# A Secure CDM-Based Data Analysis Platform (SCAP) in Multi-Centered Distributed Setting
## 3 Methods
### Communication for Distributing AC  
We implemented three modes for distributing the AC and analyzing the CDM data of SCAP-connected hospitals: full-automation mode, intervention mode, and hybrid mode. In this section, we describe these three modes. Figure 4: Sequence diagram for communication between the user and TGS. Figure 3: Sequence diagram for the communication between the user and CS. Figure 5 shows the communication process between the user, RS, and SS of hospitals in full-automation mode. In this mode, as the name suggests, the entire process, from the distribution of the AC to the returning CDM data analysis results, is conducted automatically. It is assumed that the user has a token, the AC, \(sig^{AC}\), and a ticket in advance. First, the user transmits the message \(M_{C-RS}\) with the above four pieces of information and the signature \(sig_{M_{C-RS}}\) to the RS of the central server group (flow 1 in Figure 5). The RS verifies the token in \(M_{C-RS}\) to determine whether the AS has authenticated the user. If the user is verified, the RS repackages the remaining information except for the token in \(M_{RS-SS}\) and sends this message with its signature to the SS (\(SS_{1}-SS_{n}\)) (flow 2 in Figure 5). The SS checks the authenticity of the user and the AC using the ticket and \(sig^{AC}\), respectively. If the verification of both the user and AC is successful, the SS runs the AC and analyzes the CDM data of its hospital (flow 3 in Figure 5). The analysis result (AR) is then returned to the RS (flow 4 in Figure 5). Finally, the user downloads the ARs from the hospitals (flow 5 in Figure 5). In full-automation mode, users can analyze the hospital data without any intervention. However, in full-automation mode, the hospital (or data manager) cannot control the process by analyzing the data of the institution and exporting the results. Institutions may simply want to deny the user access to the data. Allowing data to be analyzed without appropriate controls can occasionally violate the security policy of an institution. To satisfy these requirements, the intervention mode requests the hospital custodian to execute the AC and return the AR. First, as in full-automation mode, the user transmits a token, the AC, \(sig^{AC}\), and a ticket to the RS (flow 1 in Figure 6). RS verifies the user's identity by validating the token. The RS distributes the AC, a token, and a ticket from the user to the SSs of the hospitals (flow 2 in Figure 6). The SS verifies the received ticket and digital signature to verify the user and integrity of the AC. The SS does not immediately execute the AC, but waits for approval from the data custodian of the hospital. The custodian confirms the AC delivered to the hospital and approves the execution (flow 3 in Figure 6). Upon approval, the SS runs the AC to analyze the data of the hospital CDM (flow 4 in Figure 6). If the custodian suspends or rejects the AC execution, the AC is not executed. Likewise,  
Figure 5: Sequence diagram for distributing AC in full-automation mode. the SS does not immediately return the AR for the CDM data to the user, but rather waits for the export approval of the custodian. If the custodian approves its export (flow 5 in Figure 6), the user can obtain the AR (flow 6 in Figure 6). By contrast, if the custodian suspends or rejects its export, the user cannot access the AR even after the data analysis has been completed. Intervention mode provides hospital control over the data analysis. Hospitals can configure secure policies compared with full-automation mode. However, if there are many requests for analysis in intervention mode, some custodians might be burdened if they are responsible for all data analyses. To overcome these shortcomings, we implemented a hybrid mode, which is a combination of full automation and intervention modes. Hospitals registered on the platform each have a whitelist of users who can analyze the data of the institution without restriction.