ISO 17090-5:2017 医療情報学—公開鍵インフラストラクチャ—パート5：医療PKIクレデンシャルを使用した認証 | ページ 7

5 Scope of application

5.1 General

The healthcare information system authenticates healthcare organizations or professionals for access control to healthcare information, such as EHR or PHR.

Inappropriate process in end entity authentication verification may increase the risk of spoofing, impersonation, and many other identity-based attacks. As result, that may cause security incidents leading to critical information leakage and system and data misuse.

This document describes target systems, methods of identification, threats, vulnerabilities and controls of health software which authenticate using PKI based on the ISO 17090 series.

These controls decrease risks of spoofing.

5.2 Target systems

The target systems of this document are as follows:

• a) digital signature library with digital signature creation function and digital signature verification function for healthcare application;
• b) digital signature creation program and digital signature verification program as stand-alone software or with healthcare application.

Examples of authentication technology to which healthcare PKI can be applied are shown in Annex A.

The following are out of scope:

• healthcare application that does not process digital signature data directly;
• healthcare application that processes digital signature and the result of signature verification with digital signature library, specific digital signature program or specific digital signature verification program;
• application interface and user interface within client environment;
• cryptographic library layer, e.g. CSP or PKCS#11, and any subsequent token access layers as depicted in Figure 1.

Figure 1 illustrates an example of software layers for web-based applications. A digital signature based application may have the same structure. According to ISO 17090-3, it is assumed that “Storage modules of the end entity subscriber private key shall conform to standards of levels equal to or higher than US FIPS 140-2 level 1”. Therefore, in addition to the smart card, as illustrated in Figure 1, a system may use other tokens, such as a USB token or a software token, for the storage modules of the private key.

Figure 1—Example of processing layer

5.3 Phases of method identification

The authentication process with Healthcare Public Key Infrastructure (HPKI) is composed of three phases as shown in Figure 2: (1) the preparation phase, (2) the configuration phase, (3) and the authentication phase.

Figure 2—Relationship between the three phases of an authentication process with HPKI

Following the preparation phase, go through the configuration phase and proceed to the authentication phase. After that, the authentication phase is repeated.

• (1) Preparation phaseThe preparation phase is composed of two steps (see Figure 3):
  • (1-1): Certificate Authority creates a certificate for public key corresponding with the subscriber's private key stored on the secure token (smart card, etc.) as credential. (Requirement for smart token that has to conform with FIPS 140-2 level 1 or more and that requirement is possible for mobile devices. Detail of that is written in ISO 17090-3.).
  • (1-2): Certificate Authority issues the certificate to the subscriber.

5.4 Threats and vulnerabilities

Table 1 shows threats and vulnerabilities assumed in the authentication process with HPKI credentials. Bracketed terms are threats and vulnerabilities. Other sentences are explanation of bracketed terms.

Bibliography