JP2003023439A - Intra-hospital overall network system and patient terminal management device, method for managing patient terminal, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an intra-hospital comprehensive network system, that allows an inpatient to use the Internet through an existing channel of a hospital to the Internet, and can isolate information of an intra-hospital job network from inpatient terminals. SOLUTION: This invention provides the intra-hospital comprehensive network system 1 that enable the intra-hospital job network and a patient terminal 42 to access a public communication channel network 6 through the same channel 9 as used by the both. A firewall 10 is installed between the intra-hospital job network and the public communication channel network 6, and the intra- hospital job network and a filtering bridge 45 are connected in parallel with the firewall 10. The filtering bridge 45 sets an IP address to each patient terminal 42 and permits passing of data, whose combination of a destination IP address and a sender IP address, is equal to a combination of the set IP address and an IP address at the outside of the firewall.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a hospital integrated network system, a patient terminal management device, a patient terminal management method and a program, and in particular, a hospital staff can use a business system and a communication network in the hospital. The present invention relates to a hospital integrated network system capable of connecting inpatients and the like to a communication network, a patient terminal management device, a patient terminal management method and program.

[0002]

2. Description of the Related Art In recent years, IT is also being used in hospitals. Electronic medical record database, medical office database,
Create a database of medical information generated in hospitals, such as a drug inventory management database and inspection information management database, build a hospital computer network such as a LAN in the hospital, and use terminal computers installed in each department and specific department. 2. Description of the Related Art Information systems such as an electronic medical record system and a medical office system that can input and view medical information have been generally used. Usually, an intranet is laid for the use of staff including doctors, and from the terminal computer in the hospital business computer network,
Lines are laid so that the Internet can be used.

On the other hand, a patient who is admitted to a hospital can obtain information on the outside of the hospital by watching a coin-operated television set in the patient's room, or by having a conversation with a visitor. There are ways to exchange letters with friends.

[0004]

However, for a patient admitted to a hospital, the means for acquiring information from the outside world is limited to information from the TV or conversation with visitors, and information from the general public is acquired. There was a problem that it was difficult to do. It is possible to lay a separate Internet line in the hospital for inpatients, but it is costly to lay the line, and a great deal of labor is required to manage and maintain the line. There was a problem.

[0005] In addition, the line for the Internet of the hospital is
There are times when it is not used, and it is possible to use this line for connecting inpatients to the Internet. However, since the hospital's Internet line is usually connected to the intranet, if the inpatient has some knowledge of the network, there is a possibility that the terminal computer for the Internet can access the in-hospital computer network. However, there is a problem that it is difficult to ensure the security of the in-hospital business computer network including personal information.

The present invention has been made in view of the above problems, and an object of the present invention is to enable an inpatient to use the Internet by using a line to the existing Internet of a hospital and to use it in a hospital. An object of the present invention is to provide an in-hospital integrated network system, a patient terminal management device, a patient terminal management method, and a program capable of isolating information on a business computer network from the terminal computer side of an inpatient. Still another object of the present invention is to provide an in-hospital integrated network system, a patient terminal management device, a patient terminal management method and a program capable of securing a regular revenue source of a hospital while effectively utilizing the hospital line. Especially.

[0007]

According to the first aspect of the present invention, the above-mentioned problem is achieved by connecting a hospital communication computer network to a public communication network and connecting a patient terminal computer to the public communication network. A hospital integrated network system for connecting and using the same line, which is installed between a hospital communication computer network connected to a public communication network and the public communication network and the hospital computer network. A firewall server computer and at least one filtering bridge connected to the firewall server computer in parallel with the hospital business computer network, the filtering bridge being a terminal connection for connecting a terminal computer in a hospital room. Means and the connecting means I to the terminal computer to be continued
An address registration unit that sets a P address and stores the set IP address, and a passage permission unit that permits data to pass through the filtering bridge in a predetermined case are provided. Permitting passage of the data when the combination of the destination IP address and the source IP address of the above is the combination of the IP address set by the address registration means and the IP address of the computer outside the firewall. Will be solved by.

According to the fourth aspect of the present invention, the connection from the terminal computer for the patient to the public communication network using the line connecting from the in-hospital computer network to the public communication network is managed. A patient terminal management device, a storage device for storing a program that defines the operation of the management device, a server for creating information,
An input device that receives information from the outside, an output device that sends information to the outside, an operation using the information received from the storage device or / and the input device, and the operation result is stored in the storage device or / and the output device. To connect a terminal computer in a hospital room, which is connected in parallel with the in-hospital business computer network to a firewall server computer provided with a central processing unit for delivering, and installed between the public communication line network and the in-hospital business computer network. Terminal connecting means, an address registering means for setting an IP address in the terminal computer connected to the connecting means, and storing the set IP address, and a passage permission permitting data to pass in a predetermined case. Means, wherein the passage permission means is a data transmission destination IP
If the combination of the address and the source IP address is the combination of the IP address set by the address registration means and the IP address of the computer outside the firewall, the data passage is permitted to solve the problem.

According to the invention of claim 7, the above-mentioned object manages the connection from the terminal computer for the patient to the public communication line network using the line connecting from the in-hospital business computer network to the public communication line network. A terminal management method for a patient, wherein a firewall server computer installed between a public communication line network and the in-hospital business computer network has a procedure of installing at least one filtering bridge in parallel with the in-hospital business computer network, A procedure for connecting a terminal computer in a hospital room to the terminal connecting means of the filtering bridge; an address registration procedure in which the filtering bridge sets an IP address in the terminal computer and stores the set IP address; Destination IP address and transmission When the combination with the IP address is the combination of the IP address set in the address registration procedure and the IP address of the computer outside the firewall, the passage permission procedure for permitting the data to pass through the filtering bridge. And, it is solved by doing.

According to the invention as set forth in claim 10, the above-mentioned object manages the connection from the terminal computer for the patient to the public communication line network using the line connecting from the in-hospital business computer network to the public communication line network. In the patient terminal management device, an IP address is set in a terminal computer connected to the terminal connection means of the patient terminal management device, an address registration procedure for storing the set IP address, and a destination IP address of data When the combination with the source IP address is the combination of the IP address set in the address registration procedure and the IP address of the computer outside the firewall, data is allowed to pass through the patient terminal management device. It is solved by a passage permission procedure and a program for executing the procedure.

As described above, the passage permitting means determines that the combination of the data transmission destination IP address and the data transmission source IP address is
When the combination of the IP address set by the address registration means and the IP address of the computer outside the firewall is configured to permit the passage of data, the hospital installed inside the firewall It is possible to prohibit access to information on the business computer network from the patient's terminal computer. In addition, when the patient sets the IP address on the terminal computer by himself / herself, it becomes impossible to send / receive data, so that it is possible to prevent the patient from setting the IP address on the terminal computer by himself / herself, and the IP address is duplicated. Can be prevented.

Further, since the filtering bridge is provided with the address registration means for setting the IP address in the terminal computer and storing the set IP address, it is possible to prevent the patient from setting the IP address in the terminal computer by himself / herself. Therefore, it is possible to prevent duplicate IP addresses. Further, since the filtering bridge is provided with the terminal connecting means for connecting the terminal computer in the patient room, the patient can bring his or her computer, which is accustomed to the operation, to the patient room and continue to use it. .

At this time, it is preferable that the filtering bridge is configured to directly transmit the data to the firewall when the source IP address of the data is the IP address set by the address registration means. .

With this configuration, all the data transmitted from the terminal computer in the hospital room is directly transmitted to the firewall and is not transmitted to other computers inside the firewall, and is installed inside the firewall. It is possible to prohibit access to the information of the existing hospital computer network from the terminal computer of the patient.

At this time, a system management server computer in which a program for operating the filtering bridge is stored is connected to the firewall via a public communication line network, and the firewall and the filtering bridge are connected to each other. Has
A router is connected, the filtering bridge includes a setup request unit that sends a setup request to the router, and the router receives the setup request received from the filtering bridge and issues a setup command to the system management server computer. It is preferable that the system management server computer is provided with a transfer unit for transmitting the program to the filtering bridge according to the setup command.

In this way, the filtering bridge is
The system management server computer includes a setup request unit that transmits a setup request to the router, and the system management server computer is configured to include a program transmission unit that transmits the program to the filtering bridge in response to the setup request. In the activated state, the filtering bridge does not need to store a program for operating the filtering bridge, which facilitates management of the program. Further, even when the version of the program is upgraded, it can be directly transmitted from the system management server computer, so that it is easy to deal with the version upgrade. Further, since the router is connected between the firewall and the filtering bridge, it is possible to send the program to the filtering bridge from the system management server computer connected via the public communication network.

[0017]

BEST MODE FOR CARRYING OUT THE INVENTION An embodiment of the present invention will be described below with reference to the drawings. The configurations and the like described below do not limit the present invention and can be variously modified within the scope of the gist of the present invention. In the present specification, the term "computer" is meant to include all information terminals equipped with a computing device. For example, a supercomputer, a general-purpose computer, an office computer, a control computer, a workstation, a personal computer, a personal digital assistant, a mobile phone equipped with an arithmetic unit, and the like are included.

The "program" in this specification can be downloaded and uploaded using a communication network, and can be distributed by being recorded in a storage medium. The storage medium refers to a computer-readable storage medium such as a flexible disk, a magneto-optical disk, a CD or a DVD for installation, execution, distribution, etc., and stores the program according to the present invention. The Internet 6 corresponds to the public communication line network in the claims.

The in-hospital integrated network system 1 of the present embodiment is a comprehensive network system for hospitals constructed between the hospital H and the system management organization 5, and includes the in-hospital work network and patient in the staff area 2. This is a system that enables the use of the Internet 6 from the terminal computer 42 of the patient in the sickroom 4 through the line 9 for the Internet 6 of the hospital work network while isolating the information from the terminal computer 42.

The configuration of the hospital integrated network system 1 of this embodiment will be described with reference to FIGS. 1 and 2. Figure 1
Represents the main configuration of the hospital integrated network system 1 according to the present embodiment. The in-hospital integrated network system 1 of this embodiment is constructed between a hospital H and a system management organization 5 that integrally manages the in-hospital integrated network system 1. First, the configuration of the hospital H will be described. In the hospital H, the staff area 2 in which the hospital staff 20 operates and the Internet terminal user 30
Internet room 3 where Internet is available
And a hospital room 4 in which the inpatient 40 stays.

In the hospital staff area 2, an examination room of the hospital H, an examination room, a waiting room for doctors and technicians, a nurse center,
The medical site area such as the conference room, the office of Hospital H, the pharmacy,
Administrative areas such as accounting centers are included.

In the medical field area, medical staff is working. The medical staff refers to the medical staff such as doctors, nurses, nurses, and laboratory technicians among the hospital staff 20.

In the office area, the office staff works. The clerical staff refers to those who perform various clerical work at the hospital H, including those who perform medical clerical work among the hospital staff 20, staffs of pharmacies including pharmacists, staff of the general affairs section, and the like.

In the staff area 2, an in-hospital server computer 21 and a plurality of staff terminal computers 22 are installed. The staff terminal computer 22 is
It is configured to be usable by medical staff and clerical staff.

The in-hospital server computer 21 is a server computer that controls the in-hospital business system. Specifically, an electronic medical record database server that registers an electronic medical record for each patient, a medical knowledge database server that registers the latest medical technology and know-how of hospital H, medical expenses related to medical procedures, insurance costs, patient costs Information such as expenses, medical fee database of medical fee database in which medical fee statement (receipt) is registered, accounting system in hospital H, personnel / labor management system, drug inventory management, record of delivery of various materials, financial management, etc. Includes a database server that stores other medical service information. Hospital staff 20
Those who are permitted to access each server among the staff terminal computers 22 from the staff terminal computer 22
1 can be accessed to browse and enter each server. The staff terminal computer 22 can be connected to the external Internet 6 through the line 9.

An inpatient 40 is staying in the hospital room 4. The hospital room 4 is provided with a port 45a as a terminal connecting means capable of connecting the terminal computer 42 brought in by the inpatient 40 itself. The inpatient 40 connects to the external Internet 6 through the line 9 by connecting the terminal computer 42 to this port 45a,
E-mail and Internet 6 are set to be available.

The inpatient 40 uses the terminal computer 4
In step 2, it is possible to contact an acquaintance or family outside the hospital H by e-mail. In addition, various kinds of information collection, goods purchase, securities trading, and transactions can be performed using the Internet 6. Further, the inpatient 40 can use the terminal computer 42 to connect to the shop server computer 71 of the shop 7 via the Internet 6 and purchase the goods using the product ordering system provided by the shop 7. .

The Internet room 3 in the hospital H can be used by an unspecified number of terminal users 30 including inpatients 40, outpatients, visitors, and hospital staff 20. In the internet room 3, a prepaid card type web computer 32 that can be connected to the internet 6 is installed. The terminal user 30 uses the Web computer 32 to connect to the external Internet 6 through the line 9.
It is set up to connect to, and to be able to use e-mail and the Internet 6.

The hospital management side 8 is the management side of the hospital H in which the in-hospital integrated network system 1 is constructed. The hospital management side 8 requests the system management organization 5 to construct and manage the in-hospital integrated network system 1. The system management organization 5 receives the construction service and management service of the hospital internal network system 1, and pays for these services.

The system management organization 5 is a separate organization from the hospital H, and upon receiving a request from the hospital management side 8, provides the hospital H with the construction service and management service of the in-hospital integrated network system 1. The system management organization 5 receives payment from the hospital management side 8 for the construction / management cost of the hospital integrated network system 1.

In the system management organization 5, an SMS (systems management server) server computer 54 is installed. The system management organization 5 manages and operates the filtering bridge 45 installed in the hospital H by the SMS server computer 54, and thereby the hospital H
The hospital integrated network system 1 of this embodiment from the outside
Run. That is, the SMS server computer 54
Performs monitoring and management of the filtering bridge 45 that performs IP address assignment of the terminal computer 42, setting of connectable range, charge management, and band limitation management.

When the terminal computer 42 first connects to the Internet 6 in the hospital room 4, the SMS server computer 54 sends a set of firmware including a program for operating the filtering bridge 45. Further, a fault monitoring packet is periodically transmitted to each filtering bridge 45 to perform fault monitoring. If necessary, the amount of packets passed by the Internet 6 connection is received from the filtering bridge 45, and the Internet usage fee is calculated. After the inpatient 40 is discharged, the filtering bridge 45 is reinitialized to prepare for the next use of the inpatient 40.

In the hospital H, the shop 7 has towels, toilet tools,
It is a shop that sells daily necessities such as newspapers and magazines, confectionery, absorbent cotton, and nursing supplies such as bandages. A shop server computer 71 is installed in the shop 7. The shop server computer 71 is a computer that controls the product ordering system provided by the shop 7, and is a WWW server computer. The merchandise ordering system provided by the shop 7 is a hospital H that can order merchandise through the Internet 6.
This is a system for the inpatient 40.

The shop server computer 71 provides a home page for ordering merchandise. In the inpatient 40, a user name and password are registered in advance on the user registration screen of the homepage, and by entering the user name and password of the inpatient 40, access to the homepage and ordering of products can be performed. It is configured. When the inpatient 40 orders a product on this home page, the shop 7 orders the product to a wholesale store or the like. When the product reaches the shop 7, the shop 7 informs the inpatient 40 by e-mail that the product has arrived. The inpatient 40 who receives this notification goes to the shop 7 to receive the product and pay the price. In addition, the delivery of the product may be delivered to the hospital room 4 by a person at the shop 7.

Next, with reference to FIG. 2, a specific configuration of the in-hospital integrated network system 1 according to this embodiment will be described. The in-hospital integrated network system 1 according to the present embodiment is a in-hospital server that controls a firewall server computer 10 installed between the Internet 6 and the in-hospital integrated network system 1 and an in-hospital business system installed in the staff area 2. The computer 21, the filtering bridge 45 and the router 46 installed in the hospital H, the port 45a for connecting the terminal computer 42 installed in the hospital room 4, the Web computer 32 installed in the Internet room 3, and the filtering bridge 45 And an SMS server computer 54 that manages the. Hereinafter, this component will be described.

Firewall server computer 10
Is installed in Hospital H. It is a server computer for security measures installed between the Internet 6 and the hospital business network. All communication requests from users on the Internet 6 are monitored to prevent unauthorized data from invading the in-hospital business network in the hospital H, and to prevent information stored in the in-hospital business network from being tampered with by a third party. To prevent. Here, the in-hospital business network corresponds to the in-hospital business computer network in the claims.

Firewall server computer 10
For this, a well-known firewall server computer having a packet filtering function, a gateway function, a proxy function, and the like is used. The firewall 10 is provided with three ports 10a to 10c. The port 10a is connected to the Internet line 9 outside the hospital H.

The port 10b is the in-hospital server computer 2 that controls the in-hospital business system via the router 24.
Connected to 1. The router 24 is a device that relays between different networks, and performs mutual network protocol and address conversion. A well-known router is used as the router 24. The port 10c is connected to the port 11a of the hub 11. This hub 11 is port 1
In addition to 1a, it has ports 11b and c. Port 1
The wiring toward the terminal computer 42 of the hospital room 4 is connected to 1b, and the wiring toward the Web computer 32 of the internet room 3 is connected to the port 11c.

In the hospital staff area 2, an in-hospital business network for the hospital staff 20 is laid. At least one hospital server computer 21 and a plurality of staff terminal computers 22 are connected to the hospital business network. In this embodiment, the in-hospital business network is an Ethernet with a bus-type network structure.
It is built with et (registered trademark). The in-hospital server computer 21 controls the in-hospital business system,
It is an existing server computer already installed in the hospital H. The in-hospital server computer 21 is configured so that a person who has been registered as a user can access it only from a computer in the in-hospital business network by inputting a user name and a password.

The staff terminal computer 22 is a general personal computer. In addition to the clinical departments in the hospital H, the hospital staff 30 is installed in a place where the hospital staff 30 operates such as a diagnosis room and a treatment room, and a user who has registered in advance enters the hospital server computer 21 by inputting the user name and password. It is accessible. The staff terminal computer 22 includes a router 24 and a firewall 10.
It is configured to be connectable to the Internet 6 via the line 9 via the.

The internet room 3 has a hub 34.
And a plurality of Web computers 32 are installed. The hub 34 is connected to the port 11c of the hub 11. The plurality of Web computers 32 are respectively connected to different ports of the hub 34, and are connected to the firewall server computer 10 via the hub 34 and the hub 11. The Web computer 32 is a computer having only a browser, and the terminal user 30
The computer 32 can use only the Internet 6. Therefore, the Web computer 32
The terminal user 30 who uses is unable to access other computers in the hospital H.

A card reader 33 is connected to each Web computer 32. Card reader 33
Is a prepaid card with a predetermined amount registered in advance,
It is a device that subtracts the amount of money according to the connection time and the packet. The card reader 33 includes a CPU, a recording device, and a card reading device, and reads the balance of the card when the card is inserted into the card reading device. If the balance of the card is not 0, the power of the Web computer 32 is turned on. When the power is turned on, the Web computer 32 launches a browser, accesses a provider server computer (not shown), and starts connection to the Internet 6.

The Web computer 32 counts the packet flow rate passing through a communication device (not shown) in the Web computer 32, and sends a signal to the card reader 33 indicating that the packet flow rate has reached the unit amount each time it reaches the unit amount. Send. The card reader 33 subtracts the unit amount from the prepaid card for each unit amount of the packet, and the Web computer 3
Internet connection fee will be collected from 2 users. Also, the card reader 33 may be configured to charge not on a packet-by-packet basis but on an hourly basis. That is,
The Web computer 32 transmits a connection start signal and a connection end signal to the card reader 33 at the start of connection to the Internet 6 and at the end of connection. Card reader 33
Receives a connection start signal, sets a timer, and every time a unit time elapses after the timer is set, the unit amount per unit time is subtracted from the prepaid card. The timer is cleared when the connection end signal is received.

In the hospital H, a plurality of filtering bridges 45 are installed. Each filtering bridge 4
The hardware configuration of No. 5 will be described based on FIG. The filtering bridge 45 includes a CPU 60 as a data calculation / control processing device, a RAM 61 as a storage device, and an R
The OM 62 and the HDD 63 are provided. CPU60 is R
Various processes are executed according to the programs stored in the OM 62 or the HDD 63.
The RAM 61 appropriately stores data necessary for the CPU 60 to execute various processes. The communication device 64 transmits data to the outside and receives data supplied from the outside.

A port 45a to which the terminal computer 42 can be connected is connected to each filtering bridge 45. The port 45a is installed at the bedside of the inpatient 40 in the hospital room 4. Terminal computer 42
It is possible to connect a general personal computer, and normally, the one brought by the inpatient 40 is used. The filtering bridge 45 is a hub 44.
Is connected to the firewall server computer 10 via. A router 46 is connected to the hub 44. Filtering bridge 45 and port 45a
Is provided for each hospital room and is configured to branch from the hub 44 to each filtering bridge 45.

In the initialized state, the HDD 63 of the filtering bridge 45 stores the MAC address of the router 46 and the setup request signal. In the initialized state, the firmware for operating the filtering bridge 45 includes RAM 61, ROM 62, and HD.
Not registered in any of D63.

The required number of filtering bridges 45 are installed in each hospital room 4 when the hospital integrated network system 1 of this embodiment is constructed. After the installation, if there is no inpatient in the hospital room 4 or if the inpatient does not connect the terminal computer 42, it is left in the initialized state. The inpatient in the hospital room 4 has a terminal computer 42
When using the in-hospital integrated network system 1, the firmware set is downloaded from the SMS server computer 54 to the filtering bridge 45, and the terminal computer 42 is made available.

The filtering bridge 45 assigns an IP address to the connected terminal computer 42,
Performs security management, billing management, and bandwidth limitation management. That is, the filtering bridge 45 gives the IP address to the terminal computer 42 connected to the port 45a. The terminal computer 42 is configured so that an IP address cannot be assigned. Further, as security management, the terminal computer 42 can be connected only to the computer outside the firewall 10. As a result, the inpatient 40 can change the terminal computer 4
2 to the terminal computer 42 of another inpatient 40, the in-hospital server computer 21, the W of the Internet room 3
It is configured so that it cannot be connected to the eb computer 32.

As the charge management, regarding the connection of the terminal computer 42 to the Internet 6, the number of packets passing through the filtering bridge 45 is counted, and the data of the passing packet amount and the communication time are stored in the ROM 62. In this embodiment, the filtering bridge 4
Data of the amount of passing packets is accumulated in step 5, and S is stored if necessary.
The SMS server computer 54 side is configured to calculate the internet usage fee by transmitting the data of the passing packet amount to the MS server computer 54. However, a card reader is connected to the filtering bridge 45 or the port 45a. The internet usage fee may be collected in real time from a prepaid card or a credit card.

At this time, a hub may be connected between the card reader and the filtering bridge 45, and the power of the hub may be turned on when the card with the remaining balance is inserted into the card reader. As a result, by inserting the card with the remaining balance, the hub is turned on to allow data to pass, and the internet can be connected. When the balance of the card becomes 0 or when the card is not inserted, the hub is powered off and the internet connection becomes impossible.

As the band limitation management, the data communication speed of the filtering bridge 45 is set to the speed set by the SMS server computer 54, for example, 10 Mbp.
Limit to s or less.

The router 46 uses the filtering bridge 4
The setup command signal required for starting
It plays a role of relaying to the MS server computer 54. The router 46 includes a CPU, a recording device, and the like.

An SMS server computer 54 is installed in the system management organization 5. The SMS server computer 54 manages the filtering bridge 45 and the router 46. Transmission of the program of the filtering bridge 45, setting of an IP address, fault monitoring, re-initialization, restart (restart), information display, accounting management, etc. are performed via the Internet 6. The SMS server computer 54 includes a CPU (not shown) as a data calculation / control processing device, RAM, ROM, and HD as storage devices.
D, a storage medium device, a keyboard and a mouse display device which are input devices, and a printer.

Next, the operation of the hospital integrated network system 1 of this embodiment will be described. When an inpatient 40 in the sickroom 4 requests to use the Internet 6 in the hospital integrated network system 1,
The person in charge of the system management organization 5 clicks the button for instructing the setup on the screen of the SMS server computer 54. This causes the SMS server computer 54 to send a setup support to the filtering bridge 45.

Upon receiving the setup instruction from the SMS server computer 54, the filtering bridge 45 transmits a setup request signal to the router 46. Upon receipt of the setup command signal, the router 46 receives the SM
A setup request signal is transmitted to the S server computer 54. Upon receiving the setup command signal, the SMS server computer 54 transmits to the filtering bridge 45 a set of firmware including a program for operating the filtering bridge 45. The filtering bridge 45 uses this firmware for R
Store in OM62 and complete the installation.

Next, in the hospital room 4, the terminal computer 42 brought by the inpatient 40 is connected to the port 45a, and the terminal computer 42 is powered on. When the filtering bridge 45 detects that the terminal computer 42 is powered on, the flowchart of FIG. 4 starts. The flowchart of FIG. 4 is executed each time the power of the terminal computer 42 is turned on. Further, it is executed by the CPU 60 of the filtering bridge 45.

In step S1, the filtering bridge 45 sends a MAC address request command to the terminal computer 42. Then, in step S2, it is determined whether the MAC address is received from the terminal computer 42.
If no MAC address has been received (step S2:
No), it is determined in step S3 whether a predetermined time has elapsed.

When a predetermined time has elapsed (step S3:
YES), the connection between the filtering bridge 45 and the terminal computer 42 may be faulty, and an error message is displayed on the SMS server computer 54 in step S4, and the process ends. The person in charge of the system management organization 5 who has seen the error display either goes to the hospital H to confirm the setting or gives an instruction to the inpatient 40 to return by telephone or the like. If the predetermined time has not elapsed (step S
3: NO), and it is determined in step S2 whether the MAC address is received from the terminal computer 42. That is, steps S2 and S3 are repeated until a predetermined time has elapsed or the MAC address is received.

When the MAC address is received (step S2: YES), in step S5, the MAC address is used as a key to search the address management table that associates the MAC address with the IP address, and the MAC address becomes the address management table. Determine if it is registered. If the MAC address is registered in the address management table (step S5: YES), step S9
The IP address received from the terminal computer 42 at
It is determined whether the IP address matches the IP address registered in the address management table.

The IP address received from the terminal computer 42 is the IP registered in the address management table.
If it matches the address (step S9: YES), the MAC address has already been registered in association with the IP address, and since the IP address has not been changed after registration, it is necessary to register and correct the IP address. If there is not, the process ends.

The IP address received from the terminal computer 42 is the IP registered in the address management table.
If it does not match the address (step S9: NO), the IP address registered in the address management table in association with the MAC address is transmitted to the terminal computer 42 and the IP address is set in the terminal computer 42 in step S10. As a result, the terminal computer 42
Even if the IP address is set by the inpatient 40 or the like on the side, the filtering bridge 45 can correct the IP address. Then, the process ends.

If the MAC address is not registered in the address management table (step S5: NO), it is the first time that the terminal computer 42 is connected to the filtering bridge 45, and therefore, a free IP address is obtained in step S6. One IP address is selected from the group and transmitted to the terminal computer 42, and the IP address is set in the terminal computer 42. Then, step S7
Then, the MAC address and IP of this terminal computer 42
The filtering bridge 45 is associated with the address.
Register in the address management table of.

Next, in step S8, a packet passage table 45 for determining whether or not to pass the packet.
The IP address of the terminal computer 42 is registered in T-1 and T-2. Outbound packet passage table 45T-1 and inbound packet passage table 4 which constitute the packet passage table
An example of 5T-2 is shown in FIG. The outgoing packet passage table 45T-1 shown in FIG. 5A is used for the filtering bridge 45 for the data received from the terminal computer 42.
It is a table for determining whether or not to allow passage of the. That is, when the filtering bridge 45 receives the data from the terminal computer 42, the filtering bridge 45 acquires the source IP address from the IP header of the packet of the data, compares it with the data of the outbound packet passage table 45T-1, and determines the source of the received packet. Source IP of the data whose IP address is any of the outgoing packet passage table 45T-1
If the address does not match the address 45y, the packet is not permitted to pass and the data is discarded.

The outgoing packet passage table 45T-1 has a relay destination IP address 45x and a transmission source I as items.
The P address 45y is included. In FIG. 5A, the IP address of the firewall 10 is illustrated as “AAAA”, and the IP address set by the filtering bridge 45 in the terminal computer 42 is illustrated as “BBBB”.

In the outgoing packet passage table 45T-1, as the passage permission data 45m, the transmission source IP address and the filtering bridge 45 are set in the terminal computer 4.
The case where the IP address is “BBBB” set to 2 is registered.

That is, in the example of FIG. 5A, the source IP
If the address is other than "BBBB" set by the filtering bridge 45, it is set that packet passage is not permitted. Also, the relay destination IP address 45
x is "AAAA" and IP address is "BBBB"
When the data is received from the terminal computer 42, the data is directly relayed to the firewall 10.

Inbound packet passage table 4 of FIG. 5 (b)
5T-2 is a table for determining whether or not to allow the data received from the firewall 10 side to pass through the filtering bridge 45. That is, when the filtering bridge 45 receives data from the hub 44 on the firewall 10 side, it acquires the destination IP address from the IP header of the packet of the data, compares it with the data of the inbound packet passage table 45T-2, and receives the packet. If the destination IP address of No. does not match the destination IP address 45w of any of the data in the inbound packet passage table 45T-2, the packet is not permitted and the data is discarded.

The inbound packet passage table 45T-2 has a relay destination IP address 45z and a transmission destination I as items.
The P address 45w is included. In FIG. 5B, the IP address set in the terminal computer 42 by the filtering bridge 45 is illustrated as “BBBB”.

In the inbound packet passage table 45T-2, as the passage permission data 45n, the destination IP address and the filtering bridge 45 are connected to the terminal computer 4
The case where the IP address is “BBBB” set to 2 is registered.

That is, in the example of FIG. 5B, the destination IP
If the address is other than "BBBB" set by the filtering bridge 45, it is set that packet passage is not permitted. Further, since the filtering bridge 45 and the terminal computer 42 are directly connected, the relay destination IP address 45z is set to the same "BBBB" as the transmission destination IP address 45w.

In step S8, the IP address set in step S6 is transferred to the outgoing packet passage table 45T-.
"BBBB" is set as the source IP address of 1 and the address "A" of the firewall 10 is set as the relay destination IP address.
AAA ”is set. Inbound packet passing table 4
"BBBB" is set as the destination IP address and relay destination IP address of 5T-2. Then, the process of FIG. 4 is completed. Steps S6, 7, 10 of the flowchart of FIG.
Corresponds to the address registration procedure in the claims.

Next, a case where the filtering bridge 45 receives data will be described. When the filtering bridge 45 receives the data, if the MAC address of the data corresponds to its own MAC address, the filtering bridge 45 holds the packet of the data in a buffer (not shown) and starts the flowchart of FIG. The flowchart of FIG. 6 is executed by the CPU 60 of the filtering bridge 45.

In step S11, the I of the received packet
The source IP address is acquired from the P header and compared with the outbound packet passage table 45T-1 to determine whether or not there is a match in the source IP address 45y of the outbound packet passage table 45T-1.

If there is a match in the source IP address 45y of the outgoing packet passage table 45T-1 (step S11: YES), the destination IP address is acquired from the IP header of the packet in step S12. , This destination IP address is the firewall 10
It is determined whether it is the IP address of the computer in the inner hospital H. Specifically, the IP network address of the IP addresses is referred to, and it is determined whether or not this IP network address is the IP address of any network in the hospital H.

When the destination IP address is not the IP address of the computer in the hospital H inside the firewall 10 (step S12: NO), the data is the hospital H.
Assuming that the data is destined for an external computer, the data is relayed to the firewall 10 in step S13, and the process ends.

When the destination IP address is the IP address of the computer in the hospital H inside the firewall 10 (step S12: YES), it means that the terminal computer 42 in the hospital room 4 is trying to access the computer in the hospital H. , The packet is discarded in step S16 for security management of the hospital business network. Then, the process ends.

If there is no match in the source IP address 45y of the outgoing packet passage table 45T-1 (step S11: NO), it may be data from the firewall 10 side, so step S14.
Then, the destination IP address is acquired from the IP header of the packet, compared with the inbound packet passage table 45-2, and it is determined whether there is a match in the destination IP address 45w of the inbound packet passage table 45-2. To do.

If there is no match in the destination IP address 45w of the inbound packet passage table 45T-2 (step S14: NO), the data is not addressed to the terminal computer 42, or the IP address of the terminal computer 42 is wrong. Packet is discarded in step S16. Then, the process ends. Destination IP address 45w of the inbound packet passage table 45T-2
If there is a match (step S14: YE)
S), assuming that the correct IP address of the terminal computer 42 is assigned, in step S15, the packet I
The sender IP address is acquired from the P header, and it is determined whether this sender IP address is the IP address of the computer in the hospital H inside the firewall 10. Specifically, the IP network address of the IP addresses is referred to, and it is determined whether or not this IP network address is the IP address of any network in the hospital H.

When the source IP address is not the IP address of the computer in the hospital H inside the firewall 10 (step S15: NO), the data is hospital H.
Assuming that the data has been transmitted from an external computer, the data is transmitted to the terminal computer 42 having the destination IP address in step S17, and the process ends.

When the source IP address is the IP address of the computer in the hospital H inside the firewall 10 (step S15: YES), the data is transmitted from any computer in the hospital H to the terminal computer 42 in the hospital room 4. Since it is about to be performed, step S16 is performed for security management of the hospital business network.
To discard the packet. Then, the process ends. This is the end of the process of the flowchart in FIG. Steps S11 to 17 of the flowchart of FIG. 6 correspond to the passage permission procedure of the claims. Further, step S13 corresponds to the direct transmission procedure in the claims.

Further, the SMS server computer 54 is
Fault monitoring of each filtering bridge 45 is regularly performed. Specifically, the SMS server computer 54 periodically transmits fault monitoring data, for example, an echo request of ICMP (Internet Control Message Protocol) to each terminal computer 42. Upon receiving the fault monitoring data, the terminal computer 42 receives the SMS message.
Data for notification of existence to the server computer 54,
For example, an echo reply is transmitted. When the SMS server computer 54 receives the data for notification of existence, the SMS server computer 54 determines that there is no fault in the filtering bridge 45 and ends the process.

Further, if the data for notifying the existence has not been received, it is determined that the communication with the terminal computer 42 which has not received the error has occurred, and the existence notification data is displayed on the screen of the SMS server computer 54. No., the number of the filtering bridge 45 of the terminal computer 42 that has not received the data and an error indicating that a failure may have occurred are displayed, and the processing ends. When an error is displayed on the screen of the SMS server computer 54, the person in charge of the system management organization 5 goes to the hospital H to check the operation of the filtering bridge 45 and exchange it.

The filtering bridge 45 counts the packet amount passing through the filtering bridge 45 and the communication time by a known method, and stores the data of the passing packet amount and the communication time in the ROM 62. When receiving the transmission instruction from the SMS server computer 54, the filtering bridge 45 transmits the data of the passing packet amount and the communication time to the SMS server computer 54. SM
In the CPU (not shown) of the S server computer 54, the unit price is added to the data of the passing packet amount or the communication time received from the filtering bridge 45 to calculate the internet usage fee for each terminal computer 42, and the HD (not shown)
Record in D. The internet usage fee may be paid at the reception of the hospital H or withdrawn from the bank account when the patient is discharged from the hospital.

As a result, the hospital H can charge the hospitalized patient 40 according to the amount of information that the patient has used the terminal computer 42, and can obtain a corresponding profit.

After the hospitalized patient 40 is discharged from the hospital, the data regarding the terminal computer 42 of the hospitalized hospitalized patient 40 remains in the filtering bridge 45.
The filtering bridge 45 is re-initialized in preparation for the use. Based on the re-initialization command sent from the SMS server computer 54, the filtering bridge 45
Are RAM 61, ROM 62, HDD 6 which are storage devices
All information in 3 is erased and reinitialized. Then S
The HDD 6 receives the MAC address of the router 46 and the setup request signal from the MS server computer 54.
3 and ends the re-initialization process.

The filtering bridge 45 sets the communication speed to the SMS server computer 54 as a band limitation management.
Limit to the speed set from. The SMS server computer 54 sends the value of the speed limit to the filtering bridge 45 as a band limit value. This bandwidth limit is
The communication speed can be set in units of 1 Kbps from 1 Kbps to 10 Mbps. In addition, it may be set only for uplink and only for downlink, or may be set for the total of uplink and downlink communication speeds. The filtering bridge 45 registers the band limit value received from the SMS server computer 45 in the RAM 61.

The filtering bridge 45 measures the amount of data passing therethrough and differentiates this amount of data with respect to time to measure the communication speed. When the bandwidth limit value is registered, the filtering bridge 45 prohibits the passage of the data of the portion exceeding the bandwidth limit value when the communication speed exceeds the bandwidth limit value.

[0088]

As described above, according to the present invention, in the passage permission means, the combination of the destination IP address and the source IP address of the data is the IP address set by the address registration means and the outside of the firewall. Access to the information of the hospital business computer network installed inside the firewall from the terminal computer of the patient because it is configured to allow the passage of data when it is combined with the IP address of the computer of Can be prohibited. In addition, when the patient sets the IP address on the terminal computer by himself / herself, it becomes impossible to send / receive data, so that it is possible to prevent the patient from setting the IP address on the terminal computer by himself / herself, and the IP address is duplicated. Can be prevented.

Further, since the filtering bridge is provided with the address registration means for setting the IP address in the terminal computer and storing the set IP address,
It is possible to prevent the patient from setting the IP address in the terminal computer by himself / herself, and it is possible to prevent the IP address from being duplicated. Further, since the filtering bridge is provided with the terminal connecting means for connecting the terminal computer in the patient room, the patient can bring his or her computer, which is accustomed to the operation, to the patient room and continue to use it. .

[Brief description of drawings]

FIG. 1 is an explanatory diagram showing an outline of a configuration of an in-hospital integrated network system according to an embodiment of the present invention.

FIG. 2 is an explanatory diagram showing a main configuration of an in-hospital integrated network system according to an embodiment of the present invention.

FIG. 3 is an explanatory diagram showing a hardware configuration of a filtering bridge according to an embodiment of the present invention.

FIG. 4 is a flowchart of a filtering bridge operation according to an exemplary embodiment of the present invention.

5A is an explanatory diagram showing an outbound packet passage table set in a filtering bridge according to an embodiment of the present invention, and FIG. 5B is set in a filtering bridge according to an embodiment of the present invention. It is an explanatory view showing an inbound packet passage table.

FIG. 6 is a flowchart of a filtering bridge operation according to an exemplary embodiment of the present invention.

[Explanation of symbols]

H hospital 1 Hospital integrated network system 2 Hospital staff area 3 Internet room 4 hospital rooms 5 system management organization 6 Internet 7 shops 8 hospital management side 9 lines 10 Firewall server computer 11, 34, 44 hubs 24, 46 routers 20 hospital staff 21 In-hospital server computer 22 Terminal computer for staff 30 terminal users 32 Web computer 33 card reader 40 inpatients 42 terminal computer 45 filtering bridge 45a port 45 45T-1 Outbound Packet Passing Table 45T-2 Inward packet passage table 54 SMS Server Computer 60 CPU 61 RAM 62 ROM 63 HDD 64 communication device 71 Shop server computer

   ─────────────────────────────────────────────────── ─── Continued front page    F-term (reference) 5B085 AA08 AE00                 5K030 GA15 HA08 HD03 HD08 HD09                       JA11 KA05 KA15 KX24 LC15                       LD19                 5K033 AA08 BA02 CB09 CC02 DB18                       DB20 EC04

Claims (12)

[Claims] 1. An in-hospital integrated network system in which the same line is used to connect a hospital communication computer network to a public communication network and a patient terminal computer to a public communication network. An in-hospital business computer network connected to a public communication line network; a firewall server computer installed between the public communication line network and the in-hospital business computer network; and the in-hospital business computer network in the firewall server computer. At least one filtering bridge connected in parallel, wherein the filtering bridge sets a terminal connection means for connecting a terminal computer in a hospital room and an IP address to the terminal computer connected to the connection means. Then An address registration unit that stores the set IP address, and a passage permission unit that permits the data to pass through the filtering bridge in a predetermined case are provided. The passage permission unit transmits the data destination IP address and the transmission destination IP address. When the combination with the original IP address is the combination of the IP address set by the address registration means and the IP address of the computer outside the firewall, the passage of the data is permitted. Network system. 2. The filtering bridge transmits the data directly to the firewall when the source IP address of the data is the IP address set by the address registration means. In-hospital comprehensive network system described. 3. A system management server computer in which a program for operating the filtering bridge is stored in the firewall,
Connected via a public communication network, between the firewall and the filtering bridge, a router is connected, the filtering bridge comprises a setup request means for transmitting a setup request to the router, the router, Receiving the setup request received from the filtering bridge, a transfer means for transmitting a setup command to the systems management server computer, wherein the systems management server computer causes the filtering bridge to execute the program according to the setup command. The in-hospital integrated network system according to claim 1, further comprising a program transmission unit for transmitting the. 4. A patient terminal management device for managing connection from a terminal computer for a patient to a public communication line network using a line connecting from an in-hospital business computer network to the public communication line network, the management device. Storage device for storing a program that defines the operation of, a server for creating information, an input device for receiving information from the outside, an output device for sending information to the outside, information received from the storage device and / or the input device A central processing unit for calculating the calculation result and passing the calculation result to the storage device and / or the output device, and a firewall server computer installed between the public communication network and the hospital computer network, Connected in parallel with the in-hospital computer network to connect terminal computers in hospital rooms. Terminal connecting means for setting the IP address in the terminal computer connected to the connecting means, and an address registering means for storing the set IP address, and a passage permitting data to pass in a predetermined case. And a passage permitting means, in which the combination of the destination IP address and the source IP address of the data is the IP address set by the address registering means and the IP address of the computer outside the firewall. A terminal management device for a patient, which permits the passage of the data when it is a combination. 5. The direct transmission means for directly transmitting the data to the firewall when the source IP address of the data is the IP address set by the address registration means. The described terminal management device for patients. 6. Setup request means for transmitting a setup request for transmitting a program for operating the patient terminal management apparatus to a router connected between the firewall and the patient terminal management apparatus. 5. The patient terminal management apparatus according to claim 4, further comprising a program receiving means for receiving the program from a systems management server computer via the public communication line network. 7. A patient terminal management method for managing connection from a terminal computer for a patient to a public communication line network using a line connecting from a hospital business computer network to a public communication line network, the method comprising: A procedure for installing at least one filtering bridge in parallel with the in-hospital business computer network on a firewall server computer installed between a network and the in-hospital business computer network; A procedure of connecting a terminal computer, an address registration procedure in which the filtering bridge sets an IP address in the terminal computer and stores the set IP address, and a combination of a data destination IP address and a source IP address But the ad Scan registration procedure with the IP address set in the firewall outside of the computer IP of
And a pass permission procedure for permitting the data to pass through the filtering bridge in the case of a combination with an address. 8. The filtering bridge transmits the data directly to the firewall when the source IP address of the data is the IP address set in the address registration procedure, overlapping with the passage permission procedure. The method for managing a patient terminal according to claim 7, wherein a direct transmission procedure is performed. 9. The system management server computer is connected to the firewall via a public communication network at any stage prior to the procedure of connecting the terminal computer in the hospital room, and the firewall and the filtering bridge are connected. And a filtering connection between the router and the router, and the filtering bridge performs a setup request procedure of transmitting to the router a setup request requesting transmission of a program for operating the filtering bridge. In response to the setup request received from the filtering bridge, a transfer procedure for transmitting a setup command to the system management server computer is performed, and the system management server computer sets up the setup command. 8. The terminal management method for a patient according to claim 7, wherein a program transmission procedure for transmitting the program to the filtering bridge is performed in response to a command. 10. A patient terminal management device for managing a connection from a terminal computer for a patient to a public communication network using a line connecting from an in-hospital computer network to the public communication network, the terminal management device for the patient An IP address is set in the terminal computer connected to the terminal connection means of the device, and the set IP
The combination of the address registration procedure for storing the address and the data transmission destination IP address and the transmission source IP address is the IP address set in the address registration procedure and the IP of the computer outside the firewall.
And a passage permission procedure for permitting data to pass through the patient terminal management device when it is a combination with an address,
A program to execute. 11. A direct transmission procedure for directly transmitting the data to the firewall when the source IP address of the data is the IP address set in the address registration procedure, overlapping with the passage permission procedure. The program according to claim 10, which is executed. 12. A setup request procedure for sending a setup request for requesting transmission of a program for operating the patient terminal management device to a router installed between the firewall and the patient terminal management device is performed. 11. The program according to claim 10, wherein a program receiving procedure for receiving the program is executed from a systems management server computer connected to a firewall via a public communication network.