Buzzwords such as Identity 2.0, Web services and SOA characterize the architectures of novel IT-systems. Concerning these recent trends, the stake holders of eHealth systems might ask a number of questions including: • Users: does that help us in providing a better care? • Owners: how does it change the suite of applications and services we provide? • Suppliers: what is the footprint on our software architecture? This presentation will discuss the relevance of Identity 2.0, Web services and SOA for IT-systems in health-care. It will identify and assess the value that can be added through ideas and technologies behind these trends. Regarding the fundamental concept of identity, architectural blueprints for Web services and SOA-based eHealth systems will also be investigated.

1. European Identity Conference 2008, Munich 2008-04-22/25 Identity 2.0, Web Services and SOA in Health-Care

3. Setting the Scene IT-Landscape in eHealth – A Vendor’s Perspective System layer System layer System layer System layer Integration layer Integration layer Integration layer Integration layer HIS ERP … Presentation Health professionals Health care provider 1 System layer Integration layer System layer Integration layer System layer Integration layer System layer Integration layer HIS ERP … Presentation Health professionals Health care provider 2 Cooperate

11. Identity 2.0 Support in WS-Based SOA Application logic WS stack processBusinessObject <dependsOnAuthn> WS consumer requestSecurityToken <reportsOnAuthn> WS provider Application logic WS stack Resources <RP> <IdP> Identity store STS provider STS logic WS stack <wsp:Policy …> <sp:ProtectionToken> … <sp:IssuedToken…> <sp:RequestSecurityTokenTemplate> <wst:TokenType> urn:oasis:names:tc:SAML:2.0:assertion </wst:TokenType> <wst:KeyType>…</wst:KeyType> <wst:KeySize>256</wst:KeySize> </sp:RequestSecurityTokenTemplate>… </sp:IssuedToken> </sp:ProtectionToken> </wsp:Policy> SAML assertion RAM representation

13. Identity 2.0 Addressing the ECR Challenge – eFA Business WSs client logic WS stack WS consumers RReg WS RReg logic WS stack Interceptors (PEP/PDP) processing IdT / AdT / AcT / PoT Folder/MDO relation, MDO metadata DReg WS DReg logic WS stack eFA security WSs (cf. below) FReg WS FReg logic WS stack In: IdT / AdT In: IdT / AcT / PoT In: IdT / AcT / PoT In: IdT / AcT / PoT ECR/folder relation, folder metadata Patient/ECR relation, ECR metadata DRep WS DRep logic WS stack MDOs

14. Identity 2.0 Addressing the ECR Challenge – eFA Security WSs Client logic WS stack WS consumers Identity store IdT STS IdT logic WS stack AdT WS AdT logic WS stack AcT WS AcT logic WS stack Policy store (DAC) Key store PoT WS PoT logic WS stack eFA business WSs (cf. above) Stub Full content GuT STS GuT logic WS stack In: IdT / AcT Out: PoT In: IdT / AdT Out: AcT In: IdT Out: AdT In: GuT (ext user) or X509Token (int user) Out: IdT In: arbitrary Out: GuT Arbitrary