SRS-002 The REST API enforces HTTPS for all communications to ensure data security
Category​
- Security
- Regulatory
Importance​
- Critical
Description​
Since it is essential to guarantee data security, all communications between servers and clients must be conducted via HTTPS (Hypertext Transfer Protocol Secure). This encrypts data in transit, safeguarding it against eavesdropping, man-in-the-middle (MITM) attacks, and tampering by malicious entities attempting to intercept sensitive information.
Implementing HTTPS involves configuring the API server to accept only secure connections, redirecting any HTTP requests to HTTPS, and obtaining and managing SSL/TLS certificates. These tasks can often be automated with the help of open-source tools.
Activities generated​
- Implement SSL/TLS encryption for the API.
- Automatically obtain and install SSL certificates.
Implements user needs​
- Protects sensitive user information during transmission, ensuring data confidentiality.
Regulatory requirements​
- 2.1: The device shall be compliant with MDR 2017/745, Annex I, point 17.2, 17.4, 18.8, 23.4(ab).
- 2.2: The device shall be compliant with data privacy regulation (Regulation (EU) 2016/679 (General Data Protection Regulation)).
Causes failure modes​
- Data interception if HTTPS is not enforced.
- Unauthorized access to data due to unencrypted communication.
- Potential regulatory non-compliance.
Tested by software tests​
- PLAN_005: Enforcing HTTPS protocol for API communications
- PLAN_006: Valid SSL/TLS certificates
Implements risk control measures​
- User credentials are securely transmitted over the Internet with encryption.
- Prevent unauthorized access to patient or care provider data.
Acceptance criteria​
- All API endpoints must redirect HTTP requests to HTTPS.
- SSL/TLS certificates must be valid and correctly installed on the API host.
- Successful completion of penetration tests with no vulnerabilities.
Constraints​
- Must use industry-standard SSL/TLS protocols.
- SSL certificates must be renewed before expiration.
Dependencies​
- Availability of free SSL certificates.
Performance considerations​
- Minimal impact on response times due to encryption overhead.
Additional notes​
No additional information is required.
Signature meaning
The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix
of the GP-001
, are:
- Author: JD-004, JD-005, JD-009, JD-017
- Approver: JD-003