Emanuele Raso

The healthcare industry is witnessing a rapid rise in the adoption of wearable and implantable medical devices, including advanced electrochemical sensors and other smart diagnostic technologies. These devices are increasingly used to enable real-time monitoring of physiological parameters, allowing for faster diagnosis and more personalized care plans. Their growing presence reflects a broader shift toward smart connected healthcare systems aimed at delivering immediate and actionable insights to both patients and medical professionals. At the same time, the healthcare industry is increasingly targeted by cyberattacks, primarily due to the high value of medical information; in addition, the growing integration of ICT technologies into medical devices has introduced new vulnerabilities that were previously absent in this sector. To mitigate these risks, new international guidelines advocate the adoption of best practices for secure software development, emphasizing a security-by-design approach in the design and implementation of such devices. However, the vast and fragmented nature of the information required to effectively support these development processes poses a challenge for the numerous stakeholders involved. In this paper, we demonstrate how key features of the Malware Information Sharing Platform (MISP) can be leveraged to systematically collect and structure vulnerability-related information for medical devices. We propose tailored structures, objects, and taxonomies specific to medical devices, facilitating a standardized data representation that enhances the security-by-design development of these devices.

Along with the creation of medical profiles of patients, Electronic Health Records have several secondary missions, such as health economy and research. The recent, increasing adoption of a common standard, i.e., the Fast Healthcare Interoperability Resources (FHIR), makes it easier to exchange medical data among the several parties involved, for example, in an epidemiological research activity. However, this exchange process is hindered by regulatory frameworks due to privacy issues related to the presence of personal information, which allows patients to be identified directly (or indirectly) from their medical data. When properly used, de-identification techniques can provide crucial support in overcoming these problems. FHIR-DIET aims to bring flexibility and concreteness to the implementation of de-identification of health data, supporting many customised data-processing behaviours that can be easily configured and tailored to match specific use case requirements. Our solution enables faster and easier cooperation between legal and IT professionals to establish and implement de-identification rules. The performance evaluation demonstrates the viability of processing hundreds of FHIR patient information data per second using standard hardware. We believe FHIR-DIET can be a valuable tool to satisfy the current regulation requirements and help to create added-value for the secondary use of healthcare data.

In the past few years, blockchain technology has emerged in numerous smart grid applications, enabling the construction of systems without the need for a trusted third party. Blockchain offers transparency, traceability, and accountability, which lets various energy management system functionalities be executed through smart contracts, such as monitoring, consumption analysis, and intelligent energy adaptation. Nevertheless, revealing sensitive energy consumption information could render users vulnerable to digital and physical assaults. This paper presents a novel method for achieving a dual balance between privacy and transparency, as well as accountability and verifiability. This equilibrium requires the incorporation of cryptographic tools like Secure Multiparty Computation and Verifiable Secret Sharing within the distributed components of a multi-channel blockchain and its associated smart contracts. We corroborate the suggested architecture throughout the entire process of a Demand Response scenario, from the collection of energy data to the ultimate reward. To address our proposal’s constraints, we present countermeasures against accidental crashes and Byzantine behavior while ensuring that the solution remains appropriate for low-performance IoT devices.

Points-of-care (PoCs) augment healthcare systems by performing care whenever needed and are becoming increasingly crucial for the well-being of the worldwide population. Personalized medicine, chronic illness management, and cost reduction can be achieved thanks to the widespread adoption of PoCs. Significant incentives for PoCs deployment are nowadays given by wearable devices and, in particular, by RFID (RadioFrequency IDentification) and NFC (Near Field Communications), which are rising among the technological cornerstones of the healthcare internet of things (H-IoT). To fully exploit recent technological advancements, this paper proposes a system architecture for RFID-and NFC-based PoCs. The architecture comprises in a unitary framework both interfaces to benefit from their complementary features, and gathered data are shared with medical experts through secure and user-friendly interfaces that implement the Fast Health Interoperability Resource (FHIR) emerging healthcare standard. The selection of the optimal UHF and NFC components is discussed concerning the employable sensing techniques. The secure transmission of sensitive medical data is addressed by developing a user-friendly "PoC App" that is the first web app exploiting attribute-based encryption (ABE). An application example of the system for monitoring the pH and cortisol levels in sweat is implemented and preliminarily tested by a healthy volunteer.

World population and life expectancy have increased steadily in recent years, raising issues regarding access to medical treatments and related expenses. Through last-generation medical sensors, NFC (Near Field Communication) and radio frequency identification (RFID) technologies can enable healthcare internet of things (H-IoT) systems to improve the quality of care while reducing costs. Moreover, the adoption of point-of-care (PoC) testing, performed whenever care is needed to return prompt feedback to the patient, can generate great synergy with NFC/RFID H-IoT systems. However, medical data are extremely sensitive and require careful management and storage to protect patients from malicious actors, so secure system architectures must be conceived for real scenarios. Existing studies do not analyze the security of raw data from the radiofrequency link to cloud-based sharing. Therefore, two novel cloud-based system architectures for data collected from NFC/RFID medical sensors are proposed in this paper. Privacy during data collection is ensured using a set of classical countermeasures selected based on the scientific literature. Then, data can be shared with the medical team using one of two architectures: in the first one, the medical system manages all data accesses, whereas in the second one, the patient defines the access policies. Comprehensive analysis of the H-IoT system can be useful for fostering research on the security of wearable wireless sensors. Moreover, the proposed architectures can be implemented for deploying and testing NFC/RFID-based healthcare applications, such as, for instance, domestic PoCs.

In recent years, body-worn RFID and NFC (near field communication) devices have become one of the principal technologies concurring to the rise of healthcare internet of thing (H-IoT) systems. Similarly, points of care (PoCs) moved increasingly closer to patients to reduce the costs while supporting precision medicine and improving chronic illness management, thanks to timely and frequent feedback from the patients themselves. A typical PoC involves medical sensing devices capable of sampling human health, personal equipment with communications and computing capabilities (smartphone or tablet) and a secure software environment for data transmission to medical centers. Hybrid platforms simultaneously employing NFC and ultra-high frequency (UHF) RFID could be successfully developed for the first sensing layer. An application example of the proposed hybrid system for the monitoring of acute myocardial infarction (AMI) survivors details how the combined use of NFC and UHF-RFID in the same PoC can support the multifaceted need of AMI survivors while protecting the sensitive data on the patient’s health.

Blockchain technology can be applied to smart grids to support business and management operations, and its distributed nature is advantageous when considering user-managed renewable systems. However, these new fully distributed systems raise a number of security and privacy issues. For this reason, numerous solutions integrating blockchain with privacy and security enhancing technologies, such as homomorphic encryption, secret sharing and zero-knowledge proof, have been proposed in the literature. The complexity of such systems from an algorithmic and protocol point of view is obvious, while the computational cost is less obvious and often overlooked by the authors. In this paper, we want to experimentally evaluate the computational weight of cryptographic techniques proposed to guarantee security and privacy on blockchains. We will take as reference commercial devices with computational capabilities similar to those we expect to find in smart grid devices. The results show that some techniques are not suitable for these scenarios and that architectural solutions must therefore be carefully designed.

Blockchain technologies offer an interesting opportunity for Smart Grids, by introducing accountability transparency and trust without requiring any trusted central authority. However, due to the transparency of data and operations, and the “store forever” policy, they also offer important privacy challenges, only partially taken up by the default features provided by the conventional blockchain. In this work we analyse the literature studies on privacy solutions for blockchain-based smart grid application. We provide a taxonomy for the different solutions and discussing the new research opportunities that are emerging.

Demand response consists in the modification of energy consumption by end users to attain specific effects on the electrical grid, namely reduce congestion and optimize the usage of renewable energy. When implemented with blockchain, demand response poses important privacy concerns since it generally needs the publication of sensitive information about users regarding their energy consumption. In this work, we devise a system to preserve privacy in such a scenario by using Secure Multiparty Computation (SMC) algorithms and a blockchain-based architecture with the goal of achieving both accountability and privacy.

With the aim to facilitate compliance with the GDPR, particularly for SMEs, this paper summarises the results of the H2020 BPR4GDPR project. With a focus on business processes, the project has proposed a holistic approach able to support compliant processes, while fulfilling requirements covering diverse application domains. The main pillars of the solution are: i) a policy-based access and usage control system, for setting the operational rules; ii) a framework for automatically re-engineering processes, so that they become compliant by design; iii) a run-time environment for the enforcement of privacy constraints and data subjects’ rights; iv) a process mining framework, devised for ex post compliance analysis and conformance checking leveraging the process execution traces.