sensitive columns within 46 columns) for column-level encryption, full encryption after column-level encryption, and full decryption including column-level decryption, our approach achieved approximately 3 minutes, 1 minute, and 9 minutes, respectively. In the blockchain, average latencies and throughputs in 1Org with 2Peers reached approximately 18 seconds and 49 transactions per second (TPS) in read mode and approximately 4 seconds and 120 TPS in write mode in 300 TPS.

Conclusions: The HBDP enables fine-grained access control and secure storage of eHealth data via attribute-based encryption cryptography. It also provides nonrepudiation and accountability through the blockchain. Therefore, we consider that our proposal provides a sufficiently secure environment for the use of eHealth data in health care research.

Keywords: Internet of Things; accountability; attribute-based encryption; blockchain; cloud computing; eHealth data; interoperability; mobile phone; privacy; research platform for health care; security.

PubMed Disclaimer

Conflict of interest statement

Conflicts of Interest: None declared.

Figures

Figure 1
Figure 1
Access procedure for analyzing eHealth data in South Korea.
Figure 2
Figure 2
Overview of our proposed framework for the health care big data platform.
Figure 3
Figure 3
User registration phase.
Figure 4
Figure 4
Storage phase.
Figure 5
Figure 5
Download phase.
Figure 6
Figure 6
Use phase.
Figure 7
Figure 7
Algorithm 1: pseudocode of authentication for the security agent.
Figure 8
Figure 8
Algorithm 2: pseudocode of use for the security agent.
Figure 9
Figure 9
Overview of our implementation.
Figure 10
Figure 10
Implemented health care big data platform (HBDP).
Figure 11
Figure 11
Android app.
Figure 12
Figure 12
Encryption and decryption of eHealth data in the health care big data platform.
Figure 13
Figure 13
Web page for detection of illegal users.
Figure 14
Figure 14
Detection of unauthenticated user.
Figure 15
Figure 15
Detection of unauthorized user.
Figure 16
Figure 16
Average time of cryptography.
Figure 17
Figure 17
Average transaction latencies.
Figure 18
Figure 18
Transaction throughputs.
See this image and copyright information in PMC

Similar articles

See all similar articles

Cited by

References

    1. Health Insurance Portability and Accountability Act. U.S. Department of Health & Human Services. [2022-01-10]. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations .
    1. General data protection regulation. Intersoft Consulting. [2022-01-10]. https://gdpr-info.eu .
    1. California Consumer Privacy Act. State of California Department of Justice. [2022-01-10]. https://oag.ca.gov/privacy/ccpa .
    1. Oh S, Seo Y, Lee E, Kim Y. A comprehensive survey on security and privacy for electronic health data. Int J Environ Res Public Health. 2021 Sep 14;18(18):9668. doi: 10.3390/ijerph18189668. https://www.mdpi.com/resolver?pii=ijerph18189668 ijerph18189668 - DOI - PMC - PubMed
    1. O'Keefe CM, Rubin DB. Individual privacy versus public good: protecting confidentiality in health research. Stat Med. 2015 Oct 15;34(23):3081–103. doi: 10.1002/sim.6543. - DOI - PubMed

Publication types