EP1685472A1

EP1685472A1 - Method for accessing a data processing system

Info

Publication number: EP1685472A1
Application number: EP04818823A
Authority: EP
Inventors: Carlos Henrique Arglebe Gilek; Gerd Schmidt
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 2003-11-19
Filing date: 2004-11-09
Publication date: 2006-08-02
Also published as: WO2005050418A1; US7624430B2; CN1882898A; DE10353966A1; US20070150940A1

Abstract

The invention relates to a method for accessing a data processing system (D1) formed from data processing units (1, 2, 3) that are networked for data exchange. The aim of the invention is to enable a system technician (8) to access protected data exclusively according to the four-eye principle. To this end, an authentication element is respectively allocated to a system administrator (4) and the system technician (8).

Description

description

Method for accessing a data processing system

The invention relates to a method for accessing a data processing system.

According to the prior art, data processing systems are widely known which consist of a plurality networked with one another for data exchange

Data processing units, e.g. B. personal computers, computer-controlled devices, servers and the like. , consist. A limited number of users is assigned to each data processing unit. Everyone has the right to prevent unauthorized use of a data processing unit

User with a personal password. Entering the password authenticates the user and gives them access to the data processing system.

In hospitals in particular, data processing systems are complex today. Diagnostic and analysis devices are part of such data processing systems. Such devices must always be kept in perfect working order. In particular, maintenance and repair of such devices generally require system technician access to the data processing system. A still unsolved problem with this is that the system technician u. U. can get access to personal patient data ^' . For data protection reasons, such a data processing system may only be accessed according to the dual control principle, ie only at the same time by two authorized persons. In practice, however, this can hardly be realized, because in the event of a malfunction of a data processing system, an immediate remedy is usually required and sometimes two authorized and corrective measures due to the malfunction, sufficiently qualified system technicians are not always available at the same time.

A method is known from DE 101 21 819 A1 in which a doctor only has access to patient-specific data if the doctor has a first chip card assigned to him and the patient present at the same time has a second chip card belonging to him to a doctor's Read in the existing data processing device for authentication.

It is an object of the invention to provide a method which enables access to a data processing system which ensures data sovereignty of a system administrator only according to the principle of the four-eyes principle.

This object is solved by the features of claim 1. Appropriate embodiments of the method result from the features of claims 2 to 13.

According to the invention, a method for accessing a data processing system is provided which is formed from data processing units networked with one another for data exchange, with the following steps:

Providing a first authentication means for authenticating a system administrator,

Authentication of the system administrator on a first data processing unit by transferring the first

Authentication means to an authentication program,

Providing a second authentication means for authenticating a system technician,

Authentication of the system technician at a second data processing unit by handing over the second Authentication means to the authentication program, and thereby automatically generating identification information identifying the carrier of the second authentication means,

Display of the identification information on the first data processing unit (1) of the system administrator and

Activation of an access authorization for the system technician and conditional automatic triggering of a function for generating and storing a log file logging the activity of the system technician on the data processing system.

According to the method of the invention

System technicians only have access to the data processing system after handing over a second authentication means assigned to them. The activation of such an access is documented by generating identification information and displayed on the first data processing unit of the system administrator. A log file which records the activity of the system technician is also generated, by means of which the intervention of the system technician, for example for the system administrator, can be traced. This ensures that data sovereignty is always held by the system administrator. On the basis of the generated log files, he can check whether a system technician has accessed data without authorization. In this case, the system administrator can immediately block any further access to the data processing system for the system technician concerned. The proposed method enables access to a data processing system based on the principle of the four-eyes principle. It is particularly advantageous that such access can also take place when the system administrator is aware of it only a system technician works on a data processing unit.

In the context of the present invention, the term “access” is understood to mean any activity in which the database of a data processing system is viewed, changed or copied in whole or in part. A "data processing unit" in the sense of the present invention is a device which, with other devices suitable for data exchange, for

Data exchange is connected. Such devices usually have a bidirectional interface for data exchange. It can be a personal computer, computer-controlled systems or devices and the like. act.

The term "system administrator" is understood to mean a person who has special rights with regard to the care and maintenance of the data processing system. In contrast to a system technician, the system administrator within the meaning of the present invention has the option of allowing or blocking access to the data processing system. This possibility is assigned to the system administrator in particular by the first authentication means.

To authenticate the system technician, the second authentication means can be compared by means of the authentication program by accessing a file containing verified second authentication means and, if one of the verified second authentication means matches, corresponding information can be transmitted to the system administrator. A "verified second authentication means" is understood to mean a copy of the second authentication means transferred to the system technician, which is from the System administrator is managed in a file that is only accessible to him. To access the data processing system, the system administrator transfers a special second authentication means to each system technician. To facilitate the verification of the authenticity of the second

Authentication means are stored together in the file. If the authentication program determines that there is an access request based on a second authentication means that is identical to a verified second authentication means, the system administrator is informed of this by means of suitable information. Each of the verified second authentication means contained in the file is advantageously associated with specific identification information. It can be, for example, the name and, if applicable, the affiliation of the system technician to a specific organization. If the second authentication means matches one of the verified second authentication means stored in the file, the system administrator can also be shown the name and organization of the system technician.

In a particularly simple case, the first and / or second authentication means is an authentication code that can be transferred to the authentication program, preferably by means of a keyboard provided on a data processing unit. To increase security, it is useful that the authentication code in a mobile, with the data processing system for

Data transmission connectable storage unit is stored. The storage unit can be an authentication card provided with a data carrier. The authentication card can have a storage means, in particular for storing the log file and / or information enabling access to the log file. The information can, for example, be one Act "Link", which can be used to find and open the log file.

To increase security, the access authorization can be activated by the system administrator by manually triggering a function provided for this purpose in the authentication program and only accessible to the system administrator. This ensures that access is only possible with the active consent of the system administrator. However, it can also be the case that the system technician is automatically granted access after an automatic check of the second authentication means. In this case too, in particular a log file is automatically created according to the invention. This enables access to data processing systems, especially in hospitals, which must be kept continuously operational.

According to a further embodiment it is provided that the connection between the first and the second

Data processing unit is manufactured over the Internet or an intranet. This enables the system technician to access a remotely provided second data processing unit. It is therefore possible for someone who is optimally qualified for the respective problem

System technicians can access the data processing system at any time, regardless of where they are. This enables malfunctions to be eliminated quickly and effectively. At the same time, the authenticity of the accessing system technician is ensured and his activity is logged. In this case, too, the system technician's access is based on the principle of the four-eyes principle. By means of the data processing system, in particular data are processed which are only available to a single person with special authorization or, in the absence of special authorization, only to persons with simple authorization may be made accessible according to the 4-eyes principle. The special authorization is expediently verified by transferring a third authentication means assigned to the person to the data processing system. The individual with special authorization can, for example, be a doctor. The data can be sensitive personal data, in particular patient data.

An exemplary embodiment of the invention is explained in more detail below with reference to the drawing. Show it:

1 shows the method on the basis of a schematic overview and

Fig. 2 shows the essential components of an authentication program.

Fig. 1 shows schematically a first data processing unit 1, for. B. a personal computer. The first

Data processing unit 1 is part of a first networked data processing system D1, which as further data processing units z. B. comprises computer-controlled devices 2 or other personal computers 3. The first data processing unit 1 is assigned to a system administrator 4, who has data sovereignty over the first data processing system D1. The system administrator 4 is particularly authorized to assign roles and rights to 5 users of the first data processing system D1 by means of a first program. Such roles and rights only allow the respective user access to the data necessary for his work area. The users can access such data at any time, ie even if the system administrator 4 is not logged into the first data processing system D1. The first data processing system D1 is connected to a second data processing system D2 of a service organization via a data line 7 secured by a firewall 6. The connection can be established, for example, via the Internet or an intranet. The second data processing system D2 comprises a second data processing unit 7, e.g. B. a personal computer, which is assigned to a system technician 8.

The system administrator 4 has a first memory card 9 for his authentication, on which a first authentication code is stored. The first authentication code can be provided for reading out by means of a suitable reading device of the first data processing system D1. The system technician 8 has a second memory card 10 for his authentication, on which a second authentication code is stored. The second authentication code can be read out by means of a suitable reading device and made accessible to the first data processing system D1. The reading unit for reading out the second memory card 10 does not necessarily have to be part of the first data processing system D1. It can also be part of the second data processing system D2. In this case, the authenticity of the second authentication code can be verified by means of a second one in the second

Data processing system D2 provided program 11 are checked before trying to access the first data processing system D1.

The function of the device is as follows:

First, an IT manager 12 responsible for the first data processing system D1 and a service organization or the system technician 8 conclude a service contract. After the conclusion of such a service contract, the system technician receives 8 from the IT manager 12 a second memory card 10 on which the second authentication code is stored.

In the event of a first maintenance / repair case, the system administrator 4 requests a call or email

Service from the service technician 8. This can be a service that can be carried out by the second data processing unit 7. In this case, the service technician 8 transfers the second memory card 10 to one at the second

Data processing unit 7 provided reader. As a result, the second authentication code authenticating the service technician 8 is transmitted to the second program 11 within the second data processing system D2. The second authentication code is checked. If the second program 11 recognizes the second authentication code as authentic, a connection to the first data processing system D1 is established via the data line 7. The desired access is checked by means of the first program 5. For this purpose, it is first checked whether the first memory card 9 in a reader, for. B. in the first data processing unit 1 is inserted. If this is not the case, access by the system technician 8 is not made possible. If access to the first authentication code stored on the first memory card 9 is possible for the authentication of the system administrator 4, the second authentication code is compared with a plurality of second authentication codes stored in a file. If the second authentication code is recognized as not authentic, access for the system technician 8 is not made possible. If the second authentication code is recognized as authentic, a protocol function is triggered. At the same time, the system technician 8 has access to the first

Data processing system Dl. As long as the service technician 8 accesses the first data processing system Dl all changes, additions and the like to the database of the first data processing system Dl are logged. As soon as the system technician 8 has completed his work and logged out, the log file is closed.

In addition to the log of all changes, additions and the like to the database of the first data processing system D1, the log file advantageously also contains the following information:

- Name of the system technician, name of the service organization,

- login / logout time,

- Type of access, possibly identification of the data processing unit used for access.

In the case of a second maintenance / repair, the system administrator uses the telephone call or e-mail to request a service from the service technician 8, which is to be carried out on site. It can be z. B. an exchange of a module with an X-ray computer tomograph in a hospital. In this case, the service technician 8 logs on to a suitable one

Data processing unit of the first data processing system D1 using the second memory card 10. In this case, too, access is only possible if the system administrator 4 is logged on to the first data processing system D1 using the first memory card 9.

According to a further advantageous function, the system administrator 4 can carry out the activity of the

Interrupt system technician 8 by giving access to the first data processing system D1 by interrupting the Access to the first authentication code is interrupted. That can e.g. B. done by the system administrator 4 taking the first memory card 9 out of the reader in question. In contrast to conventional methods, the system administrator 4 always retains data sovereignty according to the method according to the invention. In addition, the automatic logging function makes it possible to understand all the activities of the system technician 8. In the event of misuse, further access by the system administrator 8 to the first data processing system D1 can easily be blocked. All that needs to be done is to remove or change the relevant second authentication code stored in the file.

With the proposed method, the system technician 8 can only access the database of the first data processing system D1 according to the dual control principle, ie. H. Such access is always under the control of the system administrator 4. In this respect, unauthorized access by the system technician 8 to personal data in need of protection, e.g. B. patient data are prevented.

Fig. 2 shows schematically the essential components of the first program 5. With Uli is a first

User interface for access from the first data processing system DI and with UI2 a second user interface for access e.g. B. on the data line 7.

An access module 13 enables or blocks access for a system technician 8 to the first one

Data processing system Dl. The access module 13 manages and compares in particular authentication codes.

The first program can advantageously have 5 further modules, which in particular maintenance and / or Facilitate repair work on the first data processing system Dl. So z. B. a localization module 14 can be provided, with which it can be determined on which data processing unit a qualified system technician 8 is currently working and possibly can be called up.

The logging module 15 logs the activity of the system technician 8. The logging module 15 in particular creates log files and stores them at a predetermined location.

An anonymization module 16 is used in particular to anonymize sensitive personal data. So z. B. patient names can be replaced by codes to a system technician 8 according to the

Data protection regulations make an insight into personal data impossible.

Auxiliary modules 17, 18 provide a description of the functions of the first program 5 that are necessary for the system administrator 4 and the system technician 8. A modality module 19 enables data exchange, e.g. B. with computer-controlled devices, such as X-ray computer tomographs, etc. In a similar manner, an IT system module 20 enables data exchange with databases, etc.

An operating system module 21 creates the necessary conditions for a correct integration of the first program 5 into the operating system used in each case.

Claims

claim

1. A method for accessing a data processing system (DI) which is formed from data processing units (1, 2, 3) networked with one another for data exchange, with the following steps:

Providing a first authentication means (9) for authenticating a system administrator (4),

Authentication of the system administrator (4) on a first data processing unit (1) by transferring the first authentication means (9) to an authentication program (5),

Providing a second authentication means (10) for authenticating a system technician (8),

Authentication of the system technician (8) on a second data processing unit (7) by transferring the second authentication means (10) to the authentication program (5) and thereby automatically generating identification information identifying the carrier of the second authentication means (10),

Display of the identification information on the first data processing unit (1) of the system administrator (4) and

Activation of an access authorization for the system technician (8) and automatic triggering of a function for generating and storing a log file logging the activity of the system technician (8) on the data processing system (DI).

2. The method according to claim 1, wherein the second authentication means (10) is compared by means of the authentication program (5) by accessing a file containing verified second authentication means (10) and, in accordance with one of the verified second authentication means (10), provides corresponding information the system administrator (4) is transmitted.

3. The method according to claim 2, wherein each verified second authentication means (10) contained in the file is assigned specific identification information therefor.

4. The method of claim 3, wherein the

Identification information includes the name and possibly the affiliation of the system technician (8) to a specific organization.

5. Method for accessing a data processing system (DI), which is formed from data processing units (1, 2, 3) networked with one another for data exchange, with the following steps:

the first (9) and / or the second

Authentication means (10) is an authentication code which can be transferred to the authentication program (5), preferably by means of a keyboard provided on a data processing unit (1, 7),

6. The method according to claim 5, wherein the authentication code is stored in a mobile storage unit that can be connected to the data processing system (D1, D2) for data transmission.

7. Procedure according to. Claim 6, wherein the storage unit is an authentication card (9, 10) provided with a data carrier.

8th . Method according to Claim 7, the authentication card (9, 10) having a storage means, in particular for storing the log file and / or information enabling access to the log file.

9. A method for accessing a data processing system (DI) which is formed from data processing units (1, 2, 3) networked with one another for data exchange, with the following steps:

Display of identification information on the first

Data processing unit (1) of the system administrator (4) and

Activation of an access authorization for the system technician (8) and automatic triggering of a function for generating and storing a log file logging the activity of the system technician (8) on the data processing system (DI),

wherein the activation of an access authorization by the system administrator (4) by manually triggering one provided in the authentication program (5) and only function accessible to the system administrator (8).

10. The method according to any one of the preceding claims, wherein data are processed by means of the data processing system (DI)

of a single person only with special authorization

or

if the special authorization is not available, only persons with a simple authorization according to the 4-eyes principle

may be made accessible.

11. The method according to claim 10, wherein the special authorization is verified by transferring a third authentication means assigned to the person to the data processing system (DI).

12. The method according to claim 10, wherein the data are sensitive personal data, in particular patient data.

13. The method according to claim 1, wherein the connection between the first (1) and the second data processing unit (7) is established via the Internet or an intranet.