Security Analysis of Standards-Driven Communication Protocols for Healthcare Scenarios

Abstract

The importance of the Electronic Health Record (EHR), that stores all healthcare-related data belonging to a patient, has been recognised in recent years by governments, institutions and industry. Initiatives like the Integrating the Healthcare Enterprise (IHE) have been developed for the definition of standard methodologies for secure and interoperable EHR exchanges among clinics and hospitals. Using the requisites specified by these initiatives, many large scale projects have been set up for enabling healthcare professionals to handle patients' EHRs. The success of applications developed in these contexts crucially depends on ensuring such security properties as confidentiality, authentication, and authorization. In this paper, we first propose a communication protocol, based on the IHE specifications, for authenticating healthcare professionals and assuring patients' safety. By means of a formal analysis carried out by using the specification language COWS and the model checker CMC, we reveal a security flaw in the protocol thus demonstrating that to simply adopt the international standards does not guarantee the absence of such type of flaws. We then propose how to emend the IHE specifications and modify the protocol accordingly. Finally, we show how to tailor our protocol for application to more critical scenarios with no assumptions on the communication channels. To demonstrate feasibility and effectiveness of our protocols we have fully implemented them.

A standard-driven communication protocol for disconnected clinics in rural areas

“…All the XDS and XDM services are given as a courtesy of the company Tiani "Spirit" GmbH 9 , located in Vienna, Austria. An outline of the overall implementation of the protocol is available online [29].…”

“…We refer the interested reader to [29] for a complete account of the specification, and to [16], [25] for the presentation of COWS and of many examples illustrating its peculiarities and expressiveness.…”

e-Health for Rural Areas in Developing Countries: Lessons from the Sebokeng Experience

“…A possible solution of such an authentication flaw, which does not put any requirement on the security of the van itself, is presented in [9]. This work introduces an ad-hoc protocol for exchanging medical records that exploits the XDM standard.…”

“…In order to perform analysis on the security of the protocol, a threat model is proposed in [9]. In such a model, an attackerà la Dolev-Yao [13] is used.…”

“…Therefore, since a considerable area of the Gauteng province suffers from the above mentioned connectivity problems, we believe that such security flaws would occur in the extension of the PoC, unless suitable measures are taken. In this paper, we tackle the problem of amending the system developed in the E-HR.GP's PoC by proposing the use of a formally-proved correct IHE-based protocol [9], so to include also clinics in rural areas with low or absent Internet connectivity and reachable only by hundred of kilometers of sand tracks.…”