Ontological Representation of Healthcare Application Security Using Blockchain Technology
Volume 33, Issue 2 (2022), pp. 365–397
Raimundas Matulevičius
Mubashar Iqbal
Emna Ammar Elhadjamor
Sonia Ayachi Ghannouchi
Mariia Bakhtina
Slaheddine Ghannouchi
Mubashar Iqbal
Emna Ammar Elhadjamor
Sonia Ayachi Ghannouchi
Mariia Bakhtina
Slaheddine Ghannouchi
Pub. online: 17 June 2022
Type: Research Article
Open Access
Open Access
Received
1 December 2021
1 December 2021
Accepted
1 May 2022
1 May 2022
Published
17 June 2022
17 June 2022
Abstract
Blockchain is gaining traction for improving the security of healthcare applications, however, it does not become a silver bullet as various security threats are observed in blockchain-based applications. Moreover, when performing the security risk management (SRM) of blockchain-based applications, there are conceptual ambiguities and semantic gaps that hinder from treating the security threats effectively. To address these issues, we present a blockchain-based healthcare security ontology (HealthOnt) that offers coherent and formal information models to treat security threats of traditional and blockchain-based applications. We evaluate the ontology by performing the SRM of a back-pain patient’s healthcare application case. The results show that HealthOnt can support the iterative process of SRM and can be continually updated when new security threats, vulnerabilities, or countermeasures emerge. In addition, the HealthOnt may assist in the modelling and analysis of real-world situations while addressing important security concerns from the perspective of stakeholders. This work can help blockchain developers, practitioners, and other associated stakeholders to develop secure blockchain-based healthcare applications in the early stages.
References
Agbo, C.C., Mahmoud, Q.H., Eklund, J.M. (2019). Blockchain technology in healthcare: a systematic review. Healthcare, 7(2). https://doi.org/10.3390/healthcare7020056.
Ahmadi, H., Arji, G., Shahmoradi, L., Safdari, R., Nilashi, M., Alizadeh, M. (2019). The application of internet of things in healthcare: a systematic literature review and classification. Universal Access in the Information Society, 18(4), 837–869. https://doi.org/10.1007/s10209-018-0618-4.
Aljedaani, B., Babar, M.A. (2021). Challenges with developing secure mobile health applications: systematic review. JMIR Mhealth Uhealth, 9(6), 15654. https://doi.org/10.2196/15654.
Arunkumar, S., Muppidi, S. (2019). Secure your blockchain solutions. https://developer.ibm.com/articles/how-to-secure-blockchain-solutions.
Bhuiyan, M.Z.A., Zaman, A., Wang, T., Wang, G., Tao, H., Hassan, M.M. (2018). Blockchain and Big Data to transform the healthcare. In: Proceedings of the International Conference on Data Processing and Applications, ICDPA 2018. Association for Computing Machinery, New York, NY, USA, pp. 62–68. 9781450364188. https://doi.org/10.1145/3224207.3224220.
Biryukov, A., Tikhomirov, S. (2019). Deanonymization and linkability of cryptocurrency transactions based on network analysis. In: 2019 IEEE European Symposium on Security and Privacy (EuroS P), pp. 172–184. https://doi.org/10.1109/EuroSP.2019.00022.
Chen, J., Ma, X., Du, M., Wang, Z. (2018). A blockchain application for medical information sharing. In: 2018 IEEE International Symposium on Innovation and Entrepreneurship (TEMS-ISIE), pp. 1–7. https://doi.org/10.1109/TEMS-ISIE.2018.8478645.
Chen, L., Lee, W.-K., Chang, C.-C., Choo, K.-K.R., Zhang, N. (2019). Blockchain based searchable encryption for electronic health record sharing. Future Generation Computer Systems, 95, 420–429. https://doi.org/10.1016/j.future.2019.01.018.
Chukwu, E., Garg, L. (2020). A systematic review of blockchain in healthcare: frameworks, prototypes, and implementations. IEEE Access, 8, 21196–21214. https://doi.org/10.1109/ACCESS.2020.2969881.
Dagher, G.G., Mohler, J., Milojkovic, M., Marella, P.B. (2018). Ancile: Privacy-preserving framework for access control and interoperability of electronic health records using blockchain technology. Sustainable Cities and Society, 39, 283–297. https://doi.org/10.1016/j.scs.2018.02.014.
Dexter, S. (2018). How Are Blockchain Transactions Validated? Consensus VS Validation. https://www.mangoresearch.co/blockchain-consensus-vs-validation.
Dinh, T.T.A., Wang, J., Chen, G., Liu, R., Ooi, B.C., Tan, K.-L. (2017). BLOCKBENCH: a framework for analyzing private blockchains. In: Proceedings of the 2017 ACM International Conference on Management of Data, SIGMOD ’17. Association for Computing Machinery, New York, NY, USA, pp. 1085–1100. 9781450341974. https://doi.org/10.1145/3035918.3064033.
Douceur, J.R. (2002). The Sybil Attack. In: Druschel, P., Kaashoek, F., Rowstron, A. (Eds.), Peer-to-Peer Systems, IPTPS 2002, Lecture Notes in Computer Science, Vol. 2429. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-45748-8_24.
Dubois, É., Mayer, N., Heymans, P., Matulevičius, R. (2010). A Systematic Approach to Define the Domain of Information System Security Risk Management. Springer, Berlin, Heidelberg, pp. 289–306. https://doi.org/10.1007/978-3-642-12544-7_16.
El-Gazzar, R., Stendal, K. (2020). Blockchain in health care: hope or hype? Journal of Medical Internet Research, 22(7). https://doi.org/10.2196/17199.
Esposito, C., De Santis, A., Tortora, G., Chang, H., Choo, K.-K.R. (2018). Blockchain: a panacea for healthcare cloud-based data security and privacy? IEEE Cloud Computing, 5(1), 31–37. https://doi.org/10.1109/MCC.2018.011791712.
Fatima, A., Colomo-Palacios, R. (2018). Security aspects in healthcare information systems: a systematic mapping. Procedia Computer Science, 138, 12–19. https://doi.org/10.1016/j.procs.2018.10.003.
Gao, Y.-L., Chen, X.-B., Chen, Y.-L., Sun, Y., Niu, X.-X., Yang, Y.-X. (2018). A secure cryptocurrency scheme based on post-quantum blockchain. IEEE Access, 6, 27205–27213. https://doi.org/10.1109/ACCESS.2018.2827203.
George, S.L., Buyse, M. (2015). Data fraud in clinical trials. Clinical Investigation (Lond), 5(2), 161–173. https://doi.org/10.4155/cli.14.116.
Griggs, K.N., Ossipova, O., Kohlios, C.P., Baccarini, A.N., Howson, E.A., Hayajneh, T. (2018). Healthcare blockchain system using smart contracts for secure automated remote patient monitoring. Journal of Medical Systems, 42(130), 1–7. https://doi.org/10.1007/s10916-018-0982-x.
Grunspan, C., Perez-Maro, R. (2018). Double spend races. International Journal of Theoretical and Applied Finance, 21(08), 1850053. https://doi.org/10.1142/s021902491850053x.
Guru, D., Perumal, S., Varadarajan, V. (2021). Approaches towards blockchain innovation: a survey and future directions. Electronics (Switzerland), 10(10), 1–15. https://doi.org/10.3390/electronics10101219.
Hathaliya, J.J., Tanwar, S. (2020). An exhaustive survey on security and privacy issues in Healthcare 4.0. Computer Communications, 153, 311–335. https://doi.org/10.1016/j.comcom.2020.02.018.
Hector, U.-R., Boris, C.-L. (2020). BLONDiE: Blockchain Ontology with Dynamic Extensibility. https://doi.org/10.48550/arXiv.2008.09518.
HelpNetSecurity (2019). More than 99% of cyberattacks rely on human interaction. https://www.helpnetsecurity.com/2019/09/10/cyberattacks-human-interaction/.
Henningsen, S., Teunis, D., Florian, M., Scheuermann, B. (2019). Eclipsing ethereum peers with false friends. In: 2019 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE Computer Society, Los Alamitos, CA, USA, pp. 300–309. https://doi.org/10.1109/EuroSPW.2019.00040.
Herzog, A., Shahmehri, N., Duma, C. (2007). An ontology of information security. International Journal of Information Security and Privacy (IJISP), 1(4), 1–23. https://doi.org/10.4018/jisp.2007100101.
Hussein, A.F., N., A., Ramírez-González, G., Abdulhay, E.W., Tavares, J.M.R.S., de Albuquerque, V.H.C. (2018). A medical records managing and securing blockchain based system supported by a genetic algorithm and discrete wavelet transform. Cognitive Systems Research, 52, 1–11. https://doi.org/10.1016/j.cogsys.2018.05.004.
IBM-Blockchain (2022). Blockchain in healthcare. https://www.ibm.com/blogs/blockchain/category/blockchain-healthcare.
Iqbal, M., Matulevičius, R. (2019). Blockchain-based application security risks: a systematic literature review. In: Proper, H.A., Stirna, J. (Eds.), Advanced Information Systems Engineering Workshops. Springer International Publishing, Cham, pp. 176–188. 978-3-030-20948-3. https://doi.org/10.1007/978-3-030-20948-3_16.
Iqbal, M., Matulevičius, R. (2020). Corda security ontology: example of post-trade matching and confirmation. Baltic Journal of Modern Computing, 8(4), 638–674. https://doi.org/10.22364/bjmc.2020.8.4.11.
Iqbal, M., Matulevičius, R. (2021a). Exploring sybil and double-spending risks in blockchain systems. IEEE Access, 9, 76153–76177. https://doi.org/10.1109/ACCESS.2021.3081998.
Iqbal, M., Matulevičius, R. (2021b). Blockchain as a countermeasure solution for security threats of healthcare applications. In: González Enríquez, J., Debois, S., Fettke, P., Plebani, P., van de Weerd, I., Weber, I. (Eds.), Business Process Management: Blockchain and Robotic Process Automation Forum. Springer International Publishing, Cham, pp. 67–84. 978-3-030-85867-4.
Iwaya, L.H., Ahmad, A., Babar, M.A. (2020). Security and privacy for mHealth and uHealth systems: a systematic mapping study. IEEE Access, 8, 150081–150112. https://doi.org/10.1109/ACCESS.2020.3015962.
Jin, H., Luo, Y., Li, P., Mathew, J. (2019). A review of secure and privacy-preserving medical data sharing. IEEE Access, 7, 61656–61669. https://doi.org/10.1109/ACCESS.2019.2916503.
Jonathan, K., Sari, A.K. (2019). Security issues and vulnerabilities on a blockchain system: a review. In: 2019 International Seminar on Research of Information Technology and Intelligent Systems (ISRITI). IEEE, Yogyakarta, Indonesia, pp. 228–232. https://doi.org/10.1109/ISRITI48646.2019.9034659.
Kang, W., Liang, Y. (2013). A security ontology with MDA for software development. In: 2013 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC). IEEE, Beijing, China, pp. 67–74. https://doi.org/10.1109/CyberC.2013.20.
Khan, N., Nassar, M. (2019). A look into privacy-preserving blockchains. In: 2019 IEEE/ACS 16th International Conference on Computer Systems and Applications (AICCSA). IEEE Computer Society, Abu Dhabi, United Arab Emirates, pp. 1–6. https://doi.org/10.1109/AICCSA47632.2019.9035235.
Kleinaki, A.S., Mytis-Gkometh, P., Drosatos, G., Efraimidis, P.S., Kaldoudi, E. (2018). A blockchain-based notarization service for biomedical knowledge retrieval. Computational and Structural Biotechnology Journal, 16, 288–297. https://doi.org/10.1016/j.csbj.2018.08.002.
Li, X., Jiang, P., Chen, T., Luo, X., Wen, Q. (2020). A survey on the security of blockchain systems. Future Generation Computer Systems, 107, 841–853. https://doi.org/10.1016/j.future.2017.08.020.
Liu, L., Chen, W., Zhang, L., Liu, J.Y., Qin, J. (2019). A type of block withholding delay attack and the countermeasure based on type-2 fuzzy inference. Mathematical Biosciences and Engineering, 17(1), 309–327. https://doi.org/10.3934/mbe.2020017.
Mansfield-Devine, S. (2016). Your life in your hands: the security issues with healthcare apps. Network Security, 2016(4), 14–18. https://doi.org/10.1016/S1353-4858(16)30038-1.
McGhin, T., Choo, K.-K.R., Zhechao, C., He, D. (2019). Blockchain in healthcare applications: research challenges and opportunities. Journal of Network and Computer Applications, 135, 62–75. https://doi.org/10.1016/j.jnca.2019.02.027.
Musamih, A., Salah, K., Jayaraman, R., Arshad, J., Debe, M., Al-Hammadi, Y., Ellahham, S. (2021). A blockchain-based approach for drug traceability in healthcare supply chain. IEEE Access, 9, 9728–9743. https://doi.org/10.1109/ACCESS.2021.3049920.
Neisse, R., Steri, G., Nai-Fovino, I. (2017). A blockchain-based approach for data accountability and provenance tracking. In: Proceedings of the 12th International Conference on Availability, Reliability and Security, ARES ’17. Association for Computing Machinery, New York, NY, USA. https://doi.org/10.1145/3098954.3098958.
Nicolas, K., Wang, Y., Giakos, G.C., Wei, B., Shen, H. (2021). Blockchain system defensive overview for double-spend and selfish mining attacks: a systematic approach. IEEE Access, 9, 3838–3857. https://doi.org/10.1109/ACCESS.2020.3047365.
Raad, J., Cruz, C. (2015). A survey on ontology evaluation methods. In: Proceedings of the International Conference on Knowledge Engineering and Ontology Development, Part of the 7th International Joint Conference on Knowledge Discovery, Knowledge Engineering and Knowledge Management. SciTePress, Lisbonne, Portugal, pp. 179–186.
Radhakrishnan, B.L., Sam Joseph, A., Sudhakar, S. (2019). Securing blockchain based electronic health record using multilevel authentication. In: 2019 5th International Conference on Advanced Computing & Communication Systems (ICACCS). IEEE, USA, pp. 699–703. https://doi.org/10.1109/ICACCS.2019.8728483.
Rahmadika, S., Rhee, K.H. (2018). Blockchain technology for providing an architecture model of decentralized personal health information. International Journal of Engineering Business Management, 10, 1–12. https://doi.org/10.1177/1847979018790589.
Ratta, P., Kaur, A., Sharma, S., Shabaz, M., Dhiman, G. (2021). Application of blockchain and internet of things in healthcare and medical sector: applications, challenges, and future perspectives. Journal of Food Quality, 2021, 7608296. https://doi.org/10.1155/2021/7608296.
Rosenfeld, M. (2014). Analysis of Hashrate-Based Double Spending. arXiv preprint arXiv:1402.2009, 1–13.
Saha, A., Amin, R., Kunal, S., Vollala, S., Dwivedi, S.K. (2019). Review on “Blockchain technology based medical healthcare system with privacy issues”. Security and Privacy, 2(5), 83. https://doi.org/10.1002/spy2.83.
Sardi, A., Rizzi, A., Sorano, E., Guerrieri, A. (2020). Cyber risk in health facilities: a systematic literature review. Sustainability, 12(17). https://doi.org/10.3390/su12177002.
Sayeed, S., Marco-Gisbert, H. (2019). Assessing blockchain consensus and security mechanisms against the 51% attack. Applied Sciences, 9(9). https://doi.org/10.3390/app9091788.
SecurityMetrics (2015). Healthcare: Recognize Social Engineering Techniques. https://www.securitymetrics.com/blog/healthcare-recognize-social-engineering-techniques.
Shankland, S. (2021). Cryptocurrency faces a quantum computing problem. https://www.cnet.com/personal-finance/crypto/cryptocurrency-faces-a-quantum-computing-problem.
SpecOpsSoft (2020). The countries experiencing the most ‘significant’ cyber-attacks. https://specopssoft.com/blog/countries-experiencing-significant-cyber-attacks/.
Steiner, C.M., Albert, D. (2017). Validating domain ontologies: a methodology exemplified for concept maps. Cogent Education, 4(1). https://doi.org/10.1080/2331186X.2016.1263006.
Swathi, P., Modi, C., Patel, D. (2019). Preventing sybil attack in blockchain using distributed behavior monitoring of miners. In: 2019 10th International Conference on Computing, Communication and Networking Technologies (ICCCNT). IEEE, Kanpur, pp. 6–11. https://doi.org/10.1109/ICCCNT45670.2019.8944507.
Tosh, D.K., Shetty, S., Liang, X., Kamhoua, C.A., Kwiat, K.A., Njilla, L. (2017). Security implications of blockchain cloud with analysis of block withholding attack. In: 17TH IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing (CCGRID), pp. 458–467. https://doi.org/10.1109/CCGRID.2017.111.
Uschold, M., Gruninger, M. (1996). Ontologies: principles, methods and applications. The Knowledge Engineering Review, 11(2), 93–136. https://doi.org/10.1017/S0269888900007797.
Velissarios, J., Herzig, J., Didem, U. (2019). Blockchain’s potential starts with security. https://www.accenture.com/us-en/insights/blockchain/potential-starts-security.
Wang, Y., Yang, J., Li, T., Zhu, F., Zhou, X. (2018). Anti-dust: a method for identifying and preventing blockchain’s dust attacks. In: 2018 International Conference on Information Systems and Computer Aided Education (ICISCAE). IEEE, Changchun, pp. 274–280. https://doi.org/10.1109/ICISCAE.2018.8666834.
Wani, T.A., Mendoza, A., Gray, K. (2020). Hospital bring-your-own-device security challenges and solutions: systematic review of gray literature. JMIR Mhealth Uhealth, 8(6), 18175. https://doi.org/10.2196/18175.
Xu, J., Xue, K., Li, S., Tian, H., Hong, J., Hong, P., Yu, N. (2019). Healthchain: a blockchain-based privacy preserving scheme for large-scale health data. IEEE Internet of Things Journal, 6(5), 8770–8781. https://doi.org/10.1109/JIOT.2019.2923525.
Yaqoob, I., Salah, K., Jayaraman, R., Al-Hammadi, Y. (2021). Blockchain for healthcare data management: opportunities, challenges, and future recommendations. Neural Computing and Applications. https://doi.org/10.1007/s00521-020-05519-w.
Yeng, P.K., Szekeres, A., Yang, B., Snekkenes, E.A. (2021). Mapping the psychosocialcultural aspects of healthcare professionals’ information security practices: systematic mapping study. JMIR Human Factors, 8(2), 17604. https://doi.org/10.2196/17604.
Yin, W., Wen, Q., Li, W., Zhang, H., Jin, Z. (2018). An anti-quantum transaction authentication approach in blockchain. IEEE Access, 6, 5393–5401. https://doi.org/10.1109/ACCESS.2017.2788411.
Zhang, A., Lin, X. (2018). Towards secure and privacy-preserving data sharing in e-health systems via consortium blockchain. Journal of Medical Systems, 42(8). https://doi.org/10.1007/s10916-018-0995-5.
Zhang, S., Lee, J.-H. (2019). Double-spending with a sybil attack in the bitcoin decentralized network. IEEE Transactions on Industrial Informatics, 15(10), 5715–5722. https://doi.org/10.1109/TII.2019.2921566.
Zhou, X., Jin, Y., Zhang, H., Li, S., Huang, X. (2016). A map of threats to validity of systematic literature reviews in software engineering. In: 2016 23rd Asia-Pacific Software Engineering Conference (APSEC). IEEE, Hamilton, New Zealand, pp. 153–160. https://doi.org/10.1109/APSEC.2016.031.
Biographies
Matulevičius Raimundas
R. Matulevičius received his PhD diploma from the Norwegian University of Science and Technology in computer and information science in 2005. He was a postdoctoral researcher at the University of Namur in Belgium from 2005 to 2009. From 2010 to 2018 he worked as an associate professor at the University of Tartu. Currently, Matulevičius holds a professor of information security position at the University of Tartu (Estonia). His research interests include security and privacy of information, security risk management, and model-driven security. His publication record includes more than 111 articles published in peer-reviewed journals, conferences, and workshops. Matulevičius has been a program committee member (e.g. NordSec, PoEM, REFSQ, and CAiSE and others), steering committee member (e.g. BIR, ADBIS, Baltic DB&IS) at international conferences. Matulevičius is an editorial board member of the Requirements Engineering Journal (REEN, Springer), Business and Information Systems Engineering (BISE, Springer) and a few other international journals. He is a co-editor of six books in the field of computer science and information systems, and an author of a book on “Fundamentals of Secure System Modelling” (Springer, 2017). Currently, he is involved in the SPARTA H2020 project (task: Privacy-by-Design) and is a principal researcher in the Erasmus+ projects on securing against phishing (CyberPhish) and blockchain skills development (CHAISE).
Iqbal Mubashar
M. Iqbal began his PhD degree in computer science at the University of Tartu (UT), Estonia, in 2018 and has been working as a junior research fellow at the UT since 2019. M. Iqbal is also a member of UT’s highly recognized information security research group, where he conducts impactful research while also teaching two blockchain-related courses. His research interests include the security implications of blockchain systems and the implementation of a security risk management framework for blockchain systems, concentrating specifically on the security of blockchain-based decentralized applications. Currently, he is involved in the ERASMUS+ sectoral alliance program, CHAISE. He has co-authored 12+ research papers in premier journals and conferences.
Ammar Elhadjamor Emna
E. Ammar Elhadjamor received her PhD in computer science from the University of Sousse in Tunisia. She is a contractual teacher of computer science at the Institut Supérieur des Sciences Appliquées et de la Technologie, University of Sousse. She is a member of the RIADI laboratory. She has taught courses related to databases, business intelligence, data warehouse, algorithms and data mining. Her research interests include machine learning, business process management, process mining, e-Learning and e-Health.
Ghannouchi Sonia Ayachi
S.A. Ghannouchi obtained her PhD in computer science from the University of Manouba in Tunisia and her HDR in enterprise computing from the University of Sousse in Tunisia. She is a full professor in business computing at the High Institute of Management of Sousse, in the University of Sousse. Her taught courses include: “Databases”, “Information systems”, “Software Engineering” and “Business Process Reengineering”. Her research interests include: software engineering and reengineering, business process modelling, business process management, process mining, e-learning and e-health.
Bakhtina Mariia
M. Bakhtina received the MA degree in innovation and technology management from the University of Tartu (UT), Estonia. There, she is pursuing a PhD degree in computer science. Also, she is working as a junior research fellow with UT. Her research interests include the influence of technologies and digital products on organisations, particularly how intelligent systems should be managed in terms of information security and privacy.
Ghannouchi Slaheddine
S. Ghannouchi is a doctor of medicine from the Faculty of Medicine of Sousse since 1986, orthopedic surgeon since 1990 and professor of anatomy at the Faculty of Medicine of Sousse since 1995. He holds a PhD in biomechanics from the Ecole Supérieure d’Arts et Métier – Paris (1998). He also graduated with a degree in legal compensation for bodily injury from the Faculty of Medicine of Marseille (2008) and he is a judicial expert at the courts since 1995 and expert with the National Health Insurance Structure (CNAM) since 1991.
