Security and Data Sharing Interaction SDSC Auditorium Friday 830a-1000am

Stuff User IP Access Control Audit Trail IRB

User’s Local IRB BIRN Web/Portal 1. User gets instructions on how to become an authorized user and template forms for user’s local IRB 2. User submits paperwork to local IRB Becoming an Authorized BIRN User 3. Local IRB can verify BIRN policies independently of user’s statements 4. User get local IRB approval (User cannot proceed without local IRB approval) 5. User begins new user process through online interface. User submits all required BIRN paperwork and local IRB information to BIRN Registration Authority coordinator. Who is BIRN RA coordinator? Can paperwork be submitted electronically via digital signature? BIRN RA Coordinator 7. BIRN RA Coordinator receives information on new user. User’s Local Lab 8b. BIRN RA coordinator verifies the location, position and affiliation of user with user’ local institution/lab. Can this be done electronically for groups/labs that BIRN already interacts with? 8a. BIRN RA coordinator verifies identity of user. Can this be done electronically via VTC? What measures need to be taken to assure that verification meets certificate authority policies? 8c. BIRN RA coordinator verifies user’s IRB approvals with user’s local IRB. Can this be done electronically? BIRN Registration Authority 10. BIRN RA Coordinator informs user of account verification status. 11. User validates his account by providing private key. How do we do this securely? How does user get information for “logging in” to system - a phone call, over VTC? 9. BIRN RA Coordinator validates new user. 6. BIRN RA receives user information. BIRN Certificate Authority 12. BIRN RA contacts CA to obtain user credentials (i.e. X.509 certificate) BIRN Secure LDAP (Certificate Escrow) 13a. User credentials placed in escrow so that proxy certificates can be generated for user as required. 13b. User information deposited to LDAP.

Data Sharing Task Force Meeting schedule and venue List of tasks Milestones

Tasks Generate forms to be completed by new BIRN user (guest + sponsor) (Jessica) Determine if BIRN-CC can be the holder of the IRB for the BIRN distributed data resources (Ellisman), if not, then who (Randy) Create detailed IRB protocol to support submission Complete IRB/IACUC template language for BIRN data upload including consent Complete IRB template language for BIRN data download (IP?) Generate policy for classes of users (Maryanne, Kelvin) Generate policy for classes of data sharing (individual, partial testbed, testbed, other) Generate policy for setting access control on data (IRB, IP)