1. 11-Feb-14HL7 Working Group Meeting – October 2002 XML Web Services Standards Roberto Ruggeri rruggeri@microsoft.com Healthcare Technical Strategist Microsoft Corporation Mark Oswald markosw@microsoft.com Principal Consultant Microsoft Corporation

2. 2 11-Feb-14HL7 Working Group Meeting – October 2002 Objectives of This Presentation Educate on WS-Standards WS-Standards design philosophy WS-Standards overview Drill down on WS-Security Educate on the industry efforts around WS-Standards Interoperability What is coming Discuss next steps

3. 3 11-Feb-14HL7 Working Group Meeting – October 2002 Web Services Architecture Extending the Foundation SOAP (Logical Messaging Model) XML, Encoding, and Transports Foundation WSDL and UDDI (Web Services Description and Directory) DescriptionAttachmentsRoutingSecurity PrivacyExtendedFoundationSecure,Reliable,TransactedFederation Reliable Messaging Transactions

4. 4 11-Feb-14HL7 Working Group Meeting – October 2002 WS-* Standards Design Principles Modular and composable Factored to stand alone or work together General-purpose Agnostic to place it is running or originated Federated No central point of administration, control, failure Standards-based Multi-vendor interoperation critical 4

5. 5 11-Feb-14HL7 Working Group Meeting – October 2002 Modular Provides a framework for SOAP/WSDL extensibility These protocols augment domain-specific protocols (e.g., healthcare) Designed to supercede and integrate with many of the industry specs today Defined by composable SOAP headers and SOAP message The specifications combined for end-to-end capabilities

6. 6 11-Feb-14HL7 Working Group Meeting – October 2002 Modular: Example <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <tru:StockSymbol xmlns:tru="http://tickers-r-us.org/payloads"> QQQ <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> http://tickers-r-us.org/getQuote soap://tickers-r-us.org/stocks mailto:johnsmith@isps-r-us.com uuid:84b9f5d0-33fb-4a81-b02b-5b760641c1d6 <tru:StockSymbol xmlns:tru="http://tickers-r-us.org/payloads"> QQQ SOAPMessage Security and License Routing <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <wssec:credentials xmlns:wssec="http://schemas.xmlsoap.org/ws/2001/10/security"> <wslic:binaryLicense xmlns:wslic="http://schemas.xmlsoap.org/ws/2001/10/licenses" wslic:valueType="wslic:x509v3" xsi:type="xsd:base64Binary"> dWJzY3JpYmVyLVBlc…..eFw0wMTEwMTAwMD <tru:StockSymbol xmlns:tru="http://tickers-r-us.org/payloads"> QQQ <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> http://tickers-r-us.org/getQuote soap://tickers-r-us.org/stocks mailto:johnsmith@isps-r-us.com uuid:84b9f5d0-33fb-4a81-b02b-5b760641c1d6 <wssec:credentials xmlns:wssec="http://schemas.xmlsoap.org/ws/2001/10/security"> <wslic:binaryLicense xmlns:wslic="http://schemas.xmlsoap.org/ws/2001/10/licenses" wslic:valueType="wslic:x509v3" xsi:type="xsd:base64Binary"> dWJzY3JpYmVyLVBlc…..eFw0wMTEwMTAwMD <tru:StockSymbol xmlns:tru="http://tickers-r-us.org/payloads"> QQQ

7. 7 11-Feb-14HL7 Working Group Meeting – October 2002 General-Purpose Universal communications Across organizations Across machines Across process Flexible communications Extensible headers Extensible body Transport protocol neutral Platform neutral Devices Desktops Clusters Datacenters Application category neutral Enterprise Application Integration Business-to-Business Business-to-Consumer Peer-to-Peer Applies to HL7 2.x, 2.XML, v3.0, CDA, CCOW, X12N (HIPAA)

8. 8 11-Feb-14HL7 Working Group Meeting – October 2002 Federated Fully distributed Crosses organization and trust domains Can be inspected by firewalls Does not require centralized servers or administration Will sometimes require edge software to do protocol translation, security work, routing, etc.

9. 9 11-Feb-14HL7 Working Group Meeting – October 2002 Standards-Based Industry commitment to Publishing specifications Working with partners to refine specifications Working with partners, customers, and standards bodies for broad adoption Different standards bodies for different specs, based on the spec

10. 10 11-Feb-14HL7 Working Group Meeting – October 2002 Interop Priority WS-i.org An open industry effort Industry initiative focused on promoting Web services interoperability Organization formed by industry leaders Open membership and participation Based on partnerships Symbiotic relationship with other standards organizations through integration of their outputs Goal: Enable interoperability across platforms, applications, and programming languages Success will accelerate adoption and deployment of Web services

11. 11 11-Feb-14HL7 Working Group Meeting – October 2002

12. So, What Has Been Delivered To Date?

13. 13 11-Feb-14HL7 Working Group Meeting – October 2002 WS-Routing Submitted to W3C A SOAP-based, stateless protocol for exchanging one-way SOAP messages from an initial sender to the ultimate receiver, potentially via a set of intermediaries Also provides an optional reverse message path enabling two-way message exchange patterns like: Request/response Peer-to-peer conversations Return of message acknowledgements, faults

14. 14 11-Feb-14HL7 Working Group Meeting – October 2002 DIME And WS-Attachments Submitted to IETF Direct Internet Message Encapsulation (DIME) A lightweight, binary message format that can be used to encapsulate one or more application-defined payloads of arbitrary type and size into a single message construct Each payload is described by a type, a length, and an optional identifier WS-Attachments is how to encapsulate SOAP in DIME

15. 15 11-Feb-14HL7 Working Group Meeting – October 2002 WS-Security Submitted to OASIS A specification for proposed SOAP extensions to be used when building secure Web services. Supercedes the following specifications SOAP-SEC Microsofts WS-Security, WS-License IBMs security token and encryption Dependent upon XML DIGSIG, XML Encryption, XML Schema, SOAP… End-to-end message-level security Defined schema Designed to be composed with other Web service protocols

16. 11-Feb-14HL7 Working Group Meeting – October 2002 A Couple of Details…

17. 17 11-Feb-14HL7 Working Group Meeting – October 2002 New SOAP Elements WS-Security New Header SOAP:actor is optional One header per actor All security information together Including and referencing security tokens Existing XML Signature XML Encryption Token formats (e.g., X.509, Kerberos, XrML, SAML)

18. 18 11-Feb-14HL7 Working Group Meeting – October 2002 Simple Example Requesting a stock quote Security token indicates username Signature uses key generated from password

19. 19 11-Feb-14HL7 Working Group Meeting – October 2002 Simple Example (1 of 2) (001) (002) (003) (004) (005) http://fabrikam.org/getQuote (006) http://fabrikam.org/stocks (007) uuid:84b9f5d0-33fb-4a81-b02b-5b760641c1d6 (008) (009) (010) (011) Zoe (012) (013) (014) (015) (016)

20. 20 11-Feb-14HL7 Working Group Meeting – October 2002 Simple Example (2 of 2) (017) (018) (019) LyLsF0Pi4wPU... (020) (021) (022) DJbchm5gK... (023) (024) (025) (026) (027) (028) (029) (030) (031) (032) QQQ (033)

21. 11-Feb-14HL7 Working Group Meeting – October 2002 Whats Coming?

22. 22 11-Feb-14HL7 Working Group Meeting – October 2002 Security Roadmap Specs Federated security Authentication and authorization Security protocol independent Brokered (aka Transitive) trust Security PrivacyTrustPolicy AuthorizationFederationSecureConversation SOAP Foundation Today

23. 23 11-Feb-14HL7 Working Group Meeting – October 2002 Messaging Includes WS-Routing in family Routing virtualizes the network Transport-independent addressing End-to-end versus hop-by-hop model Reliable Messaging model multi-message conversations Resilient in face of multi-hop routing Supports multiple QOS levels (e.g. in order, no duplicates, etc.)

24. 24 11-Feb-14HL7 Working Group Meeting – October 2002 Transactions And Coordination Models distributed agreement in terms of transactions Short-lived transactions use two-phase commit Common in DBMS and OLTP worlds Long-lived/x-trust-domain transactions use coordinated compensation Common in workflow/EAI world

25. 25 11-Feb-14HL7 Working Group Meeting – October 2002 Business Processes Business Process Execution Language (BPEL4WS) Proposed by the Microsoft, IBM and BEA Built on top of WS-Transactions A language for formally describing interoperable business processes and business interaction protocols In short, it is a language for enabling the orchestration of web services to specify business processes Supercedes XLANG (MS) and WSFL (IBM)

26. 26 11-Feb-14HL7 Working Group Meeting – October 2002 Work with horizontal standards Restrict the domain by limiting the scope and imposing additional policies Provide feedback to the standards to improve healthcare friendliness Benefit from widely available technologies On many platforms Many implementations on the same platform Vendors investing big $$$ How do WE Take Advantage MLLP ebXML (EBMS) WS-*FTP/SS/MIMEHTTP/S HL7 v2.xHL7 v2.XMLCDAHL7 v3 … … Payload Transport

27. 27 11-Feb-14HL7 Working Group Meeting – October 2002 Next Steps… POC @ HIMMS 2003 More in-depth analysis and evaluation Inside one of the current SIGs Web Services SIG (?) Work with WS-I to leverage the work done for conformance and interoperability

28. 11-Feb-14HL7 Working Group Meeting – October 2002 Discussion