Method for anonymously evaluating security-critical data records

Abstract

The invention relates to a computer-implemented method for anonymously providing security-critical data records (DSi), in particular health-related data records, comprising the following steps carried out in a data centre (2): - storing a multiplicity of safety-critical data records (DSi) which each comprise multiple data entries (valj) that are in particular medical measurement data, - receiving, via an external interface, a computer program (exe1, exe2, < / 3>) designed to process selected data entries (valj) from the data records (DSi) when said computer program is executed, wherein at least two data entries (valj) of a data record (DSi) are used during the processing of data entries (valj) and from these at least one value is calculated which is stored in the output data record (5), and wherein the processed data entries (valj) are stored in at least one output data record (5), - executing the computer program (exe1, exe2, < / 3>), and - outputting the at least one output data record (5) via said or another external interface.

Description

[0001] Methods for the anonymous evaluation of security-critical data sets

[0002] The invention relates to a method for the anonymous evaluation of security-critical data sets.

[0003] Health-related datasets encompass a wide range of sensitive information pertaining to the physical and mental health of individuals. This data can include, among other things, medical histories, diagnostic reports, treatment histories, laboratory results, and genetic information. Due to their sensitivity and potential for misuse, the protection and secure processing of this data is of paramount importance.

[0004] The security-critical processing of health-related data requires the use of advanced technologies and methods to prevent unauthorized access, manipulation, or data loss. Essential security measures include encrypting data both in transit and at rest, implementing role-based access controls, and continuously monitoring and logging access and activity. In summary, the secure storage of health-related data requires robust and reliable infrastructures that encompass both physical and digital security measures.

[0005] Furthermore, ethical considerations regarding the use and disclosure of this data are of central importance, particularly with regard to minimizing risks to the individuals concerned. The development and implementation of solutions for the secure handling of health-related datasets must therefore always be in accordance with these legal and ethical requirements in order to guarantee the trust of the public and the individuals concerned.

[0006] Sharing health-related datasets with third parties, for example for research purposes or statistical analysis, presents numerous challenges. One of the biggest technical challenges is ensuring that the data is anonymized or pseudonymized to protect the identity of the individuals concerned. This requires specialized techniques that prevent individual data from being re-identified through inference. At the same time, data integrity must be maintained so that the information relevant for analysis remains complete and accurate. Ensuring data quality is another issue, as only high-quality and consistent data can yield reliable results.

[0007] The transfer of health-related datasets to third parties can occur, for example, because only a few third parties (e.g., Google, Meta, Amazon, etc.) possess large data centers capable of analyzing health-related datasets using artificial intelligence (AI). While the analysis of health-related datasets using AI offers significant potential for improving medical research and patient care, it is undesirable, for the aforementioned reasons, that the datasets be transferred to these third parties.

[0008] In the current state of the art, the data sets have so far been anonymized or pseudonymized and passed on to third parties for evaluation in their entirety.

[0009] The present invention was thus made against the background that the transfer of security-critical data sets requires high security precautions to ensure the protection of this data during transfer and processing and to minimize the risk of data leaks or misuse.

[0010] Documents US 2022 / 391537 Al and US 2015 / 0317490 Al disclose methods for outputting anonymized datasets. Recipients can then perform calculations on these anonymized datasets. The problem is that, even though anonymized, personal data is still output, which does not completely eliminate the possibility of tracing the data back to the individual.

[0011] The document CN 113126996 A describes the submission of a computer program as source code to enable verification of the computer program.

[0012] One aim of the invention is to make it possible for third parties to analyze security-critical health-related datasets. At the same time, however, high security measures are to be provided.

[0013] This objective is achieved through a procedure for the anonymous provision of safety-critical health-related datasets, the procedure comprising the following steps carried out in a data center: storing a large number of safety-critical datasets, each comprising multiple data entries of data, in particular medical measurement data (i.e., preferably at least one of the data entries is a medical measurement),

[0014] - via an external interface, receiving a computer program that is configured to process selected data entries from the data records during its execution, wherein, in processing data entries, at least two data entries of a data record are used, of which at least one is a medical measurement or preferably both are medical measurements, and from these at least one value is calculated which is stored in the output data record and wherein the processed data entries are stored in at least one output data record, executing the computer program; and outputting the at least one output data record via the aforementioned or another external interface.

[0015] The present invention enables the complete data sets to remain within the data center and not be transferred to third parties for evaluation. A "data center described herein" is understood to be a data center that stores security-critical data sets that are not publicly accessible. The data center could consist of a single computing unit or of multiple computing units.

[0016] A key feature of the invention is that the data entries can be pre-processed before being made available to third parties. This allows the evaluation of the data entries to be performed in the data center, and the result of the evaluation can be returned to the user as an output data set.

[0017] A further advantage of the solution according to the invention is that the operator of the data center cannot determine in advance which output data sets might be relevant for investigating a medical property. In other words, it is not the responsibility of the data center operator to select the output data sets for a specific medical property. This selection is made by researchers from universities or developers from third parties and communicated to the data center operator in the form of a computer program. Because the computer program is executed within the data center, and thus the output data set is compiled or created internally, the researchers or developers do not need to be provided with the entire data set.The solution according to the invention prevents the need to provide the entire datasets to third parties so that they can extract the necessary data themselves or perform an analysis of the datasets. With the solution according to the invention, only the result of processing the medical data is provided to the third parties, making it impossible to correlate the original datasets with other datasets and thus assign them to specific individuals. At the same time, however, it remains up to the third parties to decide which data—and in particular, in which processed form—are required for their research.

[0018] For example, blood test results could be stored as datasets in the data center, with each individual blood test result comprising several blood values, i.e., medical measurement data. The blood values ​​could, for example, include at least two of the following: hemoglobin (Hb), hematocrit (Hct), erythrocytes (red blood cells, RBC), leukocytes (white blood cells, WBC), thrombocytes (platelets, PLT), blood glucose, creatinine, cholesterol, electrolytes, and C-reactive protein (CRP). Furthermore, the dataset could include a characteristic to be investigated, such as the presence of a specific disease. If the entire dataset were released, the sheer number of data entries would make it easy to correlate it with another dataset that may have been released along with other data and subsequently leaked.If researchers or developers want to analyze the relationship between a specific disease and a specific blood value or combination of blood values, such as the probability of a specific disease progression when certain threshold values ​​of blood values ​​like Hb and WBC are exceeded, the computer program can be designed in such a way that this relationship is checked in the data center itself and the result of the analysis is output as a data set.

[0019] According to the invention, the output data set thus only includes the result of processed data entries. In the preceding example, for instance, only the differences (Hb - WBC) and (RBC - PLT) might be relevant to the researchers, whereby the computer program can be designed such that only these two differences are stored as processed data entries in the output data set. This makes it difficult or impossible to trace which output data set belongs to which data set. Generally, it is preferred if, when processing data entries, the output data set uses at least two data entries from a data set and calculates a value from these, which is then stored in the output data set. The output data set can calculate at least one, or preferably only, such values ​​that were calculated from at least two data entries.

[0020] In other implementations, researchers might want to investigate, for example, the relationship between age and blood pressure with mortality probability. The datasets could contain, among other things, data entries such as age, blood pressure, and age at death. In the data center, a statistical analysis is performed on all datasets containing these data entries; that is, a statistical relationship is determined between a property under investigation and two other data entries (more generally, at least one data entry). This statistical relationship is determined across multiple datasets, preferably across all datasets that include the property under investigation and the data entry(s). The determined value, or output dataset, is considered to be the statistical relationship itself, e.g., a data series, a data model, or a trained model.

[0021] Therefore, a first data entry and a second data entry are preferably used during processing. The first data entry is a medical characteristic to be examined, in particular a disease status, and the second data entry is a demographic characteristic or a medical measurement of a person. During the processing step, a statistical relationship between the characteristic to be examined and the second data entry is determined. The computer program thus enables the statistical relationship between the characteristic to be examined and the second data entry (and / or further data entries) to be investigated within the data center. Examples of demographic characteristics are age and gender; examples of medical measurements are blood pressure, weight, blood glucose level, oxygen saturation, or blood markers.It should be noted that the medical characteristic to be examined may be, for example, a direct medical measurement or a condition determined for this person, e.g., a finding, i.e., not a direct medical measurement.

[0022] In the latter embodiment, it is particularly preferred that the output data set is a model with weights (values) to determine the probability of a property under investigation occurring with respect to a data entry. The third parties who sent the computer program to the data center then receive the model, which can either be used directly for further calculations or displayed graphically to simplify further analysis.

[0023] It is particularly advantageous if a third data entry is used during processing, representing a demographic characteristic or a medical measurement of the individual in question. More than three data entries can also be considered during processing. This enables increasingly complex analyses within the data center, allowing, for example, the determination of mortality probability in relation to age and blood pressure, or other factors. When third parties receive the model, they could either examine the model itself, for example, to determine whether there is any correlation between mortality probability, age, and blood pressure, or apply a patient's data set to it, where this data set specifies, for example, age and blood pressure, and calculate a mortality probability from this data.

[0024] Several analyses can be used to examine statistical relationships. For example, determining statistical relationships could involve creating a linear regression model or using logistic regression. Other methods could include creating a contingency table, performing correlation analysis, using the chi-square test, the t-test, or the Mann-Whitney U test.

[0025] The output dataset could, for example, include an indicator such as a p-value, representing the statistical significance of the observed relationship between the first and second data entries, and potentially other data entries. The indicator is thus the value, or one of the values, of the output dataset. This provides a property that is particularly easy for third parties to evaluate.

[0026] Furthermore, it is preferable to use all or at least a predetermined number of data records to determine the statistical correlation. This ensures the traceability of the underlying data records, because if, for example, only two data records are used, the statistical correlation could potentially be used to infer the original data records.

[0027] Another way to store processed data entries in the output dataset is to add noise according to the computer program, so that the resulting values ​​are then randomly generated within a range of + / - 1% of the original value. Other methods for preprocessing data entries are also possible.

[0028] In the procedure described above, it is particularly important that it is transparent that the computer program does not output any unauthorized data in the output data set. As a first step, the data center operator could only receive computer programs from trusted senders, such as those listed in a data center directory. However, to avoid relying solely on this trust basis, an additional security layer can be introduced: the ability to verify within the data center whether the computer program stores any unauthorized data in the output data sets. This cannot be achieved, or not solely achieved, by checking the output data set. For this reason, one or more of the following measures can be implemented.

[0029] In a first preferred embodiment, the computer program can include an indication of a property to be investigated, in particular a medical property to be investigated, wherein the computer program is configured to store data relevant only to the stated indication in at least one output set. The indication is understood to mean what the sender of the computer program intends to do using the output data sets, e.g., which disease progression it wants to investigate or which investigation procedure it is using.

[0030] In one approach, the data center can use this to check, for example, whether the sender of the computer program is authorized to receive output data for the specified indication, and only output the data if this authorization is granted. For instance, the data center could maintain a list specifying predetermined indications for predetermined senders. In one example, Google might only be permitted to conduct research on cancer, but not on sexually transmitted diseases; or a tax authority might only be permitted to process tax cases, but not to investigate traffic violations. In these cases, possible indications could be "cancer," "sexually transmitted disease" (both medical indications), "tax case," and "traffic violation" (neither of which are medical indications).

[0031] The data center operator can also verify whether the output data set matches the indication. To do this, the data center can perform the following step after the execution step and before the output step: - Check, based on the output data, whether the computer program only accesses or only stores selected data entries from the data sets in output data sets that correspond to the stated indication.

[0032] If the output dataset contains processed data entries that do not correlate with the indication, the process can be stopped before the output datasets are displayed. For example, an indication might be "sexually transmitted disease," but the output dataset might list "eye color." Since this data record in the output dataset does not belong to the indication, the output dataset will not be displayed. For example, the data center could maintain a list containing predefined datasets for predetermined indications. Alternatively or additionally, the data center could only allow access to those data entries that belong to the specified indication (e.g., according to the list explained below).

[0033] As previously explained, the data entries could, for example, be distorted or processed differently, making it not always possible to trace the origin of a data entry in the output data set. This could be exploited by fraudulent senders of computer programs, for example, to execute the program in such a way that it takes an Hb value, distorts it, and reports it as an Hkt value. To the data center operator, it appears as if the computer program is outputting Hkt values, although it is actually outputting Hb values, without the data center being able to prove this. Many other manipulation techniques are possible by processing multiple data entries. To prevent this, the receiving step of the computer program can include the following steps:

[0034] - Receiving the computer program as source code; and optionally compiling or machine-interpreting the source code; and executing the compiled or interpreted source code as a computer program.

[0035] Since the data center receives the source code in this preferred embodiment, the individual functions defined in the source code can be verified. In particular, it is possible to trace which data entries the computer program uses and how it processes them. The data center can, for example, contain both the source code and the already compiled or interpreted source code. Preferably, however, the data center receives only the source code and compiles or interprets it itself in order to execute it as a computer program.

[0036] In one variant, the source code can be used only to check whether the computer program performs any malicious functions in the data center, for example, by modifying one of the aforementioned lists. Preferably, however, the procedure can include the following step, performed before the execution of the computer program:

[0037] - Check the source code to see if the computer program is designed to only store such data entries from the data records in output data records during its execution, or to only access such data entries from the data records that belong to the stated indication.

[0038] This prevents the manipulations described above, because it could be determined that a value designated as an Hkt value is actually an Hb value according to the functions specified in the source code.

[0039] To meet high security standards, it can be arranged that the data center receives the computer program from a first requesting communication partner and outputs the output data set only to that first communication partner; that is, the output data set is only made available to this communication partner. Furthermore, the data center can receive a second computer program from a second communication partner and output a second output data set generated according to the second computer program only to the second communication partner.

[0040] Preferably, all the steps described above are fully computer-implemented by the data center, especially the verification steps, which can be implemented, for example, using the lists described. Alternatively, the verification steps could also be performed with human intervention, for example, by showing the source code to a person on a screen so they can review it. However, the source code verification could also be fully computer-implemented, for example, by AI.

[0041] In another aspect, the invention relates to a data center which is equipped to carry out the aforementioned method.

[0042] To better illustrate the present invention and explain its operation in detail, reference is made below to the accompanying figure. This figure serves to clarify the technical features of the invention. The following description of the figure is intended to contribute to a thorough understanding of the structural and functional properties of the invention and to explain its advantages and technical advances compared to the prior art. It shows:

[0043] Figure 1 shows a data center that receives a computer program from a participant and returns an output data set to that participant.

[0044] Figure 2 shows a variant of Figure 1, where source code is received.

[0045] Figure 3 shows another variant in which a statistical correlation is determined.

[0046] Figure 1 shows a system 1 with a data center 2, which stores security-critical data sets DS1, DS2, ..., generally DSi. The security-critical data sets DSi each contain personal data entries vall, val2, ..., generally valj, thus placing the highest security demands on data center 2. If the data entries valj are medical data, especially medical measurement data such as blood values, they are also referred to as health-related data.

[0047] Typically, a huge amount of DSi datasets resides in data center 1, making manual analysis impossible. However, research institutions and similar organizations need to analyze this data anonymously, for example, to conduct studies. Previously, the plan was to anonymize or pseudonymize the DSi datasets and provide them to research institutions in this form. However, it is repeatedly possible to trace these DSi datasets back to the individuals from whom they originally originated. To minimize this risk, the procedure described below is being implemented.

[0048] A first communication partner 3 (also called the sender) creates a computer program, for example, because they are researching a particular disease. This first disease is referred to here as indication indl. Generally, one also speaks of an indication of a property to be investigated. To research this disease, the first communication partner 3 needs, for example, the data entries val2 from all data records DSi. Typically, the first communication partner will need a subset of data entries valj from all data records DSi, but never all data entries valj from all data records DSi.

[0049] The first communication partner, 3, writes a computer program called exel (this is referred to as an ".exe" file for illustrative purposes only; it could have any other file extension). The first communication partner, 3, sends the computer program exel to the data center, 2. Thus, data center 2 can receive the first computer program exel via an external interface. This external interface could be, for example, an internet connection, a USB connection, or something similar. It is only important to ensure that this is not an internal interface of a processing unit, such as between the CPU and RAM.

[0050] Once data center 2 has received the first computer program, it can execute it. The computer program can be received as a pre-compiled program, although this is not mandatory; see the explanations regarding the source code below. When the first computer program, exel, is executed in data center 2, it extracts the selected data entries valj from the data records DSi that are required by the first communication partner 3 to investigate the aforementioned indication indl. The first computer program, exel, stores these extracted data entries valj in an output data record 5. There could also be multiple output data records 5, which is implicitly included in the following discussion.

[0051] In the specific example shown in Figure 1, all data entries "val2" were required for the indication indl. Output record 5, generated by the first computer program exel, therefore comprises the data entries val2 of all data records DSi. The data structure {DSI : val2: yg / dl, DS2: val2: wg / dl} shown for output record 5 was chosen for illustrative purposes only. Output record 5 could, for example, also include the data entries val4 of all data records DSi if these were needed for investigating the indication indl.

[0052] Afterwards, data center 2 sends the output data set 5 back to the same initial communication partner 3 from which the first computer program, Excel, originated. It is understood that all modern encryption techniques can be used for this purpose. The transmission of output data set 5 occurs via the same external interface or a different external interface, such as an internet interface, a USB interface, or the like.

[0053] Furthermore, it is evident that the first computer program, exel, also transmits the information for the first indication, indl, for example, as an additional file or as part of the computer program exe2. This allows data center 2 to verify whether the first communication partner, 3, is even permitted to receive output data records 5 for the first indication, indl. For this purpose, a list 3 can be stored in data center 2 beforehand, specifying for each communication partner, 3, 4, for which indication, indl, ind2, they are permitted to receive output data records 5. In Figure 1, this is represented by "3: indl," meaning that communication partner 3 is permitted to receive output data records 5 for the first indication, indl. Furthermore, this list 6, or another list, can specify the maximum number of data entries, valj, that may be processed and output for each indication, indl, ind2.Of course, the computer program exel can also output fewer data entries valj than are listed. In Figure 1, for the first indication indl, only the second data entry val2 may be output, see “indl : val2”.

[0054] Furthermore, Figure 1 shows a second communication partner 4, which creates a second computer program exe2 for a second indication ind2 and sends it to the data center, optionally together with the second indication ind2 for the aforementioned purposes of verifying authorization. When the second computer program exe2 is executed in the data center 2, it not only extracts the data entries vall required for the second indication ind2, but also processes them. In Figure 1, this is represented by the operator "%", so that the output data set 5 includes the processed data entries x% and v%, which are derived from the original values ​​x and v. The processing step is, for example, noise reduction to further anonymize or pseudonymize the data entries. Subsequently, these processed data entries can be stored in the output data set 5 and sent back to the second communication partner.

[0055] Figure 2 shows another variant in which all aspects can be implemented as described in Figure 1, but the following two independent variants can be used. First, the first communication participant 3 can use source code instead of an already compiled computer program exe3.<!--3--> generate it and send it to data center 2. The source code<!--3--> It contains human-readable text written in a programming language, containing the logical instructions and algorithms that define the behavior of the computer program. The source code<!--3--> This has the advantage that all instructions and algorithms can be clearly understood, which would not be possible with the already compiled computer program exe3. The functionality of the computer program exe3 is therefore easier to grasp even before it is executed.

[0056] The first communication participant 3 therefore sends the source code<!--3-->to the data center that hosts the source code<!--3--> It receives and compiles or interprets the data to execute the instructions and algorithms defined within it. The compiling or interpreting step is represented in Figure 2 by the function “<!--3--> : exe3" is displayed. The source code can be viewed beforehand.<!--3--> However, it must be checked, for example, whether it only outputs or uses those data entries valj that are permissible according to the indication indl (list 6 can be used again for this).

[0057] The second variation, shown in Figure 2, is another way of processing the data entries valj. As shown, two data entries vall, val2 of the same data set DSi are linked and stored in this form in output data set 5. In the example of Figure 2, the processing step is to calculate the difference between the second data entry val2 and the first data entry vall of the respective data set DSi, see {DSI : val2-vall : yx g / dl, DS2: val2-vall : wv g / dl}. Thus, instead of two data entries, only one value is output. This can be perfectly sufficient for research purposes, for example, if this difference is the decisive criterion for investigating the indication.

[0058] In general, when processing data entries valj, at least two (i.e., possibly also three, four, five, . . .) data entries valj of a data record DSi can be used and a value calculated from them, e.g. by subtraction, addition, multiplication, division, etc.

[0059] Figure 3 shows another variation in which a statistical relationship between a property under investigation and a demographic characteristic or a medical measurement is determined. Here, the datasets DSi each include an initial data entry vall, which specifies a property under investigation. For example, the property under investigation could be the presence of a disease, so the data entry would be "y" if the disease is present and "n" if the disease is not. However, the properties under investigation could also be different, e.g., age at death, to determine a mortality probability.

[0060] Furthermore, the DSi datasets include a second data entry, val2, which specifies a demographic characteristic such as age or gender, or a medical measurement. A statistical relationship between the two data entries can now be determined using the entire dataset or at least a predetermined number of datasets. For example, a p-value can be calculated, indicating whether the relationship between the second data entry and the characteristic under investigation is statistically significant. This can be stored as a value in the output dataset. Other indicators representing the statistical significance of the determined relationship between the first and second data entries can also be specified in the output dataset.

[0061] Alternatively or additionally to the indication, a data series or, more generally, a model can also be included in the output dataset, where the data series or model describes the statistical relationship. The data series or model will have several weights or, more generally, values ​​that describe it.

[0062] It goes without saying that further analyses can also be carried out when determining the statistical relationship, for example by determining the statistical relationship of the property to be investigated in view of two or more data entries, e.g. whether a mortality probability is related to age and blood pressure.

[0063] Regarding the variant of Figure 3, it is evident that the output data set does not allow any conclusions to be drawn about the DSi data sets.

[0064] All variants described in connection with Figures 1 and 2 are also applicable to the embodiment shown in Figure 3. In particular, the indication mentioned can be the indication of the property to be investigated, for which the statistical relationship is determined.

Images