HERO-Crates (Hybrid Encrypted Research Object Crates) a secure method for storing and sharing sensitive metadata

Research Object Crates (RO-Crate) are a method for communicating metadata for research repositories and workflows that are becoming more widely adopted. They allow for clear, human and machine readable metadata designed to enable FAIR (Findable, Accessible, Interoperable, Reusable) research. Despite their use in sensitive research fields there is no standard for protection of sensitive metadata within an RO-Crate. Our instrument data service required a metadata storage format that was capable of protecting sensitive health metadata. We developed a method for granular encryption of any given metadata element that preserves the RO-Crate s flexible standard. This was accomplished by using GnuPG to collate and encrypt metadata entries that can be embedded into PGP encrypted blocks within the RO-Crate format. These blocks can be seamlessly re-inserted back into the RO-Crate upon decryption. With this method we are able to use RO-Crates as a secure recovery format. With secure RO-Crates metadata including sensitive health data can be ingested, stored and exported in an end-to-end secure manner. Only those with the permission to read this information are able to make use of it while the rest of the RO-Crate remains intact. By relying on GnuPG, encryption and signing is straightforward and available to almost any user on any system. As the encrypted blocks are integrated into the RO-Crate they can be linked directly to identities, governance standards and ethics policies. This opens up a world where RO-Crates can be used to store and communicate secure information and workflows while adhering to FAIR research principles.