ELIXIR: Authentication and Authorization Infrastructure Requirements Beurs van Berlage Amsterdam 14-17th September, 2010 Andrew Lyall www.elixir-europe.org @emblebi

ELIXIR in one slide Three year €3Million ESFRI BMS PP Project Consortium of 32 European organisations co-ordinated by EMBL-EBI An e-Infrastructure with a current user base within Europe of at least one million (unique IP addresses accessing EMBL-EBI) Provides the infrastructure to enable the utilisation of the Human Genome and all the other molecules of life, related data and services Used in basic life sciences, agricultural, environmental, pharmaceutical and many other areas of research ELIXIR was created to deploy these data in order to help to address the European Grand Challenges Emerging disruptive technologies mean that there will be at least a 1000-fold increase in data over the next decade Most of the data are available without authentication – the main exception is data relating to individual patients & volunteers

ELIXIR is coordinated by EMBL-EBI The European Bioinformatics Institute is an outstation of the European Molecular Biology Laboratory EMBL is an International organisation created by treaty (cf CERN, ESA) EMBL-EBI has 400 Staff, €30 Million Budget, several million users 15 year history of service provision and scientific excellence Sited at the Wellcome Trust Genome Campus Hinxton, Cambridge, UK after European competition 2008 funding sources

One Million Unique Users in 2009 Very large user community One Million Unique Users in 2009

Comprehensive, universal, integrated… Genomes Ensembl , Genomes, EGA Nucleotide sequence EMBL - Bank Gene expression ArrayExpress Proteomes UniProt , PRIDE Protein families, motifs and domains InterPro Protein structure PDBe Protein interactions IntAct Chemical entities ChEBI ChEMBL Pathways Reactome Systems BioModels Literature and ontologies CitExplore , GO Life sciences Medicine Agriculture Pharmaceuticals Biotechnology Environment Bio-fuels Cosmaceuticals Neutraceuticals Consumer products Personal genomes Etc…

BMS Support of the European Grand Challenges ELIXIR will provide Infrastructure for the other ESFRI BMS RI.

Growth of disk storage at EMBL-EBI Ten petabytes at May 2010.

Q1 How are users authenticated? They aren’t... Users access the data collections anonymously via web pages, web services and download Except for a very few who need to access data that could be used to identify an individual (personal data) However, the number of users needing to do this is on the increase The problems are not technical, they are political, ethical and societal

How are users of personal data authenticated? On a case by case basis Each data-set has a custodian The custodian specifies a mechanism for certification and authorisation and an oversight procedure Often certification and permission will be handled by a Data Access Committee or an Ethics Committee A variety of different mechanisms are used – conceptually, each data manager or custodian will decides for themselves Not all sensitive data are equally sensitive so it is likely that there will be different mechanisms even from the same source ELIXIR will need to pass these mechanisms through unchanged It will probably be necessary to audit access

Q3. Which types of resources are in use? A typical resource will integrate expert data-curation, RDBMS access, high-bandwidth networking and high-performance storage Some resource may also integrate HPC for an “algorithmic” step The resource will be accessed without authentication (except for personal data) The are perhaps twenty resources located at EMBL-EBI that account for 80% of the total usage These are deployed using EMBL-EBI’s private grid They are made accessible without authorisation through a web page, via web services or by download of the data set. The remaining 20% of usage is accounted for by many hundreds of resources all around Europe which are deployed using similar means – many of these are important in their own right.

Q4 Where will we be in five years time? Most data will be accessed without authentication Commercial or public domain grids and/or clouds may be doing the deployment rather than privately owned ones Modest progress will have been made on the political, ethical and societal problems associated with accessing personal data More investigators will be accessing personal data, probably by ad-hoc means Some of the technology currently under development will have been useful in providing these solutions

Q5 Are the users happy? Authentication is unacceptable to many users The user base is very diverse and there is considerable organisational complexity Those who need to access personal data usually understand the issues and are prepared to accept the limitations that this imposes Open access is crucial to the progress of biology and medicine

Example of organisational complexity *** ** Hospital Clinical Research Centre Case Report Form (CRF) Clinical Scientist Patient Notes EPR System Study DMS Clinical DMS Statistics System Hospital laboratory * University Images LIMS System Instrument System Pathology Tissue bank Public domain Key = Identifiable ELIXIR Research System = Deidentified

Example of stakeholder complexity Clinical Researcher Research Nurses Surgeons Pathologists Scientists Technicians Statisticians Bioinformaticians …and the patients!