Biomedical Data Protection

Introduction

Data could be non-personal data generated by a production machine or personal data: name, address, localisation, online identifier, cultural profile, income and health information of one subject.

Within personal data we find Biomedical Data: all those data and information that belongs to a patient. The main kind are:

• Medical examination – all data concerning all examinations that depict medical condition.
• Inpatient health monitoring – all data generated and stored when we are submitted to some clinical practice (i.e. an ECG recording).
• Medical imaging – those images we have associated a report where it is interpreted and where it is written what kind of illnesses you may have.
• Laboratory data – data obtained from analysis in laboratory.
• Patient generated health data – data generated with some application on our smartphone.

All biomedical data must be protected from physical falls in structures of falling in the protection system of the same structure. The Italy has the electronic health record, a collection of the position, the hospital or the laboratory, in which are stored patient’s data.

In the last years, the cybersecurity developed because some cybercriminals attack different hospital all over the world, blocking system or stealing data, for ransom.

MEDJACK, hijacking medical device, has as target healthcare system and devices (blood gas analysers, PACS, infusion/insulin pumps, pacemaker…) because are often used obsolete software (WinXP, …) and are closed (systems no updated and no antivirus). IT departments cannot manage them, don’t have administrator privileges and they often treat data in clear. All those instruments are very delicate object from the cybersecurity point of view.

These software target obsolete software with WinXP for example, this obsolete system it is less important than other systems, and this medjack system is no longer considered dangerous by protection systems. At this point it perform a “lateral movement” and infects weak devices. Once the weak device has been infected, it leaves a backdoor to the cybercriminal in the corporate network of the hospital. In this way, they can access everywhere, in each hospital, in each country.

Another way to attack is the Orangeworm, a malware Kwampirs detected in X-Ray and MRI control machines and in computer used for filling patient consent statements. The healthcare sector is so targeted from those attack because personal data earn a lot of money in the black market, and more sensible data are the healthcare records.

In general, there are three areas that we must care about: Safety – protecting data or infrastructure, from an accident occurred, by chance. Privacy – the state of being alone or kept apart from others. Security – means protect data, system and infrastructure from fraudulent attacks.

The level of security and safety is related to a lot of technical regulations, Italian mandatory regulation are:

• General Data Protection Regulation (GDPR): involves EU citizens everywhere they are and must be observed by any entity company and institution that treated personal data.
• Network and Information System Directive: it is about system, for a more technological aspect that handle personal data, it applies to critical infrastructure that cannot be block, here data flow continually.
• Minimal measure of security ICT and data treatment: they are a practical reference for evaluating and improving the level of IT security of administrations, in order to counter the most frequent cyber threats. The measures consist of controls of a technological, organizational and procedural nature and useful for the Public Administrations to assess their level of IT security.

There are other regulations that are optional, so the hospital could choose to comply with this control.

GDPR

General Data Protection Regulation (GDPR) is a European regulation, valid in all the UE countries, for protecting personal data. Enforced on 25 May 2018, aims to harmonize data privacy laws across Europe, and to protect and empower all EU citizens data privacy, both from legal both from technical point of view.

• Art. 5 GDPR – principles relating to processing of personal data. Personal data shall be: processed lawfully, fairly and in a transparent manner in relation to the data subject. They are collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Art. 9 GDPR – Processing of special categories of personal data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, biometric data for the purpose of uniquely identifying a natural person, data concerning health or person's sex life or sexual orientation, shall be prohibited. It does not applies if the data subject has given explicit consent to the processing of those personal data for some specified purposes.
• Art. 32 GDPR – Security of processing: the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the pseudonymisation and encryption of personal data; the ability to ensure confidentiality (the state of keeping or being kept secret or private), integrity (internal consistency or lack of corruption in electronic data), availability (the quality of being able to be used or obtained) and resilience (resilient to accidents, made with redundancy) of processing systems and services.

GDPR actors

European Data Protection Board – the board is composed of the head of a supervisory authority of each Member State and of the European Data Protection Supervisor. Its role is to review what is working and what is not working and to give advice and guidance. The Board has a Chair/President. There’s consultation between the European Union commission and the Board.

Supervisory Authority – an independent public authority which is established by any Member State to enforce legislation locally. It makes sure that the regulation is executed in each state. It is responsible for imposing and managing administration fines to controllers and processors. It must coordinate with other Supervisory Authorities when there are multiple actors in more than one-member state in any dispute.

Data Processor – a natural or legal person, public authority, agency or other body which process personal data on behalf of the controller. The processors do not determine the purpose and or means of the processing. They just process the data as requested by the controller. This also occurs when data processing is outsourced by the controller and data is processed by a third party (example: cloud service provider). Under the previous directive, it was only the data controller that would be fined in case of non-compliance. Under the new legislation, the processor is also liable.

Data controller – defines what personal data the company needs and for what purposes. The company then requests that data from people. It is responsible for compliance with the regulation. Under the new law, the controller must be able to demonstrate compliance at any given time following a request from SA or DSj.

Data subject – is a natural person, a living being.

Data Protection Officer – It is a new figure created by GDPR. It is mandatory only for those controllers and processors whose core activities consists of processing operations which require regular and systematic monitoring of data subject (i.e. university) on a large scale or of special categories of data, including information such as health data or religious and political beliefs.

It must be appointed in the basis of professional qualities and expert knowledge on data protection law and practice. It must be a staff member or an external professional. Appropriate resources are provided to carry out their tasks and maintain their expert knowledge. That must report directly to the highest level of management and not carry out other tasks that could result in a conflict of interest.

GDPR key elements

There are some right that people have on their data, and those are regulated by GDPR:

• Breach notification: is mandatory for any data breach that is likely to “result in a risk for the rights and freedoms of individuals”. It must be done within 72 hours after discovering the breach. Data possessors must notify data controllers “without undue delay” after direst becoming aware of a data breach.
• Right to access: obtain from the data controller confirmation as to whether a citizen’s personal data are being processed, where and for what purpose. The controller shall provide a copy to the personal data, free of charge, in an electronic format.
• Right to be Forgotten: the data subject can request the data controller to erase his/her personal data, crease further dissemination of the data, and potentially have third parties halt processing of the data.
• Data portability: the data subject has the right to receive his/her personal data in a ‘commonly use and machine-readable format’ and has the right to transmit that data to another controller.
• Privacy by Design and by Default: inclusion of data protection from the onset of the designing of systems, rather than an addition.
• Data minimization: controllers must hold and process only the data necessary for the completion of their duties. Access to personal data must be limited to those needing to perform their processing.
• Security of processing: the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

Pseudonymization and anonymization

Pseudonymization and anonymization – The two main measure used for data protection are:

• Pseudonymization: data management and de-identification procedure by which personally identifiable information fields within a data record are replaced by one or more artificial identifiers, or pseudonyms. Pseudonymized data can still go through re-identification to associate them again with a subject. Some Pseudonymization techniques are Scrambling: mixing or obfuscation of letters, the process may be reversible or not; Encryption (symmetric): reversible for there who know the secret key; Masking: some important/unique part of the data is replaced with random characters or other data; Tokenization: non-mathematical approach that replaces sensitive data with non-sensitive substitutes, referred to as token; Blurring: uses an approximation of data values.
• Anonymization: personal data are rendered anonymous in such a fashion that the data subject is no longer identifiable, and GDPR does not apply to anonymous data. Data cannot be re-identified. k-Anonymity is a special form of anonymization in which info of each subject cannot be distinguished from that of at least other k-1 individual. For example, you have 10 individuals with the same data (all born in august but we don’t know the day). The greater k, the more ambiguous is the identification. Let RT(A_1, ….. , A_n) be a table and QI is a “quasi identifier” associated with it. RT is said to satisfy k-anonymity if and only if each sequence of RT values in RT [QI] appears with at least k occurrences in RT [QI]. This is made by generalization, i.e. by transforming the QI values into less specific forms so that they no longer uniquely represent individuals. k-anonymity guarantees that an individual can be associated with her/his real tuple with a probability of a most 1/k.

Introduction to cryptography

Cryptography is one of the main technique we need for data protection. At each time of history, people tried to protect data and messages using Steganography – hiding the message without altering its shape. Examples: engraving of hidden text on wooden tables covered with wax, Invisible ink, microdots or money etc or Cryptography – by altering a message, it is made unintelligible for anyone who has not some secret tools that, instead, are owned by the writer and the legitimate reader.

Today cryptography studies the design of secure systems both with Cryptanalysis that studies techniques to "break" cryptographic systems are the two main part of Cryptology that studies communication over insecure channels and its problems. Cryptology and cryptanalysis are strictly link and improve together.

General model of cryptographic system

General model of cryptographic system – Three people named Alice Bob and Eve are the main actor of the transmission of a message: Alice is the user who generates the message, Bob is the receiver of the message and Eve is the malicious user who want to intercept the message.

In the simplest model, Alice protect the message creating a secret key and somehow share it with Bob so they own two copies of the same key. These two copies are used to perform description and inscription: Alice starts with the plaintext = message in clear and uses some encryption methods in which she put the message as input, uses the secret key as a second input and the box produced as output the ciphertext = message encrypted (or hidden).

These ciphertext is shared in the public network and reaches Bob passing into the decryption box that gives the original message in the condition in which Bob has the decryption key. Eve is looking in the public network for some message passing, she try to get it and read the content. If Alice transmits the cyphertext, Eve could get it, she could know the encryption algorithm but since she has not the secret key she could not read the original content.

Secrecy of the message (confidentiality) depends on secrecy of the key. The most common Eve’s attacks could be, passive attacks in which her goals could be read one or more secret messages or find the secret key and then read all secret messages or also active attack where she alter the secret message or impersonate Alice (forge messages).

Today if we want to be sure that a cryptographic system has a reasonable level of security we have to consider these kind of possible attacks: the first is the one in which is known the ciphertext only, it is the most difficult attach because the malicious user has few information; in the second is known the ciphertext and the corresponding plaintext, in this case is now some part of cyphertext with the corresponding plaintext. The last two are those in which encryption and decryption machine are temporary accessible so plaintext and ciphertext can be chosen. The used could choose several plaintext encrypting them and record the corresponding ciphertext without knowing the ciphertext to be attached.

The way to share the key between the two main user is based on Kerckoffs principle (1883): the security of a cryptographic system cannot be based on the secrecy of the encryption/decryption algorithm conversely, it is based on the secrecy of the key. The rules imposed by Kerckoffs, valid still today are:

• A cryptographic system must be physically, if not mathematically, indecipherable (perfect cipher).
• The system should not require secrecy, and must be able to fall into alien hands without drawbacks.
• It must be possible to exchange and store the key without the need of written notes, and it must be possible to change the key when desired by users.
• The system must be applicable to telegraphic correspondence.
• The system must be portable and its use and operation must not require the availability of a large number of people.
• Finally, given the circumstances in which it will presumably be used, the system must not require knowledge of a long set of rules, or be difficult to apply.

Symmetric cryptography

Symmetric (or private key) cryptography – The first and oldest form of cryptography. Alice and Bob shared a copy the secret key before communication start. Alice starts from a plaintext input, transforms the plaintext (X) into a cyphertext message through the secret key (K). She used an encryption algorithm (E) that starting from k and X gives the cyphertext (Y).

Y = E(K, X)

Then the cyphertext is transmitted to Bob that having the copy of the key is able to get back the initial message using a decryption algorithm (D) under the condition is that the input (K, Y) are consistent.

X = D(K, Y)

Even if Eve intercept Y could not read the message because does not know k.

There are different algorithm to do it, the two modern cryptosystems are Data Encryption Standard (DES) and, the most used today, Advanced Encryption Standard (AES).

Asymmetric cryptography

Asymmetric (or public key) cryptography – Is the method used today. Starting from 1972 researchers found mathematical solution to asymmetric encryption using paired keys, one is secret one is public. First the user (Alice) computes the private key, than starting from the private key, applies a one way function to obtain the public key. The one way function is a function that can be easily computed in one direction but is unfeasible (impossibile) to compute in the other direction. So Alice could create the public key with these function but none, neither Alice, could go back to the private key. After that the key is published because do not reveal information of the private one.

The cryptographic algorithm is splitted in two part: one for encryption one for decryption, the public key is used only for encryption instead the private one is used only for decryption. These means that Bob, who has all the public keys, want to send Alice a private message. He could take her public key in the public directory for encryption and then can transmit the ciphertext to Alice.

The encryption algorithm (E), uses as input the Alice’s public key (PUa) and the plaintext (X), and compute the ciphertext (Y).

Y = E(PUa, X)

The message is transmitted to Alice gain. She is the only use who knows the private key corresponding to the public one used and she can use the decryption algorithm (D), the private kay (PRa) and the cyphertext to obtain the plaintext (X).

X = D(PRa, Y)

We have two different boxes E/D that work with different keys so there’s no more the problem to share safely the key, top! Even if Eve get the ciphertext and the public key she can make the decryption in anyway because she does not know the Alice’s private key. The most important asymmetric algorithm are RSA, El Gamal McEl…

Digital signatures

Digital Signatures – Another use of asymmetric cryptography is the case in which we want to keep secret authentication of the message. So the case in which when Bob sent a message to A