Systems and methods for protecting and governing genomic and other information

• US 10,621,550 B2
• Filed: 10/17/2012
• Issued: 04/14/2020
• Est. Priority Date: 10/17/2011
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Carey, W. Knox, Maher, David P., Manente, Michael G., Nilsson, Jarl, Shamoon, Talal G.
• Primary Examiner(s): Tiedeman, Jason S
• Application Number:
  US13/654,349
• Publication Number:
  US 20130096943A1
• Time in Patent Office: 2,736 Days
• Field of Search: 705 2, 705 3
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G16B 50/00 ICT programming tools or database systems specially adapted for bioinformatics
• CPC Class Codes: G16B 50/30 Data warehousing; Computing architectures
• CPC Class Codes: G16B 50/40 Encryption of genetic data
• CPC Class Codes: G16H 10/40 for data related to laboratory analysis, e.g. patient specimen analysis
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

Trusted, privacy-protected systems and method are disclosed for processing, handling, and performing tests on human genomic and other information. According to some embodiments, a system is disclosed that is a cloud-based system for the trusted storage and analysis of genetic and other information. Some embodiments of the system may include or support some or all of authenticated and certified data sources; authenticated and certified diagnostic tests; and policy-based access to data.

Claims

1. A trusted data analysis platform for performing computations on genomic data comprising:

a processor and a memory containing instructions that when executed by the processor cause a trusted data analysis platform including a plurality of virtual diagnostic tests to perform operations comprising;

receiving, from a requestor system, a request to execute a virtual diagnostic test on the trusted data analysis platform, the virtual diagnostic test comprising a test algorithm for testing genomic data, an input specification governing types and/or characteristics of data input to the virtual diagnostic test, and a set of one or more digital signatures;

identifying, by the trusted data analysis platform, at least one sequence data object based on the request;

verifying an authorization of the virtual diagnostic test to access the at least one sequence data object according to permissions associated with the at least one sequence data object and determining that the at least one sequence data object satisfies the input specification;

authenticating the virtual diagnostic test using at least one digital signature from the set of one or more digital signatures;

executing the test algorithm, by the trusted data analysis platform in a secure execution environment, using the at least one sequence data object, to generate a test algorithm output; and

providing, to the requestor system, the test algorithm output.

2. The platform of claim 1, wherein the virtual diagnostic test further comprises an output specification describing a format of the test algorithm output.

3. The platform of claim 1, wherein the virtual diagnostic test further comprises a workflow specification and at least a second computer program, and wherein an order of execution of the test algorithm and the second computer program, and inputs and outputs of the test algorithm and the second computer program are specified by the workflow specification.

4. The platform of claim 1, wherein the at least one digital signature includes a creator signature of a creator of the virtual diagnostic test, and authenticating the virtual diagnostic test further comprises:

verifying the creator of the virtual diagnostic test using the creator signature,

verifying a requestor of the virtual diagnostic test using a requestor signature of the requestor of the virtual diagnostic test, and

determining that the virtual diagnostic test satisfies the permissions, based on the creator of the virtual diagnostic test and the requestor of the virtual diagnostic test.

5. The platform of claim 1, wherein the at least one sequence data object comprises a laboratory signature and a device signature, and wherein the operations further comprise verifying a laboratory associated with the at least one sequence data object based on the laboratory signature and verifying a device associated with the at least one sequence data object based on the device signature, and wherein the determination that the at least one sequence data object satisfies the input specification further depends on the laboratory and the device.

6. The platform of claim 1, wherein the at least one sequence data object comprises an analyzer sequence, and wherein the determination that the at least one sequence data object satisfies the input specification depends on a quality characteristic of the analyzer sequence.

7. The platform of claim 1, wherein the at least one sequence data object comprises an analyzer sequence, and wherein the determination that the at least one sequence data object satisfies the input specification depends on a chain-of-handling characteristic of the analyzer sequence.

8. The platform of claim 1, wherein the operations further comprise storing an audit record comprising a hash of the at least one sequence data object, the virtual diagnostic test, and the test algorithm output.

9. The platform of claim 1, wherein at least one link object associates a customer account with the at least one sequence data object.

10. The platform of claim 9, wherein executing the virtual diagnostic test comprises indirectly accessing the at least one sequence data object associated with the customer account using the at least one link object according to a permissions framework.

11. The platform of claim 1, wherein the request indicates the at least one sequence data object.

12. The platform of claim 1, wherein the request comprises a predicate, and wherein the trusted data analysis platform identifies the at least one sequence data object based on the predicate.

13. A computer-implemented method for performing trusted computations on human genomic data, the method comprising:

receiving, by a trusted data analysis platform including a plurality of virtual diagnostic tests from a requestor system, a request to execute a virtual diagnostic test on the trusted data analysis platform, the virtual diagnostic test comprising a test algorithm for testing genomic data, an input specification governing types and/or characteristics of data input to the virtual diagnostic test, and a set of one or more digital signatures;

identifying, by the trusted data analysis platform, at least one sequence data object based on the request;

verifying an authorization of the virtual diagnostic test to access the at least one sequence data object according to permissions associated with the at least one sequence data object and determining that the at least one sequence data object satisfies the input specification;

authenticating the virtual diagnostic test using at least one digital signature from the set of one or more digital signatures;

executing the test algorithm, by the trusted data analysis platform in a secure execution environment, using the at least one sequence data object, to generate a test algorithm output; and

providing, from the trusted data analysis platform to the requestor system, the test algorithm output.

14. The computer-implemented method of claim 13, wherein the virtual diagnostic test further comprises an output specification describing a format of the test algorithm output.

15. The computer-implemented method of claim 13, wherein the virtual diagnostic test further comprises a workflow specification and at least a second computer program, and wherein an order of execution of the test algorithm and the second computer program, and inputs and outputs of the test algorithm and the second computer program are specified by the workflow specification.

16. The computer-implemented method of claim 13, wherein the at least one digital signature includes a creator signature of a creator of the virtual diagnostic test, and authenticating the virtual diagnostic test comprises:

verifying the creator of the virtual diagnostic test using the creator signature,

verifying a requestor of the virtual diagnostic test using a requestor signature of the requestor of the virtual diagnostic test, and

determining that the virtual diagnostic test satisfies the permissions, based on the creator of the virtual diagnostic test and the requestor of the virtual diagnostic test.

17. The computer-implemented method of claim 13, wherein the at least one sequence data object comprises a laboratory signature and a device signature, and wherein the method further comprises verifying a laboratory associated with the at least one sequence data object based on the laboratory signature and verifying a device associated with the at least one sequence data object based on the device signature, and wherein the determination that the at least one sequence data object satisfies the input specification depends on the laboratory and the device.

18. The computer-implemented method of claim 13, wherein the at least one sequence data object comprises an analyzer sequence, and wherein the determination that the first at least one sequence data object satisfies the input specification depends on a quality characteristic of the analyzer sequence.

19. The computer-implemented method of claim 13, wherein the at least one sequence data object comprises an analyzer sequence, and wherein the determination that the at least one sequence data object satisfies the input specification depends on a chain-of-handling characteristic of the analyzer sequence.

20. The computer-implemented method of claim 13, wherein the method further comprises storing an audit record comprising a hash of the at least one sequence data object, the virtual diagnostic test;

and the test algorithm output.

21. The computer-implemented method of claim 13, wherein at least one link object associates a customer account with the at least one sequence data object.

22. The computer-implemented method of claim 21, wherein executing the virtual diagnostic test comprises indirectly accessing the at least one sequence data object associated with the customer account using the at least one link object according to a permissions framework.

23. The computer-implemented method of claim 13, wherein the request indicates the at least one sequence data object.

24. The computer-implemented method of claim 13, wherein the request comprises a predicate, and wherein the trusted data analysis platform identifies the at least one sequence data object based on the predicate.