JP3814215B2 - General network system in hospital, terminal management apparatus for patient, terminal management method for patient, and program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an in-hospital integrated network system, a patient terminal management apparatus, a patient terminal management method, and a program. In particular, hospital staff can use a hospital business system and a communication network, and inpatients can communicate with each other. The present invention relates to an in-hospital comprehensive network system, a patient terminal management apparatus, a patient terminal management method, and a program that can be connected to a line network.
[0002]
[Prior art]
In recent years, IT is also progressing in hospitals. Create medical information database generated in hospitals such as electronic medical record database, medical office database, drug inventory management database, examination information management database, etc., and construct in-hospital business computer network such as LAN in hospital to identify each department Information systems such as an electronic medical record system and a medical office system that can input and browse medical information from a terminal computer installed in a department are generally used.
Usually, an intranet is laid for the use of staff including doctors, and a line is laid so that the Internet can be used from a terminal computer in the hospital business computer network.
[0003]
On the other hand, patients who are admitted to the hospital can obtain information on the outside world outside the hospital by watching a coin-operated TV set up in the hospital room, by talking to a visitor who came to the hospital, by a letter with an acquaintance. There is a method to exchange.
[0004]
[Problems to be solved by the invention]
However, for patients admitted to the hospital, the means of acquiring information from the outside world is limited to information from the television and conversations with visitors, and there is a problem that it is difficult to acquire information from the general public.
Although it is possible to lay a separate internet line in the hospital for inpatients, it is costly to lay the line and requires a lot of labor to manage and maintain the line. There was a problem.
[0005]
In addition, there are times when the hospital Internet line is not used, and this line can also be used for the Internet connection of hospitalized patients. However, because the hospital Internet line is usually connected to the intranet, if there is some knowledge about the network for inpatients, there is a possibility that the terminal computer for Internet can access the hospital business computer network. In addition, there is a problem that it is difficult to secure the security of the in-hospital business computer network including personal information.
[0006]
The present invention has been made in view of the above problems, and an object of the present invention is to make it possible for an inpatient to use the Internet by using a line to the existing Internet of a hospital, and to use an in-hospital computer network. In-hospital network system, patient terminal management apparatus, patient terminal management method, and program can be isolated from inpatient terminal computer side.
Still another object of the present invention is to provide an in-hospital comprehensive network system, a patient terminal management device, a patient terminal management method, and a program capable of ensuring a regular revenue source of the hospital while effectively using the hospital line. There is.
[0007]
[Means for Solving the Problems]
According to the first aspect of the present invention, the connection from the hospital computer network to the public communication network and the connection from the patient terminal computer to the public communication network are performed using the same line. An in-hospital integrated network system, an in-hospital business computer network connected to a public communication network, a firewall server computer installed between the public communication network and the in-hospital computer network, and the firewall server And at least one filtering bridge connected in parallel with the in-hospital business computer network. The filtering bridge is connected to a terminal connection means for connecting a terminal computer in a hospital room, and the connection means. The terminal computer An address registration unit that stores the set IP address, and a passage permission unit that allows the data to pass through the filtering bridge in a predetermined case, and the passage permission unit includes: When the combination of the data destination IP address and the source IP address is a combination of the IP address set by the address registration means and the IP address of the computer outside the firewall, the data is allowed to pass. Is solved.
[0008]
According to the invention according to claim 4, the subject is a patient terminal that manages the connection from the patient terminal computer to the public communication line network using the line connected from the in-hospital business computer network to the public communication line network. A storage device for storing a program defining the operation of the management device; a server for creating information; an input device for accepting information from outside; an output device for sending information to the outside; And / or a central processing unit that calculates using the information received from the input device and passes the calculated result to the storage device or / and the output device, between the public communication line network and the hospital business computer network Connected to the firewall server computer installed in parallel with the in-hospital business computer network. Terminal connection means for connecting a computer, IP address setting for the terminal computer connected to the connection means, address registration means for storing the set IP address, and data passing in a predetermined case Pass permission means for permitting the transmission, and the passage permission means includes a combination of a data transmission destination IP address and a transmission source IP address, the IP address set by the address registration means and a computer outside the firewall. In the case of a combination with an IP address, the problem is solved by allowing data to pass through.
[0009]
According to the seventh aspect of the present invention, there is provided a patient terminal for managing a connection from a terminal computer for a patient to a public communication line network using a line connected from the in-hospital business computer network to the public communication line network. A management method comprising: installing at least one filtering bridge in parallel with the hospital business computer network in a firewall server computer installed between a public communication line network and the hospital business computer network; and the filtering bridge A procedure for connecting a terminal computer in a hospital room to the terminal connection means, an address registration procedure in which the filtering bridge sets an IP address in the terminal computer and stores the set IP address, and a data transmission destination IP Address and source IP address And a passage permission procedure for allowing the data to pass through the filtering bridge when the combination is an IP address set in the address registration procedure and an IP address of a computer outside the firewall, It is solved by doing.
[0010]
According to the invention according to claim 10, the subject is a patient terminal that manages connection from a terminal computer for a patient to a public communication line network using a line connecting from the hospital business computer network to the public communication line network. In the management device, an IP address is set in the terminal computer connected to the terminal connection means of the patient terminal management device, the address registration procedure for storing the set IP address, the data transmission destination IP address and the transmission source IP A passage permission procedure for permitting data to pass through the patient terminal management apparatus when the combination of the address is a combination of the IP address set in the address registration procedure and the IP address of the computer outside the firewall Is solved by a program for executing
[0011]
As described above, in the passage permission unit, the combination of the data transmission destination IP address and the transmission source IP address is a combination of the IP address set by the address registration unit and the IP address of the computer outside the firewall. In addition, since it is configured to permit the passage of data, it is possible to prohibit the access from the terminal computer of the patient to the information of the hospital business computer network installed inside the firewall.
In addition, when a patient sets an IP address on the terminal computer himself / herself, it becomes impossible to transmit / receive data, so that it is possible to prevent the patient from setting an IP address on the terminal computer himself / herself and the IP address is duplicated. Can be prevented.
[0012]
Further, since the filtering bridge includes an address registration means for setting an IP address in the terminal computer and storing the set IP address, it becomes possible to prevent the patient from setting an IP address in the terminal computer by himself. It is possible to prevent duplicate addresses.
Moreover, since the filtering bridge includes terminal connection means for connecting a terminal computer in the hospital room, the patient can bring his / her computer accustomed to the operation into the hospital room and continue to use it. .
[0013]
At this time, it is preferable that the filtering bridge is configured to transmit the data directly to the firewall when the source IP address of the data is an IP address set by the address registration unit.
[0014]
Because of this configuration, all data sent from the terminal computer in the hospital room is sent directly to the firewall and is no longer sent to other computers inside the firewall. Access to information on the business computer network from the patient's terminal computer can be prohibited.
[0015]
At this time, a system management server computer storing a program for operating the filtering bridge is connected to the firewall via a public communication network, and between the firewall and the filtering bridge, A router is connected, and the filtering bridge includes setup request means for transmitting a setup request to the router. The router receives the setup request received from the filtering bridge, and sends a setup command to the systems management server computer. The system management server computer transmits a program to the filtering bridge in response to the setup command. It is preferable to configured with.
[0016]
As described above, the filtering bridge includes a setup request unit that transmits a setup request to the router, and the systems management server computer includes a program transmission unit that transmits the program to the filtering bridge in response to the setup request. Therefore, it is not necessary to store a program for operating the filtering bridge in the filtering bridge in the initialized state, and management of the program becomes easy. In addition, even when the program is upgraded, it can be transmitted directly from the systems management server computer.
Further, since the router is connected between the firewall and the filtering bridge, the system management server computer connected via the public communication line network can transmit the program to the filtering bridge.
[0017]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The configurations described below do not limit the present invention and can be variously modified within the scope of the gist of the present invention.
In this specification, “computer” means to include all information terminals provided with an arithmetic device. For example, in addition to a supercomputer, a general-purpose computer, an office computer, a control computer, a workstation, a personal computer, a mobile information terminal, a mobile phone equipped with a computing device, and the like are also included.
[0018]
The “program” in the present specification can be downloaded and uploaded using a communication line network, and can be recorded and distributed on a storage medium.
The storage medium refers to a computer-readable storage medium such as a flexible disk, a magneto-optical disk, a CD, or a DVD for installation, execution, distribution, etc., and stores the program according to the present invention.
The Internet 6 corresponds to the public communication line network in the claims.
[0019]
An in-hospital comprehensive network system 1 of this embodiment is a comprehensive network system for hospitals constructed between a hospital H and a system management organization 5, and includes an in-hospital business network in a staff area 2 and a patient terminal computer. In this system, the Internet 6 can be used from the terminal computer 42 of the patient in the hospital room 4 through the line 9 for the Internet 6 of the hospital work network while isolating information from the terminal 42.
[0020]
The configuration of the in-hospital comprehensive network system 1 according to the present embodiment will be described with reference to FIGS. FIG. 1 shows a main configuration of an in-hospital comprehensive network system 1 according to the present embodiment.
The in-hospital comprehensive network system 1 of the present embodiment is constructed between the hospital H and a system management organization 5 that manages and manages the in-hospital comprehensive network system 1.
First, the configuration in the hospital H will be described.
In the hospital H, a staff area 2 where the hospital staff 20 operates, an internet room 3 where the internet terminal user 30 can use the internet, and a hospital room 4 where the inpatient 40 stays are provided.
[0021]
Hospital staff area 2 includes hospital H examination rooms, examination rooms, waiting rooms for doctors, engineers, etc., nurse centers, conference rooms, and other medical areas, and hospital H offices, pharmacies, accounting centers, etc. It is.
[0022]
In the medical field area, medical staff are working. The medical staff refers to those who are engaged in medical care, such as doctors, nurses, nurses, laboratory technicians, among the hospital staff 20.
[0023]
In the office area, office staff are working. The office staff refers to the staff who performs various office work in the hospital H, including the hospital staff 20 who performs medical office work, the staff of the pharmacy including the pharmacist, the staff of the general affairs section, and the like.
[0024]
In the staff area 2, an in-hospital server computer 21 and a plurality of staff terminal computers 22 are installed. The staff terminal computer 22 is configured to be usable by medical staff and office staff.
[0025]
The in-hospital server computer 21 is a server computer that supervises an in-hospital business system. Specifically, an electronic medical record database server that registers the electronic medical records for each patient, a medical knowledge database server that registers the latest medical technologies and know-how of hospital H, medical expenses related to medical practices, insurance costs, and patient costs Medical fee server of medical fee database that registers information such as expenses, medical fee statement (receipt), accounting system in hospital H, personnel / labor management system, drug inventory management, various component delivery records, financial management, etc. Includes a database server that stores other medical service information.
Those who are permitted to access each server among the hospital staff 20 can access the in-hospital server computer 21 from the terminal computer 22 for staff, and can browse and input each server.
The staff terminal computer 22 can be connected to the external Internet 6 through the line 9.
[0026]
An inpatient 40 stays in the hospital room 4.
In the hospital room 4, a port 45 a is installed as a terminal connection means capable of connecting the terminal computer 42 brought in by the hospitalized patient 40. The inpatient 40 is connected to the external Internet 6 through the line 9 by connecting the terminal computer 42 to the port 45a, and is set to be able to use electronic mail and the Internet 6.
[0027]
The inpatient 40 can contact an acquaintance or family member outside the hospital H by e-mail using the terminal computer 42. Further, various information collection, article purchase, securities trading, transactions, and the like can be performed using the Internet 6.
Further, the inpatient 40 can use the terminal computer 42 to connect to the store server computer 71 of the store 7 via the Internet 6 and purchase goods using a product ordering system provided by the store 7. .
[0028]
The internet room 3 in the hospital H can be used by an unspecified number of terminal users 30 including inpatients 40, outpatients, visitors, and hospital staff 20.
In the Internet room 3, a prepaid card type Web computer 32 that can be connected to the Internet 6 is installed.
The terminal user 30 is connected to the external Internet 6 through the line 9 using the Web computer 32, and is set to be able to use electronic mail and the Internet 6.
[0029]
The hospital management side 8 is the management side of the hospital H where the in-hospital comprehensive network system 1 is constructed. The hospital management side 8 requests the system management organization 5 to construct and manage the in-hospital comprehensive network system 1.
The system management organization 5 receives a construction service and a management service for the in-hospital comprehensive network system 1 and pays for these services.
[0030]
The system management organization 5 is an organization separate from the hospital H, and provides a construction service and a management service for the in-hospital integrated network system 1 to the hospital H in response to a request from the hospital management side 8. The system management organization 5 receives payment of construction and management costs for the hospital internal network system 1 from the hospital management side 8.
[0031]
In the system management organization 5, an SMS (Systems Management Server) server computer 54 is installed. The system management organization 5 manages and operates the filtering bridge 45 installed in the hospital H with the SMS server computer 54, thereby operating the in-hospital comprehensive network system 1 of this embodiment from outside the hospital H.
That is, the SMS server computer 54 monitors and manages the filtering bridge 45 that performs IP address assignment, connection range setting, billing management, and bandwidth limitation management of the terminal computer 42.
[0032]
When the Internet 6 is first connected from the terminal computer 42 in the hospital room 4, the SMS server computer 54 transmits a firmware set including a program for operating the filtering bridge 45.
Further, failure monitoring is performed by periodically transmitting failure monitoring packets to each filtering bridge 45.
If necessary, the amount of packets passing through the Internet 6 connection is received from the filtering bridge 45 and the Internet usage fee is calculated.
After leaving the hospitalized patient 40, the filtering bridge 45 is reinitialized in preparation for the next use of the hospitalized patient 40.
[0033]
The store 7 is a store that sells daily items such as towels, toiletries, newspapers, magazines, etc., and nursing items such as confectionery, absorbent cotton, and bandages in the hospital H. A store server computer 71 is installed in the store 7. The store server computer 71 is a computer that supervises the product ordering system provided by the store 7, and is composed of a WWW server computer. The merchandise ordering system provided by the store 7 is a system for hospitalized patients 40 of the hospital H that can order merchandise through the Internet 6.
[0034]
The store server computer 71 provides a homepage for ordering products. The hospitalized patient 40 is registered in advance with a user name and password on the user registration screen of the homepage, and by entering the user name and password of the inpatient 40, it is possible to access the homepage and order products. It is configured. When an in-patient 40 orders a product on this homepage, the store 7 orders a product from a wholesale store or the like. When the product arrives at the store 7, the store 7 notifies the hospitalized patient 40 that the product has arrived by e-mail.
The hospitalized patient 40 who has received this communication goes to the store 7 to receive the goods and pay the price. In addition, the delivery of goods may be delivered to the hospital room 4 by a person at the store 7.
[0035]
Next, a specific configuration of the in-hospital comprehensive network system 1 according to this embodiment will be described with reference to FIG.
An in-hospital network system 1 according to this embodiment includes a firewall server computer 10 installed between the Internet 6 and the in-hospital network system 1 and an in-hospital server that supervises an in-hospital business system installed in the staff area 2. The computer 21, the filtering bridge 45 and the router 46 installed in the hospital H, the port 45 a for connecting the terminal computer 42 installed in the hospital room 4, the Web computer 32 installed in the Internet room 3, and the filtering bridge 45 The SMS server computer 54 that manages the above is the main component.
Hereinafter, this component will be described.
[0036]
The firewall server computer 10 is installed in the hospital H. It is a server computer for security measures installed between the Internet 6 and the hospital business network. All communication requests from users on the Internet 6 are monitored to prevent unauthorized data from entering the in-hospital business network in the hospital H, and information on the in-hospital business network being altered by a third party in advance. It is something to prevent.
Here, the in-hospital business network corresponds to the in-hospital business computer network.
[0037]
As the firewall server computer 10, a known firewall server computer having functions such as a packet filtering function, a gateway function, and a proxy function is used.
The firewall 10 is provided with three ports 10a to 10c. The port 10 a is connected to the Internet line 9 outside the hospital H.
[0038]
The port 10b is connected via a router 24 to an in-hospital server computer 21 that supervises an in-hospital business system.
The router 24 is a device that relays between different networks, and performs mutual network protocol and address conversion. A known router is used as the router 24.
The port 10 c is connected to the port 11 a of the hub 11. The hub 11 includes ports 11b and 11c in addition to the port 11a. A wiring toward the terminal computer 42 in the hospital room 4 is connected to the port 11b, and a wiring toward the Web computer 32 in the Internet room 3 is connected to the port 11c.
[0039]
In the hospital staff area 2, an in-hospital business network for the hospital staff 20 is laid. At least one hospital server computer 21 and a plurality of staff terminal computers 22 are connected to the hospital business network. In this embodiment, the in-hospital business network is constructed with Ethernet (registered trademark) having a bus network structure.
The in-hospital server computer 21 controls the in-hospital business system and is an existing server computer already installed in the hospital H.
The in-hospital server computer 21 is configured so that a person registered in advance can access only from a computer in the in-hospital business network by inputting a user name and a password.
[0040]
The staff terminal computer 22 is a general personal computer. In addition to the department in the hospital H, a hospital staff 30 such as a diagnosis room or a treatment room is installed in a place where business is performed, and a person who has been registered as a user in advance enters the hospital server computer 21 by entering a user name and password. Is accessible.
The staff terminal computer 22 is configured to be connected to the Internet 6 via the line 9 via the router 24 and the firewall 10.
[0041]
A hub 34 and a plurality of Web computers 32 are installed in the Internet room 3.
The hub 34 is connected to the port 11 c of the hub 11. The plurality of Web computers 32 are respectively connected to different ports of the hub 34 and are connected to the firewall server computer 10 via the hub 34 and the hub 11.
The Web computer 32 is a computer having only a browser, and the terminal user 30 can use only the Internet 6 with the Web computer 32. Therefore, the terminal user 30 who uses the Web computer 32 cannot access other computers in the hospital H.
[0042]
Each web computer 32 is connected to a card reader 33. The card reader 33 is a device that subtracts an amount corresponding to a connection time or a packet from a prepaid card in which a predetermined amount is registered in advance.
The card reader 33 includes a CPU, a recording device, and a card reading device. When the card is inserted into the card reading device, the remaining amount of the card is read. If the remaining amount of the card is not 0, the Web computer 32 is turned on.
When the power is turned on, the Web computer 32 starts up a browser, accesses a provider server computer (not shown), and starts connection to the Internet 6.
[0043]
The web computer 32 counts the packet flow rate through a communication device (not shown) in the web computer 32 and transmits a signal indicating that the packet flow rate has reached the unit amount to the card reader 33 every time the packet flow rate reaches the unit amount. The card reader 33 subtracts the unit amount from the prepaid card for each unit amount of the packet, and collects the Internet connection fee from the user of the Web computer 32.
Further, the card reader 33 may be configured to charge for each time instead of charging for each packet. That is, the Web computer 32 transmits a connection start signal and a connection end signal to the card reader 33 at the start of connection to the Internet 6 and at the end of connection. When the card reader 33 receives the connection start signal, the card reader 33 sets a timer and subtracts the unit amount per unit time from the prepaid card every time the unit time elapses after the timer is set. When the connection end signal is received, the timer is cleared.
[0044]
In hospital H, a plurality of filtering bridges 45 are installed.
The hardware configuration of each filtering bridge 45 will be described with reference to FIG.
The filtering bridge 45 includes a CPU 60 as a data calculation / control processing device, a RAM 61 as a storage device, a ROM 62, and an HDD 63. The CPU 60 executes various processes according to programs stored in the ROM 62 or the HDD 63. The RAM 61 appropriately stores data necessary for the CPU 60 to execute various processes.
The communication device 64 transmits data to the outside and receives data supplied from the outside.
[0045]
Each filtering bridge 45 is connected to a port 45a to which a terminal computer 42 can be connected. The port 45 a is installed in the hospital room 4 at the bedside of the inpatient 40.
As the terminal computer 42, it is possible to connect a general personal computer, and a computer brought by the inpatient 40 is usually used.
The filtering bridge 45 is connected to the firewall server computer 10 via the hub 44. A router 46 is connected to the hub 44.
The filtering bridge 45 and the port 45a are provided for each hospital room, and are configured to branch from the hub 44 to each filtering bridge 45.
[0046]
In the initialized state, the MAC address of the router 46 and the setup request signal are stored in the HDD 63 of the filtering bridge 45. In the initialized state, the firmware for operating the filtering bridge 45 is not registered in any of the RAM 61, the ROM 62, and the HDD 63.
[0047]
The necessary number of filtering bridges 45 corresponding to each hospital room 4 is installed when the in-hospital comprehensive network system 1 of the present embodiment is constructed.
After the installation, if there is no inpatient in the hospital room 4 or if the inpatient does not connect the terminal computer 42, it is left in an initialized state.
When an inpatient in the hospital room 4 uses the in-hospital network system 1 with the terminal computer 42, the firmware set is downloaded from the SMS server computer 54 to the filtering bridge 45, and the terminal computer 42 is made usable. .
[0048]
The filtering bridge 45 performs IP address assignment, security management, charging management, and bandwidth limitation management for the connected terminal computer 42.
That is, the filtering bridge 45 gives an IP address to the terminal computer 42 connected to the port 45a. The terminal computer 42 is configured not to be assigned an IP address.
As the security management, the terminal computer 42 can be connected only to computers outside the firewall 10. Accordingly, the inpatient 40 is configured not to be connected from the terminal computer 42 to the terminal computer 42 of the other inpatient 40, the hospital server computer 21, or the Web computer 32 of the Internet room 3.
[0049]
As the charge management, the amount of packets passing through the filtering bridge 45 for the connection of the terminal computer 42 to the Internet 6 is counted, and the amount of packets passed and the communication time data are stored in the ROM 62.
In this embodiment, the passing packet amount data is accumulated in the filtering bridge 45, the passing packet amount data is transmitted to the SMS server computer 54 as necessary, and the Internet usage fee is calculated on the SMS server computer 54 side. Although configured as described above, a card reader may be connected to the filtering bridge 45 or the port 45a, and the Internet usage fee may be collected in real time from a prepaid card or a credit card with this card reader.
[0050]
At this time, a hub may be connected between the card reader and the filtering bridge 45, and the hub may be turned on when a remaining card is inserted into the card reader. As a result, by inserting a card with a remaining balance, the hub is turned on and data can be passed, and the Internet can be connected. When the balance of the card becomes 0 or when the card is not inserted, the hub is turned off and the Internet connection becomes impossible.
[0051]
Further, as the bandwidth limitation management, the data communication speed of the filtering bridge 45 is limited to a speed set by the SMS server computer 54, for example, 10 Mbps or less.
[0052]
The router 46 plays a role of relaying a setup command signal necessary for starting the filtering bridge 45 to the SMS server computer 54. The router 46 includes a CPU, a recording device, and the like.
[0053]
An SMS server computer 54 is installed in the system management organization 5. The SMS server computer 54 manages the filtering bridge 45 and the router 46. Transmission of the program of the filtering bridge 45, IP address setting, failure monitoring, reinitialization, restart (restart), information display, billing management, etc. are performed via the Internet 6.
The SMS server computer 54 includes a CPU (not shown) as a data calculation / control processing device, a RAM, ROM, HDD and storage medium device as storage devices, a keyboard and mouse display device as input devices, and a printer.
[0054]
Next, the operation of the in-hospital comprehensive network system 1 of this embodiment will be described.
When an inpatient 40 in the hospital room 4 makes a request to use the Internet 6 in the in-hospital integrated network system 1, the person in charge of the system management organization 5 instructs the setup on the screen of the SMS server computer 54. Click the button. As a result, the SMS server computer 54 transmits a setup support to the filtering bridge 45.
[0055]
When receiving a setup instruction from the SMS server computer 54, the filtering bridge 45 transmits a setup request signal to the router 46.
Upon receiving the setup command signal, the router 46 transmits a setup request signal to the SMS server computer 54.
When the SMS server computer 54 receives this setup command signal, the SMS server computer 54 transmits a firmware set including a program for operating the filtering bridge 45 to the filtering bridge 45.
The filtering bridge 45 stores this firmware in the ROM 62 and completes the installation.
[0056]
Next, in the hospital room 4, the terminal computer 42 brought by the inpatient 40 is connected to the port 45a, and the terminal computer 42 is turned on.
When the filtering bridge 45 detects that the terminal computer 42 is powered on, the flowchart of FIG. 4 starts. The flowchart of FIG. 4 is executed each time the terminal computer 42 is turned on. Further, it is executed by the CPU 60 of the filtering bridge 45.
[0057]
In step S <b> 1, the filtering bridge 45 transmits a MAC address request command to the terminal computer 42.
Next, in step S2, it is determined whether a MAC address is received from the terminal computer.
If the MAC address has not been received (step S2: NO), it is determined whether a predetermined time has elapsed in step S3.
[0058]
If the predetermined time has elapsed (step S3: YES), the connection between the filtering bridge 45 and the terminal computer 42 may be faulty. In step S4, an error is displayed on the SMS server computer 54 and the process is performed. finish.
The person in charge of the system management organization 5 who sees the error indication goes to the hospital H and confirms the setting, or instructs the inpatient 40 to return by telephone or the like.
If the predetermined time has not elapsed (step S3: NO), it is determined whether a MAC address has been received from the terminal computer 42 in step S2. That is, steps S2 and S3 are repeated until a predetermined time elapses or a MAC address is received.
[0059]
When the MAC address is received (step S2: YES), an address management table that associates the MAC address with the IP address is searched using the MAC address as a key in step S5, and the MAC address is registered in the address management table. Judgment is made.
If the MAC address is registered in the address management table (step S5: YES), it is determined whether or not the IP address received from the terminal computer 42 in step S9 matches the IP address registered in the address management table.
[0060]
If the IP address received from the terminal computer 42 matches the IP address registered in the address management table (step S9: YES), the MAC address is already registered in association with the IP address, and after registration. Since the IP address has not been changed, it is determined that there is no need to register or correct the IP address, and the process ends.
[0061]
If the IP address received from the terminal computer 42 does not match the IP address registered in the address management table (step S9: NO), the IP registered in association with the MAC address in the address management table in step S10. The address is transmitted to the terminal computer 42, and the IP address is set in the terminal computer 42.
As a result, even when an IP address is set by 40 hospitalized patients on the terminal computer 42 side, the filtering bridge 45 can correct the IP address.
Next, the process ends.
[0062]
If the MAC address is not registered in the address management table (step S5: NO), it is the first time that the terminal computer 42 is connected to the filtering bridge 45. Then, one IP address is selected and transmitted to the terminal computer 42, and the IP address is set in the terminal computer 42.
In step S7, the MAC address and IP address of the terminal computer 42 are associated with each other and registered in the address management table of the filtering bridge 45.
[0063]
In step S8, the IP address of the terminal computer 42 is registered in the packet passage tables 45T-1 and 45T-2 for determining whether or not to allow the packet to pass.
An example of the outward packet passage table 45T-1 and the inward packet passage table 45T-2 constituting the packet passage table is shown in FIG.
The outgoing packet passage table 45T-1 in FIG. 5A is a table for determining whether or not the data received from the terminal computer 42 is permitted to pass through the filtering bridge 45. That is, when receiving data from the terminal computer 42, the filtering bridge 45 obtains the transmission source IP address from the IP header of the data packet, compares it with the data in the outgoing packet passage table 45T-1, and transmits the transmission source of the received packet. If the IP address does not match the source IP address 45y of any data in the outgoing packet passage table 45T-1, the data is discarded without allowing the packet to pass.
[0064]
The outgoing packet passage table 45T-1 includes, as items, a relay destination IP address 45x and a transmission source IP address 45y.
In FIG. 5A, the IP address of the firewall 10 is exemplified as “AAAA”, and the IP address set by the filtering bridge 45 in the terminal computer 42 is exemplified as “BBBB”.
[0065]
In the outgoing packet passage table 45T-1, a case where the transmission source IP address is the IP address “BBBB” set in the terminal computer 42 by the filtering bridge 45 is registered as the passage permission data 45m.
[0066]
That is, in the example of FIG. 5A, it is set that the packet passage is not permitted when the source IP address is other than “BBBB” set by the filtering bridge 45. In addition, when data is received from the terminal computer 42 whose relay destination IP address 45x is “AAAA” and whose IP address is “BBBB”, this data is set to be relayed directly to the firewall 10.
[0067]
The inward packet passage table 45T-2 in FIG. 5B is a table for determining whether or not the data received from the firewall 10 side is permitted to pass through the filtering bridge 45. That is, when the filtering bridge 45 receives data from the hub 44 on the firewall 10 side, the filtering bridge 45 acquires the destination IP address from the IP header of the data packet, compares it with the data in the inward packet passage table 45T-2, and receives the received packet. If the destination IP address does not match the destination IP address 45w of any data in the inward packet passage table 45T-2, the packet is not allowed to pass and the data is discarded.
[0068]
The inward packet passage table 45T-2 includes, as items, a relay destination IP address 45z and a transmission destination IP address 45w.
In FIG. 5B, the IP address set in the terminal computer 42 by the filtering bridge 45 is exemplified as “BBBB”.
[0069]
In the inbound packet passage table 45T-2, the case where the transmission destination IP address is the IP address “BBBB” set in the terminal computer 42 by the filtering bridge 45 is registered as the passage permission data 45n.
[0070]
That is, in the example of FIG. 5B, when the transmission destination IP address is other than “BBBB” set by the filtering bridge 45, it is set that the packet passage is not permitted. Further, since the filtering bridge 45 and the terminal computer 42 are directly connected, the relay destination IP address 45z is set to “BBBB” which is the same as the transmission destination IP address 45w.
[0071]
In step S8, the IP address set in step S6 is set to “BBBB” as the transmission source IP address of the outgoing packet passage table 45T-1, and the address “AAAA” of the firewall 10 is set as the relay destination IP address. Further, “BBBB” is set as the transmission destination IP address and relay destination IP address of the inward packet passage table 45T-2.
Thereafter, the process of FIG. 4 is terminated.
Steps S6, 7, and 10 in the flowchart of FIG. 4 correspond to the address registration procedure in the claims.
[0072]
Next, a case where the filtering bridge 45 receives data will be described.
When the filtering bridge 45 receives the data, if the MAC address of the data corresponds to its own MAC address, the filtering bridge 45 holds the data packet in a buffer (not shown) and starts the flowchart of FIG. The flowchart in FIG. 6 is executed by the CPU 60 of the filtering bridge 45.
[0073]
In step S11, the source IP address is acquired from the IP header of the received packet, compared with the outgoing packet passage table 45T-1, and matches the source IP address 45y of the outgoing packet passage table 45T-1. Determine if there is any.
[0074]
If there is a match in the source IP address 45y of the outgoing packet passage table 45T-1 (step S11: YES), the destination IP address is acquired from the IP header of the packet in step S12, and this transmission is performed. It is determined whether the destination IP address is an IP address of a computer in the hospital H inside the firewall 10.
Specifically, an IP network address is referred to among IP addresses, and it is determined whether or not this IP network address is an IP address of any network in hospital H.
[0075]
If the destination IP address is not the IP address of the computer in the hospital H inside the firewall 10 (step S12: NO), the data is addressed to a computer outside the hospital H, and the data is transferred to the firewall 10 in step S13. And the process ends.
[0076]
When the destination IP address is the IP address of the computer in the hospital H inside the firewall 10 (step S12: YES), since the terminal computer 42 in the hospital room 4 is trying to access the computer in the hospital H, For network security management, the packet is discarded in step S16. Next, the process ends.
[0077]
If there is no match in the source IP address 45y of the outgoing packet passage table 45T-1 (step S11: NO), there is a possibility that the data is from the firewall 10, so in step S14, the IP header of the packet The destination IP address is acquired from the list and compared with the inbound packet passage table 45-2 to determine whether there is a match in the destination IP address 45w of the inbound packet passage table 45-2.
[0078]
If there is no match in the destination IP address 45w of the inbound packet passage table 45T-2 (step S14: NO), it is assumed that the data is not addressed to the terminal computer 42 or that the IP address of the terminal computer 42 is incorrect. In step S16, the packet is discarded. Next, the process ends.
If there is a match in the destination IP address 45w of the inbound packet passage table 45T-2 (step S14: YES), it is determined that the correct IP address of the terminal computer 42 has been assigned, and in step S15, the IP header of the packet The source IP address is acquired from the list, and it is determined whether this source IP address is the IP address of the computer in the hospital H inside the firewall 10.
Specifically, an IP network address is referred to among IP addresses, and it is determined whether or not this IP network address is an IP address of any network in hospital H.
[0079]
If the source IP address is not the IP address of the computer in the hospital H inside the firewall 10 (step S15: NO), the data is transmitted from the computer outside the hospital H, and the data is transmitted in step S17. The data is transmitted to the terminal computer 42 having the destination IP address, and the process is terminated.
[0080]
When the transmission source IP address is the IP address of the computer in the hospital H inside the firewall 10 (step S15: YES), data is transmitted from any computer in the hospital H to the terminal computer 42 in the hospital room 4. Therefore, the packet is discarded in step S16 for security management of the hospital service network. Next, the process ends.
The process of the flowchart in FIG.
Steps S11 to S17 in the flowchart of FIG. 6 correspond to the passage permission procedure in the claims. Step S13 corresponds to the direct transmission procedure in the claims.
[0081]
Further, the SMS server computer 54 periodically monitors the failure of each filtering bridge 45. Specifically, the SMS server computer 54 periodically transmits failure monitoring data, for example, an echo request for ICMP (Internet Control Message Protocol) to each terminal computer 42.
When receiving the failure monitoring data, the terminal computer 42 transmits survival notification data, for example, an echo response, to the SMS server computer 54.
When the SMS server computer 54 receives the existence notification data, the SMS server computer 54 determines that there is no failure in the filtering bridge 45 and ends the process.
[0082]
Further, if the life notification data has not been received, it is determined that a failure has occurred in communication with the terminal computer 42 that has not been received, and the life notification data is displayed on the screen of the SMS server computer 54. The number of the filtering bridge 45 of the terminal computer 42 that has not been received and an error display indicating that a failure may have occurred are displayed, and the process is terminated.
When an error is displayed on the screen of the SMS server computer 54, the person in charge of the system management organization 5 goes to the hospital H to check the operation of the filtering bridge 45 and exchange it.
[0083]
The filtering bridge 45 counts the amount of packets passing through the filtering bridge 45 and the communication time by a known method, and stores data on the amount of packets passed and the communication time in the ROM 62.
When the transmission instruction is received from the SMS server computer 54, the filtering bridge 45 transmits data of the amount of passing packets and communication time to the SMS server computer 54.
The CPU (not shown) of the SMS server computer 54 adds the unit price to the passing packet amount or communication time data received from the filtering bridge 45, calculates the Internet usage fee for each terminal computer 42, and records it in the HDD (not shown). .
The Internet usage fee may be paid at the reception of the hospital H when the patient leaves the hospital, or may be withdrawn from a bank account.
[0084]
Thereby, the hospital H can charge the inpatient 40 according to the amount of information that the patient uses the terminal computer 42, and can obtain a corresponding profit.
[0085]
After the hospitalized patient 40 is discharged, data regarding the terminal computer 42 of the discharged hospitalized patient 40 remains in the filtering bridge 45, and therefore the filtering bridge 45 is reinitialized in preparation for the next use of the hospitalized patient 40.
Based on the reinitialization command transmitted from the SMS server computer 54, the filtering bridge 45 erases all the information in the RAM 61, ROM 62, and HDD 63, which are storage devices, and reinitializes the information.
Thereafter, the MAC address of the router 46 and the setup request signal are received from the SMS server computer 54, stored in the HDD 63, and the reinitialization process is terminated.
[0086]
The filtering bridge 45 limits the communication speed to the speed set by the SMS server computer 54 as bandwidth limitation management.
The SMS server computer 54 transmits the speed limit value to the filtering bridge 45 as a band limit value. The bandwidth limit value can set the communication speed in 1 Kbps units between 1 Kbps and 10 Mbps. Further, it may be set only for uplink and downlink, or may be set for the sum of uplink and downlink communication speeds.
The filtering bridge 45 registers the bandwidth limit value received from the SMS server computer 45 in the RAM 61.
[0087]
The filtering bridge 45 measures the communication speed by measuring the amount of data passing therethrough and differentiating the amount of data with respect to time. When the bandwidth limit value is registered, when the communication speed exceeds the bandwidth limit value, the filtering bridge 45 prohibits the passage of the data exceeding the bandwidth limit value.
[0088]
【The invention's effect】
As described above, according to the present invention, the passage permission unit is configured such that the combination of the data transmission destination IP address and the transmission source IP address is the IP address set by the address registration unit and the IP address of the computer outside the firewall. In the case of a combination, the access to data from the patient's terminal computer can be prohibited from accessing the information on the hospital business computer network installed inside the firewall. .
In addition, when a patient sets an IP address on the terminal computer himself / herself, it becomes impossible to transmit / receive data, so that it is possible to prevent the patient from setting an IP address on the terminal computer himself / herself, and the IP address overlap Can be prevented.
[0089]
In addition, since the filtering bridge includes an address registration unit that sets an IP address in the terminal computer and stores the set IP address, it is possible to prevent the patient from setting an IP address in the terminal computer by himself. Duplicate IP addresses can be prevented.
Moreover, since the filtering bridge includes terminal connection means for connecting a terminal computer in the hospital room, the patient can bring his / her computer accustomed to the operation into the hospital room and continue to use it. .
[Brief description of the drawings]
FIG. 1 is an explanatory diagram showing an outline of a configuration of an in-hospital comprehensive network system according to an embodiment of the present invention.
FIG. 2 is an explanatory diagram showing a main configuration of an in-hospital comprehensive network system according to an embodiment of the present invention.
FIG. 3 is an explanatory diagram showing a hardware configuration of a filtering bridge according to an embodiment of the present invention.
FIG. 4 is a filtering bridge operation flowchart according to an exemplary embodiment of the present invention.
FIG. 5A is an explanatory diagram showing an outgoing packet passage table set in the filtering bridge according to the embodiment of the present invention, and FIG. 5B is set in the filtering bridge according to the embodiment of the present invention. It is explanatory drawing which shows the inward packet passage table.
FIG. 6 is a flowchart of a filtering bridge operation according to an embodiment of the present invention.
[Explanation of symbols]
H hospital
1 Hospital network system
2 Hospital staff area
3 Internet room
4 hospital rooms
5 System management organization
6 Internet
7 shops
8 Hospital management
9 lines
10 Firewall server computer
11, 34, 44 hub
24, 46 routers
20 Hospital staff
21 Hospital server computer
22 Terminal computer for staff
30 Terminal users
32 Web computer
33 Card reader
40 Hospitalized patients
42 Terminal computer
45 Filtering bridge
45a Port 45
45T-1 Outgoing packet passage table
45T-2 Inward packet passage table
54 SMS server computer
60 CPU
61 RAM
62 ROM
63 HDD
64 Communication device
71 Shop server computer

Claims (12)

An in-hospital network system that uses the same line for connection to the public communication line network from the hospital business computer network and connection to the public communication line network from the terminal computer for the patient,
A hospital business computer network connected to a public communication network, a firewall server computer installed between the public communication network and the hospital business computer network, and the firewall server computer in parallel with the hospital business computer network And at least one filtering bridge connected to
The filtering bridge includes terminal connection means for connecting a terminal computer in a hospital room, address registration means for setting an IP address in the terminal computer connected to the connection means, and storing the set IP address; Passing permission means for permitting data to pass through the filtering bridge in a predetermined case, and
The passage permission unit, when the combination of the data destination IP address and the source IP address is a combination of the IP address set by the address registration unit and the IP address of the computer outside the firewall, An integrated hospital network system that allows data to pass through. The in-hospital general according to claim 1, wherein the filtering bridge directly transmits the data to the firewall when the source IP address of the data is an IP address set by the address registration unit. Network system. A system management server computer storing a program for operating the filtering bridge is connected to the firewall via a public communication network.
A router is connected between the firewall and the filtering bridge,
The filtering bridge includes setup request means for transmitting a setup request to the router,
The router includes a transfer unit that receives the setup request received from the filtering bridge and transmits a setup command to the systems management server computer.
The in-hospital comprehensive network system according to claim 1, wherein the systems management server computer includes program transmission means for transmitting the program to the filtering bridge in response to the setup command. A terminal management apparatus for a patient that manages connection to a public communication line network from a terminal computer for a patient using a line connected to a public communication line network from a hospital business computer network,
From a storage device for storing a program defining the operation of the management device, a server for creating information, an input device for receiving information from the outside, an output device for sending information to the outside, the storage device and / or the input device A central processing unit that calculates using the received information and passes the calculated result to the storage device or / and the output device,
A firewall server computer installed between the public communication network and the hospital business computer network is connected in parallel with the hospital computer network,
Terminal connection means for connecting a terminal computer in a hospital room, an address registration means for setting the IP address in the terminal computer connected to the connection means, and storing the set IP address, and data in a predetermined case Passing permission means for permitting the passage of
The passage permission unit, when the combination of the data destination IP address and the source IP address is a combination of the IP address set by the address registration unit and the IP address of the computer outside the firewall, A terminal management apparatus for a patient, characterized by permitting the passage of data. 5. The patient terminal according to claim 4, further comprising: a direct transmission unit that directly transmits the data to the firewall when the transmission source IP address of the data is an IP address set by the address registration unit. Management device. Setup request means for transmitting a setup request for requesting transmission of a program for operating the patient terminal management device to a router connected between the firewall and the patient terminal management device;
5. The patient terminal management apparatus according to claim 4, further comprising program receiving means for receiving the program from a systems management server computer via the public communication line network. A terminal management method for a patient for managing connection from a terminal computer for a patient to a public communication line network using a line connected to a public communication line network from a hospital business computer network,
A procedure for installing at least one filtering bridge in parallel with the hospital business computer network in a firewall server computer installed between a public communication network and the hospital business computer network;
A procedure for connecting a terminal computer in a hospital room to the terminal connection means of the filtering bridge;
An address registration procedure in which the filtering bridge sets an IP address in the terminal computer and stores the set IP address;
When the combination of the data destination IP address and the source IP address is a combination of the IP address set in the address registration procedure and the IP address of the computer outside the firewall, the data is passed through the filtering bridge. A terminal management method for a patient, comprising: a passage permission procedure for permitting passage. When the source IP address of the data is the IP address set in the address registration procedure, the filtering bridge directly transmits the data to the firewall, overlapping with the passage permission procedure. The terminal management method for patients according to claim 7 characterized by things. At any stage prior to the procedure of connecting the terminal computer in the hospital room, a systems management server computer is connected to the firewall via a public communication network, and between the firewall and the filtering bridge, Follow the steps to connect the router,
The filtering bridge performs a setup request procedure for transmitting a setup request for requesting transmission of a program for operating the filtering bridge to the router,
In response to the setup request received from the filtering bridge, the router performs a transfer procedure for sending a setup command to the systems management server computer.
8. The terminal management method for a patient according to claim 7, wherein the systems management server computer performs a program transmission procedure for transmitting the program to the filtering bridge in response to the setup command. To the patient terminal management device that manages the connection from the terminal computer for the patient to the public communication line network using the line connected to the public communication line network from the hospital business computer network,
An address registration procedure for setting an IP address in a terminal computer connected to the terminal connection means of the patient terminal management apparatus, and storing the set IP address;
When the combination of the data destination IP address and the source IP address is a combination of the IP address set in the address registration procedure and the IP address of the computer outside the firewall, the patient terminal management device And a passage permission procedure for allowing a person to pass. When the transmission source IP address of the data is an IP address set in the address registration procedure, a direct transmission procedure for directly transmitting the data to the firewall is executed, overlapping with the passage permission procedure. The program according to claim 10. Performing a setup request procedure for transmitting a setup request for requesting transmission of a program for operating the patient terminal management device to a router installed between the firewall and the patient terminal management device;
11. The program according to claim 10, wherein a program receiving procedure for receiving the program is executed from a systems management server computer connected to a firewall via a public communication line network.

Images