# US 7,610,490 B2 · Method and arrangement for controlling access to sensitive data stored in an apparatus, by another apparatus

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,610,490 B2
- Document ID: US7610490B2
- Status: Granted
- Kind: B2
- Application number: 11/026,494
- Filed: 2004-12-30
- Published: 2005-08-11
- Granted: 2009-10-27
- Earliest claimed: 2003-12-30
- Assignees: Siemens Aktiengesellschaft
- Inventors: Bernt Bieber; Dirk Weseloh
- Web page: https://patentgrep.com/patent/US7610490B2

## CPC

- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- G06F 12/1458: {by checking the subject access rights}
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards
- G06F 21/40: by quorum, i.e. whereby two or more security principals are required
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G16H 40/40: for the management of medical equipment or devices, e.g. scheduling maintenance or upgrades
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/10: {for controlling access to devices or network resources}
- Y10S 707/99939: Privileged access
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA
- Y10S: TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS

## Abstract

In a method and arrangement for control of the access to sensitive data stored in a first apparatus a first user of a first apparatus is notified of an access by the second apparatus to sensitive data stored in the first apparatus, and the notification is transmitted to the second apparatus. A first unique identification of the first user is requested by the first apparatus. A second unique identification of a second user of the second apparatus by the second apparatus. A check of the constellation (acquired via the requests) of the first and second users is made using a predetermined association file, the association file associating one or more allowed second users with each first user. Enablement of access of the second apparatus to the sensitive data stored in the first apparatus is prevented when the check of the association establishes an allowed constellation of first and second users. Access of the second apparatus to the sensitive data stored in the first apparatus is prevented when the check of the association establishes no allowed constellation of first and second users or access of the second apparatus to the sensitive data stored in the first apparatus has not been declared by the first user.

## Claims

### Claim 1

A method for controlling access to sensitive data stored in a first apparatus by a second apparatus in communication with the first apparatus, comprising the steps of:
upon a request by the second apparatus, operated by a second user, to access sensitive data stored in the first apparatus, generating a notification at said first apparatus of said request to access, and prompting a first user of the first apparatus to transmit said notification to the second apparatus;
said first apparatus also requesting a first unique identification of said first user;
at said second apparatus upon receipt of said notification, requesting a second unique identification of the second user of the second apparatus by the second apparatus;
accessing from said first apparatus an association file wherein at least one second user is stored in a stored association with each first user, and checking whether the second user identified by said second unique identification has a predetermined association in said association file with said first user identified by said first unique identification; accessing by said second apparatus to the sensitive data stored in the first apparatus if said predetermined association is found in said association file; and
preventing access by said second apparatus to the sensitive data stored in the first apparatus if no predetermined association is found in said association file between the second user identified by said second unique identification and the first user identified by said first unique identification, or if access by said second apparatus to the sensitive data stored in the first apparatus has not been declared by said first user.

### Claim 2 (depends on 1)

A method as claimed in claim 1 comprising transferring a request by said second apparatus for said notification only after receiving, at said second apparatus, a communication generated by the first apparatus and transmitted to the second apparatus.

### Claim 3 (depends on 2)

A method as claimed in claim 2 comprising automatically generating said communication at said first apparatus and automatically transmitting said communication from said first apparatus to said second apparatus.

### Claim 4 (depends on 2)

A method as claimed in claim 2 comprising transferring said request for notification by said second apparatus only after checking said communication at said second apparatus by said second user.

### Claim 5 (depends on 1)

A method as claimed in claim 1 comprising controlling at said first apparatus said request for said second unique identification of said second user of said second apparatus.

### Claim 6 (depends on 1)

A method as claimed in claim 1 comprising generating a result of said request for said first unique identification of said first user of said first apparatus, and transmitting said result to said second apparatus and outputting said result at said second apparatus to said second user.

### Claim 7 (depends on 1)

A method as claimed in claim 1 comprising generating a result of said request for said second unique identification of said second user of said second apparatus, and transmitting said result from said second apparatus to said first apparatus and outputting said result at said first apparatus to said first user.

### Claim 8 (depends on 1)

A method as claimed in claim 1 comprising including, in each of said request for said first unique identification of said first user and said request for said second unique identification of said second user, a request for an identifier selected from the group consisting of a password, a biometric feature, an electronic signature and an individualized machine-readable article.

### Claim 9 (depends on 1)

A method as claimed in claim 1 comprising conducting said check of said association file at a location selected from the group consisting of said first apparatus, said second apparatus and a further apparatus connected to one of said first apparatus or said second apparatus.

### Claim 10 (depends on 1)

A method as claimed in claim 1 comprising outputting a result of checking said association file at a location selected from said first apparatus and said second apparatus.

### Claim 11 (depends on 1)

A method as claimed in claim 1 comprising automatically protocolling all data transferred between said first apparatus and said second apparatus and outputting said protocol to said first apparatus and said second apparatus.

### Claim 12 (depends on 1)

A method as claimed in claim 1 comprising, if access to said sensitive data stored at said first apparatus is not enabled, transferring an authorization form to the first apparatus from the second apparatus.

### Claim 13 (depends on 1)

A method as claimed in claim 1 comprising employing, as said second apparatus, a maintenance system for remote maintenance of said first apparatus.

### Claim 14 (depends on 1)

A method as claimed in claim 1 comprising employing, as said first apparatus, a medical system and employing as said second apparatus, a maintenance system for remote maintenance of said medical system.

### Claim 15 (depends on 14)

A method as claimed in claim 14 comprising storing patient data in said medical system as said sensitive data.

### Claim 16

An arrangement for controlling access to sensitive data stored in a first apparatus by a second apparatus in communication with the first apparatus, comprising:
a first apparatus operated by a first user and a second apparatus, operated by a second user, configured to communicate with each other;
upon receipt at the first apparatus of a request from the second apparatus for access by the second apparatus to the sensitive data stored in the first apparatus, said first apparatus being configured to generate a notification of said request for access to said first user, and to generate a prompt for said first user to transmit said notification to the second apparatus;
said first apparatus also being configured to request a first unique identification of the first user of said first apparatus;
said second apparatus being configured, upon receipt of said notification, to request a second unique identification of the second user of the second apparatus;
a memory having an association file stored therein wherein at least one second user is stored in a stored association with each first user;
said first apparatus being configured to access said memory and to check whether the second user identified by said second unique identification has a predetermined association in said association file with said first user identified by said first unique identification;
said first apparatus being configured to enable access by said second apparatus to the sensitive data stored in the first apparatus if said predetermined association is found in said association file; and
said first apparatus being configured to prevent access by said second apparatus to the sensitive data stored in the first apparatus if no predetermined association is found in said association file between the second user identified by said second unique identification and the first user identified by said first unique identification, or if access by said second apparatus to the sensitive data stored in the first apparatus has not been declared by said first user.

### Claim 17 (depends on 16)

An arrangement as claimed in claim 16 wherein said second apparatus is configured to transmit said request for access only after receiving, at said second apparatus, a communication generated by the first apparatus and transmitted to the second apparatus.

### Claim 18 (depends on 16)

An arrangement as claimed in claim 16 comprising a protocolling unit for automatically protocolling all data transferred between said first apparatus and said second apparatus and outputting said protocol to said first apparatus and said second apparatus.

### Claim 19 (depends on 16)

An arrangement as claimed in claim 16 wherein said second apparatus, if access to said sensitive data stored at said first apparatus is not enabled, is configured to transmit an authorization form to the first apparatus from the second apparatus.

### Claim 20 (depends on 16)

An arrangement as claimed in claim 16 wherein said second apparatus is a maintenance system for remote maintenance of said first apparatus.

### Claim 21 (depends on 16)

An arrangement as claimed in claim 16 wherein said first apparatus is a medical system and said second apparatus is a maintenance system for remote maintenance of said medical system.

### Claim 22 (depends on 21)

An arrangement as claimed in claim 21 wherein said memory contains patient data for said medical system as said sensitive data.