ASTM E2086-00

This guide recommends security mechanisms for protection of healthcare information transmitted using the IPS. The IPS consists of multiple protocol layers.

The lowest layer which can provide end–to–end security is the Internet Protocol (IP). IP may run over a variety of subnetwork technologies, such as Ethernet, X.25, ATM, and even asynchronous dial–up lines. While it is possible to provide security services directly over those technologies, such approaches only protect a single subnetwork and are not discussed further.

A variety of protocols may be run on top of IP. These include the Transmission Control Protocol (TCP), which provides reliable, sequenced data delivery (sessions), and the User Datagram Protocol (UDP), which provides unsequenced data delivery (datagrams). Other protocols at this layer include various routing and configuration protocols used by the network itself.

Application protocols typically make use of either TCP or UDP. A variety of standard application protocols have been defined for such applications as file transfer (FTP), electronic mail (SMTP), and the World Wide Web (HTTP). Some applications have their own security requirements, dictated by the structure of the application or its protocols.

The remainder of this guide is organized as follows: Section 5 discusses security threats and the countermeasures which can be used to protect against these threats. Section 6 presents a brief overview of cryptography, as most network security mechanisms rely on its use. Section 7 distinguishes between network and application security and discusses when each level of security might be useful. The remaining sections recommend specific security protocols and mechanisms for both network and application security needs.

1.1 This guide covers mechanisms that can be used to protect healthcare information which is being transmitted over networks using the Internet Protocol Suite (IPS). This includes the actual Internet itself, as well as corporate intranets constructed from off-the-shelf components implementing these protocols. An organization's security policy will determine when these mechanisms are used, based on risk analysis.

1.2 The Internet Engineering Task Force (IETF) is defining security standards for use with the IPS. This guide covers the relevant standards and recommends, where needed, particular options (such as cryptographic transformations) to be used with the standards. Most standards referenced here are proposed standards issues as Request for Comments (RFC's). Some are in the draft stage, but are stable enough (and widely enough implemented) to be recommended for use at this time.