PDaSP Track 2: Secure Analytics over Federated Environments for Biomedical Science (SAFE-Bio)

Award ID: 2628738

Biomedical research increasingly depends on combining sensitive health information held by many different hospitals and universities. Doctors and scientists could make faster progress against disease if they were able to analyze large collections of patient data together, but this information is private and legally protected, and institutions are often unable to share it because doing so risks exposing personal details. A central difficulty is that even if data are "locked" and protected when they are stored or sent across a network, they need be "unlocked" inside a computer's memory in order to be analyzed, which creates a point of vulnerability. This project is building a software system to allow computers to analyze such sensitive information while it stays locked and hidden, even from computer system administrators who may have direct access to the computing systems. The aim is to let different institutions work together on shared scientific questions without ever revealing private data. Success of such a system would enable researchers to collaborate in areas involving sensitive data, such as genetics, personalized treatment, and public health, while protecting the privacy of the individuals whose information makes those advances possible. The benefits reach beyond medicine to any setting in which organizations need to cooperate on confidential information that they cannot otherwise share freely. This project is developing and validating a framework called SAFE-Bio: Secure Analytics over Federated Environments for Biomedical research, which applies confidential computing to secure, collaborative analysis across independent institutions. Confidential computing relies on hardware isolated enclaves that keep data encrypted even while they are being processed, so that the information remains inaccessible to system administrators and to other software running on the same machine. The framework provides a portable middleware layer that hides the differences among competing hardware platforms, allowing both new and legacy analytical applications to be moved onto the secure environment with little modification. The technical work is organized into research and development, testing and evaluation, and a pathway toward broader adoption. Central contributions include a certifier component for transparent deployment of confidential hardware, a chain of trust architecture that attests to the integrity of the full software stack, a curated operating system and container environment for general purpose applications, and security orchestration that extends confidential guarantees across distributed federated workflows. The framework is evaluated through realistic biomedical scenarios that involve distributed genomic datasets and analytics driven by artificial intelligence (AI), using established community testbeds and measurement methods to quantify security, performance, and the runtime overhead introduced by enclave based execution. The team of researchers spans the University of Virginia, Datica Research, the University of Southern California, and the National Institute of Standards and Technology, combining expertise in cybersecurity, distributed systems, biomedical informatics, and standards development. The project contributes reusable architectures, middleware, evaluation methods, and deployment guidance that lower barriers to secure collaboration, together with training opportunities for postdoctoral researchers and research computing professionals. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

NSF Program Director: Jemin George