## Security and Privacy Challenges in e-Health Cloud
Systems in the end-user platform should be able to divide the execution environment for applications into separated domains isolated from each other. Medical data is kept within TVD that is accessed only by authorized users. Data leakage can be prevented by the TVD infrastructure and security architecture. When medical data is stored on external storages, the system automatically encrypts the data with a key that is only accessible in the corresponding privacy domain. While when exporting data to external systems that are not connected to the TVD, a security gateway is introduced to control the data export under a data protection protocol. A key feature of the TVD infrastructure is its automatic management. The TVD establishment, key management and policy enforcement are totally transparent to the users. The infrastructure automatically verifies the integrity of client platforms when they try to join a TVD and then distributes keys and policies. Policy enforcement and data encryption are handled by a security kernel in the client platform without any kind of user interaction. The connection is secured between different platforms using an IPSec-secured virtual private network. Nevertheless, the approach entails that the end user platforms contain a security hardware module such as the Trusted Platform Module (TPM). However, this cannot be the case for all devices especially those used by patients. On the other hand, a privacy domain is established in the Cloud and enforced on the client platforms of the healthcare providers for each application which raises concerns about the complexity and scalability of this approach. In another approach, [PERSON] and [PERSON] in [17] introduced a privacy framework to support EHR exchange by allowing general practitioners to securely transfer information to specialists through the online referral and appointment planer (ORAP). In ORAP security model, EHR is only stored at the physicians' practices, which are considered to be the only trusted environments. EHRs are encrypted and signed before leaving the physician's practice to the central or cloud storage and they can only be decrypted by the receiving specialist. The patient's home, also, is not considered to be a secure environment and so patients cannot access the EHR from their homes. At the current stage, the ORAP model does not secure any patient-centric functions (e.g., medical history, action plan, collaboration tools) nor enable users to work with single EHRs entries (e.g., view, update). The model just allows transferring EHR securely when a referral is made. Finally, the DACAR platform for e-Health Cloud [58] was developed with the most common requirements for security such as: (a) cryptographic protocols to verify identities; (b) individual and role-based policies to control and provide access rights to resources; (c) functions to ensure that during any operation, data is accurate, complete and consistent; (d) mechanisms to protect data from any unauthorized disclosure by assuring that stored or transmitted data are accessible only to those authorized to have access; (e) mechanisms to keep track of a chronological sequence of audit records. Examples of security techniques incorporated in DACAR are digital signature, hashing and encryption, integrity check-sum, Single Point of Contact (SPoC), access controls, audit trail and identity mapping. Obviously, the current solutions for e-Health Cloud security which may include access control and data encryption would require the development of management policies, users' privileges, authenticity certificates and cryptographic keys. Many solutions revolve around patient-centric solutions as they provide patients with better control over their content and more trust in the system as they know they have the final say on who accesses their data and how. However, this approach has some drawbacks and the most important of which is the increased responsibilities of the patients.