Tiêu chuẩn iso 17090 1 2013

ISO 17090 1 2013 pdf © ISO 2013 Health informatics — Public key infrastructure — Part 1 Informatique de santé — Infrastructure de clé publique — INTERNATIONAL STANDARD ISO 17090 1 Second edition 2013[.]

INTERNATIONAL STANDARD ISO 17090-1 Second edition 2013-05-01 Health informatics — Public key infrastructure — Part 1: ˜‡”˜‹‡™‘ˆ†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•‡”˜‹…‡• Informatique de santé — Infrastructure de clé publique — ƒ”–‹‡ͷǣ—‡†ǯ‡•‡„Ž‡†‡••‡”˜‹…‡•†‡…‡”–‹ϔ‹…ƒ–—±”‹“—‡ ``,`,,,,,,`,,,`,``,,`,,```,`,`-`-`,,`,,`,`,,` - Reference number ISO 17090-1:2013(E) Copyright International Organization for Standardization Provided by IHS under license with ISO No reproduction or networking permitted without license from IHS Licensee=University of Alberta/5966844001, User=sharabiani, shahramfs Not for Resale, 11/30/2013 21:55:37 MST © ISO 2013 ISO 17090-1:2013(E) COPYRIGHT PROTECTED DOCUMENT © ISO 2013 ŽŽ”‹‰Š–•”‡•‡”˜‡†ǤŽ‡••‘–Š‡”™‹•‡•’‡…‹ϐ‹‡†ǡ‘’ƒ”–‘ˆ–Š‹•’—„Ž‹…ƒ–‹‘ƒ›„‡”‡’”‘†—…‡†‘”—–‹Ž‹œ‡†‘–Š‡”™‹•‡‹ƒ›ˆ‘” ‘” „› ƒ› ‡ƒ•ǡ ‡Ž‡…–”‘‹… ‘” ‡…Šƒ‹…ƒŽǡ ‹…Ž—†‹‰ ’Š‘–‘…‘’›‹‰ǡ ‘” ’‘•–‹‰ ‘ –Š‡ ‹–‡”‡– ‘” ƒ ‹–”ƒ‡–ǡ ™‹–Š‘—– ’”‹‘” ™”‹––‡’‡”‹••‹‘Ǥ‡”‹••‹‘…ƒ„‡”‡“—‡•–‡†ˆ”‘‡‹–Š‡” ƒ––Š‡ƒ††”‡••„‡Ž‘™‘” ǯ•‡„‡”„‘†›‹–Š‡…‘—–”›‘ˆ the requester …‘’›”‹‰Š–‘ˆϐ‹…‡ ƒ•‡’‘•–ƒŽ‡ͷ͸ȈǦͳʹͳͳ ‡‡˜ƒʹͲ Tel + 41 22 749 01 11 Fax + 41 22 749 09 47 Ǧƒ‹Ž…‘’›”‹‰Š–̷‹•‘Ǥ‘”‰ Web www.iso.org —„Ž‹•Š‡†‹™‹–œ‡”Žƒ† ``,`,,,,,,`,,,`,``,,`,,` ii Copyright International Organization for Standardization Provided by IHS under license with ISO No reproduction or networking permitted without license from IHS © ISO 2013 – All rights reserved Licensee=University of Alberta/5966844001, User=sharabiani, shahramfs Not for Resale, 11/30/2013 21:55:37 MST ISO 17090-1:2013(E) Contents Page Foreword iv Introduction v ``,`,,,,,,`,,,`,``,,`,,```,`,`-`-`,,`,,`,`,,` - Scope Normative references ͵ ‡”•ƒ††‡ϐ‹‹–‹‘• ͵Ǥͳ ‡ƒŽ–Š…ƒ”‡…‘–‡š––‡”• ͵Ǥʹ ‡…—”‹–›•‡”˜‹…‡•–‡”• ͵Ǥ͵ —„Ž‹…‡›‹ˆ”ƒ•–”—…–—”‡”‡Žƒ–‡†–‡”• Abbreviations Healthcare context ͷǤͳ ‡”–‹ϐ‹…ƒ–‡Š‘Ž†‡”•ƒ†”‡Ž›‹‰’ƒ”–‹‡•‹Š‡ƒŽ–Š…ƒ”‡ 5.2 Examples of actors 10 ͷǤ͵ ’’Ž‹…ƒ„‹Ž‹–›‘ˆ†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•–‘Š‡ƒŽ–Š…ƒ”‡ 11 Requirements for security services in healthcare applications 12 ͸Ǥͳ ‡ƒŽ–Š…ƒ”‡…Šƒ”ƒ…–‡”‹•–‹…• 12 ͸Ǥʹ ‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡–‡…Š‹…ƒŽ”‡“—‹”‡‡–•‹Š‡ƒŽ–Š…ƒ”‡ 13 ͸Ǥ͵ ‡ƒŽ–Š…ƒ”‡Ǧ•’‡…‹ϐ‹…‡‡†•ƒ†–Š‡•‡’ƒ”ƒ–‹‘‘ˆƒ—–Š‡–‹…ƒ–‹‘ˆ”‘ data encipherment 14 ͸ǤͶ ‡ƒŽ–Š‹†—•–”›•‡…—”‹–›ƒƒ‰‡‡–ˆ”ƒ‡™‘”ˆ‘”†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡• 14 ͸Ǥͷ ‘Ž‹…›”‡“—‹”‡‡–•ˆ‘”†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡‹••—ƒ…‡ƒ†—•‡‹Š‡ƒŽ–Š…ƒ”‡ 14 Public key cryptography 15 ͹Ǥͳ ›‡–”‹…˜•Ǥƒ•›‡–”‹……”›’–‘‰”ƒ’Š› 15 ͹Ǥʹ ‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡• 15 7.3 Digital signatures 15 ͹ǤͶ ”‘–‡…–‹‰–Š‡’”‹˜ƒ–‡‡› 16 ͺ ‡’Ž‘›‹‰†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡• 17 ͺǤͳ ‡…‡••ƒ”›…‘’‘‡–• 17 ͺǤʹ •–ƒ„Ž‹•Š‹‰‹†‡–‹–›—•‹‰“—ƒŽ‹ϐ‹‡†…‡”–‹ϐ‹…ƒ–‡• 18 ͺǤ͵ •–ƒ„Ž‹•Š‹‰•’‡…‹ƒŽ‹–›ƒ†”‘Ž‡•—•‹‰‹†‡–‹–›…‡”–‹ϐ‹…ƒ–‡• 18 ͺǤͶ •‹‰ƒ––”‹„—–‡…‡”–‹ϐ‹…ƒ–‡•ˆ‘”ƒ—–Š‘”‹•ƒ–‹‘ƒ†ƒ……‡••…‘–”‘Ž 19 Interoperability requirements 20 9.1 Overview 20 ͻǤʹ ’–‹‘•ˆ‘”†‡’Ž‘›‹‰Š‡ƒŽ–Š…ƒ”‡†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•ƒ…”‘••Œ—”‹•†‹…–‹‘• 20 9.3 Option usage 22 Annex A (informative)…‡ƒ”‹‘•ˆ‘”–Š‡—•‡‘ˆ†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•‹Š‡ƒŽ–Š…ƒ”‡ 23 Bibliography 38 iii © ISO 2013 – All rights reserved Copyright International Organization for Standardization Provided by IHS under license with ISO No reproduction or networking permitted without license from IHS Licensee=University of Alberta/5966844001, User=sharabiani, shahramfs Not for Resale, 11/30/2013 21:55:37 MST ISO 17090-1:2013(E) Foreword ȋ–Š‡ –‡”ƒ–‹‘ƒŽ”‰ƒ‹œƒ–‹‘ˆ‘”–ƒ†ƒ”†‹œƒ–‹‘Ȍ‹•ƒ™‘”Ž†™‹†‡ˆ‡†‡”ƒ–‹‘‘ˆƒ–‹‘ƒŽ•–ƒ†ƒ”†• „‘†‹‡• ȋ  ‡„‡” „‘†‹‡•ȌǤ Š‡ ™‘” ‘ˆ ’”‡’ƒ”‹‰ Š‡ƒŽ–Š…ƒ”‡‡˜‹”‘‡–•ǡ–Š‹•–‡…Š‘Ž‘‰›—•‡•ƒ—–Š‡–‹…ƒ–‹‘ǡ‡…‹’Š‡”‡–ǡƒ††‹‰‹–ƒŽ •‹‰ƒ–—”‡• –‘ ˆƒ…‹Ž‹–ƒ–‡ …‘ϐ‹†‡–‹ƒŽ ƒ……‡•• –‘ǡ ƒ† ‘˜‡‡– ‘ˆǡ ‹†‹˜‹†—ƒŽ Š‡ƒŽ–Š ”‡…‘”†• –‘ ‡‡– „‘–Š…Ž‹‹…ƒŽƒ†ƒ†‹‹•–”ƒ–‹˜‡‡‡†•ǤŠ‡•‡”˜‹…‡•‘ˆˆ‡”‡†„›–Š‡†‡’Ž‘›‡–‘ˆ†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡• ȋ‹…Ž—†‹‰ ‡…‹’Š‡”‡–ǡ ‹ˆ‘”ƒ–‹‘ ‹–‡‰”‹–›ǡ ƒ† †‹‰‹–ƒŽ •‹‰ƒ–—”‡•Ȍ ƒ”‡ ƒ„Ž‡ –‘ ƒ††”‡•• ƒ› ‘ˆ –Š‡•‡•‡…—”‹–›‹••—‡•ǤŠ‹•‹•‡•’‡…‹ƒŽŽ›–Š‡…ƒ•‡‹ˆ†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•ƒ”‡—•‡†‹…‘Œ—…–‹‘™‹–Šƒ ƒ……”‡†‹–‡†‹ˆ‘”ƒ–‹‘•‡…—”‹–›•–ƒ†ƒ”†Ǥƒ›‹†‹˜‹†—ƒŽ‘”‰ƒ‹•ƒ–‹‘•ƒ”‘—†–Š‡™‘”Ž†Šƒ˜‡•–ƒ”–‡† –‘—•‡†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•ˆ‘”–Š‹•’—”’‘•‡Ǥ ``,`,,,,,,`,,,`,``,,`,,```,`,`-`-`,,`,,`,`,,` - –‡”‘’‡”ƒ„‹Ž‹–› ‘ˆ †‹‰‹–ƒŽ …‡”–‹ϐ‹…ƒ–‡ –‡…Š‘Ž‘‰› ƒ† •—’’‘”–‹‰ ’‘Ž‹…‹‡•ǡ ’”‘…‡†—”‡•ǡ ƒ† ’”ƒ…–‹…‡• is of fundamental importance if information is to be exchanged between organisations and between Œ—”‹•†‹…–‹‘•‹•—’’‘”–‘ˆŠ‡ƒŽ–Š…ƒ”‡ƒ’’Ž‹…ƒ–‹‘•ȋˆ‘”‡šƒ’Ž‡„‡–™‡‡ƒŠ‘•’‹–ƒŽƒ†ƒ…‘—‹–› ’Š›•‹…‹ƒ™‘”‹‰™‹–Š–Š‡•ƒ‡’ƒ–‹‡–ȌǤ …Š‹‡˜‹‰ ‹–‡”‘’‡”ƒ„‹Ž‹–› „‡–™‡‡ †‹ˆˆ‡”‡– †‹‰‹–ƒŽ …‡”–‹ϐ‹…ƒ–‡ ‹’Ž‡‡–ƒ–‹‘• ”‡“—‹”‡• –Š‡ ‡•–ƒ„Ž‹•Š‡–‘ˆƒˆ”ƒ‡™‘”‘ˆ–”—•–ǡ—†‡”™Š‹…Š’ƒ”–‹‡•”‡•’‘•‹„Ž‡ˆ‘”’”‘–‡…–‹‰ƒ‹†‹˜‹†—ƒŽǯ• ‹ˆ‘”ƒ–‹‘ ”‹‰Š–• ƒ› ”‡Ž› ‘ –Š‡ ’‘Ž‹…‹‡• ƒ† ’”ƒ…–‹…‡• ƒ†ǡ „› ‡š–‡•‹‘ǡ –Š‡ ˜ƒŽ‹†‹–› ‘ˆ †‹‰‹–ƒŽ …‡”–‹ϐ‹…ƒ–‡•‹••—‡†„›‘–Š‡”‡•–ƒ„Ž‹•Š‡†ƒ—–Š‘”‹–‹‡•Ǥ ƒ›…‘—–”‹‡•ƒ”‡†‡’Ž‘›‹‰†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•–‘•—’’‘”–•‡…—”‡…‘—‹…ƒ–‹‘•™‹–Š‹–Š‡‹”ƒ–‹‘ƒŽ „‘—†ƒ”‹‡•Ǥ …‘•‹•–‡…‹‡•™‹ŽŽƒ”‹•‡‹’‘Ž‹…‹‡•ƒ†’”‘…‡†—”‡•„‡–™‡‡–Š‡…‡”–‹ϐ‹…ƒ–‹‘ƒ—–Š‘”‹–‹‡• ȋ•Ȍƒ†–Š‡”‡‰‹•–”ƒ–‹‘ƒ—–Š‘”‹–‹‡•ȋ•Ȍ‘ˆ†‹ˆˆ‡”‡–…‘—–”‹‡•‹ˆ•–ƒ†ƒ”†•†‡˜‡Ž‘’‡–ƒ…–‹˜‹–›‹• restricted to within national boundaries ‹‰‹–ƒŽ …‡”–‹ϐ‹…ƒ–‡ –‡…Š‘Ž‘‰› ‹• •–‹ŽŽ ‡˜‘Ž˜‹‰ ‹ …‡”–ƒ‹ ƒ•’‡…–• –Šƒ– ƒ”‡ ‘– •’‡…‹ϐ‹… –‘ Š‡ƒŽ–Š…ƒ”‡Ǥ ’‘”–ƒ–•–ƒ†ƒ”†‹•ƒ–‹‘‡ˆˆ‘”–•ƒ†ǡ‹•‘‡…ƒ•‡•ǡ•—’’‘”–‹‰Ž‡‰‹•Žƒ–‹‘ƒ”‡‘‰‘‹‰Ǥ–Š‡‘–Š‡” Šƒ†ǡŠ‡ƒŽ–Š…ƒ”‡’”‘˜‹†‡”•‹ƒ›…‘—–”‹‡•ƒ”‡ƒŽ”‡ƒ†›—•‹‰‘”’Žƒ‹‰–‘—•‡†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•Ǥ This International Standard seeks to address the need for guidance of these rapid international developments Š‹• –‡”ƒ–‹‘ƒŽ–ƒ†ƒ”††‡•…”‹„‡•–Š‡…‘‘–‡…Š‹…ƒŽǡ‘’‡”ƒ–‹‘ƒŽǡƒ†’‘Ž‹…›”‡“—‹”‡‡–•–Šƒ– ‡‡†–‘„‡ƒ††”‡••‡†–‘‡ƒ„Ž‡†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•–‘„‡—•‡†‹’”‘–‡…–‹‰–Š‡‡š…Šƒ‰‡‘ˆŠ‡ƒŽ–Š…ƒ”‡ ‹ˆ‘”ƒ–‹‘™‹–Š‹ƒ•‹‰Ž‡†‘ƒ‹ǡ„‡–™‡‡†‘ƒ‹•ǡƒ†ƒ…”‘••Œ—”‹•†‹…–‹‘ƒŽ„‘—†ƒ”‹‡•Ǥ –•’—”’‘•‡ ‹• –‘ …”‡ƒ–‡ ƒ ’Žƒ–ˆ‘” ˆ‘” ‰Ž‘„ƒŽ ‹–‡”‘’‡”ƒ„‹Ž‹–›Ǥ – •’‡…‹ϐ‹…ƒŽŽ› •—’’‘”–• †‹‰‹–ƒŽ …‡”–‹ϐ‹…ƒ–‡Ǧ‡ƒ„Ž‡† …‘—‹…ƒ–‹‘ƒ…”‘••„‘”†‡”•ǡ„—–…‘—Ž†ƒŽ•‘’”‘˜‹†‡‰—‹†ƒ…‡ˆ‘”–Š‡ƒ–‹‘ƒŽ‘””‡‰‹‘ƒŽ†‡’Ž‘›‡– ‘ˆ†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•‹Š‡ƒŽ–Š…ƒ”‡ǤŠ‡ –‡”‡–‹•‹…”‡ƒ•‹‰Ž›—•‡†ƒ•–Š‡˜‡Š‹…Ž‡‘ˆ…Š‘‹…‡–‘•—’’‘”– –Š‡‘˜‡‡–‘ˆŠ‡ƒŽ–Š…ƒ”‡†ƒ–ƒ„‡–™‡‡Š‡ƒŽ–Š…ƒ”‡‘”‰ƒ‹•ƒ–‹‘•ƒ†‹•–Š‡‘Ž›”‡ƒŽ‹•–‹……Š‘‹…‡ˆ‘” cross-border communication in this sector v © ISO 2013 – All rights reserved Copyright International Organization for Standardization Provided by IHS under license with ISO No reproduction or networking permitted without license from IHS Licensee=University of Alberta/5966844001, User=sharabiani, shahramfs Not for Resale, 11/30/2013 21:55:37 MST ISO 17090-1:2013(E) Š‹• –‡”ƒ–‹‘ƒŽ –ƒ†ƒ”† •Š‘—Ž† „‡ ƒ’’”‘ƒ…Š‡† ƒ• ƒ ™Š‘Ž‡ǡ ™‹–Š –Š‡ –Š”‡‡ ’ƒ”–• ƒŽŽ ƒ‹‰ ƒ …‘–”‹„—–‹‘–‘†‡ϐ‹‹‰Š‘™†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•…ƒ„‡—•‡†–‘’”‘˜‹†‡•‡…—”‹–›•‡”˜‹…‡•‹–Š‡Š‡ƒŽ–Š ‹†—•–”›ǡ‹…Ž—†‹‰ƒ—–Š‡–‹…ƒ–‹‘ǡ…‘ϐ‹†‡–‹ƒŽ‹–›ǡ†ƒ–ƒ‹–‡‰”‹–›ǡƒ†–Š‡–‡…Š‹…ƒŽ…ƒ’ƒ…‹–›–‘•—’’‘”– –Š‡“—ƒŽ‹–›‘ˆ†‹‰‹–ƒŽ•‹‰ƒ–—”‡Ǥ  ͳ͹ͲͻͲǦͳ †‡ϐ‹‡• –Š‡ „ƒ•‹… …‘…‡’–• —†‡”Ž›‹‰ –Š‡ —•‡ ‘ˆ †‹‰‹–ƒŽ …‡”–‹ϐ‹…ƒ–‡• ‹ Š‡ƒŽ–Š…ƒ”‡ ƒ† ’”‘˜‹†‡• ƒ •…Š‡‡ ‘ˆ ‹–‡”‘’‡”ƒ„‹Ž‹–› ”‡“—‹”‡‡–• –‘ ‡•–ƒ„Ž‹•Š †‹‰‹–ƒŽ …‡”–‹ϐ‹…ƒ–‡Ǧ‡ƒ„Ž‡† •‡…—”‡ communication of health information  ͳ͹ͲͻͲǦʹ ’”‘˜‹†‡• Š‡ƒŽ–Š…ƒ”‡ •’‡…‹ϐ‹… ’”‘ϐ‹Ž‡• ‘ˆ †‹‰‹–ƒŽ …‡”–‹ϐ‹…ƒ–‡• „ƒ•‡† ‘ –Š‡ –‡”ƒ–‹‘ƒŽ –ƒ†ƒ”†ǤͷͲͻƒ†–Š‡’”‘ϐ‹Ž‡‘ˆ–Š‹••’‡…‹ϐ‹‡†‹  Ȁ ͵ʹͺͲˆ‘”†‹ˆˆ‡”‡––›’‡•‘ˆ…‡”–‹ϐ‹…ƒ–‡•Ǥ ͳ͹ͲͻͲǦ͵†‡ƒŽ•™‹–Šƒƒ‰‡‡–‹••—‡•‹˜‘Ž˜‡†‹‹’Ž‡‡–‹‰ƒ†—•‹‰†‹‰‹–ƒŽ…‡”–‹ϐ‹…ƒ–‡•‹ Š‡ƒŽ–Š…ƒ”‡Ǥ