Preserving Data Confidentiality Research Articles

Pregnant People-Infant Linkage for Surveillance

Objectives and ApproachAs maternal mortality and morbidity continue to progress, better data is needed to comprehensively understand the problem, especially in underserved populations who are differentially impacted. Surveillance in safety-net populations is complicated by care fragmentation and interoperability challenges between primary care and hospital settings. . AllianceChicago (AC), a health center-controlled network, supports a common data infrastructure across a set of Federally Qualified Health Centers (FQHCs) in Chicago that is further linked to a distributed query infrastructure connecting Chicago’s major health systems known as CAPriCORN. Leveraging electronic health record (EHR) data collected by the AC and CAPriCORN consortium, the objective of this surveillance effort was to connect infant data with maternal data while protecting privacy. We developed a deterministic matching algorithm that utilized multiple approaches and technologies for Pregnant People-Infant (PPI) pair identification. The linkage process involved a five-step method in which each step is recorded within the linkage database and the confidence interval is calculated. ResultsPreliminary analyses are ongoing. Through each step of the linkage process, the confidence interval increased with the increase of matching nodes, highlighting its accumulative accuracy. The result demonstrates the feasibility of linking maternal and baby healthcare characteristics using a range of clinical and demographic variables captured in pseudonymized hospital and ambulatory data. Conclusions and ImplicationsOur approach improves the capacity of EHR data for surveillance while protecting patient privacy and preserving data confidentiality. Triangulating outcomes recorded in different settings can help improve data quality for research and surveillance.

Plug-and-play four-state modulation continuous-variable quantum key distribution

In this paper, a novel and highly efficient secure communication scheme is proposed through the integration of four-state modulation quantum key distribution and plug-and-play technology. This scheme serves the purpose of transmitting information reliably while preserving data confidentiality between two communicating parties. The most important advantage of the proposed continuous-variable QKD system is that the birefringence effect in fiber can be compensated automatically. Notably, simulation experimental evaluations are conducted, unveiling the performance of the plug-and-play four-state QKD which is as good as the four-state protocol when having small Rayleigh scattering noise. Furthermore, we conduct a comprehensive analysis of potential security threats targeted at the proposed protocol, thereby substantiating its robustness against such attacks. Moreover, theoretical justifications are provided to validate the security of the proposed scheme.

Secure Extraction of Personal Information from EHR by Federated Machine Learning.

Secure extraction of Personally Identifiable Information (PII) from Electronic Health Records (EHRs) presents significant privacy and security challenges. This study explores the application of Federated Learning (FL) to overcome these challenges within the context of French EHRs. By utilizing a multilingual BERT model in an FL simulation involving 20 hospitals, each represented by a unique medical department or pole, we compared the performance of two setups: individual models, where each hospital uses only its own training and validation data without engaging in the FL process, and federated models, where multiple hospitals collaborate to train a global FL model. Our findings demonstrate that FL models not only preserve data confidentiality but also outperform the individual models. In fact, the Global FL model achieved an F1 score of 75,7%, slightly comparable to that of the Centralized approach at 78,5%. This research underscores the potential of FL in extracting PIIs from EHRs, encouraging its broader adoption in health data analysis.

Encryption techniques for financial data security in fintech applications

In the dynamic world of financial technology (Fintech), securing financial data is a key priority. Increasing digital connectivity, adoption of cloud-based services requiring complex measures to protect the integrity, privacy and availability of sensitive information. Encryption techniques are emerging as a key tool to achieve these goals about itself by converting plaintext into ciphertext, protected from unauthorized access and probability violations. This review paper examines the various encryption techniques required to secure financial information in fintech applications. The main methods described include symmetric encryption, asymmetric and hybrid encryption techniques. Additionally, the function of end-to-end encryption (E2EE) is discussed in terms of protecting data privacy while it is being sent, which is essential for safeguarding sensitive financial activities such as mobile banking and digital payments. With its sophisticated method of permitting calculations on encrypted data without the need for decryption, homomorphic encryption shows promise for facilitating safe data analysis in Fintech settings while preserving data confidentiality. Each encryption method is scrutinized in terms of its strengths, weaknesses and practical applications in Fintech. Considerations such as computing efficiency, scalability, and regulatory compliance are addressed to provide insights for optimizing data protection strategies while adhering to industry standards and regulatory frameworks. The future of Fintech security is expected to be shaped by new developments in encryption technology, including post-quantum cryptography, artificial intelligence integration for adaptive security measures, and privacy-preserving solutions. The goal of these advancements is to strengthen the robustness of financial data security techniques in an increasingly linked digital world while mitigating changing cyber risks.

Data Security and Privacy Mechanism Based on Key Exposure Method over Cloud

Recent news reveal a powerful attacker which breaks data confidentiality by acquiring cryptographic keys, by means of coercion or backdoors in cryptographic software. Once the encryption key is exposed, the only viable measure to preserve data confidentiality is to limit the attacker’s access to the ciphertext. This may be achieved, for example, by spreading ciphertext blocks across servers in multiple administrative domains—thus assuming that the adversary cannot compromise all of them. Nevertheless, if data is encrypted with existing schemes, an adversary equipped with the encryption key, can still compromise a single server and decrypt the ciphertext blocks stored therein. In this paper, we study data confidentiality against an adversary which knows the encryption key and has access to a large fraction of the ciphertext blocks. To this end, we propose Bastion, a novel and efficient scheme that guarantees data confidentiality even if the encryption key is leaked and the adversary has access to almost all ciphertext blocks. We analyze the security of Bastion, and we evaluate its performance by means of a prototype implementation. We also discuss practical insights with respect to the integration of Bastion in commercial dispersed storage systems.

ПРИНЦИПИ РОЗВИТКУ ІНФОРМАЦІЙНОГО ЗАБЕЗПЕЧЕННЯ ЛОГІСТИЧНИХ ПРОЦЕСІВ У ТОРГІВЛІ

he development of information support for logistical processes in trade encompasses various aspects aimed at optimizing and improving their efficiency. However, issues such as system instability or obsolescence, software deficiencies, and limited compatibility among them can complicate the implementation of new technologies. The increasing volume of digital information requires security measures to preserve data confidentiality and integrity. Based on a thorough analysis of the key principles of developing information support for logistical processes in trade, it has been demonstrated that the integration of technologies, digital transformation, openness, standardization, analytics, forecasting, flexibility, scalability, security provision, mobility, as well as collaboration and data exchange are crucial principles for successful supply chain management. These principles are interrelated and complementary creating a solid foundation for enhancing efficiency, optimizing costs, and improving customer satisfaction. It is argued that implementing these principles enables companies to quickly adapt to changes in market conditions, effectively respond to challenges in the modern business environment, and ensure a high level of competitiveness. This is made possible by optimizing logistical processes, reducing order processing time, improving demand forecasting accuracy, and ensuring supply continuity. It is argued that the successful implementation of these principles requires companies not only to adopt advanced technologies but also to be prepared for cultural changes, including openness to innovation, willingness to collaborate, and data exchange among all participants in the logistics chain. Through this, companies can create an efficient, flexible, and secure logistics system capable of meeting the needs of the modern market and ensuring high customer satisfaction. The development of information support for logistical processes in trade, based on the principles of technology integration, digital transformation, flexibility, and other key aspects, forms the basis for increasing efficiency, reducing costs, and improving service. Collaboration and data exchange provide companies with the ability to quickly adapt to market changes, optimize supply chains, and ensure competitiveness. The use of modern technologies and approaches, including mobility and data security provision, plays a crucial role in creating an effective and reliable logistics system.

Using encrypted genotypes and phenotypes for collaborative genomic analyses to maintain data confidentiality.

To adhere to and capitalize on the benefits of the FAIR (findable, accessible, interoperable, and reusable) principles in agricultural genome-to-phenome studies, it is crucial to address privacy and intellectual property issues that prevent sharing and reuse of data in research and industry. Direct sharing of genotype and phenotype data is often prohibited due to intellectual property and privacy concerns. Thus, there is a pressing need for encryption methods that obscure confidential aspects of the data, without affecting the outcomes of certain statistical analyses. A homomorphic encryption method for genotypes and phenotypes (HEGP) has been proposed for single-marker regression in genome-wide association studies (GWAS) using linear mixed models with Gaussian errors. This methodology permits frequentist likelihood-based parameter estimation and inference. In this paper, we extend HEGP to broader applications in genome-to-phenome analyses. We show that HEGP is suited to commonly used linear mixed models for genetic analyses of quantitative traits including genomic best linear unbiased prediction (GBLUP) and ridge-regression best linear unbiased prediction (RR-BLUP), as well as Bayesian variable selection methods (e.g. those in Bayesian Alphabet), for genetic parameter estimation, genomic prediction, and GWAS. By advancing the capabilities of HEGP, we offer researchers and industry professionals a secure and efficient approach for collaborative genomic analyses while preserving data confidentiality.

MAPLE: A Metadata-Hiding Policy-Controllable Encrypted Search Platform with Minimal Trust

Commodity encrypted storage platforms (e.g., IceDrive, pCloud) permit data store and sharing across multiple users while preserving data confidentiality. However, end-to-end encryption may not be sufficient since it only offers confidentiality when the data is at rest or in transit. Meanwhile, sensitive information can be leaked from metadata representing activities during data operations (e.g., query, processing). Recent encrypted search platforms such as DORY (OSDI’20) or DURASIFT (WPES’19) permit multi-user data query functionalities, while protecting metadata privacy. However, they either incur a high processing overhead or offer limited security/functionality, and require strong trust assumptions. We propose MAPLE, a new metadata-hiding encrypted search platform that offers query functionalities (search, update) on the shared data across multiple users with complex policy controls. MAPLE protects metadata privacy all the time during query processing, while achieving significantly (asymptotically) lower processing overhead than state-of-the-art platforms. The core technique of MAPLE is the design of oblivious data structures for search index and access control coupled with secure computation techniques to enable efficient query processing with a minimal trust. We fully implemented MAPLE and evaluated its performance on commodity cloud (Amazon EC2) under real settings. Experimental results showed that MAPLE achieved a concrete performance comparable with its counterparts, while offering provably stronger security guarantees and more diverse functionalities.

A Secure and Privacy-Preserving Blockchain-Based XAI-Justice System

Pursuing “intelligent justice” necessitates an impartial, productive, and technologically driven methodology for judicial determinations. This scholarly composition proposes a framework that harnesses Artificial Intelligence (AI) innovations such as Natural Language Processing (NLP), ChatGPT, ontological alignment, and the semantic web, in conjunction with blockchain and privacy techniques, to examine, deduce, and proffer recommendations for the administration of justice. Specifically, through the integration of blockchain technology, the system affords a secure and transparent infrastructure for the management of legal documentation and transactions while preserving data confidentiality. Privacy approaches, including differential privacy and homomorphic encryption techniques, are further employed to safeguard sensitive data and uphold discretion. The advantages of the suggested framework encompass heightened efficiency and expediency, diminished error propensity, a more uniform approach to judicial determinations, and augmented security and privacy. Additionally, by utilizing explainable AI methodologies, the ethical and legal ramifications of deploying intelligent algorithms and blockchain technologies within the legal domain are scrupulously contemplated, ensuring a secure, efficient, and transparent justice system that concurrently protects sensitive information upholds privacy.

Generalized Policy-Based Noninterference for Efficient Confidentiality-Preservation

As more organizations are leveraging third-party cloud and edge data centers to process data efficiently, the issue of preserving data confidentiality becomes increasingly important. In response, numerous security mechanisms have been introduced and promoted in recent years including software-based ones such as homomorphic encryption, as well as hardware-based ones such as Intel SGX and AMD SEV. However these mechanisms vary in their security properties, performance characteristics, availability, and application modalities, making it hard for programmers to judiciously choose and correctly employ the right one for a given data query. This paper presents a mechanism-independent approach to distributed confidentiality-preserving data analytics. Our approach hinges on a core programming language which abstracts the intricacies of individual security mechanisms. Data is labeled using custom confidentiality levels arranged along a lattice in order to capture its exact confidentiality constraints. High-level mappings between available mechanisms and these labels are captured through a novel expressive form of security policy. Confidentiality is guaranteed through a type system based on a novel formulation of noninterference, generalized to support our security policy definition. Queries written in a largely security-agnostic subset of our language are transformed to the full language to automatically use mechanisms in an efficient, possibly combined manner, while provably preserving confidentiality in data queries end-to-end. We prototype our approach as an extension to the popular Apache Spark analytics engine, demonstrating the significant versatility and performance benefits of our approach over single hardwired mechanisms --- including in existing systems --- without compromising on confidentiality.

Enabling inter-organizational analytics in business networks through meta machine learning

AbstractSuccessful analytics solutions that provide valuable insights often hinge on the connection of various data sources. While it is often feasible to generate larger data pools within organizations, the application of analytics within (inter-organizational) business networks is still severely constrained. As data is distributed across several legal units, potentially even across countries, the fear of disclosing sensitive information as well as the sheer volume of the data that would need to be exchanged are key inhibitors for the creation of effective system-wide solutions—all while still reaching superior prediction performance. In this work, we propose a meta machine learning method that deals with these obstacles to enable comprehensive analyses within a business network. We follow a design science research approach and evaluate our method with respect to feasibility and performance in an industrial use case. First, we show that it is feasible to perform network-wide analyses that preserve data confidentiality as well as limit data transfer volume. Second, we demonstrate that our method outperforms a conventional isolated analysis and even gets close to a (hypothetical) scenario where all data could be shared within the network. Thus, we provide a fundamental contribution for making business networks more effective, as we remove a key obstacle to tap the huge potential of learning from data that is scattered throughout the network.

An intelligent DDoS attack detection tree-based model using Gini index feature selection method

Cyber security has recently garnered enormous attention due to the popularity of the Internet of Things (IoT), intelligent devices’ rapid growth, and a vast number of real-life applications. As a result, detecting threats and constructing an efficient Intrusion detection system (IDS) have become crucial in today's security requirements. Withal, the large amount of high dimensional data might influence detection effectiveness and raise the computation requirements. Artificial Intelligence (AI) has recently attracted much attention and is widely used to build intelligent IDSs to preserve data confidentiality, integrity, and availability. Distributed denial of service (DDoS) is a denial of service (DoS) variant mainly targeting asset availability. Preventing DoS at the network or infrastructure level typically depends on implementing an IDS. This paper proposes a novel intelligent DDoS attack detection model based on a Decision Tee (DT) algorithm and an enhanced Gini index feature selection method. Our approach is evaluated on the UNSW-NB15 dataset, which contains 1,140,045 samples and is more recent and comprehensive than those used in previous works. Our system achieved an overall accuracy of 98%, outperforming baseline models that used more advanced algorithms such as Random Forest and XGBoost. Our enhanced Gini index feature selection method allowed us to select only 13 out of 45 security features, significantly reducing the data dimensionality and avoiding overfitting issues. Our model also has a lower false alarm rate, misclassifying only 2% of the testing instances. Our approach is, therefore, highly effective and efficient, with the potential to be used in real-world network security applications.

Hill Matrix and Radix-64 Bit Algorithm to Preserve Data Confidentiality

There are many cloud data security techniques and algorithms available that can be used to detect attacks on cloud data, but these techniques and algorithms cannot be used to protect data from an attacker. Cloud cryptography is the best way to transmit data in a secure and reliable format. Various researchers have developed various mechanisms to transfer data securely, which can convert data from readable to unreadable, but these algorithms are not sufficient to provide complete data security. Each algorithm has some data security issues. If some effective data protection techniques are used, the attacker will not be able to decipher the encrypted data, and even if the attacker tries to tamper with the data, the attacker will not have access to the original data. In this paper, various data security techniques are developed, which can be used to protect the data from attackers completely. First, a customized American Standard Code for Information Interchange (ASCII) table is developed. The value of each Index is defined in a customized ASCII table. When an attacker tries to decrypt the data, the attacker always tries to apply the predefined ASCII table on the Ciphertext, which in a way, can be helpful for the attacker to decrypt the data. After that, a radix 64-bit encryption mechanism is used, with the help of which the number of cipher data is doubled from the original data. When the number of cipher values is double the original data, the attacker tries to decrypt each value. Instead of getting the original data, the attacker gets such data that has no relation to the original data. After that, a Hill Matrix algorithm is created, with the help of which a key is generated that is used in the exact plain text for which it is created, and this Key cannot be used in any other plain text. The boundaries of each Hill text work up to that text. The techniques used in this paper are compared with those used in various papers and discussed that how far the current algorithm is better than all other algorithms. Then, the Kasiski test is used to verify the validity of the proposed algorithm and found that, if the proposed algorithm is used for data encryption, so an attacker cannot break the proposed algorithm security using any technique or algorithm.

A High Secured Steganalysis Using QVDHC Model

Data compression plays a vital role in data security as it saves memory, transfer speed is high, easy to handle and secure. Mainly the compression techniques are categorized into two types. They are lossless, lossy data compression. The data format will be an audio, image, text or video. The main objective is to save memory of using these techniques is to save memory and to preserve data confidentiality, integrity. In this paper, a hybrid approach was proposed which combines Quotient Value Difference (QVD) with Huffman coding. These two methods are more efficient, simple to implement and provides better security to the data. The secret message is encoded using Huffman coding, while the cover image is compressed using QVD. Then the encoded data is embedded into cover image and transferred over the network to receiver. At the receiver end, the data is decompressed to obtain original message. The proposed method shows high level performance when compared to other existing methods with better quality and minimum error.

Budget Distributed Support Vector Machine for Non-ID Federated Learning Scenarios

In recent years, there has been remarkable growth in Federated Learning (FL) approaches because they have proven to be very effective in training large Machine Learning (ML) models and also serve to preserve data confidentiality, as recommended by the GDPR or other business confidentiality restrictions that may apply. Despite the success of FL, performance is greatly reduced when data is not distributed identically (non-ID) across participants, as local model updates tend to diverge from the optimal global solution and thus the model averaging procedure in the aggregator is less effective. Kernel methods such as Support Vector Machines (SVMs) have not seen an equivalent evolution in the area of privacy preserving edge computing because they suffer from inherent computational, privacy and scalability issues. Furthermore, non-linear SVMs do not naturally lead to federated schemes, since locally trained models cannot be passed to the aggregator because they reveal training data (they are built on Support Vectors), and the global model cannot be updated at every worker using gradient descent. In this article, we explore the use of a particular controlled complexity (“Budget”) Distributed SVM (BDSVM) in the FL scenario with non-ID data, which is the least favorable situation, but very common in practice. The proposed BDSVM algorithm is as follows: model weights are broadcasted to workers, which locally update some kernel Gram matrices computed according to a common architectural base and send them back to the aggregator, which finally combines them, updates the global model, and repeats the procedure until a convergence criterion is met. Experimental results using synthetic 2D datasets show that the proposed method can obtain maximal margin decision boundaries even when the data is non-ID distributed. Further experiments using real-world datasets with non-ID data distribution show that the proposed algorithm provides better performance with less communication requirements than a comparable Multilayer Perceptron (MLP) trained using FedAvg. The advantage is more remarkable for a larger number of edge devices. We have also demonstrated the robustness of the proposed method against information leakage, membership inference attacks, and situations with dropout or straggler participants. Finally, in experiments run on separate processes/machines interconnected via the cloud messaging service developed in the context of the EU-H2020 MUSKETEER project, BDSVM is able to train better models than FedAvg in about half the time.

Securing Cloud Data Under Key Exposure

Abstract: Recent news reveal a powerful attacker which breaks data confidentiality by acquiring cryptographic keys, by means of coercion or backdoors in cryptographic software. Once the encryption key is exposed, the only viable measure to preserve data confidentiality is to limit the attacker’s access to the ciphertext. This may be achieved, for example, by spreading ciphertext blocks across servers in multiple administrative domains—thus assuming that the adversary cannot compromise all of them. Nevertheless, if data is encrypted with existing schemes, an adversary equipped with the encryption key, can still compromise a single server and decrypt the ciphertext blocks stored therein. In this paper, we study data confidentiality against an adversary which knows the encryption key and has access to a large fraction of the ciphertext blocks[3]. To this end, we propose Bastion, a novel and efficient scheme that guarantees data confidentiality even if the encryption key is leaked and the adversary has access to almost all ciphertext blocks. We analyze the security of Bastion, and we evaluate its performance by means of a prototype implementation. We also discuss practical insights with respect to the integration of Bastion in commercial dispersed storage systems.

Ubiquitous Secure Communication in a Future Internet Architecture

In a world with increasing simplicity to store, transfer, and analyze large volumes of data, preserving data confidentiality and integrity of Internet traffic by default becomes more and more important. Unfortunately, a large gap exists between low-security opportunistic encryption and trust-on-first-use (TOFU) protocols, and high-security communication, such as TLS using server certificates or DNSSEC. Our goal is to reduce this gap and provide a base layer for authentication and secrecy that is strictly better than TOFU security. We achieve this by integrating the authentication method PILA into the future Internet architecture SCION. This combines PILA’s address-based authentication, which leverages irrefutable cryptographic proof of misbehavior, and the flexibility of SCION’s control-plane PKI and its per-AS independent addressing scheme. In this work, two concrete issues of PILA are addressed: (1) the reliance on the hierarchical RPKI which introduces a single global trust root, i.e., a single point of failure regarding the security of PILA, and (2) the necessity of an out-of-band communication to prevent downgrade attacks, which can incur a latency overhead and might be used as a resource exhaustion attack vector. We describe how PILA in combination with SCION mitigates these issues and analyze the security of the system. Finally, we discuss several interesting use cases including the SSH, TLS, and DNS protocols.

A NOVEL APPROACH FOR DATA CONFIDENTIALITY UNDER KEY EXPOSURE IN CLOUDS

Recent surveys reveals a powerful attacker which breaks data confidentiality by acquiring cryptographic keys, by means of coercion or backdoors in cryptographic software. Once the encryption key is exposed, the only viable measure to preserve data confidentiality is to limit the attacker’s access to the ciphertext. Nevertheless, if data is encrypted with existing schemes, an adversary equipped with the encryption key, can still compromise a single server and decrypt the ciphertext blocks stored therein. In this paper, we study data confidentiality against an adversary which knows the encryption key and has access to a large fraction of the ciphertext blocks. To this end, we propose Bastion, a novel and efficient scheme that guarantees data confidentiality even if the encryption key is leaked and the adversary has access to almost all ciphertext blocks[8]. Index terms – Data Confidentiality, Key exposure, dispersed storage.

Security and privacy issues in federated healthcare – An overview

Abstract Securing medical records is a significant task in Healthcare communication. The major setback during the transfer of medical data in the electronic medium is the inherent difficulty in preserving data confidentiality and patients’ privacy. The innovation in technology and improvisation in the medical field has given numerous advancements in transferring the medical data with foolproof security. In today’s healthcare industry, federated network operation is gaining significance to deal with distributed network resources due to the efficient handling of privacy issues. The design of a federated security system for healthcare services is one of the intense research topics. This article highlights the importance of federated learning in healthcare. Also, the article discusses the privacy and security issues in communicating the e-health data.

Patient privacy in smart cities by blockchain technology and feature selection with Harris Hawks Optimization (HHO) algorithm and machine learning.

A medical center in the smart cities of the future needs data security and confidentiality to treat patients accurately. One mechanism for sending medical data is to send information to other medical centers without preserving confidentiality. This method is not impressive because in treating people, the privacy of medical information is a principle. In the proposed framework, the opinion of experts from other medical centers for the treatment of patients is received and consider the best therapy. The proposed method has two layers. In the first layer, data transmission uses blockchain. In the second layer, blocks related to patients’ records analyze by machine learning methods. Patient records place in a block of the blockchain. Block of patient sends to other medical centers. Each treatment center can recommend the proposed type of treatment and blockchain attachment and send it to all nodes and treatment centers. Each medical center receiving data of the patients, then predicts the treatment using data mining methods. Sending medical data between medical centers with blockchain and maintaining confidentiality is one of the innovations of this article. The proposed method is a binary version of the HHO algorithm for feature selection. Another innovation of this research is the use of majority voting learning in diagnosing the type of disease in medical centers. Implementation of the proposed system shows that the blockchain preserves data confidentiality of about 100%. The reliability and reliability of the proposed framework are much higher than the centralized method. The result shows that the accuracy, sensitivity, and precision of the proposed method for diagnosing heart disease are 92.75%, 92.15%, and 95.69%, respectively. The proposed method has a lower error in diagnosing heart disease from ANN, SVM, DT, RF, AdaBoost, and BN.