Two weeks ago I received great news. The proposal I committed with my fellow coworkers (Boris Terzic and Markus Gumbel) got accepted at the OSGi community event, so I hope I’ll see some of you I only met virtually till now. Concerning the topic – I think it’ll be interesting for all of you working or at least intending to work with security and OSGi. Now, after I am allowed to talk about it, I will be able to share some of the experiences we gained.
In the talk titled “Do not disturb my circles! Secure Application Isolation with OSGi”[1], Markus Gumbel[2], and I are going to talk about how to isolate several application domains within one JVM – based on OSGi mechanisms. No big deal, some of you might say, but depending on your requirements, it actually might become a big deal or even serious issue. In our very case, we will face a Common Criteria(CC)[3], evaluation for our JVM based components ([4], gives a nice introduction on this topic – unfortunately only in German). But first things first…
InterComponentWare AG (ICW)[5],, the company I am working for right now, is one of the (if not the) leading eHealth provider in the business, with a wide ranging product portfolio. The core product is called LifeSensor[6],, which is an electronic health record like Google[7], and Microsoft[8], introduced recently in their first versions. If you, like me, are a little paranoid about privacy issues, I can recommend you “our” service for sure. We take security pretty serious and have a whole department dedicated to this. Medical data are always a big issue. Consider your CreditCard data is lost, you can get reimbursed from your CreditCard company, once the access to your medical data is compromised, it can’t be undone. Pretty serious from my point of view! Anyway, this is actually not where I am aiming at. We (and my group in particular) are involved in the implementation of the German Telematic Infrastructure project specified by the Gematik[9], and commissioned by the German government.
In our talk, we will take the “Konnektor” we are developing as the sample application to illustrate the usage of the OSGi security features. The Konnektor (we use the Cisco AXP platform[10], underneath) is the key device deployed at every medical practice and pharmacy. It is responsible for creating secure connections to the telematic infrastructure back end, as well as other security relevant tasks like reading eHealthCards, signing prescriptions or uploading emergency data on the electronicHealthCards for instance. [11], gives a nice overview, how things are done in more detail. Additionally the specification allows to have third party applications to be deployed on the connector as well, to extend its functionality. A concrete example would be the integration of the LifeSenor mentioned above to directly upload your X-Ray images to your eHealthRecord. You might understand, that security plays a very important role in such a scenario.
The key problem we are faced with is that the functionality of the Konnektor has to be certified according to the CC, which I mentioned at the beginning of this post. Well, certifying software in general is not easy, especially if you are talking about security and something as complex as we have. The real problem in our case however is not certifying that the software does exactly the stuff specified – no more, no less -, but also allowing third party “plug-ins” to extend its features without compromising its certified functionality or the security of the whole system. In a simple scenario, a doctor uploads a new “feature” from a malicious source to the Konnektor and we have to ensure beforehand that nothing serious can happen – tough one! Well, of course, we not only found a way, but also found a way using OSGi’s security features to do the trick even within the same JVM. The Konnektor and potentially dangerous third party extensions running side by side in the same JVM (of course, without restarting – there is a reason why we are using OSGi!).
Like every other cutting edge software project, we also found ourselves struggling with various problems no one has experience before and so I am pretty sure, we can contribute some important insights in the domain of secure OSGi application development. I hope this will be as interesting for you as it is for me to work on this topic. It is really something you can’t find a lot published about, if someone has done something similar or knows about something, I would be happy to hear about it!
Although, the sample we chose is pretty unique domain wise, the basic techniques we will present are applicable in many different domains as well (banking, insurance, development, personal live style,…). Just think of your Eclipse installation. Right now, you install your plug-ins without a SecurityManager and hope that the plug-in only does what it is supposed to do… What if it doesn’t – or better doesn’t intend to play by the rules? I can see OSGi frameworks running as general platforms combining various different application in one JVM in the furture – a kind of a meta Operating System. As soon as this vision becomes reality, I don’t want applications being able to communicate without restrictions with each other. My health insurance provider together with my personal medical record manager in one container… you never know what an insurer might do, when they get a hold of your sensitive medical records. At least I certainly don’t want to try this out!
I realize that parts of this post might sound like a commercial. If so, this is certainly not intended, but I felt the need to explain in more detail than I will be able at the talk, why we did what we did and why this is so important. In the talk, we will stick to the technology only and avoid as much as possible any relation to a concrete product – I really hate talks pretending to point out new technologies or lessons learned, but actually trying to sell a product instead, so you’re safe here for sure!
For those of you attending the conference, don’t hesitate to talk to me, if you have any questions or just say hello. I was and certainly am a big fan of technical discussions. All of you who won’t be able to attend the event and interested in the topic, don’t worry, after the talk, I am certainly blogging more about this topic in the near future 
Till then, stay tuned!
Cheers,
Mirko
UPDATE: the slides can be downloaded from the OSGi Website for everyone interested (pdf)
–
[1] http://www.osgi.org/CommunityEvent/Program
[2] http://www.osgi.org/CommunityEvent/Speakers#MG
[3] http://www.commoncriteriaportal.org
[4] http://www.bsi.bund.de/cc/
[5] http://www.icw-global.com
[6] https://www.lifesensor.com
[7] http://www.google.com/health
[8] http://www.healthvault.com
[9] http://www.gematik.de
[10] http://www.cisco.com/en/US/prod/routers/ps9701/axp_promo.html
[11] http://www.cisco.com/en/US/prod/collateral/routers/ps9701/data_sheet_c02_459078.html
