METHOD FOR CONTROLLING THE ACCESS TO A DATA NETWORK

• US 20070199048A1
• Filed: 02/07/2007
• Published: 08/23/2007
• Est. Priority Date: 02/07/2006
• Status: Active Grant

• Current Assignee: Siemens Healthineers AG (Siemens AG)
• Original Assignee: Siemens AG
• Inventors: Kaleja, Stefan
• Granted Patent: US 8,438,657 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A method for controlling access to a data network uses an end point identifier associated with an end point for control of the access to the data network. When a user X is logged in at the end point and a data query is directed from the end point to a data server, the data server uses the end point identifier of the end point in order to grant the user authorizations for data access.

Claims

1. A method for controlling access to a data network with a data source and a plurality of end points engaged in data exchange with the data source, comprising:

checking a user identification of a user working at an end point by the data source;

granting, to the user, authorizations for the data processing, which authorizations are associated with the user identification; and

treating an end point identifier as a user identification, wherein the granting of the authorizations correspond to the end point identifier.

2. The method according to claim 1, wherein the authorization for access to data of the data source is granted corresponding to an association of the end point identifier with a user group.

3. The method according to claim 2, wherein the end point identifier is associated with a plurality of user groups.

4. The method according to claim 1, further comprising granting an authorization for execution of work steps on the data stored in the data source corresponding to an association of the end point identifier with a role.

5. The method according to claim 4, wherein the end point identifier is associated with a plurality of roles.

6. The method according to claim 1, further comprising assigning properties of a non-interactive user identification to the end point identifier.

7. The method according to claim 1, further comprising controlling the access to a medical data network 1 wherein data are exchanged according to the DICOM standard, the method further comprising transmitting to a data server serving as a data source, and then subsequently utilizing a logical address of an application entity (which logical address is used as an end point identifier) by the data server 10 as a user identification.

8. The method according to claim 7, wherein granting the authorizations comprises:

granting the authorizations are corresponding to a hierarchical authorization system with a plurality of authorization levels, wherein the authorizations of a superordinate level include the authorizations of a subordinate level.

9. The method according to claim 8, wherein authorizations for partial data access to data of a higher authorization level are granted to the association of an end point identifier with a subordinate authorization level.

10. A data server for a data network, comprising:

a process for checking a user identification of a user working at an end point; and

a process for granting, to the user, authorizations for data processing, which authorizations are associated with the user identification, wherein an end point identifier is treated as a user identification, and wherein the granting of the authorizations correspond to the end point identifier.

11. An end point computer for a data network, comprising a process for exchanging data with a data source, based on an authorization granted based on a user identification that corresponds with an end point identifier.

12. A computer program product for execution on a data server, the computer program product comprising code for checking a user identification of a user working at an end point;

and for granting, to the user, authorizations for data processing, which authorizations are associated with the user identification, wherein an end point identifier is treated as a user identification, and wherein the granting of the authorizations correspond to the end point identifier.

13. A computer program product for execution on an end point computer, the computer program product comprising code for exchanging data with a data source, based on an authorization granted based on a user identification that corresponds with an end point identifier.