For demonstration purposes a simple application example has been developed together with Simone Fischer-Hübner. Although several modules are used, our focus clearly lay on the privacy model, being the most complex and powerful. Other modules are used for special purposes.

A small medical treatment center wants to use a centralized data management. High level privacy is to be guaranteed for all patient data, but statistical research on operations and selective data transmission to other centers must remain possible. The principles of minimal knowledge and separation of duties are to be enforced.

Storing and processing of data are done within one protected system without remote access from and transfer to other systems. The only exceptions are the transfer of billing data to the patient's medical insurance company and the necessary transfer of diagnosis data to another medical treatment center. Both require a secure network connection.

The patient's way through treatment shall follow the following steps:

1. Reception by a clerk
2. Diagnosis and treatment instruction by an examination specialist
3. Operation by a surgeon or transfer to another medical treatment center
4. Recovering therapy
5. Dismissal by a clerk
6. Billing to the patient's medical insurance company

First of all, the purposes of data storage and their tasks are defined:

For storage the following object classes are needed:

Next, users are defined and authorized for their tasks:

Data processing is done by transformation procedures:

The next step is the definition of authorized TPs for all tasks:

Finally, all necessary accesses are to be given. Possible accesses are Read, Write, Delete, Create and Append.

All data must be entered by a security officer with rsbac_pm, using tickets provided by a data protection officer with the same program. Currently, all object classes, tasks, purposes etc. must be entered as numbers, leaving the encoding for humans. Other Models

Since the Privacy Model only protects personal data and system calls, other data are still only protected by discretionary access control and should be protected by another security model. At least the identification and authentification file /etc/shadow should also be declared as personal data with its own object class, so that only necessary accesses by authorized programs can be performed.

In this example Functional Control can be used to restrict access to security relevant files. In this model, objects of categories security and system object are only accessible by security officers (not necessarily the same users as in PM) and administrators. If only unauthorized modification must be prevented, e.g. for /etc/passwd, the Security Information Modification model with its attribute data type should be sufficient.

The Mandatory Model should be additionally used for confident, but not personal data, e.g. business data. Steps of Treatment from the System's Point of View

A patient's progress through the medical treatment center is covered by the following steps:

1. The Clerk checks in the patient. She creates a file for action data with pm_create and a file for reception data with the editor, appending reception to the action file.
2. The examination specialist creates a diagnosis file and uses the editor to write and change her diagnosis. The she creates and fills a treatment instruction file for this patient with the editor, changing it when necessary. Finally she appends her actions to the action file. If necessary, she can transfer a patient to another specialist or medical treatment center. For this she can transfer diagnosis and treatment instruction data by the transfer program.
3. The surgeon reads her treatment instruction with the display program and operates the patient. Afterwards she creates and edits the operation data file, writing a protocol of the operation. As before, all actions are appended to the action file. Like the examinator, the surgeon can transfer patients to another specialist or medical treatment center. For this she can also transfer diagnosis and treatment instruction data by the transfer program.
4. The therapist also reads her treatment instructions, works with the patient and appends her actions to the action file.
5. When the treatment has been completed, the patient is dismissed by the clerk, who finishes reception and action data with the append editor.
6. At last, the billing clerk reads the action file and creates and edits the billing file, which she transfers to the patient's medical insurance company by transfer program.
7. Diagnosises, treatment instructions and operation data can be read by the scientist's statistics program, generating statistical data. Reading of other data requires the patient's consent for the purpose research. Statistical data files can only be created, changed and deleted by users with the current task statistics.

Table of Contents: RSBAC Handbook
Back: Administration Examples