Patent Description:
Current solutions of handling such sensitive data are not satisfying, because they are either too complex and not user friendly, do not provide sufficient functionalities in view of the handling of the data and/or the safe handling of the respective data is not sufficiently provided. For example, some of the currently available fitness trackers come with a proprietary app that needs to be installed to access the data. The device SDK (Software Development Kit) is the only method for getting real-time access to sensor data. Data ownership in these cases, i.e. the ownership of the raw data, is often unclear and/or not completely secure. There are no current solutions that provide a clear ownership of the data and a secure way of handling such sensitive data. <CIT>, <CIT> and <CIT> are documents of the related art.

In view of the prior art, it is an object of the present disclosure to provide improved systems and methods for secure handling of sensitive data.

This object is achieved by the independent claims. Preferred variations and further developments are defined by the features of the dependent claims.

The present disclosure relates to a system for secure handling of sensitive data, the system comprises: a sensing device configured to measure electrophysiological signals and to encrypt the measured electrophysiological signals to generate encrypted electrophysiological signals using a public data key; a remote server configured to receive the encrypted electrophysiological signals from the sensing device and an encrypted private data key, wherein the remote server is further configured to decrypt the private data key based on a user's key phrase and to decrypt the encrypted electrophysiological signals based on the decrypted private data key to generate classified data based on the decrypted electrophysiological signals.

Various embodiments may preferably implement the following features:
Preferably, the public data key is provided on the sensing device and the private data key is provided on the external server.

The private data key is encrypted and wherein the user's key phrase is used to decrypt the private data key.

Preferably, the system further comprises: a user device configured to receive the encrypted electrophysiological signals from the sensing device and transmit the encrypted electrophysiological signals to the remote server. However, the sensing device may transmit the encrypted electrophysiological signals to the remote server directly without the user device being involved.

Preferably, the remote server is further configured to display the classified data on a user interface.

Preferably, the remote server is further configured to transmit the classified data to a user device.

Preferably, the user device comprises a display and wherein the user device is configured to display the classified data on the display.

Preferably, the remote server is further configured to receive instructions on how to generate the classified data, wherein the instructions preferably comprise information on one or more classifications from a set of classifications that are to be generated as the classified data.

Preferably, generating the classified data comprises transformation and filtering of the decrypted data.

The instructions are preferably provided by a user input on a web interface provided by the external server, wherein the web interface is preferably accessible for the user by way of the user key phrase (password).

Preferably, the web interface is accessible for the user by way of the user key phrase and a device identifier (ID).

Preferably, the device ID is a random value that is preferably automatically filled in by the software development kit (SDK) on the user device, so that the user does not have to fill in a (long) random value (such as yrj4dj5jtu3uc), but can concentrate only on the key phrase (password).

It is further preferred that the instructions are generated based on options selected by the user, so-called opt-in (options), which specify one or more classifications from a set of classifications that are to be generated as the classified data.

Preferably, the classified data are derived from the encrypted data received from the sensing device.

Preferably, the remote server is further configured to generate a token based on the user's key phrase and/or the classified data, wherein the token is preferably indicative of a successful reception of the user's key phrase and/or indicative on how to generate the classified data.

Preferably, the token comprises a predetermined or user specified validation time, wherein upon expiration of the validation time the remote server is configured to stop generating classified data.

Preferably, before the sensing device is used to measure electrophysiological signals, the sensing device comprises an initial public data key and the remote server comprises an initial private data key, wherein the initial private and public data keys are encrypted by a default random-generated device password, and wherein the remote server is configured to: generate a new encrypted private data key and a new public data key upon change, by a user, of the default random-generated device password to the user's key phrase; send the new public data key to the sensing device as the public data key; and store the new private data key on the external server as the private data key.

Preferably, after generation of the private key and the public key, the private key and the public key are provided with a predetermined lifetime, which upon expiry of said predetermined lifetime cause the private key and the public key to be inoperable.

Preferably, the predetermined lifetime is a timer that may specify a predetermined time span for which the private key and the public key are valid and which is preferably reset with every access of the user to the user device and/or the server such that the private key and the public key expire when the user does not access the user device and/or the server within the predetermined time span.

Preferably, the above-mentioned steps of generating a new private key and a new public key are repeated if the predetermined lifetime (timer) expired to create new private and public keys, which preferably again carry said lifetime. That is, after expiry of the predetermined lifetime (timer), the remote server is configured to: generate a new encrypted private data key and a new public data key upon access of the server by the user; send the new public data key to the sensing device as the public data key; and store the new private data key on the external server as the private data
The use of such a lifetime of the private and public key may further increase the security of the system.

Preferably, the user's key phrase is specific for a particular sensing device. This way, the external server can provide sensing device specific classifications based on the user's input without knowing the user behind it. Thus, the provider of the server has no knowledge about the user but only about the device.

The present disclosure also relates to a method for secure handling of sensitive data, the method including the following steps: measuring electrophysiological signals using a sensing device; encrypting the measured electrophysiological signals by means of a public data key provided on the sensing device; transmitting, by the sensing device, the encrypted electrophysiological signals to a remote server; receiving, by the remote server, the encrypted electrophysiological signals; decrypting the encrypted electrophysiological signals at the remote server based on a user's key phrase and a private data key; generating classified data based on the decrypted electrophysiological signals at the remote server.

Preferably, transmitting, by the sensing device, the encrypted electrophysiological signals to a remote server comprises transmitting the encrypted electrophysiological signals via a user device.

Preferably, the user device runs a third-party application (not from the provider of the sensing device and/or the server), wherein only a software development kit (SDK) from the provider of the sensing device and/or the server is added to the third-party application to allow communication between the user device (the application) and the sensing device/server.

Preferably, the method further comprises: displaying, by the remote server, the classified data on a user interface.

Preferably, the method further comprises: transmitting, by the remote server, the classified data to a user device.

Preferably, the method further comprises: displaying, by the user device, the classified data.

Preferably, generating classified data based on the encrypted electrophysiological signals at the remote server comprises: receiving, by the remote server, instructions on how to generate the classified data, wherein the instructions preferably comprise information on one or more classifications from a set of classifications that are to be generated as the classified data.

It is further preferred that the instructions are generated based on options selected by the user, so-called opt-in (options), which specify different classifications one or more classifications from a set of classifications that are to be generated as the classified data.

Preferably, the method further comprises: generating a token based on the user's key phrase and/or the classified data, wherein the token is preferably indicative of a successful reception of the user's key phrase and/or indicative on how to generate the classified data.

Preferably, the token comprises a predetermined or user specified validation time, wherein the method further comprises: stopping, by the remote server, to generating classified data upon expiration of the validation time.

Preferably, before the sensing device is used to measure electrophysiological signals, the method comprises: generating an initial private data key for the remote server and an initial public data key for the sensing device; encrypting the initial private and public data keys by a default random-generated device password; generating a new encrypted private data key and a new public data key upon change, by a user, of the default random-generated device password to the user's key phrase; storing the new public data key on the sensing device as the public data key; and storing the new private data key on the external server as the private data key.

Preferably, the method further comprises: receiving, by the external server, a validation request from the user device; validating, at the external server, the user device in case a predetermined condition is fulfilled.

Preferably, validating the user device comprises generating a token (API token) and sending the token to the user device.

Preferably, communication between the external server and the user device and/or the sensing device is allowed only for user devices having received the respective token.

Preferably, the presence of the respective token is checked by the external server and/or the sensing device before every communication with the user device.

Preferably, validating the user device is based on an access control list that specifies user devices that are allowed to communicate with the external server.

Preferably, the predetermined condition is whether the user device is comprised in the access control list.

Preferably, further comprising prohibiting communication between the external server and the user device and/or the sensing device when the predetermined condition is not fulfilled and/or in case no token is received by the user device.

The above-mentioned use of a predetermined lifetime is also applicable to the token described with regard to the validation procedure.

Preferably, wherein the user's key phrase is specific for a particular sensing device.

The term "classified" as used herein is understood in the sense of "classification" or "categorization" and not in the sense of "secret" or "confidential".

According to the above-described methods and systems a minimum of two parties are needed to decrypt the data (e.g. minimum <NUM> always including the user). For example, in case the sensing device and the external server are provided by a first party, the user may be the second party and the application provider is the third-party, the present disclosure requires the user's key phrase (input from the second party) and the private data key (stored on the first parties external server) in order to decrypt the data. Neither of the two parties has exclusive rights to decrypt the data. The provided classification options (opt-in's) and the data access is independent of the user and data ownership is with the sensing device and/or external server provider.

The above-described systems and methods provide an unobtrusive solution that can be integrated into a range of applications to extend their functionality with a sensing device with enabling the least privilege over the data: no raw data access to third-parties, no control of the measured raw data and full ownership of the raw data by the user based on opt-in functionalities. The least privilege in this context means: users have full control over their data, third-parties can access classified data from the measured raw data, but not the raw data itself, and the supplier of the measuring device and/or provider of the external server has access to the data but no control over it if there's no permission from the user, i.e. no key phrase and opt-in.

In fact, the present disclosure provides the following advantages. The opt-in of the various classifications cannot be bypassed by the third-party since this is handled by the user on a provided web application from the external server. A third-party has no access to the raw data since they have no access to the private data key and the user's key phrase. Even if a third-party would get access to the key phrase, they still cannot decrypt the raw data, because the private data key is missing. The service provider, i.e. the owner of the external server and/or provider of the sensing device, has no access to the raw data if the user has not given an opt-in and key phrase in order to decrypt the data on the external server. Users have no access to the raw data since they need to have access to the private data key, which is only available on the external server and never gets sent. If users do not register for an API key (API token), they cannot even send data to the external server. That is, the API key is generated by the provider of the external server and provide to the provider of the third-party application upon request. Therefore, only third-party applications that received a respective API key have the permission to exchange data with the external server. Thus, providing the provider of the external server with an additional option to control the access of the external server, e.g. to allow only certified third-party applications the right to exchange data with the external server. There is no need to download an additional application or driver to make this work, all of this can be done by including a lightweight SDK into the third-party application.

The exemplary embodiments disclosed herein are directed to providing features that will become readily apparent by reference to the following description when taken in conjunction with the accompany drawings. In accordance with various embodiments, exemplary systems, methods, devices and computer program products are disclosed herein. It is understood, however, that these embodiments are presented by way of example and not limitation, and it will be apparent to those of ordinary skill in the art who read the present disclosure that various modifications to the disclosed embodiments can be made while remaining within the scope of the present disclosure.

Preferred embodiments of the present invention are further elucidated below with reference to the figures. The described embodiments do not limit the present invention.

With reference to <FIG> a system for secure handling of sensitive data according to an embodiment of the present disclosure is described. <FIG> shows the sensing device <NUM>, an external server <NUM> and a user device <NUM>, wherein the presence of analog signals is indicated by a diamond shaped symbol, encrypted data is indicated by closed lock symbol and encrypted data is indicated by an open lock symbol.

The sensing device <NUM> is provided with a public data key <NUM> and sensoring equipment <NUM>, e.g. electrode sensors. The sensoring equipment <NUM> is configured to sense electrophysiological signals, e.g. due to heart (ECG), muscle (EMG), eye (EOG) or brain (EEG) activity, or other sensitive data.

The signals measured by the sensoring equipment <NUM> may be amplified by an amplification unit <NUM> for further processing. Other signal processing steps are possible and the present disclosure is not limited to any specific signal processing, which will largely depend on the specific signals that are being processed. The skilled person will apply the necessary signal processing for the specific application based on his/her common general knowledge. A more detailed description thereof is therefore not necessary at this point.

That is, the amplifier receives data from the sensoring equipment <NUM>, amplifies it and converts it into encrypted data. Minimal data processing may take place at this point as well, but the raw data is not changed, only put into a certain format (and encrypted). Furthermore, the data is buffered at this point (e.g. in case of a Bluetooth malfunction).

Next, the amplified signals are encrypted using the public data key <NUM> stored on the sensing device <NUM> such that the raw data is encrypted before being sent by the sensing device <NUM>. The encryption may be done by an encryption unit <NUM>. The use of public and private data keys and the respective encryption and decryption algorithms are generally known to the skilled person and the details thereof are therefore not further outlined at this point.

In order to send the encrypted data, the sensing device <NUM> may use any wireless or wired technology available. In <FIG>, the encrypted data is sent to a user device <NUM>, which receives the encrypted data. In this case, it is preferable that a wireless near field technology such as Bluetooth is used for sending the encrypted data from the sensing device <NUM> to the user device <NUM>. In this case, the sensing device <NUM> may be provided with a firmware BLE (Bluetooth low energy) unit <NUM> and the user device <NUM> may be provided with a Bluetooth unit, e.g. an Android BLE unit. However, the user device may also be connected via a wired connection to the sensing device. The connection may also be a combination of a wired and wireless connection, e.g. via a base station of the user device and/or the sensing device.

The user device <NUM> may be any stationary or portable device in proximity to the sensing device <NUM>. Examples for such a user device <NUM> are personal computers, laptops, tablets, mobile phones and the like. In an embodiment, the user device <NUM> is a mobile device, preferably a mobile phone.

The user device <NUM> runs a third-party application, which is configured to communicate with the external server <NUM> and configured to display classified data received from the external server <NUM> on the user device <NUM>. The third-party application may incorporate a software development kit of the provider of the sensing device <NUM> and the external server <NUM> to provide the necessary communication capabilities.

Third-party in the context of this disclosure refers to a party or an entity different to the provider of the sensing device <NUM> and/or the external server <NUM>. The third-party application running on the user device <NUM> may be supplemented only by necessary software for communication between the user device <NUM> and the sensing device <NUM> and/or the external server <NUM>.

The user device <NUM> forwards the encrypted data received from the sensing device <NUM> to the external server <NUM>. It should be appreciated that the encrypted data can also be send directly from the sensing device <NUM> to the external server <NUM>. However, in this case an onboard memory (on the sensing device <NUM>) may be needed to be available for buffering in case the sensing device <NUM> has no access to the internet. Therefore, it is preferred to connect the sensing device <NUM> to a user device <NUM>, where it also works without an internet connection and where it can buffer as much data as is available on the user device <NUM> (which is usually multiple GBs).

The connection between the user device <NUM> and the external server <NUM> may be any wireless or wired technology available. Since the external server <NUM> is at a remote location, the connection may preferably be a wireless connection such as LTE, LTE-Advanced, <NUM>, <NUM>+ or <NUM>. However, in other cases the connection may be a broadband connection to connect the user device <NUM> to the external server <NUM>, e.g. a personal computer may connect to the external server via a DSL (digital subscriber line) or a glass fiber connection. Combinations of wired and wireless connections are also possible, e.g. using a wireless router.

The encrypted data is received at the external server <NUM> via an interface, e.g. an internet interface <NUM>. The encrypted data can be decrypted at the external server <NUM> using a private data key <NUM> provided on the external server <NUM>. However, before the decryption can take place, a user key phrase is needed to decrypt the private data key <NUM>, which is provided as an encrypted private data key <NUM> on the external server <NUM>. That is, a user needs to provide a user key phrase to decrypt the private data key and thereby to permit the decryption of the encrypted raw data at the external server <NUM>. The encryption may be executed by an encryption unit <NUM>.

The private and public key pairs may be generated before the sensing device <NUM> gets sent to the user and are encrypted by a default random-generated key phrase which may then be changed as soon as the user sets up the device. After setting a new key phrase the user will create a new encrypted private data key for the external server <NUM> and will receive a new public data key on the sensing device <NUM>.

The user also uses the key phrase to specify which classifications, from a set of predetermined classifications, are to be prepared and sent to the user device <NUM>. That is, the external server <NUM> is configured to provide an independent web application, i.e. independent from the third-party application on the user device <NUM>. The web application is provided for the user to register his/her sensing device <NUM> with an associated key phrase (password). The web application is further provided to enable the selection of different classifications. Thus, the user has full control over the decryption of the raw data and how the raw data is processed (classified) at the remote server <NUM> and the third-party application cannot influence these parameters.

If permitted by the user, by way of the user key phrase, the decrypted data is forwarded to the classification unit <NUM>, which is configured to process the decrypted data and to generate classified data. The classified data is then sent to the user device <NUM>, where the classified data may be displayed to the user.

The external server <NUM> may also comprise a storage <NUM> configured to store the classified data. Preferably, the external server encrypts the classified data (by way of an encryption unit <NUM>) before storing the classified data in storage <NUM> and therefore stores only encrypted classified data in storage <NUM>. The encryption is preferably also done with use of the public data key. For this encryption, the external server may have access to the public data key, e.g. using the sensing device for the encryption or temporarily accessing the public data key and subsequently deleting it.

In order to control access and/or communication between the user device <NUM> and the external server <NUM> and/or the sensing device <NUM>, tokens may be used (e.g. JSON Web Tokens based approach). JSON Web Tokens are an open, industry standard RFC <NUM> method for representing claims securely between two parties.

The token is generated at the external server <NUM> and send to the user device <NUM>, where the token is saved. Only user devices <NUM> that are in possession of a respective token can access and/or communicate with the external server <NUM> and/or the sensing device <NUM>. The token may also carry a timer, wherein upon expiry may prohibit access and/or communication between the user device <NUM> and the external server <NUM> and/or the sensing device <NUM> until a new token is generated. The timer may, for example, expire if the user has not logged into the external server <NUM> and/or the user device <NUM> before expiration of said timer.

Whereas if the user logs into the external server <NUM> and/or the user device <NUM> before expiration of said timer, said time may be reset.

All of the aforementioned units and their designated functions may be implemented using a processor that is configured to perform the respective functions.

<FIG> shows a system according to an embodiment of the present disclosure. The system may be used system for secure handling of sensitive data. The system comprises: a sensing device configured to measure electrophysiological signals and to encrypt the measured electrophysiological signals to generate encrypted electrophysiological signals using a public data key; a remote server configured to receive the encrypted electrophysiological signals from the sensing device, wherein the remote server is further configured to decrypt the encrypted electrophysiological signals based on a user's key phrase and a private data key to generate classified data based on the decrypted electrophysiological signals
In an embodiment, the system further comprises: a user device configured to receive the encrypted electrophysiological signals from the sensing device and transmit the encrypted electrophysiological signals to the remote server.

In an embodiment, the remote server is further configured to display the classified data on a user interface.

In an embodiment, the remote server is further configured to transmit the classified data to a user device.

In an embodiment, the user device comprises a display and wherein the user device is configured to display the classified data on the display.

In an embodiment, the remote server is further configured to receive instructions on how to generate the classified data, wherein the instructions preferably comprise information on one or more classifications from a set of classifications that are to be generated as the classified data.

In an embodiment, the remote server is further configured to generate a token based on the user's key phrase and/or the classified data, wherein the token is preferably indicative of a successful reception of the user's key phrase and/or indicative on how to generate the classified data.

In an embodiment, the token comprises a predetermined or user specified validation time, wherein upon expiration of the validation time the remote server is configured to stop generating classified data.

In an embodiment, before the sensing device is used to measure electrophysiological signals, the sensing device comprises an initial public data key and the remote server comprises an initial private data key, wherein the initial private and public data keys are encrypted by a default random-generated device password, and wherein the remote server is configured to: generate a new encrypted private data key and a new public data key upon change, by a user, of the default random-generated device password to the user's key phrase; send the new public data key to the sensing device as the public data key; and store the new private data key on the external server as the private data key.

In an embodiment, the user's key phrase is specific for a particular sensing device.

<FIG> shows a schematic diagram of a method according to an embodiment of the present disclosure. The method may be used for secure handling of sensitive data. The method includes the following steps:.

In an embodiment, The method of claim <NUM>, wherein transmitting, by the sensing device, the encrypted electrophysiological signals to a remote server comprises transmitting the encrypted electrophysiological signals via a user device.

In an embodiment, the method further comprises: displaying, by the remote server, the classified data on a user interface.

In an embodiment, the method further comprises: transmitting, by the remote server, the classified data to a user device.

In an embodiment, further comprises: displaying, by the user device, the classified data.

In an embodiment, generating classified data based on the encrypted electrophysiological signals at the remote server comprises: receiving, by the remote server, instructions on how to generate the classified data, wherein the instructions preferably comprise information on one or more classifications from a set of classifications that are to be generated as the classified data.

In an embodiment, the method further comprises: generating a token based on the user's key phrase and/or the classified data, wherein the token is preferably indicative of a successful reception of the user's key phrase and/or indicative on how to generate the classified data.

In an embodiment, the token comprises a predetermined or user specified validation time, wherein the method further comprises: stopping, by the remote server, to generating classified data upon expiration of the validation time.

In an embodiment, before the sensing device is used to measure electrophysiological signals, the method comprises: generating an initial private data key for the remote server and an initial public data key for the sensing device; encrypting the initial private and public data keys by a default random-generated device password; generating a new encrypted private data key and a new public data key upon change, by a user, of the default random-generated device password to the user's key phrase; storing the new public data key on the sensing device as the public data key; and storing the new private data key on the external server as the private data key.

In an embodiment (not shown), a computer-implemented method comprising the steps of the above described method for secure handling of sensitive data is provided.

In an embodiment (not shown), a computer program product comprising instructions which, when the program is executed by a computer, cause the computer to carry out the steps of the above described method for secure handling of sensitive data is provided.

In view of the systems and methods described herein, third-parties may use the sensing device to provide extended applications without users having to download drivers or additional background applications. The raw data flows directly through their apps without providing access to the raw data, protecting users' privacy. Users can gradually opt into different classifications, i.e. individually choose different classifications, which are then securely and encrypted at the external server <NUM>, ensuring that the third-parties can only access users' classified data if they have permission to do so. In addition, the data is only processed in certain ways if the user gives permission and the provider of the sensing device <NUM> and/or the externals server <NUM> has no control over the streamed and stored data classification if the user does not allow it. That is, users have a public key on their hardware (sensing device <NUM>) to encrypt the raw data via hardware acceleration and an encrypted private key is provided on the external server <NUM> that can only be decrypted with a user key phrase to decrypt the raw data.

In other words, the opt-in of the various classifications cannot be bypassed by the third-party since this is handled by the user on a provided web application from the external server <NUM>. The third-party has no access to the raw data since they have no access to the private data key and the user key phrase. Even if the third-party would get access to the key phrase, the third-party can still not decrypt the brain data, because of the missing private data key. In addition, the provider of the sensing device <NUM> and/or the external server <NUM> has no access to the raw data if the user has not given an opt-in and key phrase in order to decrypt the data on the external server <NUM>. Users have no access to the raw data since they need to have access to the private data key which is only available on the external server <NUM> and never gets sent. If users do not register for an API key, they cannot even send data to the external server <NUM>. There is no need to download an additional application or driver to make this work, all of this can be implemented by including a lightweight SDK into the third-party application.

Thus, unobtrusive systems and methods are provided that can be integrated into a range of applications to extend their functionality with health related data sensing with enabling the least privilege over the data: no raw data access to third-parties, no control of raw data from the provider of the sensing device <NUM> and/or the external server <NUM> and full ownership of the raw data from the user based on opt-in procedure. The least privilege in this context means: users have full control over their data, third-parties can access classified data from the raw data, but not the raw data itself, and the provider of the sensing device <NUM> and/or the external server <NUM> has access to the raw data but no control over it if there's no key phrase and opt-in from the user.

Thus, the breadth and scope of the present disclosure should not be limited by any one of the above-described exemplary embodiments.

Additionally, a person having ordinary skill in the art would understand that information and signals can be represented using any one of a variety of different technologies and techniques.

A skilled person would further appreciate that any one of the various illustrative logical blocks, units, processors, means, circuits, methods and functions described in connection with the aspects disclosed herein can be implemented by electronic hardware (e.g., a digital implementation, an analog implementation, or a combination of the two), firmware, various forms of program or design code incorporating instructions (which can be referred to herein, for convenience, as "software" or a "software unit"), or any combination of these techniques.

To clearly illustrate this interchangeability of hardware, firmware and software, various illustrative components, blocks, units, circuits, and steps have been described above generally in terms of their functionality. In accordance with various embodiments, a processor, device, component, circuit, structure, machine, unit, etc. can be configured to perform one or more of the functions described herein. The term "configured to" or "configured for" as used herein with respect to a specified operation or function refers to a processor, device, component, circuit, structure, machine, unit, etc. that is physically constructed, programmed and/or arranged to perform the specified operation or function.

Furthermore, a skilled person would understand that various illustrative logical blocks, units, devices, components and circuits described herein can be implemented within or performed by an integrated circuit (IC) that can include a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, or any combination thereof. The logical blocks, units, and circuits can further include antennas and/or transceivers to communicate with various components within the device.

In this document, the term "unit" as used herein, refers to software, firmware, hardware, and any combination of these elements for performing the associated functions described herein. Additionally, for purpose of discussion, the various units are described as discrete units; however, as would be apparent to one of ordinary skill in the art, two or more units may be combined to form a single unit that performs the associated functions according to embodiments of the present disclosure.

Claim 1:
A system for secure handling of sensitive data, the system comprising:
a sensing device (<NUM>) configured to measure electrophysiological signals and to encrypt the measured electrophysiological signals to generate encrypted electrophysiological signals using a public data key (<NUM>);
a remote server (<NUM>) configured to receive the encrypted electrophysiological signals from the sensing device (<NUM>), and to store an encrypted private data key (<NUM>),
wherein the remote server (<NUM>) is further configured to decrypt the private data key (<NUM>) based on a user's key phrase and to decrypt the encrypted electrophysiological signals based on the decrypted private data key (<NUM>) to generate classified data based on the decrypted electrophysiological signals.