Experimental evaluation of query processing on encrypted Telemedicine data

In advanced health care systems, the patients’ medical data can be outsourced to cloud servers to enable remote healthcare service providers to access and analyze patients’ data from any location to provide better treatment. However, outsourcing sensitive medical data makes data owners, i.e., patients, concerned about their privacy because private companies run the cloud service and the data can be accessed by them. Therefore, it is important to encrypt the data in the form of documents before outsourcing them to the cloud in a way that enables a data user, i.e., a doctor, to search over these documents without allowing the cloud provider to learn any private information about patients. Several schemes have been proposed to enable search over encrypted medical cloud data to preserve patient privacy, but the existing schemes suffer from high communication/computation overhead because they are designed for a single-data-owner setting. Moreover, they are not secure against known-plaintext/background and linkability attacks, and do not allow doctors to customize their search to avoid downloading irrelevant documents. In this paper, we develop an efficient search scheme over encrypted data for multi-data-owner setting. To secure our scheme, the cloud server obtains noisy similarity scores and doctors de-noise them to download the most relevant documents. Our scheme enables doctors to prescribe search conditions to customize the search without revealing the conditions to the server. Our formal proof and analysis indicate that our scheme can preserve privacy and is secure against known plaintext/background and linkability attacks, and the results of extensive experiments demonstrate the efficiency of our scheme compared to the existing works.

With the growing popularity of data and service outsourcing, where the data resides on remote servers in encrypted form, there remain open questions about what kind of query operations can be performed on the encrypted data. In this paper, we focus on one such important query operation, namely range query. One of the basic security primitive that can be used to evaluate range queries is secure comparison of encrypted integers. However, the existing secure comparison protocols strongly rely on the encrypted bit-wise representations rather than on pure encrypted integers. Therefore, in this paper, we first propose an efficient method for converting an encrypted integer z into encryptions of the individual bits of z. We then utilize the proposed security primitive to construct a new protocol for secure evaluation of range queries in the cloud computing environment. Furthermore, we empirically show the efficiency gains of using our security primitive over existing method under the range query application.

Data Mining has wide applications in many areas such as banking, medicine, scientific research and among government agencies. Classification is one of the commonly used tasks in data mining applications. For the past decade, due to the rise of various privacy issues, many theoretical and practical solutions to the classification problem have been proposed under different security models. However, with the recent popularity of cloud computing, users now have the opportunity to outsource their data, in encrypted form, as well as the data mining tasks to the cloud. Since the data on the cloud is in encrypted form, existing privacy-preserving classification techniques are not applicable. In this paper, we focus on solving the classification problem over encrypted data. In particular, we propose a secure k-NN classifier over encrypted data in the cloud. The proposed protocol protects the confidentiality of data, privacy of user's input query, and hides the data access patterns. To the best of our knowledge, our work is the first to develop a secure k-NN classifier over encrypted data under the semi-honest model. Also, we empirically analyze the efficiency of our proposed protocol using a real-world dataset under different parameter settings.

The rapid adoption of cloud computing has transformed the way data is stored, shared, and accessed across organizationsand individuals. Despite its scalability and cost efficiency, cloud storage introduces serious security and privacy challenges, particularly when sensitive data is outsourced to third-party cloud service providers. Traditional access control mechanisms often rely on the cloud provider’s trustworthiness, which may expose data to unauthorized access, insider threats, and data breaches. To address these concerns, CryptCloud+ is proposed as a secure and expressive data access control framework that enforces fine-grained authorization directly through cryptographic techniques. CryptCloud+ focuses on ensuring data confidentiality while enabling flexible and policy-driven access control over encrypted cloud data. The system leverages encryption-based access control, where data is encrypted before being uploaded to the cloud, and only authorized users possessing valid cryptographic credentials can decrypt and access the data. This approach eliminates the need to trust the cloud service provider, as all sensitive operations related to data access are handled at the client side. A key contribution of CryptCloud+ is its support for expressive access policies, allowing data owners to define complex rules based on user attributes such as roles, departments, access levels, or time constraints. These policies enable fine grained access control without requiring data owners to manage individual permissions manually. The framework ensures that users can access only the data they are authorized for, while unauthorized users, including cloud administrators, are unable to infer any meaningful information from the encrypted data. The proposed system is implemented using Python, taking advantage of its robust cryptographic libraries, simplicity, and integration capabilities. Python-based modules handle key generation, encryption, decryption, and policy enforcement, making the system modular and easy to extend. The implementation demonstrates how secure key management and attribute-based access enforcement can be achieved efficiently in a real-world cloud environment. CryptCloud+ also addresses scalability and performance concerns by minimizing computation overhead during data access. Encryption and decryption operations are optimized to ensure that system performance remains practical even as the number of users and data files increases. Experimental results indicate that the framework maintains strong security guarantees while providing acceptable response times for authorized users. In addition to security, the system enhances usability by allowing seamless data sharing among multiple users without re encrypting data for each individual. This significantly reduces management complexity for data owners while preserving strict access control policies. The system design ensures compatibility with existing cloud storage services, making itadaptable to various deployment scenarios. Overall, CryptCloud+ presents a secure, flexible, and effiient solution for cloud data access control. By combining cryptographic enforcement with expressive policy definition and Python-based implementation, the frameworkstrengthens data security, protects user privacy, and improves trust in cloud storage systems. The proposed model demonstrates the feasibility of practical, cryptography-driven access control for modern cloud environments.

The problem of efficiently evaluating XPath and XQuery queries has become increasingly significant since more and more XML data is stored in its native form. We propose a novel optimisation technique for XML queries that is based on the semantic properties exhibited by XML data. In sharp contrast to previous studies on selectivity estimation we propose to specify bounds on the number of element nodes in an XML tree that form the root of isomorphic subtrees. It turns out that efficient reasoning about these constraints provides effective means to predict the number of XPath and XQuery query answers, to predict the number of updates using the XQuery update facility, to predict the number of en(de)cryptions using XML encryption, and to optimise XML queries.

As one of the most popular queries in big data era, the <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$k$</tex-math></inline-formula> nearest neighbors ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$k$</tex-math></inline-formula> NN) query plays a significant role in various applications, such as medical diagnosis, signal processing, and recommendation systems. Meanwhile, driven by the advancement of the cloud service, an emerging trend among applications is to outsource the dataset and the corresponding <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$k$</tex-math></inline-formula> NN query services to the cloud. However, as the cloud is not fully trusted, those applications will face vital privacy concerns, and thus they usually encrypt data before outsourcing them to the cloud. Because encrypted data are outsourced to cloud, the <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$k$</tex-math></inline-formula> NN query over encrypted data has become increasingly attractive, and many solutions have been put forth in recent years. However, existing solutions cannot fully satisfy the objects of returning exact query results, protecting database privacy and query privacy, achieving high query efficiency, and imposing low computational costs at the user side. To address these issues, in this paper, we propose a new practical and privacy-preserving <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$k$</tex-math></inline-formula> NN query scheme. Specifically, we first refine the general security requirements for the matrix encryption by systematically analyzing existing algorithms. Then, we design a novel asymmetric matrix encryption (AME) to securely achieve Euclidean distance computation and two distances comparison in a single-party and non-interactive way. Then, based on the AME scheme, we propose a privacy-preserving <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$k$</tex-math></inline-formula> NN query scheme, in which a max-heap of size <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$k$</tex-math></inline-formula> is used to accelerate query efficiency. Detailed security analysis shows that our proposed scheme is really privacy-preserving. In addition, extensive performance evaluations are conducted, and the results demonstrate that our proposed scheme is also highly efficient.

The proliferation of a new breed of data management applications that store and process data at remote locations has led to the emergence of search over encrypted data as an important research problem. In a typical setting of the problem, data is stored at the remote location in an encrypted form. A query generated at the clientside is transformed into a representation such that it can be evaluated directly on encrypted data at the remote location. The results might be processed by the client after decryption to determine the final answers.

In the Database-As-a-Service (DAS) model, clients store their database contents at servers belonging to potentially untrusted service providers. To maintain data confidentiality, clients need to outsource their data to servers in encrypted form. At the same time, clients must still be able to execute queries over encrypted data. One prominent and fairly effective technique for executing SQL-style range queries over encrypted data involves partitioning (or bucketization) of encrypted attributes.However, executing aggregation-type queries over encrypted data is a notoriously difficult problem. One well-known cryptographic tool often utilized to support encrypted aggregation is homomorphic encryption; it enables arithmetic operations over encrypted data. One technique based on a specific homomorphic encryption function was recently proposed in the context of the DAS model. Unfortunately, as shown in this paper, this technique is insecure against ciphertext-only attacks. We propose a simple alternative for handling encrypted aggregation queries and describe its implementation. We also consider a different flavor of the DAS model which involves mixed databases, where some attributes are encrypted and some are left in the clear. We show how range queries can be executed in this model.

A Study on Deduplication Techniques over Encrypted Data

Database query evaluation over encrypted data can allow database users to maintain the privacy of their data while outsourcing data processing. Order-Preserving Encryption (OPE) and Order-Revealing Encryption (ORE) were designed to enable efficient query execution, but provide only partial privacy. More private protocols, based on Searchable Symmetric Encryption (SSE), Oblivious RAM (ORAM) or custom encrypted data structures, have also been designed. In this paper, we develop a framework to provide the first comprehensive comparison among a number of range query protocols that ensure varying levels of privacy of user data. We evaluate five ORE-based and five generic range query protocols. We analyze and compare them both theoretically and experimentally and measure their performance over database indexing and query evaluation. We report not only execution time but also I/O performance, communication amount, and usage of cryptographic primitive operations. Our comparison reveals some interesting insights concerning the relative security and performance of these approaches in database settings.

BackgroundPoor treatment adherence in COPD patients is associated with poor clinical outcomes and increased healthcare burden. Personalized approaches for adherence management, supported with technology-based interventions, may offer benefits to patients and providers but are currently unproven in terms of clinical outcomes as opposed to adherence outcomes.MethodsMaximizing Adherence and Gaining New Information For Your COPD (MAGNIFY COPD study), a pragmatic cluster randomized trial, aims to evaluate the impact of an adherence technology package (interventional package), comprising an adherence review, ongoing provision of a dual bronchodilator but with an add-on inhaler sensor device and a connected mobile application. This will compare time to treatment failure and other clinical outcomes in patients identified at high risk of exacerbations with historic poor treatment adherence as measured by prescription collection to mono/dual therapy over one year (1312 patients) versus usual care. Treatment failure is defined as the first occurrence of one of the following: (1) moderate/severe COPD exacerbation, (2) prescription of triple therapy (inhaled corticosteroid/long-acting β2-agonist/long-acting muscarinic antagonist [ICS/LABA/LAMA]), (3) prescription of additional chronic therapy for COPD, or (4) respiratory-related death. Adherence, moderate/severe exacerbations, respiratory-related healthcare resource utilization and costs, and intervention package acceptance rate will also be assessed. Eligible primary care practices (N=176) participating in the Optimum Patient Care Quality Improvement Program will be randomized (1:1) to either adherence support cluster arm (suitable patients already receiving or initiated Ultibro® Breezhaler® [indacaterol/glycopyrronium] will be offered interventional package) or the control cluster arm (suitable patients continue to receive usual clinical care). Patients will be identified and outcomes collected from anonymized electronic medical records within the Optimum Patient Care Research Database. On study completion, electronic medical record data will be re-extracted to analyze outcomes in both study groups.Registration NumberISRCTN10567920.ConclusionMAGNIFY will explore patient benefits of technology-based interventions for electronic adherence monitoring.

Medication nonadherence is associated with increased disease severity and poor disease outcomes. Patients with skin conditions specifically may be at risk of poor disease control due to low adherence to topical treatments. Barriers to adherence include time-consuming application, irritation, and inexact dosing.1 The use of the electronic monitors is the gold standard in objective evaluation of patient medication adherence. A microprocessor in the cap captures each opening and closing of the medication container and the related date and time.2 Electronic monitor data demonstrate significant decline in adherence to topical therapies over the treatment course for skin conditions, such as psoriasis and acne vulgaris, from 84.6 to 51% and 85 to 42%, respectively.3, 4 Physicians and patients tend to overestimate medication adherence compared to actual electronic monitor data, suggesting the importance of interventions such as patient education, frequent evaluation, motivational interviewing, and promotion of adherence. Commercially available electronic monitors were originally designed for pill bottles and do not fit common packaging for topical drugs such as tubes and pump bottles. This creates a challenge for assessing adherence to topical ointments and creams. An adapter has been described to attach electronic monitors to tubes of medication, but that adapter is not suitable for many packages. 3D printing offers a feasible means to create adaptors for other tube sizes. Our objective was to create an adapter to affix electronic monitors to various sized containers of topical medications based on prior studies using similar adapters to assess adherence to dermatologic therapy.5 The electronic cap adapters were reverse engineered from the two containers by taking measurements of the threads and container dimensions. The adapters were designed to work with Medication Even Monitoring System caps and were created using the Carbon M1 printer which utilizes Continuous Liquid Interface Production technology, a form of the digital light processing method of 3D printing. The material used to print the adapter was Carbon 3D's urethane methacrylate resin. Two different sizes of adapters were created to fit a 10 fl. oz. bottle of ointment and a 45 g tube of cream. The adapter was secured to each container using medical grade epoxy and threaded onto the electronic monitor cap (Figures 1 and 2). Iterative prototyping and fit testing were used to tune the 3D printed models to their specific container. The suitability of the adapters was assessed by determining if the adapters fit the electronic monitoring caps and created a water-tight seal. Water tightness was assessed by filling each container with water and then pressurizing them by hand to ensure no leakage occurred. Accuracy testing was performed by simulating medication events and recording the percentage of openings and closings registered by the cap-adapter system over a 1-month trial. Each custom-sized adapter was successfully designed to meet with specific thread specifications, allowing for a water-tight seal to be achieved between the container and the electronic monitor. The adapters created make it possible to affix the electronic monitor to topical medication containers, allowing assessment of medication adherence in upcoming studies. As the adapters are rigidly fixed to each container there is no risk of missed dosing, ensuring each studies accuracy. The 1-month test trial yielded 100% accuracy. Medical adherence to topical therapies is relatively low compared to oral systemic medications.6 Particularly, since adherence tends to be overestimated by patients without monitoring, electronic monitors serve as a reliable method of assessing the role of adherence in the management of dermatologic conditions.6 Previous studies have shown 100% accuracy of electronic monitors confirming the opening of medication packages, consistent with this study's results.5, 7 An adapter allows the electronic monitor to fit standard cream and ointment containers, extending the use of the monitoring device to dermatologic agents. The benefit of using the adapters as opposed to patient self-reporting of medication use is objective monitoring of patient adherence to their assigned medication protocol. Limitations of the cap-adapter system include the monitoring only of the rate of use, not the quantity or actual application of medication; therefore, the monitors rely on the user to correctly control the dosage volume and physical application of the medication. An alternative potential design is a pump version of the electronic monitoring cap that allows for accurate dispensing of dermatological ointments in a controlled dose, thus, tracking the volume of product dispensed along with frequency of use. 3D printing is an effective method to create custom-designed adapters which can be paired with electronic monitors to assess adherence in patients with skin conditions that require frequent and consistent application of topical medications such as psoriasis, atopic dermatitis, and acne vulgaris.1 These data can inform further interventions to support topical medication adherence for patients with skin conditions, who are at a disproportionate risk for nonadherence compared to patients treated with oral medication.

Using database encryption to protect data in some situations where access control is not solely enough is inevitable. Database encryption provides an additional layer of protection to conventional access control techniques. It prevents unauthorized users, including intruders breaking into a network, from viewing the sensitive data. As a result data keeps protected even in the incident that database is successfully attacked or stolen. However, data encryption and decryption process result in database performance degradation. In the situation where all the information is stored in encrypted form, one cannot make the selection on the database content any more. Data should be decrypted first, so an unwilling tradeoff between the security and the performance is normally forced. The appropriate approaches to increase the performance are methods to deal directly with the encrypted data without firstly decrypting them. This paper while introduce some methods for searching on encrypted data, provides a comparison study between current methods in terms of performance and security.

Cloud computing offers a new way of service provision by re-arranging various resources and IT structures over the Internet. Private user data are often stored in cloud in an encrypted form in order to preserve the privacy of data owners. Encrypted data sharing introduces new challenges for cloud data deduplication. We found that existing solutions of deduplication suffer from high computation complexity and cost and therefore few of them can be really deployed in practice. In this paper, we propose a scheme to deduplicate encrypted data stored in cloud based on proxy re-encryption. We evaluate its performance and advantages based on extensive analysis and implementation. The results show the efficiency and effectiveness of the scheme for potential practical deployment.

With remote storage systems, a user may store his data in the encrypted form at the remote storage server to preserve confidentiality. Later, the user wants to receive his data securely through an untrusted network. The user does not want to receive all of the stored data but the data related to specific words, to reduce the communication overload in the network. In this case, we need secure and efficient keyword search schemes over the encrypted data. In the paper, we show that the keyword search schemes suggested by Byun et al. and Ballard et al. do not provide semantic security which is the most important security requirement for the keyword search schemes.