title: Security Engineering and Federated Learning for Healthcare Information Systems
Creators: name: Abdullahi Yari, Imrana
Publisher: name: Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU)
Year: 2024
Subjects: subject: Digitalization, Healthcare, Information access, Data sharing, Data regulations, Telemedicine, Electronic health record (EHR) systems, Patient-centered healthcare information systems (PHS), Peer-to-peer (P2P) networks, Security issues, Security attacks, Federated learning, Authentication, Protocol, Security engineering, CVSS, Systematic literature review

description: Digitalization revolutionizes healthcare by enabling seamless information access to stakeholders, enhancing service efficiency, personalizing care, and bolstering online health support. However, current health systems face challenges. Health information is often siloed in the existing systems, which makes data sharing difficult due to varying formats, export interfaces, and standards. Healthcare providers are also required to comply with data regulations like the EU General Data Protection Regulation (GDPR) to maintain patients’ data. Advancements in healthcare practices, such as telemedicine and precision medicine, alongside increased individual utilization of digital systems and limitations in data exchange, are leading the shift from traditional electronic health record (EHR) systems to patient-centered healthcare information systems (PHSs). PHS complements the EHRs, makes patients aware of their health, and offers new features like complete control of their medical data and provision of vetted information. PHSs are deployed on traditional technologies such as centralized databases, peer-to-peer (P2P), or distributed ledger technology (DLT). P2P PHSs include interoperable COVID-19 proximity trackers or decentralized personal health records. Utilizing P2P technology for PHS deployment situates data locally at the edge, under the sovereignty of individual device owners, increasing scalability and reducing the attack surface and organizational hurdles to implementing data regulations. However, health information on P2P networks raises distinct security challenges, which could affect the attainment of PHS goals. For example, the absence of reliable and trusted computing bases on P2P networks and the responsibility of users to support their devices’ information security independently pre-sent profound adverse security risks. Moreover, in P2P PHS, data are in isolated, heterogeneous, and distributed environments. While this is favorable for certain security aspects, it brings challenges to traditional data transaction procedures in machine learning (ML). In addressing these issues, this dissertation focuses on the novel P2P PHS. It aims to: i) identify current design and architectural patterns for P2P PHS and P2P networks and propose a novel but secure architecture for PHS deployment; ii) systematically investigate the inherent and possible security issues for P2P PHS; iii) propose secure measures to provide additional security; and iv) investigate and design a suitable and privacy-preserving federated ML framework for P2P PHSs. First, the author studied the origins and properties of P2P networks (and PHS). He identified three archetypical P2P network architectures: centralized, decentralized, and hybrid. Based on their characteristics and the requirements for PHS, he proposed a novel but suitable and secure P2P PHS architecture. It has hierarchical relationships between parties like PHS providers, practitioners, and patients, supports an interoperable ecosystem, facilitates processes like user registration and identity authentication, ensures compliance with data regulations, and enhances scalability and resource accessibility. Second, the author systematically identified and reviewed 49 studies (published between 2008 and 2020) from reliable sources that discuss the inherent security issues of P2P systems. Through thematic data analysis and the foundational information security principles of confidentiality, integrity, and availability, he identified and evaluated eight inherent security issues, such as the Sybil attack, related to PHS design and implementation on P2P networks, alongside seven contributory factors, including the absence of content verification. In addition, the author assessed the chances of exploiting the issues, impact, and risk associated (using a severity scoring system) for the P2P PHS architectures. Third, the author established a six-phase guideline for provisioning P2P PHSs while maintaining information security. Among the security measures proposed in the guideline phases, effective identity-based authentication should be prioritized during P2P PHS planning and implementation. Consequently, following established methodologies for creating authentication protocols and strengthening password security and access control, he proposed a robust yet secure authentication protocol. This protocol facilitates offline accessibility, employs independent and stateless data encryption keys, and permits patients and healthcare providers to mutually authenticate and exchange data securely. The protocol incorporates a software-based card to streamline the integration of authentication mechanisms in emerging national health-IT infrastructures. Security and performance assessments indicate that the protocol effectively protects against threats and maintains performance on par with conventional, less secure authentication techniques. Fourth, the novelty and hierarchical nature of P2P PHS architecture poses challenges to the existing federated learning (FL) solutions since they use centralized engines for model update aggregation. Current privacy-preserving techniques used for FL are insufficient since they can only ensure privacy in execution environments. Therefore, he proposed a novel FL framework suitable for P2P PHS multi-tier and hybrid architecture. It increases communication efficiency and scalability and leverages identity-based authentication to ensure end-to-end privacy—by dropping illegitimate clients beforehand and purging their contributions during training. This dissertation establishes a foundation for understanding P2P (and PHS) system architectures, delineating their merits and demerits. It also proposes a novel architecture adaptable to any PHS provider implementing a secure system. The guideline for securing PHSs on P2P networks on public networks facilitates individual developers and providers to prioritize and deal with potential security issues during the entire system development and maintenance life cycle. The proposed authentication protocol is a foundation for designing and implementing P2P PHSs. At the same time, the secure but scalable FL concepts presented will make the use of ML on P2P PHSs more secure and trustworthy.