title: An integrated architecture for deploying a virtual private medical network over the web.
abstract: In this paper we describe a pilot architecture aiming at protecting Web-based medical applications through the development of a virtual private medical network. The basic technology, which is utilized by this integrated architecture, is the Trusted Third Party (TTP). In specific, a TTP is used to generate, distribute, and revoke digital certificates to/from medical practitioners and healthcare organizations wishing to communicate in a secure way. Digital certificates and digital signatures are, in particular, used to provide peer and data origin authentication and access control functionalities. We also propose a logical Public Key Infrastructure (PKI) architecture, which is robust, scalable, and based on standards. This architecture aims at supporting large-scale healthcare applications. It supports openness, scalability, flexibility and extensibility, and can be integrated with existing TTP schemes and infrastructures offering transparency and adequate security. Finally, it is demonstrated that the proposed architecture enjoys all desirable usability characteristics, and meets the set of criteria, which constitutes an applicable framework for the development of trusted medical services over the Web.
authors.affiliation: Department of Information and Communication Systems, University of Aegean, Athens, Greece. sgritz@aegean.gr
authors.forename: S
authors.initials: S
authors.lastname: Gritzalis
authors.forename: D
authors.initials: D
authors.lastname: Gritzalis
authors.forename: C
authors.initials: C
authors.lastname: Moulinos
authors.forename: J
authors.initials: J
authors.lastname: Iliadis
mesh_terms: D002568:Certification / Q000331:legislation & jurisprudence; D016494:Computer Security / Q000295:instrumentation* / Q000592:standards; D003219:Confidentiality; D003628:Database Management Systems / Q000295:instrumentation*; D006801:Humans; D007255:Information Services / Q000458:organization & administration / Q000592:standards; D016247:Information Storage and Retrieval / Q000592:standards; D020407:Internet / Q000295:instrumentation* / Q000592:standards; D008491:Medical Informatics Applications; D016347:Medical Records Systems, Computerized; D010865:Pilot Projects; D015397:Program Evaluation; D018511:Systems Integration; D014584:User-Computer Interface