05/06/2008kbele/cs5261 Role Based Secure Web Application Framework By Kunal Bele

05/06/2008kbele/cs5262 Outline of the talk  Motivation for the project  Earlier Work  About the Web-Application  Security  Basic Architecture  Features

05/06/2008kbele/cs5263 Motivation for the Project  Some web-based medical diagnosis services has secure requirements to protect patient data -Neuroguide project sponsored by PEAK Ageing with Dr. Sara Quall - HMTR project for rehab - HIPAA (Health Insurance Portability and Accountability Act ) Accountability Act )

05/06/2008kbele/cs5264 Earlier Work  Secure Information Sharing (SIS) project by Ganesh Godavari which utilized Attribute Certificates to Authenticate ROLE-based information.  ENgine FOR Controlling Emergent (ENforCE) Hierarchical Role-Based Access developed by Osama Khaleel in his Master’s Thesis.

05/06/2008kbele/cs5265 HIPAA Policies  HIPAA sets forth 3 main security policies 1. Administrative - Access to the health information must be restricted to only those employees who have a need for it to complete their job function. 2. Physical - Access to hardware and software must be limited to properly authorized individuals. 3. Technical - When information flows over open networks, some form of encryption must be utilized.

05/06/2008kbele/cs5266 Tools for the Project  Web Application – J2EE  Web Server – Apache Tomcat  Database – MySQL  Platform - Linux

05/06/2008kbele/cs5267 About the Web-Application  Application consists of the records of the patients & their diagnosis  Patient’s data to be stored securely (encrypted)  Data to be retrieved depending on the ROLE of the person retrieving the data  Other data to be kept encrypted/invisible

05/06/2008kbele/cs5268 Data Viewed  Patients – Only their own personal records  Doctors – All the records of all the patients  Research Assistants – Only the diagnosis

05/06/2008kbele/cs5269 The Framework The Framework  The Goal - Automating several encryption steps like getting client-key, setting attributes, encryption technique into an API.  Suggestions?

05/06/2008kbele/cs52610 Security  Two types of security:: - Username-Password based - Certificate based  Which one is more secure?

05/06/2008kbele/cs52611 Features  Data to be first encrypted & then to be stored in database. Hence, even if Database is hacked, no direct information retrieved.

05/06/2008kbele/cs52612 References  Osama Khaleel's Master Thesis Osama Khaleel's Master Thesis Osama Khaleel's Master Thesis  Secure Web Server with Client Certificate Authentication & Access – Dr. Chow Secure Web Server with Client Certificate Authentication & Access – Dr. Chow Secure Web Server with Client Certificate Authentication & Access – Dr. Chow  Rights of the Patients Rights of the Patients Rights of the Patients  HIPAA wiki HIPAA wiki HIPAA wiki