A monitoring/auditing mechanism for SSL/TLS secured service sessions in Health Care Applications¹

Article type: Research Article

Authors: Kavadias, C.D.^a | Koutsopoulos, K.A.^a | Vlachos, M.P.^a | Bourka, A.^a | Kollias, V.^b | Stassinopoulos, G.^a

Affiliations: [a] National Technical University of Athens (NTUA); Department of Electrical & Computer Engineering, 9, Heroon Polytechniou Str., 157 73, Zographou, Athens, Greece. Tel.: + 30 1 7721493; Fax: +30 1 7722534; E-mail: [email protected], [email protected] | [b] TELETEL S.A; 124, Kifisias Avenue, Athens, Greece. Tel.: + 30 1 6983393; Fax: +30 1 6983391; E-mail: [email protected]

Note: [1] The work described in this paper is partially funded by the European Commission in the context of the IST project HARP (Harmonization For The Security Of Web Technologies And Applications).

Abstract: This paper analyzes the SSL/TLS procedures and defines the functionality of a monitoring/auditing entity running in parallel with the protocol, which is decoding, checking the certificate and permitting session establishment based on the decoded certificate information, the network addresses of the endpoints and a predefined access list. Finally, this paper discusses how such a facility can be used for detection impersonation attempts in Health Care applications and provides case studies to show the effectiveness and applicability of the proposed method.

Keywords: SSL/TLS, protocol analysis, public key cryptography, PKI, healthcare applications, case studies

DOI: 10.3233/THC-2003-11101

Journal: Technology and Health Care, vol. 11, no. 1, pp. 1-9, 2003