Pdasp track 2: secure analytics over federated environments for biomedical science (safe-BIO)

The National Science Foundation awarded the University of Virginia $638,879 on October 1, 2026, under the NSF Technology, Innovation, and Partnerships program (CFDA 47.084) to develop and validate SAFE-BIO, a framework for secure analytics over federated environments that enables collaborative biomedical research across independent institutions while protecting sensitive patient data.

The project builds software infrastructure that applies confidential computing—using hardware-isolated enclaves that keep data encrypted during processing—to allow researchers at different hospitals and universities to analyze shared patient information together without exposing private details to system administrators or other software running on the same machines. The work addresses a central vulnerability in existing data-sharing approaches: while protected data can be locked in storage or transit, conventional analysis requires decryption in a computer's memory, creating exposure risk. The system aims to support collaboration on research areas involving sensitive data, including genetics, personalized medicine, and public health, while extending applicability beyond biomedical settings to any domain requiring confidential cross-organizational analysis.

The award runs through September 30, 2028, with performance taking place in Charlottesville, Virginia.

Abstract

Biomedical research increasingly depends on combining sensitive health information held by many different hospitals and universities. Doctors and scientists could make faster progress against disease if they were able to analyze large collections of patient data together, but this information is private and legally protected, and institutions are often unable to share IT because doing so risks exposing personal details. A central difficulty is that even if data are locked and protected when they are stored or sent across a network, they need be unlocked inside a computer's memory in order to be analyzed, which creates a point of vulnerability. This project is building a software system to allow computers to analyze such sensitive information while IT stays locked and hidden, even from computer system administrators who may have direct access to the computing systems. The aim is to let different institutions work together on shared scientific questions without ever revealing private data. Success of such a system would enable researchers to collaborate in areas involving sensitive data, such as genetics, personalized treatment, and public health, while protecting the privacy of the individuals whose information makes those advances possible. The benefits reach beyond medicine to any setting in which organizations need to cooperate on confidential information that they cannot otherwise share freely. This project is developing and validating a framework called safe-BIO: secure analytics over federated environments for biomedical research, which applies confidential computing to secure, collaborative analysis across independent institutions. Confidential computing relies on hardware isolated enclaves that keep data encrypted even while they are being processed, so that the information remains inaccessible to system administrators and to other software running on the same machine. The framework provides a portable middleware layer that hides the differences among competing hardware platforms, allowing both new and legacy analytical applications to be moved onto the secure environment with little modification. The technical work is organized into research and development, testing and evaluation, and a pathway toward broader adoption. Central contributions include a certifier component for transparent deployment of confidential hardware, a chain of trust architecture that attests to the integrity of the full software stack, a curated operating system and container environment for general purpose applications, and security orchestration that extends confidential guarantees across distributed federated workflows. The framework is evaluated through realistic biomedical scenarios that involve distributed genomic datasets and analytics driven by artificial intelligence (AI), using established community testbeds and measurement methods to quantify security, performance, and the runtime overhead introduced by enclave based execution. The team of researchers spans the university of virginia, datica research, the university of southern california, and the national institute of standards and technology, combining expertise in cybersecurity, distributed systems, biomedical informatics, and standards development. The project contributes reusable architectures, middleware, evaluation methods, and deployment guidance that lower barriers to secure collaboration, together with training opportunities for postdoctoral researchers and research computing professionals. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the foundation's intellectual merit and broader impacts review criteria.- subawards are planned for this award.