Method and system for providing a secure multi-user portable database

• US 7,661,146 B2
• Filed: 07/01/2005
• Issued: 02/09/2010
• Est. Priority Date: 07/01/2005
• Status: Active Grant

• Current Assignee: Privamed Incorporated
• Original Assignee: Privamed Incorporated
• Inventors: Karimzadeh, Mansour Aaron, Schaeffer, Mark Douglas, Namdar, Farshad, Dilmanian, F. Avraham
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US11/173,133
• Publication Number:
  US 20070006322A1
• Time in Patent Office: 1,684 Days
• Field of Search: 705/2, 705/52, 705/75, 713/193, 713/156, 713/165, 713/166, 713/167, 713/173, 713/175, 726/9, 726/27, 726/28, 726/29, 726/30
• US Class Current: 726/27
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: G16H 10/65 stored on portable record carriers, e.g. on smartcards, RFID tags or CD
• CPC Class Codes: H04L 2209/88 Medical equipments
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A system and method for providing, managing, and accessing a multi-user secure portable database using secure memory cards is provided. The database has a secure portion for storing security keys and a non-secure portion for encrypted data files. Access to the encrypted data files is controlled by assigning access rights through an access control matrix to each encrypted data file according to a hierarchical structure of users. A user requesting access is identified in the hierarchy, associated with a key for allowing the requested access, and the requested access allowed to a file in accordance with the rights allocated through the access control matrix. A patient can selectively grant access to encrypted medical records on his card to a physician. Authentication of the owner/patient is preferably required. Other records required by emergency medical personnel are readable from the same card without requiring permission from the patient.

Claims

1. A method of providing, managing, and accessing a multi-user portable secure database comprising:

providing a first portable database stored on a portable storage device with a secure portion and a non-secure portion;

storing security components for encrypting and decrypting data files in the secure portion of the first portable database;

storing encrypted data files in the non-secure portion of the first portable database; and

controlling access to the encrypted data files using a first computer process being executed by a processing device, wherein said controlling access further comprises;

assigning an access control matrix to each encrypted data file in the first portable database according to a hierarchical structure, wherein the access control matrix defines access rights of each user to each encrypted data file, the access control matrix assigning a level of access to each type of access;

associating a user requesting access with one of the security components comprising a key for allowing the requested access to the first portable database in response to authentication of a second portable database against the first portable database by the first computer process, the second portable database comprising a secure portion; and

allowing the requested access to one or more of the encrypted data files in the first portable database based on the authentication performed by the first computer process and in accordance with the access control matrix in the first portable database.

2. The method of claim 1, further comprising:

issuing each user a certificate that identifies the issued user in the hierarchical structure; and

additionally storing a private key associated with the certificate in the secure portion, wherein said allowing the requested access includes identifying the certificate with the user requesting access.

3. The method of claim 1, wherein the secure portion and the non-secure portion reside on at least one secure memory card or on at least one secure token comprising a processor.

4. The method of claim 1, the method further comprising accessing the secure portable database, said accessing comprising authenticating the user requesting access, said authenticating comprising providing authenticating data to identify the user requesting access.

5. The method of claim 4, wherein the authenticating data comprises at least one of biometric data and keypad input.

6. The method of claim 5, wherein the biometric data comprises a fingerprint.

7. The method of claim 5, wherein the keypad input comprises one of a personal identification number and a password.

8. The method of claim 4, wherein said authenticating further comprises comparing the authenticating data to a known identifier of the user requesting access, wherein the known identifier is stored in the secure portion.

9. The method of claim 4, wherein the stored security components include a private key and a certificate of the user requesting access, wherein the certificate comprises a public key of the user and identifies the user in the hierarchical structure, and wherein said accessing further comprises:

retrieving the private key and the certificate of the user requesting access from the secure portion in response to said authenticating.

10. The method of claim 9, wherein a type of access requested is selected from a group comprising Create, Read, Update and Delete, and further wherein the level of access assigned to each type of access is selected from a group comprising Restricted, Allowed, Grant and Supergrant.

11. The method of claim 10, wherein the type of access requested is the Create type of access, the user requesting access writing a new file to the portable secure database, said writing comprising:

retrieving the certificate in response to said authenticating;

automatically embedding the hierarchical structure obtained from the certificate in the new file;

automatically generating and embedding the access control matrix;

automatically encrypting the new file according to the access control matrix; and

storing the encrypted new file in the non-secure portion.

12. The method of claim 11, said writing further comprising digitally signing the encrypted new file.

13. The method of claim 11, wherein the hierarchical structure comprises levels identifying each user, groups to which each user belongs, and a world that includes all groups in the portable secure database, and wherein

said automatically encrypting comprises:

identifying every user and group to which the level of access for at least one type of access to the new file is not Restricted according to the access control matrix;

retrieving a public key for every identified users and groups; and

encrypting the new file with the public keys for the identified users and groups.

14. The method of claim 11, said writing further comprising:

providing a log comprising a hash of each encrypted data file to verify integrity of the portable secure database;

creating a hash of the encrypted new file;

updating the log in response to said writing the encrypted new file; and

digitally signing the log with a card administrator key.

15. The method of claim 11, said writing further comprising:

time stamping the encrypted new file.

16. The method of claim 11, the method further comprising exporting the encrypted data files to at least one of a local or remote backup storage space.

17. The method of claim 10, wherein the requested type of access is the Read type of access, the user requesting access to read one of the encrypted data files, said reading comprising:

retrieving the one of the encrypted data files from the non-secure portion, the one of the encrypted data files being encrypted with the public key of the user requesting access;

retrieving the private key from the secure portion upon authentication;

decrypting the one of the encrypted data files with the private key in accordance with the level of access provided in the access control matrix.

18. The method of claim 17, wherein the one of the encrypted data files is digitally signed, the method further comprising:

accessing a digital signature attached to the one of the encrypted data files;

obtaining a certificate of a user owning the digital signature, the certificate comprising the owner'"'"'s public key; and

validating the digital signature using the owner'"'"'s public key.

19. The method of claim 4, said authenticating further comprising:

providing challenge data in response to said retrieving;

providing response data by digitally signing the challenge data with the private key;

retrieving the public key from a certificate; and

using the public key to validate the response data.

20. The method of claim 19, said authenticating further comprising validating an expiration date of the certificate, wherein the expiration date is stored in the certificate, said validating comprising comparing the expiration date to a trusted time stamp.

21. The method of claim 1, further comprising:

providing a counter associated with one of the encrypted data files; and

stepping the counter in response to the one of the encrypted data files being successfully updated.

22. The method of claim 1, wherein the portable secure database is a medical database comprising a plurality of personalized data cards, wherein a type of access requested is selected from a group comprising Create, Read, Update and Delete, further wherein the level of access assigned to each type of access is selected from a group comprising Restricted, Allowed, Grant and Supergrant, and wherein the method further comprises:

initializing each data card with identifying records, wherein said initializing is performed by a card administrator; and

issuing a certificate and a private key associated with an owner of each of the plurality of data cards on the owner'"'"'s card.

23. The method of claim 22, wherein one of the encrypted files is a pharmaceutical prescription with a number of refills, the method further comprising providing a counter associated with the number of refills;

and

decrementing the counter in response to a pharmacist filling the pharmaceutical prescription.

24. The method of claim 22, wherein the hierarchical structure comprises levels identifying each user, groups to which each user belongs, and a world that includes all groups in the portable secure database,

wherein the groups include an emergency medical team group, a hospital group, a physician group, a patient group, and a health insurance company group, and

wherein at least one of the users is a patient in the patient group, one of the plurality of data cards being a patient card owned by the patient, the patient card comprising the patient'"'"'s encrypted personal medical records;

the method further comprising;

allowing access to any user included in the world of users of the medical database to read encrypted data files comprising identifying data from the patient card, said allowing comprising assigning the Allowed level of access to the Read type of access to the world level in the access control matrix assigned to the identifying encrypted data files.

25. The method of claim 24, wherein the identifying data comprises at least one of a name, a card identification number, a date of birth, an address, a social security number, a photograph, a religious preference, an image of a driver'"'"'s license, organ donor information, and special medical conditions.

26. The method of claim 25, wherein the user requesting access is a member of the emergency medical team group, the method further comprising allowing access to the emergency medical team user to read encrypted data files comprising emergency records and to write new encrypted emergency records comprising an access matrix including the Allowed level of access to the Read type of access to the emergency medical team group and to the hospital group.

27. The method of claim 26, wherein the emergency records comprise at least one of blood type, allergies, epilepsy, diabetes, heart conditions, metal plates, pace makers, and other special medical conditions, and

wherein the new emergency records comprise vital signs, blood pressure, and other medical data collected during emergency treatment.

28. The method of claim 24, the method further comprising the patient assigning to one of the encrypted personal medical records a level of access selected from Allowed, Grant, or Supergrant to a Read type of access to one of the physicians in the physician group.

29. The method of claim 28, the patient assigning further comprising:

authenticating the patient; and

authenticating the one of the physician with the patient card present, wherein the one of the physicians acquires the selected level of access in response to said authenticating acts.

30. The method of claim 24, wherein a type of access requested is the Create type of access, further wherein the user requesting the Create type of access is one of the physicians, the one of the physicians requesting access to write a medical record to the patient card, said writing comprising:

authenticating the one of the physician;

embedding the hierarchical structure;

embedding the access control matrix;

providing a randomly generated key;

encrypting the medical record with the randomly generated key;

encrypting each certificate corresponding to each group to which a level of access other than Restricted has been assigned according to the access control matrix with the randomly generated key;

attaching the encrypted certificates to the encrypted medical record; and

storing the encrypted medical record to the non-secure portion of the patient card.

31. The method of claim 30, said writing further comprising:

encrypting the randomly generated key with the patient public key; and

storing the encrypted randomly generated key on the non-secure portion of the portable database.

32. The method of claim 31, wherein a type of access requested is the Read type of access to the encrypted medical record on the patient card, said reading comprising:

authenticating the user requesting read access;

authenticating the patient;

retrieving the patient private key and the encrypted randomly generated key in response to said authenticating;

decrypting the encrypted randomly generated key automatically with the patient private key;

decrypting the medical record with the randomly generated key; and

allowing access to the user requesting read access in accordance with the access control matrix.

33. The method of claim 30, wherein said writing further comprises storing the randomly generated key on the secure portion of the patient data card, further wherein a type of access requested is the Read type of access to the encrypted medical record on the patient card, said reading comprising:

authenticating the patient;

authenticating a user requesting read access;

retrieving the patient private key and the randomly generated key in response to said authenticating;

decrypting the medical record with the randomly generated key; and

allowing access to the user requesting read access in accordance with the access control matrix.

34. The method of claim 30, said writing further comprising:

providing a Card Administrator public key; and

additionally encrypting the randomly generated key and the attached certificates with the Card Administrator public key.

35. The method of claim 34, wherein a type of access requested is the Read type of access to the encrypted medical record on the patient card, said reading comprising:

providing a Card Administrator private key; and

decrypting the randomly generated key and the attached certificates with the Card Administrator private key.

36. The method of claim 1, wherein the first portable database comprises a portable database card associated with a first holder and the second portable database comprises a portable database card associated with a second holder.

37. The method of claim 36, wherein the first holder is a patient and the second holder is at least one of a doctor, health care provider, pharmacist, medical insurance company, and an Emergency Medical team (EMI) worker.

38. A multi-user system for storing, updating, and accessing secure data records, said system comprising:

a first portable database device comprising;

a secure portion and a non-secure portion;

a data structuring module configured to embed a hierarchical structure for each user into each secure data record in the first portable database device, wherein the hierarchical structure identifies each user and allows for assigning access rights to each secure data record; and

an access control module configured to embed a security element into each secure data record and to cooperate with a security management module for managing a plurality of security elements associated with a plurality of users and with said data structuring module,

wherein said access control module is configured to assign the access rights for each user to each secure data record and to allow a user access to a secure data record in accordance with the assigned access rights, and

wherein the non-secure portion of the first portable database comprises the secure data records and the secure portion comprises at least one of the plurality of security elements; and

a second portable database device comprising a secure portion and configured to hold authentication information, wherein the second portable database device is authenticated against the first portable database device using the authentication information before the user is permitted to access the first portable database device.

39. The system of claim 38, further comprising a management module comprising:

a user authentication module to identify and authenticate a user requesting access; and

a key management module configured to manage and store the plurality of security elements for embedding into the secure data records in cooperation with said access control module.

40. The system of claim 39, wherein the user authentication module is configured to accept at least one of biometric data and keyboard input.

41. The system of claim 38, wherein the plurality of security elements include encryption keys and certificates associated with the plurality of users.

42. The system of claim 38, wherein the hierarchical structure includes levels identifying each user, groups to which each user belongs, and a world that includes all groups in the first portable database device.

43. The system of claim 42, wherein the access rights comprise a level of access assignable to each type of access for each user according to the hierarchical structure.

44. The system of claim 43, wherein the assignable levels of access include Restricted, Allowed, Grant and Supergrant.

45. The system of claim 44, wherein the types of access include Create, Read, Update, And Delete.

46. The system of claim 45, wherein the secure data records comprise patient medical records and wherein the first portable database device comprises a plurality of data cards, wherein the groups include an emergency medical team group, a hospital group, a physician group, a patient group, and a health insurance company group, and

wherein at least one of the users is a patient in the patient group, at least one of the plurality of data cards being a patient card owned by a patient from the patient group, the patient card comprising the patient'"'"'s encrypted personal medical records.

47. The system of claim 38, wherein the secure data files comprise at least one of textual data, digital images, digital audio data, and digital video data.

48. A multi-user system adapted to store, update, and access secure data records using, said system comprising:

a portable database device, said portable database device comprising;

a secure portion and a non-secure portion;

a first data path adapted to provide access to the security element in the secure portion and a second data path adapted to provide access to the secure data record in the non-secure portion;

a data structuring module, configured to embed a hierarchical structure for a user into a secure data record in the portable database device, wherein the hierarchical structure identifies the user and allows for assigning access rights to the secure data record; and

an access control module, configured to embed a security element into the secure data record and to cooperate with a security management module for managing a security element associated with a user and said data structuring module,

wherein said access control module is configured to assign the access rights for the user to the secure data record and to allow a user access to the secure data record in accordance with the assigned access rights, and

wherein the non-secure portion of the portable database device comprises the secure data records and the secure portion comprises at least one of the plurality of security elements.

49. A method of providing, managing, and accessing a multi-user portable secure database comprising:

providing a portable database stored on a portable storage device with a secure portion and a non-secure portion;

storing security components adapted to encrypt and decrypt data files in the secure portion of the portable database;

storing encrypted data files in the non-secure portion of the portable database;

storing, in the portable database, an audit log associated with at least one of the encrypted data files in the portable database, the audit log providing information concerning modifications to the at least one of the encryption data files;

hashing the audit log using a first computer process being executable by a processing device; and

controlling access to the encrypted data files using a second computer process being executable by the processing device, wherein said controlling access step further comprises;

assigning an access control matrix to each encrypted data file in the portable database according to a hierarchical structure, wherein the access control matrix defines access rights of each user to each encrypted data file, the access control matrix assigning a level of access to each type of access;

associating a user requesting access with one of the security components comprising a key for allowing the requested access to the portable database; and

allowing the requested access to one or more of the encrypted data files in the portable database using the second computer process in accordance with the access control matrix in the portable database.

50. The method of claim 49, further comprising rehashing the audit log, thereby ensuring that the at least one of the encrypted data files has not been tampered with.