Research Paper Presentation Software Engineering in agent systems

Goal and Motivation Goal Secure communication using PKI, JADE-S Authentication using JAAS Access authorization with policy rules Motivation Providing a DSS that assists physician to classify different cases Providing an approach to security issues arisen from the distributed locations of healthcare facilities Conforming to ethical regulations for handling patients’ health data

UK Data Protection Act 1998 Principles “Personal data shall be processed fairly and lawfully,” …and under listed conditions. Patients’ records are for diagnosis or training classifiers only. “Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.”

UK Data Protection Act 1998 Principles “Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.” Anonymised data with link-id are used for training. “Personal data shall be accurate and, where necessary, kept up to date.”

UK Data Protection Act 1998 Principles “Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.” All training cases will be discarded when the training phase of a classifier is over.

UK Data Protection Act 1998 Principles “Personal data shall be processed in accordance with the rights of data subjects under this Act.” Patients can request to withdraw from providing their case data and the data will be removed from corresponding databases.

UK Data Protection Act 1998 Principles “Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.” Clinical centers enforce their access policy to conform with the above principle.

UK Data Protection Act 1998 Principles “Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.” The network of this project is within the EU boundary, and data provided outside the boundary will be anonymised and protected with an agreement conforming to the principles.

The architecture A distributed network containing 60 different centers Figure 1 from Xiao, L., Lewis, P., Gibb, A.: Developing a Security Protocol for a Distributed Decision Support System in a Healthcare Environment. In: 30th International Conference on Software Engineering, pp. 673–682. ACM, New York (2008) A Yellow Page Agent contains a list of trusted principals, which a principal will be verified by Jade Security Service Agent against their access levels (0-9) if a resource or service is requested by the principal. The functional and security requirements can be maintained separately, and the functionality and security are integrated to perform a particular role.

Access Sensibility Level “0. Update a private patient record: often only available to the patient’s principle physician.” “1. Read a private patient record: also available to the producers of specific classifiers.” “2. Read a public anonymised patient record: available to classifier producers and under agreements to other hospitals in the HealthAgents network.” “3. Create a classifier: available to specific experienced clinicians with sufficient power who may allow the classifier producers to access required anonymised data and later set the publicity of the classifier.” “4. Update a classifier reputation: available to experienced clinicians who have executed that classifier upon a case and the accurate diagnosis result is known to them at that moment.” “5. Execute a local classifier: often available to local hospitals.” “6. Execute a global classifier: available to all hospitals in the HealthAgents network.” “7. Invoke a system service (Yellow Pages, etc.): may open even to hospitals outside of the HealthAgents network, this allows them to gain better knowledge of the available resources inside the network so they may want to join in later.” This list of access sensibility level is cited from Xiao, L., Lewis, P., Gibb, A.: Developing a Security Protocol for a Distributed Decision Support System in a Healthcare Environment. In: 30th International Conference on Software Engineering, pp. 673–682. ACM, New York (2008)

The Secure Messages Figure 6 from Xiao, L., Lewis, P., Gibb, A.: Developing a Security Protocol for a Distributed Decision Support System in a Healthcare Environment. In: 30th International Conference on Software Engineering, pp. 673–682. ACM, New York (2008) The handleMessage() in the HealthAgent sends or recieves message using the methods in JadeMessagingService, and the JadeSecurityService would encrypt or decrypt the message. The protocol compacting the message is Lightweight Coordination Calculus. A message sent has to be signed and encrypted by a sender from the trust list or will be deleted. The Jade Security Service Agent provide services to both Yellow Page Agent and the Jade Security Service class.

Authentication & Authorisation Figure 7 from Xiao, L., Lewis, P., Gibb, A.: Developing a Security Protocol for a Distributed Decision Support System in a Healthcare Environment. In: 30th International Conference on Software Engineering, pp. 673–682. ACM, New York (2008) The secure message passing is meaningless without authenticating the senders and receivers, and a LoginModule prompts for a username and a password to identify the principal. The agent interaction model describes the following scenario: a clinician created a classifier as no existing classifier is available, and the clinician evaluate the result given by the new classifier. After the diagnoisis is confirmed, the clinician then updates the patient record and the rank of the classifier.

Reviews Strengths Conformance to UK Data Protection Act An architecture allowing the addition of new classifiers. Training classifiers with anonymised data Introduction of resource access levels The use of local and global access policy Private records only available for local access

Reviews Shortcomings A patient’s case data used to train a classifier, and that classifier is not updated when that patient requests to remove his or her data. Section 5.5 and Figure 5 are missing.

Reference Xiao, L., Lewis, P., Gibb, A.: Developing a Security Protocol for a Distributed Decision Support System in a Healthcare Environment. In: 30th International Conference on Software Engineering, pp. 673–682. ACM, New York (2008)