Patent Application
20080027939
These and other features of this invention will be more readily understood from the following detailed description of the various aspects of the invention taken in conjunction with the accompanying drawings in which:
The drawings are not necessarily to scale. The drawings are merely schematic representations, not intended to portray specific parameters of the invention. The drawings are intended to depict only typical embodiments of the invention, and therefore should not be considered as limiting the scope of the invention. In the drawings, like numbering represents like elements.
For convenience purposes, the Detailed Description of the Invention has the following sections:
I. General Description
II. Computerized Implementation
As indicated above, the present invention provides a method, system, and program product for managing personal attributes across enterprise domains. Specifically, under the present invention, personal attributes for an end-user will be located among the enterprise domains. Once located, the personal attributes will be grouped into a set of profiles based on associated services (e.g., medical, insurance, etc.). The end-user can log into the system to see his/her personal attributes and to provide input regarding how access to the personal attributes should be controlled. Specifically, based on the end-user's input (and possibly other factors such as applicable legislation) an access control policy will be generated and used to control access to the personal attributes. In addition, any transactions involving the personal attributes will be recorded so that auditing can take place.
Referring now to
Under the present invention, PIMS 16 will first locate the personal attributes 12A-C of user 18 that are distributed across enterprise domains 14A-C. In general, enterprise domains 14A-C are maintained by service providers utilized by end-user 18. For example, enterprise domains 14A-C are maintained by a university medical center, an employer, and a bank of end-user 18, respectively. As further shown, enterprise domains 14A-C can each include an identity attribute system (iDAS as known in the art) that store the personal attributes or any system(s) that act in a similar way to an iDAS, such as a service that provides information to requesters about an entity such as a personal business. Along these lines, PIMS 16 could locate the personal attributes by querying the iDAS. Regardless, once the personal attributes 12A-C are located, PIMS 16 will organize the same into profiles based on the associated services (e.g., an insurance policy number can be linked with healthcare services). Using PIMS 16, end-user 18 can view personal attributes 12A-C and make decisions about whether to share particular attributes 12A-C based on the desired services. These choices will then be translated by PIMS 16 into one or more access control policies that govern the sharing of personal attributes 12A-C.
Referring now to
Referring to
Referring now to
As shown, computer system 104 includes a processing unit 106, a memory 108, a bus 110, and input/output (I/O) interfaces 112. Further, computer system 104 is shown in communication with external I/O devices/resources 114 and storage system 116. In general, processing unit 106 executes computer program code, such as PIMS 16, which is stored in memory 108 and/or storage system 116. While executing computer program code, processing unit 106 can read and/or write data to/from memory 108, storage system 116, and/or I/O interfaces 112. Bus 110 provides a communication link between each of the components in computer system 104. External devices 114 can comprise any devices (e.g., keyboard, pointing device, display, etc.) that enable a user to interact with computer system 104 and/or any devices (e.g., network card, modem, etc.) that enable computer system 104 to communicate with one or more other computing devices.
Computerized implementation 102 is only illustrative of various types of computer infrastructures for implementing the invention. For example, in one embodiment, computer implementation 102 comprises two or more computing devices (e.g., a server cluster) that communicate over a network to perform the various process steps of the invention. Moreover, computer system 104 is only representative of various possible computer systems that can include numerous combinations of hardware and/or software. To this extent, in other embodiments, computer system 104 can comprise any specific purpose computing article of manufacture comprising hardware and/or computer program code for performing specific functions, any computing article of manufacture that comprises a combination of specific purpose and general purpose hardware/software, or the like. In each case, the program code and hardware can be created using standard programming and engineering techniques, respectively. Moreover, processing unit 106 may comprise a single processing unit, or be distributed across one or more processing units in one or more locations, e.g., on a client and server. Similarly, memory 108 and/or storage system 116 can comprise any combination of various types of data storage and/or transmission media that reside at one or more physical locations. Further, interfaces 112 can comprise any system for exchanging information with one or more external interfaces 114. Still further, it is understood that one or more additional components (e.g., system software, math co-processing unit, etc.) not shown in
Storage system 116 can be any type of system (e.g., a database) capable of providing storage for information under the present invention such as selections made by end user 18, etc. To this extent, storage system 116 could include one or more storage devices, such as a magnetic disk drive or an optical disk drive. In another embodiment, storage system 116 includes data distributed across, for example, a local area network (LAN), a wide area network (WAN) or a storage area network (SAN) (not shown). In addition, although not shown, additional components, such as cache memory, communication systems, system software, etc., may be incorporated into computer system 104.
Shown in memory 108 of computer system 104 is PIMS 16, which includes an attribute discovery system 120, an attribute organization system 122, an access control system 124, a policy enforcement system 126, and an audit system 128. These systems perform the functions of the present invention as discussed above. Specifically, attribute discovery system 120 will locate the personal attributes among enterprise domains 14A-C, attribute organization system 122 will organize the personal attributes into a set of profiles based on associated services (e.g., provided by enterprise domains), access control system 124 will provide the interfaces for end-user 18 to view personal attributes and make selections regarding their access and then generate access control policies based thereon, policy enforcement system 126 will control access to the personal attributes based on the access control polices, and audit system 128 will record any transactions involving the personal attributes for viewing and/or auditing by end-user 18.
While shown and described herein as a method and system for controlling access to personal attributes across enterprise domains, it is understood that the invention further provides various alternative embodiments. For example, in one embodiment, the invention provides a computer-readable/useable medium that includes computer program code to enable a computer infrastructure to control access to personal attributes across enterprise domains. To this extent, the computer-readable/useable medium includes program code that implements each of the various process steps of the invention. It is understood that the terms computer-readable medium or computer useable medium comprises one or more of any type of physical embodiment of the program code. In particular, the computer-readable/useable medium can comprise program code embodied on one or more portable storage articles of manufacture (e.g., a compact disc, a magnetic disk, a tape, etc.), on one or more data storage portions of a computing device, such as memory 108 (
In another embodiment, the invention provides a business method that performs the process steps of the invention on a subscription, advertising, and/or fee basis. That is, a service provider, such as a Solution Integrator, could offer to control access to personal attributes across enterprise domains. In this case, the service provider can create, maintain, support, etc., a computer infrastructure, such as computer implementation 102 (
In still another embodiment, the invention provides a computer-implemented method for controlling access to personal attributes across enterprise domains. In this case, a computer infrastructure, such as computer implementation 102 (
As used herein, it is understood that the terms “program code” and “computer program code” are synonymous and mean any expression, in any language, code or notation, of a set of instructions intended to cause a computing device having an information processing capability to perform a particular function either directly or after either or both of the following: (a) conversion to another language, code or notation; and/or (b) reproduction in a different material form. To this extent, program code can be embodied as one or more of: an application/software program, component software/a library of functions, an operating system, a basic I/O system/driver for a particular computing and/or I/O device, and the like.
The foregoing description of various aspects of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed, and obviously, many modifications and variations are possible. Such modifications and variations that may be apparent to a person skilled in the art are intended to be included within the scope of the invention as defined by the accompanying claims.
