JP2014142794A - Portable information storage device and method for controlling the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To output medical information when authentication is successful by an authentication system for emergency in emergency.SOLUTION: The portable information storage device comprises: emergency condition determination means for determining whether or not a user is put in an emergency condition on the basis of location information, and for, when determining that the user is put in the emergency condition, setting an emergency condition flag; an effective term determination means for determining whether or not a first effective term determined on the basis of the date when it is determined that the user is put in the emergency condition and a preliminarily stored effective term expires; authentication system switching means for, when it is determined that the effective term does not expire, or when it is determined that the effective term expires, and the following determination result of the emergency condition determination means indicates that the user is put in the emergency condition, switching the authentication system of authentication means to an authentication system for emergency in response to a request for authentication by the authentication system for emergency; authentication means for performing authentication by the authentication system for emergency or an authentication system for a normal operation; and output means for, when the authentication by the authentication means is successful, outputting medical information.

Description

  The present invention relates to an information management system and an information management method using a portable information storage device (hereinafter referred to as an IC card).

  In recent years, an information management system using an IC card having a security function has become common from the viewpoint of information security protection based on the enforcement of the Personal Information Protection Law. Such an IC card has a widely known mechanism for identifying and authenticating before use and restricting the use of the IC card only to the owner. Here, the person who accesses the data stored in the IC card can be classified into an owner and a user. The owner indicates a person related to the data contents in the IC card, and the user indicates a person who operates the data.

  For example, in medical care, if an electronic medical record of a patient is used as data, the patient is the owner and the doctor is the user. From such a background, there is a method of storing medical information in an IC card as an information management system using the IC card. In the medical field, from the viewpoint of personal information protection, a mechanism has been proposed in which medical information such as medical records cannot be accessed by a doctor without the permission of the patient.

Patent Document 1 proposes a method of authenticating the owner of an IC card and permitting reading and writing to the IC card only when the owner permits it. Specifically, the doctor encrypts the medical information with the doctor's key in advance and stores it in the patient's IC card. The patient can authenticate the patient's IC card at the time of storage, and the doctor can write medical information to the patient's IC card only when the patient who has succeeded in the authentication permits the writing. Similarly, when a doctor uses medical information stored in a patient's IC card, the doctor can only obtain medical information from the patient's IC card when the patient authenticates and the patient who has succeeded in authentication permits the output. Can be read.
In addition, a technique has been proposed in which the biometric information of a person who is permitted to use the IC card by the owner in advance is registered so that the IC card can be used by a person other than the owner.

JP 2000-67187 A

However, the method described in Patent Document 1 has a problem that no one can access data stored in the IC card when the owner of the IC card falls into an emergency and cannot perform an authentication action.
In addition, a person other than the owner who has been previously permitted to use the IC card by the owner and whose biometric information has been registered to enable the use of the IC card is close to the owner when the owner falls into an emergency situation. Sometimes it is not. Even in such a case, there is a problem that no one can access the data stored in the IC card.
The present invention has been made in view of such problems, and an object of the present invention is to provide a technology that allows a specific user to access an IC card only when it can be determined that it is an emergency.

In order to solve the above problems, the portable information storage device of the present invention is
Storage means for storing medical information;
An emergency state determination unit that determines whether or not an emergency state is present based on position information indicating a geographical position, and sets an emergency state flag to a state indicating an emergency state when the emergency state is determined. When,
When the emergency state flag indicates an emergency state, it is determined based on the date and time when the emergency state determination unit determines that the emergency state is in an emergency state, and a first valid period stored in advance. Expiration date determining means for determining whether the first expiration date has expired;
When the expiration date determining means determines that the expiration date has not expired, or when the expiration date determination means determines that the expiration date has expired, the emergency state determination means executed thereafter If the result of the determination indicates an emergency condition,
An authentication method switching unit that switches the authentication method of the authentication unit to the emergency authentication method when authentication by the emergency authentication method is requested;
Authentication means for authenticating by the emergency authentication method or the normal authentication method;
Output means for outputting the medical information when authentication by the authentication means is successful;
Have

  Only when it can be determined that it is an emergency, a specific user can access information in the IC card by switching the authentication means.

It is a figure explaining the apparatus structure in 1st, 2nd embodiment. It is a figure explaining the functional structure of the IC card in 1st, 2nd embodiment. It is a figure explaining the function structure of the terminal in 1st, 2nd embodiment. It is a figure explaining the flow of the read-out and write-in process at the normal time in 1st, 2nd embodiment. It is a figure explaining the flow of the read-out process in emergency in 1st, 2nd embodiment. It is a figure explaining the flow of the expiration date determination process in 2nd Embodiment.

(First embodiment)
<Overall system configuration>
FIG. 1A shows an example of the overall configuration of a system in this embodiment. The system according to this embodiment includes an owner IC card 100, a user IC card 101, an owner terminal 102, and a user terminal 103.
In the figure, an owner IC card 100 and a user IC card 101 are IC (Integrated Circuit) cards that are widely used, and are cards that incorporate an integrated circuit for recording and calculating information. The owner IC card 100 is connected to the owner terminal 102 and receives information from the user terminal 103 via the owner terminal 102 or outputs it to the user terminal 103.

Further, identification and authentication are performed in response to a request for writing or reading information from the user terminal 103, and writing or reading is permitted only when the authentication is successful. Furthermore, it is determined whether the owner IC card 100 is in an emergency state, and the owner authentication method is switched according to the determination result.
The user IC card 101 is used for identifying and authenticating the user of the user terminal 103. The owner terminal 102 is connected to the owner IC card 100 and is used as an interface for identifying and authenticating the owner of the owner IC card 100. The user terminal 103 is connected to the user IC card 101 and is used as an interface for identifying and authenticating the owner of the user IC card 101.

It is assumed that data communication is performed between the owner terminal 102 and the user terminal 103 via the network line 104. The network line 104 is wired in the figure, but may be wireless.
When data communication is performed between the IC card and the terminal, it is performed via a connection terminal (not shown). The connection terminal may be a contact type or a non-contact type.

<Basic configuration of IC card applicable to owner IC card 100 and user IC card 101>
A basic configuration of an IC card applicable to the present embodiment will be described with reference to FIG.
In the figure, an IC card 200 is, for example, a common IC card, and includes a CPU 201, a ROM 202, a RAM 203, an EEPROM 204, and an I / F 205, which are connected by a bus 206.

  In the figure, a CPU 201 is a CPU capable of controlling the operation of each unit in the IC card or executing a program loaded in the RAM 203. A ROM 202 is a read-only memory, and stores an OS serving as an IC card application and a platform in advance. A RAM 203 is a RAM for temporarily storing a program and data to be processed for processing by the CPU 201, and a program for the OS and the CPU 201 to perform various processes to be described later is loaded therein. Become.

  The EEPROM 204 stores user information because the data is retained even when the IC card power is turned off. The I / F 205 is an interface having a structure such as a contact method or a non-contact method, and is used when sharing power and transmitting / receiving various information to / from an external device. The bus 206 controls data transfer between the component modules.

<Basic Configuration of Host Computer Applicable to Owner Terminal 102 and User Terminal 103>
A host computer applicable to this embodiment will be described with reference to FIG. FIG. 1C is a diagram showing a basic configuration of the host computer 300 functioning as the owner terminal 102 and the user terminal 103 according to the present embodiment, and the relationship with the peripheral devices.

  In the figure, a host computer 300 is, for example, a widely used personal computer, and can store image data and the like in an HDD 306, a CDD 307, an FDD 308, a DVD 309, and the like. In addition, image data stored in the HDD 306, the CDD 307, the FDD 308, the DVD 309, and the like can be displayed on the monitor 302. Further, these image data can be distributed via the Internet or the like by using the NIC 310 or the like. In addition, various instructions from the user are performed by input from the monitor 302 having a touch panel, the pointing device 312 and the keyboard 313. Inside the host computer 300, blocks to be described later are connected by a bus 301, and various data can be transferred.

  In the figure, the monitor 302 can display various information from the host computer 300. The CPU 303 is a central processing unit that can control the operation of each unit in the host computer 300 or execute a program loaded in the RAM 305. A ROM 304 is a read-only memory that stores a BIOS and a boot program. A RAM 305 is a random access memory that temporarily stores a program and image data to be processed in order to be processed by the CPU 303, and is loaded with a program for the OS and the CPU 303 to perform various processes described later. It will be.

An HDD 306 is a hard disk drive used for storing an OS and a program transferred to a RAM or the like, or for storing or reading image data while the apparatus is operating.
The CDD 307 is a CD drive that can read data from a compact disc (CD) such as a CD-ROM, CD-R, CD-R / W, etc., which is one of external storage media, and write data to the CD.
The FDD 308 is an FD drive that can read data from an FD (flexible disk) and write data to the FD.

The DVDD 309 is a DVD drive that can read data from a DVD such as a DVD-ROM and a DVD-RAM and write data to the DVD.
Note that when a program for image processing is stored in a CD-ROM, FD, DVD-ROM or the like, these programs are installed in the HDD 306 and transferred to the RAM 305 as necessary.

The I / F 311 is an interface for connecting the NIC 310 to the host computer 300. The NIC 310 is a network interface card for connecting to a network such as the Internet. The host computer 300 transmits data to the Internet via the I / F 311 and receives data from the Internet.
The I / F 314 is an interface for connecting the pointing device 312 and the keyboard 313 to the host computer 300, and various instructions input from the pointing device 312 and the keyboard 313 are input to the CPU 303 via the I / F 314. The IC card reader / writer 315 is also connected via the I / F 314.

<Functional configuration of owner IC card 100>
A functional configuration of the owner IC card (portable information storage device) 100 applied to the present embodiment will be described with reference to FIG. As shown in the figure, the owner IC card 100 includes an input unit 401, a control unit 402, a storage unit 403, an identification authentication unit 404, an emergency state determination unit 405, an expiration date determination unit 406, an authentication method switching unit 407, an output. 408 and a position information acquisition unit 409.

The input unit 401 receives authentication information, position information, data, and the like as information from the owner terminal 102 connected to the owner IC card 100.
The authentication information is information used for identification and authentication of the owner IC card, such as a password or biometric information.
The position information is used to determine whether or not an emergency state exists. The “position information indicating the current position of the owner IC card” is compared with “position information indicating the place that can be regarded as an emergency state”, and the distance between the “current position of the owner IC card” and the “location that can be regarded as an emergency state” Is less than a predetermined value, it is determined that the owner of the owner IC card is in an emergency state. “A place that can be considered as an emergency” means, for example, “in the vicinity of a stretcher equipped in an emergency vehicle to accommodate the victim” or “a hospital equipped with a lifesaving emergency facility (so-called“ emergency hospital ”). It is an emergency room (near the so-called “ICU”).
The data is electronic information recorded in the owner IC card 100, and is owner information such as medical information such as an electronic medical record in a medical field.
The control unit 402 performs control so that necessary processing is performed according to an access request from the owner terminal 102 and input data from the input unit 401.

The storage unit 403 is a storage area, and stores authentication data for performing identification and authentication and the above-described owner information.
The identification and authentication unit 404 has a function for identifying and authenticating the owner of the owner IC card 100, and uses authentication information input from the input unit 401 and authentication data stored in the storage unit 403. Identification and authentication are performed, and the result is output to the output unit 408. In the present embodiment, the authentication method is described as a password authentication method. However, the present invention is not limited to this authentication method, and other methods such as a fingerprint authentication method and an iris authentication method may be used. Further, the authentication method provided by the identification / authentication unit 404 is not limited to one, and it may not be recognized that the identification / authentication is successful unless a plurality of authentication methods are successful.

Furthermore, the identification and authentication unit 404 changes the identification and authentication method depending on the determination result of the emergency state determination unit 405. The identification / authentication method to be changed is the authentication method switched by the authentication method switching unit 407 (emergency authentication method). If it is not determined to be in an emergency state, authentication can be performed only by the normal authentication method.
The emergency state determination unit 405 determines whether or not it is an emergency state. Here, the emergency state will be described. An emergency state is a state in which use by a normal usage method is impossible, and includes, for example, a lifesaving emergency site in the medical field.

In the present embodiment, the emergency state is described as a lifesaving emergency site. In the lifesaving emergency site, the owner of the owner IC card 100 is a patient, and the user of the user IC card 101 is a doctor or an emergency worker. Further, the owner IC card 100 stores medical information such as an electronic medical record that is usually examined by a patient.
There may be cases where the patient is not conscious or the patient's biological information is missing at the critical care site. In such a case, it is conceivable that password authentication or biometric authentication cannot be performed. The emergency state determination unit 405 determines such an emergency state, that is, a lifesaving emergency state.

<Emergency judgment method>
Next, an emergency state determination method in the emergency state determination unit 405 will be described. Position information indicating a geographical position (hereinafter also referred to as “first position information”) and transmission source identification information for identifying the transmission source of the first position information are input to the input unit 401. The emergency state determination unit 405 uses the first position information and source identification information input to the input unit 401.
When the sender identification information includes predetermined information that is permitted to be used only by equipment, vehicles, or facilities corresponding to an emergency state (hereinafter also referred to as “emergency response equipment identification information”), the emergency state determination unit 405 The place indicated by the first position information is determined to be in an emergency state.
As described above, the first position information is position information used to determine that the emergency state is present. In the present embodiment, the first position information is described as position information of an emergency vehicle. The location information of the terminal that made the call may be used.
The emergency state determination unit 405 further uses the position information of the owner IC card 100 acquired by the position information acquisition unit 409.

The emergency state determination unit 405 is input to the input unit 401 and position information indicating the geographical position of the owner IC card 100 acquired by the position information acquisition unit 409 (hereinafter also referred to as “second position information”). The first position information is compared.
The emergency state determination unit 405 determines that the owner of the owner IC card 100 is in an emergency state when the first position information and the second position information match.
For example, when the first position information is latitude y1 and longitude x1, and the second position information is latitude y2 and longitude x2, | y1-y2 | is more than the first predetermined value for distance determination. Assume that | x1−x2 | is smaller than a second predetermined value for distance determination. In such a case, it is determined that the geographical positions indicated by the two pieces of position information match. The first predetermined value for distance determination and the second predetermined value for distance determination may be the same value or different values.
In the present embodiment, a position information acquisition unit 409 is provided in the owner IC card 100 to acquire position information, and the acquired position information is used as position information of the owner IC card 100.
However, the position information of the owner terminal 102 may be registered in advance in the HDD 306 of the owner terminal 102 and the position information may be used. For example, when the owner IC card 100 is connected to the owner terminal 102, the position information of the owner terminal 102 input from the connected owner terminal 102 to the input unit 401 of the owner IC card 100 is used as the owner. The position information of the IC card 100 may be used.

When the emergency state determination unit 405 determines that the state is an emergency state, the authentication method switching unit 407 is notified of the result and an authentication state flag indicating that the state is an emergency state is set. When the emergency state flag is in a standing state, it indicates that the state is an emergency state.
If the two pieces of positional information are compared but do not match, or the sender identification information does not include emergency response equipment identification information, the owner of the owner IC card 100 is determined not to be in an emergency state, and the identification authentication unit 404 performs identification and authentication by a normal authentication method.
The expiry date determination unit 406 determines the expiry date of the emergency state when the emergency state determination unit 405 determines that it is an emergency state. While it is within the validity period, identification authentication is performed by the authentication method switched by the authentication method switching unit 407.

  A method for determining an expiration date in the expiration date determination unit 406 will be described. The expiration date is a period (hereinafter, also referred to as “first effective period”) determined in advance from the time when the emergency state determination unit 405 determines that the emergency state has occurred. For example, when the validity period is set in advance as “1 day (24 hours)”, the first validity period is set 24 hours after the date and time determined to be in an emergency state. If no valid period is set, no valid period is set.

The authentication method switching unit 407 switches to an authentication method different from the existing authentication method when the emergency state determination unit 405 determines that the state is an emergency state. In the present embodiment, the authentication method is described as being switched to the one-time password method. However, any authentication method may be used as long as the method authenticates the owner. In addition, access may be made without authentication, or during normal times, access is not possible unless a plurality of authentication methods are successful, but access may be made only when one authentication method is successful only in an emergency.
The output unit 408 outputs the data requested to be accessed when the identification / authentication result of the identification / authentication unit 404 or the identification / authentication is successful.

<Functional configuration of user IC card 101>
A functional configuration of the user IC card 101 applied to the present embodiment will be described with reference to FIG. As shown in FIG. 2B, the user IC card 101 according to the present embodiment includes an input unit 501, a control unit 502, a storage unit 503, an identification / authentication unit 504, and an output unit 505. The user IC card 101 is used to identify the user of the user terminal 103, and since each component is the same as the component described with respect to the owner IC card described above, description thereof is omitted. .

<Functional configuration of owner terminal 102 and user terminal 103>
A functional configuration of the owner terminal 102 applied to the present embodiment will be described with reference to FIG. As shown in FIG. 3, the owner terminal 102 in this embodiment includes an input unit 601, a control unit 602, a display unit 603, and an output unit 604.
The input unit 601 receives authentication information for performing authentication of the owner IC card 100 connected to the owner terminal 102.

The control unit 602 performs control according to an authentication result, an access request, data output from the owner IC card 100 or the user terminal 103, and authentication information input from the input unit 601. The display unit 603 displays an operation instruction for performing identification and authentication, a message corresponding to the authentication result, and the like. The output unit 604 outputs authentication information to the owner IC card 100 or outputs data input from the owner IC card 100 or the user terminal 103.
Since the functional configuration of the user terminal 103 is the same as that of the owner terminal 102, the description thereof is omitted.

<Information writing flow to owner IC card 100>
An information writing flow to the owner IC card 100 will be described with reference to FIG. In this description, the owner will be described as a patient and the user as a doctor.
First, the doctor connects the user IC card 101 to the user terminal 103 and performs user identification and authentication (step S701).
The user IC card 101 outputs a user identification and authentication result to the user terminal 103.
If the user identification and authentication is successful, the doctor diagnoses the patient and creates an electronic medical record at the user terminal 103 (step S702).
If the user identification authentication fails, an authentication failure message is output to the user terminal 103 (step S703).

In the present embodiment, the created electronic medical record is used as plain text, but may be encrypted using an encryption key common to doctors. When a doctor common key is used, it is necessary to determine that the doctor is a doctor based on the identification and authentication described above, and to encrypt using a common key that can be used only by the doctor.
When the creation of the electronic medical record is completed, the doctor uses the user terminal 103 to request writing of the electronic medical record to the patient's IC card (step S704).
The write request (access request) of the user terminal 103 is received by the owner terminal 102, and the owner terminal 102 performs identification and authentication of the owner of the connected owner IC card 100 (step S705).
If the owner identification authentication is successful, the owner terminal 102 stores the electronic medical record received from the user terminal 103 in the owner IC card 100 (step S706), and ends the process.
If the owner identification authentication fails, an authentication failure message is output to one or both of the owner terminal 102 and the user terminal 103 (step S703), and the process ends.

<Flow of reading information from owner IC card 100>
An information read flow from the normal owner IC card 100 will be described with reference to FIG. Similar to the flow of writing to the owner IC card 100, in this description, the owner of the IC card will be described as a patient, and the user as a doctor.
First, the doctor connects the user IC card 101 to the user terminal 103 and performs user identification and authentication (step S801).
The user IC card 101 outputs the user authentication result to the user terminal 103.
When the user identification and authentication is successful, the doctor makes a request (access request) to read the electronic medical record from the user terminal 103 to the owner terminal 102 (step S802).

If the user identification authentication fails, an authentication failure message is output to the user terminal 103 (step S803).
The read request of the user terminal 103 is received by the owner terminal 102, and the owner terminal 102 performs identification and authentication of the owner of the connected owner IC card 100 (step S804).
If the owner identification authentication is successful, the owner terminal 102 reads the electronic medical record stored in the owner IC card 100 (step S805), outputs the electronic medical record to the user terminal 103, and ends the process. If the electronic medical record received by the user terminal 103 is encrypted, it is decrypted in the user terminal 103.
When the owner identification authentication fails, an authentication failure message is output to one or both of the owner terminal 102 and the user terminal 103 (step S803), and the process ends.

<Information reading flow from the owner IC card 100 in an emergency>
An information read flow from the owner IC card 100 in an emergency will be described with reference to FIG. Here, the owner of the IC card is described as a patient, and the user is described as a doctor.
The doctor connects the user IC card 101 to the user terminal 103, performs user identification and authentication, and then issues a read request to the owner terminal 102 via the user terminal 103 (step S901).
Since the identification and authentication method in the user terminal 103 has already been described, a description thereof will be omitted. The read request of the user terminal 103 is received by the owner terminal 102, and the owner terminal 102 checks whether it is in an emergency state in the connected owner IC card 100 (step S902).

In the owner IC card 100, an emergency state flag is set when the emergency state determination unit 405 described above determines an emergency state. That is, in step S902, it is checked whether or not the owner IC card 100 has already been determined to be in an emergency state. If the emergency state flag is set, that is, if it is determined that the state is an emergency state, the expiration date is checked (step S903).
The expiration date is the expiration date determined by the expiration date determination unit 406 described above. If it is determined that the expiration date is within the expiration date, it is already generated (step S907) and output (step S908). Is used for authentication (step S909).

If the expiration date has expired, the emergency state flag is returned to a state that is not an emergency state, and it is determined again whether or not it is an emergency state (step S904). If the emergency state flag is not set in step S902, that is, if it is determined that the emergency state is not set, it is determined whether or not the emergency state is set (step S904).
In emergency state determination, it is determined whether it is an emergency state by the method demonstrated in the emergency state determination part 405 mentioned above. If it is determined that the current state is an emergency state, an emergency state flag and an expiration date are set (step S905).
When it is determined that the state is not an emergency state, the owner is identified and authenticated by a conventional authentication method designated in advance (step S906).
When the emergency state flag is set, a one-time password is generated (step S907).

The one-time password is generated by the authentication method switched by the authentication method switching unit 407 described above. As described in the description of the authentication method switching unit 407, in this embodiment, an authentication method using a one-time password is used, but another authentication method may be used. When the one-time password is generated in step S907, the generated one-time password is output to the user terminal 103 via the owner terminal 102 (step S908).
The doctor performs authentication using the one-time password output to the user terminal 103 (step S909).
If the authentication is successful in step S910, the owner IC card 100 outputs the electronic medical record stored in the owner IC card 100 to the user terminal 103 via the owner terminal 102 (step S911).
If authentication fails in step S910, the electronic medical record stored in the owner IC card 100 is not output to the user terminal 103, and the process ends.

  In this way, the doctor can access the patient's electronic medical record even in an emergency where the patient cannot perform the authentication act. Further, by providing an effective period, it is possible to access only within a predetermined period after an emergency state, and even after a predetermined period, even a doctor cannot access the patient's electronic medical record.

(Second Embodiment)
A second embodiment of the present invention will be described. In the description of the present embodiment, portions different from those of the first embodiment will be mainly described, and the drawings and reference numerals will be used for the portions overlapping with those of the first embodiment.

In the first embodiment, the first validity period after the first validity period from the date and time determined to be in an emergency state is set as the first validity period of the emergency authentication method. However, the emergency state does not always continue from the date and time when the emergency state is determined until the first expiration date. If the emergency state does not continue, it is preferable that the emergency authentication method cannot be used from the viewpoint of security enhancement.
Therefore, in the present embodiment, the emergency state is canceled when there is no access request for a certain period of time after the emergency state is determined.

The expiration date determination in this embodiment will be described with reference to FIG.
In step S1001, it is determined whether the first expiration date has expired. The determination as to whether or not the first expiration date has expired is executed based on the date and time determined to be an emergency and the first validity period stored in advance. “Prestored” means stored before the expiration date is determined.

The method for determining whether or not the first expiration date has expired is not particularly limited.
For example, “first expiration date” obtained by adding “first validity period stored in advance” to “date and time determined to be in an emergency state” and “date and time for executing the determination” It is possible to determine whether or not the first expiration date has expired.
In addition, by comparing a period obtained by subtracting “date and time determined to be in an emergency state” from “date and time when the determination is performed” and “first valid period stored in advance” It may be determined whether or not the first expiration date has expired.

In step S1002, it is determined whether the second expiration date has expired. The second effective period is shorter than the first effective period. For example, the second effective period is 1 hour, and the first effective period is 24 hours.
The determination as to whether the second validity period has expired is executed based on the date and time when authentication by the emergency authentication method was requested last time and the second validity period stored in advance.
The method for determining whether or not the second expiration date has expired is not particularly limited as is the case with the method for determining whether or not the first expiration date has expired.

If both the first expiration date and the second expiration date have not expired, that is, if it is determined NO in both step S1001 and step S1002, the emergency authentication method has not expired. Determination is made (step S1003).
On the other hand, if either the first expiration date or the second expiration date has expired, that is, if it is determined YES in either step S1001 or step S1002, the expiration date of the emergency authentication method is It determines with having cut | disconnected (step S1004).

According to the present embodiment, even if the first expiration date has not expired, if the second expiration date has expired, it is determined that the emergency authentication method has expired. The
That is, even before the first valid period (for example, 24 hours) has elapsed from the date and time determined to be in the emergency state, the second valid period (from the date and time when authentication by the emergency authentication method was requested last time ( For example, when one hour) elapses, it is determined that the authentication method has expired.

  In this embodiment, when the authentication by the emergency authentication method is not requested for a predetermined period, it is determined that the emergency authentication method has expired. However, the emergency state determination unit 405 periodically checks the emergency state. The expiration date may be automatically updated according to the determination result.

  As shown in the first embodiment and the second embodiment, the doctor can access the electronic medical record of the patient even in an emergency where the patient cannot perform the authentication action. In addition, by providing an expiration date, it is possible to allow access only in an emergency, and it is possible to prevent unauthorized access to the owner IC card 100 except in an emergency.

100 owner IC card 401 input unit 402 control unit 403 storage unit 404 identification and authentication unit 405 emergency state determination unit 406 expiration date determination unit 407 authentication method switching unit 408 output unit 409 position information acquisition unit

Claims (5)

Storage means for storing medical information;
An emergency state determination unit that determines whether or not an emergency state is present based on position information indicating a geographical position, and sets an emergency state flag to a state indicating an emergency state when the emergency state is determined. When,
When the emergency state flag indicates an emergency state, it is determined based on the date and time when the emergency state determination unit determines that the emergency state is in an emergency state, and a first valid period stored in advance. Expiration date determining means for determining whether the first expiration date has expired;
When the expiration date determining means determines that the expiration date has not expired, or when the expiration date determination means determines that the expiration date has expired, the emergency state determination means executed thereafter If the result of the determination indicates an emergency condition,
An authentication method switching unit that switches the authentication method of the authentication unit to the emergency authentication method when authentication by the emergency authentication method is requested;
Authentication means for authenticating by the emergency authentication method or the normal authentication method;
Output means for outputting the medical information when authentication by the authentication means is successful;
A portable information storage device comprising: An input unit for inputting first location information indicating a geographical location and source identification information for identifying a source of the first location information;
Position information acquisition means for acquiring second position information indicating a geographical position of the portable information storage device;
Further comprising
The emergency state determination means includes
When the emergency status flag does not indicate an emergency status, or when the emergency status flag indicates an emergency status, but the expiration date determining means determines that the expiration date has expired And when it is determined that the source is one of equipment, vehicle or facility corresponding to an emergency state based on the source identification information,
The first position information and the second position information are compared, and an emergency state is determined when the distance between the geographical positions indicated by the two position information is equal to or less than a predetermined value. Portable information storage device. The expiration date determining means includes
Further storing a second validity period shorter than the first validity period;
When authentication by the emergency authentication method is requested,
A second validity period determined based on whether or not the first validity period has expired, and the date and time when authentication by the emergency authentication method was last requested, and the second validity period, Determine whether it is out
3. The portable information according to claim 1, wherein when both the first validity period and the second validity period have not expired, it is determined that the validity period of the emergency authentication method has not expired. Storage device. A storage step in which the storage means stores medical information;
The emergency state determination means determines whether or not the emergency state is based on the position information indicating the geographical position, and determines that the emergency state flag indicates the emergency state when the emergency state determination unit determines that the state is an emergency state. Emergency state determination step to be set;
When the expiration date determining means indicates that the emergency state flag indicates an emergency state, the date and time when the emergency state determination means determines that the emergency state is in an emergency state, and a first effective period stored in advance, An expiration date determination step for determining whether or not the first expiration date determined based on
Authentication method switching means
When the expiration date determining means determines that the expiration date has not expired, or when the expiration date determination means determines that the expiration date has expired, the emergency state determination means executed thereafter If the result of the determination indicates an emergency condition,
When authentication by the emergency authentication method is requested, a switching step of switching the authentication unit authentication method to the emergency authentication method;
An authentication step for authenticating by the authentication method for emergency or the authentication method for normal time;
An output unit that outputs the medical information when authentication in the authentication step is successful; and
A method for controlling a portable information storage device comprising: The program for making a computer perform the control method of the portable information storage device of Claim 4.

Images