Process Sensitive Data Research Articles

Distributed-Ledger-Based Blockchain Technology for Reliable Electronic Voting System with Statistical Analysis

In today’s society, voting is crucial to choosing the representatives of the people. The current voting process is filled with a vast array of disputes and manipulations. The leader must be selected in a precise manner without any malpractices. In addition, the people and authorities are not happy with the election results and label them unpredictable. We offer a better solution to the current problems, such as tampering, non-residents voting outside of the polling place, quick results analysis, quick counting, and reduced use of staff and funds during the electoral franchise process. In this offer, blockchain technology is used to create the distributed application (dApp) framework that will be used for the proposed e-voting system. Additionally, it offers unique characteristics such as immutability, transparency, privacy, and reception freedom that reduce crimes involving the processing of sensitive data in the electoral process. Ganache, MetaMask, and specified dagger hashing algorithm are used to develop the dApp. A key strength of this paper is the statistical analysis of transactions on the blockchain. Moreover, it also provides security to voters’ identity and leads to immediate acceptable counting results with more accuracy.

ASSERT: A Blockchain-Based Architectural Approach for Engineering Secure Self-Adaptive IoT Systems.

Internet of Things (IoT) systems are complex systems that can manage mission-critical, costly operations or the collection, storage, and processing of sensitive data. Therefore, security represents a primary concern that should be considered when engineering IoT systems. Additionally, several challenges need to be addressed, including the following ones. IoT systems’ environments are dynamic and uncertain. For instance, IoT devices can be mobile or might run out of batteries, so they can become suddenly unavailable. To cope with such environments, IoT systems can be engineered as goal-driven and self-adaptive systems. A goal-driven IoT system is composed of a dynamic set of IoT devices and services that temporarily connect and cooperate to achieve a specific goal. Several approaches have been proposed to engineer goal-driven and self-adaptive IoT systems. However, none of the existing approaches enable goal-driven IoT systems to automatically detect security threats and autonomously adapt to mitigate them. Toward bridging these gaps, this paper proposes a distributed architectural Approach for engineering goal-driven IoT Systems that can autonomously SElf-adapt to secuRity Threats in their environments (ASSERT). ASSERT exploits techniques and adopts notions, such as agents, federated learning, feedback loops, and blockchain, for maintaining the systems’ security and enhancing the trustworthiness of the adaptations they perform. The results of the experiments that we conducted to validate the approach’s feasibility show that it performs and scales well when detecting security threats, performing autonomous security adaptations to mitigate the threats and enabling systems’ constituents to learn about security threats in their environments collaboratively.

Load Balanced Data Transmission Strategy Based on Cloud–Edge–End Collaboration in the Internet of Things

To improve the response speed and quality of Internet of Things (IoT) services and reduce system operating costs, this paper refines the edge layer according to the different data transmission capabilities of different edge devices, constructs a four-layer heterogeneous IoT framework under cloud–edge–end (CEE) collaboration, and gives the corresponding data hierarchical transmission strategy, so as to effectively process sensitive data such as real-time, near-real-time, and non-real-time data. Meanwhile, the link based high-performance adaptive load balancing scheme is developed to achieve the dynamic optimal allocation of system resources. Simulation results demonstrate that the data hierarchical transmission strategy based on a CEE collaboration framework can not only make full use of resources and improve the successful delivery rate of packets but can also greatly reduce the end-to-end transmission delay of data. Especially, compared with the cloud-mist framework without refining the edge layer, the data transmission rate based on CEE collaboration architecture is increased by about 27.3%, 12.7%, and 8%, respectively, in three network environments of light-weight, medium, and heavy load.

Position paper on management of personal data in environment and health research in Europe.

Management of datasets that include health information and other sensitive personal information of European study participants has to be compliant with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). Within scientific research, the widely subscribed'FAIR' data principles should apply, meaning that research data should be findable, accessible, interoperable and re-usable. Balancing the aim of open science driven FAIR data management with GDPR compliant personal data protection safeguards is now a common challenge for many research projects dealing with (sensitive) personal data. In December 2020 a workshop was held with representatives of several large EU research consortia and of the European Commission to reflect on how to apply the FAIR data principles for environment and health research (E&H). Several recent data intensive EU funded E&H research projects face this challenge and work intensively towards developing solutions to access, exchange, store, handle, share, process and use such sensitive personal data, with the aim to support European and transnational collaborations. As a result, several recommendations, opportunities and current limitations were formulated. New technical developments such as federated data management and analysis systems, machine learning together with advanced search software, harmonized ontologies and data quality standards should in principle facilitate the FAIRification of data. To address ethical, legal, political and financial obstacles to the wider re-use of data for research purposes, both specific expertise and underpinning infrastructure are needed. There is a need for the E&H research data to find their place in the European Open Science Cloud. Communities using health and population data, environmental data and other publicly available data have to interconnect and synergize. To maximize the use and re-use of environment and health data, a dedicated supporting European infrastructure effort, such as the EIRENE research infrastructure within the ESFRI roadmap 2021, is needed that would interact with existing infrastructures.

Personal Health Data in Turkish Law and the Obligation of the Administration to Protect Personal Health Data

Hassas kişisel veriler kategorisi içinde yer alan kişisel sağlık verileri, “kimliği belirli ya da belirlenebilir gerçek kişiye ilişkin her türlü sağlık bilgisi” olarak tanımlanabilir. Bu tanımın kapsamına kişinin “geçmişi, şimdiki anı ve geleceğine ilişkin fiziksel ve ruhsal sağlığı hakkında her türlü bilgi ile kişiye sunulan sağlık hizmetiyle ilgili bilgiler” dahildir. 
 Bu çalışmada öncelikle, ulusal ve Türkiye’nin taraf olduğu uluslararası düzenlemeler ışığında, kişisel sağlık verileri kavramı ve bu verilerin işlenmesine ilişkin kurallar ve usuller ele alınacaktır. Türk hukukunda kişisel sağlık verilerinin işlenebileceği hallere ayrıca değinilecektir. Bu bağlamda, veri koruma hukukunda, hassas verilerin işlenmesinin diğer verilere kıyasla daha katı bir denetime tabi tutulması anlamına gelen hassaslık ilkesi ve veri toplama ve işlemenin bağlı olduğu amaç/amaçları gerçekleştirmek için zorunlu olan miktarla sınırlı olacak şekilde veri toplanması gerekliliğini ifade eden minimumluk ilkesine uygunluk değerlendirmesi yapılacaktır. Ardından, idarenin kişisel sağlık verilerinin korunmasına ilişkin yükümlülükleri açıklanacaktır. İdarenin kişisel sağlık verilerine ilişkin aydınlatma, veri güvenliğini sağlama, düzenleme ve denetleme yapma yükümlülüklerinin anlamı ve kapsamı ortaya konulacaktır. 
 Avrupa İnsan Hakları Mahkemesi ve Danıştay kararları ışığında, idarenin söz konusu yükümlülüklerini yerine getirmemesi durumunun nasıl ortaya çıkabileceği ve ortaya çıkış şekillerine göre sorumluluğunun türünün ve kapsamının ne olacağı ihtimallere göre değerlendirilecektir.

Trusted Platform Module-Based Privacy in the Public Cloud: Challenges and Future Perspective

Public cloud providers offer ready-to-use, easily scalable servers on demand for a variety of applications. Storing and processing private and sensitive data in the cloud brings multiple security issues and indeed these concerns currently prevent many users from utilizing cloud resources. Improving both security and trust for users is increasingly important for cloud providers. In this context, we first investigate the classes of security threats encountered by cloud applications. We then analyze various software- and hardware-based solutions to handle these security challenges and provide the user with a chain of trust. Our analysis shows that pure software-based solutions do not sufficiently mitigate the challenges of the cloud environment. Hardware-based solutions utilizing the Trusted Platform Module (TPM) alleviate the issues; however, it is challenging to implement in the public cloud environment. Finally, we introduce our TPM-SGX-based approach that utilizes software TPM and Software Guard Extension (SGX) to provide similar security as the hardware-based approach.

Determining Cyber Security-Related Behaviors of Internet Users: Example of the Faculty of Sport Sciences Students

Abstract The most practical and fastest way to access information in today’s world is via the internet. Thanks to the internet, the necessary information can be reached in a short time. Nevertheless, in addition to the benefits of the internet, it can also pose risks for users. For this reason, it is important to increase the level of awareness of individuals against threats that may occur in the cyber network. Sports organizations, like other sectors, process sensitive personal data and may face cyber attacks. It is important to determine the cyber security behaviors of the students of the faculty of sport sciences, who will be taking part in different careers in sports in the future, and so to contribute to the students’ development in this regard. In this study, the cyber security-related behaviors of the faculty of sport sciences students were examined in terms of gender, age, frequency of internet usage, frequency of monthly purchases of products or services over the internet, and level of knowledge about cyber security. The “Personal Cyber Security Provision Scale” developed by Erol and associates (2015) was used as a data collection tool. For this reason, ANOVA and Independent Samples t-Test were used to investigate the significant differences between the scale scores and the variables. According to the findings of the study, students’ behaviors related to cyber security differ according to gender, daily internet usage, monthly product or service purchase frequency, and knowledge level about cyber security. The age variable, on the other hand, does not affect cyber security behaviors. According to the results obtained from the Personal Cyber Security Ensuring Scale, the students of the faculty of sport sciences have high cyber security awareness. However, it is seen that they have lower scores from the factors of “Take Precautions” and “Privacy Protection” compared to other factors on the scale. Therefore, it is important for students to be informed about cyber security practices, what kind of precautions they should take in this regard, and how they can learn about improvements in this field to create cyber security awareness.

Rethinking Explicit Consent and Intimate Data: The Case of Menstruapps

Period-tracking software applications or ‘menstruapps’ have witnessed a surge in popularity in recent years. At the same time, many of them are a part of the adtech industry, using business models that create revenue by selling users’ personal and intimate data. This exploratory article brings menstruapps into a feminist legal debate. It investigates the supranational European legal standards on intimate and sensitive data processing, particularly the General Data Protection Regulation (GDPR). Scrutinising explicit consent according to GDPR Article 9, this paper, through empirical examples, claims that current legal standards are not enforced. The standards are, furthermore, theoretically insufficient to fully safeguard data subjects’ integrity and autonomy. Instead of abandoning the concept, the article reimagines consent, using a contextual and communicative model where power relations are taken into consideration, building on the feminist concept of freedom to negotiate.

A pilot study towards a smart-health framework to collect and analyze biomarkers with low-cost and flexible wearables

Artificial intelligence-enabled applications on edge devices have the potential to revolutionize disease detection and monitoring with smart health (sHealth) applications. The major challenges are user-friendly and flexible sensors for seamless collection of physiological data for long hours, online and on-device processing of sensitive medical data to facilitate privacy protection, reliable extraction of disease-related biomarkers, and implementation of lightweight artificially intelligent algorithms for inference at the edge without degrading the system performance. In this pilot project, we conducted a yearlong field study with 9 participants conducting 480 data collection sessions in the “living lab” environment. We used smartphones as the edge computing device and implemented pre-trained machine learning algorithms in the smartphone app for computing disease-related Events-of-Interest (EoI). We considered real-time data processing on the smartphone itself without sharing raw data with the cloud or any other computing facility to minimize privacy concerns, and network bandwidth requirements. We used a commercial smart band and a custom-designed zero-power inkjet-printed sensor for physiological sensing and capturing health biomarkers such as heart rate variability (HRV) and core body temperature. The extracted HRV feature values are within the 95% confidence interval of normative values. On top of that, the extracted HRV shows some informative trends i.e. hammock pattern for healthy subjects which may be helpful in subsequent research studies. Moreover, we used core body temperature with user-reported outcomes for estimating flu-related symptoms severity and visualizing the spatiotemporal trend in a cloud-server to facilitate personalized as well as community-wide health monitoring. Inference at the edge provided a data reduction of 3 order while the runtime latency, power consumption, memory requirement, and storage size of the smartphone app were 500 ms, 51.90 mAH, 9.4 MB, and 2.4 MB, respectively. Our developed framework of sHealth enables automated community-wide monitoring of symptoms severity in addition to personalized monitoring which paves the way for early monitoring of a disease outbreak for a smart and connected community.

Leveraging the Potential of Digital Technology for Better Individualized Treatment of Parkinson's Disease.

Recent years have witnessed a strongly increasing interest in digital technology within medicine (sensor devices, specific smartphone apps) and specifically also neurology. Quantitative measures derived from digital technology could provide Digital Biomarkers (DMs) enabling a quantitative and continuous monitoring of disease symptoms, also outside clinics. This includes the possibility to continuously and sensitively monitor the response to treatment, hence opening the opportunity to adapt medication pathways quickly. In addition, DMs may in the future allow early diagnosis, stratification of patient subgroups and prediction of clinical outcomes. Thus, DMs could complement or in certain cases even replace classical examiner-based outcome measures and molecular biomarkers measured in cerebral spinal fluid, blood, urine, saliva, or other body liquids. Altogether, DMs could play a prominent role in the emerging field of precision medicine. However, realizing this vision requires dedicated research. First, advanced data analytical methods need to be developed and applied, which extract candidate DMs from raw signals. Second, these candidate DMs need to be validated by (a) showing their correlation to established clinical outcome measures, and (b) demonstrating their diagnostic and/or prognostic value compared to established biomarkers. These points again require the use of advanced data analytical methods, including machine learning. In addition, the arising ethical, legal and social questions associated with the collection and processing of sensitive patient data and the use of machine learning methods to analyze these data for better individualized treatment of the disease, must be considered thoroughly. Using Parkinson's Disease (PD) as a prime example of a complex multifactorial disorder, the purpose of this article is to critically review the current state of research regarding the use of DMs, discuss open challenges and highlight emerging new directions.

Cost-optimized, data-protection-aware offloading between an edge data center and the cloud

An edge data center can host applications that require low-latency access to nearby end devices. If the resource requirements of the applications exceed the capacity of the edge data center, some non-latency-critical application components may be offloaded to the cloud. Such offloading may incur financial costs both for the use of cloud resources and for data transfer between the edge data center and the cloud. Moreover, such offloading may violate data protection requirements if components process sensitive data. The operator of the edge data center has to decide which components to keep in the edge data center and which ones to offload to the cloud. In this paper, we formalize this problem and prove that it is strongly NP-hard. We introduce an optimization algorithm that is fast enough to be run online for dynamic and automatic offloading decisions, guarantees that the solution satisfies hard constraints regarding latency, data protection, and capacity, and achieves near-optimal costs. We also show how the algorithm can be extended to handle multiple edge data centers. Experiments show that the cost of the solution found by our algorithm is on average only 2.7% higher than the optimum.

PANDA: Preference-Based Bandwidth Allocation in Fog-Enabled Internet of Underground-Mine Things

Traditionally, sensor networks are surmised to enhance safety in underground mines by providing consistent monitoring of the conditions. However, to cope with the frequent condition changes of such a hostile environment, we need a specific network architecture for the deployed nodes to enable dynamic decision making. In this article, we argue that the fog computing paradigm can be leveraged to ensure safety in the Internet of Underground-Mine Things. We emphasize on prioritizing and speeding up the processing of sensitive data by introducing a factor named “criticality index” and ensuring the fairness of bandwidth allocation using this index to comply with the resource requirement of critical data. We formulate the interaction between the fog nodes using the notions of the Stackelberg game. Simulation-based results show that using the proposed scheme, the fog nodes are able to allocate bandwidth with less average error and offset bandwidth, compared to the benchmark schemes.

The Difficulty of Defining Sensitive Data—The Concept of Sensitive Data in the EU Data Protection Framework

AbstractThe concept of sensitive data has been a mainstay of data protection for a number of decades. The concept itself is used to denote several categories of data for which processing is deemed to pose a higher risk for data subjects than other forms of data. Such risks are often perceived in terms of an elevated probability of discrimination, or related harms, to vulnerable groups in society. As a result, data protection frameworks have traditionally foreseen a higher burden for the processing of sensitive data than other forms of data. The sui generis protection of sensitive data—stronger than the protection of non-sensitive personal data—can also seemingly be a necessity from a fundamental rights-based perspective, as indicated by human rights jurisprudence. This Article seeks to analyze the continued relevance of sensitive data in both contemporary and potential future contexts. Such an exercise is important for two main reasons. First, the legal regime responsible for the regulation of the use of personal data has evolved considerably since the concept of sensitive data was first used. This has been exemplified by the creation of the EU’s General Data Protection Regulation (GDPR) in Europe. It has introduced a number of requirements relating to sensitive data that are likely to represent added burdens for controllers who want to process personal data. Second, the very nature of personal data is changing. Increases in computing power, more complex algorithms, and the availability of ever more potentially complimentary data online mean that more and more data can be considered of a sensitive nature. This creates various risks going forward, including an inflation effect whereby the concept loses its value, as well as the possibility that data controllers may increasingly seek to circumvent compliance with the requirements placed upon the use of sensitive data. This Article analyzes how such developments are likely to influence the concept of sensitive data and, in particular, its ability to protect vulnerable groups from harm. The authors propose a possible interpretative solution: A hybrid approach where a purpose-based definition acquires a bigger role in deciding whether data is sensitive, combined with a context-based ‘backstop’ based on reasonable foreseeability.

Proof of concept for lightweight PUF-based authentication protocol using NodeMCU ESP8266

Wireless sensor node is the foundation for building the next generation of ubiquitous networks or the so-called internet of things (IoT). Each node is equipped with sensing, computing devices, and a radio transceiver. Each node is connected to other nodes via a wireless sensor network (WSN). Examples of WSN applications include health care monitoring, and industrial monitoring. These applications process sensitive data, which if disclosed, may lead to unwanted implications. Therefore, it is crucial to provide fundamental security services such as identification and authentication in WSN. Nevertheless, providing this security on WSN imposes a significant challenge as each node in WSN has a limited area and energy consumption. Therefore, in this study, we provide a proof of concept of a lightweight authentication protocol by using physical unclonable function (PUF) technology for resource-constrained wireless sensor nodes. The authentication protocol has been implemented on NodeMCU ESP8266 devices. A server-client protocol configuration has been used to verify the functionality of the authentication protocol. Our findings indicate that the protocol used approximately 7% of flash memory and 48% of static random-access memory (SRAM) in the sensor node during the authentication process. Hence, the proposed scheme is suitable to be used for resource-constrained IoT devices such as WSN.

C3PO: C loud-based C onfidentiality-preserving C ontinuous Query P r o cessing

With the advent of the Internet of things (IoT), billions of devices are expected to continuously collect and process sensitive data (e.g., location, personal health factors). Due to the limited computational capacity available on IoT devices, the current de facto model for building IoT applications is to send the gathered data to the cloud for computation. While building private cloud infrastructures for handling large amounts of data streams can be expensive, using low-cost public (untrusted) cloud infrastructures for processing continuous queries including sensitive data leads to strong concerns over data confidentiality. This article presents C3PO, a confidentiality-preserving, continuous query processing engine, that leverages the public cloud. The key idea is to intelligently utilize partially homomorphic and property-preserving encryption to perform as many computationally intensive operations as possible—without revealing plaintext—in the untrusted cloud. C3PO provides simple abstractions to the developer to hide the complexities of applying complex cryptographic primitives, reasoning about the performance of such primitives, deciding which computations can be executed in an untrusted tier, and optimizing cloud resource usage. An empirical evaluation with several benchmarks and case studies shows the feasibility of our approach. We consider different classes of IoT devices that differ in their computational and memory resources (from a Raspberry Pi 3 to a very small device with a Cortex-M3 microprocessor) and through the use of optimizations, we demonstrate the feasibility of using partially homomorphic and property-preserving encryption on IoT devices.

Geospatial Analysis and Mapping Strategies for Fine-Grained and Detailed COVID-19 Data with GIS

The unprecedented COVID-19 pandemic is showing dramatic impact across the world. Public health authorities attempt to fight against the virus while maintaining economic activity. In the face of the uncertainty derived from the virus, all the countries have adopted non-pharmaceutical interventions for limiting the mobility and maintaining social distancing. In order to support these interventions, some health authorities and governments have opted for sharing very fine-grained data related with the impact of the virus in their territories. Geographical science is playing a major role in terms of understanding how the virus spreads across regions. Location of cases allows identifying the spatial patterns traced by the virus. Understanding these patterns makes controlling the virus spread feasible, minimizes its impact in vulnerable regions, anticipates potential outbreaks, or elaborates predictive risk maps. The application of geospatial analysis to fine-grained data must be urgently adopted for optimal decision making in real and near-real time. However, some aspects related to process and map sensitive health data in emergency cases have not yet been sufficiently explored. Among them include concerns about how these datasets with sensitive information must be shown depending on aspects related to data aggregation, scaling, privacy issues, or the need to know in advance the particularities of the study area. In this paper, we introduce our experience in mapping fine-grained data related to the incidence of the COVID-19 during the first wave in the region of Galicia (NW Spain), and after that we discuss the mentioned aspects.

Digital and Decentralized Management of Patient Data in Healthcare Using Blockchain Implementations

Blockchain solutions offer efficient approaches for trustworthy data management, especially in the medical field when storing and processing sensitive patient data. Many institutional and industrial facilities have already recognized the importance of the technology for the health sector and have also formulated basic ideas, concepts and main use cases, but concrete implementations and executions are comparatively rare. This mini review examines current research on specific blockchain implementations in healthcare that go beyond the state of concept studies or theoretical implementation ideas and describes the most promising systems based on systematic literature research. The review shows that secure storage and easy access to complete patient data is becoming increasingly important. Blockchain technology can be used as a secure, transparent and digital way to meet these needs. Hybrid solutions consisting of conventional data storage and blockchain-based access management are increasingly being developed and implemented. The automation of blockchain processes through smart contracts is also recommended. The review further reveals ambiguities in the use of permissioned and permissionless blockchain frameworks, machine learning (ML) integration as well as the question of which data should be stored in the blockchain and how this should be viewed legally. Therefore, there is still a need for further research, especially on these aspects, in order to further establish the use of blockchains in healthcare.

Privacy Preserving Classification of EEG Data Using Machine Learning and Homomorphic Encryption

Data privacy is a major concern when accessing and processing sensitive medical data. A promising approach among privacy-preserving techniques is homomorphic encryption (HE), which allows for computations to be performed on encrypted data. Currently, HE still faces practical limitations related to high computational complexity, noise accumulation, and sole applicability the at bit or small integer values level. We propose herein an encoding method that enables typical HE schemes to operate on real-valued numbers of arbitrary precision and size. The approach is evaluated on two real-world scenarios relying on EEG signals: seizure detection and prediction of predisposition to alcoholism. A supervised machine learning-based approach is formulated, and training is performed using a direct (non-iterative) fitting method that requires a fixed and deterministic number of steps. Experiments on synthetic data of varying size and complexity are performed to determine the impact on runtime and error accumulation. The computational time for training the models increases but remains manageable, while the inference time remains in the order of milliseconds. The prediction performance of the models operating on encoded and encrypted data is comparable to that of standard models operating on plaintext data.

Encrypted Control for Networked Systems: An Illustrative Introduction and Current Challenges

Cloud computing and distributed computing are becoming ubiquitous in many modern control areas such as smart grids, building automation, robot swarms, and intelligent transportation systems. Compared to “isolated” control systems, the main advantages of cloud-based and distributed control systems are resource pooling and outsourcing, rapid scalability, and high performance. However, these capabilities do not come without risks. In fact, the involved communication and processing of sensitive data via public networks and on third-party platforms promote (among other cyberthreats) eavesdropping and the manipulation of data (see “Summary”). That these threats are relevant to real-world applications is apparent from an increasing number of cyberattacks explicitly addressing industrial control systems [68]. Prominent examples are the malwares Stuxnet, Duqu, Industroyer, and Triton [14] as well as inference attacks arising from smart meters used as surveillance devices [30, 46].

Can the GDPR make data flow for research easier? Yes it can, by differentiating! A careful reading of the GDPR shows how EU data protection law leaves open some significant flexibilities for data protection-sound research activities

Against the common perception of data protection as a road-block, we demonstrate that the GDPR can work as a research enabler. This study demonstrates that European data protection law's regulatory pillars, the first related to the protection of the fundamental right to data protection and the second regarding the promotion of the free flow of personal data, result into an architecture of layered data protection regimes, which come to tighten or relax data subjects’ rights and data protection safeguards vis à vis processing activities differently grounded in public or merely economic interests. Each of the identified data protection regimes shape different “enabling regulatory spots” for the processing of sensitive personal data for research purposes.