EAGER: SeaCat: An SDN End-to-End Application Containment ArchitecTure to Enable Secure Role Based Network Access in Healthcare

医疗保健正在被信息技术所改变。 然而，随着该技术的承诺，人们对医疗保健信息和系统的隐私，机密性和操作完整性表示担忧。医生和其他医疗保健专业人员越来越多地依赖于网络应用程序来执行各种任务，如访问患者记录、远程诊断和咨询、家庭患者监护、医疗保健相关分析，甚至远程外科手术。除了这些特定领域的应用程序外，医疗保健专业人员还使用所有其他更典型的职业应用程序，通常来自同一设备。应用的这种多样性，特别是可能使用相同设备的同一个人可能同时使用这些不同应用的事实，对医疗保健信息技术（IT）操作提出了特别的挑战。理想情况下，个人通过使用特定的网络应用程序所扮演的角色应该决定与该角色相关的安全和性能上下文。该项目开发、集成和测试一个原型系统，用于基于软件定义网络（SDN）技术的医疗数据和应用程序的端到端隔离和包容。 医疗保健应用程序通常是受信任的，但需要在可能包含不受信任的应用程序和实体的主机和网络环境中安全地运行并保护它们访问的数据。该项目通过开发和原型化SDN端到端应用包容架构（SeaCat）来解决这些问题，并展示其在电子健康记录（EHR）和医疗成像应用中的实用性。该项目将结合联合收割机软件定义的网络（SDN）原语与应用程序的包容机制，以实现端到端的应用程序包容在医疗保健IT环境。 EHR应用程序用户通过SeaCat认证后，EHR特定上下文将从EHR服务器通过网络动态创建，并扩展到端点。EHR应用程序及其使用的任何临时本地数据都包含在此上下文中，并受到保护，免受网络和端点中的数据泄漏和恶意行为者的影响。一旦用户应用程序结束，完整的端到端上下文（包括临时存储在端点或网络设备中的任何数据）将被删除，环境将恢复到干净状态。 HIPAA隐私和安全规则反映了此类保障措施的法定任务。 然而，与此同时，医疗保健IT应用程序正在医疗保健园区以外的更大地理区域中扩展，并且应用程序正在利用高带宽，低延迟网络连接到新的位置，通常使用智能手机和平板电脑。 该项目中的应用包容架构将支持医疗保健的隔离和隐私问题，并促进未来千兆医疗保健应用的部署。

Healthcare is being transformed by information technology. However, with the promises of the technology have come concerns about the privacy, confidentiality and operational integrity of healthcare information and systems. Physicians and other healthcare professionals increasingly rely on networked applications for tasks as diverse as accessing patient records, remote diagnoses and consultations, in-home patient monitoring, healthcare related analytics and even remote surgical procedures. In addition to these domain specific applications, healthcare professionals use all the other more typical vocational applications, often from the same device. This diversity of applications and in particular the fact that the same individual, possibly using the same device, might be concurrently using these different applications, presents a particular challenge to healthcare information technology (IT) operations. Ideally, the role an individual is playing by using a specific networked application, should determine both the security and the performance context associated with that role. This project develops, integrates, and tests a prototype system for end-to-end isolation and containment of healthcare data and applications based on Software Defined Networking (SDN) technology. Health care applications are generally trusted, but need to operate securely and protect the data they access, in a host and network environment that might contain untrusted applications and entities. The project addresses these concerns by developing and prototyping an SDN End-to-end Application Containment ArchitecTure (SeaCat), and demonstrating its utility with electronic health record (EHR) and medical imaging applications. The project will combine software defined networking (SDN) primitives with application containment mechanisms to realize end-to-end application containment in a health care IT environment. After a EHR application user has authenticated with SeaCat, an EHR specific context is dynamically created from the EHR Server, through the network and extending into the endpoint. The EHR application and any temporary local data it is using are contained within this context and protected from data leakage and malicious actors in both the network and the endpoint. Once the user application ends, the complete end-to-end context, including any data temporarily stored within the endpoint or network devices, is removed and the environment reverts to a clean state.The importance of safeguarding healthcare data is well known. The HIPAA privacy and security rules reflect legislated mandates for such safeguards. Yet at the same time healthcare IT applications are being extended over a larger geographic region beyond healthcare campuses, and applications are making use of high-bandwidth, low-latency networks linking to the new locations, often with smartphones and tablets. The application containment architecture in this project will support isolation and privacy concerns for healthcare and facilitate the deployment of future gigabit healthcare applications.