# A Secure CDM-Based Data Analysis Platform (SCAP) in Multi-Centered Distributed Setting
## 4 Results
### Implementation for CS
TGS issues tickets that allow users to authenticate multiple SSs. The user calls the request_to_issue_ticket procedure with the token and \(sig^{AC}\) to receive a ticket from the TGS. The procedure parameters are included in \(M_{C-TGS}\) and sent to the TGS with the signature \(sig_{M_{C-TGS}}\) (line 4 in Algorithm 5 for flow 1 in Figure 4). The TGS calls the handle_issuing_ticket_request procedure. As presented in the previous algorithms, this procedure verifies the message, identity, and \(sig^{AC}\) passed by the user and returns an ERROR if it fails (from lines 2 to 17 in Algorithm 6). If all of the information is valid, this procedure generates a ticket cryptographically. The TGS creates a message \(M_{TGS-C}\) with the ticket and returns the message to the user along with \(sig_{M_{TGS-C}}\) (from lines 19 to 22 in Algorithm 6 for flow 2 in Figure 4). The request_to_issue_ticket procedure verifies \(sig_{M_{TGS-C}}\), and if the message is not tampered with, the procedure on the user side extracts a ticket from the message and returns it. The user safely stores the acquired TGS ticket, along with the token and \(sig^{AC}\). ### Implementation of RS and SS

Algorithms 7-9 show algorithms for analyzing the CDM data among users (Algorithm 7), RS (Algorithm 8), and SS (Algorithm 9), as shown in Figure 5. In this section, only algorithms for the SS set in full-automation mode are introduced. However, there was no significant difference in the algorithm in the intervention or hybrid modes. The user invokes the request_to_analyze_CDM_data procedure with a token, AC, \(sig^{AC}\), and ticket. This procedure transmits \(M_{C-RS}\), which includes the above parameters and signature \(sig_{M_{C-RS}}\), to RS (line 4 in Algorithm 7 for flow 2 in Figure 5). RS calls the handle_distributing_AC_request procedure. This procedure validates the tokens in \(sig_{M_{C-RS}}\) and \(M_{C-RS}\) and returns an ERROR if the verification fails (from lines 1 to 11 in Algorithm 8). If there are no errors, this procedure forwards \(M_{RS-SS}\), which includes AC, \(sig^{AC}\), and the ticket, and signature \(sig_{M_{RS-SS}}\), to all SSs registered in the SCAP (line 19 in Algorithm 8 for flow 2 in Figure 5). SS calls the handle_analyzing_CDM_data_request. This procedure validates \(sig_{M_{RS-SS}}\), ticket, and \(sig^{AC}\) before executing the AC and returns an ERROR if verification fails (from lines 2 to 17 in Algorithm 9). The SS does not immediatelyexecute the AC, even if all verifications are successful. In general, AC execution is a time-consuming task; therefore, instead of synchronizing all algorithms in Algorithms 7-9, we append the AC to the thread pool. If AC is successfully included in the thread pool, this procedure returns a SUCCESS message, and if it fails for any reason, it returns an ERROR immediately (from lines 19 to 24 in Algorithm 9). If the thread pool is full owing to many data analysis requests from other users, a scheduler suspends the execution AC until resources become available. Thus, the computational resources of the SS can be efficiently operated. The return of the handle_analyzing_CDM_data_request procedure is delivered to the user through the RS without hesitation. Figure 7 shows the structure of the SS used to implement the algorithm of Algorithm 9. Unlike other components of SCAP, the SS provides various functions for analyzing medical data. (1) The SS places the AC into the queue. In general, the execution of the AC requires considerable computational resources; it is therefore impossible to execute all analysis requests from users in parallel. Thus, the SS limits the ACs that can be run at a time using the management pool for the ACs. (2) The SS can run the AC to analyze the CDM data of the institution. If all previous verifications are successful, the SS executes the AC using the R engine. Alternatively, if the AC is written in a programming language other than R, the appropriate execution engine is called.