Abstract:
A system and method for controlling access to data within a hierarchically organized document, such as an XML document. Elements may have their access rights specified, for example as a variable in an XML tag. If not specified within an element of the document, access rights are inherited from its nearest ancestor. Specified access rights may refer to a collection of entitlement expressions, which describe with arbitrarily fine granularity which users and user types may access the data.

Description:
[0001]    The present application claims benefit of U.S. Provisional Application No. 60/279,041, filed Mar. 27, 2001, which is incorporated herein by reference. 
     
    
     
       FIELD OF THE INVENTION  
         [0002]    The present invention provides a system and method for managing objects and resources with access rights embedded in nodes within a hierarchical tree structure. The system is suitable for implementation of HL7-approved XML standards for medical records and/or messages.  
         BACKGROUND OF THE INVENTION  
         [0003]    Controlling the access of a large number of users to a vast array of data represents one of the greatest challenges facing the future of the Internet. One example of an immense access control undertaking that will exceed the capabilities of current access control systems relates to the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).  
           [0004]    HIPAA will be implemented in accordance with a Rule (Federal Register/Vol. 65, No. 250/Thursday, Dec. 28, 2000/Rules and Regulations p. 82462, 45 CFR Parts 160 and 164, Rin: 0991-AB08, Standards for Privacy of Individually Identifiable Health Information) promulgated by the Department of Health and Human Services (HHS) in an effort to achieve the adoption of industry standards for the electronic transmission of health information. In short, HIPAA requires that all patient information transfers between organizations be in a standardized form and that standards of privacy be maintained. Health Level 7 (HL7) is an organization that creates the standards for storage and interchange of medical records encompassed by HIPAA. Standardization complications include the fact that there are currently about 400 formats for electronic health care claims processing in use nationwide. Further, the need to manage this information will require finely granular (down to the per field level) access to a massively scaled number of records. This access must obey the mandated confidentiality and respect specific patient confidentiality requests.  
           [0005]    HL7 has chosen the eXtensible Markup Language (XML) as the basis for structuring medical records for storage and messaging. This language organizes data as a tree structure documents. XML is standardized by W3C, (http://www.w3.org/TR/REC-xml). W3C is an international industry consortium responsible for developing common code standards for the World Wide Web.  
           [0006]    Applications storing or transferring medical records will require access control mechanisms to assure that HIPAA requirements are met. It is an object of the present invention to supply this need.  
           [0007]    U.S. Pat. No. 6,061,684, “Method and system for controlling user access to a resource in a networked computing environment,” assigned to Microsoft Corporation (Redmond, Wash.), describes a unified and straightforward approach to managing file and other resource security in a networked computing environment. The invention can be implemented in a multi-user computer network that includes a client computer, a server computer that controls a resource sharable among users of the network, such as a shared file folder or directory, and a communications pathway between the client computer and the server computer. The resource is organized as a hierarchy of elements with a root element at the top of the hierarchy and additional elements below the root element. According to the invention, a request is received to change a protection, such as an access permission, of an element of the resource hierarchy (other than the root) with respect to a particular network user. If the element in question lacks an associated access control list, a nearest ancestor element of the hierarchy is located that has an associated access control list. The first (descendant) element inherits the access control list of the second (ancestor) element. This inheritance is done by generating a copy of the access control list of the second element and associating the generated copy with the first element. The requested change in protection is then incorporated into the generated copy that has been associated with the first element so as to establish an updated access control list for the first element. Further, the requested change can be propagated downwards in the hierarchy from the first element to its descendants having access control lists.  
           [0008]    U.S. Pat. No. 6,038,563, “System and method for restricting database access to managed object information using a permissions table that specifies access rights corresponding to user access rights to the managed objects,” assigned to Sun Microsystems, Inc. (Palo Alto, Calif.), describes an access control database that specifies access rights by users to specified sets of the managed objects. The specified access rights include access rights to obtain management information from the network. An access control server provides users access to the managed objects in accordance with the access rights specified by the access control database. An information transfer mechanism sends management information from the network to a database management system (DBMS) for storage in a set of database tables. Each database table stores management information for a corresponding class of managed objects. An access control procedure limits access to the management information stored in the database tables using at least one permissions table. A permissions table defines a subset of rows in the database tables that are accessible to at least one of the users. The set of database table rows that are accessible corresponds to the managed object access rights specified by the access control database. A user access request to access management information in the database is intercepted, and the access control procedure is invoked when the user access request is a select statement. The database access engine accesses information in the set of database tables using the permissions tables such that each user is allowed access only to management information in the set of database tables that the user would be allowed by the access control database to access.  
           [0009]    U.S. Pat. No. 5,878,415, “Controlling access to objects in a hierarchical database,” assigned to Novell, Inc. (Provo, Utah), describes methods and systems for controlling access to objects in a hierarchical database. The database may include a directory services repository, and/or synchronized partitions. An access constraint propagator reads an access control property of an ancestor of a target object. The access control property designates an inheritable access constraint such as an object class filter or an “inheritable” flag. The object class filter restricts a grant of rights to objects of an identified class. The “inheritable” flag allows inheritance of an access constraint on a specific object property. The propagator enforces the inheritable access constraint by applying it to at least the target object.  
         SUMMARY OF THE INVENTION  
         [0010]    In one aspect, the present invention comprises a system for managing objects and resources with access rights embedded in nodes within a hierarchical tree-structure. The system includes a host, housing a Web server, a database server, an entitlement server, and a transaction server; a network, such as the Internet or an intranet; and one or more client PCs.  
           [0011]    In another aspect, the present invention comprises a method of inputting a transaction in XML form for use in the determination and granting of access rights embedded in nodes within a hierarchical tree structure. The method includes receiving transaction data from the external system; parsing and validating the XML; determining whether the received data is valid; adding access data to the entitlement server and text content to the database server; determining whether an error occurred; sending an error message to the external system; and sending a confirmation message to the external system.  
           [0012]    In yet another aspect, the present invention comprises a method of interacting with a host system into which an XML document has been accepted. The method includes identifying the user accessing the host using a client PC; receiving a request; determining whether an access check is needed; determining whether permission should be granted; performing the request; replying to the user; and handling the denial of the request.  
           [0013]    One advantage of the present invention is that it provides a way to protect objects described by a tree structure.  
           [0014]    A second advantage of the present invention is that it provides a way to protect objects with as much granularity as the tree structure permits.  
           [0015]    A third advantage of the present invention is that it provides a way to protect objects with as much granularity as the set of users permits.  
           [0016]    A fourth advantage of the present invention is that the entitlement IDs (or expressions or objects) can be defined in a diverse ways, allowing for a wide variety of applications.  
           [0017]    A fifth advantage of the present invention is that the entitlement IDs may be collected separately, meaning that they do not need to be sprinkled throughout the code structure. They can be cached before the XML is parsed, leading to improved system speed and efficiency.  
           [0018]    A sixth advantage of the present invention is that may be packaged either as a separate XML document or as a separate part of the document containing the objects to protect. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWING  
       [0019]    The invention is described with reference to the several figures of the drawing, in which,  
         [0020]    [0020]FIG. 1 shows a system for managing objects and resources in a hierarchy with access rights embedded in nodes;  
         [0021]    [0021]FIG. 2 is a flow chart illustrating a method of inputting a transaction in XML form;  
         [0022]    [0022]FIG. 3 is a flow chart illustrating a method of interacting with a host system into which the XML document has been accepted; and  
         [0023]    [0023]FIG. 4 illustrates the used of XML to manage objects and resources in a hierarchy with access rights embedded in some nodes.  
     
    
     DETAILED DESCRIPTION  
       [0024]    [0024]FIG. 1 illustrates a system for managing objects and resources in a hierarchy with access rights embedded in nodes. System  100  includes a host  105 , comprising a Web server  110 , a database server  120 , an entitlement server  130 , and a transaction server  140 , which are all interconnected within host  105 . Host  105  can be either a single computer, or a series of computers operating in concert. System  100  also includes connections to a network  150  (such as the Internet or an intranet), through which an external system  160 , and one or more client PCs  170  connect with host  105 .  
         [0025]    In some embodiments of the invention, external system  160  and client PCs  170  use network  150  to communicate with host  105  for the purposes of generating and receiving documents programmed in XML. In other embodiments, client PCs  170  need never actually create or access XML directly. Instead, web server  110  invokes transaction server  140  to request text from an XML document, and then transforms the text into HTML to send back to the client PC  170 .  
         [0026]    Typically, client PC  170  is a personal computer. External system  160  may be a peer to host  105  or a host-type system of wholly separate elements; however, external system  160  must contain an application capable of generating and translating XML. Host  105  represents a network-connected host environment consisting of one or more servers. Web server  110 , which may be a single server or multiple servers operating in a cluster, executes the functions associated with serving World Wide Web pages. Database server  120  stores the actual content of the XML transactions and is called upon by other elements of host  105  for such content. The internal form of the content need not be XML as long as the tree structuring information is preserved. Entitlement server  130  operates as one type of a database server dedicated to hosting and adjudicating access control for applications served by host  105 . The functionality of one suitable entitlement server  130  is fully described in U.S. Pat. No. 6,154,741 to Feldman, which is assigned to EntitleNet, Inc., and incorporated herein by reference. Transaction server  140  functions as the XML interpreter, and houses various software applications for that purpose, including those that pass portions of submitted XML documents to entitlement server  130  and database server  120  for storage. Transaction server  140  also receives transaction results from entitlement server  130  and database server  120  and responds accordingly to the transaction&#39;s requestor. In addition, transaction server  140  governs the retrieval of requested portions of XML documents.  
         [0027]    [0027]FIG. 2 is a flowchart illustrating a method of inputting a transaction in XML form. Entitlement information within the XML affects the exchange with respect to the way permission to access information is granted. Method  200  includes the following steps:  
         [0028]    Step  210 : Receiving Transaction Data  
         [0029]    In this step, transaction server  140  receives an XML document with associated transaction data generated by external system  160 . External system  160  sends this XML document to transaction server  140  via network  150 .  
         [0030]    Step  220 : Parsing and Validating XML  
         [0031]    In this step, transaction server  140  parses the received XML document to check for validity using software applications and techniques well known in the art.  
         [0032]    Step  230 : Are the Data Valid? 
         [0033]    In this decision step, transaction server  140  determines whether the XML document is valid. If yes, process  200  proceeds to step  240 ; if no, process  200  proceeds to step  260 .  
         [0034]    Step  240 : Adding Access Data to Entitlement Server and Text Content to Database Server  
         [0035]    In this step, transaction server  140  translates the information parsed in step  220  into the appropriate internal form and stores it on entitlement server  130  and database server  120 . In particular, access information is added to entitlement server  130 , and the text information is saved to database server  120 . In addition, some tracking information is added to database server  120  to track the processing performed.  
         [0036]    Step  250 : Did an Error Occur? 
         [0037]    In this decision step, transaction server  140  checks to see if any errors occurred thus far. If yes, process  200  proceeds to step  260 ; if no, process  200  proceeds to step  270 .  
         [0038]    Step  260 : Sending Error Message  
         [0039]    In this step, transaction server  140  sends an error message back to the originating external system  160  via network  150 , and processing ends.  
         [0040]    Step  270 : Sending Confirmation Message  
         [0041]    In this step, transaction server  140  sends a confirmation message back to originating external system  160  via network  150 , and processing ends.  
         [0042]    [0042]FIG. 3 is a flowchart illustrating a method of interacting with a host system into which the XML document has been accepted. While FIG. 2 covered the programmatic interface with host  105  using external system  160 , FIG. 3 instead covers the interaction of client PCs  170  with host  105 . Method  300  includes the following steps:  
         [0043]    Step  310 : Authenticating User  
         [0044]    In this step, Web server  110  authenticates users on client PC  170  talking to host  105  using network  150  and applications known in the art, such as using a secure socket layer interchange.  
         [0045]    Step  320 : Receiving Request  
         [0046]    In this step, Web server  110  receives a request for information from a user using Web-browsing software installed on client PC  170 .  
         [0047]    Step  330 : Is an Access Check Needed? 
         [0048]    In this decision step, Web server  110  determines whether the information request requires an access control check. If yes, process  300  proceeds to step  340 ; if no, process  300  proceeds to step  380 .  
         [0049]    Step  340 : Is Permission Granted? 
         [0050]    In this decision step, entitlement server  130  determines whether to grant access based on user identification obtained in step  310  and the access check performed in step  330 . If yes, process  300  proceeds to step  350 ; if no, process  300  proceeds to step  370 .  
         [0051]    Step  350 : Performing Request  
         [0052]    In this step, entitlement server  130  performs the request received from Web server  110 . The performance of this request (or adjudication) is fully described in U.S. Pat. No. 6,154,741 assigned to EntitleNet, Inc.  
         [0053]    Step  360 : Replying to User  
         [0054]    In this step, Web server  110  sends a reply to the request for information originating from client PC  170  via network  150 , and processing ends.  
         [0055]    Step  370 : Handling Denial  
         [0056]    In this step, Web server  110  handles the denial of access to information (i.e., the user on client PC  170  is not allowed to receive the information requested) by communicating with client PC  170  via network  150 , and processing ends.  
         [0057]    [0057]FIG. 4 illustrates the use of XML to manage objects and resources in a hierarchy with access rights embedded in some nodes. An entitlementID element creates a BMAP object with a name given by the ID attribute and entitles it with the entitlement expression given by the V attribute. (The names are arbitrary and chosen for the purposes of exposition.) An arbitrary number of these may be defined to yield any desired granularity.  
         [0058]    An entitlement attribute within an element specifies the entitlementID governing the element. Entitlements are enforced in a tree-oriented manner with lower or enclosed elements of the tree governed by the enclosing nodes. An exception to this is that an entitlement attribute on an element supercedes the entitlement of higher nodes. This presents two constructs which, when used in concert, allow the specification of the control of access to portions of an XML data structure.  
         [0059]    Other embodiments of the invention will be apparent to those skilled in the art from a consideration of the specification or practice of the invention disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the invention being indicated by the following claims.