Studies and development of digital signature technologies by smart card on handheld devices

INTRODUCTION 
 6
Medical staff performing daily ward rounds or visits to patients are 
usually far from a desktop PC connected to the Hospital Information 
System. So, doctors and nurses would need to memorize all patients' 
clinical information in order to update the HIS after completion of ward 
rounds. This result in time being wasted, and is very inefficient, such that 
medical staff often do not adopt a fluid workflow (i.e. current system are 
paper based, time consuming and not readily accessible). 
Doctors and nurses working with home patients have an even 
greater difficulty managing and accessing up to date information specific 
to the patient they are seeing, as currently it is impossible to access the 
HIS via a patient's home. This is a major factor for considering the 
adoption of a home hospitalization system. 
Another issue addressed by the project is the real-time secure 
management of data from different remote sources (i.e. from research 
projects, clinical trials, ability to pool and share in real time patients' 
information from various sources, e.g. clinical labs, general practitioners, 
other hospitals etc.). 
Mobi-Dev has the aim to provide the clinical staff with portable 
devices (based on palm PCs) wirelessly connected to different 
information databases, able to perform real time data management. Each 
palm PC is integrated with a microphone, a smart card reader, a 
Bluetooth transceiver and a UMTS one. 
 
To achieve the wanted upshot about the security in Mobi-Dev, this 
thesis has the aim to create on the user software interface the possibility 
of signing the prescriptions and the operations made by users during 
their daily work, by using digital signature. 
As first step to perform it has been to implement it on PC side, 
creating a software interface with an application of digital signature, 
where the user interface has to be as near as possible to the health 
professionals way of working, trying to obtain an example of pervasive 
computing where software is developed around user customs, and not 
vice versa. 
INTRODUCTION 
 7
This one is a useful first result for two reason: 
1. It’s just a worthwhile solution to integrate digital signature in a hospital 
informatics structure. 
2. It’s obliged transition to perform it on PDA. 
In fact the thesis has mostly the purpose to consider the possibility 
to implement the digital signature directly on handheld device.  
So the second step is searching how carry out it on PDA and a 
actualized it. 
 
MOBI-DEV PROJECT 
 8
1 CHAPTER 
MOBI-DEV PROJECT 
 
 
1.1 MOBILE DEVICES FOR HEALT CARE APPLICATION 
 
Mobi-Dev is a European project that provides a new generation of 
mobile devices for health care professionals, working in and outside of 
hospitals. 
The innovative Mobi-Dev integrated platform, based on PDA client-
server architecture, will: 
 ξ  provide mobility: giving users access to the Hospital Information 
System (HIS) in their hands at any time from anywhere, in and out side of 
the hospital, using web interfaces based on bluetooth technology and 
UMTS networks. 
 ξ  improve user friendliness: it undertakes the challenge to input data by 
voice: not simply voice transcription but natural language understanding, 
with automatic extraction of structured information 
 ξ  assure security of data transmission and management, identification, 
authentication and certification of users with digital certificates and smart 
cards 
Different are the scenarios, which Mobi-Dev is direct to, either inside 
and outside hospital premises: 
1. Physicians and nurses working inside and outside hospital 
2. Physicians connected with their laboratories and pharmacies 
3. Researchers working in healthcare studies 
MOBI-DEV PROJECT 
 9
 
1.2 THE PROJECT AIM 
 
The Mobi-Dev system improves many aspects of daily routine for 
medical staff and allows health professionals to perform real time data 
management by connecting to different information databases, and to 
exchange clinical data between portable devices and remote databases 
in a security fashion, through the use of electronic signatures. 
Based on the Mobi-Dev's proposed organizational methodology, it is 
envisaged that the addressed problems can be effectively resolved: all 
the above mentioned drawbacks of the system as experienced up to now, 
are completely eliminated. 
Mobi-Dev increases the efficiency, comprehensive management and 
quality of care of European citizens through its innovative integration of 
state of the art technologies. 
It contributes to the future creation of a global intercommunication 
system among health care structures (hospitals, clinical labs, GPs, 
pharmacies etc.) 
 
1.3 TECHNICAL APPROACH 
 
The Mobi-Dev system consists of a platform with a client-server 
architecture integrated with SW applications. It provides the clinical staff 
with portable devices (based on palm PCs) wirelessly connected to 
different information databases, able to perform real time data 
management. 
An Internet based system is sets up to exchange clinical data 
between the Mobi-Dev portable devices and various kind of relevant 
information databases (HIS, GPs personal databases, clinical 
laboratories and pharmacy databases). 
Web interfaces with HIS is realized using standard database 
interfaces products. The palm PC with microphone is  integrated with a 
smart card reader, a Bluetooth transceiver and a UMTS one. 
MOBI-DEV PROJECT 
 10
Central servers manages the mobile devices and performs the 
time/memory consuming tasks, as the language understanding. 
Security and privacy issues are of the main importance for the 
project and put under the strict control of well established experts. User 
identification applications permits the reuse of the same device by 
different persons while smart card application grants . 
 
1.3.1 INCLUDED FEATURES 
 
The smart card grants electronic signing of input data with legal 
validity all over Europe, more over the reuse of the same device by 
different persons , so as the user identification applications permits. 
the Bluetooth connection permit the use of Mobi-Dev inside the 
hospitals in conformity with the most restrictive and recent security 
regarding electromagnetic pollution. It is also lower the communication 
costs within the premises of the hospital requirements. 
GPRS/UMTS connection permits the use of the system for 
transmitting large amounts of data 
The natural language understanding allows the users to enter data 
into structured databases, simply speaking to the palm Pc in a natural 
way. 
The Mobi-Dev Project implements a pilot of the innovative 
communication tool to demonstrate its feasibility and usefulness in 
different scenarios in Italy, Spain, Greece and UK. Target groups are 
nurses and medical doctors working inside and outside the hospital 
premises connected with the HIS, GPs (General Practitioner) visiting 
patients home and being connected with diagnostic laboratories, 
pharmacies and with their own clinical databases and researchers 
working in epidemiological and clinical studies. Accordance to the user 
requests and market demand is assured by users involvement in the 
system definition and by a user centered system evaluation. 
The effective marketing and exploitation of Mobi-Dev tool by the 
end of the Project is the highest strategic priority for the Consortium, in 
accordance to EU policies end SMEs interests of the consortium. 
MOBI-DEV PROJECT 
 11
 
1.4 MOBI-DEV PURPOSES AND TECHNOLOGY TO BE USED  
 
1.4.1 MOBI-DEV KEY-POINTS  
 
1. Integration of health care center’s databases and realization of 
standard and easily accessible coherent interface.  
The most promising technologies seem to be the web related ones. 
In fact, nowadays the major databases already offer a web interface 
through which it is possible to input data and manage the database 
remotely. It’s important to note that most of the HIS do not have a web 
interface; thus, standardizing the various hospital databases imposing a 
particular database for which a web interface has been already 
developed, is, at least in this moment, impossible to do. This fact raises 
the need to develop a solution that will be anyway adaptable to the 
existing situation. The main advantages due to the use of web 
technologies are: 
 ξ  Absolute independence from the platform 
 ξ  No need to develop ad hoc client (it will be based on common 
browsers) 
 ξ  Possibility to rely upon a number of well-known technologies for what 
concerns security (SSL, PKI…) 
 ξ  Possibility to create, in perspective, a global linking framework 
between different health care structures 
2. Possibility to input/output data into the his or database of health 
centers from anywhere, via mobile, wireless connections. 
It is possible to use palm computers as client stations, linked with 
the hospital intranet through wireless technologies (Bluetooth in the 
hospital environment, UMTS or other for the exterior). These palm 
computers has to support at least an Internet browser, a microphone and 
a Smart Card reader. 
3. Possibility to input/output data into the health care centre database in 
an easy and natural way, via natural language recognition.  
MOBI-DEV PROJECT 
 12
Storing information in the database and requesting information 
from it, is realized directly using operator’s voice. A dedicated server, 
always situated in the hospital intranet, carries on the tasks of performing 
speech recognition (i.e. transforming the speech signal into text) and 
analyses the text subsequently for semantic representation of the 
contents. The server receives native speech-files from the portable 
devices over the wireless network and sends back the results of the 
analysis by means of XML messages to the database. 
4. Access to data, possibility to modify and/or integrate them exclusively 
authorized to identified health professionals. 
It is sufficient to use well-known technologies, as for example SSL 
v3, to authenticate with reasonable confidence the user. Users 
certificates are stored in a smart card to increase the system security 
degree. 
5. Possibility of identifying the professional who entered the information 
in the database. 
It is possible to use electronic signature technologies to certify 
data provenience. Smart cards with cryptographic capabilities already 
exist, able to electronically sign data and documents. 
MOBI-DEV PROJECT 
 13
 
1.4.2 HW ARCHITECTURE 
 
The hardware Mobi-Dev needs is a server set (e.g. PC) wired by a 
local area network, the necessary framework for the wireless connection 
(UMTS station, bluetooth stations) and palm PCs. The palms must have 
a wireless modem compatible with bluetooth and UMTS, a Smart Card 
ISO-7816 reader, a microphone and a display with a resolution that 
allows the use of a web browser. 
The web server is composed by a single machine or by different 
machines connected each other (Virtual Web Server) for special needs 
(i.e. big hospital structure, with a big number of clients). 
 
1.4.3 SPEECH UNDERSTANDING SERVER 
 
Mobi-Dev’s activities related to medical natural language 
understanding DO NOT involve basic research, but are concentrated 
around existing tools and products that have been tested as individual 
components in various environments. These components are speech 
recognition software for dictation (several commercial products available 
for some languages) and a semantic parser (developed by L&C for 
analyzing medical prescriptions in Dutch and French). What is new in 
Mobi-Dev is that these components will be used in other functional 
settings than they have originally been developed for. 
The functional and technical scenario for using these tools is the 
following. Healthcare workers will carry hand held computers on which 
they will activate an input form. This form will be filled out by using 
speech, not just by navigating through the form by means of voice, but by 
using full natural speech. The form is just displayed to show the kind of 
information that is expected when entering information, and to display the 
results for immediate verification. The hand held device - with build-in 
voice recorder - will capture the speech signal as an ordinary recorder 
MOBI-DEV PROJECT 
 14
and send it over the wireless network as a WAV-file to a server where the 
speech recognition software is installed. The speech recognition software 
will be bought “as is” on the market. Choices will be made according to 
the availability for the languages included in Mobi-Dev and the 
availability of a software development kit (SDK). 
This server will transform the speech signal into text (speech 
recognition phase), that is then analyzed by the semantic parser (speech 
understanding phase). The parser will generate an XML-message 
containing the semantic interpretation of the text. This message is then 
send to the central DB where the values of the tags of the XML-message 
will be stored in the relevant tables of this healthcare record system. This 
event will then trigger the forms on the hand held devices to be updated 
with the newly received information.  
The server will be implemented as a dedicated NT-server fulfilling 
two basic external functions: the acceptance of WAV-files in an XML-
envelop containing additional identification information related to the 
patient (input-side), and the sending of an XML-message with the results.