Presentation is loading. Please wait.

Presentation is loading. Please wait.

Identity Federation in Healthcare Networks Xiaohui Chen Department of Computer Science University of Virginia.

Published by Modified over 9 years ago

Similar presentations

Presentation on theme: "Identity Federation in Healthcare Networks Xiaohui Chen Department of Computer Science University of Virginia."— Presentation transcript:

1 Identity Federation in Healthcare Networks Xiaohui Chen Department of Computer Science University of Virginia

2 Department of Computer Science, University of Virginia 2 Agenda  Introduction  Current Efforts  System Design  System Implementation  Demo  Conclusions and future work

3 Department of Computer Science, University of Virginia 3 Introduction  What is identity? The distinguishing characteristic or personality of an individual  Why is identity important? All the important things you do require your identity  Why has identity become a problem? Enterprise side Personal side

4 Department of Computer Science, University of Virginia 4 Introduction  Our proposed solution “ Identity Federation ” “ The agreements, standards, and technologies that make identity and entitlements portable across autonomous domains ”

5 Store cookie Initial login Authorization decision Authorization request Request authentication token Data request + authentication token Return generated token Authorization Rules Data http://cs.virginia.edu/tl#TrustLevelToken http://cs.virginia.edu/TrustLevelSTS.asmx 2.5 Authorization Web Service (Authorization Engine ) Medical Data PortalAncillary Services Pharmacy Insurance Billing Clinics Authentication Web Service (Secure Token Service) WS-Policy Data Repository and Web Service Fingerprint Scanner HP5550..... IsAttending == true TrustLevel %gt;= Fingerprint..... Trust Establishment and Federation Signaturee-TokenRFID WSE 2.0

6 Department of Computer Science, University of Virginia 6 Current Efforts  OASIS and SAML  Microsoft, IBM and WS-Roadmap  Liberty Alliance .NET Passport  Shibboleth

7 Department of Computer Science, University of Virginia 7 System Design  Identity Federation by inter-domain identity mapping through anonymous token/attribute exchange via Token Exchange Service  Why choose this design?

8 Department of Computer Science, University of Virginia 8 System Design  Key Ideas: Identity establishment/management with strong authentication Trust establishment between domains Universal identity with inter-domain identity mapping and attribute mapping Inter-domain security information exchange via Token Exchange Server Privacy protection – pseudonym, attribute exchange Request forwarding for web single sign-on

9 Department of Computer Science, University of Virginia 9 System Design  Strong authentication Biometric Non-biometric Two factors  Trust levels Numerical Comparable

10 Department of Computer Science, University of Virginia 10 System Design  Identity mapping One-to-one Many-to-one One-to-many Pseudonym John@hospital.comJohn@pharmacy.com Tom@hospital.comguest@pharmacy.com 54087@hospital.com

11 Department of Computer Science, University of Virginia 11 System Design  Attribute mapping Any security information can establish meaningful mappings between domains along with a user ’ s identity, e.g. trust level mapping, role mapping, privilege mapping … Standard attribute names

12 Department of Computer Science, University of Virginia 12 System Design  Trust Relation Setup Defined by policy files Administrated by authority With whom to federate identity? How to federate identity?

13 Department of Computer Science, University of Virginia 13 System Design  Inter-domain security information exchange Heterogeneous systems have different security information formats Attribute exchange via standard web service interface Standard token formats – SAML, WS- Trust  Single-Sign-On

14 Department of Computer Science, University of Virginia 14 System Design  Security Token Service  Token Exchange Service  Trust Authority

15 Department of Computer Science, University of Virginia 15 System Design

16 Department of Computer Science, University of Virginia 16 System Design  Security Token Service WSE2.0 based Attribute extension  Trust level  Location  Time  Role Identity Federation extension  Inter-domain request control  Endpoint for inter-domain security information exchange with web service  Identity and attribute mapping

17 Department of Computer Science, University of Virginia 17 System Design  Token Exchange Service Facilitates inter-domain security information exchange with request forwarding Automatic directory lookup Trust broker Define standard attribute names

18 Department of Computer Science, University of Virginia 18 System Design  Trust Authority Manages inter-domain trust relationship Publishes domain information Defines attributes provided Defines services provided

19 Department of Computer Science, University of Virginia 19 System Design

20 Department of Computer Science, University of Virginia 20 System Implementation  Three trust domains Medical portal – hospital Pharmacy portal – pharmacy News portal – MSN  Related services Security token service Trust authority Token Exchange Service

21 Department of Computer Science, University of Virginia 21 System Implementation  Medical Portal Authentication and authorization Medical data management Doctor/Patient portal service Electronic prescription management/submission via active federation Event alert system

22 Department of Computer Science, University of Virginia 22 System Implementation  Pharmacy Portal Structurally the same as hospital portal Electronic prescription management Automatically sends/receives prescription information to hospital via active federation

23 Department of Computer Science, University of Virginia 23 System Implementation  Mock MSN Portal Represents a third party news portal Federates identity with hospital portal Web Single-Sign-On

24 Department of Computer Science, University of Virginia 24 Demo  Trust Level  Alerts with active federation  Federation between MSN and hospital

25 Department of Computer Science, University of Virginia 25 Conclusion  Identity federation with user identity mapping between domains is flexible, maintainable and powerful  Token Exchange Service with web service security information exchange successfully hides local security system implementation  Trust authority with domain information publishing is a practical way to administrate trust relationship  Levels of authentication provide one way to evaluate identity trustworthiness across domains  Identity federation with Single Sign-On successfully alleviates the identity crisis

26 Department of Computer Science, University of Virginia 26 Future Work  Fully automatic trust negotiation and establishment  More powerful attribute exchange/evaluation algorithm to protect user privacy  Become SAML compliant  Standards other than Microsoft and IBM ’ s WS-X  Integration with other federation approaches

27 Department of Computer Science, University of Virginia 27 Publications  Xiaohui Chen and Alfred C. Weaver, Identity Federation in Federated Trust Healthcare Network, Submitted to XXXXIdentity Federation in Federated Trust Healthcare Network  Alfred C. Weaver, Samuel J. Dwyer III, Andrew M. Snyder, James Van Dyke, James Hu, Xiaohui Chen, Timothy Mulholland, Andrew Marshall, Federated, Secure Trust Networks for Distributed Healthcare IT Services, IEEE International Conference on Industrial Informatics, Banff, Alberta, Canada, August 2003Federated, Secure Trust Networks for Distributed Healthcare IT Services  Junzhe Hu and Alfred C. Weaver, A Dynamic, Context- Aware Security Infrastructure for Distributed Healthcare Applications, Pervasive Privacy Security, Privacy, and Trust (PSPT2004), Boston, MA, August, 2004A Dynamic, Context- Aware Security Infrastructure for Distributed Healthcare Applications,  Alfred C. Weaver, Enforcing Distributed Data Security via Web Services, Workshop on Factory Communications (WFCS2004), Vienna, Austria, September 21-24, 2004Enforcing Distributed Data Security via Web Services,

Download ppt "Identity Federation in Healthcare Networks Xiaohui Chen Department of Computer Science University of Virginia."

Similar presentations

Creating HIPAA-Compliant Medical Data Applications with Amazon Web Services Presented by, Tulika Srivastava Purdue University.

Creating HIPAA-Compliant Medical Data Applications with Amazon Web Services Presented by, Tulika Srivastava Purdue University.
NRL Security Architecture: A Web Services-Based Solution

NRL Security Architecture: A Web Services-Based Solution
Policy Based Dynamic Negotiation for Grid Services Authorization Infolunch, L3S Research Center Hannover, 29 th Jun. 2005 Ionut Constandache Daniel Olmedilla.

Policy Based Dynamic Negotiation for Grid Services Authorization Infolunch, L3S Research Center Hannover, 29 th Jun Ionut Constandache Daniel Olmedilla.
Eunice Mondésir Pierre Weill-Tessier 1 Federated Identity with Ping Federate Project Supervisor: M. Maknavicius-Laurent ASR Coordinator: G. Bernard ASR.

Eunice Mondésir Pierre Weill-Tessier 1 Federated Identity with Ping Federate Project Supervisor: M. Maknavicius-Laurent ASR Coordinator: G. Bernard ASR.
Federated Digital Rights Management Mairéad Martin The University of Tennessee TERENA General Assembly Meeting Prague, CZ October 24, 2002.

Federated Digital Rights Management Mairéad Martin The University of Tennessee TERENA General Assembly Meeting Prague, CZ October 24, 2002.
SIM403. Claims Provider Trust Relying Party x Relying Party Trust Claims Provider Trust Your ADFS STS Partner ADFS STS & IP Relying Party Trust Partner.

SIM403. Claims Provider Trust Relying Party x Relying Party Trust Claims Provider Trust Your ADFS STS Partner ADFS STS & IP Relying Party Trust Partner.
Identity Management Based on P3P Authors: Oliver Berthold and Marit Kohntopp P3P = Platform for Privacy Preferences Project.

Identity Management Based on P3P Authors: Oliver Berthold and Marit Kohntopp P3P = Platform for Privacy Preferences Project.
Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Andrew Stone Common Security.

Copyright © 2008 Accenture All Rights Reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Andrew Stone Common Security.
Massachusetts: Transforming the Healthcare Economy John D. Halamka MD CIO, Harvard Medical School and Beth Israel Deaconess Medical Center.

Massachusetts: Transforming the Healthcare Economy John D. Halamka MD CIO, Harvard Medical School and Beth Israel Deaconess Medical Center.
Environmental Council of States Network Authentication and Authorization Services The Shared Security Component February 28, 2005.

Environmental Council of States Network Authentication and Authorization Services The Shared Security Component February 28, 2005.
Dorian Grid Identity Management and Federation Dialogue Workshop II Edinburgh, Scotland February 9-10, 2006 Stephen Langella Department.

Dorian Grid Identity Management and Federation Dialogue Workshop II Edinburgh, Scotland February 9-10, 2006 Stephen Langella Department.
T-110.5140 Network Application Frameworks and XML Service Federation 30.04.2007 Sasu Tarkoma.

T Network Application Frameworks and XML Service Federation Sasu Tarkoma.
Beispielbild Shibboleth, a potential security framework for EDIT Lutz Suhrbier AG Netzbasierte Informationssysteme (http://www.ag-nbi.de)http://www.ag-nbi.de.

Beispielbild Shibboleth, a potential security framework for EDIT Lutz Suhrbier AG Netzbasierte Informationssysteme (
 Key exchange o Kerberos o Digital certificates  Certificate authority structure o PGP, hierarchical model  Recovery from exposed keys o Revocation.

 Key exchange o Kerberos o Digital certificates  Certificate authority structure o PGP, hierarchical model  Recovery from exposed keys o Revocation.
Information Resources and Communications University of California, Office of the President UCTrust Implementation Experiences David Walker, UCOP Albert.

Information Resources and Communications University of California, Office of the President UCTrust Implementation Experiences David Walker, UCOP Albert.
1 Federated, Secure Trust Networks for Distributed Healthcare IT Services Alfred Weaver Samuel Dwyer Andrew Snyder Jim Van Dyke Tim Mulholland James Hu.

1 Federated, Secure Trust Networks for Distributed Healthcare IT Services Alfred Weaver Samuel Dwyer Andrew Snyder Jim Van Dyke Tim Mulholland James Hu.
A Primer on Healthcare Information Exchange John D. Halamka MD CIO, Harvard Medical School and Beth Israel Deaconess Medical Center.

A Primer on Healthcare Information Exchange John D. Halamka MD CIO, Harvard Medical School and Beth Israel Deaconess Medical Center.
1 July 2005© 2005 University of Kent1 Seamless Integration of PERMIS and Shibboleth – Development of a Flexible PERMIS Authorisation Module for Shibboleth.

1 July 2005© 2005 University of Kent1 Seamless Integration of PERMIS and Shibboleth – Development of a Flexible PERMIS Authorisation Module for Shibboleth.
Esri UC2013. Technical Workshop. Technical Workshop 2013 Esri International User Conference July 8–12, 2013 | San Diego, California Building Secure Applications.

Esri UC2013. Technical Workshop. Technical Workshop 2013 Esri International User Conference July 8–12, 2013 | San Diego, California Building Secure Applications.
SIM205. (On-Premises) Storage Servers Networking O/S Middleware Virtualization Data Applications Runtime You manage Infrastructure (as a Service)

SIM205. (On-Premises) Storage Servers Networking O/S Middleware Virtualization Data Applications Runtime You manage Infrastructure (as a Service)

Similar presentations

Ads by Google