Role-based access control

• US 8,448,240 B2
• Filed: 01/30/2007
• Issued: 05/21/2013
• Est. Priority Date: 01/31/2006
• Status: Expired due to Fees

• Current Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Petkovic, Milan, Conrado, Claudine Viegas, Hammoutene, Malik
• Primary Examiner(s): Brown, Christopher J
• Assistant Examiner(s): MOHAMMADI, FAHIMEH M
• Application Number:
  US12/162,844
• Publication Number:
  US 20090019516A1
• Time in Patent Office: 2,303 Days
• Field of Search: 370/350, 705/51, 380255-258, 713/201, 713151-156, 713/161, 713168-170, 713/187, 713/191, 713/193, 709220-224, 726/26
• US Class Current: 726/21
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

A user interface and a processor coupled to the user interface wherein the processor receives access requests through the user interface and authorizes access through the user interface. The processor associates a rights request with a role based policy to determine access rights, modifies the determined access rights in accordance with an exception list related to particular users and records, and authorizes access to a record based upon the modified determined access rights.

Claims

1. A method of using a role-based access control (RBAC)system for controlling access rights to protected resources in a medical record keeping system, the method comprising the acts of:

assigning role based policies to individual users of the record keeping system based on roles of the users, wherein a role based policy includes a set of predetermined access rights for a corresponding role to a medical record of a patient in the record keeping system, wherein the medical record keeping system stores medical records of multiple patients;

modifying the set of predetermined access rights to change access of an individual user to the medical record of the patient in accordance with an exception list related to the individual user and the medical record of the patient without changing the role of the individual user or modifying the role based policy assigned to the individual user;

authorizing access to the medical record based upon the modified set of predetermined access rights, wherein at least one of the acts is performed by a microprocessor;

determining if an exception applies to a majority of the users or a majority of the medical records; and

modifying the role based policy to include the exception if the exception applies to the majority of at least one of users or the medical records.

2. The method of claim 1, wherein the role based policy is a default policy modified to be a personalized policy through instruction from the patient.

3. The method of claim 1, further comprising:

modifying the exception list to apply to a minority of users rights previously controlled by the role based policy.

4. The method of claim 1, comprising the act of associating the role based policy to the exception list.

5. The method of claim 1, wherein the exception list is one of a plurality of exception lists, the method comprising the act of associating each of the plurality of role based policies to one or more of the plurality of exception lists.

6. The method of claim 1, wherein the role based policy is one of a plurality of role based policies and the exception list is one of a plurality of exception lists, the method comprising the act of associating each one of the plurality of role based policies to one of the plurality of exception lists.

7. The method of claim 1, comprising the act of associating additional access rights and restricted access rights with the exception list.

8. The method of claim 1, wherein modifying the set of predetermined access rights include removing present access rights of the user to at least a sub-portion of the record.

9. The method of claim 1, wherein the record includes information about a human subject and the exception list denies access to certain information in the record to the user, and wherein the user was previously given access to the certain information through the assignment of the user with the role based policy.

10. The method of claim 1, wherein the user is a doctor, the record corresponds to a patient, the determined access rights from the role-based policy correspond to default access rights of a doctor to the record and the exception list modifies the determined access rights, and wherein the role-based policy continues to provide the default access rights to doctors assigned the role-based policy after the modified determined access rights.

11. A role-based access control (RBAC) system for controlling access to protected resources, the system comprising:

a user interface;

and a processor operably coupled to the user interface, wherein the processor is configured to receive access requests through the user interface and is configured to authorize access through the user interface, wherein the processor is configured to associate a rights request of an individual user with a role based policy to determine access rights to a medical record of a patient, modify the determined access rights to change access of the individual user to the medical record of the patient without modifying the role based policy in accordance with an exception list related to particular users and medical records, and authorize access to the medical record based upon the modified determined access rights,

wherein the processor is configured to determine if an exception applies to a majority of users, is configured to modify the role based policy to include the exception if the exception applies to the majority of users, and is configured to modify the exception list to apply to a minority. of users rights previously controlled by the role based policy.

12. The system of claim 11, wherein the role based policy is one of a plurality of role based policies and the exception list is one of a plurality of exception lists, the processor configured to associate each one of the plurality of role based policies to one of the plurality. of exception lists.

13. The system of claim 11, wherein the processor is configured to associate additional access rights and restricted access rights with the exception list.

14. The system of claim 11, wherein the processor is configured to update instructions for determining the role based policy by combining the role based policy with the exception list and wherein the access requests are requests to access the medical records.

15. An application embodied on a non-transitory computer readable medium configured to provide a role-based access control system (RBAC), the application comprising:

a portion configured to associate a rights request of an individual user with a role based policy to determine access rights for a corresponding role to a medical record of a patient in the RBAC system, wherein the RBAC system stores medical records of multiple patients;

a portion configured to modify the determined access rights to change access of the individual user to the medical record of the patient in accordance with an exception list related to the individual user and a medical record of the patient without modifying the role based policy assigned to the individual user;

a portion configured to authorize access to the medical record based upon the modified determined access rights;

a portion configured to determine if an exception applies to a majority of atomic blocks that have the same policy;

a portion configured to modify the role based policy to include the exception if the exception applies to the majority of atomic blocks; and

a portion configured to modify the exception list to apply to a minority of atomic blocks previously controlled by the role based policy.

16. The application of claim 15, wherein the role based policy is a default policy modified to be a personalized policy.

17. The application of claim 15, comprising a portion configured to associate the role based policy to the exception list.

18. The application of claim 15, wherein the exception list is one of a plurality of exception lists, the application comprising a portion configured to associate each of the plurality of role based policies to one or more of the plurality of exception lists.

19. The application of claim 15, wherein the role based policy is one of a plurality of role based policies and the exception list is one of a plurality of exception lists, the application comprising a portion configured to associate each one of the plurality of role based policies to one of the plurality of exception lists.

20. The application of claim 15, comprising a portion configured to associate additional access rights and restricted access rights with the exception list.