COMPREHENSIVE INFORMATION SECURITY MODEL OF A CLOUD MEDICAL MANAGEMENT SYSTEM

Abstract

A comprehensive problem of ensuring information security in modern cloud-based medical information systems implementing algorithmic management of medical services based on data analysis and automated decision-making procedures has been investigated. It is shown that the growing volume of medical data, the active adoption of telemedicine, mobile services, and integrated electronic health records require the development of secure, scalable, and cyberattack-resistant architectures. It is substantiated that traditional cybersecurity approaches do not provide an adequate level of resilience under dynamic workloads and insider threats, nor do they account for the specific features of algorithmic management, where the integrity of decision-making parameters is critical. A model for integrating security mechanisms directly into the decision-making logic, built on the Analytic Hierarchy Process (AHP), is proposed. A classification of medical data based on criticality, considering their influence on clinical and administrative decision outcomes, is justified. Key threats to cloud-based medical systems are identified, including modification of AHP weights, replay attacks, API compromise, unauthorized cache access, database query substitution, credential leakage, and event log tampering. Based on these findings, a set of principles for designing a secure architecture is formulated, incorporating a role-based access control (RBAC) model, multi-level logging, AES-256 cryptographic data protection, integrity monitoring, cache lifetime restrictions, as well as the deployment of monitoring and automated incident response systems. Examples of implementing security mechanisms in Redis and PostgreSQL environments are provided, demonstrating the practical feasibility of applying the proposed model in cloud infrastructures with high scalability requirements. It is shown that integrating security at the level of decision-making algorithms increases trust in automated systems, ensures the integrity and confidentiality of medical information, and significantly reduces the risks of insider and external attacks. The proposed concept may serve as a foundation for developing new generations of secure cloud solutions in healthcare and for further advancing regulatory requirements for the protection of medical data..