Healthcare Data Privacy on the Cloud (AKA How can we use a public cloud for patient health records?)

Transcription

1 Healthcare Data Privacy on the Cloud (AKA How can we use a public cloud for patient health records?) Kunwadee Sripanidkulchai, Ph.D. Head of Healthcare Systems and Data Analytics Lab (HDA), NECTEC 1

2 Around 2011, we started this massive healthcare data project... Data Analytics and Health Records SaaS Cloud-based Health Information Exchange and Data Analytics Platform Hospital A Hospital B II Hospital C 4 Electronic Health Records 2

3 Motivation for using a public cloud as the underlying infrastructure for a new SaaS offering Lower barrier to deployment Easier to implement Rapid elasticity and auto-scaling High availability Data durability (automatic replication) Backups Future-proof approach through automatic patching and upgrade of the hardware, OS and platform services 3

4 Public Cloud Show-Stoppers Most popular question: Will the data be private? Caveats (in Thailand s case): Cloud location Legal implications for location of data storage Network performance Cost 4

5 For the rest of this talk Focus on the privacy of data Assume that cloud provider implements and ensures best practices in infrastructure security Assume we implement best practices in application-level security 5

6 My users worst nightmares Is deleted data really deleted? 6

7 My users worst nightmares Is deleted data really deleted? Source: wikipedia 6

8 My users worst nightmares Is deleted data really deleted? Remediation: Cloud user must perform secure delete Source: wikipedia 6

9 So secure delete will work for files or instances that I terminate myself... What about deleted database records? What about data on instances that are auto-scaled? What happens when they crash or when the provider terminates them? What about data on durable data replicas that the provider automatically creates for me? What happens when they crash or when the provider terminates them? Source: wikipedia 7

10 So secure delete will work for files or instances that I terminate myself... What about deleted database records? What about data on instances that are auto-scaled? What happens when they crash or when the provider terminates them? What about data on durable data replicas that the provider automatically creates for me? What happens when they crash or when the provider terminates them? Source: wikipedia 7

11 So secure delete will work for files or instances that I terminate myself... What about deleted database records? What about data on instances that are auto-scaled? What happens when they crash or when the provider terminates them? What about data on durable data replicas that the provider automatically creates for me? What happens when they crash or when the provider terminates them? Remediation: Data encryption. Source: wikipedia 7

12 What about other types of breaches? Heartbleed (SSL) may have exposed sensitive account information Amazon Cross-Site Scripting (XSS) bug VENOM (qemu) and other possible cross-vm side channels Source: Crowdstrike 8

13 What about other types of breaches? Heartbleed (SSL) may have exposed sensitive account information Amazon Cross-Site Scripting (XSS) bug VENOM (qemu) and other possible cross-vm side channels Remediation: Data encryption. Source: Crowdstrike 8

14 Encryption sounds easy enough, but is it? Search over encrypted data Key management (preferably outside the public cloud) Manage application user access to data (preferably outside the public cloud) 9

15 Encryption sounds easy enough, but is it? Search over encrypted data Key management (preferably outside the public cloud) Manage application user access to data (preferably outside the public cloud) Remediation: Encryption and decryption of data off the cloud! 9

16 Encryption sounds easy enough, but is it? Search over encrypted data Key management (preferably outside the public cloud) Manage application user access to data (preferably outside the public cloud) Source: wikipedia Remediation: Encryption and decryption of data off the cloud! 9

17 Implications of off-cloud encryption The cloud must only see and use encrypted data at any point in time, thus data must be encrypted and decrypted off the public cloud Simplified implementation We must run application servers to support encryption and decryption off the public cloud Key management Application servers Application servers that are off the public cloud no longer benefit from high availability, auto-scaling, and back-ups offered by the public cloud 10

18 Summary We can use the public cloud to store encrypted data that will support data privacy, as long as, we have an infrastructure off-the-cloud that will perform all encryption, decryption, and key management We lose the benefits of cloud computing as the encrypt/decrypt computation infrastructure and the key management infrastructure needs to be off-the-cloud No auto-scaling No high-availability No automated backups We are left to implement these features in our own private cloud. 11