Instrument access control system

• US 8,250,636 B2
• Filed: 02/05/2010
• Issued: 08/21/2012
• Est. Priority Date: 11/12/2002
• Status: Active Grant

• Current Assignee: EMD Millipore Corporation (Merck & Co., Inc.)
• Original Assignee: EMD Millipore Corporation (Merck & Co., Inc.)
• Inventors: Hirsch, Thomas Steven
• Primary Examiner(s): DADA, BEEMNET W
• Application Number:
  US12/658,509
• Publication Number:
  US 20100235896A1
• Time in Patent Office: 928 Days
• Field of Search: 726 2- 5, 726 26- 29, 713/155, 713/168
• US Class Current: 726/5
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A system for centrally managing a set of network-connected laboratory instruments is disclosed. For example, the system includes a centralized database that includes information about the instruments in the system and about the authorized users of the system. In particular, the centralized database indicates which users are authorized to use each of the instruments in the system. The database may also include information about the operations that each user is authorized to perform using the instruments and information indicating whether tests performed by each instrument must be signed using one or more electronic signatures. The system may recognize a number of “roles,” each of which is associated with a particular set of rights, and may assign one or more roles to each user. Instruments and other elements of the system may access the centralized database over a network to enforce the user rights represented by the information in the database.

Claims

1. A user authenticating access-control and management system for a network-connected shared laboratory instrument comprising:

(A) a network connected shared laboratory instrument;

(B) a network connected domain controller for receiving logon credentials from a user in an attempt to access the shared laboratory instrument, and authenticating the user as an authorized user of the system based on logon credentials associated with the user prior; and

(C) a network connected role server including a role database for determining whether the logon credentials authorize the user to access the selected shared laboratory instrument by comparing the logon credentials to credential information stored in the'"'"'role database by the following steps,

(C)(1) identifying a role of the user;

(C)(2) identifying a set of default laboratory instrument access rights associated with the role;

(C)(3) identifying a set of user-specific laboratory instrument access rights associated with the user;

(C)(4) applying the user-specific laboratory test instrument access rights to the default laboratory test instrument access rights to obtain a set of final laboratory instrument access rights associated with the user;

(C)(5) determining whether the set of final laboratory instrument access rights associated with the user includes the right to access the selected shared laboratory instrument; and

(C)(6) determining that the logon credentials authorize the user to access the selected shared laboratory instruments if it is determined that the set of final laboratory instrument access rights associated with the user includes the right to access the selected shared laboratory instrument;

(C)(7) granting the user access to the selected shared laboratory test instrument only if it is determined that the user is an authorized user of the system and the logon credentials authorize the user to access the selected shared laboratory instrument;

(C)(8) identifying a set of operations that the user has the right to perform using the selected shared laboratory instrument for performing one or more laboratory tests; and

(C)(9) allowing the user to perform on the selected shared laboratory instrument only those operations in the identified set of operations for performing one or more laboratory tests.

2. The system of claim 1 wherein the network connected role server includes an operating system authentication mechanism.

3. The system of claim 2, wherein (C)(7) is performed by means distinct from the operating system authentication mechanism.

4. The system of claim 1, wherein (D) is performed by a computer on which an operating system executes, wherein the operating system recognizes a first set of user-roles, and wherein step (D)(1) comprises a step of selecting the role from among a second set of roles that is independent of the first set of roles.

5. The system of claim 1, wherein (C) is performed by a software program executed by a computer executing an operating system, wherein the operating system recognizes a first set of user roles, and wherein the first determining means comprises means for identifying the role from among a second set of roles that is independent of the first set of roles.

6. The system of claim 1, wherein (B) comprises a step of receiving the logon credentials from the user through an input device coupled locally to the selected shared laboratory instrument.

7. The system of claim 1. wherein the logon credentials comprise a username and a password.

8. The system of claim 1, wherein (D) comprises a step of determining whether the logon credentials authorize the user to access the select one of the plurality of shared laboratory test instruments by comparing the credentials to credential information stored in a local copy of the data store.