Model-based security analysis of the German health card architecture.
OBJECTIVE
Health-care information systems are particularly security-critical. In order to make these applications secure, the security analysis has to be an integral part of the system design and IT management process for such systems.


METHODS
This work presents the experiences and results from the security analysis of the system architecture of the German Health Card, by making use of an approach to model-based security engineering that is based on the UML extension UMLsec. The focus lies on the security mechanisms and security policies of the smart-card-based architecture which were analyzed using the UMLsec method and tools.


RESULTS
Main results of the paper include a report on the employment of the UMLsec method in an industrial health information systems context as well as indications of its benefits and limitations. In particular, two potential security weaknesses were detected and countermeasures discussed.


CONCLUSIONS
The results indicate that it can be feasible to apply a model-based security analysis using UMLsec to an industrial health information system like the German Health Card architecture, and that doing so can have concrete benefits (such as discovering potential weaknesses, and an increased confidence that no further vulnerabilities of the kind that were considered are present).
Jürjens
J
J
Computing Department, The Open University, Milton Keynes MK7 6AA, UK. j.jurjens@open.ac.uk
Rumm
R
R
D016494:Computer Security; D005858:Germany; D017146:Models, Organizational; D010355:Patient Identification Systems / Q000379:methods*