FHIR at Scale Taskforce (FAST) Security IG overview
summary
Overview explains how the FAST Security IG extends OAuth 2.0 using Unified Data Access Profiles and UDAP workflows to scale both consumer (authorization code) and B2B (client credentials or auth code) exchanges. It uses asymmetric cryptography and PKI for reusable credentials, JSON Web Token claims to prevent token reuse, trusted dynamic client registration and digitally signed endorsements/certifications for one-time vetting, a tiered OAuth model for identity providers, STU1 published Sept 2022 and active STU2 work with open source implementations and connectathon testing.
AI-written summary · about
chapters (19)
- 0:00Introduction to FAST Security IG
- 1:28History and FAST origins
- 3:15FAST objectives and members
- 4:40Security challenges in FHIR at scale
- 5:44Unified Data Access Profiles (UDAP)
- 6:48Asymmetric cryptography in UDAP
- 7:52UDAP server metadata and security
- 8:35Trusted dynamic client registration
- 9:39Certifications and endorsements
- 10:42Tiered OAuth for B2C interactions
- 11:46B2B and B2C use cases
- 13:33Benefits of reusable credentials
- 14:39Public key infrastructure role
- 15:45Tiered OAuth benefits summary
- 16:50Implementation guide ecosystem
- 17:53How to engage with FAST
- 18:13Q&A: OAuth 2 extensions
- 20:19Q&A: Zero trust environments
- 21:24Q&A: PKI and UDAP value
related talks
01h 01mSharing Health Information Through APIs
01h 04mApisecure, 14 & 15 March 2023 - Grahame Grieve, Principal at Health Intersections Pty Ltd.
43mFHIR® Roadmap for TEFCA Exchange
21mFHIR meets corporate security
27mA Shared Services Model to Promote Rapid Adoption of FIDO2 Within Federal Government
45mApisecure, 14 & 15 March 2023 - John Moehrke, Co-Chair at Security Working Group.
15mEvolution of UAA Towards OAuth 2.1 and OpenID Foundation
01h 00mSupercharging OAuth 2.0 Security