1. Integrating the Healthcare Enterprise Improving Clinical Care: Enterprise User Authentication For IT Infrastructure Robert Horn Agfa Healthcare

2. Vendor Webex – October 2003 IHE Integration Profiles B The IHE Process – Integration Profiles IHE Integration Profiles: – Detailed selection of standards and options each solving a specific integration problem – A growing set of effective provider/vendor agreed solutions – Vendors can implement with ROI – Providers can deploy with stability Standards Easy to Integrate Products IHE Integration Profile A IHE Demonstration IHE Connectathon Product With IHE User Site RFP IHE Technical Framework

3. Vendor Webex – October 2003 Enterprise User Authentication (EUA) Profile Kerberos based support for single sign on Multi-year role out – This year: Kerberos Server Initial Login (username/password), Local system facilities HTTP Authentication – Next year: DICOM HL7 CCOW Connectathon focus

4. Vendor Webex – October 2003 Single Signon EUA contributes to creating a Single Signon Solution: EUA establishes a well known and trustable user identity mechanism EUA establishes a mechanism to extend the user identity to network messages, network transactions, and network connections. Only part of this is ready in the first year. EUA is being integrated with CCOW for application integration. EUA can be extended to a variety of user identification mechanisms.

5. Vendor Webex – October 2003 IHE Security Plans & Context future Basic Security DICOM TLS Basic Security Audit Trail EUA – HTTP Protocol EUA - CCOW EUA – HL7 EUA – DICOM Protocol EUA – Kerberos Server EUA – Initial Login TBD – IETF Audit TBD – Reliable Syslog EUA – other protocol? Kerberized Smart Cards Local Node Security Current IHE Plan IHE Activity, presently not scheduled Outside the SCOPE of IHE IHE supports, enhances, And coexists with these IHE Assumes that these have been provided IHE does not specify User Authorization Systems 2002200320042005 Basic Security HL7 TLS Legend: Private Network Security Node Authentication

6. Synergy between IHE IT Int. Profiles RID with EUA/CT & PIX Display Information Source Time Client Time Server Patient Identitifier Consumer Patient Identifier X-ref Manager Kerberos Authentication Server Client Authentication Agent Example of support of multiple actors/profiles 6

7. Vendor Webex – October 2003 Kerberos Authentication Kerberos Server “kinit” Cache Request TGT Response (contains TGT) application TGT Request Service ticket Response with Service Ticket Application server Protocol specific communication, using Service Ticket as authenticator Communication Initiated Initial username, password Single System Environment

8. Vendor Webex – October 2003 Kerberos Documentation Online – “Moron’s Guide”, http://www.isi.edu/gost/brian/security/kerberos.html – MIT Site http://web.mit.edu/kerberos/www/ – Various Microsoft support documents Hardcopy – Kerberos, Brian Tung, Addison Wesley – Various vendor manuals Configuration and API documentation – See Microsoft, Unix, or other vendor documentation.

9. Vendor Webex – October 2003 HTTP Authentication Client Authentication Agent HTTP Client HTTP Kerberized ServerKerberos Authentication Server Start HTTP Session HTTP Get – with no authentication. 401 response (WWW Authenticate: Negotiate) Get Kerberos Service Ticket Service Ticket HTTP Get – Kerberized Communication HTTP Response

10. Vendor Webex – October 2003 HTTP Documentation Standard (still in draft stage) – http://www.ietf.org/internet-drafts/draft- brezak-spnego-http-04.txt) http://www.ietf.org/internet-drafts/draft- brezak-spnego-http-04.txt Other documentation – http://support.microsoft.com/default.aspx?s cid=kb;ben-us;326985) http://support.microsoft.com/default.aspx?s cid=kb;ben-us;326985

11. Vendor Webex – October 2003 Protocols - DICOM DICOM Associations will convey user identification. User identified associations enables: – Better Audit logs – User specific customizations – User specific authorization Work Item approved, work underway

12. Vendor Webex – October 2003 Protocols - HL7 HL7 transactions will convey user identification. User identified associations enables: – Better Audit logs – User specific customizations – User specific authorization Work Item approved, work underway

13. Vendor Webex – October 2003 Protocols - CCOW EUA defines a CCOW identity space: – User.Id.Logon.Kerberos – This enables some single signon capabilities. CCOW exchange of service ticket information is a work item that is underway

14. Vendor Webex – October 2003 Fast User Switch First year, limited to single system Motivation: High startup times for system services, database connections, and other application services during normal system login. Customer requirement for fast user switching Solution: Initiate applications as a “null user” during system startup Utilize Context Manager and Kerberos Authentication Server to authenticate actual users Utilize Follow Context to switch user identities without incurring the high startup costs.

15. Vendor Webex – October 2003 Fast User Switch Kerberos Authentication Server Device with Fast User Switching User Context Participant Context ManagerClient Authentication Agent Join Context Switch to User A Change ContextUser A LoginFollow ContextUser B LoginChange ContextFollow Context Switch to User B

16. Vendor Webex – October 2003 Connectathon vs Demonstration The focus will be on using the connectathon to verify functionality. These features do not demonstrate very well, because when working properly they are invisible to the user.