SECURING MEDICAL SAAS SOLUTIONS USING A NOVEL END-TO-END ENCRYPTION PROTOCOL

E-Health solutions using the Internet provide many benefits for health centers; hosting such solutions in public Cloud Computing environments as Software-as-a-Service becomes increasingly popular. However, the deployment of e-health services in shared environments is restricted du to regulations prohibiting medical data access by illegitimate parties, such as cloud computing intermediaries. A pivotal requirement is therefore having security end-to-end , namely from a user agent to the server process; yet there is no viable approach for contemporary browser-based SaaS solutions. This paper outlines a bluprint for e-health solution architectures featuring an end-to-end security mechanism to prevent intermediary data access and therefore to ensure appropriate patient data privacy and security. This bluprint is instantiated based on a novel security protocol, the Trusted Cloud Transfer Protocol (TCTP) in the form of a prototype implementation. The evaluation of the prototype demonstrates its fulfilment of healthcare-specific security and privacy requirements, as well as low implementation efforts for similar architectures, and no measurable performance overhead in a practical benchmark