JP2018060307A - Operation information recording program, operation information recording device, and operation information recording method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To easily specify an operator who performed a specific operation to an information processing device.SOLUTION: An operation information recording device 14 includes: an acquisition part 20 that acquires information specifying an operation to an information processing device; an extraction part 22 that extracts information specifying an operation corresponding to a period in accordance with the time of receiving an input, of the information specifying the operation acquired by the acquisition part 20, when receiving the input of identification information of an operator to a specific area included in a screen of software operating on an operating system of the information processing device; and a recording part 24 that records the information specifying the operation extracted by the extraction part 22 in association with the received identification information of the operator.SELECTED DRAWING: Figure 3

Description

  The present invention relates to an operation information recording program, an operation information recording apparatus, and an operation information recording method.

  2. Description of the Related Art Conventionally, in a fraud monitoring system, a technique is known in which identification information of an operator who operates an information processing apparatus and event contents such as logon and logoff to the information processing apparatus are associated and recorded as an audit log. In this technique, for example, identification information of an account logged into the information processing apparatus is handled as the identification information of the operator.

  A technique for identifying a client terminal that accesses data to be tracked based on an access log stored in a server is also known.

  There is also known a technique for identifying an unauthorized event by collating time-series data of an operator's operation history with respect to an information processing apparatus and an abnormal process pattern.

JP 2006-195634 A JP 2007-048266 A JP 2005-222216 A

  When information leakage occurs in the information processing system, for example, the administrator investigates which operator has operated each information processing apparatus constituting the information processing system from an operation log or the like.

  For example, when a certain information processing device is shared by a plurality of operators and the information processing device is operated, the user logs out and logs on to the information processing device every time the operator changes after logging in with a shared account of the operating system. There may not be. That is, in this case, even if the operator of the information processing apparatus changes, the account logged in to the information processing apparatus does not change. Therefore, in this case, if an account logged into the information processing apparatus is handled as an operator of the information processing apparatus, it is difficult to specify the actual operator of the information processing apparatus from the operation log or the like.

  An object of the present invention is, as one aspect, to easily identify an operator who has performed a specific operation on an information processing apparatus.

  As one aspect, the present invention acquires information that specifies an operation for an information processing apparatus. In addition, when receiving the input of the operator identification information to the specific area included in the screen of the software operating on the operating system of the information processing apparatus, the following information among the acquired information specifying the operation is: Extract. That is, information for specifying an operation corresponding to a period corresponding to the time at which the input is received is extracted from the acquired information for specifying the operation. Then, the information specifying the extracted operation is recorded in association with the received identification information of the operator.

  As one aspect, there is an effect that an operator who has performed a specific operation on the information processing apparatus can be easily specified.

It is a block diagram which shows schematic structure of the medical information system which concerns on each embodiment. It is a figure which shows an example of the screen of the electronic medical record software which operate | moves on the operating system of a terminal. It is a functional block diagram of the operation information recording device concerning a 1st embodiment. It is a figure which shows an example of an operation table. It is a figure which shows an example of a person in charge table. It is a figure which shows an example of an operator table. It is a figure which shows the modification of an operator table. It is a block diagram which shows schematic structure of the computer which functions as an operation information recording device concerning each embodiment. It is a flowchart which shows an example of the operation information recording process which concerns on each embodiment. It is a flowchart which shows an example of the operator recording process which concerns on 1st Embodiment. It is a functional block diagram of the operation information recording device concerning a 2nd embodiment. It is a figure which shows an example of an authentication login table. It is a figure which shows an example of a joint table. It is a figure which shows an example of a 1st operator table. It is a figure which shows an example of a 2nd operator table. It is a figure which shows an example of an event log table. It is a figure which shows an example of a position information table. It is a figure which shows an example of a 3rd operator table. It is a flowchart which shows an example of the person in charge recording process which concerns on 2nd Embodiment. It is a flowchart which shows an example of the authentication recording process which concerns on 2nd Embodiment. It is a flowchart which shows an example of the correction process which concerns on 2nd Embodiment. It is a flowchart which shows an example of the log table update process which concerns on 2nd Embodiment.

  Hereinafter, an example of an embodiment of the present invention will be described in detail with reference to the drawings. In the following embodiments, a case where the present invention is applied to a medical information system will be described as an example.

[First Embodiment]
First, with reference to FIG. 1, the structure of the medical information system 10 which concerns on this embodiment is demonstrated. As shown in FIG. 1, the medical information system 10 includes a plurality of terminals 12 and an operation information recording device 14. The terminal 12 and the operation information recording device 14 are connected to the network 16. The terminal 12 is an example of an information processing apparatus, and an example of the terminal 12 is a personal computer. An example of the operation information recording device 14 is a server computer.

  When the operator operates the terminal 12, the terminal 12 transmits information for specifying an operation on the terminal 12 (hereinafter referred to as “operation information”) to the operation information recording device 14 via the network 16. In the present embodiment, the terminal 12 transmits, as operation information, the date and time when the operation was performed on the terminal 12 (hereinafter referred to as “operation date and time”) and the operation type such as a keyboard and a mouse to the operation information recording device 14. .

  In addition, the terminal 12 transmits the operator identification information input to the specific area included in the screen of the software operating on the operating system (OS) of the terminal 12 to the operation information recording device 14 via the network 16. . In the present embodiment, as shown in FIG. 2 as an example, the terminal 12 receives the name of the person in charge in the input area 18 of the person in charge included in the screen of the electronic medical record software operating on the OS of the terminal 12. The following processing is performed. In this case, the terminal 12 transmits the person-in-charge name input to the input area 18 to the operation information recording device 14 as identification information of the operator of the terminal 12. Further, in this case, the terminal 12 also transmits the date and time when the person-in-charge name is input in the input area 18 (hereinafter referred to as “person-in-charge input date and time”) to the operation information recording device 14.

  Next, a functional configuration of the operation information recording apparatus 14 according to the present embodiment will be described with reference to FIG. As illustrated in FIG. 3, the operation information recording device 14 includes an acquisition unit 20, an extraction unit 22, and a recording unit 24. In addition, in the predetermined storage area of the operation information recording device 14, the operation table 40, the person-in-charge table 42, and the operator table 44 are individually stored for each terminal 12.

  The acquisition unit 20 acquires operation information transmitted from the terminal 12. Then, the acquisition unit 20 records the acquired operation information in the operation table 40 corresponding to the terminal 12 that is the transmission source of the operation information.

  FIG. 4 shows an example of the operation table 40. As shown in FIG. 4, information indicating the operation date and time included in the operation information and the type of operation performed on the terminal 12 is recorded in the operation table 40.

  The acquisition unit 20 acquires the person-in-charge input date and time transmitted from the terminal 12 and the person-in-charge name input in the input area 18. Then, the acquisition unit 20 records the acquired person input date / time and the person in charge name in the person in charge table 42 corresponding to the terminal 12 that has transmitted the person in charge input date / time and the person in charge name.

  FIG. 5 shows an example of the person-in-charge table 42. As shown in FIG. 5, the person-in-charge input date is recorded in the person-in-charge table 42, and the person-in-charge name input in the input area 18 is recorded as the operator of the terminal 12.

  When the acquisition unit 20 acquires the person-in-charge input date and time and the person-in-charge name, the extraction unit 22 selects a record corresponding to the period corresponding to the acquired person-in-charge input date from the records recorded in the operation table 40. Extract. In the present embodiment, the extraction unit 22 extracts records within a predetermined period (for example, 1 minute) before and after the person-in-charge input date and time acquired by the acquisition unit 20 from the records recorded in the operation table 40. To do.

  The recording unit 24 records the record extracted by the extraction unit 22 in the operator table 44 in association with the corresponding person name. In the present embodiment, the recording unit 24 stores, in the operator table 44, the date and time of the record earlier than the person-in-charge input date and time among the records extracted by the extraction unit 22 as the start date and time when the operation of the terminal 12 is started. Record. In addition, the recording unit 24 records the date and time of the record dated later than the person-in-charge input date among the records extracted by the extraction unit 22 in the operator table 44 as the end date and time when the operation of the terminal 12 is completed. Then, the recording unit 24 records the person-in-charge name as the operator of the terminal 12 in the operator table 44 in association with the start date and time and the end date and time.

  In the present embodiment, when the extraction unit 22 extracts a plurality of records with the date and time earlier than the person-in-charge input date and time, the recording unit 24 uses the earliest date and time record among the extracted records as the start date and time. Record in table 44. In this embodiment, when a plurality of records having a date and time later than the person-in-charge input date and time are extracted by the extraction unit 22, the recording unit 24 uses the latest date and time record among the extracted records as the end date and time. Record in table 44.

  Further, in the present embodiment, the recording unit 24 stores in the operator table 44 using the person-in-charge input date / time as the start date / time when the extraction unit 22 has not extracted a date / time record within a predetermined period before the person-in-charge input date / time. Record. Further, the recording unit 24 records the person-in-charge input date / time in the operator table 44 as the end date / time when the extraction unit 22 does not extract the date / time record within a predetermined period after the person-in-charge input date / time.

  FIG. 6 shows an example of the operator table 44. As shown in FIG. 6, the operator table 44 records the start date and time, the end date and time, and the operator in time series. Note that the recording unit 24 records the same record for the operator in the operator table 44, and the difference between the end date and time of the previous record and the start date and time of the subsequent record is within a predetermined period (for example, 30 minutes) You may perform the process shown below. That is, in this case, the recording unit 24 records one record in which the same operator continues as the start date / time of the record with the earliest start date / time and the end date / time of the record with the latest end date / time. May be recorded in the operator table 44. FIG. 7 shows an example of the operator table 44 when records in which the same operator in the operator table 44 shown in FIG. 6 continues are recorded as one record.

  The operation information recording device 14 can be realized by a computer 60 shown in FIG. 8, for example. The computer 60 includes a central processing unit (CPU) 61, a memory 62 as a temporary storage area, and a nonvolatile storage unit 63. The computer 60 includes an input / output device 64 such as a display device and an input device. The computer 60 also includes a read / write (R / W) unit 65 that controls reading and writing of data with respect to the recording medium 68 and a network I / F 66 connected to the network. The CPU 61, the memory 62, the storage unit 63, the input / output device 64, the R / W unit 65, and the network I / F 66 are connected to each other via a bus 67.

  The storage unit 63 can be realized by a hard disk drive (HDD), a solid state drive (SSD), a flash memory, or the like. An operation information recording program 70 for causing the computer 60 to function as the operation information recording device 14 is stored in the storage unit 63 as a storage medium. The operation information recording program 70 includes an acquisition process 71, an extraction process 72, and a recording process 73. The storage unit 63 has an information storage area 74 in which the operation table 40, the person-in-charge table 42, and the operator table 44 are stored.

  The CPU 61 reads the operation information recording program 70 from the storage unit 63 and expands it in the memory 62, and executes a process included in the operation information recording program 70. The CPU 61 operates as the acquisition unit 20 illustrated in FIG. 3 by executing the acquisition process 71. The CPU 61 operates as the extraction unit 22 illustrated in FIG. 3 by executing the extraction process 72. The CPU 61 operates as the recording unit 24 illustrated in FIG. 3 by executing the recording process 73. As a result, the computer 60 that has executed the operation information recording program 70 functions as the operation information recording device 14.

  The function realized by the operation information recording program 70 can also be realized by, for example, a semiconductor integrated circuit, more specifically, an application specific integrated circuit (ASIC).

  Next, the operation of the operation information recording device 14 according to this embodiment will be described. When the operation information recording device 14 executes the operation information recording program 70, the operation information recording process shown in FIG. 9 and the operator recording process shown in FIG. 10 are executed. The operation information recording process shown in FIG. 9 and the operator recording process shown in FIG. 10 are executed by the CPU 61, for example, when the power of the operation information recording device 14 is turned on.

  In step S <b> 10 of the operation information recording process illustrated in FIG. 9, the acquisition unit 20 waits until operation information transmitted from the terminal 12 is received. When the operation information transmitted from the terminal 12 is acquired by the acquisition unit 20 via the network I / F 66, the determination in step S10 is affirmative, and the process proceeds to step S12.

  In the next step S12, the acquisition unit 20 records the operation information acquired in step S10 in the operation table 40 corresponding to the terminal 12 that is the transmission source of the operation information. When the process of step S12 ends, the process returns to step S10.

  On the other hand, in step S <b> 20 of the operator recording process shown in FIG. 10, the acquisition unit 20 waits until the person-in-charge input date / time transmitted from the terminal 12 and the person-in-charge name input in the input area 18 are received. When the person-in-charge input date and time and the person-in-charge name transmitted from the terminal 12 are acquired by the acquisition unit 20 receiving via the network I / F 66, the determination in step S20 is affirmative, and the process proceeds to step S22. .

  In step S22, the acquisition unit 20 records the person-in-charge input date and time and the person-in-charge name acquired in step S20 in the person-in-charge table 42 corresponding to the terminal 12 that is the source of the person-in-charge input date and person in charge. In the next step S24, the extraction unit 22 extracts a record corresponding to the period corresponding to the person-in-charge input date and time acquired in step S20 from the records recorded in the operation table 40 as described above.

  In the next step S26, as described above, the recording unit 24 records the record acquired in step S24 in the operator table 44 in association with the corresponding person name. When the process of step S26 ends, the process returns to step S20.

  As described above, according to the present embodiment, the operation information recording device 14 acquires information for specifying an operation on the terminal 12. Further, when the operation information recording device 14 receives the input of the operator identification information to the input area 18 included in the screen of the software operating on the OS of the terminal 12, among the information specifying the acquired operation, The following information is extracted. That is, in this case, the operation information recording device 14 extracts information specifying an operation corresponding to a period corresponding to the time when the input is received, from the information specifying the acquired operation. Then, the operation information recording device 14 records the information specifying the extracted operation in the operator table 44 in association with the received identification information of the operator.

  Therefore, for example, the administrator of the medical information system 10 can easily specify the operator who performed a specific operation on the terminal 12 by referring to the operator table 44.

[Second Embodiment]
Next, a second embodiment will be described. In the medical information system according to the present embodiment, the same parts as those of the medical information system 10 according to the first embodiment are denoted by the same reference numerals, and detailed description thereof is omitted.

  As shown in FIG. 1, the medical information system 210 according to the present embodiment includes a plurality of terminals 212 and an operation information recording device 214.

  Similarly to the terminal 12 according to the first embodiment, the terminal 212 transmits the operation date and time and the operation type such as a keyboard and a mouse to the operation information recording device 214 as operation information. Similarly to the terminal 12 according to the first embodiment, the terminal 212 transmits the person-in-charge name and the person-in-charge input date and time to the operation information recording device 214 when the person-in-charge name is input in the input area 18.

  In addition, the terminal 212 records the date and time of authentication (hereinafter referred to as “authentication date and time”) when the operator is authenticated by software that authenticates the operator operating on the OS such as scheduler software. To device 214. In this case, the terminal 212 further transmits the operator identification information used for authentication to the operation information recording device 214.

  Next, a functional configuration of the operation information recording device 214 according to the present embodiment will be described with reference to FIG. As illustrated in FIG. 11, the operation information recording device 214 includes an acquisition unit 220, an extraction unit 222, and a recording unit 224. In addition, each of the operation table 40, the person-in-charge table 42, the authentication login table 246, the combination table 248, the first operator table 250, and the second operator table 252 is stored in a predetermined storage area of the operation information recording device 214. Each terminal 212 is stored separately. Further, the event log table 254 and the third operator table 258 are individually stored for each terminal 212 in a predetermined storage area of the operation information recording device 214. In addition, a position information table 256 is stored in a predetermined storage area of the operation information recording device 214.

  FIG. 12 shows an example of the authentication login table 246. As shown in FIG. 12, the authentication login table 246 records the date and the operator. FIG. 13 shows an example of the join table 248. As shown in FIG. 13, the date and the operator are recorded in the connection table 248. The combination table 248 is a table in which records of the person-in-charge table 42 and the authentication login table 246 are recorded.

  FIG. 14 shows an example of the first operator table 250. As shown in FIG. 14, the first operator table 250 records the start date and time, the end date and time, and the operator. The first operator table 250 is a table in which records based on the records in the combined table 248 are recorded. FIG. 15 shows an example of the second operator table 252. As shown in FIG. 15, the start date / time, the end date / time, and the operator are recorded in the second operator table 252. The second operator table 252 is a table in which a record obtained by correcting the record of the first operator table 250 is recorded.

  FIG. 16 shows an example of the event log table 254. As shown in FIG. 16, the event log table 254 records date and time, operation details, and an operator. In the present embodiment, the operation content of the event log table 254 is recorded by the log recording software when, for example, a login and logout operation is performed on the terminal 212.

  Further, the operation content of the event log table 254 is recorded by the log recording software when the operation of starting and ending the software on the OS of the terminal 212 is performed. Further, the operation content of the event log table 254 is recorded by the log recording software when the file operation such as copying and deletion of the file on the OS of the terminal 212 is performed. Further, in the operation content of the event log table 254, the operation content by the operator is recorded by the log recording software when the login and logout operations to the Web system are performed. Further, as the date and time of the event log table 254, the date and time when the above-described various operations are performed by the operator is recorded by the log recording software.

  FIG. 17 shows an example of the position information table 256. As shown in FIG. 17, in the location information table 256, the network address of the network segment to which the terminal 212 is connected is recorded in advance for each installation location of the terminal 212.

  FIG. 18 shows an example of the third operator table 258. As shown in FIG. 18, the third operator table 258 records the start date and time, the end date and time, and the operator. The third operator table 258 is a table in which a record obtained by correcting the record of the second operator table 252 is recorded.

  In the present embodiment, among the tables shown in FIG. 11, each table other than the position information table 256 is associated with the Internet Protocol (IP) address of the corresponding terminal 212. That is, in the present embodiment, by referring to the position information table 256, the installation location of the terminal 212 corresponding to each table can be specified. Instead of the IP address of the terminal 212, for example, the installation location of the terminal 212 may be specified using other identification information such as the host name of the terminal 212.

  Similar to the acquisition unit 20 according to the first embodiment, the acquisition unit 220 acquires the operation information transmitted from the terminal 212 and uses the acquired operation information as an operation table 40 corresponding to the terminal 212 that is the transmission source of the operation information. To record. Further, the acquisition unit 220 acquires the person-in-charge input date and time transmitted from the terminal 212 and the person-in-charge name input in the input area 18, similarly to the acquisition unit 20 according to the first embodiment. Then, as in the acquisition unit 20 according to the first embodiment, the acquisition unit 220 assigns the acquired person-in-charge input date / time and the person-in-charge name corresponding to the terminal 12 that is the source of the person-in-charge input date / time and the person-in-charge name. Record in the person table 42.

  The acquisition unit 220 acquires the authentication date and time transmitted from the terminal 212 and the operator identification information used for authentication. Then, the acquisition unit 220 records the acquired authentication date and identification information in the authentication login table 246 corresponding to the authentication date and time and the terminal 12 that transmitted the identification information.

  The extraction unit 222 extracts a record corresponding to a period corresponding to the start date and time and the end date and time of the record recorded in the first operator table 250 from the records recorded in the operation table 40. In the present embodiment, the extraction unit 222 records records within a predetermined period (for example, 1 minute) before the start date and time of the records recorded in the first operator table 250 among the records recorded in the operation table 40. Extract. Further, the extraction unit 222 extracts records within a predetermined period (for example, 1 minute) after the end date and time of the records recorded in the first operator table 250 from the records recorded in the operation table 40.

  The recording unit 224 reads all records in the person-in-charge table 42 and the authentication login table 246, rearranges them in time series using the date / time column, and records them in the combined table 248. FIG. 13 shows, as an example, a combined table 248 in which all records of the person-in-charge table 42 shown in FIG. 5 and the authentication login table 246 shown in FIG. .

  Also, the recording unit 224 sets the start date / time, the end date / time, and the operator as the first operator for the record in which the same operator in the combination table 248 is continuous, with the earliest date / time as the start date / time. Record in table 250. FIG. 14 shows, as an example, a first operator table 250 in which a start date and time, an end date and time, and an operator are recorded based on the combination table 248 shown in FIG. In the present embodiment, the recording unit 224 sets the start date / time, the end date / time, and the operator as the first date / time for the records in which the same operator in the combination table 248 is not consecutive, using the date / time of the record as the start date / time. Record in the operator table 250.

  The recording unit 224 reads each record of the first operator table 250, corrects the start date and time and end date and time of each record to the date and time of the corresponding record (operation information) extracted by the extraction unit 222, Record in the second operator table 252. In the present embodiment, when a plurality of records are extracted by the extraction unit 222, the recording unit 224 sets the start date / time to the record with the earliest date among the records extracted by the extraction unit 222 corresponding to the start date / time. Correct the date and time. When a plurality of records are extracted by the extraction unit 222, the recording unit 224 sets the end date / time to the date / time of the latest record among the records extracted by the extraction unit 222 corresponding to the end date / time. to correct. Note that the recording unit 224 records the start date / time and end date / time in the second operator table 252 without correcting the record when the record is not extracted by the extraction unit 222 corresponding to the start date / time and end date / time.

  In FIG. 15, as an example, the start date and time and end date and time of the first operator table 250 are corrected and recorded based on the operation table 40 shown in FIG. 4 and the first operator table 250 shown in FIG. The second operator table 252 is shown. As shown in FIG. 15, for example, the start date and time of the first record in FIG. 14 is the date and time of the record (third record from the top in FIG. 4) within one minute before the start date and time in the operation table 40. It is corrected and recorded in the second operator table 252.

  In addition, the recording unit 224 reads each record in the second operator table 252 and corrects the start date and time and end date and time of each record based on the operation table 40, the event log table 254, and the position information table 256. 3 records in the operator table 258. Hereinafter, this correction process will be described.

  Here, in order to avoid complications, as an example, a case where the second operator table 252 corresponding to the terminal 212 installed in the internal medicine on the first floor (hereinafter referred to as “target terminal 212”) is corrected will be described. To do. Also, here, each table such as the operation table 40, the second operator table 252 and the third operator table 258 corresponding to the target terminal 212 will be described with the word “target” at the head. . Here, each table such as the event log table 254 corresponding to the terminal 212 (for example, a terminal installed in the office on the fifth floor) that is a predetermined distance or more away from the target terminal 212 is “other” at the top. This is explained with the words

  Here, a record in which the date and time in the target operation table 40 is not included in the range of the start date and time and the end date and time of each record in the target second operator table 252 is referred to as an unprocessed record.

  In the present embodiment, the recording unit 224 extracts other operators of the event log table 254 recorded at a date and time within a predetermined period (for example, 1 minute) before and after the date and time of an unprocessed record. Further, the recording unit 224 determines that the extracted operator cannot operate the target terminal 212 at the date and time of the unprocessed record. Then, the recording unit 224 corrects the end date / time of the record immediately before the date / time of the unprocessed record or the start date / time of the record immediately after the date / time of the unprocessed record in the second operator table 252.

  Specifically, description will be made by taking as an example a record whose date and time in the operation table 40 of FIG. 4 is “2015/12/16 08:46:38”. In another event log table 254, a record of “A” for the operator is recorded at a date and time within a predetermined period (for example, 1 minute) after “2015/12/16 08:46:38”. A case will be described as an example.

  In this case, as shown in FIG. 14, among the records before and after “2015/12/16 08:46:38” in the target second operator table 252, the operator of the previous record is the other event log table 254. Will be recorded. In this case, the recording unit 224 determines that “A” cannot operate the target terminal 212 at “2015/12/16 08:46:38”. That is, the recording unit 224 is “C” in which the operator of the target terminal 212 of “2015/12/16 08:46:38” is recorded by the operator of the subsequent record among the preceding and following records. Is determined. Then, the recording unit 224 corrects the start date and time of the subsequent record to “2015/12/16 08:46:38” and records it in the third operator table 258.

  As described above, the recording unit 224 determines whether it is impossible to operate the target terminal 212 using the records of the other event log table 254, but is not limited thereto. For example, the recording unit 224 cannot operate the target terminal 212 using the date and time of the other second operator table 252 and the third operator table 258 and the record of the table in which the operator is recorded. It may be determined whether or not.

  Further, the recording unit 224 records the operator in a record of the event log table 254 based on the third operator table 258. In the present embodiment, the recording unit 224 displays the operator of the record in the third operator table 258 including the date / time of the record in the event log table 254 between the start date / time and the end date / time in the record of the event log table 254. Record to operator.

  The operation information recording device 214 can be realized by, for example, the computer 60 shown in FIG. The storage unit 63 stores an operation information recording program 270 for causing the computer 60 to function as the operation information recording device 214. The operation information recording program 270 includes an acquisition process 271, an extraction process 272, and a recording process 273. The storage unit 63 includes an information storage area 274 in which the operation table 40, the person-in-charge table 42, the authentication login table 246, the combination table 248, and the first operator table 250 are stored. The information storage area 274 also stores a second operator table 252, an event log table 254, a position information table 256, and a third operator table 258.

  The CPU 61 reads the operation information recording program 270 from the storage unit 63 and expands it in the memory 62, and executes the process of the operation information recording program 270. The CPU 61 operates as the acquisition unit 220 illustrated in FIG. 11 by executing the acquisition process 271. The CPU 61 operates as the extraction unit 222 illustrated in FIG. 11 by executing the extraction process 272. The CPU 61 operates as the recording unit 224 illustrated in FIG. 11 by executing the recording process 273. As a result, the computer 60 that has executed the operation information recording program 270 functions as the operation information recording device 214.

  The function realized by the operation information recording program 270 can be realized by, for example, a semiconductor integrated circuit, more specifically, an ASIC or the like.

  Next, the operation of the operation information recording device 214 according to the present embodiment will be described for differences from the operation information recording device 14 according to the first embodiment. When the operation information recording device 214 executes the operation information recording program 270, the operation information recording process shown in FIG. 9, the person-in-charge recording process shown in FIG. 19, the authentication recording process shown in FIG. 20, the correction process shown in FIG. And the log table update process shown in FIG. 22 is executed. The operation information recording process shown in FIG. 9, the person-in-charge recording process shown in FIG. 19, and the authentication recording process shown in FIG. 20 are executed by the CPU 61, for example, when the operation information recording device 214 is turned on. . Further, the correction processing shown in FIG. 21 is executed by the CPU 61 at regular timing such as once a day at midnight. Further, the log table update process shown in FIG. 22 is executed by the CPU 61 after the correction process shown in FIG.

  Note that the correction processing illustrated in FIG. 21 may be executed in series on the table corresponding to each terminal 212 or may be executed in parallel. Also, the log table update process shown in FIG. 22 may be executed in series for the table corresponding to each terminal 212 or may be executed in parallel.

  In step S <b> 40 of the person-in-charge recording process illustrated in FIG. 19, the acquisition unit 220 waits until the person-in-charge input date / time transmitted from the terminal 212 and the person-in-charge name input in the input area 18 are received. When the person in charge input date and person name transmitted from the terminal 212 are acquired by the acquisition unit 220 via the network I / F 66, the determination in step S40 is affirmative, and the process proceeds to step S42. .

  In step S42, the acquisition unit 220 records the person-in-charge input date and the person-in-charge name acquired in step S40 in the person-in-charge table 42 corresponding to the terminal 212 that is the source of the person-in-charge input date and person in charge. When the process of step S42 ends, the process returns to step S40.

  In step S50 of the authentication recording process illustrated in FIG. 20, the acquisition unit 220 waits until receiving the authentication date and time transmitted from the terminal 212 and the operator identification information used for authentication. If the acquisition unit 220 acquires the authentication date and time and identification information transmitted from the terminal 212 via the network I / F 66, the determination in step S50 is affirmative, and the process proceeds to step S52.

  In step S52, the acquisition unit 220 records the authentication date / time and the identification information acquired in step S50 in the authentication login table 246 corresponding to the authentication date / time and identification information transmission source terminal 212. When the process of step S52 ends, the process returns to step S50.

  In step S60 of the correction process shown in FIG. 21, the recording unit 224 reads all the records in the person-in-charge table 42 and the authentication login table 246, rearranges them in time series using the date / time column, and records them in the combination table 248. In the next step S62, as described above, the recording unit 224 sets the earliest date / time as the start date / time and the latest date / time as the end date / time for the record in which the same operator in the join table 248 continues, and the start date / time, end date / time. , And the operator is recorded in the first operator table 250. Further, the recording unit 224 sets the start date / time, the end date / time, and the operator to the first operator table 250 for the records in which the same operator in the combination table 248 is not consecutive, using the date / time of the record as the start date / time and end date / time. Record.

  In the next step S64, the recording unit 224 substitutes “1” for a variable N used as a counter. In the next step S <b> 66, the recording unit 224 reads the Nth record in the first operator table 250. In the next step S68, the extraction unit 222 determines whether or not a record with a date and time within a predetermined period before the start date and time of the record read in step S66 exists in the operation table 40. If this determination is negative, the process proceeds to step S74. If the determination is affirmative, the process proceeds to step S70.

  In step S70, the extraction unit 222 extracts, from the operation table 40, a record having a date and time within a predetermined period before the start date and time of the record read in step S66. In the next step S72, the recording unit 224 corrects the start date and time of the record read in step S66 to the date and time of the record extracted in step S70. In the present embodiment, when a plurality of records are extracted in step S70, the recording unit 224 sets the start date / time of the record read in step S66 as the earliest date / time among the plurality of extracted records. Correct the date and time of the record.

  In step S74, the extraction unit 222 determines whether or not there is a record in the operation table 40 with a date and time within a predetermined period after the end date and time of the record read in step S66. If this determination is negative, the process proceeds to step S80. If the determination is affirmative, the process proceeds to step S76.

  In step S76, the extraction unit 222 extracts, from the operation table 40, a record with a date and time within a predetermined period after the end date and time of the record read in step S66. In the next step S78, the recording unit 224 corrects the end date and time of the record read in step S66 to the date and time of the record extracted in step S76. In the present embodiment, when a plurality of records are extracted in step S76, the recording unit 224 sets the end date / time of the record read in step S66 as the latest date / time among the plurality of extracted records. Correct the date and time of the record.

  In step S80, the recording unit 224 records the record read in step S66 and subjected to the processing from step S68 to step S78 in the second operator table 252. In the next step S <b> 82, the recording unit 224 adds “1” to the variable N. In the next step S84, the recording unit 224 determines whether or not the processing from step S66 to step S82 has been completed for all the records in the first operator table 250. If this determination is negative, the process returns to step S66. If the determination is affirmative, the process proceeds to step S86.

  In the next step S86, the recording unit 224 reads each record of the second operator table 252 as described above. Then, as described above, the recording unit 224 corrects the start date / time and end date / time of each read record based on the operation table 40, the other event log table 254, and the position information table 256, thereby correcting the third operator. Record in table 258. When the process of step S86 ends, the correction process ends.

  In step S100 of the log table update process shown in FIG. 22, the recording unit 224 substitutes “1” for a variable M used as a counter. In the next step S102, the recording unit 224 reads the Mth record in the third operator table 258.

  In the next step S104, the recording unit 224 determines whether or not the event log table 254 includes a record having a date and time included in the period from the start date and time to the end date and time of the record read in step S102. If this determination is negative, the process proceeds to step S108. If the determination is affirmative, the process proceeds to step S106.

  In step S106, the operator of the record read in step S102 is recorded in the operator of the date and time included in the period from the start date and time to the end date and time of the record read in step S102 in the event log table 254. To do.

  In step S <b> 108, the recording unit 224 adds “1” to the variable M. In the next step S110, the recording unit 224 determines whether or not the processing from step S102 to step S108 has been completed for all the records in the third operator table 258. If this determination is negative, the process returns to step S102. If the determination is affirmative, this log table update process ends.

  As described above, according to the present embodiment, the operation information recording device 214, when the person in charge name input to the input area 18 continuously indicates the same person in charge name, Among them, operation information within a predetermined period before the earliest time is extracted. Further, in this case, the operation information recording device 214 extracts operation information within a predetermined period after the latest time among the times when the input is continuously received.

  Further, the operation information recording device 214 sets the time of the operation information corresponding to the earliest time as the start time when the operation on the terminal 212 is started, and the time of the operation information corresponding to the latest time as the operation of the terminal 212. It is the finished end time. Then, the operation information recording device 214 records the start time and the end time in association with the operator identification information. Therefore, an operator who has performed a specific operation on the terminal 212 can be easily specified.

  Further, according to the present embodiment, the operation information recording device 214 corresponds to a period corresponding to the authenticated time when the operator is authenticated by software that authenticates the operator operating on the OS of the terminal 212. The operation information to be extracted is further extracted. Therefore, an operator who has performed a specific operation on the terminal 212 can be specified with high accuracy.

  In each of the above embodiments, the case where each table other than the position information table 256 is prepared for each terminal 12 (212) has been described, but the present invention is not limited to this. For example, each table other than the position information table 256 may be prepared one by one. In this case, an example in which an identification information sequence for uniquely identifying the terminal 12 (212) is provided in each table and the record in each table corresponds to which terminal 12 (212) is exemplified.

  Moreover, although each said embodiment demonstrated the case where the acquisition part 20 (220) acquires the person in charge input date and person name transmitted from the terminal 12 (212), it is not limited to this. For example, the acquisition unit 20 (220) may acquire the person-in-charge input date and person-in-charge name from the log output by the electronic medical record software.

  In the second embodiment, the case where the acquisition unit 220 acquires the authentication date and time and the operator identification information used for authentication transmitted from the terminal 212 has been described. However, the present invention is not limited to this. For example, the acquisition unit 220 may acquire the authentication date and time and the identification information of the operator used for authentication from a log output by software that authenticates the operator.

  Moreover, in each said embodiment, it is good also as a form which abbreviate | omits the date of the date of each table where a date is recorded, and records time.

  Moreover, although each said embodiment demonstrated the aspect in which the operation information recording programs 70 and 270 were previously memorize | stored (installed) in the memory | storage part 63, it is not limited to this. The operation information recording programs 70 and 270 can be provided in a form recorded on a recording medium such as a CD-ROM, a DVD-ROM, a USB memory, or a memory card.

  Regarding the above embodiments, the following additional notes are disclosed.

(Appendix 1)
Obtain information that identifies the operation on the information processing device,
When receiving the input of the operator identification information to the specific area included in the screen of the software operating on the operating system of the information processing apparatus, at the time when the input is received among the information specifying the acquired operation Extract information that identifies the operation corresponding to the time period,
Information that identifies the extracted operation is recorded in association with the received identification information of the operator.
An operation information recording program causing a computer to execute processing.

(Appendix 2)
When the identification information of the operator input to the specific area indicates the same operator continuously, the operation within a predetermined period before the earliest time among the times when the input is continuously received is specified. Extracting information to identify the operation within a predetermined period after the latest time,
The time of information specifying the operation corresponding to the earliest time is set as the start time when the operation on the information processing device is started, and the time of information specifying the operation corresponding to the latest time is set as the information processing device. Recording the start time and the end time in association with the identification information of the operator as the end time when the operation for
The operation information recording program according to supplementary note 1, wherein:

(Appendix 3)
When a plurality of pieces of information specifying the operation corresponding to the earliest time are extracted, information specifying the operation corresponding to the latest time is set as the start time of the information specifying the operation at the earliest time. A plurality of the times, the time of the information specifying the operation at the latest time is set as the end time, and the start time and the end time are recorded in association with the identification information of the operator.
The operation information recording program according to Supplementary Note 2, wherein

(Appendix 4)
If the operator is authenticated by software that authenticates the operator operating on the operating system of the information processing apparatus, further extract information specifying an operation corresponding to a period corresponding to the authenticated time,
Information that identifies the extracted operation is further recorded in association with the identified identification information of the operator.
The operation information recording program according to any one of Supplementary Note 1 to Supplementary Note 3, wherein

(Appendix 5)
An acquisition unit for acquiring information for specifying an operation on the information processing apparatus;
When input of operator identification information to a specific area included in a screen of software operating on the operating system of the information processing apparatus is received, the input among the information specifying the operation acquired by the acquisition unit An extractor for extracting information for identifying an operation corresponding to a period according to the time when
A recording unit that records information identifying the operation extracted by the extraction unit in association with the received identification information of the operator;
An operation information recording apparatus comprising:

(Appendix 6)
In the case where the identification information of the operator input to the specific region indicates the same operator continuously, the extraction unit is within a predetermined period before the earliest time among the times when the input is continuously received Extracting information for specifying the operation of, and extracting information for specifying the operation within a predetermined period after the latest time,
The recording unit sets a time of information specifying the operation corresponding to the earliest time as a start time when an operation on the information processing apparatus is started, and a time of information specifying the operation corresponding to the latest time As the end time when the operation on the information processing apparatus is ended, the start time and the end time are recorded in association with the identification information of the operator.
The operation information recording device according to appendix 5, characterized in that:

(Appendix 7)
When a plurality of pieces of information specifying the operation corresponding to the earliest time are extracted, the recording unit sets the time of information specifying the operation at the earliest time as the start time, and corresponds to the latest time When a plurality of pieces of information specifying the operation are extracted, the start time and the end time are recorded in association with the identification information of the operator, with the time of the information specifying the latest operation as the end time. To
The operation information recording device according to appendix 6, characterized in that:

(Appendix 8)
When the operator is authenticated by software that authenticates the operator operating on the operating system of the information processing apparatus, the extraction unit stores information that specifies an operation corresponding to a period corresponding to the authenticated time. Extract further,
The recording unit further records information identifying the operation extracted by the extraction unit in association with the authenticated identification information of the operator;
The operation information recording device according to any one of appendix 5 to appendix 7, characterized in that:

(Appendix 9)
Obtain information that identifies the operation on the information processing device,
When receiving the input of the operator identification information to the specific area included in the screen of the software operating on the operating system of the information processing apparatus, at the time when the input is received among the information specifying the acquired operation Extract information that identifies the operation corresponding to the time period,
Information that identifies the extracted operation is recorded in association with the received identification information of the operator.
An operation information recording method, wherein the computer executes processing.

(Appendix 10)
When the identification information of the operator input to the specific area indicates the same operator continuously, the operation within a predetermined period before the earliest time among the times when the input is continuously received is specified. Extracting information to identify the operation within a predetermined period after the latest time,
The time of information specifying the operation corresponding to the earliest time is set as the start time when the operation on the information processing device is started, and the time of information specifying the operation corresponding to the latest time is set as the information processing device. Recording the start time and the end time in association with the identification information of the operator as the end time when the operation for
The operation information recording method according to appendix 9, characterized in that:

(Appendix 11)
When a plurality of pieces of information specifying the operation corresponding to the earliest time are extracted, information specifying the operation corresponding to the latest time is set as the start time of the information specifying the operation at the earliest time. A plurality of the times, the time of the information specifying the operation at the latest time is set as the end time, and the start time and the end time are recorded in association with the identification information of the operator.
The operation information recording method according to supplementary note 10, wherein:

(Appendix 12)
If the operator is authenticated by software that authenticates the operator operating on the operating system of the information processing apparatus, further extract information specifying an operation corresponding to a period corresponding to the authenticated time,
Information that identifies the extracted operation is further recorded in association with the identified identification information of the operator.
The operation information recording method according to any one of Supplementary Note 9 to Supplementary Note 11, wherein:

(Appendix 13)
Obtain information that identifies the operation on the information processing device,
When receiving the input of the operator identification information to the specific area included in the screen of the software operating on the operating system of the information processing apparatus, at the time when the input is received among the information specifying the acquired operation Extract information that identifies the operation corresponding to the time period,
Information that identifies the extracted operation is recorded in association with the received identification information of the operator.
A storage medium storing an operation information recording program characterized by causing a computer to execute processing.

10, 210 Medical information system 12, 212 Terminal 14, 214 Operation information recording device 18 Input area 20, 220 Acquisition unit 22, 222 Extraction unit 24, 224 Recording unit 40 Operation table 42 Person in charge table 44 Operator table 61 CPU
62 memory 63 storage unit 68 recording medium 70, 270 operation information recording program 246 authentication login table 248 connection table 250 first operator table 252 second operator table 254 event log table 256 position information table 258 third operator table

Claims (6)

Obtain information that identifies the operation on the information processing device,
When receiving the input of the operator identification information to the specific area included in the screen of the software operating on the operating system of the information processing apparatus, at the time when the input is received among the information specifying the acquired operation Extract information that identifies the operation corresponding to the time period,
Information that identifies the extracted operation is recorded in association with the received identification information of the operator.
An operation information recording program causing a computer to execute processing. When the identification information of the operator input to the specific area indicates the same operator continuously, the operation within a predetermined period before the earliest time among the times when the input is continuously received is specified. Extracting information to identify the operation within a predetermined period after the latest time,
The time of information specifying the operation corresponding to the earliest time is set as the start time when the operation on the information processing device is started, and the time of information specifying the operation corresponding to the latest time is set as the information processing device. Recording the start time and the end time in association with the identification information of the operator as the end time when the operation for
The operation information recording program according to claim 1, wherein: When a plurality of pieces of information specifying the operation corresponding to the earliest time are extracted, information specifying the operation corresponding to the latest time is set as the start time of the information specifying the operation at the earliest time. A plurality of the times, the time of the information specifying the operation at the latest time is set as the end time, and the start time and the end time are recorded in association with the identification information of the operator.
The operation information recording program according to claim 2, wherein: If the operator is authenticated by software that authenticates the operator operating on the operating system of the information processing apparatus, further extract information specifying an operation corresponding to a period corresponding to the authenticated time,
Information that identifies the extracted operation is further recorded in association with the identified identification information of the operator.
The operation information recording program according to any one of claims 1 to 3, wherein the operation information recording program is recorded. An acquisition unit for acquiring information for specifying an operation on the information processing apparatus;
When input of operator identification information to a specific area included in a screen of software operating on the operating system of the information processing apparatus is received, the input among the information specifying the operation acquired by the acquisition unit An extractor for extracting information for identifying an operation corresponding to a period according to the time when
A recording unit that records information identifying the operation extracted by the extraction unit in association with the received identification information of the operator;
An operation information recording apparatus comprising: Obtain information that identifies the operation on the information processing device,
When receiving the input of the operator identification information to the specific area included in the screen of the software operating on the operating system of the information processing apparatus, at the time when the input is received among the information specifying the acquired operation Extract information that identifies the operation corresponding to the time period,
Information that identifies the extracted operation is recorded in association with the received identification information of the operator.
An operation information recording method, wherein the computer executes processing.