Source-linked AI summary
Towards Practical Privacy-Preserving Analytics for IoT and Cloud Based Healthcare Systems
Sagar Sharma, Keke Chen, Amit Sheth
TL;DR
IoT and cloud healthcare systems need analytics over highly sensitive data, but practical privacy protection must balance security with cost and model utility. The paper uses kHealth to analyze involved parties, privacy assets, outsourced computation, information sharing, and candidate privacy substrates. It concludes that no straightforward solution simultaneously guarantees privacy, practicality, and quality, so system design must match protections and workload allocation to the analytics and participants.
Problem
Healthcare analytics relies on sensitive patient data and generated models, while protecting privacy across storage, processing, communication, and sharing remains difficult.
Method
Using kHealth, the paper analyzes involved parties, privacy assets, analytic requirements, outsourced-computation scenarios, and privacy-preserving techniques.
Results
The paper finds that practical privacy-preserving analytics requires tradeoffs among privacy, efficiency or cost, expressiveness, and model quality across alternative techniques.
Takeaways & Limitations
A practical design should select protections and distribute workloads according to analytic needs, participant resources, and the required privacy level.
Abstract
from arXiv · showhide
Modern healthcare systems now rely on advanced computing methods and technologies, such as Internet of Things (IoT) devices and clouds, to collect and analyze personal health data at an unprecedented scale and depth. Patients, doctors, healthcare providers, and researchers depend on analytical models derived from such data sources to remotely monitor patients, early-diagnose diseases, and find personalized treatments and medications. However, without appropriate privacy protection, conducting data analytics becomes a source of a privacy nightmare. In this article, we present the research challenges in developing practical privacy-preserving analytics in healthcare information systems. The study is based on kHealth - a personalized digital healthcare information system that is being developed and tested for disease monitoring. We analyze the data and analytic requirements for the involved parties, identify the privacy assets, analyze existing privacy substrates, and discuss the potential tradeoff among privacy, efficiency, and model quality.
I. INTRODUCTION
Modern healthcare combines continuous monitoring, streamed data, and advanced analytics to support personalized services, but protecting sensitive information without sacrificing utility remains difficult. The paper uses kHealth to examine privacy-preserving analytics and tradeoffs among privacy, cost, and utility.
- Healthcare systems combine EHRs, IoT sensor streams, and analytics to build models for real-time health-anomaly monitoring.Inputs include diagnoses, visits, laboratory results, medications, treatment plans, and physiological measurements such as heart rate and oxygen saturation.
- IoT devices and diverse datasets support models ranging from statistical aggregation to data mining, machine learning, natural language processing, and deep learning.These models can detect abnormal health changes, predict clinical events, and warn about emerging conditions.
- Protecting healthcare data is urgent because unauthorized exposure can violate HIPAA and create lasting social and economic harms.
- Privacy must cover storage, processing, and communication, yet strong protection can conflict with data utility, model learning, and sharing.The paper describes complete protection outside users’ devices as an ideal that is almost unachievable.
- Protection methods constrain algorithm design because operations on obfuscated data may require complex algorithms to be decomposed into simpler additions and multiplications.Homomorphic-encryption frameworks therefore express data-mining algorithms through supported operations.
- Privacy-preserving frameworks increase communication, storage, and computation costs, requiring workload allocation according to participant resources.Resource-constrained parties should perform lighter tasks, while expensive processing can be parallelized at a cloud.
- Using kHealth, the paper analyzes privacy-preserving healthcare data-mining algorithms and their tradeoffs among privacy, cost, and utility.The system is being evaluated with patients and physicians, providing the context for examining privacy risks, features, and candidate solutions.
II. IOT HEALTHCARE FRAMEWORK
kHealth is an IoT-based health-monitoring framework that combines personal, physiological, population, and public data to generate personalized predictive models. Its encrypted data and EHR workflows support asthma control, continuous outbreak monitoring, and model distribution to patients and consumers.
- kHealth combines wearable-sensor observations with population data from Twitter and weather services and public data from the CDC and hospitals.These sources are used to generate personalized predictive models for subscribed patients.
- The kHealth framework collects encrypted personal sensor data and EHRs with public and population data to build and distribute asthma-related models.The service provider may use a cloud for processing, while personalized models go to patients’ devices and global models to consumers.
A. INVOLVED PARTIES
The kHealth framework distributes responsibilities among service providers, patients, medical providers, researchers, and cloud infrastructure. These parties contribute data, consume models, provide care or research, and support outsourced storage and processing.
- The system includes a healthcare service provider, distributed patient data contributors, medical providers, researchers, and a cloud.
- Figure 1 depicts the involved parties and their interactions within kHealth.
- Service providers store protected patient data and may outsource storage and computation to cloud providers for analytics infrastructure.Patients subscribe to the provider’s services and may possess wearable sensors and healthcare-monitoring devices.
B. ANALYTICS COMPONENTS
Digital-health analytics span statistical summarization, supervised learning, and unsupervised learning, producing either global models or personalized models. Privacy-preserving analytics must adapt these algorithmic categories to different systems and security assumptions.
- Privacy-preserving analytics develops protected versions of statistical and machine-learning algorithms for different systems and security assumptions.
- Statistical Summarization: Statistical summarization extracts descriptive and inferential knowledge from individual, population, and global medical observations.
- Supervised Learning: Supervised learning uses labeled examples for diagnosis, disease-phenotype identification, and global-outbreak prediction.
- Unsupervised Learning: Unsupervised learning analyzes unlabeled, very large datasets through clustering, semantic indexing, and dimensionality reduction to identify healthcare patterns.
- Analytic models may be global, such as regional disease-outbreak predictors, or personalized, such as alarms adapted to an individual’s health conditions.
III. APPLICATION SCENARIOS AND PRIVACY ISSUES
The framework distinguishes outsourced computation from information sharing as two privacy-sensitive application scenarios, with exposures varying by parties, trust, and interactions. It assumes adversaries follow protocols but may secretly seek information, while infrastructure and communication channels are externally secured.
- Application scenarios: Outsourced computation covers data storage, analytics, communication, and intermediate processing outside users’ personal devices and home networks.
- Application scenarios: Information sharing lets interested parties learn global models or data, or jointly learn models, while protecting individual privacy.
- Privacy variation: Privacy issues differ with the application scenario, involved parties, their trustworthiness, and their interactions.
- Privacy assumptions: Adversarial parties are assumed honest-but-curious: they execute protocols correctly but may surreptitiously inspect information for personal benefit.
- Privacy assumptions: Infrastructure and communication channels are assumed protected from external hacking, co-resident attacks, and active breaches.
A. PRIVATE ASSETS AT RISK
The paper identifies user data, generated models, and intermediate learning results as privacy assets at risk. These assets can reveal sensitive health conditions, individual or group information, and details about models or training data.
- User data: EHRs and IoT sensor data can reveal health conditions, activity patterns, location traces, and life choices through direct observation or inference.
- Generated models: Global models should not distinguish individuals or groups, while personalized models must reach only authorized individuals privately.
- Generated models: Model probing can expose private information, including health conditions inferred from visible attributes using a leaked disease-detection model.
- Intermediate results: Intermediate results can reveal information about both the learned model and its training data.
- Intermediate results: Iteration counts, convergence, model size, and elapsed time may support learning but require controls against revealing additional knowledge.
B. OUTSOURCED COMPUTATION
Outsourced computation places resource-intensive healthcare analytics with cloud providers or service providers that may be honest-but-curious. Privacy mechanisms must protect data and models while retaining outsourcing benefits and practical computation.
- Outsourcing scenarios: Outsourcing commonly sends resource-intensive tasks from service providers to untrusted clouds or from resource-constrained users to untrusted service providers.
- Trusted-provider outsourcing: A trusted service provider may use public clouds for elastic storage and computing, while shielding privacy assets from a curious cloud provider.
- End-user outsourcing: In the untrusted-service-provider scenario, users submit encrypted or protected data and the provider learns models from obfuscated datasets.
- End-user outsourcing: Complex analytics over encrypted data can become very expensive or impossible without intermediate decryption or unmasking.
- Crypto-service provider: A crypto-service provider can manage secret keys, decrypt intermediate results, and assist modeling, but must not collude with the service provider.
- Crypto-service provider: The depicted framework has the service provider and crypto-service provider collaboratively generate models over encrypted or masked data, with models decodable only by individual users.
C. INFORMATION SHARING
Healthcare information sharing must support research and service delivery without exposing individual privacy. The paper compares privacy-preserving building blocks by their expressiveness, efficiency, privacy strength, and computational or communication costs.
- Information sharing: Healthcare data and analytics are shared with researchers, providers, insurers, pharmacies, and laboratories to learn global trends or models without breaching individual privacy.
- Sharing modes: Information sharing can be interactive through queries, non-interactive through curated datasets, or collaborative through joint model learning without revealing raw data.
- Sharing modes: Interactive sharing permits tighter query controls, whereas non-interactive publication allows more varied attacks and potentially more severe leakage.
- Outsourced-computation trade-offs: Fully homomorphic encryption and garbled circuits with oblivious transfer are expressive enough for general analytics but impose excessive storage, communication, and computation costs.
- Outsourced-computation trade-offs: Somewhat and additive homomorphic encryption improve practicality but restrict supported operations, and RLWE adds communication and storage burdens.
- Outsourced-computation trade-offs: Pairing-based BGN encryption has unacceptable decryption performance for larger integers, limiting high-precision analytics on large datasets.
- Outsourced-computation trade-offs: Paillier encryption is efficient and compact relative to RLWE, but its unencrypted operand in homomorphic multiplication requires additional privacy protection.
- Outsourced-computation trade-offs: Data perturbation and order-preserving encryption are efficient under weaker privacy notions, but perturbation methods can be vulnerable to distributional attacks.
B. METHODS AND TRADE-OFFS FOR INFORMATION SHARING
Differential privacy is widely accepted for information sharing because of its rigorous theoretical foundation, but output perturbation can reduce model quality. Its suitability therefore depends on the privacy–quality requirements of the application.
- Differential privacy perturbs the outputs of sensitive functions to support information sharing.
- Output perturbation can affect the quality of models learned from functional outputs.
- Applications requiring the highest-quality models may find differential privacy unsuitable when models are sensitive to perturbation.
V. CONCLUSION
Practical privacy-preserving analytics for IoT healthcare requires balancing privacy, model quality, and computational, communication, and storage costs. The paper recommends analyzing system requirements and applying suitable privacy mechanisms, while compensating for algorithmic restrictions where necessary.
- A practical privacy solution requires analyzing stakeholders, privacy assets, desired models, model quality, and model audiences.
- Depending on analytics and privacy requirements, a cryptographic service provider may be added to the framework.
- Homomorphic encryption, data perturbation, and differential privacy can be applied after balancing computation, communication, and storage costs.
- Privacy restrictions may prevent implementing the best healthcare models, requiring compensation through parallelizable methods such as ensemble learning.
BIOGRAPHIES
The biographies describe researchers whose work spans privacy-preserving data mining, cloud and IoT computing, healthcare informatics, and related data-intensive fields.
- Sagar Sharma is a Wright State University computer science PhD student researching privacy-preserving outsourced data mining, big data, cloud computing, and IoT.
- Keke Chen is a Wright State University associate professor who directs the DIAC Lab and researches secure data services, outsourced-data privacy, cloud computing, IoT, healthcare informatics, and big data.
- Amit Sheth is the LexisNexis Ohio Eminent Scholar and executive director of Kno.e.sis, with research interests including SmartIoT, semantic web, and big data.