DIGITALLY SIGNING DATA. Cihan Biyikoglu Program Manager HealthVault Core Platform

Size: px

Start display at page:

Download "DIGITALLY SIGNING DATA. Cihan Biyikoglu Program Manager HealthVault Core Platform Cihan.Biyikoglu@microsoft.com"

Kristina Melton
8 years ago
Views:

1 DIGITALLY SIGNING DATA Cihan Biyikoglu Program Manager HealthVault Core Platform

2 Session Objectives Find out how to guard data against tampering and repudiation using digital signatures. Understand built-in support for digitally signing data in Healthvault.

3 Session Outline 1. Overview 2. Signing and Validation 3. Future Improvements 4. Conclusion & QA

4 Session Outline 1. Overview 2. Signing and Validation 3. Future Improvements 4. Conclusion & QA

5 Overview Digital Signatures in Healthvault What is a digital signature? The encrypted cryptographic hash of the data to provide evidence that data has not been tampered with and origin of the data is verifiable. For Instance: Clinic#1 signs the medication data before it is submitted to Healthvault. Pharma#2 retrieves the medication and validates the signature to ensure 1. Clinic#1 was the one who signed the data & 2. Data has not been tampered with.

6 Overview How does signing work? Signing Document Hash Digest Encrypt Signature Signed Document Appended Document

7 Overview cont. How does signing work? Validation Signed Document Document Hash Digest Signed Document Signature Decrypt Digest?

8 Overview cont. Signature Attributes in Healthvault W3C specification with the following requirements

9 Session Outline 1. Overview 2. Signing and Validation 3. Future Improvements 4. Conclusion & QA

10 Digitally Signing Data HealthRecordItem.Sign() or ItemTypes.type.Sign() Signs the item using an X509 certificate. // Pharma#1 grabs the cert out of the machine cert store X509Store store = new X509Store(StoreLocation.LocalMachine); store.open(openflags.readonly); X509Certificate2 cert = store.certificates.find(x509findtype.findbyserialnumber, "5a 9a bb ae 7d e0 37 6c d0 ", true)[0]; //Pharma#1 grabs a new medication Microsoft.Health.ItemTypes.Medication med = new Medication(); //fill out the properties med.blah = new blah(); //Pharma#1 sign the medication item med.sign(cert); //Pharma#1 add the signed item to the health record PersonInfo.SelectedRecord.NewItem(med);

11 Signature Validation at Creation <Signature xmlns=" <SignedInfo> <CanonicalizationMethod Algorithm=" /> <SignatureMethod Algorithm=" /> <Reference URI=""> <Transforms> <Transform Algorithm=" <xs:transform xmlns:xs=" version="1.0"> <xs:template match="thing"> <xs:copy-of select="data-xml" /> <xs:value-of select="data-other" /> </xs:template> </xs:transform> </Transform> </Transforms> <DigestMethod Algorithm=" /> <DigestValue> lkj=)hwjdafjnawki3ce=</digestvalue> </Reference> </SignedInfo> <SignatureValue> <KeyInfo> <X509Data> <X509Certificate> MIIEASDFHRNEWhsafhjWENRKHJSADFIUWEKRHADWM</X509Certificate> </X509Data> </KeyInfo> </Signature>

12 Validating Signed Data HealthRecordItemSections.Signature Digital signature is stored in the Signature section of the item. HealthRecordSearcher searcher = PersonInfo.SelectedRecord.CreateSearcher(); HealthRecordFilter filter = new HealthRecordFilter(typeID); //add the signature section to retrieve the signature with the items //All does include HealthRecordItemSections.Signature; filter.view.sections = HealthRecordItemSections.All; //add the filter to the searched searcher.filters.add(filter); //retrieve items HealthRecordItemCollection items = searcher.getmatchingitems()[0];

13 Validating Signed Data cont. HealthRecordItem.ValidateCertificate() Verifies the Certificate is still valid. //Pharma#2 verify certificate stored in HealthRecordItemSignatures is valid med.validatecertificate(); HealthRecordItem.IsSignatureValid() Validates the signature for the health record item. //Pharma#2 check to see if there is a signature on the object. if (med.healthrecorditemsignatures.count >0) //validate signature isvalid = med.issignaturevalid();

14 Viewing Signed Data Remember: Edits to the core data invalidates the signature.

15 Session Outline 1. Overview 2. Signing and Validation 3. Future Improvements 4. Conclusion & QA

16 Future Improvements Improvements to Java SDK Improvements to Blob handling in core platform

17 Conclusion Digital Signatures provide a great way to protect integrity of critical health data. HealthVault.Net SDK provides great ease of use.

18 Q&A Questions? Also Visit: Look into the Future with Healthvault 5:00 6:00 in

2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.

20 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Personal Secure Email Certificate

Entrust Certificate Services Personal Secure Email Certificate Enrollment Guide Date of Issue: October 2010 Copyright 2010 Entrust. All rights reserved. Entrust is a trademark or a registered trademark