Download to read offline
Uploaded byThodoris Bais
Securing eHealth and eGovernment with Java - Java2Days 2019
The document discusses securing eHealth and eGovernment systems with electronic signatures in Java. It covers topics like eHealth and eGovernment use cases in Germany and the Netherlands, requirements for secure transmission, electronic signature types and certificates, the Digital Signature Services (DSS) framework, and PDF security issues. The presentation aims to demonstrate how to create and validate digital signatures using Java libraries to enable secure eHealth and eGovernment applications and document exchange.
More Related Content
Similar to Securing eHealth and eGovernment with Java - Java2Days 2019
![20260201 [FOSDEM] gomodjail - library sandboxing for Go modules.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/20260201fosdemgomodjail-librarysandboxingforgomodules-260201225659-76609ec4-thumbnail.jpg?width=640&height=640&fit=bounds)
Securing eHealth and eGovernment with Java - Java2Days 2019
- 1. @wernerkeil @thodorisbais Securing eHealthand eGovernment with Java
- 2. Werner Keil ThodorisBais Maintenance Lead JSR-385 Expert Group Member JSR-385 Let’s meet @thodorisbais@wernerkeil
- 3. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Agenda 1. eHealth and eGovernment 2. Signatures and Certificates 3. DSS Framework 4. PDF Insecurity 5. Demo 6. Links / Q&A
- 4. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais eGovernment in DE ExternalInternal
- 5. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais eHealth in DE Long distance communication Health Data Patient Monitoring
- 6. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais eGovernment in NL
- 7. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais eHealth in NL 80% Access to medical records 75% Health monitoring
- 8. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais eHealth in NL – How to achieve these goals
- 9. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Benefits of eHealth Insight into own health Time saving
- 10. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Requirements for Secure Transmission Integrity Identity Authenticity
- 11. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Authenticity of Author and Data • Assignment of data to the signer • Protection against denial by signatory • Protection of data against manipulation • On the transmission path • Through the receiver
- 12. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Risks & Solutions
- 13. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Electronic Signatures
- 14. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Functionality The electronic signature is a cryptographic method that uses two asymmetric keys • Private key • Public key
- 15. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Signature Process
- 16. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Signature Process
- 17. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Signature Types The signature law distinguishes three (or four) types of signatures: • Simple Electronic Signature (SES) • Advanced Electronic Signature(AdES) • Qualified Electronic Signature (QES) • Qualified Electronic Signature with Provider Accreditation
- 18. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Signature Types
- 19. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Advanced Electronic Signature Electronic signatures, where: • The owner can be uniquely identified and assigned to the signature • The signature is generated by means which owner can keep under their sole control • It is capable of identifying if accompanying data has changed after the message was signed • The signature can be invalidated in the event of such change
- 20. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Scope of Application An advanced electronic signature holder can also be a company, service, app, etc. The advanced electronic signature can therefore be used to sign documents if there are no legal formalities (personal certificates) With the advanced electronic signature, mass signatures are possible, for example to ensure the integrity of documents in the area of electronic invoicing or archiving (functional certificates)
- 21. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Qualified Electronic Signature An advanced electronic signature based on a secure signature creation device and a qualified certificate valid at the time of creation. Qualified Certificates • Serial Number • Reference to Qualified Certificate • Name of the owner (natural person) • Signature verification • Period of validity • Certification Service • Usage restrictions
- 22. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Qualified Electronic Signature with Accreditation Provision of the PKI by a trust center that has undergone the voluntary accreditation process. Certificate providers prove compliance with the provisions of the Act and the SigV before commencing operations Accreditation as a quality label provides proof of the comprehensively tested safety.
- 23. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Certificates
- 24. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Certificates The assignment of the electronic signature to the owner is carried out by means of certificates A certificate is an electronic certificate linking the public signature verification key to the name of the holder (natural or legal person)
- 25. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Signature Formats There are four main types of signatures: • XAdES (XML Document) • CAdES (Common binaries of different kinds) • PAdES (PDF Document) • Associated Signature Containers (ASiC)
- 26. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Signature Packaging Depending on the signature format, different packaging of the signature and the document are possible: • Enveloped • Enveloping • Detached • Internally Detached
- 27. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Signature Creation and Validation
- 28. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Signature Validation • TOTAL_PASSED • TOTAL_FAILED • INDETERMINATE
- 29. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Multinational Document Flow
- 30. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais DSS Framework
- 31. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais DSS Framework DSS (Digital Signature Services) is an open-source software library for electronic signature creation and validation. DSS supports the creation and verification of interoperable and secure electronic signatures in line with European legislation. Three main features can be distinguished within the framework: • Creation of a Digital Signature • Extension of a Digital Signature • Validation of a Digital Signature
- 32. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais DSS Framework – Features • Formats of the signed documents: XML, PDF, DOC, TXT, ZIP,… • Packaging structures: enveloping, enveloped, detached and internally-detached • Forms signatures: XAdES, CAdES, PAdES and ASiC-S/ASiC-E • Profiles associated to each form of the digital signature • Trust management • Revocation data handling (OCSP and CRL sources) • Certificate chain building • Signature validation and validation policy • Validation of the signing certificate
- 33. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais PDF Insecurity https://www.pdf-insecurity.org/index.html
- 34. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais PDF Insecurity
- 35.
- 36. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais Links CEF Digital Home: https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/eSignature eGov EU Twitter Account: @eGov_EU CEF DSS: https://ec.europa.eu/cefdigital/wiki/display/CEFDIGITAL/DSS DSS Framework on GitHub: https://github.com/esig/dss Bouncy Castle for Java: https://www.bouncycastle.org/java.html Apache Sanctuario: https://santuario.apache.org/ Apache PDFBox: https://pdfbox.apache.org/
- 37. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais @wernerkeil @thodorisbais
- 38. © 2017-2019 CreativeArts & Technologies and others. All rights reserved.#Java2Days #eHealth #eGov #eSignature #Java @wernerkeil @thodorisbais
Editor's Notes
- #5 E-government is the opening up and adaptation of the public sector through information and communication technologies. One distinguishes between: Internal E-Government - Use of IT within the public sector without any contact with the citizen, such as electronic medical records, exchange between public authorities, healthcare providers, pharmacies, etc. External E-Government - Web site and services for citizens, patients, customers, companies, ...
- #6 Currently, Germany is still at an early stage of the application of e-health or M-Health. There are, however, already some advantages and possibilities to see how both are used or can be used soon. For example for: Communication over long distances, regardless of location. Especially in rural areas, or where there is a shortage of doctors Computer-based procedures for the collection, transmission and evaluation of health data. The monitoring of patients, for example, the chronically ill, or voluntary self-monitoring (Quantified Self)
- #7 eIDAS: accessing Dutch government services online The introduction of the Electronic Identification and Trust Services Regulation (eIDAS) means EU citizens from other member states can access Dutch government services online. What government services can I access in the Netherlands? You can use your login details for any approved European electronic identification scheme to access all the same services as Dutch people can using their DigiD. If, for example, you are a German national working in the Netherlands, you can log in using your ‘Neuer Personalausweis’ to: see how much pension you have built up through the Social Insurance Bank (SVB); submit your tax return to the Tax and Customs Administration; check your pension payments to your pension provider; object to the assessment of the value of your property under the Valuation of Immovable Property Act (WOZ); BSN ?
- #8 The government is encouraging the healthcare sector to expand telehealth (eHealth) services. Below the goals set by the Dutch government: Access to medical records At least 80% of chronically ill people should have access to their own medical records by 2019, and at least 40% of other members of the population. Health monitoring By 2019 75% of chronically ill people and vulnerable elderly people should be able to monitor certain aspects of their own health and share the data with their health provider. This would include things like blood pressure and cholesterol levels. Online contact with care provider People receiving care and support at home should be able to communicate with their care provider 24 hours a day via a screen, if they wish.
- #9 Support for innovators via online platform Healthcare innovators wishing to make a new digital application can go to zorgvoorinnoveren.nl (in Dutch), where they will find support to help them develop their idea swiftly and effectively into a working application. The site also has tips on getting funding. Making digital data sharing easier The government is consulting with healthcare administrators on standards that should facilitate digital data sharing. They are also talking to suppliers of IT systems. Sharing eHealth knowhow The government is bringing healthcare innovators and other parties together. It has established a startup network, for example, which includes healthcare providers, patients and lawyers. The network allows them to share knowledge and help startups and innovations advance to the next stage. Personal digital healthcare environment Some healthcare providers and IT suppliers already offer patients the opportunity to draw up and manage a personal health record (PHR). But safely combining and sharing personal health information is a complex matter, and is currently possible to only a limited extent. Various parties in the healthcare sector are therefore collaborating on a programme to give people more control over their own health.
- #10 Time savings Telehealth can save time. For example, patients can schedule their own appointment with their care provider online. And they do not even need to leave their home if they can arrange an online consultation (by video link, for example). Insight into own health A personal digital healthcare environment gives people more insight into their health. If they wish, they can share all or part of their data with a healthcare provider or informal carer, so that they do not have to repeatedly relate their entire medical history. This allows the healthcare provider to work more effectively, determine the right treatment more quickly, and avoid mistakes. Patients gain more control over their own health thanks to a greater understanding of their health situation. Lower administrative burden Doctors have less paperwork and can share information securely and easily with colleagues.
- #11 Integrity Messages should not be able to be falsified unnoticed Identity A message should be clearly assigned to the sender Authenticity The identity of the sender should be verifiable Confidentiality Messages should not be read by unauthorized persons
- #13 E-communication entails risks Who is my counterpart? Who is reading? Has anyone changed something? Solutions: E-Signature & Encryption Unauthorised third parties cannot read an encrypted message Electronically signed documents can not be changed unnoticed, neither during transmission nor through the receiver -Sender can not deny text (e.g., binding offer)
- #15 The private key to be kept secret is used to encrypt the hash value of the document (= "Compressed text consisting of a sequence of binary values) The public key can only be used for decryption and matches only one private key. It can be publicly retrieved and is often sent with the message
- #16 Public key matches only one private key
- #29 TOTAL-PASSED response indicates that the signature has passed verification and it complies with the signature validation policy TOTAL_FAILED response indicates that either the signature format is incorrect or that the digital signature value fails the verification. INDETERMINATE validation response indicates that the format and digital signature verifications have not failed but there is an insufficient information to determine if the electronic signature is valid.
- #36 Generally and following ETSI standard, the validation process of an electronic signature must provide one of these three following statuses: TOTAL-FAILED, TOTAL-PASSED or INDETERMINATE. TOTAL-PASSED response indicates that the signature has passed verification and it complies with the signature validation policy. TOTAL_FAILED response indicates that either the signature format is incorrect or that the digital signature value fails the verification. INDETERMINATE validation response indicates that the format and digital signature verifications have not failed but there is an insufficient information to determine if the electronic signature is valid.