Securing the E-Health Cloud

1. Securing the E-Health Cloud Hans Löhr, Ahmad-Reza Sadeghi, Marcel Winandy 1st ACM International Health Informatics Symposium (IHI 2010) Arlington,Virginia, USA, 11-12 November 2010 Freitag, 12. November 2010

2. Introduction Buzzwords of the year: E-Health Cloud Computing Freitag, 12. November 2010

3. Introduction Put together: E-Health Cloud Freitag, 12. November 2010

4. Introduction Put together: E-Health Cloud First idea: a paper with both buzzwords (cool!) Freitag, 12. November 2010

5. Introduction Put together: E-Health Cloud First idea: a paper with both buzzwords (cool!) Seriously: What about security & privacy? Freitag, 12. November 2010

6. Outline • E-Health Cloud Models • Security & Privacy Problem Areas • Security Architecture for Privacy Domains Freitag, 12. November 2010

7. Simple E-Health Cloud Freitag, 12. November 2010

8. Simple E-Health Cloud Examples: ... Freitag, 12. November 2010

9. Simple E-Health Cloud Examples: • Patients need to manage complex access rights • Patients don‘t understand security implications ... • Privacy: server provider can gain access to data in PHRs Freitag, 12. November 2010

10. Advanced E-Health Cloud Freitag, 12. November 2010

18. Advanced E-Health Cloud Healthcare Telematics Boundary Freitag, 12. November 2010

23. Advanced E-Health Cloud Examples: • Europe Healthcare - Germany, Austria, Netherlands, ... Telematics Boundary • Asia - Taiwan, ... Freitag, 12. November 2010

24. Advanced E-Health Cloud Examples: • Europe Healthcare - Germany, Austria, Netherlands, ... Telematics Boundary • Asia - Taiwan, ... Huh! Pretty complex. Must be secure, right? Freitag, 12. November 2010

25. Security Problem Areas • Data Storage and Processing • Data centers: unauthorized information leakage • Platform security: vulnerable to malware • Mobile storage (USB memory sticks) • Infrastructure Management • Cryptographic keys, certiﬁcates • Hardware / software components • Usability and User Experience • Smartcard PIN (when unconscious?) • Time consuming Freitag, 12. November 2010

26. Security Problem Areas • Data Storage and Processing • Data centers: unauthorized information leakage • Platform security: vulnerable to malware • Mobile storage (USB memory sticks) • Infrastructure Management • Cryptographic keys, certiﬁcates • Hardware / software components • Usability and User Experience • Smartcard PIN (when unconscious?) • Time consuming Freitag, 12. November 2010

27. Platform Security (Server) Freitag, 12. November 2010

33. Platform Security (Client) Freitag, 12. November 2010

39. Privacy Domains Freitag, 12. November 2010

40. Privacy Domains Freitag, 12. November 2010

41. Privacy Domains Security Kernel Freitag, 12. November 2010

46. Privacy Domains Trusted Virtual Domain Security Kernel Freitag, 12. November 2010

52. Technology: Trusted Virtual Domains (TVDs) TVD = coalition of virtual machines • Isolated compartments • Trust relationships • Transparent policy enforcement • Secure communication • Clienton modern security security functionality) (based platform hardware Freitag, 12. November 2010

53. Software Architecture /<%*45%=+5*? 0<5*%<*5-;++*44 6123=8-)*%:*% !"#$ !"#12345*%-"#$ 011#23+435&-./ 617*3859- )*%:*% )*+,%*-./0 A*B4*%:*% 066*41)+4#3 9(::$#;7($< 011#23+435 ;++&,<5=<> "#$!6$#1(77435 %&=)4*&>*4(3+ )3?!!:4**435! )*%:*% %'87 7#"+;)$( @(A5A<!B.& !"#$%&'(!"#$ C)"(3(+ !"#$%&'(!"#$! )66*41)+4#3D 011#23+435&! %&'()*+,&-./ -./ )*+,%=5(-C*%<*8 !"#12345*%-"#$ %&'()*+,&-./ !%,45*? 73%?@3%* 73%?@3%* Freitag, 12. November 2010

54. User Interface Freitag, 12. November 2010

55. Conclusion • E-Health Clouds: big security & privacy challenges! • TVDs can solve unaddressed issues: • Establish privacy domains • Extend security to end user platforms • Ongoing projects: study usability & deploy technology Freitag, 12. November 2010

56. Conclusion • E-Health Clouds: big security & privacy challenges! • TVDs can solve unaddressed issues: • Establish privacy domains • Extend security to end user platforms • Ongoing projects: study usability & deploy technology (EU FP7 funded) MediTrust (National German) Freitag, 12. November 2010

57. Questions? Contact: Marcel Winandy Ruhr-University Bochum marcel.winandy@trust.rub.de http://www.trust.rub.de Freitag, 12. November 2010

Securing the E-Health Cloud

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Ähnlich wie Securing the E-Health Cloud

Ähnlich wie Securing the E-Health Cloud (20)

Mehr von Marcel Winandy

Mehr von Marcel Winandy (13)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Securing the E-Health Cloud