August 31st, 2010 Security Conference Call

Security Working Group Meeting

Back to Security Main Page

Attendees

• Tabitha Albertson
• Ed Coyne
• Mike Davis Security Co-chair
• Jon Farmer
• Suzanne Gonzales-Webb CBCC Co-chair
• Rob Horn
• Michelle Johnston
• Vannak Kann
• Pat Pyette
• Scott Robertson
• David Staggs
• Cliff Thompson
• Richard Thoreson CBCC Co-chair
• Serafina Versaggi scribe
• Tony Weida
• Craig Winter

Agenda

1. (05 min) Roll Call, Accept Minutes August 24th Security Work Group, Call for additional agenda items & Accept Agenda
2. (05 min) Pat Pyette - PASS Audit Update
3. (50 min) Security and Privacy Ontology project
   • (10 min) Overview of the following sources for this ontology:
     • Suzanne: Will present Neumann and Strembeck
     • Mike: Will present ASTM 1986-09 and ISO 22600-2, both of which address functional and structural roles
     • Ed Coyne: Will present term definitions from ANSI/INCITS 359-2004
   • (40 min) Tony Weida will lead the discussion on the status of the draft ontology
     • Precedence of source material for naming and other purposes. Sources include the Security-Privacy DAM, HL7 RBAC Permission Catalog, ANSI INCITS 359-2004, etc.
     • Format and timing for distributing updates to the WG
     • Review and discussion of ontology updates
     • Next steps

Minutes

3. Updates/Discussion

Scott Robertson offered a motion to accept minutes from the meeting of August 24, seconded by Tony Weida.

PASS Audit Update

• Ballot for the Health Care Audit Control Services is now opened for comment until September 27th.

Security and Privacy Ontology Project

• Suzanne, Mike and Ed provided a brief overview on the background material for the Security and Privacy Ontology related to Role-based Access Control
  • Functional and Structural Roles were discussed in depth
  • Neumann and Strembeck, ASTM 1986-09, ANCI/INCITS 359-2004 and ISO 22600-2 (PMAC) were covered in particular
• The first point discussed was the fact that there are several authoritative sources for names and definitions of elements that are part of this ontology.
  • In the desire to keep things simple, Tony is maintaining a strictly ordered list and as new sources are added, they will be inserted into the list in the appropriate priority rank. The starting point is:

1. HL7 Composite Privacy and Security DAM
2. RBAC Permission Catalog
3. ANSI-INCITS 359-2004

• Tony suggests that we give precedence to HL7 artifacts, since we are an HL7 organization/project. That should be a good precedence to talk us through the RBAC section of the project.
  • Mike agrees that these are the kinds of decisions that we need to make. We agree that we’ll use the classes and attributes from the information model (DAM).
    • When we break out the ontology further, we’ll either put in a standard as an example to illustrate the ontology. For instance, ASMT would not be something we would declare as part of the ontology, but we can put it in as an example. We’ll make those decisions as they come up.
• Tony: At the same time we’re identifying all the classes of interest to provide a common vocabulary for those working in the areas of security and privacy, we’re not copying all the classes from the SM, but we’re choosing things that are useful and using them in a way that is consistent with the ontology.
  • For example, there is a class for provider organization and one for jurisdictional organization. Both have a super class called Authority which has to do with the relationship between the policy and the authority for that policy.
  • It would be reasonable to have an organization class which is a parent in the ontology for jurisdictional organization and a provider organization, since it is being used in a sense of a generalization.
• The next item for discussion is how to distribute updates to the ontology: posting the protégé model and screen shots to provide visualization to people who are unable to look at the model in protégé.
  • The work group agreed to posting updates once a week at the end of the work week, starting this week. People can then be prepared for the next Tuesday Security meeting.
  • Protégé file structure which breaks down in to multiple name spaces, each with a set of files
  • Screen shots will be in a Word document
  • Materials will be posted on the Security and Privacy Ontology wiki under the Draft Ontology section.

---

Next steps:

---

• Tony is looking to add content from externally available sources, like the table of objects from the Permission Catalog.
  • Tony and Jon Farmer are developing code to take those tables and convert them into Protégé since they haven’t been able to find a tool that can readily achieve this. Tony hopes to have this available next week.
  • Tony has also renamed and cleaned up of the base security and privacy ontology for the core RBAC constructs. (e.g., changed Podunk instances to a more generic name, etc.; Role to SecurityRole (with annotation).)
• Tony also followed up on the action item from a couple of weeks ago to verify the relationship between constraint and permission in the draft ontology is in alignment with ANSI/INCITS 359-2004.
  • Toward that end, Tony created a class to represent a specialization of constraints which are a separation of duty constraints: further broken down into static and dynamic variations.
    • These refer to two or more security roles which cannot be assumed at the same time. The static ones which cannot be assigned to a user at the same time, and the dynamic ones are only assigned to a user at the time of a session.
    • So the static separation of duty constraints apply to user assignments, while the dynamic separation of duty constraints apply only to sessions (enforceable on sessions).
    • To clarify this issue, the model will have a collection of constraints which will be in a constraint catalog. And organizations will have a constraint catalog as well as a permission catalog.

---

The meeting was adjourned at 2:10 PM EDT

---

No significant motions or decisions were made

---

Back to Security Main Page