Norwegian Helsenett
ebMS 2.0 with each payload signed by the sender and encrypted for the recipient - Norway's health messaging profile.
Health messaging in Norway uses the national health network's ebXML framework - ebMS 2.0 exchanges in which the business documents themselves are signed and encrypted. The Norwegian profile requires each payload to be signed by the sender and encrypted for the specific recipient, so a message remains protected when it is stored or relayed.
What the profile mandates
| Requirement | Where it comes from | In Zato |
|---|---|---|
| ebMS 2.0 message structure | The national ebXML framework | ebXML messaging over an outgoing SOAP connection |
| Payloads signed by the sender | The framework's security profile | sign=True on the call |
| Payloads encrypted for the recipient | The framework's security profile | encrypt=True on the call |
| Enterprise certificates for both operations | The national PKI | A WS-Security definition holding the PEM material |
| Party identifiers from the addressing registry | The national directory | from_party and to_party on the call |
Configuring the connection
Step 1. Create a WS-Security definition under Security > WS-Security and fill in its Crypto material tab: your Signing key and Signing certificate chain for the signatures, the recipient's Peer certificate for encryption, and your Decryption key with Trust anchors for what comes back:
Step 2. Create the outgoing connection under Connections > Outgoing > SOAP with the counterparty's address and attach the definition in the Security tab.
Step 3. Send with both switches on - each part is signed first, so the signature covers the plaintext, then encrypted for the recipient:
info = EbXMLInfo()
info.from_party = 'my-her-id'
info.to_party = 'their-her-id'
info.cpa_id = 'cpa-identifier'
info.conversation_id = self.cid
info.service = 'urn:example:messaging'
info.action = 'SubmitMessage'
part = Part()
part.content_id = 'payload-1'
part.content_type = 'application/xml'
part.data = clinical_document
ack = self.soap['Helsenett'].invoke_ebxml(info, [part], sign=True, encrypt=True)
The signatures and the wrapped content keys of each payload go in the message's security header.