NIST collaboration and testing

The CONNECT team collaborated with the NIST team on testing and validating SOAP based transport for Document Submission. This is part of an ongoing effort to ensure that the product meets all compliance requirements that are being tested by various certification bodies including NIST. The team is tracking all ongoing work with the NIST team using the Epic story CONN-558. As new use cases for SOAP based transport are introduced in the NIST testing tools, the team will continue to work with the NIST team to ensure and validate CONNECT's compliance.

Details on how the NIST's Transport Testing Tool (TTT) was utilized and the tests performed can be found below -

NIST Transport Testing Tool (http://transport-testing.nist.gov/ttt/)

We are focusing only on the TTT for sending/receiving:

XDR Send
FindDocuments - Not available yet
GetDocuments - Not available yet
RetrieveDocument - Not available yet

Set up trust store and key store

Download the NIST keystore from http://sourceforge.net/projects/iheos/files/SOAP_TEST.zip/download
Copy the NIST keystore into key store directory (C:\glassfish3\glassfish\domains\domain1\config)
Export the NIST certificate from keystore as nist.cer

keytool -export -rfc -alias gateway -file nist.cer -keystore keystore -keypass changeit -storepass changeit

Import the NIST certificate into cacerts.jks

keytool -import -v -noprompt -trustcacerts -alias HOST1 -file nist.cer -keystore cacerts.jks -storepass changeit

If the certificate already exists in cacerts.jks, delete the certificate HOST1:

From the c:\glassfish3\glassfish\domains\domain1\config directory, run the command java -jar C:\app\portecle-1.7\portecle-1.7\portecle.jar
Open cacerts.jks file
Give the password (changeit)
Right click on HOST1 certificate and delete it.
Perform the keytool -import command (step 3).

Update C:\glassfish3\glassfish\domains\domain1\config\domain.xml to accept NIST keystore as the new key store

Replace -Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/gateway.jks with:

-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore

Update the SSL port in C:\glassfish3\glassfish\domains\domain1\config\domain.xml

Replace <network-listener port="8181" protocol="http-listener-2" transport="tcp" name="http-listener-2" thread-pool="http-thread-pool"></network-listener>

<network-listener port="443" protocol="http-listener-2" transport="tcp" name="http-listener-2" thread-pool="http-thread-pool"></network-listener>

Update C:\glassfish3\glassfish\domains\domain1\config\nhin\signature.properties to accept NIST keystore as the new key store

Replace org.apache.ws.security.crypto.merlin.file=gateway.jks with:

org.apache.ws.security.crypto.merlin.file=keystore

Change the orchestrator from SAML to JAVA implementation in the PolicyEngineProxyConfig.xml file under nhin directory.

Replace adapterpolicyengineorchestratorsamljava with adapterpolicyengineorchestratorjava

adapterpolicyengineorchestratorjava

Restart app server

Set up TTT to send messages to SUT

Provide NIST team with SUT endpoints:

XDR Send = Document Submission: https://<Hostname or IP address>:443/Gateway/DocumentSubmission/2_0/DocumentRepositoryXDR_Service

Send request from TTT to SUT

Browse to http://ttt.transparenthealth.org/ttt/
Click on XDR Send
In Environment dropdown, select SOAP_TEST
Enter local patient ID
In Select Test Data Set, select anything that has full metadata
In SAML dropdown, select NHIN SAML
Check the TLS box
For Document Recipient, choose the Actor
Click Run
Click Inspect Results for detailed test results.

Set up TTT to accept messages from SUT

Define an Actor Simulator:

On the Home panel, select the “Simulator Control” in the “Simulators” column
In the Environment dropdown, select SOAP_TEST
Select “Document Recipient” from the Actor Type pull-down menu.
Click “Create Actor Simulator”
Copy the End Point Displayed in “PnR TLS endpoint”, this is a TLS endpoint, DO NOT USE the PnR endpoint above it, as it is non-TLS. Note/Copy the TLS endpoint displayed in the page which needs to be updated in the uddiConnectionInfo_g1.xml. The endpoint looks like https://ttt.transport-testing.org:8443/ttt/sim/e6bb0458-ee24-42dc-a003-cb28683e3cd2/rec/xdrpr where the bold characters in the URL is the simulator actor data which will change for each simulator actor we create.
Select the Expected C-CDA Type from the list that you will send to the TTT, this will allow the C-CDA to be sent to the appropriate Validator. This endpoint will always be associated with this type C-CDA, you will create an endpoint for each C-CDA you will send. Select Non-CCDA content (no validation) as Expected CCDA Type for XDR content.
Enter in the “Name” field the Name you wish to give this connection and save it.
Click “Save”, this will create a new simulator under the name you entered above. You can continue to create several connections here, give each a different name to reference later. These names can be referenced in the simulator control messages page for filtering.
To leave the “Sim Control” menu up, click “Home”

Set up SUT to send messages to TTT

In validation suite uddiConnectionInfo_g1.xml, for the 2.2 gateway, change the Document Submission endpoint https://<Host Name or IP Address>:8181/Gateway/DocumentSubmission/2_0/DocumentRepositoryXDR_Service to the NIST TLS endpoint created above.
In validation suite internalConnectionInfo_g1.xml, replace all 8181 ports to 443.
In validation suite - g1 - Document Submission test case request, blank out the content for the <urn1:resource> tag.
In validation suite - g1 - Document Submission test case request, change the value of Association type for the <urn4:Association> tag to "urn:oasis:names:tc:ebxml-regrep:AssociationType:HasMember".
In validation suite - g1 - Document Submission test case request, provide a valid value for AccessConsentPolicy tag like urn:oid:1.2.3.4.
In validation suite - g1 - Document Submission test case request, provide a valid value for instanceAccessConsentPolicy tag like 1.2.3.4.123456789.

Send the Message to TTT

In SoapUI, execute the g1 Document Submission test.
Click on “Simulator Message View” in the NIST toolkit. Select the name from the drop down menu “Simulator”.
When the message from the messages list is selected, request and response messages, detailed log are displayed. The response contains the validation errors and/or warnings detected by the tool. Additionally, the bottom part contains a log that can be inspected for further insights on the tests performed.

Acronyms

ATL - Authorized Test Laboratories
CDA - Clinical Document Architecture
MDN - Multicast Domain Name System
MU - Meaningful Use
NHIO - National Health Insurance Office
NIST - National Institute of Standards and Technology
PnR - Provide and Register
SAML - Security Assertions Markup Language
SUT - System Under Test
TLS - Transport Level Security
TTT - Transport Testing Tool

The CONNECT team collaborated with the NIST team on testing and validating SOAP based transport for Document Submission. This is part of an ongoing effort to ensure that the product meets all compliance requirements that are being tested by various certification bodies including NIST. The team is tracking all ongoing work with the NIST team using the Epic story CONN-558. As new use cases for SOAP based transport are introduced in the NIST testing tools, the team will continue to work with the NIST team to ensure and validate CONNECT's compliance.