Medical Data with Trust (Reapplying Capability Architectures to Secure Crucial IT Systems)
*This paper was originally written as the author’s Master’s Thesis at Keio University 2024.
Description
This thesis explores the application of capability-based systems to enhance security in crucial IT systems, with the focus on the medical industry. Current conventional systems are built around the notion of data transit, face significant challenges in guar-anteeing robust security, especially in environments where data confidentiality and compliance with regulatory frameworks like HIPAA are critical. These system often lack the mechanisms to enforce fine-grained access control and policy alignment when data is shared. Capability-based systems offer a promising alternative by encapsulating access rights with data, enabling fine-grained, resource-specific control. This mechanism ensures that policies defined by the data owner are enforced, even when the data is shared across systems. Additionally, capabilities support crucial policies such as Principle of Least Privilege (POLP), aligning with security needs and regulatory requirements. The thesis evaluates the effectiveness of capability-based systems in addressing key metrics such as confidentiality, integrity, compliance, and access control, comparing them to conventional mechanisms like Role-Based Access Control (RBAC). Through detailed analysis and used case scenarios in medical environments, the research demonstrates that capability-based systems can significantly enhance security in our interconnected digital landscape, offering a more robust solution to modern security challenges.