Publication: Securing Healthcare Domains and Empowering Patients Through Decentralized and Self-Sovereign Identity Technologies
Loading...
Date
2026-04-16
Authors
López Martínez, Antonio
item.page.secondaryauthor
Escuela Internacional de Doctorado
item.page.director
Gil Pérez, Manuel ; Ruiz Martínez, Antonio
Publisher
Universidad de Murcia
publication.page.editor
publication.page.department
DOI
item.page.type
info:eu-repo/semantics/doctoralThesis
Description
Abstract
El sector sanitario, se encuentra actualmente en una encrucijada entre la innovación y la vulnerabilidad. Gestionar datos personales sensibles y proteger vidas humanas lo convierte en un objetivo para los ciberataques, enfrentando costes por incidente de seguridad más altos que en otros sectores. Al mismo tiempo, se están estudiando nuevas tecnologías como Machine Learning y Blockchain para mejorar la atención al paciente y optimizar procesos. Sin embargo, la transición hacia un sistema sanitario impulsado digitalmente sigue obstaculizada por desafíos persistentes: resistencia al cambio, marcos regulatorios estrictos y limitaciones presupuestarias.
Además, la falta de mapeos estandarizados para el diverso ecosistema de actores genera ambigüedad y deja expuestas brechas en las defensas de seguridad. Los paradigmas actuales, como la centralización, amplifican estos riesgos al crear puntos únicos de fallo. Mientras tanto, los intentos de descentralización en ciertos países han dado lugar a registros fragmentados y a una accesibilidad comprometida del paciente entre regiones o proveedores. Como respuesta, el modelo de Identidad Autosoberana (SSI) surge como un enfoque prometedor, que empodera a los pacientes para controlar sus datos mediante identificadores descentralizados y credenciales criptográficamente seguras, con el potencial de mejorar la seguridad de los datos en el ámbito sanitario.
Bajo la modalidad de compendio, los cuatro capítulos que componen esta tesis doctoral (tres publicados y uno en revisión) abordan el objetivo de analizar la seguridad y la privacidad en el dominio sanitario y proponen un marco de gestión de datos centrado en el paciente. Para ello, en primer lugar, se realizó una revisión de la literatura sobre problemas de seguridad y privacidad en el sector, abordando los actores y componentes del sistema de salud, los principales ciberataques con una propuesta de taxonomía, las líneas de investigación actuales sobre mecanismos de seguridad, los conjuntos de datasets y los retos que orientan el desarrollo de esta tesis. En segundo lugar, se definió un caso de uso clínico, analizando los protocolos, componentes, tipos de datos y el desarrollo de requisitos de seguridad y privacidad para protegerlo. Además, se propusieron mecanismos seguros en función de la criticidad de los datos gestionados en cada requisito.
El tercer capítulo definió un framework SSI para los datos del paciente, implementando una wallet en el dispositivo del paciente y tecnología blockchain como fuente de confianza y registro verificable de datos, permitiendo el intercambio seguro de datos clínicos gracias a las Credenciales Verificables (VCs). En cuarto lugar, el framework SSI inicial se amplió para proponer un modelo de control de acceso. A partir del análisis de los participantes del sistema sanitario y tres casos de uso distintos, se definió la composición de una Historia Clínica Electrónica (EHR). Uniendo participantes sanitarios con EHR, se presenta el modelo de control de acceso, aprovechando la tecnología de Smart Contracts (SCs). En este caso, se realizó una evaluación para obtener resultados sobre la viabilidad de la propuesta a nivel nacional. Extrayendo los datos de España sobre la frecuencia de visitas al sistema sanitario y considerando la cantidad de interacciones con nuestro framework, concluimos que podría implementarse para satisfacer las necesidades de gestión de datos sanitarios de un país.
No obstante, algunos aspectos de esta investigación permanecen sin resolver. Entre ellos destaca la inclusión de un agente de privacidad impulsado por IA en el framework SSI, integrado en la wallet del paciente para actuar como recomendador en el intercambio de datos con distintos actores del sistema de salud, así como asistente personal en el día a día.
The healthcare sector, vital for societal well-being, currently finds itself at the crossroads of innovation and vulnerability. Its unique responsibility, handling sensitive personal data and safeguarding human lives, makes it an attractive target for cyberattacks, experiencing substantially higher costs per security incident compared to other industries. Simultaneously, new technologies such as Machine Learning, Tactile Internet, and Blockchain are being studied to improve patient care and optimize processes. However, the transition towards a digitally driven healthcare system remains hindered by persistent challenges: resistance to change, stringent regulatory landscapes, and tight budget constraints. Moreover, healthcare’s internal complexity compounds its security challenges. A lack of standardized mappings for the diverse ecosystem of actors creates ambiguity and exposes gaps in security defenses. Current paradigms, such as centralized data management, amplify these risks by creating single points of failure. Meanwhile, attempts at decentralization in certain countries have led to fragmented records and compromised patient accessibility across regions or providers. In response to these multifaceted challenges, the Self-Sovereign Identity (SSI) model emerges as a promising approach, empowering patients to control their data through decentralized identifiers and cryptographically secure credentials, potentially revolutionizing healthcare data management and security. Under the compendium modality, the four chapters composing this PhD dissertation (three published and one under review) embraces the objective of analyzing security and privacy in healthcare domain and propose a patient-centered data management framework. For that, firstly, a comprehensive literature review on security and privacy issues in healthcare was conducted, reporting on the healthcare actors and components, the main cyberattacks with a taxonomy definition, the current research lines on security mechanisms, public datasets, and challenges that set the direction for this thesis. Secondly, a clinical use case belonging to the healthcare domain was defined, analyzing the clinical protocols, components, types of data, and the development of security and privacy requirements to protect and secure the use case. Moreover, secure mechanisms were proposed regarding the criticality of the data managed in each requirement. The third chapter defines an SSI framework for patient data, implementing a personal wallet in the patient device and blockchain technology as a source of trust and verifiable data registry, allowing the secure exchange of clinical data thanks to Verifiable Credentials (VCs). Fourthly, the initial SSI framework was expanded to propose an access control model. With the analysis of the healthcare participants and three different use cases, the definition of the parts that compose an Electronic Health Record (EHR) was conducted. Joining the healthcare participants and the EHR, the access control model was presented and introduced into the SSI framework, leveraging Smart Contracts (SCs) technology. In this case, a comprehensive evaluation was performed to obtain rigorous results about the inclusion of the SSI framework and the access control model in a country-level domain. Extracting the numbers from Spain regarding the frequency of visits to the healthcare environment, the quantity of interactions with our framework was considered, and specific tests are conducted to conclude that the access control model could be implemented to satisfy the needs of healthcare data management of a country. Nevertheless, some aspects of this research remain unsolved, so further effort is still required. Prime among them is the inclusion of an AI-powered privacy agent in the SSI framework, which incorporates it into the patient wallet to act as a recommender in the exchange of data with various healthcare actors, as well as a daily personal assistant.
The healthcare sector, vital for societal well-being, currently finds itself at the crossroads of innovation and vulnerability. Its unique responsibility, handling sensitive personal data and safeguarding human lives, makes it an attractive target for cyberattacks, experiencing substantially higher costs per security incident compared to other industries. Simultaneously, new technologies such as Machine Learning, Tactile Internet, and Blockchain are being studied to improve patient care and optimize processes. However, the transition towards a digitally driven healthcare system remains hindered by persistent challenges: resistance to change, stringent regulatory landscapes, and tight budget constraints. Moreover, healthcare’s internal complexity compounds its security challenges. A lack of standardized mappings for the diverse ecosystem of actors creates ambiguity and exposes gaps in security defenses. Current paradigms, such as centralized data management, amplify these risks by creating single points of failure. Meanwhile, attempts at decentralization in certain countries have led to fragmented records and compromised patient accessibility across regions or providers. In response to these multifaceted challenges, the Self-Sovereign Identity (SSI) model emerges as a promising approach, empowering patients to control their data through decentralized identifiers and cryptographically secure credentials, potentially revolutionizing healthcare data management and security. Under the compendium modality, the four chapters composing this PhD dissertation (three published and one under review) embraces the objective of analyzing security and privacy in healthcare domain and propose a patient-centered data management framework. For that, firstly, a comprehensive literature review on security and privacy issues in healthcare was conducted, reporting on the healthcare actors and components, the main cyberattacks with a taxonomy definition, the current research lines on security mechanisms, public datasets, and challenges that set the direction for this thesis. Secondly, a clinical use case belonging to the healthcare domain was defined, analyzing the clinical protocols, components, types of data, and the development of security and privacy requirements to protect and secure the use case. Moreover, secure mechanisms were proposed regarding the criticality of the data managed in each requirement. The third chapter defines an SSI framework for patient data, implementing a personal wallet in the patient device and blockchain technology as a source of trust and verifiable data registry, allowing the secure exchange of clinical data thanks to Verifiable Credentials (VCs). Fourthly, the initial SSI framework was expanded to propose an access control model. With the analysis of the healthcare participants and three different use cases, the definition of the parts that compose an Electronic Health Record (EHR) was conducted. Joining the healthcare participants and the EHR, the access control model was presented and introduced into the SSI framework, leveraging Smart Contracts (SCs) technology. In this case, a comprehensive evaluation was performed to obtain rigorous results about the inclusion of the SSI framework and the access control model in a country-level domain. Extracting the numbers from Spain regarding the frequency of visits to the healthcare environment, the quantity of interactions with our framework was considered, and specific tests are conducted to conclude that the access control model could be implemented to satisfy the needs of healthcare data management of a country. Nevertheless, some aspects of this research remain unsolved, so further effort is still required. Prime among them is the inclusion of an AI-powered privacy agent in the SSI framework, which incorporates it into the patient wallet to act as a recommender in the exchange of data with various healthcare actors, as well as a daily personal assistant.
publication.page.subject
Citation
item.page.embargo
Collections
Ir a Estadísticas
Este ítem está sujeto a una licencia Creative Commons. http://creativecommons.org/licenses/by-nc-nd/4.0/