Rapid Authentication Systems?

Barrington Johnson asks: "I am an emergency physician, and am looking for a solution for authentication which is compatible with rapid logons and logoffs. We have several web-based terminals into which we put information. The web application gives a real-time representation of the emergency department, so it is important that it is kept up to date. We have an opportunity to re-design our system, and I know that if I make the authentication process too difficult e.g. username+password, doctors will store up their data entry, and do it all in one go, removing the real-time usefulness of the display. At what level (application/browser/system) should authentication occur, and what method would be best?" Might a smartcard-based authentication system work well in this situation?

USB Keys

[ffejie]

Maybe you could use something like USB Keys for easier authentication? I didn't think it got any easier than a username and a password.

SmartCards slow -- YMMV

[redelm]

We use SmartCards with PINs at work in an MS-Win2k environment. They take ~5 sec to authenticate. UID/pw takes less than 1 sec.

A restaurant-type system might be best/fastest.

Perhaps forgo authentication? Or make it concurrent with data entry? A "secret" 4-6 char UID field that whoever fills-in when they enter other data (vitals).

Re:SmartCards slow -- YMMV

[zhiwenchong]

This is interesting. 5 seconds? That's slow.

Are these proximity-type cards? Can RF-based proximity-card readers be used with terminals?

I use a proximity card to enter university buildings, and it takes less than 1 sec for the reader to read my card, find my record in the authorized personnel database, and unlock the door. Instantaneous.

UID/pw usually takes more than 1 sec -- it depends on the length of UID and pw, and how fast the person can type.

Re:SmartCards slow -- YMMV

[redelm]

These are not prox cards. We have those too and they are fast. These are SmartCards with a gold surface chip.

Agreed on the typing, I was measuring from complete entry of data to access-grant.

Other smartcard problems

[jtheory]

Another smartcard slow-down problem -- where would they keep the cards? In a pocket (and possibly left at home) means it's going to be much slower (where's that darned card?), and possibly inaccessible. On a cord around the neck? That might be a bad idea -- I read an article about how doctors are now strongly discouraged from using neckties - a study found they tend to be teeming with bacteria; whenever he leans forward, it drags in... whatever he's standing next to. Plus, what's the last thing you do a

Here you go

[wbav]

A nice device, allows over-ride if you loose it, and instant unlock as need be.

wireless lock [thinkgeek.com]

Re:Here you go

[Triumph The Insult C]

sorry, i think you got that wrong

the correct link is here [diebold.com]

2 tiers of authentication

[arrow]

Maybe consider 2 tiers of authentication.

First level being a 4 digit pin that can be easily entered at a login screen that will allow view access to all the important data.

Second level, require a username and password if anyone actualy wants to modify something.

Re:2 tiers of authentication

[V. Mole]

Uh, the whole point is to encourage easy modification, so that the records are up to date.

Simple answer...

[SoCalChris]

I am an emergency physician

Hire a professional web designer that specializes in security. I wouldn't want people to expect me to be a doctor, and I wouldn't want a doctor designing a secure web site for me.

No offense, but for something like medical records, stick to what you went to school for.

Re:Simple answer...

[sixseve]

I don't think he's planning to implement this himself. When you hire a web designer or system implementor you need to know what to ask for, and I think that's what he's trying to figure out here.

Re:Simple answer...

[thesp]

I think that this is not a good way forward. What makes you think that a professional generic information-content-presenter will have any real understanding of the needs of a professional information-user when it comes to a system that is not directed at a mass audience, and must be excatly tailored to achieve maximum efficiency and usability.

Too often hav I seen professional designers choose technology over stability and form over function when it comes to implementing everyday tools. When it comes to m

Host-Based Auth

[sampowers]

Depending on your network setup, host-based auth might be best. You could assign a specific IP address based on a DHCP Client-ID and have the web app look up the client's address in a table to determine if it's allowed automatic access (ie, to jump straight to an authorized state), or otherwise to prompt for a username/password, and thereby set the authorized state.

Re:Host-Based Auth

[Atzanteol]

Client certs would be better for this, but I think then you have the problem that these terminals are shared. How do you know who's using it?

Re:Host-Based Auth

[sampowers]

I just thought of this after posting, but maybe kerberos is a possibility, although I'm not very familiar with it..

iButtons or other hardware keys

[psyconaut]

You could augment with a PIN or password, too. They're actually quite easy to implement...infact, you could do the authentication in Java within the web app.

http://www.ibutton.com

-psy

It depends.

[Nos.]

Like everything... it depends.

How secure are the workstations? If the public can get at them then security is still a big concern. If not, a simple 4 digit pin as others suggested might be enough. However, if its feasible that a unknown person could have a few minutes unobserved at the machine, then I would look for something a little more secure

How quick is quick? Smart cards, or USB keys could be quick, but if in a hurry, Doctors may not want to fumble around with something else they have to carry around... and what if they forgot it at home. Typing username - TAB - password - ENTER is usally very quick for anyone that has typed their username and password a few times. However, it could be inconvenient if the doctors are not usually standing/sitting with both hands free. What is the environment like? Do they sit at a desk, or quickly pass one of these terminals, click a few buttons, and continue on? If they're time spend at the terminal is measured in minutes, 5 seconds to log on wouldn't be inappropriate. If its measured in seconds, something quicker should be investigated.

What's the budget like? Bio-metric sensors are always an option, like a thumb print scanner. However, these would be slightly more costly that a small USB key, but eliminate remembering passwords/pins and carring around an ID card/USB key.

Re:It depends.

[Anonymous Coward]

How about the problem with examination gloves and thumbscanners. some form of RFID on a card they already carry might be handiest

Depends on your security needs

[hackstraw]

I'm not sure how sensitive the data is, but I'm assuming its relatively low. (Please don't go on a tangent here, there is little to no security involved with paper files...)

The quickest/easiest/cheapest way would be to use a standard mag strip reader or an RFID tag with no pin/password etc, just a swipe, and someway to "logout".

If more security is needed or possibly variable security needed (maybe 1st screen is kinda public domain, but to get more details you need more authentication), then a smartcard that uses its serial number as a token like in the RFID or mag strip example I just gave, and then the user would have to put in a PIN to get the more sensitive data.

The fortunate thing is that all 3 technologies are pretty inexpensive and easy to work with.

Re:Depends on your security needs

[UberGeeb]

How about something similar that doesn't even require a logout? Use RFID or other proximity-based id, and the system will only accept data if it's accompanied with an appropriate id from that terminal's scanner. Combine with a short pin or password in the data entry form in case someone manages to lift an id from an authorized user and you should have a secure enough system.

Don't require a session login, require an id and associated pin number with each data transaction.

Re:Depends on your security needs

[demonlapin]

I'm in med school, so I know how awful the authentication via user/pass is (really the only terrible thing about the VA system, if you ever worked in one of those).

If it were my institution, we've already got transponder-on-the-ID-card-based authentication for entry to ER, ICU, OR, etc. I'd just extend that system out to provide authentication. Define a logout key, and you're done.

If you're in a smaller environment, that would be a new expense, and maybe a hard sell to the admin. But it's totally HIPAA-t

Check out a Sun Ray solution

[Kevin Burtch]

Try a different approach... instead of having to log in and out of a web page each time, log in once (per shift) and take your session with you.

The Sun Ray will allow you to log in using both your smartcard and your login/password combo.
Once logged in, you can launch your web browser and log into whatever you need (and whatever other apps you need).
Now, if you need to run away... just yank out your smartcard and the Sun Ray is available to someone else (they have to login at this point).
When you got back,

Re:Check out a Sun Ray solution

[Red Leader.]

I used one of these in a university hotel. It was slow as hell to bring the desktop up after I inserted my keycard. I think a prox card would be easier - it's not like doctor's don't already have a clip full of IDs.

Re:Check out a Sun Ray solution

[Kevin Burtch]

Sounds like the server was VERY poorly configured.

The Sun Ray device itself does not determine the performance.
Any lag or performance issue will be due to a severely overloaded server, or poorly configured network.

I've set up multiple labs for universities, and they love them... no performance problems at all.

Hire me

[Tye_Informer]

One suggestion here is to hire a security professional. That is not a bad idea.

However I have a better one. Hire me! (Better for me, at least). But seriously, if you can't figure out the best solution, you certainly are not going to get it solved here. Bring in a consultant who specializes in this aspect of your business (ER management) and have them explain the options.

It is not clear what your requirements are, but I am not sure this is a good candidate for a "technology" solution. Charts are still the standard method for tracking in ER environments and a good old-fashioned white board is a pretty good way to track assignments. No matter what the solution, if the doctor has to go away from the patient to check status or update status the system is going to be always out of date (hence charts hanging on for so long).

I know this isn't the sexiest solution but you need to prepare yourself for the boring solutions when you present this problem.

SunRay or similar

[Jahf]

I'll post anonymously just so I don't get flamed ... yes, I work at Sun ... blah :)

A SunRay server + terminals would seem ideal here. Pop your smartcard in, log in once in the morning, pull the card out and walk away. Need to enter something? Walk to an available terminal anywhere on the same network and pop your card in again. Your session appears. Rinse, wash, repeat. No keyboard input except during the login.

If you have enough memory you can just keep the sessions running indefinitely. I would highly r

Something you have and something you know

[_LORAX_]

Those are the two items that will make a system secure. I would say proximity RFID reader + pin code.

When the Dr walks up it unlocks and askes for a pin ( it already knows who you are ). Once the pin is entered you are set... once the RFID leaves range ( 5-8 ft ) the station would automaticly lock. I personally think this would be the best of all worlds. I would not skimp on the proximity sensor for a card swipe since locking the station is still important, and the card is one more thing that they would have to keep clean. As much as the slashdot crew hares RFID it could be very handy you have to admit.

Re:Something you have and something you know

[Thomas Shaddack]

Modification: Put the RFID into a ring that the operators will wear, and the reader into the keyboard. The ring can be the base for the chip's antenna coil. Lock the input when there is no RFID response for more than 10 seconds. Voila - automatic login, automatic logout, zero attention needed to operate the system. Short range of the sensing prevents false identifying of different person unless they both want to have their hands over the keyboard at once, and as the presence of hands over the keyboard is ne

iButtons

[sshack]

Something like a timed ticket+ibuttons would work.
Doctor arrives at work, logs in his user/password then simply taps his ibutton on whatever system he wants to use. Hit's the logout button when he's done, and moves on to the next machine.

Why do the login/pass thing in the morning? Because people lose small things like ibuttons. So each morning when you login (and for the next 8 hours or however long until the login ticket expires) the ibutton supplies is the new "key". If you lose it, simply get a new one

Why authenticate?

[Andy_R]

Why is authentication needed?

In an ER situtation, there must be hundreds of things lying around that unauthorised people MUST NOT mess with, or people die and other people get fired. Just define the terminal as one of those things.

Stick a dummy video camera pointing at the keyboard, and tell all the unauthorised staff they'll get fired if they are seen touching it.

If you need to identify who is making entries, give every doctor a dedicated function key, and refuse any entires that are not preceded by a fkey press.

Re:Why authenticate?

[BrynM]

Why is authentication needed?

One acronym my friend: HIPAA [hhs.gov]. The Federal and State governments would get a little mad at you and fine you lots of money... Then it's the patient's turn to raid your pocketbook.

Re:Why authenticate?

[flink]

I work for a medical software company. Due to HIPAA regulations, if we even have PHI on our PC, even if it's not being displayed, we have to lock the PC when we aren't there. All hard copies have to be locked up and disposed of in a secure container. We also have to be able to disclose to our customers and their patients who viewed what data when and for what purpose if demanded of us, so all access has to be authenticated.

Mag Stripes, Edit Windows

[Cranx]

1) Magnetic stripes on the neck-worn ID tags which contain a unique sequence of characters which are the equivalent of/tied to a doctor's username/password. Require the doctors to swipe them everywhere to input data. Periodically require doctors to re-key their cards.

2) Keep a central authentication system, but also mirror authentication information locally to wherever a doctor authenticates so subsequent authentications go quickly.

3) Disallow record editing after hours without permission. Counsel doctors who habitually require after-hours editing.

Re:Mag Stripes, Edit Windows

[megabeck42]

4) Audit logs. Record the entry and modification of every piece of information. Log time, username, and terminal.

4a) Remember that its not your job to review the audit log and you should not unless subpoenaed.

4b) Consider getting an old ibm/lexmark proprinter, one of the old, built-to-withstand-ww3 fan-fold printers to have a paper copy of the logfiles.

4c) An even better model is where you prohibit the removal of records. When information must be corrected, an update is added such that the old and new in

Something like this:

[Breakerofthings]

USB Wireless Security Lock [thinkgeek.com], if it can tell the difference between Bob and Tom, for example, would be ideal, for starters.
You haven't really asked an answerable question, however, since you didn't tell us what the exact security requirements are.
e.g., just don't secure the damn thing would be a legitimate response in some circumstances (probably not this one, granted).

Identifying a suitable solution depends on determining just how 'secure' the system needs to be; there are different requirements for se

BlueTooth

[cs668]

It seems like you could use a BlueTooth device to authenticate. The same way that if you have a BlueTooth cell-phone the screensaver on a mac will shut off when you get close to the system.

Go to lunch..

[omega9]

..at some place like Applebees and watch the waitstaff work. Every person active on the floor has a badge with a magstrip that's attached to a ripcord on their belt. Every time they need to use a register they have to swipe their card for access, and when they walk away I'm sure they're required to logoff. It's all touchscreen and the units seem to update very quickly (screen refresh, zero wait time, etc...). I'd bet the whole system is tightly controled and transactions are tied back to exact individual em

BYPASS the terminals

[nusratt]

Use a portable device for data collection, i.e. a PDA, or Tablet PC, or one of the various intermediate form-factors. When the user is ready, data is transmitted either wirelessly or by briefly docking the device. Authentication is inherent in the ID of the transmitting device. If user-acceptance of data-entry into a small device is a problem, then spread around some full-size docking keyboards for shared use.

Also, I'd bet money that there are already vendors or VARs who offer vertically-integrated solut

zerg

[Lord Omlette]

The fact that you have to ask slashdot means your security is weak and needs a serious audit, pronto.

re: shiny things, consider a biometric fingerprint scanner [kk.org].

Other options

[gmiller123456]

You could use one of the fingerprint scanners, they're pretty cheap now. Also a while back I remember hearing about a system that used a webcam, and automatically recognized you when you walked up to the computer.

Depending on the level of security you need, you could just as easily not have any authentication at all, and just tell unauthorized users not to touch it.