Norwegian Helsenett
ebMS 2.0 with each payload signed by the sender and encrypted for the recipient - Norway's health messaging profile.
Health messaging in Norway runs over the national health network's ebXML framework - ebMS 2.0 exchanges in which the business documents themselves are cryptographically protected. Unlike networks that rely on the transport alone, the Norwegian profile requires each payload to be signed by the sender and encrypted for the specific recipient, so a message stays protected wherever it is stored or relayed.
What the profile mandates
| Requirement | Where it comes from | The Zato block |
|---|---|---|
| ebMS 2.0 message structure | The national ebXML framework | ebXML messaging over an outgoing SOAP connection |
| Payloads signed by the sender | The framework's security profile | sign=True on the call |
| Payloads encrypted for the recipient | The framework's security profile | encrypt=True on the call |
| Enterprise certificates for both operations | The national PKI | A WS-Security definition holding the PEM material |
| Party identifiers from the addressing registry | The national directory | from_party and to_party on the call |
Piecing it together
Step 1. Create a WS-Security definition under Security > WS-Security and fill in its Crypto material tab: your Signing key and Signing certificate chain for the signatures, the recipient's Peer certificate for encryption, and your Decryption key with Trust anchors for what comes back:
Step 2. Create the outgoing connection under Connections > Outgoing > SOAP with the counterparty's address and attach the definition in the Security tab.
Step 3. Send with both switches on - each part is signed first, so the signature covers the plaintext, then encrypted for the recipient:
info = EbXMLInfo()
info.from_party = 'my-her-id'
info.to_party = 'their-her-id'
info.cpa_id = 'cpa-identifier'
info.conversation_id = self.cid
info.service = 'urn:example:messaging'
info.action = 'SubmitMessage'
part = Part()
part.content_id = 'payload-1'
part.content_type = 'application/xml'
part.data = clinical_document
ack = self.soap['Helsenett'].invoke_ebxml(info, [part], sign=True, encrypt=True)
The signatures and the wrapped content keys travel in the message's security header, per payload, which is what distinguishes this profile from transport-only protection.