Method, system and program product for automatically managing information privacy

• US 20040088579A1
• Filed: 11/05/2002
• Published: 05/06/2004
• Est. Priority Date: 11/05/2002
• Status: Active Grant

• Current Assignee: Daedalus Blue LLC
• Original Assignee: International Business Machines Corporation
• Inventors: Powers, Calvin S., Presler-Marshall, Martin
• Granted Patent: US 7,469,416 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: G16H 20/10 relating to drugs or medications, e.g. for ensuring correct administration to patients
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A request including a call for the information in a bean and a purpose for the call is received. Upon receipt, the purpose is compared to a privacy control policy that is packaged with the bean. If the purpose complies with the privacy control policy, the requested access and/or use of the information is permitted.

Claims

1. A method for automatically managing information privacy, comprising:

receiving a request that includes a call for information in a bean and a purpose for the call; and

automatically determining whether the requested should be granted by comparing the purpose to a privacy control policy that is packaged with the bean.

2. The method of claim 1, wherein the call comprises a call to a method within the bean, wherein the method includes a procedure that operates on the information, and wherein the method references at least one rule in the privacy control policy.

3. The method of claim 2, further comprising:

providing the information pursuant to a web transaction; and

storing the information and the method in the bean, prior to the receiving step.

4. The method of claim 1, wherein the bean is an ENTERPRISE JAVABEAN.

5. The method of claim 1, wherein the privacy control policy is packaged with the bean as a deployment descriptor.

6. The method of claim 1, further comprising automatically performing access control to the information based on user information corresponding to a requestor making the request and an access control policy packaged with the bean.

7. The method of claim 1, wherein the step of automatically determining is carried out by an application server.

8. The method of claim 6, wherein the application server is WEBSPHERE application server.

9. A computer-implemented method for automatically managing information privacy, comprising:

receiving a request that includes a call for information in a bean and a purpose for the call, wherein the call is to a method within the bean, and wherein the method references at least one privacy control rule that is packaged with the bean; and

automatically determining whether the request should be granted by comparing the purpose to the at least one privacy control rule, wherein the request is granted if the purpose complies with the at least one privacy control rule.

10. The method of claim 9, wherein the bean is an ENTERPRISE JAVABEAN.

11. The method of claim 9, wherein the method comprises a procedure that operates on the information.

12. The method of claim 9, further comprising automatically performing access control to the information by comparing user information for a requester making the request to an access control policy that is also packaged with the bean.

13. The method of claim 9, wherein the at least one privacy control rule is part of a, privacy control policy that is packaged with the bean as a deployment descriptor.

14. The method of claim 9, wherein the step of automatically determining is performed by an application server.

15. The method of claim 9, further comprising:

providing the information pursuant to a web transaction; and

storing the information and the method in the bean, prior to the receiving step.

16. A system for automatically managing information privacy, comprising:

an input system for receiving a request that includes a call for information in a bean and a purpose for the call, wherein the call is to a method within the bean, and wherein the method references at least one privacy control rule that is packaged with the bean; and

a privacy control system for automatically determining whether the request should be granted by comparing the purpose to the at least one privacy control rule, wherein the request is granted if the purpose complies with the at least one privacy control rule.

17. The system of claim 16, wherein the bean is an ENTERPRISE JAVABEAN.

18. The system of claim 16, wherein the method comprises a procedure that operates on the information.

19. The system of claim 16, further comprising an access control system for automatically performing access control to the information by comparing user information for a requester making the request to an access control policy that is also packaged with the bean.

20. The system of claim 16, wherein the at least one privacy control rule is part of a privacy control policy that is packaged with the bean as a deployment descriptor.

21. The system of claim 16, wherein the input system and the privacy control system are part of an application server.

22. The system of claim 21, wherein the application server is WEBSPHERE application server.

23. The system of claim 16, further comprising:

an interface for providing the information pursuant to a web transaction; and

a bean system for storing the information and the method in the bean.

24. A program product stored on a recordable medium for automatically managing information privacy, which when executed, comprises:

program code for receiving a request that includes a call for information in a bean and a purpose for the call, wherein the call is to a method within the bean, and wherein the method references at least one privacy control rule that is packaged with the bean; and

program code for automatically determining whether the request should be granted by comparing the purpose to the at least one privacy control rule, wherein the request is granted if the purpose complies with the at least one privacy control rule.

25. The program product of claim 24, wherein the bean is an ENTERPRISE JAVABEAN.

26. The program product of claim 24, wherein the method comprises a procedure that operates on the information.

27. The program product of claim 24, further comprising program code for automatically performing access control to the information by comparing user information for a requester making the request to an access control policy that is also packaged with the bean.

28. The program product of claim 24, wherein the at least one privacy control rule is part of a privacy control policy that is packaged with the bean as a deployment descriptor.

29. The program product of claim 24, wherein the program code for receiving and the program code for automatically determining are part of an application server.

30. The program product of claim 29, wherein the application server is WEBSPHERE application server.

31. The program product of claim 24, further comprising:

an interface for providing the information pursuant to a web transaction; and

program code for storing the information and the method in the bean.