Submitted by PPG Direito (ppgdir@pucrs.br) on 2018-10-05T12:52:39Z No. of bitstreams: 1 Clarissa_Lopes_ Bellarmino_Tes.pdf: 1858165 bytes, checksum: f3c9f1535f426f30e77001036a4fc860 (MD5) / Approved for entry into archive by Sheila Dias (sheila.dias@pucrs.br) on 2018-10-08T12:22:57Z (GMT) No. of bitstreams: 1 Clarissa_Lopes_ Bellarmino_Tes.pdf: 1858165 bytes, checksum: f3c9f1535f426f30e77001036a4fc860 (MD5) / Made available in DSpace on 2018-10-08T12:34:27Z (GMT). No. of bitstreams: 1 Clarissa_Lopes_ Bellarmino_Tes.pdf: 1858165 bytes, checksum: f3c9f1535f426f30e77001036a4fc860 (MD5) Previous issue date: 2018-08-22 / Scientific research involving human beings, carried out in the biomedical and genetic areas, generates data from activities developed in biobank, among which genetic data, which should be protected not only in the ethical scope, but also in the legal sphere. Genetic data are information related to hereditary characteristics obtained from samples of human biological sources (eg: cells, hair, tissues, blood, bone, tumors and organs, among other materials derived from human body). These samples can be stored, processed and accessed on biobank - nonprofit structure, organized and systematized in universities and research institutions that provides technologies and/or equipment necessary for scientific investigation. The purpose of this study is to verify whether current Brazilian regulation is sufficient or not regarding the ethical-legal protection of human genetic data in biobank activities, considering the rights of the participants, as far as safeguarding their personal data and to sensitive data, fundamentals of genetic identify. Genetic identify understood as the projection of personal identify. In view of this, it is essential to review the national literature in the light of the constitutional principle of human dignity and fundamental rights, such as the right to life, health, intimacy, privacy and the free development of personality. In turn, a review and analysis of current Brazilian legislation, as well as the identification of guidelines, recommendations and international regulations, are constructs that support and contribute to the understanding of the relevance and pertinence of the subject of personal data protection, particularly human genetic data, demanding the legal support from the principles of the democratic State based on the rule of law. Finally, it is concluded that the protection of human genetic data in biobank activities is deserving of specific legislation, which includes measures of coherence in case of violation of the principle of human dignity and of the fundamental rights implied, that guarantees the integrity of the participant of the research and their personal rights, that imposes to the researchers, the participants, the research institutions and universities and the State, the duties and limits of action in relation to human life and health. Therefore, a specific infraconstitutional legislation, effective in the legal and effective protection in its implementation. / Las investigaciones cient?ficas que involucran seres humanos, realizadas en las ?reas biom?dica y gen?tica, generan datos a partir de actividades desarrolladas en biobanco - entre los cuales datos gen?ticos - debiendo los mismos ser protegidos, no s?lo en el ?mbito ?tico, sino tambi?n en el ?mbito jur?dico. Los datos gen?ticos son informaciones sobre las caracter?sticas hereditarias obtenidas de muestras de material biol?gico humano (por ejemplo, c?lulas, pelo, tejidos, sangre, huesos, tumores y ?rganos, entre otros ejemplares derivados del cuerpo humano). Estas muestras pueden ser almacenadas, procesadas y accesadas en biobanco - estructura sin fines de lucro, organizada y sistematizada en universidades e instituciones de investigaci?n que ofrece tecnolog?as y / o recursos necesarios para la investigaci?n cient?fica. El prop?sito de este estudio es verificar si la regulaci?n brasile?a actual es suficiente - o no - cuanto a la protecci?n ?tico-jur?dica de los datos gen?ticos humanos en actividades de biobanco, garantizando los derechos de los participantes, con la salvaguardia de sus datos personales y datos sensibles, fundamentales para la identidad gen?tica. Identidad gen?tica entendida como proyecci?n de la identidad personal. En este prisma, es imprescindible una revisi?n de la literatura nacional, a la luz del principio constitucional de la dignidad humana y de los derechos fundamentales, tales como el derecho a la vida, a la salud, a la intimidad, a la privacidad y al libre desarrollo de la personalidad. Por su parte, una revisi?n y an?lisis de la legislaci?n brasile?a actual, as? como la identificaci?n de directrices, recomendaciones y regulaciones internacionales, son constructos que fundamentan y contribuyen a la comprensi?n de la relevancia y pertenencia de la tem?tica acerca de la protecci?n de datos personales, particularmente datos gen?ticos humanos, lo que exije del Estado Democr?tico de Derecho el debido apoyo legal. Por ?ltimo, se concluye que la protecci?n de los datos gen?ticos humanos en las actividades de biobanco est? merced a una legislaci?n espec?fica, que contemple medidas de cohesi?n para el caso de afrenta al principio de la dignidad humana y de los derechos fundamentales implicados, que garantice la integridad del producto, que participa en la investigaci?n y sus derechos personales, que imponga a los investigadores, a los participantes, a las instituciones de investigaci?n y universidades y al Estado, los deberes y l?mites de actuaci?n en relaci?n con la vida humana y la salud. Por lo tanto, una legislaci?n infraconstitucional espec?fica, eficaz en la protecci?n jur?dica y efectiva en su implementaci?n. / As pesquisas cient?ficas envolvendo seres humanos, realizadas nas ?reas biom?dica e gen?tica, geram dados a partir de atividades desenvolvidas em biobanco, dentre os quais dados gen?ticos, devendo os mesmos serem protegidos, n?o apenas no ?mbito ?tico, como tamb?m no ?mbito jur?dico. Dados gen?ticos s?o informa??es referentes ?s caracter?sticas heredit?rias obtidas de amostras de material biol?gico humano (por exemplo: c?lulas, cabelo, tecidos, sangue, ossos, tumores e ?rg?os, entre outros exemplares derivados do corpo humano). Essas amostras podem ser armazenadas, processadas e acessadas em biobanco - estrutura sem fins lucrativos, organizada e sistematizada em universidades e institui??es de pesquisa que oferece tecnologias e/ou equipamentos necess?rios ? pesquisa cient?fica. O prop?sito deste estudo ? verificar se a regula??o brasileira atual ? suficiente ou n?o quanto ? prote??o ?tico-jur?dica dos dados gen?ticos humanos em atividades de biobanco, considerando os direitos dos participantes, na medida da salvaguarda dos seus dados pessoais e dados sens?veis, fundamentos da identidade gen?tica. Identidade gen?tica entendida como proje??o da identidade pessoal. Sob este prisma, ? imprescind?vel uma revis?o da literatura nacional e internacional, ? luz de princ?pio constitucional da dignidade humana e dos direitos fundamentais, tais como o direito ? vida, ? sa?de, ? intimidade, ? privacidade e ao livre desenvolvimento da personalidade. Por sua vez, uma revis?o e an?lise da legisla??o brasileira atual, assim como a identifica??o de diretrizes, recomenda??es e regulamenta??es internacionais, s?o construtos que fundamentam e contribuem para a compreens?o da relev?ncia e pertin?ncia da tem?tica da prote??o de dados pessoais, particularmente dados gen?ticos humanos, exigindo do Estado Democr?tico de Direito o devido respaldo legal. Por fim, conclui-se que a prote??o dos dados gen?ticos humanos em atividades de biobanco est? a merecer uma legisla??o espec?fica, que contemple medidas de coers?o para o caso de afronta ao princ?pio da dignidade humana e dos direitos fundamentais implicados, que garanta a integridade do participante da pesquisa e seus direitos pessoais, que imponha aos pesquisadores, aos participantes, ?s institui??es de pesquisa e universidades e ao Estado, os deveres e limites de atua??o em rela??o vida humana e ? sa?de. Portanto, uma legisla??o infraconstitucional espec?fica, eficaz na prote??o jur?dica e efetiva na sua implementa??o.

As modern technology continues to affect civilization, the issue of electronic rights grows in a global conversation. The right to be forgotten is a data protection regulation specific to the European Union but its consequences are creating an international stir in the fields of mass communication and law. Freedom of expression and privacy rights are both founding values of the United States which are protected by constitutional amendments written before the internet also changed those fields. In a study that analyzes the legal process of when these two fundamental values collide, this research offers insight into both personal and judicial views of informational priority. This thesis conducts a legal analysis of cases that cite the infamous precedents of Melvin v. Reid and Sidis v. F-R Pub. Corp., to examine the factors on which U.S. courts of law determinewhether freedom or privacy rules.

La question de la protection et de la valorisation des données de santé fait l’objet d’un renouvellement permanent car elle est tiraillée pas des intérêts contradictoires. Les logiques juridiques, sanitaires et économiques s’affrontent et s’expriment au travers d’une règlementation particulièrement fournie et disparate des données de santé. Le droit de propriété semble à même de concilier ces enjeux d’apparence antinomiques. Au regard de la place de ce droit dans notre ordonnancement juridique et de la singularité des données de santé, l’étude de leur rapprochement mérite une étude d’une certaine ampleur. Il s’agit dans un premier temps de s’assurer de la compatibilité de ce droit avec les données de santé. La réponse impose une vision de la propriété simplifiée pour finalement constater que les droits existants sur ces données sont en fait déjà des droits de propriétés mais qui, du fait de la particularité des données de santé, sont largement limités. Dans un second temps, se pose donc la question de la pertinence de l’application d’un droit de propriété plus « complet » aux données de santé. Or, on remarque que la spécificité de ces données est telle que cette solution n’est pas la plus efficace pour parvenir à un juste équilibre entre patients et collecteurs de données. Pour autant, d’autres solutions sont possibles. / The question of the protection and enhancement of health data is subject to a permanent renewal because it appears to be in the middle of some conflicting interests. Legal, health and economic logics confront and express themselves through a particularly heterogenous set of regulations on health data. Property rights here seem able to reconcile these issues that first look contradictory appearance issues. Given the place of this right in our legal system and uniqueness of health data, the study of their reconciliation deserves a study of some magnitude. This is a first step to ensure the compatibility of this law with health data. The answer requires a vision of simplified property only to find that the existing rights of the data is already in the property rights but which, because of the particularity of health data, are largely limited. Secondly, therefore the question of the relevance of the application of "more complete" property rights applies to health data. However, we note that the specificity of health data implies that such a the solution is not the most effective for achieving a fair balance between patients and data collectors. Nevertheless, other solutions are possible.

No description available.

University of Macau / Faculty of Law

University of Macau / Faculty of Science and Technology / Department of Computer and Information Science

The application of higher-order PDA-based flow analyses to object-oriented languages enables comprehensive and precise characterization of program behavior, while retaining practicality with efficiency. We implement one such flow analysis which we've named OOCFA2. While over the years many advancements in flow analysis have been made, they have almost exclusively been with respect to functional languages, often modeled with the calculus. Object-oriented semantics--while also able to be modeled in a functional setting--provide certain structural guarantees and common idioms which we believe are valuable to reason over in a first-class manner. By tailoring modern, advanced flow analyses to object-oriented semantics, we believe it is possible to achieve greater precision and efficiency than could be had using a functional modeling. This, in turn, reflects upon the possible classes of higher-level analyses using the underlying flow analysis: the more powerful, efficient, and flexible the flow analysis, the more classes of higher-level analyses--e.g., security analyses--can be practically expressed. The growing trend is that smartphone and mobile-device (e.g., tablet) users are integrating these devices into their lives, in more frequent and more personal ways. Accordingly, the primary application and proof-of-concept for this work is the analysis of the Android operating system's permissions-based security system vis--vis potentially malicious applications. It is implemented atop OOCFA2. The use of a such a powerful higher-order flow analysis allows one to apply its knowledge to create a wide variety of powerful and practical security-analysis "front-ends"--not only the permissions-checking analysis in this work, but also, e.g., information-flow analyses. OOCFA2 is the first PDA-based higher-order flow analysis in an object-oriented setting. We empirically evaluate its accuracy and performance to prove its practical viability. We also evaluate the proof-of-concept security analysis' accuracy as directly related to OOCFA2; this shows promising results for the potential of building security-oriented "front-ends" atop OOCFA2.

With continued advances in computing, the amount of digital data continues to grow at an astounding rate. This has strained enterprise infrastructures and triggered development of service oriented architectures. In recent years, storage has also begun its transformation into a class of service. By outsourcing storage to an external storage service provider (SSP), enterprises not only cut management cost but also obtain on-demand infrastructure with superior disaster recovery and content dissemination capabilities. Wide deployment of this new outsourced storage environment requires solutions to many challenging problems. The foremost is the development of usable security and access control mechanisms that provide desirable levels of data confidentiality without placing an inordinate amount of trust into the SSP. This absence of a trusted reference monitor is a fundamental departure from traditional mechanisms and new solutions are required. The second important challenge is the autonomic management of SSP's infrastructure, uniquely characterized by a highly dynamic workload with large data capacity requirements. This dissertation research proposes models and techniques to address these two challenges. First, we introduce a novel access control system called xACCESS that uses cryptographic access control primitives (CAPs) to "embed" access control into stored data. This eliminates any dependency on the SSP for enforcement of security policies. We also analyze the privacy characteristics of its data sharing mechanisms and propose enhancements for more secure and convenient data sharing. We also develop a secure multiuser search approach that permits hosting of secured search indices at untrusted SSPs. We introduce a novel access control barrel (ACB) primitive that embeds access control into indices to prevent unauthorized information extraction during search. Our contribution to the autonomic SSP storage management has two important highlights. First, we have developed an impact analysis engine that efficiently analyzes the impact of a client-initiated change (workload surge, storage growth) on the SSP storage area network with minimal administrator involvement. Second, we have designed a new algorithm to quickly perform reallocation of resources in order to efficiently integrate the client change.

Fault tolerant and secure distributed data storage systems typically require that only up to a threshold of storage nodes can ever be compromised or fail. In proactively-secure systems, this requirement is modified to hold only in a time interval (also called epoch), resulting in increased security. An attacker or adversary could compromise distinct sets of nodes in any two time intervals. This attack model is also called the mobile adversary model. Proactively-secure systems require all nodes to "refresh" themselves periodically to a clean state to maintain the availability, integrity, and confidentiality properties of the data storage service. This dissertation investigates the design of a proactively-secure distributed data storage system. Data can be stored at storage servers using encoding schemes called secret sharing, or encryption-with-replication. The primary challenge is that the protocols that the servers run periodically to maintain integrity and confidentiality must scale with large amounts of stored data. Determining how much data can be proactively-secured in practical settings is an important objective of this dissertation. The protocol for maintain the confidentiality of stored data is developed in the context of data storage using secret sharing. We propose a new technique called the GridSharing framework that uses a combination of XOR secret sharing and replication for storing data efficiently. We experimentally show that the algorithm can secure several hundred GBs of data. We give distributed protocols run periodically by the servers for maintaining the integrity of replicated data under the mobile adversary model. This protocol is integrated into a document repository to make it proactively-secure. The proactively-secure document repository is implemented and evaluated on the Emulab cluster (http://www.emulab.net). The experimental evaluation shows that several 100 GBs of data can be proactively-secured. This dissertation also includes work on fault and intrusion detection - a necessary component in any secure system. We give a novel Byzantine-fault detection algorithm for quorum systems, and experimentally evaluate its performance using simulations and by deploying it in the AgileFS distributed file system.

Personal information, especially certified personal information, can be very valuable to its subject, but it can also be abused by other parties for identify theft, blackmail, fraud, and more. One partial solution to the problem is credentials, whereby personal information is tied to identity, for example by a photo or signature on a physical credential. We present an efficient scheme for large, redactable, digital credentials that allow certified personal attributes to safely be used to provide identification. A novel method is provided for combining credentials, even when they were originally issued by different authorities. Compared to other redactable digital credential schemes, the proposed scheme is approximately two orders of magnitude faster, due to aiming for auditability over anonymity. In order to expand this scheme to hold other records, medical records for example, we present a method for efficient signatures on redactable data where there are dependencies between different pieces of data. Positive results are shown using both artificial datasets and a dataset derived from a Linux package manager. Electronic credentials must of course be held in a physical device with electronic memory. To hedge against the loss or compromise of the physical device holding a user's credentials, the credentials may be split up. An architecture is developed and prototyped for using split-up credentials, with part of the credentials held by a network attached agent. This architecture is generalized into a framework for running identity agents with various capabilities. Finally, a system for securely sharing medical records is built upon the generalized agent framework. The medical records are optionally stored using the redactable digital credentials, for source verifiability.