Activity-oriented access control to ubiquitous hospital information and services

作者：Le Xuan Hung; Lee Sungyoung^*; Lee Young Koo; Lee Heejo; Khalid Murad; Sankar Ravi

来源：Information Sciences, 2010, 180(16): 2979-2990.

DOI：10.1016/j.ins.2010.04.020

• Access control
• Ubiquitous hospital information system and services
• Security
• Human activity

In hospital information systems, protecting the confidentiality of health information, whilst at the same time allowing authorized physicians to access it conveniently, is a crucial requirement. The need to deliver health information at the point-of-care is a primary factor to increase healthcare quality and cost efficiency. However, current systems require considerable coordination effort of hospital professionals to locate relevant documents to support a specific activity. This paper presents a flexible and dynamic access control model, Activity-Oriented Access Control (AOAC), which is based on user activity to authorize access permissions. A user is allowed to perform an activity if he/she holds a number of satisfactory attributes (i.e. roles, assignments, etc.) under a specified condition (e.g. time, location). Results of AOAC implementation in a realistic healthcare scenario have shown to meet two important requirements: protecting confidentiality of health information by denying an unauthorized access, and allowing physicians to conveniently browse medical data at the point-of-care. Furthermore, the average execution time was 0.078 s which allows AOAC to work in real-time.

• 出版日期2010-8-15