Using the different disability indicators that are available in each survey, we use a structural equation approach involving a latent concept of disability in which probabilities of receiving attendance allowance depend on disability. Despite major differences in design, once sample composition has been standardized through statistical matching, the surveys deliver similar results for the model of disability and receipt of attendance allowance. Provided that surveys offer a sufficiently wide range of disability indicators, the detail of disability measurement appears relatively unimportant.We compare three major UK surveys, the British Household Panel Survey, Family Resources Survey and the English Longitudinal Study of Ageing, in terms of the picture that they give of the relationship between disability and receipt of the  Besides the age restriction, eligibility for AA requires the claimant to be in need of care to perform daily activities. The AA claim form says ‘you may get Attendance Allowance if your disability means that you need help with your personal care or you need someone to supervise you for your own or someone else's safety’. It defines help with personal care as ‘day‐to‐day help with things like washing (or getting in or out of the bath or shower), dressing, eating, going to and using the toilet, or telling people what you need or making yourself understood’, and supervision as needing ‘someone to watch over you to help you avoid substantial danger to yourself or other people’  from a set of possible utilization functions F. The individual's chosen vector of ‘functionings’ is b = f(x), which is thus constrained by his or her economic entitlements X and available ways of using economic resources F. We view the concept of disability as a health‐related limitation on the set F relative to some socially agreed minimal norm N. The aim of disability policy is to offer support to people for whom F ⊂ N. Support may take the form of cash or services, both of which expand the individual's choice set X, and it may be universal, in which case support is independent of the preintervention X, or means tested, in which case entitlement depends on X. The important point here is that the concept of disability is concerned with constraints on basic functionings, rather than medical conditions themselves. The survey indicators that are used to measure disability should therefore focus on potential difficulties with everyday activities rather than health or disease.Our policy motivation has implications for the appropriate conceptualization of disability. We are not concerned here with medical concepts of impairment, but rather disability conceived as a set of constraints on functioning which originate from health impairments broadly defined. This corresponds to Sen's  ‘capabilcomplete in its coverage of disability if its questionnaire content generates disability indicators that are capable of reflecting all the multiple dimensions of disability. Two surveys are mutually compatible if their respective indicators of any particular dimension of disability give the same undistorted picture of that underlying concept. For researchers using similar methods but different sources of data to be sure of agreeing on their conclusions, both completeness and compatibility are necessary in general. We investigate three British surveys, the Family Resources Survey (FRS), the English Longitudinal Survey of Ageing (ELSA) and the British Household Panel Survey (BHPS), which have been widely used for research on health, disability and related topics. We find that compatibility is not a serious difficulty, although there are some signs that completeness is a problem for the BHPS.The contribution of this paper is to investigate whether different indicators of disability, collected in three widely used household surveys, are consistent with a common set of findings relating to the targeting of disability benefits for older people. If we admit the possibility that underlying disability is multi‐dimensional, there are two aspects to this comparability issue: completeness and compatibility. A survey is η is influenced by a set of SES characteristics and the probability of receiving AA is a function of η and SES characteristics. See Bollen  are used as explanatory covariates, together with several other characteristics that are related to socio‐economic status (SES)  count of them, the latent variable framework allows us to develop an index of disability which makes use of all available sample information. This composite index can then be used as a sounder basis for policy analysis focused on the targeting of disability benefit. Second, the latent variable framework reduces the scope for bias arising from the measurement error in observed disability‐related indicators and therefore gives more reliable estimates of the relationship between benefit receipt and influences like disability and income—again improving the robustness of an analysis of benefit targeting. To our knowledge the latent disability approach has not been applied in multiple surveys each with different indicators of disability and the application to disability benefit receipt is also novel.In Sections The programs that were used to analyse the data can be obtained fromhttp://wileyonlinelibrary.com/journal/rss-datasets2In the gerontology literature, Johnson and Wolinsky  conceptuns individuals in surveys s = 1, 2, 3. Each sampled individual i is characterized by unobserved Q‐dimensional ‘true’ disability ηi=(ηi1…ηiQ), socio‐economic individual characteristics Zi observable in all surveys, a set of survey‐specific disability‐related discrete indicators DijS,j=1,…,JS, and a binary indicator of benefit receipt (Ri=1) or non‐receipt (Ri=0). We aim to draw inferences about the conditional distributions P(η|Z) and P which describe respectively the distribution of disability in the population and the relationship between benefit receipt and the individual's disability and other characteristics. By definition, these population distributions are independent of any survey that is used to draw inferences about them. An important question is whether the distributions Ps that are produced by the three surveys with their different disability indicators nevertheless give a coherent indication of underlying ‘true’ disability η and its relationship with benefit receipt R.Analysis is based on independent samples of λjqs are factor loadings relating observed indicators in survey s to underlying disability, εijs is a normally distributed residual term representing random‐response error, implying an ordered probit link function generating the observable indicator Dijs from its unobserved continuous form D~ijs, Mjs is the number of response categories for indicator Dijs and the Ajms are threshold parameters. In what follows we refer to equations qth disability component ηiq is related to Zi through a linear relationship representing the processes leading to disability (disability model):θq is a vector of coefficients. The residual νiq captures other unobservable factors and satisfies. E(νiq|Zi)=0. Benefit receipt is modelled by a probit specification (the benefit receipt model):Ri=1 when R~i>0 and Ri=0 otherwise, β and the γq are coefficients and ui is a stochastic disturbance term. Although allowing correlation between the Q latent constructs, we make the standard assumption underlying probit models that the stochastic residual ui is independent of  and the residuals in the measurement equations β and θq.We estimate a structural equation model which comprises three components: a survey‐specific measurement model, a disability model and a benefit receipt model. We use an ordinal quasi‐linear structure for disability measurement:s is complete if the J×Q loadings matrix {λjqs} is of full column rank Q; this requires that, for each dimension of disability q, at least one of the j observed indicators Dijs has a non‐zero loading λjqs. In the on‐line appendix, we show that completeness is sufficient to identify the model under our assumptions. The surveys are said to be compatible if the assumption of common parameters across surveys in equations We say that survey et al., a priori a subset of indicators in each survey for which response behaviour is gender invariant, it is impossible to distinguish the causal effect of gender on true latent disability from its effect on reporting behaviour. We allow for the possibility of inherent gender differences in disabilities by allowing the parameters of the measurement equations Zi of equation Several studies have shown that, in the older population, women tend to report significantly higher rates of functional difficulties than comparable men . In the BHPS, it is not always possible to distinguish whether a particular source of income is gross or net. BHPS information on health and disability is more detailed than the FRS in some respects but less so than the ELSA. The surveys differ in the information that they collect by proxy for participants who cannot provide responses themselves; in particular the FRS collects information on disability and AA receipt from proxy respondents, whereas the BHPS and ELSA do not. We return to treatment of proxy respondents below. Campbell , Taylor et al.  and Tayl   plus any dependent children whom they are living with), but it excludes disability and means‐tested benefits. Disability benefits must be excluded from the latent disability equation because they are a consequence, and not a cause, of disability, and from the AA equation as it is income in the absence of AA that influences the decision to claim. Means‐tested benefits are excluded because their level can also depend on disability through the severe disability premium, which is an addition to the income thresholds that are used to assess entitlement to means‐tested welfare benefits and applies where the claimant is receiving AA. To account for differences in benefit unit size we apply the modified Organisation for Economic Co‐operation and Development equivalence scale to income. For this older population, our income measure is dominated by pension income, which is a good indicator of past labour market success, itself strongly related to lifestyle characteristics which have associated health implications. Thus estimates of the effect of income on disability should be interpreted in this wide sense. Log‐income is entered as a spline with a knot at the median log‐income level ( log (£615.70) per month, 2002 prices). Our definition of housing tenure distinguishes those who own their homes outright from those who rent or are still repaying their mortgage. Outright home ownership is used to capture an additional long‐term socio‐economic influence on health. It also allows for the lower financial need (lower housing costs) that outright owners have compared with those who face rent or mortgage costs, to influence their benefit claim behaviour. Current partnership status (married or cohabiting versus single) is also included as a covariate in the AA receipt equation since it has previously been found to affect benefit claim behaviour  and on  Goldman  in relat . There are some differences between surveys (for the subsamples aged 65 years and older): for example, before survey weights are applied the ELSA sample members are slightly younger and more educated than their BHPS and FRS counterparts, the proportion of outright homeowners is higher in the ELSA and the BHPS than in the FRS, and the mean of (log‐) income is significantly higher in the BHPS than in the ELSA and the FRS. The FRS reports a higher rate of AA receipt (9.7%) than does the ELSA or BHPS (7.2%). Comparisons with administrative data are not straightforward because they include AA recipients in the care home population. We estimate that, of the over‐65‐years non‐care‐home population, excluding those who received disability living allowance, between 12.7% and 13.8% received AA in 2002. This is based on Department for Work and Pensions statistics on recipients of AA and disability living allowance which include, but do not separately distinguish, recipients in care homes, together with estimates from Comas‐Herrera et al. . However, we are forced to exclude proxy responses in the ELSA (1.9%) and BHPS (4.1%) as their proxy questionnaires do not collect the respondent's disability (ELSA) or AA receipt (BHPS). We retain the larger proportion of proxy cases (6.5%) in the FRS which does collect this and other relevant information for proxy cases, using a proxy response as an additional disability indicator in the measurement model. After these exclusions and dropping cases with missing values for variables that are used in the analysis, the sample sizes are 1042, 5142 and 6744 individuals from the BHPS, ELSA and FRS respectively. We also assess the sensitivity of the results to the exclusion of FRS proxy cases in which case the FRS sample is reduced to 6308.In the next section, we present results based on the full unweighted samples, and we return to the issue of sample comparability in Section 44.1a priori one indicator from each survey that appears to be based on essentially the same question. These are the FRS question about mobility (‘moving about’), the ELSA question about capacity to ‘walk 100 yards’ and the BHPS question about ‘walking more than 10 minutes’. We then normalize the factor loading for each of these indicators to be 1. In Section et al. . The estimated coefficients for the FRS and ELSA are similar in size and the Wald test cannot reject the hypothesis of equality; when the BHPS is used as the basis for comparison, the null hypothesis of joint equality of coefficients is rejected .Estimates for the model (3) of latent disability status are reported in Table 4.3Estimates for equation et al., The estimated probability of receiving AA declines non‐linearly with income. We find that, below median income, the coefficient is significant at the 10% level only in the ELSA, so the income gradient in AA receipt operates primarily among higher income people. The negative gradient is due both to the low incidence of disability among high income groups Pudney,  and to tWe find significant evidence of a negative association between the level of education and AA receipt in both the ELSA and the FRS. This suggests that any advantage that more‐educated people may have in navigating the benefits system is outweighed by factors such as less contact throughout their lives with the benefit system, or greater perceived stigma from claiming benefits . Owningp‐values 0.100 and 0.095). We do not reject coefficient equality between the FRS and ELSA.Receipt of AA appears gender related in the FRS and the ELSA, where men are less likely to receive AA than women; gender differences are insignificant in the BHPS. In all three surveys, age affects the probability of AA receipt non‐linearly, with a convex age profile. There is again a significant difference between the estimated age profile for the BHPS compared with the FRS and ELSA, with a less significant upturn at older ages. Finally, none of the surveys suggests that the presence of a partner significantly affects the probability of receiving AA. Inspection of coefficients in this piecemeal way creates a bias in favour of finding significant differences, because of the multiple comparisons that are involved. However, a joint Wald test finds a significant difference between the BHPS and the other two samples  are valid and if the weights are implemented in the ‘correct’ way by each survey, then separate weighted samples should identify essentially the same population parameters, if the questionnaires have the same informational content. However, the weighting strategies are not harmonized across the three surveys . For the AA equation, the Wald χ2p‐value decreases from 0.100 to 0.048 for the FRS–BHPS comparison and it rises from 0.095 to 0.142 for the ELSA–BHPS comparison (see on‐line appendix Table A3).In single‐survey analysis, the standard method of controlling sample composition is to use survey weights. Broadly, these have three elements: et al., Matching techniques provide another way of reducing bias from differences in the sampling distribution of covariates across surveys. They involve estimating the models by using survey‐specific subsamples which are balanced in terms of the set of common covariates that are thought to influence disability and AA receipt. The matching approach has not been widely used in this context, but there are some precedents , when the FRS or ELSA are used to mimic the BHPS sample composition. However, none of the individual t‐tests would be significant if a Bonferroni correction were used, and the striking similarity of estimated coefficients is confirmed by the χ2‐tests of coefficients’ joint equality: in none of the six paired survey comparisons is the null hypothesis rejected.We repeated estimation of the system of equations γ are positive, significant and remarkably similar in size. The negative income gradient is also confirmed, except for an insignificant positive coefficient when the ELSA mimics the BHPS sample composition. The negative association between homeownership and receipt of AA is again found whenever the coefficient on homeownership is significant. For age, coefficient equality is rejected at the 5% level only for the second spline when BHPS observations are used to mimic the ELSA sample composition; but such isolated rejections are likely to arise from sampling error when large numbers of individual t‐tests are used, and none would be significant if a Bonferroni correction were used. Joint Wald χ2‐tests of coefficient equality again fail to reject the hypothesis of coefficient equality in any of the six pairwise comparisons.Estimated coefficients for the AA receipt equation 66.1et al., p‐values 0.140 and 0.192 respectively). The two‐factor specification confirms our previous findings on the relationship of AA receipt to socio‐economic characteristics, since tests of coefficient equality do not reject the null hypothesis that coefficients β of the observed covariates in the two‐factor models are equal to those obtained with the one‐factor specification in both surveys. The estimated coefficients of the two‐factor models are similar in size for the FRS and ELSA. On the basis of a Wald test, we reject the hypothesis of equality for the full AA coefficient vector   but we do not reject for β alone . Cross‐survey differences in the magnitude of the coefficients are not large and, for practical research purposes, one would draw essentially the same conclusions from the FRS and ELSA results.In the estimated one‐factor measurement models of on‐line appendix Table A1, there is a strikingly low correlation between the latent disability index and those indicators which might be thought to represent cognitive rather than physical disability. To allow for a distinction between physical and cognitive disability, we have also estimated a two‐factor model for each sample, following an exploratory factor analysis of the disability indicators. The attempt failed for the BHPS, where only a single factor could be detected, arguably because the BHPS disability questions lack completeness and have poor sensitivity to the cognitive dimension of disability. For the FRS and ELSA, two‐factor models can be estimated . The second factor appears to distinguish the cognitive aspect of disability for the FRS where difficulties in communication, in memory, concentration, learning or understanding and in recognizing physical danger are fairly obviously related to cognitive functioning. Since incontinence could stem from physical and/or cognitive problems, we allow for a cross‐loading between the two factors for difficulties with continence. In the ELSA, the second factor is determined from four cognitively demanding IADLs  and, as for the FRS, we allow a cross‐loading for continence. It is well known that there are limitations in the extent to which IADLs capture difficulties in cognitive functioning . Details of the estimates are in the on‐line appendix, Tables O5–O7. However, the scope of this exercise is limited by the lack of a directly comparable indicator in the BHPS.The comparability of estimates of the disability and AA equations can be improved by normalizing the loadings of more similar questionnaire items. For instance, the FRS and ELSA have questions on the capacity to lift weights (variable LIFTING) which are arguably more similar than those on general mobility. When the factor loading for LIFTING is normalized to 1, the concordance between the FRS and ELSA disability equation and AA coefficients indeed improves, with the Wald 6.3Since we are forced to exclude proxy cases from the analysis of the ELSA and BHPS, we investigate the consequences of also excluding them from the FRS and dropping the proxy indicator from the disability measurement equations (see Tables O8–O10 of the on‐line appendix). This has the effect of changing slightly the factor loadings on the other indicators. Nevertheless, all factor loadings remain positive and highly significant. The largest changes in loadings are for men, where the factor loading on lifting increases from 1.005 to 1.039, whereas those for memory problems and recognizing when in danger fall from 0.420 to 0.356 and from 0.510 to 0.355 respectively. The estimated latent disability and AA receipt equations are not changed substantially. However, there are some small effects on the statistical significance of differences between the surveys in the estimated coefficients. In both the disability and the receipt‐of‐AA equations, after dropping proxy cases, the differences between the FRS and ELSA become smaller but increase slightly when the FRS is contrasted with the BHPS.7Our aim in this study is to contribute to the current policy debate over reform prospects for the social care system by investigating the robustness of survey‐based evidence on the targeting of public support for older people with disabilities. We have examined the three UK surveys  which have been the basis for much of the empirical analysis underpinning the debate on policy on disability in the pensioner population. Despite differences between the three surveys in terms of their questionnaire content, we have found that they have a coherent story to tell about the targeting of one form of public support in relation to disability, income and other personal and household characteristics.ad hoc count indices as disability measures. Results confirm that the probability of receiving AA increases strongly with the severity of disability and decreases with income—especially for those in the top half of the income distribution—after allowing for the socio‐economic gradient in health that associates higher living standards with lower disability. This is important in the context of renewed suggestions that consideration be given to means testing AA (Commission on the Future of Health and Social Care in England, We also claim to offer some advance in terms of the statistical modelling methodology that is typically used in the disability research literature. Adopting a latent variable approach, we can exploit the existence of multiple—but largely arbitrary and individually unreliable—survey indicators, while avoiding the common practice of using ‘Appendix: Additional Tables’.Click here for additional data file.


Equipped with a third hand under their direct control, surgeons may be able to perform certain surgical interventions alone; this would reduce the need for a human assistant and related coordination difficulties. However, does human performance improve with three hands compared to two hands? To evaluate this possibility, we carried out a behavioural study on the performance of naive adults catching objects with three virtual hands controlled by their two hands and right foot. The subjects could successfully control the virtual hands in a few trials. With this control strategy, the workspace of the hands was inversely correlated with the task velocity. The comparison of performance between the three and two hands control revealed no significant difference of success in catching falling objects and in average effort during the tasks. Subjects preferred the three handed control strategy, found it easier, with less physical and mental burden. Although the coordination of the foot with the natural hands increased trial after trial, about two minutes of practice was not sufficient to develop a sense of ownership towards the third arm. Many tasks in open surgery, laparoscopic and micro- surgery need one or several assistants e.g. to hold a suction tube to clear blood, direct the camera in laparoscopic surgery and push organs aside. In microsurgery, delicate tissues should be held during long intervals in a fixed position for suturing, which is difficult for humans. If the assistant holding the camera is novice or unfamiliar with the surgeon, the assistant can often have problems in positioning it appropriately in the 3D space, may be confused with the fulcrum effect and suffer from fatigueThe idea of having a robotic arm helping humans in the operating room is not new. Camera holders are among the most common robotic surgical assistant devices. They are either motion controlled  improves the performance compared to using two hands in a demanding task. It is also important to assess the users’ preference for different possible control strategies with two or three hands. The present study aims at investigating such questions. An experiment is designed in virtual reality in which the same task is performed with two virtual hands vs. with three virtual hands. The third hand is controlled by tracking foot movements. The functional differences in limb usage in two handed and three handed scenarios are investigated. The performance of the subjects and the physical and mental burden of the tasks are compared. The learning curves of the participants, their sense of ownership towards the third hand and the ease of control of the third hand are analysed.The experiment consists of catching three virtual falling polygons once using two hands (2 h) that mimic the movements of the two real hands of the user, and another time using three hands (3 h); the third hand is controlled by the foot. In the 2 h scenario, the left hand can catch the left and middle objects while the right hand is able to catch the right and middle objects. In the 3 h scenario, left and right hands can only catch the left and right objects respectively while the middle object can only be caught by the foot controlled virtual hand. The target zone is a circle centred at the centre of the falling object and with a diameter equal to the polygon’s smallest edge. Left and right hands can catch an object by pinching inside the target zone, however, the foot-controlled hand should only get inside the zone to catch. Each experiment involves three game rounds. The objects’ falling speed is doubled in the second and third rounds compared to their respective previous round. The experimental setup and paradigm are explained in detail in the Methods section.The results are presented for the average performance of all the participants as well as left- and right-handed subjects. No significant difference between females’ and males’ performance was detected in any of the measures analysed below, thus we do not differentiate the subjects according to their sex in the following. Subjects’ performance is assessed through objective measures of efficiency, workspace, smoothness, velocity, limb’s simultaneous action, number of pinches by each hand and effort. 26 of the 35 subjects managed to finish the game with two hands and 25 subjects managed to finish the three hands game 3 h. The 2 h game was finished in 127 ± 7 s and the three handed one in 126 ± 9 s. Slightly fewer objects were lost in the 3 h scenario (3.8 ± 0.8 for the 2 h game vs. 3.5 ± 0.8 for 3 h). There are large individual performance differences among the subjects. In 2 h there was a direct relation between the increase in game’s speed and the number of lost objects i.e. as the speed increased more objects were lost. However, there was no such relation in 3 h. In this paradigm, the performance got worse in the second game round compared to the first one but then improved in the third round. In the maximum speed condition, 46% less objects were lost in 3 h compared to 2 h.It is useful, in the design of control interfaces, to know the comfortable workspace of the limbs with respect to each other and as a function of movement velocity. Right-handed participants used the right hand for catching the middle object in 63 ± 6% of the cases and left-handed participants used the left hand in 69 ± 11% of the cases. In the three-handed game, different subjects had quite different strategies in moving their limbs. Some moved their limbs in a rectangular space, whereas others performed actions with minimal movements resulting in nearly linear workspaces .workspace of each limb is defined as the smallest rectangle containing all the paths of that limb. The size of the workspace was negatively correlated with the falling speed of the objects such that the workspace decreased of half when the velocity was doubled in each game round The smoothness of the movements of each limb was quantified using the spectral arc length metric  for catching a specific object. The results of simultaneous action (defined as the time during which both hands are moving simultaneously) increased constantly through game rounds from 23% to 44% of the total time of the game. In the three-handed experiment there was less simultaneous movement between one of the hands and the leg than between the two hands  and 19% from the second to the third round, which is not significant.The number of pinches for catching objects decreased with increasing speed. Left-handed subjects pinched significantly more with their left hand  compared to right-handed subjects. Both groups pinched more with their dominant hand compared to the non-dominant hand. 52 ± 5% of pinches in the two handed scenario and 58 ± 6% of them in the three handed one are done in the target area i.e. over the object.The histogram of the instance of action initiation of each limb shows that all the limbs moved within 10 seconds from the start of the game . In mostW: work, F: force, m: mass, s: displacement, t0: the time at which the game starts, te: the time at which the game ends.We define effort as the work per mass. This measure gives insight into the amount of consumed energy in each of the two handed and three handed experimental strategies and it can be used as a metric of performance efficiency. Work is defined in Eq.Δsi) in each time step (Δt = 0.2 s) as presented in Eq.t0 (i = 1) and ending at te (i = n).By discretising Eq.p Δt = 0. s as preThe average work per mass of the two and three handed scenarios were similar, with a small difference of 3%. Subjects found it natural to control three hands simultaneously . Those who started with the three handed game found it more natural to control the third hand by foot compared to those who started from the two handed one but the difference is not significant. It has also been easy for the subjects to control the third hand by foot . Those who started with the three handed game found it slightly easier. Participants were not confused by the number of tasks they had to perform at the same time with three virtual hands . Those who started with the three handed game have reported slightly less confusion (not significant), indicating that doing the same task with two hands did not result in participants feeling more comfortable in the three handed strategy. Physical and mental burdens are low (under 2.5) for the whole sample (Q4 and Q5).Participants were almost neutral about having sense of ownership towards the third hand . However, those who started with the three handed experiment had an average ipsatized response of 0.66 which is significantly higher  compared to those who started with the two handed game with an average ipsatized response of −0.06. Not only do these results indicate that performing a task with two hands before the three handed experiment does not help the participant feel more comfortable in the three handed game, but it also produces an unwanted reference which negatively influences the user’s perception of the three handed task.Subjects did not feel that their foot was turning into the third arm (Q7). Mean answer for all the participants to the corresponding question is 4.2, indicating that the sense of ownership towards the third hand is not as a replacement of an existing limb (here the foot) but it is perceived as a virtual supernumerary limb. Answers to the control question were independent of the succession of the games and it was almost neutral , illustrating that subjects did not feel that their real hands were turning into virtual limbs. We expected negative or neutral answers to this question indicating that subjects have not answered the questions in a random manner.The comparative questionnaire revealed that the three-handed game was better accepted in every sense . 69% of An experimental study was conducted to analyse and compare humans’ performance in doing a demanding task with two or with three hands. The experiment was carried out in virtual reality where the third hand was controlled by the right foot. The virtual hands were controlled by motion of the real hands and the foot tracked by two Kinect camerasPrevious studies have typically investigated the factors influencing the bimanual or one hand and one foot coordination30The two hands moved at similar velocities on average, while the foot always moved faster than the hands. This shows that the foot interface should compensate for the faster and more jerky foot movements in order to control a robotic arm with the same speed characteristics as biological arms. This ultimately may help coordination of the three arms. The three limbs were moved simultaneously in less than 10% of the time through the game rounds. This shows that performing three independent tasks with three limbs is not achievable within a few minutes of practice and it is not the best approach to multi-limb applications. The two hands had more simultaneous movement compared to one hand and one foot. Ipsilateral hand and foot had the least simultaneous movement among all the possible combinations of the limbs. It is known that ipsilateral limbs have the most inaccurate simultaneous movements in opposite directionsOn average over all the participants and conditions, there was no significant performance difference between the two control strategies. However, at maximum game speed, objects were lost twice as frequently in the two-handed as in the three handed game. This shows that the three-handed control is more effective once the task becomes more demanding. A previous study on hands-foot coordination in gaming, reports less cognitive burden in independent tasksTwo minutes of practice was not enough for developing the sense of ownership towards the third hand. In our previous experiment with three different virtual gamesIn the current experiment, starting with the two handed game did not improve performance significantly relative to subjects who started directly with the three handed game. This indicates that performing the same task with two hands does not help in mastering the three hands paradigm.The main limitations of this experiment are the sample group and the task type. Most of the subjects were students, thus younger than a typical surgeon and with an engineering background. Also the task is not comparable to a surgical manipulation. Therefore the present results cannot be applied directly to a surgical situation. Further testing will require involving surgeons and tasks closer to surgical gestures. However, it provides strong evidence of the usefulness of a third arm in demanding tasks from surgical to industrial application.These preliminary results encourage us to address step by step the levels of growing complexity of manipulation. This might include embodiment of a third hand for positioning only , grasping with the third arm (e.g. a two fingered hand acting as a tweezer) and cooperation among different limbs. Each of these general steps has to be divided into more detailed scenarios with respective increased complexity.Hands-foot collaboration is widely used in tasks such as driving (vehicle control), playing certain musical instruments and more recently in gaming. However there is little published literature on the possibility of using a foot controlled supernumerary hand along with the two real hands for complex manipulation. This paper provided a comparison of performance during the same task carried out with two and three hands. The results show that in the selected three objects reaching task, subjects preferred to use three hands. They found it easier to complete the task with three hands and reported lower mental and physical burdens than when two hands were used. In fact, from the objective measure of caught objects, we learned that in the most demanding task (fastest game speed), the participants performed better with three hands. This suggests that a third arm can improve performance in applications that involve handling multiple tasks in a short period of time.This study casts light on the users’ approach to the three handed control as compared to the two handed one. The findings suggest a high potential in using the foot to become more autonomous in surgery as well as other fields.Thirty-five subjects with mean age 23 ± 5 years participated in the experiment. Thirteen were female and ten left-handed. The experiment was approved by the BMI Ethics Committee for Human Behavioural Research at EPFL and the methods were carried out in accordance with the approved guidelines. Informed consent was obtained from all subjects. The experiment was developed to investigate and compare the performance of participants in carrying out a demanding object grasping task using two distinct strategies: with two virtual hands (2 h) or with three virtual hands (3 h). All the subjects participated in both scenarios. 17 subjects started the grasping game with the 2 h strategy and then proceeded to the 3 h while 18 other participants started with 3 h and then proceeded to the 2 h, so that the influence of practice with one strategy or the other could be investigated .The experiment is designed as a virtual game played with two or three virtual hands. Two virtual hands move on a computer monitor according to the movements of the two real hands of the player, while the third virtual hand is controlled by the player’s right foot, i.e. the third hand trajectory on the monitor corresponds to the foot’s planar movement on the floor. Two Microsoft XBOX 360 Kinect© depth cameras are used, one for tracking the movements of the player’s two hands and the other one for the foot. The software development kit (SDK) of the 3Gear Systems Company, which includes a library of predefined hand gestures, has been used to track the finger motions of the real hands. Each SDK supports only one camera, consequently a network of two PCs have to operate in parallel to render three virtual hands in real-time.touched with the foot controlled (yellow) virtual hand. An object is “touched” when the centre of gravity of the (yellow) virtual hand gets within a circular target zone of the centre of the falling rectangle, where the diameter of the target zone corresponds approximately to the width of the rectangle.A game has been implemented for the 2 h and 3 h-scenarios in which three polygons with different shapes falling from top to the bottom have to be caught before they reach the ground . The lefWhen an object is caught, it disappears and a new object starts falling from top. The screen is divided into three columns of equal width. Each object stays in its allocated column but it doesn’t always fall from the same spot within its zone. This change in horizontal location forces the player to stay concentrated and active during the game. Each game has three rounds. In the first two rounds, if three samples of each object are caught, the next round starts with double falling speed compared to the previous round. In the last (fastest) round, if three samples of each object are caught, a win message will appear on the screen. In each round, if more than three samples from the same object are lost, the game will be over and a failure message appears on the screen.In the 2 h paradigm, the left and right objects can be caught only with the respective hand while the middle object can be caught with either hand. The 3 h paradigm uses the translational movement of the right foot to control the third virtual hand. Three virtual hands appear on the screen that can catch three falling objects. The left and right objects are caught as in the 2 h experiment while the middle object can now only be caught by the third – foot controlled – virtual hand. In both scenarios, the user should pinch to catch the triangle and the hexagon. The rectangle object placed in the middle is “caught” when the virtual hand’s palm comes over it .In each game, the planar position of the virtual hands are recorded at a frequency of 5 Hz and the hands’ movement velocity is then calculated. In addition, the time of pinches with the left and right hands are recorded. This is completed by a subjective assessment at the end of the three handed experiment through a questionnaire about different aspects of the control strategy, the sense of ownership towards the third hand, the perceived level of complexity of the task and the physical and mental burden of the game as described in At the end of the whole experiment, subjects answer four questions on the two different games . These qThe data sets are tested for normality using the Jarque-Bera test. The normally distributed data sets are compared using the t-test whereas the Wilcoxon rank sum test is used for comparison of non-normal independent sets with a significance level p < 5%. The significant differences are reported wherever applicable. The applied method is presented in the text wherever applicable. The standard error of the mean (SEM) values are reported through the text and in the diagrams.How to cite this article: Abdi, E. et al. In a demanding task, three-handed manipulation is preferred to two-handed manipulation. Sci. Rep. 6, 21758; doi: 10.1038/srep21758 (2016).


Application of personalized medicine requires integration of different data to determine each patient's unique clinical constitution. The automated analysis of medical data is a growing field where different machine learning techniques are used to minimize the time-consuming task of manual analysis. The evaluation, and often training, of automated classifiers requires manually labelled data as ground truth. In many cases such labelling is not perfect, either because of the data being ambiguous even for a trained expert or because of mistakes. Here we investigated the interobserver variability of image data comprising fluorescently stained circulating tumor cells and its effect on the performance of two automated classifiers, a random forest and a support vector machine. We found that uncertainty in annotation between observers limited the performance of the automated classifiers, especially when it was included in the test set on which classifier performance was measured. The random forest classifier turned out to be resilient to uncertainty in the training data while the support vector machine's performance is highly dependent on the amount of uncertainty in the training data. We finally introduced the consensus data set as a possible solution for evaluation of automated classifiers that minimizes the penalty of interobserver variability. In the od cells , 16. Howod cells , 18. In  functionalized and structured medical wire (FSMW) [This paper builds on the previous result in enumerating CTCs in images using image analysis techniques combined with support vector machines (SVMs) and naïve Bayesian classifiers (NBCs) . Data foe (FSMW)  that is e (FSMW) –22. The e (FSMW) . After ce (FSMW) . In thatThe use of different machine learning and machine vision techniques is an active research field with the aim of making disease diagnosis more accurate and efficient . Especia in vivo and in vitro [μm2, 0.5 μm2, or 0.25 μm2 pixel resolution of the images. CTCs are those cells that exhibit nuclear dye (blue) colocalized with the antibodies against cytokeratin and/or EpCAM (both green); see The data set used for this study was the same as used in our earlier publication , where Cin vitro . After cNobs = 11 observers  had normal or corrected to normal eyesight and no one had any known issues with color vision. Cutouts were presented on individual laptops in one session to avoid different light conditions and without any time restrictions. The order of the data points was random and the observers were instructed not to confer.Manual annotation was needed for both training and evaluation of the classifiers as well as for the determination of interobserver variability. The observers were instructed to determine if the most central object in each image cutout was a CTC or not. For an example of multiple objects occurring in the same cutout see μm2 around the center of each image cutout. This means that the cutouts had 100 × 100, 71 × 71, or 50 × 50 pixels, depending on if they were from an image taken with a 40x, 20x, or 10x ocular. We then applied a Gauss convolution filter with standard deviation σ = 1 pixel to the cutouts to reduce the effects of high frequency noise. The classifiers we used, SVM and RF, both required inputs with fixed dimensions and therefore all cutouts were downsampled to 50 × 50 pixels using the raster package in R (https://cran.r-project.org/package=raster). The color space of the cutouts were red-green-blue (RGB) when read but for the classification we transformed them to hue-saturation-value (HSV) using the grDevices package . This was done as HSV has a natural division between color dimensions (H and S) and intensity (V), which is not present in RGB space. In the HSV space we dropped the V dimension as preliminary tests revealed that this factor is not decisive in the classification of cutouts containing a CTC or not. The image matrix was then vectorized so that each cutout is then represented by an array with 5000 entries with the hue and saturation values of the cutout. For the rest of this paper any reference to automated classification of a data point or cutout will mean that this vector containing the hue and saturation values of a cutout was presented to the classifier.As the cutouts have been taken at different magnifications we first normalized the image matrix to cover a region of the size of 2500 https://cran.r-project.org/package=h2o) for the RF and the kernlab package (https://cran.r-project.org/package=kernlab) for the SVM. The RF was an implementation of the Breiman forest [C = 2 and γ = 0.005, where C is the soft margin penalty and γ the inverted radius of the RBF. Parameters, number of trees as well as C and γ for the SVM, were optimized to give the highest accuracy possible on a subset of the data.The automated classifiers were implemented in R using the h2o interface  or no CTC (0) by the respective observer. If two observers agreed on all data points their agreement is one, whereas total disagreement gives the value zero. In We define the agreement between observers A and the others is defined asA against all other observers is given byIn P(A = B) = 0.85, and the assumption that the probability of agreement would be equal for each image cutout can be inserted into the Bernoulli distribution p11 ≈ 259 of the cases. In our dataset, all eleven observers agreed on 365 data points and we refer to these data points as the total consensus data set. This implies in turn an average pairwise agreement of P(A = B) = 0.91, which is significantly different  from the measured agreements in The average agreement between any pair of observers was 85%; that is, c, for which we say that consensus was reached. As the decision between CTC or no CTC is binary, we required that for the Nobs = 11 observersc observers by chance annotated the cutout as containing a CTC or not should be less than 5%. In our case this means that c = 9 observers had to agree that the cutout does or does not contain a CTC for consensus to be reached and in our data set consensus was reached in 502 of the 617 cutouts (81%). For the consensus data set the interobserver agreement was naturally higher with mean (median) of 0.93 (0.95). In The requirement that all observers should agree may be unnecessarily harsh as we may then discard data that a single observer made a mistake on. In studies where observers are not well supervised and possibly anonymous, as in the case of citizen science projects , 33, a sIn the case of consensus data points, the observers that avoided false positive CTC annotation again had considerably lower number of CTCs than the other nine observers; see Given the distinctly different number of CTCs see  identifiWhen evaluating automated classifiers different performance measures are used to show their agreement with an annotation considered to be ground truth. We have so far demonstrated that for certain data sets the annotation can vary strongly depending on the observer performing the annotation. The performance measures we use to evaluate the automated classifiers are defined with the help of correctly identified CTCs (TP), falsely identified CTCs (FP), objects correctly identified as not CTCs (TN), and CTCs that were not identified as such (FN). Our performance measures are then defined as accuracy Acc:In our earlier study , a suppoOur results from the interobserver variability study indicate that a different observer might have annotated the data quite differently. We divided the data set into five randomized folds, without any regard to whether the observers agreed on data points and train a random forest (RF) and a SVM on 3 of those and test on 1 fold. We got the average performance measures Acc = 0.86 ± 0.04, Pre = 0.83 ± 0.06, and Rec = 0.88 ± 0.08 across observers for the RF and the performance measures Acc = 0.86 ± 0.03, Pre = 0.85 ± 0.05, and Rec = 0.85 ± 0.08 for the SVM see . Thus, tTo examine if and how differences in annotation affected the classifiers' performance, we split the data set into the total consensus data set that can be considered ground truth (GT) with 365 data points and a part with probabilistic annotation (probGT) containing the remaining 252 data points. From probGT different annotations can be generated by assigning the label for each data point from a randomly chosen observer. On average 81 data points will change label between two probabilistic annotations. For classifier evaluation, GT was in turn split into three folds and the probGT into two folds, giving in total five folds with approximately the same number of cutouts. To get prediction by the classifiers we trained on two folds and tested on a third fold. The test fold was always one of the GT folds as we were here trying to separate the effects of uncertain labels in the test set from uncertainty in training labels. Averages and standard deviations were obtained by 50 repetitions of the training and testing across the folds with new annotations drawn for probGT between each repetition. When training on only GT folds, which do not change any labels between repetitions, we repeated the procedure 10 times to check if any randomness originated in the training of the classifiers.In If we, instead of training only on GT, took one fold from GT and one from probGT and then tested on one GT fold the RF achieved performance measures Acc = 0.96 ± 0.01, Pre = 0.94 ± 0.02, and Rec = 0.98 ± 0.01 and the SVM achieved performance measures Acc = 0.92 ± 0.01, Pre = 0.88 ± 0.02, and Rec = 0.95 ± 0.01. This means that the label noise during training generally decreased the performance with a stronger performance reduction for the SVM than for the RF. The performances of both classifiers were still better than that recorded on the entire data set where testing was done against partly probabilistic annotation. Even when we trained the RF on the two probGT folds, which we know has a high degree of label noise and it can be assumed that the data in probGT is of a lower quality than in GT, its performance measures were Acc = 0.94 ± 0.02, Pre = 0.89 ± 0.05, and Rec = 0.97 ± 0.03. An example of what we refer to as low quality data is the low color intensity cutout shown in This nicely illustrates that the RF is more robust when faced with label noise than many other classifiers, as was shown in the comparison between RFs and decision trees by Breiman . While tTo at least partly solve the issue of uncertain annotation affecting the performance of the automated classifiers we evaluated the classifiers against the consensus data set. As discussed earlier, it is reasonable that the consensus data set is defined as cutouts for which at least nine out of eleven observers agree with each other, because in this case the probability for random annotation of cutouts as containing a CTC or not is less than 5%. In the case of five observers it would be required that all five observers agree in order to satisfy this condition. Thus, the consensus limit varies with the number of observers. When training and evaluating the classifiers against the consensus data set we split the data set of 502 consensus data points into four folds, trained on three of them and tested on the fourth.In In summary, the use of a consensus data set for training and evaluation of automated classifiers turned out to be a good option for evaluation of automated classification. In combination with the resilience of the RF to label noise in the training data, it seems that especially the test set has to be carefully chosen to give a correct evaluation of how well the classifier performs. The issue remains to find a good consensus data set as the manual annotation of data is hard to come by and time-consuming for the observers. This is especially the case when the annotation requires expert knowledge and experience in interpreting, for example, radiology images , 29.As the use of computational methods is growing in cell biology, both for classification and modeling of biological systems , 34, 35,Two very pressing questions remain to be investigated: (i) how to determine what is good data to use for training and testing the classifiers and (ii) how to detect and treat data that may occur in a clinical setting that is not appropriate for classification using the automated classification. Regarding the first question, we have shown that the creation of a consensus data set is a valid approach, but this normally requires a considerable effort from many observers to make the consensus statistically sound. In many cases these observer also have to be experts, for example, trained physicians that may not be very motivated to annotate data for machine learning algorithms rather than dealing with patients. It can be imagined that machine vision could step in to provide additional observers supplementing human observers. In this case care must be taken that the automated classification can be interpreted as an independent observer that is not getting slaved by human observers. This study suggests that RFs may be a strong candidate for this issue, because we have shown that noise in training data does not strongly affect the RF's performance on a total consensus test set. Another possibility is to use generative models which can be trained without labels  and whicInstead of simply enumerating CTCs, as done here, it is desirable to determine subgroups within the CTC population, for example, to distinguish between apoptotic and viable CTCs , 17. In


Internet-based applications are providing new ways of promoting health and reducing the cost of care. Although data can be kept encrypted in servers, the user does not have the ability to decide whom the data are shared with. Technically this is linked to the problem of who owns the data encryption keys required to decrypt the data. Currently, cloud service providers, rather than users, have full rights to the key. In practical terms this makes the users lose full control over their data. Trust and uptake of these applications can be increased by allowing patients to feel in control of their data, generally stored in cloud-based services.This paper addresses this security challenge by providing the user a way of controlling encryption keys independently of the cloud service provider. We provide a secure and usable system that enables a patient to share health information with doctors and specialists.We contribute a secure protocol for patients to share their data with doctors and others on the cloud while keeping complete ownership. We developed a simple, stereotypical health application and carried out security tests, performance tests, and usability tests with both students and doctors (N=15).We developed the health application as an app for Android mobile phones. We carried out the usability tests on potential participants and medical professionals. Of 20 participants, 14 (70%) either agreed or strongly agreed that they felt safer using our system. Using mixed methods, we show that participants agreed that privacy and security of health data are important and that our system addresses these issues.We presented a security protocol that enables patients to securely share their eHealth data with doctors and nurses and developed a secure and usable system that enables patients to share mental health information with doctors. A new type of sociotechnical challenge has arisen with the advent of eHealth and big data technologies. For example, ubiquitous and wearable health systems collect data through sensors and mobile apps and store the data in the servers of multiple commercial service providers. Furthermore, a growing number of people share this sensitive medical information through social networks such as Facebook and Twitter. This is significantly different from the traditional health service, where service providers kept tight control over patient data.It has been argued that these new technologies can lead to positive health outcomes, as they are evidence of people self-managing their illness . Some ofFurthermore, these new technologies may help improve population health by helping researchers learn about the drivers of different pathologies, or how people's behavior is affected by social influence and public health promotion campaigns . The infHowever, privacy , trust, A trivial solution to sharing data in the cloud involves the data owners first encrypting their data before storing to cloud servers. The data owner can then distribute encryption keys to every user in the group thereby keeping the data protected from the cloud provider and also malicious users. Authorized users in the group can then download the encrypted data from the cloud and decrypt the data using the encryption key provided. However, the main problem with this solution is user revocation. When the data owner wishes to revoke one of the users in the group, he must re-encrypt the data with a new encryption key and redistribute the new key to all the remaining users in the group. This renders the revoked user’s key useless and he or she will thus not be able to access the data contents. This process of re-encrypting the data and redistributing keys to all the remaining users in the group every time a user is revoked access can place a huge burden on the data owner. This is especially the case when the group size is very large, in excess of thousands to hundreds of thousands .There is a growing body of research on the trust, privacy, and security in information systems, most of which apply to health.These issues often arise from insider attacks. For example, malicious insiders to a cloud service provider  can steal data, because they have direct access to it. Insiders who are not happy with their job and who have recently been terminated may take revenge and destroy, corrupt, or sell all data owner’s data . OrganizThere have been multiple studies around privacy and trust in health systems in research -15. One The THEWS  architecture  providedEven when data are encrypted, it may still be possible for a malicious cloud provider to deduce information from the encrypted data. Zhang et al  propose Little of this work has focused on private data sharing between patients and doctors using social networks. We present a new security model that would allow users to have a much more fine-grained control of their health data.One of the major issues with private sharing of health information, and hence the major focus of this paper, is encryption key management. As discussed above, the trivial solution is computationally inefficient when having to revoke users because of the burden on re-encryption and redistribution of keys.Microsoft HealthVault ,19 proviProxy re-encryption and attribute-based encryption (ABE)  are two Silva et al  present Tran et al  utilize Huda et al  propose In our previous work , we focuFurthermore, we applied our key partitioning encryption solution in two studies ,28. In oOur work leverages existing encryption algorithms to help build a more secure protocol that allows health data to be shared between a patient and many doctors, where the patient is in full control over who can access his health data and who cannot.Our contribution is a new way of protecting data, without revealing the full encryption key to both the user and the cloud provider. The encryption key is a string of digital information that defines what a cryptographic algorithm produces, that is, how data are encrypted/decrypted. This is in addition to users’ passwords. The encryption key is used to generate a ciphertext of the original data and hence make the data illegible to ordinary users. The encryption key is used to decrypt or convert the ciphertext back to the original plaintext data.We propose a system that is designed to be highly scalable, providing the ability to share data with many users, such as doctors and nurses, while allowing the simple revocation of a user without the need to re-encrypt the data every time a user revocation occurs. We focus on creating a secure and usable system that will enable patients to share mental health information with doctors and mental health specialists, from the comfort of their own home.In this project, we evaluate the security model through a prototypical mobile phone app. We chose to recruit students and medical professionals to evaluate the security of our system because they were the most likely potential users of the system. Using a mobile phone app, patients can report and receive help, wherever they are. In the field of mental health, for example, studies have also shown that the use of mobile phone apps can support significant reductions in depression, stress, and substance use .Our system is built upon a requirements-driven design methodology .The secure encryption protocol has been developed over several projects at the Commonwealth Scientific and Industrial Research Organisation ,26,28. WFor the evaluation discussed in this study, we created a fictitious, but quite common, scenario: collecting data and providing support.The best way of designing and then evaluating a security feature is through a minimum viable application in a realistic scenario. This security feature would be applicable in other scenarios, but the reification into concrete terms with users, and evaluate the design on scalability and nonfunctional requirements. Our application emulates one where data are collected to provide support to people at risk of mental health issues at the workplace.We chose this scenario because it was relevant to our research and because of its significance. There is evidence of increased work stress, sleep disorders, and depression in the workplace . As a reWe also speculated that certain aspects, characteristic of mental health issues, would make the importance of trust and privacy more relevant to users. Trust and stigma also make it harder for people to seek help or share information about their mental health. In workplace well-being programs, for example, employees might be less likely to share information if they feel that it could be used by their employers. Trust is in great measure a consequence of the software design of systems and apps used to collect and manage the data.We take advantage of ElGamal encryption , a publiThere are three main steps of the ElGamal encryption algorithm:xmod p, where x is a randomly selected secret key. The public key is thus {p, b, c} and private key is x.Initialization: Given a prime p, a primitive root c of p, compute b=cEncryption: Generate random value r and encrypt data m as follows:rmod p=m×crxmod pE(m) = m×brmod pAlso note: g=cDecryption: This decrypts m with secret key x as follows:x(E(m)) = g-x×E(m) mod p=(cr)-x×m×crxmod p=c-rx×m×crxmod p=m mod pDWe use both symmetric and asymmetric encryption and decryption in our work to protect the health data from being accessed by untrusted social networks. We utilize both cryptography methods because they provide stronger security and higher performance while supporting larger data sizes in eHealth.For the sake of our evaluation, we have simplified the application so that it provides the most common features found in commercial products. Our prototype app allows the patient to enter a text value , a number value , and an image. The app also includes a button used to encrypt the text, number, and image and send the data to a cloud server that is used to represent the social network. In our work, we developed a local cloud server that does encryption/decryption operations.One of the main limitations of our work is that current social networks cannot automatically carry out encryption/decryption. However, we mainly wanted to demonstrate the potential capability of our system should a social network provide this feature in the future. Another limitation of our work is that, once the doctor has fully decrypted the patient’s health data, there is no way to revoke access. This is currently beyond the scope of our paper. The doctor however, would not be able to view any further health information posted by the patient.One of the main goals of our system is to make it simple to use for both patients and doctors. Our system is not designed to replace existing health record systems but provide a convenient way for patients and doctors to communicate with each other remotely while ensuring privacy and security of health data. In terms of privacy, we offer a solution that enables the patient to define who can access their personal health data. We do not focus on the other aspects of privacy such as determining when the data were accessed, how the data were accessed, and to what extent the data are communicated. In terms of security, we provide solutions to availability through the use of the cloud and confidentiality in terms of allowing only authorized doctors to access the data. We do not focus on integrity or accountability in this work.To describe the protocol, we assume that the patient’s public and private key pair has already been generated and stored in the app. We also assume the social network to be honest-but-curious in the sense that the rules of the protocol will be followed as intended but will still try to find out any sensitive information if possible.The patient first runs the prototype app and inputs a text string and a number value, and uploads an image onto his mobile phone. When the patient presses the “Send” button, the app will then generate an arbitrary symmetric key and encrypt the text, number, and image. The symmetric key will then be encrypted using the public key. The encrypted data contents and encrypted symmetric key will then be sent to the social network, for storage see .When the patient decides to share the data with a doctor, he presses the “Share” button on the app and enters the doctor’s social network username. The app will then partition the patient’s private key into 2 random parts. The first partition will be sent to the social network and the other will be sent to the doctor. By doing this, the untrusted social network has no knowledge of the full private key, because the other partition is stored on the doctor’s local machine see .When the doctor wishes to access the patient’s data, they simply call the social network to retrieve the data. The social network partially decrypts the symmetric key using the partial key supplied by the patient and sends the encrypted data contents and partially decrypted symmetric key to the doctor. The doctor uses the partial key supplied by the patient to fully decrypt the symmetric key and finally decrypt the data contents. The standard method of accessing data involves the data consumer downloading the encrypted data from the cloud and decrypting the data on his own machine, using the encryption key supplied by the data owner. In our protocol, the data consumer does not have access to the other half of the key, which prevents the data consumer from ever knowing the full encryption key see .When the patient decides to revoke a specific user’s access to his eHealth data, the patient sends a request to the social network platform to remove the doctor’s partial key entry from storage. If the doctor attempts to download the data from the social network, he will only see the encrypted text (“ciphertext”). The doctor will not be able to fully decrypt or read the data without the partial key. In the trivial solution described earlier, the data owner would have to re-encrypt the data and redistribute the new encryption key to all of the remaining consumers in the group, thus placing a burden upon the data owner. In our solution, because the data consumer has no knowledge of the other half of the key partition stored in the cloud, the data owner would simply have to delete that key partition. Thus, he need not worry about re-encryption and the redistribution of keys see .To verify the security of our protocol, we have used an automatic cryptographic verifier tool called ProVerif , which hWe first modeled the behavior of the symmetric and asymmetric encryption, ElGamal encryption/decryption, and digital signatures.We then modeled the patient by following the logic of the protocol. In other words, the patient sending their encrypted health data to the cloud server is modeled.The cloud provider model simply retrieved the encrypted data from the patient via the public communication channel. When requested by the doctor, it would carry out a partial decryption of the symmetric key using the doctor’s key partition and send it back to the doctor via the public communication channel.The doctor was modeled as retrieving the key partition from the patient via the private communication channel. The doctor then retrieves the encrypted data and uses her own key partition to fully decrypt the partially decrypted symmetric key and then fully decrypt the encrypted data to reveal the plaintext health data.Each of the processes of the data owner, cloud provider, and data consumer were run simultaneously, to simulate realism.In total, we recruited 5 medical professionals and 15 students to carry out the usability testing of our eHealth application. According to Nielsen , the minTo carry out the usability tests, we provided participants with a 4-inch LG mobile phone with Android operating system (OS) and a 10-inch ASUS Eee Pad tablet , which cAll 20 participants were given the same demo. Each participant was first introduced to the main idea of our secure eHealth system. We then asked the participants to carry out simple tasks such as the following:Report current moodShare information with another userShow that the other user can view the user's mood submissionView mood submissions, etcEach participant was told that their mood submission was encrypted, and they were shown the back end of their stored mood submission. Participants then answered our trust and usability questionnaire.We have illustrated the user interface of our MindFeedback app with We asked the participants to think aloud while taking notes. Finally, participants answered a short questionnaire see , with quWe investigated the relationship between how trustworthy and secure our system is and how useful our system is to everyday users. SurveyMonkey was used to provide the questionnaires to the participants and to carry out the analysis of the questionnaire responses.Demographic questions  Are you male or female?  What is your ethnicity?  What is the highest level of school you have completed or the highest degree you have received?Seven-point Likert scale questionsTrust and security    When I’m connected to the Internet, I am concerned about exposing my health information to the public.    I am not too concerned about what others see when I post my health-related information on the Internet.    This system has made me more aware of what I may be exposing to others on the network.    I feel safer when using the system.    Personal information, which I input, is managed carefully and will not be leaked.Ease of use    It is easy to use.    It is user-friendly.    It requires the fewest steps possible to accomplish what I want to do with it.    Both occasional and regular users would like it.    I can use it successfully every time.    The app is tedious.    I require written instructions to use it.    It is difficult to recover from mistakes.Satisfaction    I am satisfied with it.    It works the way I want it to work.    The app could be better.    The app wasn’t as satisfactory compared to other health apps.Feedback    Would you like to provide any other feedback on our system?The computational overhead introduced by our encryption system on storage and retrieval of eHealth information was tested with simple Advanced Encryption Standard (AES) encryption/decryption of similar text data. We carried out 20 test cases and measured the time taken for each test case. To carry out the tests, we used the ASUS Eee Pad Transformer Prime TF201 tablet with Android OS  to run oThe scalability tests measured the maximum load distribution our system can handle. This was done using a commercial scalability testing tool that made calls to the login and getdata methods of our cloud service. The tests showed that the maximum number of threads executed concurrently without the system becoming a bottleneck was 200. Tests were on an HP Notebook running Windows 8 with Intel Core i5 and 4GB RAM.We now provide a brief security risk analysis of our work.Insider attacks: Our protocol prevents insider attacks because the data are never fully decrypted in the untrusted cloud under any circumstance. The data remain encrypted at all times on the untrusted cloud servers as well as on untrusted public communication channels.User revocation: Revocation of a doctor from data access can be achieved efficiently without having to re-encrypt the data each time. The doctor’s key partition is simply removed from the cloud storage. This way, if the revoked doctor now attempts to access the health data, he will not be able to retrieve the full plaintext without the remaining key partition.Update secrecy: Because health data are constantly changing, patients may wish to update their health data. This is made possible in our protocol; as long as the updated version is encrypted with the same symmetric key that was used to encrypt the original health data, the patients may update their health data any number of times as they wish. This makes our solution feasible to be deployed in a real-world scenario.Mobile stealing: In the event someone steals the patient’s mobile phone, they will not be able to access the personal health information as they would need to know the patient’s credentials such as email id and password in order to access the mobile phone app. Hence, a patient does not need to be tied down to only one mobile phone device and can keep changing his device as often as he would like without any loss of personal health information.We used an automatic cryptographic verifier tool called ProVerif  to formaWe conducted a quantitative-based usability evaluation. From our trust and security results, 10 out of 15 participants (67%) had at least some concern over what others see when they post health-related information on the Internet. Out of 15 participants, 12 (80%) felt that their data would be kept private and secure when using our system and were also made more aware of the type of information that they may be exposing over the Internet. In regard to whether their personal information will be managed carefully and not leaked to the outside, nearly half of the participants agreed. Participants did mention that some form of training or a video demonstration would have communicated the security of the system a lot more effectively.From our ease-of-use responses, we found that 11 out of 15 participants (73%) found our system easy to use and learn, user-friendly, and were able to use it successfully, every time. However, 4 out of 15 participants (27%) did find the app a little “tedious” to work with initially, and required some instructions to understand the system a little better. Overall, the satisfaction of the app was mostly positive. Out of 15 participants, 13 (87%) were satisfied with our app and found that it worked in the way they wanted it to. However, most agreed that the app could have been improved. For instance, participants provided feedback that the app could have had a better-looking and much more intuitive interface.We also performed an identical usability evaluation with the 5 medical professionals. From our trust and security results, 2 out of 5 participants (40%) were strongly concerned about exposing health information over the Internet while the rest were partially concerned. After using our app, 4 out of 5 participants (80%) felt that the personal information they entered into the app would not be leaked to the outside. Results were mainly positive about feeling safer when using the system and being more aware of what they might be exposing to others on the network. In terms of feedback, participants reported that users would not understand the key process and that it might need to be accompanied with images, for better understanding. We needed to better showcase the trivial solution of data sharing, as described in the introduction, and how our system solves the issues of the solution. Another participant reported that the 2-part encryption was ideal.In terms of ease of use, 3 out of 5 participants (60%) agreed that the app required the fewest steps possible, in order for them to accomplish what they wanted to with the app. Results were also mostly positive, in terms of the app being user-friendly, easy to use, and the ability to use it successfully, every time. However, a few participants agreed that some form of written instructions was needed to make this app usable. Overall, medical professionals found our system satisfactory. Out of 5 participants, 4 (80%) found the app satisfactory and working in the way they wanted it to.Similar to the potential users, 2 out of 5 medical professionals (40%) also felt that the app could have been better. For instance, most of the feedback involved improving the user interface. Doctors reported that a notification system for the app would have been very handy. The notification system could pop up or beep and alert a patient when a doctor has provided feedback. For more serious medical problems, the notification system could forward the patient’s request to an emergency unit or mental health crisis team, in the event that the doctor cannot respond out of hours. Most doctors provided positive feedback about the security of the app. One participant noted that the 2-part encryption might be frustrating for older patients, and that such a system perfectly suits teenage patients.As a measure of performance, we tested the overhead introduced in our system, regarding the storage and retrieval of eHealth information, with simple AES encryption/decryption of similar text data. We carried out 20 test cases and measured the time taken for each test case. To carry out the tests, we used the ASUS Eee Pad Transformer Prime TF201 tablet  with AndIn our performance tests, we measured the overhead introduced by our system compared with a simple AES encryption and decryption operation. We first measured the overhead introduced by uploading the patient’s health data to the cloud server. The diagram clearly highlights the overhead of our system compared with a simple AES encryption solution. The mean time for the simple AES symmetric encryption was 0.18 seconds, with a standard deviation of 0.006 seconds. However, the mean time for the MindFeedback tests was 0.485 seconds, with a standard deviation of 0.09 seconds. The overhead is accounted for the additional encryption of the symmetric key, followed by the partial decryption of the symmetric key through the ElGamal encryption algorithm. There was also some network latency overhead.We also measured the overhead introduced by our protocol for the download or retrieval of the patient’s health data. As seen in the diagram, the system only had a slight overhead compared with a simple AES decryption operation. The mean time of the AES decryption tests was 0.001 seconds, with a standard deviation of 0.0003 seconds. The mean time of the MindFeedback download tests was 0.961 seconds, with a standard deviation of 0.332 seconds. Note that the patient’s encrypted key used to protect health data is first partially decrypted in the cloud server and then fully decrypted on the patient’s mobile phone. This is then followed by an AES symmetric decryption using the key on the mobile phone, thus accounting for the overhead.In the scalability tests, we measured the maximum load distribution that our locally deployed SOAP (Simple Object Access Protocol) Web service could handle. We used a scalability tool that made calls to the login and getData methods of our cloud service. The maximum number of threads we were able to run concurrently without the system becoming a bottleneck was 200. We carried out the tests on an HP Notebook running Windows 8 with Intel Core i5 and 4GB RAM.See The diagrams highlight the near-ideal bell curve distribution. Our system could withstand up to 200 concurrent calls to our Web service, which makes it more feasible for use in a real-world scenario.eHealth applications are a fast-growing segment in the technology market; however, privacy and security issues hinder the wide-scale adoption that patients can potentially benefit from. In this paper, we presented a solution that will enable patients to share their personal health information with doctors remotely while ensuring privacy and security.We then presented our system based on the encryption key partitioning algorithm that will enable patients and doctors to communicate with each other privately and securely. We leveraged mobile phones to provide greater convenience for patients. We carried out performance tests, usability tests, and scalability tests to show that our system is feasible to be deployed in a real-world scenario.Our performance tests were shown to be practical to be deployed in a real-world scenario, even after it introduced a slight overhead due to our security protocol. From the usability tests, we found that many users were concerned when they shared their personal health information online and that they felt safer when using our system. A majority of participants found our app easy to use and efficient but had provided feedback that it could be better. For example, the app could have had a notification system that beeped every time a doctor sent feedback to the patient or alert the emergency unit for more serious medical problems. In terms of scalability, our system was shown to withstand up to 200 concurrent calls to our locally run Web service, thus making it feasible to be deployed in a real-world scenario.One recommendation for further development is to remove the assumption that the doctor is trusted. That is, once the doctor is able to view the patient’s fully decrypted personal health information, she may then accidentally or inadvertently send the data to another doctor without the knowledge and/or permission of the patient. A solution could be developed to prevent unauthorized sharing of personal health information by authorized doctors. One way to do this would be to utilize an additional security token such that the health information can be viewed only if the security token is present in an authorized doctor’s device. Another way would be to perhaps encapsulate the personal health information in a secure data object and require that credentials be entered every time an authorized doctor requests access. Another recommendation for future work is to handle the scenario where a revoked doctor colludes with the social network. Currently, this will reveal the full key that will then allow the doctor to decrypt all of the personal health information stored by the patient on the social network.


Spatially separated entanglement is demonstrated by interfering two high-repetition squeezed pulse trains. The entanglement correlation of the quadrature amplitudes between individual pulses is interrogated. It is characterized in terms of the sufficient inseparability criterion with an optimum result of  Quantum entanglement is one of the most fundamental properties of quantum mechanics and plays an essential role for demonstrating Einstein, Podolsky, and Rosen (EPR) paradox2356910et al. rigorously defined the concept of quantum steeringA recent review of this field has summarized the relationship of the EPR paradox and Bell’s theorem. The experimental demonstration of the paradox differs from Bell’s inequality in that the former tests the incompatibility of local realism with the completeness of quantum mechanics, whereas the latter tests the incorrectness of local realism : the conclusions of the latter are stronger that of the formerIn recent years, there has been an effort to achieve loophole free EPR experiment taking advantage of the progress of experimental techniques151691056In this paper, the first step of the program is reported, namely, the time-domain observation of quantum correlations between individual entangled pulses with high repetition rate of 76 MHz and extension of the separation distance between Alice and Bob to achieve the causal separation criterion. This scheme has several advantages compared with previously reported pulsed entanglement experiments19204 (VAN) laser, operating at 1064 nm with a pulse duration of 7 ps and a pulse repetition rate of 76 MHz. Most of laser beam is directed to a second harmonic generator to produce 532 nm light to pump optical parametric amplifiers (OPAs), which are employed to generate quadrature amplitude squeezed pulse trains. It is important to maximize the mode matching between the local oscillator (LO) and the entangled beam. To do this, the LO pulses are obtained from a small portion of the laser emission. They are then passed through a single-mode periodically poled lithium niobate (PPLN) waveguide, which is used as the nonlinear material in the OPAs, to ensure proper spatial mode matching with the signal.A schematic diagram of our experiment is illustrated in π/2 and an observing visibility of (98 ± 1)%. Two squeezed pulse trains at 1064 nm are produced from single-pass OPAs pumped by the frequency-doubled laser pulses. Each OPA consists of a PPLN waveguide with a length of 5.0 mm and effective core area of 3 μm × 5 μm as the second-order nonlinear material. Squeezing of about 3.4 ± 0.2 dB below the shot noise limit is obtained over a bandwidth of 200 MHz. Entanglement can be stably observed during the whole measurement. Details of how the squeezed states are generated and measured can be found elsewhere19The entanglement is produced by combining two squeezed pulse trains at a 50/50 beam splitter (BS) with a relative phase of i = A or B) or the phase ηV = 0.92 ± 0.03 between each entangled beam and its homodyne LO beam. The quantum efficiencies of the photodiodes are measured to be ηD = 0.85 ± 0.03. Hence the overall detection efficiency is The output beams from the BS are sent to Alice and Bob who are spatially separated, and they are then interrogated in homodyne detectors (HDs) having a bandwidth of 200 MHz by mixing them with local oscillators (LOs). The common path arrangement is used in the interferometers, in which the entangled pulse and the LO collinearly propagated with orthogonal polarization. Due to this arrangement, the relative phase between the entangled pulse and the LO is moderately stabilized. Either the amplitude , an integrating time window of 13 ns is chosen. To achieve the causal separation criterion, each measurement should be independent of the adjacent ones, The inseparability criterion for an entanglement is related to their degree of quantum correlation. It is based on the variance of the difference and sum of a pair of canonical conjugates variable and can be written as2324A at Alice is fixed on measurement of one quadrature and the phase of LOB at Bob is simultaneously scanned.  When the two squeezed states are blocked, the HDs record the shot noise level, which is 7.5 dB above the amplifier noise. The sum and difference noise curves successively drop below the SNL. Taking the electronic noise of the HDs into account, a noise reduction of 2.0 ± 0.2 dB below the shot noise level for two beams is observed when the same quadrature is measured at both observer stations. However, that accounts for neither the detection efficiency nor propagation efficiency. The noise reduction is translated into correlation variance to get To investigate the entanglement correlation between Alice and Bob, they first are spatially separated by a distance of 20 cm. Note that this distance is much longer than the spatial pulse length of 2 mm that limits the minimum time needed to switch measuring quadrature amplitudes. Before interrogating the EPR correlation in the time-domain, we first checked the entanglement in the frequency domain. The subtraction and addition of the resulting photocurrents from the two sets of homodyne systems is recorded using a spectrum analyzer. The measured spectra for In the time-domain measurement, the quadrature values measured by Alice and Bob can be compared explicitly, in contrast to the variances of Positive and negative covariances represent correlation and anticorrelation, respectively. The correlation variance is using the afore-mentioned method. The correlation variance is These experiments constitute the first demonstration of entanglement with continuous variable that is sufficiently separated to verify the casual separation criterion. Such separation has been extensively discussed in the literature on entanglement with discrete variable and Bell’s inequalities. For two spatially separated subsystems at A and B, the causal separation criterion is specified by2L is the separation distance, c is the speed of light, tA and tB are the times of light from the source to positions A and B, and Δt is the independent measurement time interval. In experiment, it is not difficult to take equal distances from source to A and B; this means that tA = tB. Hence, the key of demonstrating causal separation is to separate two measurement stations at a distance of large enough than the cΔt. For experiments using a continuous wave light source, the independent measurement time interval Δt is relative not only to the measurement time (the bandwidth of the photodide) but also to the light coherence length. Hence, it is difficult to determine the measurement time interval for which successive measurements are independent and also measurements at different sites are correlated for continuous wave light. Fortunately, it is possible to limit it to lie within only the pulse duration when a pulsed laser is employed as the light source. In the worst case, the measurement time interval can be limited within the interval between successive pulses. The former result has shown that the measurement time interval can be made less than 13 ns. Hence, if two observers Alice and Bob are spatially separated by more than 4 m, the causal separation criterion will be achieved.where To strictly demonstrate EPR, the conditional variance between observers Alice and Bob should be such that measurement of either observable by Alice permits the inference of the same variable by Bob to better than the standard quantum limit. That is, the variance should satisfy the EPR criterion of In summary, we have demonstrated a spatially separated entanglement. It was characterized in terms of the inseparability criterion with an optimum result of How to cite this article: Zhang, Y. et al. Experimental realization of spatially separated entanglement with continuous variables using laser pulse trains. Sci. Rep.5, 13029; doi: 10.1038/srep13029 (2015).