Trust is not Global

re: Trust is not Global

Shane Taylor — Thu, 03 Dec 2009 15:56:17 GMT

A very good conversation is happening here that I want to make sure you know about:

http://blogs.gartner.com/wes_rishel/2009/12/01/guest-david-mccallie-on-simplifying-interop/

I have even reposted Liam's comment as I think its relevance is high for this thread.

re: Trust is not Global

Don Rule — Wed, 02 Dec 2009 20:56:15 GMT

The tricky part about this is that Trust implies both Authentication AND Authorization. Certs handle the trust hierarcy pretty well but you probably also want to restrict the radiologist to the relevant portion of your record. Certs work well for the authentication hierarchy and although there is a very flexible way to express authorization in ASN.1 there haven't been sufficient standards to make them usable - the military went down that road but had trouble when it came to security levels across services (e.g. if it is produced by the Marines then the navy can edit but airforce can only read and the army gets the redacted copy).

This has been an issue for digital rights and XrML turned out to be infinitely flexible but the complexity held back adoption. HealthVault does this internally so I'd be interested to know how you configure it in federated scenarios.

re: Trust is not Global

Shane Taylor — Wed, 02 Dec 2009 20:46:24 GMT

Sean,

You have great thoughts on this. I wanted to make sure you read some of the comments on Wes's other posting. If you haven't, I think you will be interested in the content. I am especially curious to see someone comment on Liam Davis-Mead's comment.

http://blogs.gartner.com/wes_rishel/2009/11/22/on-ebay-the-fax-and-healthcare-interop/