JP4723866B2 - Medical device and unauthorized access audit system - Google Patents

Description

  The present invention relates to a medical device and a fraudulent access audit system having a function of managing the security of personal information such as patient information, and more particularly to a medical device and fraud that can support audit of whether or not there is fraudulent access to personal information The present invention relates to an access audit system.

  Conventionally, an ultrasonic diagnostic apparatus, an X-ray CT (computed tomography) apparatus, a medical apparatus such as an MRI (magnetic resonance imaging), a HIS (hospital information system, and an RIS (radiology information system) In the medical information system, an audit log is recorded. The audit log records detailed information such as setting changes for the medical device, access to personal information such as patient information, or information related to login / logoff operations.

  Then, the security administrator who manages the security of the personal information stored in the medical device or the medical information system audits the presence / absence of unauthorized access to the personal information using the audit log.

  However, the audit log is simply time-series information and a huge amount of information. Therefore, it can be said that it is virtually impossible to check all audit logs. Therefore, use of commercially available log analysis software can be considered as one means for analyzing the audit log.

Recent log analysis software includes, for example, those referred to in Non-Patent Document 1 and Non-Patent Document 2.
BOM (registered trademark) for Windows (registered trademark), [online], Say Technologies Co., Ltd. (SAY Technologies) product information, [December 10, 2004 search], Internet <URL: http: //www.say -tech.co.jp/product/01.html> Surveillance solution, Windows (registered trademark) server, [online], Say Technologies, Inc., [Searched on December 10, 2004], Internet <URL: http://www.say-tech.co .jp / sol / 01.html>

  However, unauthorized access to personal information stored in a medical device or medical information system has characteristics different from unauthorized access to general information systems other than those for medical use.

  As a first example, there is a situation in which an emergency user who is not registered as a user may log on to a medical device or a medical information system. In other words, the medical device may need to be urgently tested, so it is necessary to be able to operate even a medical worker such as a radiologist who is not registered in advance. Therefore, in preparation for such a case, there has been proposed a plan in which an emergency user is prepared as a special user so that even a non-registered user can operate the medical device.

  However, in that case, there is a possibility that unauthorized access may be performed by exploiting the situation that this emergency user can access.

  As a second example, unauthorized access in which regular registered users' access concentrates on specific personal information may occur. In general information systems other than those for medical use, a regular access right is given, and only a specific user registered as a user can access personal information. For this reason, an unauthorized access may occur in which a specific user registered as a user acquires a large amount of personal information and makes it external. That is, unauthorized access in a general information system other than for medical use is characterized in that one user illegally obtains a large amount of personal information.

On the other hand, in the case of unauthorized access to a medical device or medical information system, in addition to unauthorized access that such a specific registered user illegally obtains and leaks a large amount of personal information, regular access authority is granted. There is a risk that many registered users who have interests will gain unauthorized access to access personal information such as medical images of specific VIP ( Very Important Person ) patients.

  Such auditing for unauthorized access unique to medical devices and medical information systems cannot be performed sufficiently by conventional log analysis software for general information systems. Therefore, it is desired to develop a tool that supports auditing when auditing the presence or absence of unauthorized access unique to medical devices or medical information systems.

  The present invention has been made to cope with such a conventional situation, and an object thereof is to provide a medical device and an unauthorized access audit system capable of supporting an unauthorized access audit specific to the medical field.

In order to achieve the above-mentioned object, the unauthorized access audit system according to the present invention permits an operation by an emergency user who has not been registered as a user to give a login authority, as described in claim 1. An audit log acquisition unit that acquires an audit log stored in at least one of the medical device and the medical information system, and the audit log acquired by the audit log acquisition unit is analyzed, and the number of times the emergency user logs in An audit log analysis unit that obtains an analysis result by aggregating at least one of the login time and the number of times the inspection image is referred to during login, and the analysis result obtained by the audit log analysis unit as a graph on the display device a graph creation unit that creates an image information for displaying, to the analysis result obtained by the audit log analyzer convex The unauthorized access that detects the unauthorized access by the emergency user when the number of logins of the emergency user within a predetermined period is equal to or greater than a predetermined threshold and creates image information for displaying the detection result of the unauthorized access on the display device And a detection unit .

Further, in order to achieve the above object, an unauthorized access audit system according to the present invention obtains an audit log stored in at least one of a medical device and a medical information system as described in claim 3. Analyzing the audit log acquired by the acquisition unit and the audit log acquisition unit, and counting the number of users of at least one of the medical device and the medical information system according to the number of times the examination image for each patient is displayed An audit log analysis unit that obtains an analysis result by a graph, and a graph creation unit that creates image information for causing the display unit to display the analysis result obtained by the audit log analysis unit as a graph It is.

In order to achieve the above-described object, the medical device according to the present invention permits an operation by an emergency user who is not registered as a user to give a login authority, as described in claim 7. In the medical device that creates and records the audit log, the audit log acquisition unit that acquires the audit log, and the audit log acquired by the audit log acquisition unit is analyzed, and the number of times the emergency user logs in, An audit log analysis unit that obtains an analysis result by aggregating at least one of the login time and the number of times an inspection image is referred to during login, and the analysis result obtained by the audit log analysis unit is displayed on a display device as a graph a graph creation unit that creates image information for causing, contact within a predetermined time period based on the audit log analyzer the analysis result obtained by The log number of the emergency user detected as unauthorized access by the emergency user to be equal to or larger than the predetermined threshold value, the unauthorized access detector unit that creates image information for displaying the detection result of the unauthorized access to the display device that, It is characterized by having.

Moreover, in order to achieve the above-described object, the medical device according to the present invention provides an audit log acquisition unit that acquires the audit log in a medical device that creates and records an audit log as described in claim 9. And analyzing the audit log acquired by the audit log acquisition unit and totaling the number of users of at least one of the medical device and the medical information system according to the number of times an examination image for each patient is displayed. An audit log analysis unit that obtains a result, and a graph creation unit that creates image information for causing the display device to display the analysis result obtained by the audit log analysis unit as a graph. .

  In the medical device and the unauthorized access audit system according to the present invention, it is possible to support an unauthorized access audit unique to the medical field.

  Embodiments of a medical device and an unauthorized access audit system according to the present invention will be described with reference to the accompanying drawings.

  FIG. 1 is a functional block diagram showing a first embodiment of a medical device and an unauthorized access audit system according to the present invention.

  The medical apparatus 1 is an arbitrary apparatus such as an ultrasonic diagnostic apparatus, an X-ray CT apparatus, or an MRI, and includes an input apparatus 2, a display apparatus 3, an audit log recording unit 4, and an audit log database 5 (DB). Further, the medical device 1 includes an unauthorized access audit system 6. However, the unauthorized access audit system 6 may be a system independent of the medical device 1 and connected to an arbitrary medical device 1.

  Furthermore, not only the medical device 1 but also the unauthorized access audit system 6 can be connected to any medical information system such as HIS, RIS, PACS, or can be built in the medical information system. Here, an example in which the unauthorized access audit system 6 is built in the medical apparatus 1 will be described.

  The unauthorized access audit system 6 can be constructed by having a computer read an unauthorized access audit program. However, all or part of the unauthorized access audit system 6 may be configured by a circuit. The unauthorized access audit system 6 includes an audit log acquisition unit 7, an audit log analysis unit 8, a graph creation unit 9 as an example of an analysis result information creation unit, and an unauthorized access detection unit 10.

  The audit log recording unit 4 performs authentication as necessary based on information input from the input device 2 to the medical device 1 and creates an audit log for use in unauthorized access audits. And a function of writing a log to the audit log database 5. Therefore, a time-series audit log is recorded in the audit log database 5.

  FIG. 2 is a diagram showing an example of an audit log stored in the audit log database 5 shown in FIG.

  As shown in FIG. 2, the audit log includes, for example, a user ID (UserID) that is identification information of an operator (user), an event ID (Logon, examination image display, Logoff, etc.) that is identification information of event contents, and a medical device 1. The device ID, which is the identification information, and the action target information (Patient ID, which is the patient identification information, Study UID, which is the identification information of the examination, etc.) specifying the action target, are created in association with the access date and time. However, some information constituting the audit log may be omitted, or conversely, any other information may be added to configure the audit log.

  For example, information for identifying whether the user is an emergency user who is not registered as a user can be added. However, it is possible to identify whether or not the user is an emergency user from the user ID.

  The audit log acquisition unit 7 receives the audit conditions input from the input device 2 and acquires the audit log required for audit from the audit log database 5 according to the audit conditions, and the acquired audit log to the audit log analysis unit 8 It has the function to give.

  Here, examples of audit conditions include the audit log file name and directory name to be audited, the audit period, the contents of audit such as the usage status of emergency users and the access status of specific personal information, and the audit log display interval ( Conditions such as daily, monthly, every three months, every six months, every year, etc.).

  The audit log analysis unit 8 has a function of analyzing the audit log received from the audit log acquisition unit 7 and a function of giving the analysis result to the graph creation unit 9 and the unauthorized access detection unit 10. At this time, the analysis content can be selected by operating the input device 2 from one or both of the usage status (access information) of the medical device 1 by the emergency user and the access status with respect to specific personal information, for example. .

  The graph creation unit 9 displays the graph on the display device 3 by providing the display device 3 with the function of creating the analysis result of the audit log received from the audit log analysis unit 8 as a graph and the created graph as image information. With functions.

  The unauthorized access detection unit 10 obtains information useful for auditing unauthorized access, such as the presence / absence, number, and frequency of unauthorized access, according to the analysis result of the audit log received from the audit log analysis unit 8 and the conditions regarded as unauthorized access. And a function of displaying the obtained result as image information on the display device 3.

  Next, operations of the medical device 1 and the unauthorized access audit system 6 will be described.

  FIG. 3 is a sequence diagram showing a flow when the medical device 1 and the unauthorized access audit system 6 shown in FIG. 1 obtain audit logs and output a graph, thereby supporting audit of the presence or absence of unauthorized access. In the figure, reference numerals with numerals S indicate steps in the sequence diagram.

  First, in step S1, a security administrator who is a user who audits unauthorized access to personal information stored in the medical apparatus 1 inputs a user ID or password to the input apparatus 2 and logs in. Request analysis of the audit log by entering. Therefore, an audit condition is given from the input device 2 to the audit log acquisition unit 7.

  Next, in step S <b> 2, the audit log acquisition unit 7 acquires an audit log necessary for the audit from the audit log database 5 according to the audit condition received from the input device 2.

  FIG. 4 is a diagram illustrating an example of an audit log acquired by the audit log acquisition unit 7 of the unauthorized access audit system 6 illustrated in FIG.

  As shown in FIG. 4, an audit log is acquired by the audit log acquisition unit 7 in accordance with the audit conditions. According to the example of the audit log shown in FIG. 4, the user (operator) “Yamada Taro” logs on to the medical device “CT001” of “XXX Hospital” at 10:12:35 on September 29, 2004. (Logon) and at 11:13:35, it can be seen that the inspection image specified with the Patient ID of “1.2.5123.11” was displayed. Furthermore, after displaying the inspection image specified with the Patient ID of “1.2.512123.2” at 12:14:35, it is understood that the user logged off at 13:15:35.

  The audit log acquisition unit 7 acquires each audit log as shown in FIG. 4 from the audit log database 5 according to the audit conditions.

  Next, in step S <b> 3, the audit log acquisition unit 7 gives the acquired audit log to the audit log analysis unit 8.

  Next, in step S 4, when an audit log analysis instruction for the desired analysis content is input from the input device 2 to the audit log analysis unit 8, the audit log analysis unit 8 receives the audit log received from the audit log acquisition unit 7. Analyzing the audit log for the analysis content specified by using

  When the analysis content is an analysis of the usage status of the medical device 1 by an emergency user, the audit log analysis unit 8 parses (analyzes) the audit log received from the audit log acquisition unit 7, and an audit log is created for each action. It is determined whether or not a predetermined condition is met. Then, the audit log analysis unit 8 extracts the audit log determined to meet the condition.

  The determination condition for extracting the audit log can be, for example, whether an audit log event within the audit period specified as the audit condition corresponds to any one of logon, logoff, and inspection image display.

  Next, the audit log analysis unit 8 tabulates, for example, the number of logons, the logon time, and the number of inspection image displays for each user (operator) using the extracted audit logs. The logon time can be obtained by subtracting the logon start time from the logon end time. The totaling period can be specified from the input device 2 and can be arbitrarily set as daily, monthly, every three months, every six months, or every year.

  FIG. 5 is a diagram showing an example of a result of counting the number of logons for each user obtained by the audit log analysis unit 8 of the unauthorized access audit system 6 shown in FIG. 1, and FIG. 6 is an unauthorized access audit system 6 shown in FIG. FIG. 7 is a diagram showing an example of the result of the logon time for each user obtained by the audit log analysis unit 8 of FIG. 7, and FIG. 7 is a diagram for each user obtained by the audit log analysis unit 8 of the unauthorized access audit system 6 shown in FIG. It is a figure which shows an example of the total result of the display frequency of a test | inspection image.

  As shown in FIG. 5, the number of logons is counted for each user in the designated audit period. For example, on September 1, 2004, it can be seen that the user “Yamada Taro” logged on once and the emergency user logged on 10 times as a result of the aggregation.

  Similarly, according to FIG. 6, the total result of the logon time for each user can be confirmed, and according to FIG. 7, the total result of the display count of the inspection image for each user can be confirmed.

  On the other hand, when the analysis content is an analysis of the access status to the specific personal information, the audit log analysis unit 8 parses the audit log received from the audit log acquisition unit 7, and the audit log is predetermined for each action. It is determined whether or not the conditions are met. Then, the audit log analysis unit 8 extracts the audit log determined to meet the condition.

  The determination condition for extracting the audit log can be, for example, whether or not an audit log event within the audit period specified as the audit condition is an inspection image display.

  Next, the audit log analysis unit 8 uses the extracted audit log to tabulate the number of display of the test image of each user (operator) for each patient who is the target of the test image, for example.

  FIG. 8 is a diagram illustrating an example of a result obtained by aggregating the number of display of the examination image of each user for each patient obtained by the audit log analysis unit 8 of the unauthorized access audit system 6 illustrated in FIG. .

  According to FIG. 8, for example, it can be confirmed that the user “Yamada Taro” has displayed the examination image of the patient “AAAAA” once. Further, for example, it can be confirmed that the user “Sato hana” has displayed the examination image of the patient “CCCCC” twice.

  Further, the audit log analysis unit 8 uses the extracted audit log, for example, a user who displayed the examination image of each patient once, a user displayed twice,..., The number of users displayed n times or more. For each day.

  Next, in step S <b> 5, the audit log analysis unit 8 gives the analysis result of the obtained audit log to the graph creation unit 9.

  In step S <b> 6, the audit log analysis unit 8 gives the obtained analysis result of the audit log to the unauthorized access detection unit 10.

  Next, in step S <b> 7, the graph creation unit 9 creates a graph based on the analysis result of the audit log received from the audit log analysis unit 8.

  FIG. 9 is a diagram showing an example of a graph indicating the number of times of emergency user logon per day created by the graph creation unit 9 of the unauthorized access audit system 6 shown in FIG.

  In FIG. 9, the vertical axis indicates the number of emergency user logons, and the horizontal axis indicates the date. According to FIG. 9, it is possible to easily confirm the transition of the number of times the emergency user logs on every day.

  FIG. 10 is a diagram showing an example of a graph showing the log-on time for each day of the emergency user created by the graph creating unit 9 of the unauthorized access audit system 6 shown in FIG.

  In FIG. 10, the vertical axis represents the emergency user logon time, and the horizontal axis represents the date. According to FIG. 10, it is possible to easily confirm the transition of the logon time of the emergency user for each day.

  FIG. 11 is a diagram illustrating an example of a graph indicating the number of times the emergency user displays the inspection image for each day created by the graph creation unit 9 of the unauthorized access audit system 6 shown in FIG. 1.

  In FIG. 11, the vertical axis indicates the number of times the emergency image is displayed by the emergency user, and the horizontal axis indicates the date. According to FIG. 11, it is possible to easily confirm the transition of the number of times the inspection image is displayed by the emergency user every day.

  FIG. 12 is a diagram showing an example of a graph showing the daily access situation to the personal information of a specific patient created by the graph creating unit 9 of the unauthorized access audit system 6 shown in FIG.

  In FIG. 12, the vertical axis indicates the number of users who have displayed patient examination images, and the horizontal axis indicates the date. In addition, the diamonds in FIG. 12 indicate the number of users who displayed the inspection image once, the squares indicate the number of users who displayed the inspection image twice, and the triangles indicate the users who displayed the inspection image three times. The cross marks indicate the number of users who have displayed the inspection image four times or more.

  According to FIG. 12, the transition of the number of users who have displayed an examination image of a certain patient can be confirmed for each display count. For example, on the 5th, it can be confirmed that there were 15 users who displayed the inspection image once. For example, on the 9th, it can be confirmed that there was one user who displayed the inspection image four times or more.

  In step S8, the unauthorized access detection unit 10 detects the presence, frequency, or frequency of unauthorized access according to a predetermined criterion based on the analysis result of the audit log received from the audit log analysis unit 8. Examples of these unauthorized access detection methods include a method in which a threshold value is set, and a total result such as the number of logins and the number of inspection image display is compared with the threshold value.

  FIG. 13 is a diagram illustrating an example of the result of unauthorized access detected by the unauthorized access detection unit 10 of the unauthorized access audit system 6 illustrated in FIG.

  In FIG. 13, the vertical axis indicates the number of times an emergency user logs on, and the horizontal axis indicates the date. In FIG. 13, the alternate long and short dash line indicates a threshold value serving as a reference for detecting unauthorized access. According to FIG. 13, the days when the emergency user logs on three times or more, which is the threshold, are 3, 4, and 6, and the emergency user continuously accesses the personal information many times during the period indicated by the dotted line. It can be confirmed that there is a possibility. Therefore, it can be inferred that there is a suspicion of unauthorized access by an emergency user, or that the medical device 1 is not properly used.

  FIG. 14 is a diagram showing an example of the result of unauthorized access detected by the unauthorized access detection unit 10 of the unauthorized access audit system 6 shown in FIG.

  In FIG. 14, the vertical axis indicates the number of times the inspection image is displayed, and the horizontal axis indicates the date. In FIG. 14, the alternate long and short dash line indicates a threshold value used as a reference when detecting unauthorized access. According to FIG. 14, there is a day (3 days) when the number of inspection image display times by the emergency user is a threshold value of 4 times or more, and the emergency user can access the personal information many times on the date indicated by the dotted line. Can be confirmed. For this reason, it can be inferred that there is a suspicion of unauthorized access by an emergency user on the 3rd.

  In addition, a threshold value is further set for the frequency at which the counting result such as the number of logons exceeds or exceeds the threshold value, and it is determined whether or not the frequency exceeds the threshold value or exceeds the threshold value. You can also.

  FIG. 15 is a diagram showing an example of the result of unauthorized access detected by the unauthorized access detection unit 10 of the unauthorized access audit system 6 shown in FIG. 1 based on the result of counting the daily access status to the personal information of a specific patient. It is.

  In FIG. 15, the vertical axis indicates the number of users who have displayed patient examination images, and the horizontal axis indicates the date. In FIG. 15, the rhombus marks indicate the number of users who displayed the inspection image once, the square marks indicate the number of users who displayed the inspection image twice, and the triangle marks indicate the number of users who displayed the inspection image three times. The cross marks indicate the number of users who have displayed the inspection image four times or more. Further, a dotted line in FIG. 15 indicates a threshold value of the number of users serving as a reference when detecting unauthorized access.

  According to FIG. 15, as indicated by the alternate long and short dash line, the number of users who have displayed the inspection image a small number of times (once or twice) on day 5 exceeds the threshold value of nine. Therefore, it turns out that many users are browsing the test | inspection image of a specific patient. For this reason, there is a suspicion that many users illegally access specific personal information.

  Moreover, according to FIG. 15, it turns out that the test | inspection image of a specific patient is displayed many times with 3 times or 4 times or more from the 8th to the 9th as shown with a dashed-two dotted line. Therefore, there is a suspicion that a specific user is accessing the patient's personal information illegally or excessively. Thus, a threshold can be set for the number of times the inspection image is displayed.

  Then, the unauthorized access detection unit 10 creates image information for displaying detection results of unauthorized access such as presence / absence, number of times, and frequency of unauthorized access. As a method of displaying the detection result of unauthorized access, for example, in addition to a method of displaying the detection result in a text format as a sentence, a method of highlighting a specific part by color, or as shown in FIGS. The method of displaying by a figure and a symbol is mentioned.

  Next, in step S9, the graph creating unit 9 gives the graph to the display device 3 as image information.

  In step S <b> 10, the unauthorized access detection unit 10 provides the display device 3 with image information for displaying the unauthorized access detection result.

  Next, in step S <b> 11, the display device 3 displays the graph and the unauthorized access detection result using the image information received from the graph creating unit 9 and the unauthorized access detection unit 10. As a result, graphs as shown in FIGS. 9, 10, 11, and 12 are displayed on the display device 3. Further, when the unauthorized access detection unit 10 displays a frame as the unauthorized access detection result, the unauthorized access detection result is displayed together with the graph as shown in FIGS. 13, 14, and 15.

  Therefore, the security administrator can easily confirm information such as the presence / absence of unauthorized access, the number of times, and the frequency from the graph displayed on the display device 3 and the detection result of unauthorized access.

That is, the medical device 1 and the unauthorized access audit system 6 as described above acquire and analyze an audit log in order to protect the personal information held in the medical device 1, thereby using the emergency user usage status, it is obtained by allowing and a benzalkonium displays the access status to the specific individual information as a graph.

  By configuring the medical device 1 and the unauthorized access audit system 6 in this way, it is possible to easily check and audit whether there is unauthorized access specific to the medical field for personal information.

  In addition, although the graph creation unit 9 for creating a graph as the analysis result information creation unit is provided in the medical device 1 or the unauthorized access audit system 6, the audit log is not limited to the graph and can be generated in any format such as a table format or a numerical value. Information for displaying the analysis result may be created and displayed on the display device 3.

  Also, some functions of the unauthorized access audit system 6 may be omitted. For example, the unauthorized access detection unit 10 may be omitted, and only the graph may be displayed on the display device 3, and the user may determine whether there is unauthorized access from the graph.

  Incidentally, the unauthorized access audit system 6 as described above can be installed in various systems and devices. Therefore, configuration examples of the unauthorized access audit system 6 are listed. The unauthorized access audit system 6 can take a configuration other than the configuration examples shown below.

  FIG. 16 is a functional block diagram showing a second embodiment of the medical device and the unauthorized access audit system according to the present invention.

  In the medical device 1A and the unauthorized access audit system 6A shown in FIG. 16, the medical device 1A is connected to a repository 20 that collectively manages audit logs via a network, for example, a syslog server. The configuration provided as one function of the repository 20 is different from the medical device 1 and the unauthorized access audit system 6 shown in FIG. Since other configurations and operations are not substantially different from the medical device 1 and the unauthorized access audit system 6 shown in FIG. 1, configurations having similar functions are denoted by the same reference numerals and description thereof is omitted.

  A transmission unit 21 is provided in the medical apparatus 1A. The transmission unit 21 is connected to the repository 20 via the network, and can transmit the audit log stored in the audit log database 5 to the repository 20. The repository 20 is provided with a reception unit as the audit log acquisition unit 7. The audit log acquisition unit 7 of the repository 20 automatically acquires audit logs from a single or a plurality of medical devices 1A via the network, and the audit logs are collectively managed in the repository 20.

  The repository 20 is provided with an unauthorized access audit system 6A. The unauthorized access audit system 6A is provided with an analysis result database 22 in addition to the same components as the unauthorized access audit system 6 shown in FIG. When the audit log analysis unit 8 receives the audit log from the audit log acquisition unit 7, the audit log analysis unit 8 automatically analyzes the audit log using the acquisition of the audit log as a trigger and writes the analysis result in the analysis result database 22. Is done.

  In the unauthorized access audit system 6A, when a graph creation instruction and unauthorized access detection instruction are input from the input device 2 of the repository 20 to the graph creation unit 9 and the unauthorized access detection unit 10, the graph creation unit 9 and the unauthorized access detection system 10A. The access detection unit 10 acquires an analysis result of the audit log from the analysis result database 22 using an instruction from the input device 2 as a trigger, creates a graph, and detects unauthorized access.

  FIG. 17 is a functional block diagram showing a third embodiment of the medical device and the unauthorized access audit system according to the present invention.

  In the medical device 1B and the unauthorized access audit system 6B shown in FIG. 17, a recording unit 31 for writing an audit log to the medium 30 is provided in the medical device 1B. On the other hand, the unauthorized access audit system 6B is, for example, a security administrator or the like. 1 is different from the medical device 1 and the unauthorized access audit system 6 shown in FIG. Since other configurations and operations are not substantially different from the medical device 1 and the unauthorized access audit system 6 shown in FIG. 1, configurations having similar functions are denoted by the same reference numerals and description thereof is omitted.

  The audit log recorded in the audit log database 5 of the medical apparatus 1B can be written to the medium 30 by the recording unit 31. For this reason, a user such as a security administrator records the audit log of the medical apparatus 1B on the medium 30 prior to the audit. During the audit, the input device 2 of the PC 32 is operated, and an audit log is input to the PC 32 using the audit log acquisition unit 7 provided as a reading unit in the unauthorized access audit system 6B.

  Next, the audit log is given to the audit log analysis from the audit log acquisition unit 7 according to the instruction from the input device 2, and the audit log is analyzed, the graph is created by the same flow as the unauthorized access audit system 6 shown in FIG. Unauthorized access detection, graphs, and unauthorized access detection results are displayed.

  FIG. 18 is a functional block diagram showing a fourth embodiment of the medical device and the unauthorized access audit system according to the present invention.

  In the medical device 1C and the unauthorized access audit system 6C shown in FIG. 18, the unauthorized access audit system 6C is an independent system, and information can be transmitted between the medical device 1C and the unauthorized access audit system 6C by various methods. This is different from the medical device 1 and the unauthorized access audit system 6 shown in FIG. Since other configurations and operations are not substantially different from the medical device 1 and the unauthorized access audit system 6 shown in FIG. 1, configurations having similar functions are denoted by the same reference numerals and description thereof is omitted.

  The medical device 1C, the unauthorized access audit system 6C, and the repository 20 are connected to each other via a network. The medical apparatus 1C is provided with a transmission unit 21 and a recording unit 31. The transmission unit 21 of the medical device 1C is connected to the repository 20 and the unauthorized access audit system 6C via a network. Then, the transmission unit 21 converts the audit log stored in the audit log database 5 to the repository 20 or the unauthorized access audit system 6C using FTP (File Transfer Protocol), HTTP (Hyper Text Transfer Protocol), DICOM (digital imaging and communications in medicine). ) And the like can be used for transmission.

  In addition, the recording unit 31 of the medical device 1 </ b> C can write the audit log stored in the audit log database 5 to the medium 30.

  The audit log acquisition unit 7 of the unauthorized access audit system 6C is provided with a reading unit 7a and a receiving unit 7b, and an audit log can be acquired from the medium 30 by the reading unit 7a. In addition, the receiving unit 7b can receive the audit log from the repository 20 or the transmitting unit 21 of the medical device 1C via the network.

  Then, in the unauthorized access audit system 6C, in accordance with an instruction from the input device 2, the audit log analysis, graph creation, unauthorized access detection, graph and unauthorized access are performed in the same flow as the unauthorized access audit system 6 shown in FIG. The detection result is displayed.

  FIG. 19 is a functional block diagram showing a fifth embodiment of the medical device and the unauthorized access audit system according to the present invention.

  In the medical device 1D and the unauthorized access audit system 6D shown in FIG. 19, the unauthorized access audit system 6C is an independent system, and the medical device 1C and the unauthorized access audit system 6C can communicate information over a network. In addition, the operation trigger of the unauthorized access audit system 6D is different from that of the medical device 1 and the unauthorized access audit system 6 shown in FIG. Since other configurations and operations are not substantially different from the medical device 1 and the unauthorized access audit system 6 shown in FIG. 1, configurations having similar functions are denoted by the same reference numerals and description thereof is omitted.

  The audit log stored in the audit log database 5 of the medical device 1C can be transmitted from the transmission unit 21 to the audit log acquisition unit 7 provided as a reception unit in the unauthorized access audit system 6C via the network. For example, the audit log is periodically transmitted from the transmission unit 21 of the medical device 1D to the audit log acquisition unit 7 of the unauthorized access audit system 6C, and the audit log received by the audit log acquisition unit 7 is automatically audit log analysis unit 8 is given.

  The audit log analysis unit 8 automatically analyzes the audit log when receiving the audit log from the audit log acquisition unit 7. The unauthorized access audit system 6C is provided with an analysis result database 22, and the audit log analysis unit 8 writes and stores the analysis result of the audit log in the analysis result database 22.

  When a user such as a security administrator inputs a graph creation instruction and an unauthorized access detection instruction from the input device 2 to the graph creation unit 9 and unauthorized access detection unit 10, the graph creation unit 9 and unauthorized access detection are performed. The unit 10 acquires the analysis result of the audit log from the analysis result database 22 using an instruction from the input device 2 as a trigger, creates a graph, and detects unauthorized access.

  In this way, when an audit log is generated in the medical device 1D and the unauthorized access audit system 6C acquires the audit log, the audit log is analyzed in advance, and the analysis result of the audit log is stored in the analysis result database 22. May be.

  In addition to the system configurations such as the various unauthorized access audit systems 6, 6A, 6B, 6C, and 6D as described above, the system can be realized as a Web service.

  Next, a configuration example in which another function is added to the unauthorized access audit system 6 will be described.

  FIG. 20 is a functional block diagram showing a sixth embodiment of the medical device and the unauthorized access audit system according to the present invention.

  In the medical device 1E and the unauthorized access audit system 6E shown in FIG. 20, the image management information database 40 and the examination order information database 41 are provided in the medical device 1E, and the detailed functions of the unauthorized access audit system 6E are shown in FIG. This is different from the medical device 1 and the unauthorized access audit system 6 shown. Since other configurations and operations are not substantially different from the medical device 1 and the unauthorized access audit system 6 shown in FIG. 1, configurations having similar functions are denoted by the same reference numerals and description thereof is omitted.

  The medical apparatus 1E is provided with an image management information database 40 and an examination order information database 41. The image management information database 40 stores image management information in which a study UID that is action target information included in the audit log and patient identification information are associated with each other, while the examination order information database 41 stores examinations for each patient. The inspection order information for managing the reservations is stored. In the examination order information, the Study UID is associated with the patient identification information.

  The audit log analysis unit 8 of the unauthorized access audit system 6E analyzes the image management information stored in the image management information database 40 and the inspection order information stored in the inspection order information database 41 when analyzing the audit log. Refer to any information to identify the patient. In other words, when it is necessary to identify and aggregate patients by analyzing the audit log, if the information that directly identifies the patient is included in the audit log, aggregation can be easily performed. If only indirect information for identifying a patient such as a Study UID is included, it is difficult to identify the patient.

  FIG. 21 is a diagram illustrating an example of a case where information for directly specifying a patient is not included in the audit log to be analyzed by the audit log analysis unit 8.

  In the audit log shown in FIG. 21, a Study UID is recorded as action target information for an event called inspection image display. For this reason, it is impossible to directly specify which patient the examination image displayed from the audit log belongs to.

  Therefore, in such a case, the audit log analysis unit 8 refers to the image management information stored in the image management information database 40 and the examination order information stored in the examination order information database 41 to identify the patient.

  FIG. 22 is a diagram showing an example of image management information stored in the image management information database 40 shown in FIG.

  As shown in FIG. 22, in the image management information database 40, the Study UID and patient identification information are associated with each other and stored as image management information. In the example of FIG. 22, it can be seen that the patient whose Study UID is “1.2.35.687.3” is “AAAAA”.

  FIG. 23 is a diagram showing an example of examination order information stored in the examination order information database 41 shown in FIG.

  As shown in FIG. 23, the examination order information database 41 stores examination order information in which a reservation date, patient identification information, and a Study UID are associated as examination reservation information. Also from the example of FIG. 23, it can be seen that the patient whose Study UID is “1.2.35.687.3” is “AAAAA”.

  As described above, when the audit log analysis unit 8 refers to the image management information stored in the image management information database 40 and the examination order information stored in the examination order information database 41, information for directly specifying the patient in the audit log is obtained. Even if it is not included, the patient can be specified. Further, if the information included in the audit log is associated with the patient identification information, the audit log analysis unit 8 can refer to other information, not limited to examination order information and image management information. Also good.

  The medical devices 1, 1A, 1B, 1C, 1D, and 1E and the unauthorized access audit systems 6, 6A, 6B, 6C, 6D, and 6E in the embodiments described above may be combined with each other, or a part of them. The function may be omitted.

1 is a functional block diagram showing a first embodiment of a medical device and an unauthorized access audit system according to the present invention. The figure which shows an example of the audit log preserve | saved in the audit log database shown in FIG. The sequence diagram which shows the flow at the time of assisting the audit | inspection of the presence or absence of unauthorized access by acquiring an audit log and outputting a graph by the medical device and unauthorized access audit system shown in FIG. The figure which shows an example of the audit log acquired by the audit log acquisition part of the unauthorized access audit system shown in FIG. The figure which shows an example of the total result of the frequency | count of logon according to the user obtained by the audit log analysis part of the unauthorized access audit system shown in FIG. The figure which shows an example of the total result of the logon time for every user obtained by the audit log analysis part of the unauthorized access audit system shown in FIG. The figure which shows an example of the total result of the display frequency of the test image classified by user obtained by the audit log analysis part of the unauthorized access audit system shown in FIG. The figure which shows an example of the result obtained by totaling the display frequency of the test image of each user classified by patient obtained by the audit log analysis part of the unauthorized access audit system shown in FIG. The figure which shows an example of the graph which shows the frequency | count of logon of the emergency user for every day produced by the graph preparation part of the unauthorized access audit system shown in FIG. The figure which shows an example of the graph which shows the logon time for every day of the emergency user created by the graph preparation part of the unauthorized access audit system shown in FIG. The figure which shows an example of the graph which shows the display frequency of the inspection image for every day of the emergency user produced by the graph preparation part of the unauthorized access audit system shown in FIG. The figure which shows an example of the graph which shows the daily access condition to the personal information of the specific patient produced by the graph preparation part of the unauthorized access audit system shown in FIG. The figure which shows the example of the result of the unauthorized access detected by the unauthorized access detection part of the unauthorized access audit system shown in FIG. The figure which shows the example of the result of the unauthorized access detected by the unauthorized access detection part of the unauthorized access audit system shown in FIG. The figure which shows the example of the result of the unauthorized access detected based on the total result of the daily access condition to the specific patient's personal information by the unauthorized access detection part of the unauthorized access audit system shown in FIG. The functional block diagram which shows 2nd Embodiment of the medical device and unauthorized access audit system which concern on this invention. The functional block diagram which shows 3rd Embodiment of the medical device and unauthorized access audit system which concern on this invention. The functional block diagram which shows 4th Embodiment of the medical device and unauthorized access audit system which concern on this invention. The functional block diagram which shows 5th Embodiment of the medical device and unauthorized access audit system which concern on this invention. The functional block diagram which shows 6th Embodiment of the medical device and unauthorized access audit system which concern on this invention. The figure which shows an example when the information for specifying a patient directly is not contained in the audit log used as the analysis object by an audit log analysis part. The figure which shows an example of the image management information preserve | saved in the image management information database shown in FIG. The figure which shows an example of the test order information preserve | saved in the test order information database shown in FIG.

Explanation of symbols

1, 1A, 1B, 1C, 1D, 1E Medical device 2 Input device 3 Display device 4 Audit log recording unit 5 Audit log database (DB)
6, 6A, 6B, 6C, 6D, 6E Unauthorized access audit system 7 Audit log acquisition unit 7a Reading unit 7b Reception unit 8 Audit log analysis unit 9 Graph creation unit 10 Unauthorized access detection unit 20 Repository 21 Transmission unit 22 Analysis result database ( DB)
30 Media 31 Recording unit 32 PC (personal computer)
40 Image management information database 41 Inspection order information database

Claims (9)

An audit log acquisition unit that acquires an audit log stored in at least one of a medical device and a medical information system configured to allow an operation by an emergency user who has not been registered to give a login authority;
Audit that analyzes the audit log acquired by the audit log acquisition unit and obtains an analysis result by totaling at least one of the number of logins of the emergency user, the login time, and the number of times of inspection image reference during login A log analysis unit;
A graph creation unit that creates image information for displaying the analysis result obtained by the audit log analysis unit as a graph on a display device;
Based on the analysis result obtained by the audit log analysis unit, if the number of logins of the emergency user within a predetermined period is greater than or equal to a predetermined threshold, it is detected as unauthorized access by the emergency user, and the detection result of this unauthorized access is An unauthorized access detector for creating image information to be displayed on the display device;
An unauthorized access audit system characterized by comprising: The unauthorized access detection unit
As the image information for causing the display device to display the detection result of the unauthorized access, the number of logins of the emergency user within the predetermined period of the graph generated by the graph generating unit is equal to or greater than the predetermined threshold. Create a frame around the part,
The unauthorized access audit system according to claim 1. An audit log acquisition unit for acquiring an audit log stored in at least one of the medical device and the medical information system;
The audit log acquired by the audit log acquisition unit is analyzed, and the analysis result is obtained by aggregating the number of users of at least one of the medical device and the medical information system according to the number of times an examination image for each patient is displayed. An audit log analysis unit to obtain,
A graph creation unit that creates image information for displaying the analysis result obtained by the audit log analysis unit as a graph on a display device;
An unauthorized access audit system characterized by comprising: If the number of the users displayed within a predetermined period based on the analysis result obtained by the audit log analysis unit is equal to or greater than a predetermined threshold, the inspection image is detected as unauthorized access to the inspection image, 4. The unauthorized access audit system according to claim 3, further comprising an unauthorized access detection unit that creates image information for causing the display device to display the detected result as an unauthorized access detection result. If there is the user who has displayed the inspection image a predetermined threshold number of times or more within a predetermined period based on the analysis result obtained by the audit log analysis unit, the user may illegally access the inspection image. 4. An unauthorized access inspection system according to claim 3, further comprising an unauthorized access detection unit that creates image information for determining that there is a suspicion and causing the display device to display the determination result as an unauthorized access detection result. . The said audit log analysis part is comprised so that a desired object may be totaled for every patient with reference to the information which linked | related the information contained in the said audit log, and patient identification information. 6. The unauthorized access audit system according to any one of 1 to 5 . In a medical device that allows operation by an emergency user who has not been registered to give login authority, and creates and records an audit log,
An audit log acquisition unit for acquiring the audit log;
Audit that analyzes the audit log acquired by the audit log acquisition unit and obtains an analysis result by totaling at least one of the number of logins of the emergency user, the login time, and the number of times of inspection image reference during login A log analysis unit;
A graph creation unit that creates image information for displaying the analysis result obtained by the audit log analysis unit as a graph on a display device;
Based on the analysis result obtained by the audit log analysis unit, if the number of logins of the emergency user within a predetermined period is greater than or equal to a predetermined threshold, it is detected as unauthorized access by the emergency user, and the detection result of this unauthorized access is An unauthorized access detector for creating image information to be displayed on the display device;
A medical device comprising: The unauthorized access detection unit
  As the image information for causing the display device to display the detection result of the unauthorized access, the number of logins of the emergency user within the predetermined period of the graph generated by the graph generating unit is equal to or greater than the predetermined threshold. Create a frame around the part,
  The medical apparatus according to claim 7. In medical devices that create and record audit logs,
An audit log acquisition unit for acquiring the audit log;
The audit log acquired by the audit log acquisition unit is analyzed, and the analysis result is obtained by aggregating the number of users of at least one of the medical device and the medical information system according to the number of times an examination image for each patient is displayed. An audit log analysis unit to obtain,
A graph creation unit that creates image information for displaying the analysis result obtained by the audit log analysis unit as a graph on a display device;
A medical device comprising:

Images