Securing access to distributed data in an unsecure data network
A method, a system, a registry, a repository and a computer program product are disclosed for securely accessing sensitive medical data records stored in a repository. Before accessing security-critical data in the repository, a registration inquiry with a separate registry must be carried out in order to obtain a security token having limited temporary validity, for example in the form of a barcode. A data source and/or a data sink can then use the security token to access the security-critical data in that an index module indexes the data record inquired about on the repository.
1. A method for secure access to data records in an unsecured network environment, the method comprising:
providing a central registry and at least one repository separate from the central registry, wherein data is exchanged between the central registry, the at least one repository, at least one of at least one data source and at least one data sink, each of the at least one data source and data sink being registered with the central registry once for data access to the repository, the data records including security-critical data and demographic data of a person, wherein the security-critical data of the person is not communicated between the central registry and the at least one of the at least one data source and the at least one data sink, and person-identifying data is not communicated between the at least one repository and the at least one of the at least one data source and the at least one data sink;
providing the security-critical data and the demographic data in physically separate devices, by storing the demographic data in the central registry and the security-critical data being accessible in the at least one repository;
sending a registration inquiry from the at least one of the at least one data source and the at least one data sink to the central registry to obtain a registration in the form of an allocation of a security token for access to a data record associated with a person;
issuing a temporarily valid security token that is uniquely associated with a person-identifying identifier, in response to the registration inquiry;
sending a message from the central registry to the at least one repository, the message including the issued security token and the associated person-identifying identifier as a mapping rule;
communicating using a first access message and a second access message between the at least one repository and the at least one of the at least one data source and the at least one data sink to one of write or access the security-critical data in the at least one repository, the first access message including the security token, the second access message including the security-critical data;
applying the mapping rule on the at least one repository to derive the person-identifying data record using the security token from the first access message and index the requested data record via the person-identifying identifier; and
executing the secure access to the indexed data record.
2. The method of claim 1 , wherein the security token expires following a configurable time period.
3. The method of claim 1 , wherein the association between the security token and the person-identifying identifier is managed by at least one of the central registry and the at least one repository.
4. The method of claim 3 , wherein the data records are medical or health-related data records of a patient and the at least one of the at least one data source and the at least one data sink is a medical image storage system.
5. The method of claim 1 , wherein the data records are medical or health-related data records of a patient and the at least one of the at least one data source and the at least one data sink is a medical image storage system.
6. The method of claim 1 , wherein the security-critical data is not stored directly in the at least one repository and the at least one repository stores an electronic link to access the security-critical data.
7. The method of claim 1 , wherein at least one of an asynchronous and synchronous communication protocol is used.
8. The method of claim 1 , wherein the security token is at least one of an analog signal, a hardware component and a software component.
9. The method of claim 8 , wherein the security token is a barcode.
10. The method of claim 1 , wherein the access comprises write accesses to the at least one repository from the data source and read accesses to the repository from the at least one data sink.
11. The method of claim 10 , wherein as a reply to an access inquiry comprising the security token of the at least one data sink for the purpose of executing a read access, the at least one repository sends only the requested security-critical data or a combination of security token, or an identification code that is unique to the registration inquiry, and the requested security-critical data to the at least one data sink.
12. The method of claim 1 , wherein the at least one repositories, the at least one data source and the at least one data sink are at least one of added, removed and changed during operation.
13. A system for secure access to data records in an unsecured network environment, comprising:
a central registry including a first memory configured to store demographic data, and a first processor configured to,
issue a temporarily valid security token in response to a registration inquiry from at least one of at least one data source and at least one data sink, the security token being uniquely associated with a person-identifying identifier, and
send a message to at least one repository, the message including the issued security token and the associated person-identifying identifier;
the at least one repository physically separated from the central registry, the at least one repository including a second memory and a second processor configured to store and manage security-critical data; and
the at least one data source and the at least one data sink, the at least one data source and the at least one data sink including a third processor and a fourth processor, respectively, the third and fourth processors configured to,
register once with the central registry for data access to the at least one repository,
send the registration inquiry to the central registry,
receive the security token as a reply to the registration inquiry, and
communicate using a first access message and a second access message between the at least one repository and the at least one of the at least one data source and the at least one data sink to one of write or access the security-critical data in the at least one repository, the first access message including the security token, the second access message including the security-critical data,
wherein the data records include security-critical data and demographic data of a person and wherein the security-critical data of the person is not communicated between the central registry and the at least one of the at least one data source and the at least one data sink, and the person-identifying data is not communicated between the at least one repository and the at least one of the at least one data source and the at least one data sink.
14. A non-transitory computer readable medium comprising computer readable instructions, which when executed by a processor cause the processor to execute the method of claim 1 .
15. The method of claim 2 , wherein the data records are medical or health-related data records of a patient and the at least one of the at least one data source and the at least one data sink is a medical image storage system.