Security Matters                                                         return to homepage


FEEDBACK   Please click here to add your comments

Issue Details Who Date
1.1 Draft A Initial Writing C. Fraser 16 December 1998
       
       

Littlefish  will limit access to authorised  users. All access will require appropriate security to protect the data and ensure confidentiality. The security will be controlled on multiple levels including network, applications, provider, and patient without requiring multiple log-ins. This security will be accomplished with:

IDs and passwords

Multiple communication firewalls for network traffic (e.g., TCP/IP provider)

Encryption technologies including digital signatures and authorisations

Dial-up/dial-back user certification

Support encryption.   Littlefish    will protect the message and authenticate the sending party by using the open encryption standard called RSA, which uses both public and private keys. An open standard allows all networks and software vendors to interact much more easily. To support this environment,   Littlefish   also must provide key management. NB Technologies that provide proprietary solutions will be avoided at all costs. (See Comments below)

System Usability

the user interface will have :

Key features/standard elements of the user interface -

Any features that enhance the usability of the system;

Availability of online manuals/help information;

Error message formats;

Screen navigation features and access methods.

 

Operational Performance

The system must be able to operate both in standalone and multi-user and environments; should support remote access via dial-in facilities; and preferably allow operation of a selected subset of functions on a portable PC including the necessary data transfers to support this style of operation.

Littlefish   will be deployed as a freely distributable basis so the programme can be purchased from vendors and copied without restriction. By doing this it is highly probable that usage of the software will rise quickly. It will operate in both stand-alone and multi-user environments and will be able to support remote access dial in facilities. We would add the smart-card feature so that only recognised users with the correct passwords could access the system and make changes to the information. The data would not be allowed out of the parent database.

Littlefish   must provide reasonable response times.

Year 2000

Littlefish  must meet leap year and Year 2000 compliance standards.

Portability and Scalability of Littlefish 

Littlefish  should be reasonably portable/scalable to cater for system growth or additional functional requirements that may arise in the future.

Littlefish  will work under all environments and will be portable and scalable

Flexibility

The Local Health service will be able to tailor  Littlefish   to their requirements without restriction whilst the underlying logic will ensure data integrity. They would be obliged to offer the new features back to the source pool so that others may benefit from their enhancements.

Open Communications Network.

Littlefish  will have the capability to provide an open, but highly secure, computer communications network among all health care providers, health plans, employers, government entities, and other organisations.

Each individual health service will decide which features it wishes to utilise

return to homepage

FEEDBACK  Please click here to add your comments

 

Comments

  I think you should update this to remove the use of RSA which is currently a patented solution only free for noncommercial use.  While the RSA patents will expire by 2002, the Internet community, via the IETF, has already put together suites of  security technology that are currently not patent encumbered.    Some of  the relevant standards are IPsec (for creating VPN's), TLS for creating secure channels and PKIX for creating public key systems.  Open source reference implementations should also be available.  The most interesting TLS
compatible system is the OpenSSL project which has gone beyond the RSA base in SSL to the new base (Diffie-Hellman, Blowfish, DES) of TLS
.
                                                                                                                      Wayne Wilson  28 May 1999