IEEE TRANSACTIONS ON INFORMATION TECHNOLOGY IN BIOMEDICINE, VOL. 00, NO. 00, 2011 1
P i ilege Managemen In as uc u e o Vi ual
O ganiza ions in Heal hca e G ids
Jo ge Cal illo, S uden Membe , IEEE, Isabel Rom´
an, Se gio Ri as, and Lau a M. Roa, Fellow, IEEE
Abs ac —This pape is ocused on he managemen o i ual
o ganiza ions (VO) inside heal hca e en i onmen s whe e g id
echnology is used as middlewa e o a heal hca e se ices-o ien ed
a chi ec u e (HSOA). Some o he main asks conside ed o he
p o ision o an e icien VO managemen a e managemen o use s,
assigna ion o oles o use s, assigna ion o p i ileges o oles, and
de ini ion o esou ces access policies. These asks a e ex emely
close o p i ilege managemen in as uc u es (PMI), so we ace
VO managemen se ices as pa o he PMI suppo ing access con-
ol o heal hca e esou ces inside he HSOA. In o de o achie e
a comple ely open and in e ope able PMI, we e iew and apply
s anda ds o secu i y and a chi ec u al design. Mo eo e , seman-
ic echnologies a e in oduced in decision poin s o access con ol
allowing he managemen o a high deg ee o desc ip o s by means
o on ologies and in e he decision making h ough ules and ea-
sone s.
Index Te ms—Access con ol, di ec o y se ices, p i ilege man-
agemen in as uc u es (PMI), seman ic echnologies, se ice-
o ien ed a chi ec u e (SOA), i ual o ganiza ion (VO).
I. INTRODUCTION
COMPUTING when de ices and applica ions in a heal h-
ca e o ganiza ion make hei acili ies accessible h ough
se ices, a ailable ia public and s able in e aces, in eg a ion,
and in e ope abili y can be achie ed mo e easily. Fu he mo e,
he de elopmen o new and mo e complex se ices, which may
be composed om elemen a y ones, o e ing ad anced capabil-
i ies o use s, should be mo e e ec i e.
The app oach o designing a sys em p o iding se ices o
bo h end-use applica ions and o he se ices dis ibu ed in a
ne wo k is o en called se ice-o ien ed a chi ec u e (SOA) [1].
A widely accep ed de ini ion o a chi ec u e is “a o mal de-
sc ip ion o a sys em, o a de ailed plan o he sys em a com-
ponen le el (including hei in e - ela ionships) o guide i s im-
plemen a ion, as well as he p inciples and guidelines go e ning
i s design and e olu ion o e ime” [2]. By applying all hese
Manusc ip ecei ed Ap il 20, 2010; e ised July 29, 2010 and Oc obe 4,
2010; accep ed Decembe 23, 2010. Da e o publica ion; da e o cu en e sion.
This wo k was suppo ed in pa by he CIBER-BBN, he Biomedical Enginee -
ing G oup in Uni e si y o Se ille and in pa by he Fondo de In es igaci´
on
Sani a ia unde P ojec PI082023.
J. Cal illo and L. M. Roa a e wi h ISCIII Ini ia i e CIBER-BBN and he
Biomedical Enginee ing G oup, Uni e si y o Se ille, Se ille 41092, Spain
(e-mail: [email p o ec ed]; [email p o ec ed]).
I. Rom´
an is wi h ISCIII Ini ia i e CIBER-BBN and he ´
A ea de Inge-
nie ´
ıa Telem´
a ica, Uni e sidad de Se illa Se ille 41092, Spain (e-mail: isabel@
ajano.us.es).
S. Ri as is wi h he Biomedical Enginee ing G oup, Uni e si y o Se ille,
Se ille 41092, Spain (e-mail: s i as i[email p o ec ed]).
Digi al Objec Iden i ie 10.1109/TITB.2010.2104160
ideas o heal hca e en i onmen s we could e e o heal hca e
se ices-o ien ed a chi ec u e (HSOA).
The collabo a ion be ween en i ies in an SOA could be based
on he concep o i ual o ganiza ion (VO) [3], which e e s o
a dynamic se o en i ies (indi iduals, sys ems, o ins i u ions)
dis ibu ed ac oss di e en adminis a i e domains and sepa-
a ed geog aphically, usually wo king owa d a common goal,
de ined a ound a se o esou ce-sha ing ules and condi ions.
No ma e he na u e o esou ces, hey all o e hei capabili ies
h ough se ice in e aces, and he p inciple o dis ibu ion al-
lows connec ing hem and composing complex se ices making
sepa a ion (adminis a i e, echnical, and geog aphic) anspa -
en o he end use .
Secu i y is a majo conce n and we could de e mine who can
access o a esou ce and unde which condi ions, es ablishing
he ules o esou ce sha ing needed o se a VO. Each esou ce
owne mus be able o de e mine he policies o con olling
access and mus us ha he en o cemen o hese ules is
gua an eed.
Nowadays, a model ocused on he subjec o ca e (SoC) as
adminis a o o his/he in o ma ion is mo e and mo e desi able,
in which each indi idual can decide abou he access o in o -
ma ion and esou ces ela ed o him/he . In pa allel, legisla ion
es ablishes scena ios in which he au ho i y o he SoC can be
empo ally in alida ed such as when a isk o public heal h ex-
is s o an eme gency ha can esul in i e e sible inju ies o
dea h isk.
The cu en si ua ion, along he p og essi e dis ibu ion o
esou ces ac oss echnological, geog aphy and adminis a i e
domains, complica es he comple e managemen by he SoC,
equi ing simple adminis a ion p ocedu es. The use o no -
malized p i ilege managemen in as uc u es (PMI) [4] o VO
managemen could p o ide a ounda ion upon which mecha-
nisms o se ices access con ol wi hin an SOA can be buil .
To sum up, in o de o achie e he comple e in e ope abili y
o esou ces and applica ions, wo issues mus be conside ed.
Fi s , he es ablishmen o a s anda dized amewo k and
guidelines o he speci ica ion and de elopmen o sys ems
can encou age he deploymen o complex SOA and ocus he
di e en wo ldwide e o s in o de o ake a s ep o wa d in
heal hca e domain. Second, mechanisms o secu i y and access
con ol a e keys o achie e eliable dis ibu ed en i onmen s.
One aluable ool o de ine a common language easing he au-
oma ion o adminis a ion and decision-making asks could be
seman ic echnologies, which would allow an SoC o manage
his/he own heal h in o ma ion and esou ces.
In he ieldo PMIsuppo edbyVOs,se e ale o sha ebeen
de eloped. Conc e ely, nume ous ini ia i es aim o enhance
accesscon ol insuch he e ogeneousand complexen i onmen s
1089-7771/$26.00 © 2011 IEEE
2 IEEE TRANSACTIONS ON INFORMATION TECHNOLOGY IN BIOMEDICINE, VOL. 00, NO. 00, 2011
TABLE I
RELEVANT STANDARDS AND THEIR CONTRIBUTIONS IN THE APPROACHED PMI
ei he by applying seman ic echnologies [5], [6] o by means
o new secu i y models [7], [8]. Wi hin he heal hca e domain,
he e a e some app oaches and heal hg id pla o ms [9]–[13],
bu he p i ilege managemen is mainly delega ed o gene al-
pu pose middlewa es, and e o s a e mo e ocused on applica-
ion o g id echnologies in heal h a he han on he add essing
secu i y equi emen s.
In his pape , we combine and imp o e pas and cu en e -
o s in o de o speci y a PMI suppo ing heal hg ids. To do
his, ele an s anda ds o PMI, as well as me hodologies o
speci ica ion o hose in as uc u es, a e analyzed om hose o
gene al pu pose o hose ha a e ocused on heal hca e en i on-
men s. Requi emen s and app oaches a e combined wi h he VO
concep and g id echnologies, and we p opose an access con ol
managemen in as uc u e o heal hca e en i onmen s based
on seman ics and s anda ds complian . Finally, we in oduce
a scena io om a eal p ojec whe e a legacy sys em mus be
included in he p oposed p i ilege managemen in as uc u e.
II. MATERIAL AND METHOD
A. PMI Founda ions and Rela ed S anda ds
As i has been in oduced ea lie , one o he keys o suc-
cess o open and in e ope able solu ions is he adop ion o
s anda ds in bo h gene al and heal hca e domains in o de o
add ess issues as secu i y and dis ibu ion. In Table I, a se o
ele an s anda ds om in e na ional s anda diza ion o ganiza-
ions is shown, explici ly indica ing how hey ha e been adop ed
in he cu en s udy. The s anda diza ion o ganiza ions a e: he
In e na ional O ganiza ion o S anda diza ion (ISO), he In e -
na ional Telecommunica ion Union, he In e ne Enginee ing
Task Fo ce, he O ganiza ion o he Ad ancemen o S uc-
u ed In o ma ion S anda ds, and he Eu opean Commi ee o
S anda diza ion (CEN).
Acco ding o secu i y ini ia i es, all o hem con ibu e o
he common PMI p o iding concep s o ea u es ha ha e been
conside ed ele an . Each s anda d included in Table I p o ides
speci ic secu i y issues no co e ed (o no so comple ely) by
he o he s.
In o de o ease in e ope abili y and exchange o in o ma ion,
common e minologies ha e o be conside ed and adop ed. In
his pape , we ha e used he concep s o [22] o build ou on-
ology, bu i is possible—and ecommended— o ex end i wi h
o he exis ing e minologies, o example hose o clinical pu -
pose [ he sys ema ized nomencla u e o medicine (SNOMED)
[25], Galen [26], e c.] o biomedical on ologies [27]. Ou esul -
ing on ology is ocused on basic seman ic ea u es o PMI and
eases he in eg a ion o o he heal h domain mo e specialized
e minologies.
B. HSOA and S anda diza ion
Se e al pa adigms (SOA is one o he mos p omising among
hem) ha e been app oached o add ess he inhe en complexi y
in he dis ibu ed compu ing sys ems, bu he design, de elop-
men , deploymen , main enance, and e olu ion o a dis ibu ed
sys em a e highly complex asks. Consequen ly, i is essen ial
ha he a chi ec u e (and any unc ion necessa y o suppo i )
be de ined in a se o s anda ds, so ha mul iple endo s can
collabo a e in he p o ision o dis ibu ed sys ems.
Some heal hca e a chi ec u es’ app oaches a e de eloped by
s anda diza ion o ganiza ions, like CEN [28] o he Objec Man-
agemen G oup [29]. In he heal hca e con ex , he ISO 12967
Heal h In o ma ion Se ice A chi ec u e (HISA) s anda d de-
sc ibes an a chi ec u e o he in eg a ion o heal hca e in o -
ma ion se ices. An impo an basis o he p oduc ion o his
se ice a chi ec u e s anda d is he e e ence model-open dis-
ibu ed p ocessing (RM-ODP) me hodology [30]. The speci-
ica ions a e o malized a oiding any dependence on speci ic
echnological p oduc s and/o solu ions.
One o he equi emen s in ou esea ch has been ha ou
esul s we e easily inco po a ed, and in e ope able, in he se
o in o ma ion sys ems o a heal hca e o ganiza ion using s an-
da ds. The ac ual implemen a ion o an SOA equi es a mid-
dlewa e laye lying be ween he compu ing and ne wo king in-
as uc u e and he se ices in a dis ibu ed compu ing sys em.
This middlewa e is in ended o o e a highe le el o abs ac-
ion o he unde lying compu ing and ne wo king esou ces
by hiding he dis ibu ion and he e ogenei y o implemen a ion
CALVILLO e al.: PRIVILEGE MANAGEMENT INFRASTRUCTURE FOR VIRTUAL ORGANIZATIONS IN HEALTHCARE GRIDS 3
echnologies. Ou esea ch is ocused on he use o g id as mid-
dlewa e o he HSOA.
C. P i ilege Managemen in G id
Globus oolki is a g id middlewa e implemen a ion includ-
ing a secu i y amewo k ( he Globus Secu i y In as uc u e—
GSI) [31] ha p o ides common au hen ica ion and au-
ho iza ion mechanisms as well as connec ions o ex e nal
in as uc u es.
The dynamic na u e o VO necessi a es i s au oma ing he
disco e y o po en ial p o ide s, hen acqui ing access igh s o
ce ain se ices, and inally en o cing he access con ol policy
on un ime upon esou ces alloca ion. Se e al ini ia i es ha e
appea ed, such as he communi y au ho iza ion se ice [32]
o he i ual o ganiza ion membe ship se ice (VOMS) [33],
which aim o es ablish con ol mechanisms by de ining g oups
o use s o a ibu es o educe he managemen asks.
Ano he eme ging app oach is o delega e ex e nal in as uc-
u es o make access con ol decision o g id se ices. The p i -
ilege and ole managemen in as uc u e s anda ds alida ion
(PERMIS) [34] is an example o a policy based au ho iza ion
in as uc u e.
D. Seman ic Technologies
Ano he c ucial co ne s one o comple ely in e ope able and
open HSOA is he use o seman ic echnologies. Following he
SOA pa adigm, we a e conside ing highly he e ogeneous sce-
na ios whe e he schemas o a ibu es a e complex oo. I is un-
easible o come o an ag eemen wi h all he esou ce p o ide s
cu en ly (o in he u u e) in ol ed. By using on ologies de-
sc ibing concep s o esou ces oge he wi h in e ence engines,
we can ob ain mainly h ee ad an ages. Fi s , SOA cha ac e -
is ics as openness and in e ope abili y a e enhanced because
o he unde s anding be ween di e en pa ies is eased. I is
achie ed by sha ing he o mal de ini ions o esou ces desc ip-
o s as on ologies. The adminis a o will use hese desc ip o s
o label he esou ces o he di e en VO. Second, by passing
an on ology o concep s h ough a easone we can in e new
knowledge and add i as explici ela ions and elemen s. Las ,
by in oducing seman ic in e ence in he mechanisms o access
con ol, he de elopmen o elemen s making decisions can be
eased. The access con ol policies would be exp essed acco d-
ing o on ologies ( esou ces, use a ibu es, en i onmen , e c.)
and ule languages. So he logic o decision poin s could be
educed o an in e ence engine he esul s o which would be
he pe mission o p ohibi ion o access.
One o he mos popula seman ic ools is he Web On ology
Language (OWL) [35], a knowledge ep esen a ion language
based on desc ip ion logic and Resou ce Desc ip ion F ame-
wo k (RDF) ep esen a ion. OWL co e s he speci ica ion o
on ologies and i has p e iously been used o he o maliza ion
o policies o access con ol [5], [36], [37]. In o de o w i e
ules composed o OWL concep s a special ule language is
equi ed and a p omising app oach is he Seman ic Web Rule
Language (SWRL) [38] ha allows es ablishing complex ela-
ions among p ope ies ex ending he OWL exp essi i y. The e
a e cu en e o s using SWRL in conjunc ion wi h OWL o
desc ibe access con ol policies [6], [39].
All he p e ious wo ks in his ield (i.e., use o OWL and
SWRL o de ine policies and decision making) ha e gene al
pu pose and hey do no add ess he speci ic equi emen s o
access con ol in such a complex domain as heal h. In ou ap-
p oach, we use he OWL language o de elop an on ology o
esou ce desc ip o s, in ol ed ac o s, and con ex cha ac e is-
ics ha can be implica ed in he decision o access (as physical
loca ion whe e he access is pe o med, da e and ime, pu pose
o use, e c.). The access con ol policies ha e been exp essed
by means o SWRL ules and es ed and execu ed by using
he Jess engine [40] due o i s compa ibili y wi h P o ´
eg´
e-OWL
pla o m [41] ha allowed de eloping he knowledge base, i.e.,
OWL on ology and SWRL ules.
SWRL ules o de ining policies and easoning wi h Jess in
a heal hca e se ing ha e been also applied in [9]. The main
di e ence wi h he cu en s udy is ha hey use hese ools o
ha monize da a p o ec ion legisla ion in Eu ope, and in his pa-
pe , an on ology and ules a e p oposed o ease he managemen
o heal h in o ma ion and esou ces by an adminis a o who can
be he own SoC. Due o he di e ences on app oaches, in his
s udy nei he on ology no ules could be eused om p e ious
e o s and hey ha e been comple ely buil om he pe spec i e
o his pape .
III. RESULTS
A. Secu i y In as uc u e and Use Cases
The app oached secu i y in as uc u e is based on he s an-
da ds, me hodologies, and echnologies e ised ea lie . We ha e
combined and imp o ed hem in o de o build an open and
comple e solu ion. On one hand, i uses he eX ensible Access
Con ol Ma kup Language (XACML) speci ica ion [18] adding
c ucial elemen s cen e ed on seman ic managemen . The esul
is he se ices decomposi ion in Fig. 1, an imp o ed e ision
o he XACML s anda d. On he o he hand, he au ho iza-
ion schema ollows he guidelines o he a ibu e-based access
con ol (ABAC) access con ol schema, in which p i ileges a e
g ouped in a ibu es, and each indi idual is assigned a se o
hose. In ou app oach, hose a ibu es a e speci ied in a concep
on ology desc ibed in he nex sec ion.
Ano he impo an poin we include in his e ision o he
XACML s anda d is he conside a ion o sepa a e and dis-
ibu ed policy in o ma ion poin s (PIP). Each one ollows i s
own unc ional p o ocol (cen e ed on a pa icula kind o a -
ibu es, ecei ing eques s, and sending in o ma ion) and i is
connec ed o he ela ed knowledge base. Following his end,
he p oposed in as uc u e eplaces cen alized componen s o
he XACML schema wi h se ices ha can be dis ibu ed and
decomposed in o he simple se ices. F om an a chi ec u al
poin o iew, Fig. 1 shows se ices om di e en laye s o he
HSOA. Thus, policy en o cemen poin (PEP) se ices di ec ly
ela ed o esou cesbelong o hein as uc u elaye ;se ices as
con ex handle easing dis ibu ion and loca ion a e pa o mid-
dlewa e laye ; esou ce and en i onmen knowledge bases, PIP
se ices, and policy decision poin (PDP) se ices, all belong o
4 IEEE TRANSACTIONS ON INFORMATION TECHNOLOGY IN BIOMEDICINE, VOL. 00, NO. 00, 2011
Fig. 1. Use case 1: using a g id se ice h ough he PREDIRCAM po al.
he gene ic se ice laye ; inally, he c eden ial eposi o y and
he policies seman ic knowledge base a e pa o he heal hca e
domain se ices laye because o hei unc ionali y and con en
a e speci ically de ined o his domain.
Acco ding o implemen a ion and echnology, al hough he e
exis se e al app oaches o add ess p i ilege managemen in
g id, in many cases hese only p esen pa ial solu ions o he
whole conce n. In gene al, e o s a e d i en o p o ide PMI
common o all g id se ices. In ac ual heal hca e sys ems, e en
wi h g id in as uc u es deployed, he e a e se e al he e oge-
neous sys ems whose adap abili y o g id is no easible. Gene -
ally, each sys em has i s local p i ilege managemen o access
con ol and i does no wan delega e access decision o hi d
pa ies.
We ha e me his issue in he PREDIRCAM p ojec [42],
which is de eloping and alida ing an in elligen pla o m o
biomedical echnologies o moni o ing,p e en ion,andpe son-
alized ea men o melli us diabe es, he ca diac and me abolic
isk, and he enal insu iciency. One o he main componen s
o he pla o m o PRE en ion DIabe es and CA dioMe abolic
Risk (PREDIRCAM) p ojec is he pla o m o ollowing up
o exe cise ou ines and ood habi s o pa ien s. This pla o m
has been de eloped using he Con en Manage Sys em (CMS)
D upal [43] e sion 6. D upal ollows a scheme comple ely
cen alized wi h a local da abase s o ing con en s o CMS.
Incompa ibili ies appea when we y o in oduce D upal in
he g id in as uc u e because he o me p o ides i s own use
managemen wi h local pe mission h ough login and passwo d,
and he la e uses a public key in as uc u e wi h X.509 ce i i-
ca es o au hen ica ion and a ibu e ce i ica es o au ho iza ion.
To in eg a e au onomous sys ems wi h hei own local p i i-
lege managemen in he g id we ha e e iewed h ee use cases:
he sys em ac ing as clien o a g id se ice, he sys em being
a se ice wi h local p i ilege managemen ha is accessed by a
g id clien , and inally, he sys em as a se ice accessed by a g id
clien , bu he access con ol is managed by he global g id in-
as uc u e. Fig. 1 shows he i s use case whe e he sys em (in
ou pa icula case, he PREDIRCAM pla o m) ac s as a clien
o a g id se ice, hanks o g id use capabili ies delega ion. We
show he main componen s in he designed au hen ica ion and
au ho iza ion in as uc u e. This app oach is lexible and scal-
able and i acili a es he managemen o di e en iden i ies o
he same use and he single sign on. Mo eo e , PIP se ices
o esou ce, en i onmen , and subjec , and PDP se ices a e
all independen elemen s, adding lexibili y o he managemen
o VO. In he ac ual implemen a ion o his a chi ec u e e e y
unc ional elemen can be dis ibu ed in he g id, in o de o
p e en he dependence in cen alized elemen s.
We ha e selec ed and adap ed echnical solu ions o
each unc ional elemen . Fo example, iden i y p o ide and
CALVILLO e al.: PRIVILEGE MANAGEMENT INFRASTRUCTURE FOR VIRTUAL ORGANIZATIONS IN HEALTHCARE GRIDS 5
Fig. 2. Use case 2: using PREDIRCAM po al acili ies using local secu i y.
delega ion elemen s a e p o ided by he Globus Secu i y In as-
uc u e. An e icien PDP se ice is implemen ed in PERMIS
and he subjec PIP se ice is based on VOMS. Resou ce PIP
se ice is based in he Globus Moni o ing & Disco e y Sys em
(MDS) [44]. The con ex handle se ice belongs o middlewa e
and i deals wi h he dis ibu ion and loca ion o he di e en
se ices; hus, i can be implemen ed in se e al ways and e en
i could be in eg a ed in PDP and PIP se ices. Fo he sake o
simplici y, in he p oposed in as uc u e Globus MDS pe o ms
asks o disco e ing and communica ing be ween he di e en
PIP, PEP, and PDP se ices.
In ou app oach, he ede a ion and au onomy o sys ems
is acili a ed because legacy se ices could be in eg a ed and
hey can choose be ween adop ing g id secu i y in as uc u e
o main aining hei own, as depic ed in Figs. 2 and 3. The i s
one shows he use case in which he legacy sys em expo s some
in e aces o g id in as uc u e bu holding i s local p i ilege
managemen . In Fig. 3, we achie e he in eg a ion by modi ying
he legacy sys em in o de o use he p i ilege managemen
in as uc u e o g id.
Finally, in PREDIRCAM p ojec we ha e adop ed he so-
lu ion o Fig. 3, and he i s s ep o achie e he in eg a ion
be ween he pla o m and he g id in as uc u e is o make he
au hen ica ion in D upal accep s X.509 ce i ica es. To p o ide
D upal wi h ce i ica e capabili ies, we ha e added he “login
ce i ica e” module [45]. Now ou legacy sys em (i.e., D upal)
allows he egis a ion o new use s o he access o egis e ed
use s o he esou ces p o ec ed by he PMI using X.509 ce i i-
ca es, and all his wi hou making any change o he da abase o
he CMS.
Fig. 3. Use case 3: using PREDIRCAM po al acili ies published as g id
se ice using g id p i ilege managemen in as uc u e.
B. On ology and Policies o Con olling Access
To achie e he a iabili y deg ee equi ed by access con ol
policies,we ha emodeled anon ology o heal hca e domain ul-
illing all he po en ial ea u es o ca ego iza ion o esou ces.
By using his on ology, he adminis a o (po en ially he SoC)
can ha e a e sa ile con ol o e he access o esou ces h ough
he po en ial ac o s who can access, he na u e o he in o ma-
ion,c ea ion da es,au ho s, physicalloca ion o access, pu pose
o use, e c.
Ano e iewo hede elopedon ology isshown inFig. 4.I is
composed o : an on ology o heal hca e ac o s, ano he ocused
on esou ce desc ip o s, and a hi d one abou secu i y used o
c ea e he access con ol policies. Fig. 4 includes he po en ial
ac o s who can y o access o p o ec ed objec s (people, o -
ganiza ions, o de ices), he wo ca ego ies o objec s o which
he access mus be con olled (in o ma ion and esou ces), and
a spec um o desc ip o s o cha ac e ize hese objec s (poin ing
i s na u e, anonymiza ion le el, ela ed disease, a ailabili y o
di e en pu poses, e c.).
As i has been exposed ea lie , policies uling he access o
esou ces a e de ined by means o SWRL language and based on
he concep on ologies. In his app oach, a policy is a “ho n-like”
ule in which he an eceden is composed o elemen s (ac o s,
esou ces, a ibu es, en i onmen ea u es, e c.) condi ioning
he decision, and he consequen speci ies i he eques ed ac ion
is pe mi ed o p ohibi ed. An example o policy is “allow my
pa ne o see all my in o ma ion ela ed o sexually ansmi ed
diseases since yea 2000 and in which hi d pe sons a e no
in ol ed,” ha is exp essed in SWRL as ollows:
who:Pe son(?pe ) ∧who:hasRela ion(?pe , who:SPOUSE) ∧
wha :Clinical_In o ma ion(?in ) ∧a :Sexual_O gans(?dis)
∧isRela edTo(?in , ?dis) ∧a :Subjec _O _Ca e(?soc) ∧
isRela edTo(?in , ?soc) ∧wha :c ea ionTime(?in , ? ime) ∧
empo al:no Be o e(? ime, "2000-1-1")
→ac ionPe mi ed(?pe , ?in )
The in e p e a ion o a ule as p e ious one is: i condi ions
speci ied in an eceden a e ue (i.e., he e a e OWL indi idu-
als sa is ying all clauses), hen he p ope y “ac ionPe mi ed”

6 IEEE TRANSACTIONS ON INFORMATION TECHNOLOGY IN BIOMEDICINE, VOL. 00, NO. 00, 2011
Fig. 4. O e iew o on ology o heal hca e domain concep s.
(o “ac ionP ohibi ed”) mus be c ea ed among ac o /s and e-
sou ce/s. This p ocess o checking ules and c ea ing p ope ies
is ealized by he in e ence engine Jess as i is explained la e .
The p ocess o decision making pe o med by PDP se ice is:
when i ecei es all he in o ma ion om PIP se ices h ough
con ex handle se ice, i combines he on ology wi h SWRL
ules, and he Jess engine execu es he in e ence. The in e ed
axioms a e inco po a ed o he on ology, and he Seman ic
Que y-Enhanced Web Rule Language (SQWRL) is used o e -
i y heexis enceo hep ope ies“ac ionPe mi ed”and“ac ion-
P ohibi ed” be ween he access eques e and he eques ed e-
sou ce (e.g., ac ionPe mi ed(SPOUSE,?p) →sqw l:selec (?p)).
A e ob aining he esul s om SQWRL que ies, he possible
scena ios a e as ollows.
1) The e is a p ope y o pe mission (o p ohibi ion); hen
he decision o accep ance (denega ion) o access is made.
2) Two o mo e policies de ined by he SoC a e incohe en ,
and he e exis he wo p ope ies (pe mission and p ohi-
bi ion) a he same ime; he mo e conse a i e decision is
made (i.e., denying he access).
3) The e is no policy uling he eques ed access, and any
decisioncanno bemade; wesol e his scena ioby making
hePDP odeny he eques and communica ing o he SoC
o speci y (i he/she will) he ule con olling his kind o
access.
C. No maliza ion and A chi ec u al Design
We ha e conside ed in all scena ios wha heal h in o ma ics
s anda ds a e es ablished. Fo example, in ou in as uc u e i
is essen ial ha ligh weigh di ec o y access p o ocol (LDAP)
eposi o ies con o m o [4] and [24]. Mo eo e , he esul s de-
sc ibed ea lie (i.e., secu i y in as uc u e, speci ica ion o poli-
cies, and access decision making) ha e been de eloped wi hin a
no malized a chi ec u e ollowing p inciples o in e ope abili y
and openness. As was p esen ed in he sec ion o me hodology,
RM-ODP and HISA ha e been chosen o he no maliza ion
o he heal hca e se ices a chi ec u e suppo ing ou app oach.
This s anda d o malizes only undamen al aspec s, which a e
common and cu en ly essen ial in any ad anced heal hca e sys-
em, so i has been ex ended in di e en ea u es.
Fig. 5 shows he ul illmen be ween ac o s and oles wi hin
he Secu i y In as uc u e Communi y, he scope o which is
o es ablish a con olled access o p o ec ed esou ces by means
o policies. Among he ele an ac o s he e a e some sys ems
(ID p o ide , con ex handle , policy en o cemen , in o ma ion,
and decision) and en i ies ela ed o people o o ganiza ions ( e-
sou ce owne , use , and use agen ). The en e p ise iewpoin
abs ac s om eal implemen a ions o use cases and i p esen s
en i ies in ol ed in he secu i y in as uc u e communi y co e -
ing all possible scena ios. The unc ionali y o each ac o in he
communi y is desc ibed by he ole/s ha he ac o ul ills. The
a ailable oles a e: eques e , iden i y p o ide , decision agen ,
esou ce and policy admin, esou ce access manage , con ex
manage , e c.
This diag am is pa o he no maliza ion o he en e p ise
iewpoin desc ibed by HISA, RM-ODP, and he s anda d ISO
15414 [46] p o iding he p ope en e p ise language. All he
componen s suppo ing he access con ol in ou app oach ha e
been designed as se ices inside he HSOA, by using he ISO
19793 s anda d [47] o hei inclusion and o maliza ion in he
di e en ODP iewpoin s, and imp o ing hei eu iliza ion and
scalabili y.
In o ma ion and compu a ional iewpoin s inhe i di ec ly
om HISA s anda ds including also he amewo k o common
concep s and sys ems es ablished by he s anda ds desc ibed in
CALVILLO e al.: PRIVILEGE MANAGEMENT INFRASTRUCTURE FOR VIRTUAL ORGANIZATIONS IN HEALTHCARE GRIDS 7
Fig. 5. Ac o ole ul illmen and assignmen ules.
Sec ion II-A. Enginee ing and echnology iewpoin s deal wi h
implemen a ion issues and speci y how g id echnologies (in
ou case, he Globus middlewa e) p o ide he capabili ies o ou
p i ilege managemen in as uc u e. Al hough in his s udy, a
eal implemen a ion wi h g id echnologies has been desc ibed,
he o maliza ion o he in as uc u e by using ODP allows
o he middlewa e echnologies o be used. Thus, only enginee -
ing and echnology iewpoin s would ha e o be p o ided.
A mo e de ailed speci ica ion o he iewpoin s o ou ap-
p oach will be he ocus o u u e s udies.
IV. CONCLUSION
Ou s udy has been ocused on he de elopmen o a heal h-
ca e PMI ha an SoC could adminis a e, i.e., he/she could
decide abou he access o his/he heal h esou ces. How his
scena io is achie ed i is wha he au ho s conside he g ea
con ibu ion o his pape .
Th oughou he en i e p ocess o de elopmen ( om design
o implemen a ion), se e al con ibu ions can be ema ked. In
he i s s age and ha ing he openness and in e ope abili y as
c ucial equi emen s, nume ous s anda ds (o secu i y, a chi-
ec u e o maliza ion, e minologies, e c.) ha e been analyzed.
The mos ele an ones ha e been combined and enhanced in
o de o build a seman ic based PMI. T adi ional and cen alized
app oaches as XACML and ole-based access con ol (RBAC)
ha e been imp o ed by conside ing he dis ibu ion and com-
posi ion o se ices ollowing he SOA pa adigm, and also he
seman ic managemen in decision poin s o access con ol al-
lowing au oma ing adminis a ion asks. In his phase, he PMI
has been o malized acco ding o ODP and HISA s anda ds.
Al hough he la e is heal hca e domain speci ic, i does no
conside secu i y issues, and in his s udy an ex ension o i
has been necessa y. Due o his o maliza ion is no malized and
echnology independen , he esul ing PMI can be implemen ed
by means o di e en pla o m and echnologies, and all he
implemen a ions e ain he same le els o in e ope abili y, scal-
abili y, and openness.
In a second s age, h ee use cases ha e been analyzed in o de
o s udy he openness o he PMI and he po en ial in eg a ion
o legacy sys ems wi h i . These use cases allowed ex ac ing
unc ional equi emen s o bo h he PMI and he legacy sys em,
s essing he adequacy o conside ing he p oblem o legacy
sys em in eg a ion in an ea ly s age o he sys em design.
The nex phase has ocused on he implemen a ion, and he
PMI se ices ha e been pa icula ized like conc e e echnologi-
calelemen s.G id echnologiesha ebeenselec edasunde lying
middlewa e and all he componen s ha e been adap ed o wo k
oge he and be con o med o selec ed s anda ds suppo ing he
designed PMI in he i s s age. In pa allel, a concep on ology
has been de eloped o suppo he access con ol mechanisms
o PMI. Mo eo e , SWRL has been used as policy language
and i has been shown how seman ic echnologies (on ologies,
in e ence engines, and ule languages) could au oma e admin-
is a ion asks and acili a e a lexible and scalable managemen
o dynamic VOs.
Finally, ou implemen ed PMI has been p o ed in a eal
p ojec (PREDIRCAM). We ha e aced he in eg a ion o a
legacy sys em wi h he PMI and he solu ion o he hi d use case
was a success. To achie e his, he legacy sys em was adap ed
o manage X.509 ce i ica es and be able o communica e wi h
he whole PMI and p o ec ed esou ces, delega ing he access
con ol o he no malized pla o m.
REFERENCES
[1] T. E l, SOA P inciples o Se ice Design. Englewood Cli s, NJ:
P en ice-Hall, 2008.
[2] The Open G oup. (2009). TOGAF, En e p ise edi ion, e sion
9. [Online]. A ailable: h p://www.openg oup.o g/a chi ec u e/ oga 9-
doc/a ch/index.h ml.
8 IEEE TRANSACTIONS ON INFORMATION TECHNOLOGY IN BIOMEDICINE, VOL. 00, NO. 00, 2011
[3] I.Fos e ,C.Kesselman,andS.Tuecke, “The ana omy o he g id: Enabling
scalable i ual o ganiza ions,” In . J. Supe compu . Appl., ol. 15, no. 3,
pp. 200–222, 2001.
[4] Heal h In o ma ics—P i ilege Managemen and Access Con ol,ISO
22600-1,2, 2006.
[5] D. T i ella o, F. Spiessens, N. Zannone, and S. E alle, “POLIPO: Policies
& On oLogies o in e ope abili y, po abili y, and au onomy,” in P oc.
Policy, IEEE Compu . Soc., Jul., 2009, pp. 110–113.
[6] N. Elahi, M. Chowdhu y, and J. Noll, “Seman ic access con ol in web
based communi ies,” in P oc. 3 d In . Mul i-Con . Compu . Global In o m.
Technol., Jul./Aug., 2008, pp. 131–136.
[7] N. Zhang, L. Yao, A. Nenadic, J. Chin, C. Goble, A. Rec o , D. Chadwick,
S. O enko, and Q. Shi, “Achie ing ine-g ained access con ol in i ual
o ganiza ions,” Concu ency Compu .: P ac . Expe ., ol. 19, pp. 1333–
1352, 2007.
[8] R. Sinno , D. Chadwick, T. Dohe y, D. Ma in, A. S ell, G. S ewa , L.
Su, and J. Wa , “Ad anced secu i y o i ual o ganiza ions: The p os
and cons o cen alized s decen alized secu i y models,” in P oc. 8 h
IEEE In . Symp. Clus e Compu . G id, May, 2008, pp. 106–113.
[9] H. B. Rahmouni, T. Solomonides, M. C. Mon , and S. Shiu, “On ology-
based p i acy compliance on Eu opean heal hg id domains,” S ud. Heal h
Technol. In o ma ., ol. 147, pp. 183–189, 2009.
[10] I. Rom´
an, L. Roa, L. Reina, and G. Madinabei ia, “Demog aphic man-
agemen in a ede a ed heal hca e en i onmen ,” In . J. Med. In ., ol. 75,
no. 9, pp. 671–682, 2006.
[11] D. K e ing, J. Ba , K. Be ono , O. Dzhimo a, J. Falkne , M. Ha ung,
A. Hoheisel, T. Knoch, T. Lingne , Y. Mohammed, K. Pe e , E. Rahm,
U. Sax, D. Somme eld, T. S einke, T. Tolxdo , M. Vossbe g, F. Viezens,
and A. Weisbecke , “MediGRID: Towa ds a use iendly secu ed g id
in as uc u e,” Fu u e Gene a . Compu . Sys ., ol. 25, no. 3, pp. 326–
336, 2009.
[12] D. J. Powe , E. A. Poli ou, M. A. Slaymake , and A. C. Simpson, “Towa ds
secu e g id-enabled heal hca e,” So w. – P ac ice Exp., ol. 35, no. 9,
pp. 857–871, 2005.
[13] D. Olmedilla, O. Rana, B. Ma hews, and W. Nejdl, “Secu i y and us
issues in seman ic g ids,” in P oc. Dags hul Semin. Semi. G id: Con e -
gence Technol., 2005, p. 05271.
[14] In o ma ion Technology—Open Sys ems In e connec ion—Secu i y
F amewo ks o Open Sys ems, ISO 10181-1,2, 1996.
[15] The Di ec o y: Public-Key and A ibu e Ce i ica e F amewo ks, ITU-T
Rec. X.509, 2008.
[16] In e ne Secu i y Glossa y, RFC 4949, e sion 2, 2007.
[17] Te minology o Policy-Based Managemen , RFC 3198, 2001.
[18] OASIS. (2005). XACML 2.0 Co e, eX ensible Access Con ol Ma kup
Language Ve sion 2.0, OASIS. [Online]. A ailable: h p://www.oasis-
open.o g/commi ees/xacml.
[19] S. Can o J. Kemp R. Philpo E. Male . (2005). Asse ions and p o ocols
o he oasis secu i y asse ion ma kup language (SAML), 2.0, [On-
line]. A ailable: h p://docs.oasis-open.o g/secu i y/saml/ 2.0/saml-co e-
2.0-os.pd .
[20] Ligh weigh Di ec o y Access P o ocol, e sion 2, RFC 3494, 2003.
[21] The Di ec o y: O e iew, ITU-T Rec. X.500, 2008.
[22] Heal h In o ma ics—Sys em o Concep s o Suppo Con inui y o Ca e—
Pa 1: Basic Concep s, Eu opean Commi ee o S anda diza ion,
CEN/TC 251, EN 13940-1, 2006.
[23] Heal h In o ma ics—Elec onic Heal h Reco d Communica ion—Pa 4:
Secu i y, ISO 13606-4, 2007.
[24] Heal h In o ma ics—Di ec o y Se ices o Secu i y, Communica ions
and Iden i ica ion o P o essionals and Pa ien s, ISO 21091, 2005.
[25] The Sys ema ized Nomencla u e o Medicine (SNOMED) [Online]. A ail-
able: h p://www.ih sdo.o g/snomed-c /.
[26] A. Rec o and W. Nowlan, “The GALEN p ojec ,” Compu . Me hods
P og ams Biomed., ol. 45, no. 1–2, pp. 75–78, 1994.
[27] OBO Found y. (2010, Jul.). “The open biological and biomedical on olo-
gies,” [Online]. A ailable: h p://www.obo ound y.o g/.
[28] Heal h In o ma ics – Se ice A chi ec u e, ISO 12967-1,2,3, 2008.
[29] CORBAmed OMG. (2010, Jul.). HDTF s anda ds [Online]. A ailable:
h p://heal hca e.omg.o g/Roadmap/co bamed_ oadmap.h m.
[30] In o ma ion Technology—Open Dis ibu ed P ocessing—Re e ence
Model, ISO 10746-1,2,3,4, 1998 (Re ised in 2010).
[31] Globus Toolki Secu i y. (2010, Jul.). [Online]. A ailable: h p://www.
globus.o g/ oolki /docs/la es -s able/secu i y/.
[32] I. Fos e , C. Kesselman, L. Pea lman, S. Tuecke, and V. Welch, “The
communi y au ho iza ion se ice: S a us and u u e,” p esen ed a he
P oc. o he Compu . in High Ene gy Physics, La Jolla, CA, Ma . 2003.
[33] R. Al ie i, R. Cecchini, V. Ciaschini, L. dell’Agnello, A. F ohne ,
K. Lo en ey, and F. Spa a o, “F om g idmap- ile o oms: Managing
au ho iza ion in a g id en i onmen ,” Fu u e Gene a ion Comp. Sys .,
ol. 21, no. 4, pp. 549–558, 2005.
[34] Pe mis (p ojec unded by he ISIS p og am). (2010, Jul.). [Online]. A ail-
able: h p://www.pe mis.o g/index.h ml.
[35] P. Pa el-Schneide , P. Hayes, and I. Ho ocks. (2004). OWL web on-
ology language seman ics and abs ac syn ax, [Online]. A ailable:
h p://www.w3.o g/TR/owl-seman ics/.
[36] T. Finin, A. Joshi, L. Kagal, J. Niu, R. Sandhu, W. Winsbo ough, and
B. Thu aisingham, “ROWLBAC: Rep esen ing ole based access con ol
in OWL,” in P oc. 13 h Symp. Access Con ol Models. Technol., Jun.,
2008, pp. 73–82.
[37] M. Knech el, J. Hladik, and F. Dau, “Using OWL DL easoning o de-
cide abou au ho iza ion in RBAC,” in P oc. OWLED Wo kshop OWL:
Expe iences and Di ec ions, 2008.
[38] I. Ho ocks, P. Pa el-Schneide , H. Boley, S. Tabe , B. G oso , and
M. Dean, 2004. SWRL: A seman ic web ule language combining
OWL and RuleML, [Online]. A ailable: h p://www.w3.o g/Submission/
SWRL/
[39] H. Shen, “A seman ic-awa e a ibu e-based access con ol model o web
se ices,” Lec . N. Compu . Sci., ol. 5574, pp. 693–703, 2009.
[40] Jess Rule Engine. (2010, Jul.). [Online]. A ailable: h p://www.jess ules.
com/jess/index.sh ml.
[41] H. Knublauch, R. Fe ge son, N. Noy, and M. Musen, “The p o ´
eg´
eOWL
plugin: An open de elopmen en i onmen o seman ic web applica-
ions,” in P oc. 3 d In . Seman ic Web Con ., 2004, pp. 229–243.
[42] P. He e o, M. E. He nando, L. Roa, E. G´
omez, and A. de Lei a,
“PREDIRCAM: Technological pla o m o he p e en ion o diabe es
melli us and ca dioMe abolic isk,” p esen ed a he 2nd Con . on Ad-
anced Technologies and T ea men s o Diabe es, 2009, A hens, G eece.
[43] CMS D upal. (2010, Jul.). [Online]. A ailable: h p://d upal.o g.
[44] MDS. (2010, Jul.). [Online]. A ailable: h p://www.globus.o g/
oolki /mds/.
[45] Login Ce i ica e Module. (2010, Jul.). [Online]. A ailable:
h p://d upal.o g/p ojec /ce i ica elogin.
[46] In o ma ion Technology—Open Dis ibu ed P ocessing—Re e ence
Model—En e p ise Language, ISO 15414, 2006.
[47] In o ma ion Technology—Open Dis ibu ed P ocessing—Use o UML o
ODP Sys em Speci ica ions, ISO 19793, 2008.
Au ho ’s pho og aphs and biog aphies no a ailable a he ime o publica ion.