JP4773878B2 - Information management system and information management method - Google Patents

Description

  The present invention relates to an application field of information security technology, and more particularly to technology for preventing privacy leakage in a system that manages processing histories related to different management targets.

  The wireless tag technology has attracted attention mainly in the fields of physical distribution management, article management, and the like, but in recent years, a method of applying this technology to the medical field has been studied (for example, see Non-Patent Document 1). In particular, various devices have been devised in order to prevent medical errors that have occurred frequently in recent years (see, for example, Non-Patent Document 2), and a method using a wireless tag is also considered here. As one of such methods, a method of attaching a wireless tag storing patient information to the patient and attaching a wireless tag storing nurse or diagnostic therapeutic agent information to the nurse or diagnostic therapeutic agent container (Conventional method 1). In this method, at the time of medication, a nurse reads each information from each RFID tag device using a reader device, and collates the read information to determine whether the person in charge and the medicine to be administered are correct. Confirm.

In addition, in order to keep a record of medical practices such as medication, it is necessary to record it in a database, etc., but since the information to be recorded is information directly related to the privacy of the patient, it must be handled with care. As a conventional method for recording information in a database while taking privacy into consideration, for example, the information to be recorded is distributed to a plurality of databases, and the information stored in each is managed by the data ID. There is a method of reducing damage even if information is leaked from the conventional method (conventional method 2).
Asako Itagaki, “5th Floor Medicine and Computers: Computers that Enter the Human Body,” TDK Techno Magazine, [online], August 2005, [Search May 15, 2006], Internet <http://www.tdk .co.jp / techmag / salon / ubiquitous / ubi050826a.htm> Several people Kozuka, “Expanding electronic medical record” [II ・ Finish]-Challenges in the introduction and operation of electronic medical records in university hospitals-, IEICE Journal Vol.88, No.2, 2005

However, in the conventional technology, there is a possibility that the privacy of the patient is infringed from information stored in the memory of the wireless tag.
In general, anyone who has a reader device can read information stored in a wireless tag. For example, in the case of the conventional method 1, a third party can use a reader device to read each piece of information from a RFID tag device attached to a patient who is taking medication, a diagnostic therapeutic agent container, or the like. In this case, privacy information such as the medical condition of the patient may be known to the third party from the read information.

On the other hand, for example, only ID information corresponding to privacy information is stored in a wireless tag, and privacy information is stored in a database to prevent the privacy information from being directly read by a third party from the wireless tag. Technology also exists (conventional method 3). However, in this conventional technique, a list in which an attacker associates ID information with information indicating that a wireless tag that has read the ID information is attached is generated in advance, and the attacker again When the ID information is read somewhere, it is impossible to prevent an attack (hotlisting) that uses the generated list to identify what the read ID information corresponds to. It should be noted that, for the hot list attacks, for example, "D. Molnar, D. Wagner," Privacy and Security in Library RFID Issues, Practices, and Architectures, "the 11 th ACM conference on Computer and communications security, Washington DC, pp. 210-219, http://www.cs.berkeley.edu/~daw/papers/librfid-ccs04.pdf, 2004 ".

Also, for example, in the case of recording and managing information related to medical practices in a conventional database (for medication, patient name, room number, name of doctor / nurse in charge, drug name / dose, administration method, administration time, etc.) Privacy information may leak. For example, in the case of the conventional method 2, if the information recorded in the database leaks, it is possible to easily associate the distributed information. In the case of the conventional method 3, when the information recorded in the database leaks Privacy information will be specified.
Such a problem is not a problem that occurs only when the wireless tag technology is applied to the medical field, but a problem that similarly occurs in a system in which different management targets manage the history of processing related to each other.

  This invention is made in view of such a point, and provides the technique which can prevent the leakage of privacy information in the system which manages the log | history of the process from which a different management object relates mutually. Objective.

  In the present invention, in order to solve the above-described problem, a first identification device including a first concealed ID memory storing first concealed ID information in which the first ID information for identifying the first management target is concealed. Is attached to the first management target, and a second identification device capable of outputting the second ID information for identifying the second management target or the second concealed ID information concealing the second ID information is provided. And attached to the second management target. Here, the first concealment ID information stored in the first concealment ID memory is an opportunity determined by an arbitrary setting condition, and it is difficult to find the relevance with the first concealment ID information. Updated to 1 concealment ID information. And when the process in which the 1st management object and the 2nd management object were related mutually was performed, the reading reception part of the reading terminal device was wirelessly transmitted from the 1st transmission part of the 1st discriminating device. A process of receiving the first concealed ID information; and (b) a process in which the reading input unit of the reading terminal apparatus receives the input of the second ID information or the second concealed ID information output from the second identification apparatus; c) Processing history in which the reading information transmission unit of the reading terminal device associates the first ID information or the first ID information corresponding to the first ID information and the second ID information or the second ID information. A process of transmitting information; and (d) first confidential ID information or first ID information and second ID information or second confidential ID information corresponding to the processing history information are stored in association with the first database device. Execute the process. The second ID information constituting the “processing history information” may be the second ID information input to the reading input unit, or by restoring the second concealment ID information input to the reading input unit. It may be obtained.

Here, the first concealment ID information stored in the first concealment ID memory is another first concealment ID for which it is difficult to find an association with the first concealment ID information due to the above-mentioned opportunity. Updated with information. Therefore, even if an attacker lists the relationship between the first concealment ID information read from the first identification device at a certain point in time and the first management target to which the first identification device is attached, A hot list attack cannot be performed on the used first management target.
In the present invention, the second identification device includes a second concealment ID memory that stores the second concealment ID information, and a second transmission unit that wirelessly transmits the second concealment ID information. The input unit may receive the second concealment ID information wirelessly transmitted from the second identification device. In this case, the second concealment ID information stored in the second concealment ID memory is difficult to find the relevance with the second concealment ID information at an opportunity determined by an arbitrary setting condition. To the second concealment ID information. Thereby, the hot list attack with respect to the 1st management object and the 2nd management object can be prevented more firmly.

  In the present invention, it is preferable that the first database device stores the first ID information corresponding to the processing history information and the second concealment ID information in association with each other, and constructs a database using the first ID information as a search key. Alternatively, the first concealment ID information and the second ID information corresponding to the processing history information are stored in association with each other, and a database using the second ID information as a search key is constructed.

  Here, in the first database device, a database in which one of the first ID information and the second ID information is concealed is constructed. Therefore, even if the information stored in the first database device leaks, the history of processing in which the first management target and the second management target are mutually related is not known to a third party. Further, since either one of the first ID information and the second ID information is concealed and the database is constructed using the information that is not concealed as a search key, the database search process can be easily performed. That is, if the database is configured by associating the first concealment ID information and the second concealment ID information, the first ID information or the second concealment ID information or the second concealment ID information is used as a search key. The 2ID information must be restored one by one and searched. Since the first concealment ID information and the second concealment ID information are information that is concealed and updated as described above, the first concealment ID information or the second concealment ID information is used as it is. This is because it cannot be used as a search key in the state.

  Here, more preferably, when the first database device constructs a database using the first ID information as a search key, the first concealment ID information corresponding to the processing history information and the second ID information are stored in association with each other, When a database using the second ID information as a search key is constructed and the first database device constructs a database using the second ID information as a search key, the first ID information corresponding to the processing history information and the second concealed ID information are obtained. The apparatus further includes a second database device that stores the database in association with each other and constructs a database using the first ID information as a search key.

  As described above, when two databases having different ID information serving as search keys are provided, if only one of the first ID information and the second ID information is known, the first management target and the second management target are mutually connected. It is possible to search the history of processing related to the. Moreover, even if information on the first database and the second database is leaked, information on a combination of the first ID information and the second ID information corresponding to each process will not be leaked.

  According to the present invention, it is possible to prevent leakage of privacy information in a system that manages processing histories related to different management targets.

The best mode for carrying out the present invention will be described below with reference to the drawings.
As described above, the present invention can be applied to a general system that manages the history of processes in which different management targets are related to each other. However, in the following embodiments, for convenience of explanation, a case where the present invention is applied to a system for managing a history of medical practice processing will be described as an example. That is, the “first management target” in each embodiment is a “diagnostic treatment agent” such as a drug, the “second management target” is “patient”, and the “process in which different management targets are related to each other” This is a medication action to a “patient” using a “diagnostic therapeutic agent”.

[First Embodiment]
Next, a first embodiment of the present invention will be described.
In this embodiment, the “first identification device” is “wireless tag device”, the “second identification device” is “barcode presentation unit”, the “first ID information” is “diagnostic treatment agent ID information”, and the “first identification device” The present invention is applied with “2 ID information” as “patient ID information”, and “diagnostic treatment agent information” and “patient” information corresponding to “diagnostic treatment agent” and “patient” in which the medication is performed are associated with each other. This is an example of storing history information in a database device. For the wireless tag device, see, for example, “EPC global, Inc.,“ EPCglobal ”, Internet <http://www.epcglobalinc.org/>”, etc.

<Configuration>
FIG. 1 is a conceptual diagram illustrating the overall configuration of the information management system 100 according to the first embodiment.
As illustrated in FIG. 1, the information management system 100 of the present embodiment includes a wireless tag device 110 (corresponding to a “first identification device”), a barcode presenting unit 120 (corresponding to a “second identification device”), A reading terminal device 130 including a tag reader / writer device 131 (corresponding to “reading reception unit”), a barcode reader device 132 (corresponding to “reading input unit”), a security server device 140, a database device 150, and a management device 160. In the example of this embodiment, the wireless tag device 110 is attached to the container of each diagnostic therapeutic agent 4, and the barcode presentation unit 120 is attached to the patient 1 by the wristband 2. Each diagnostic therapeutic agent 4 is usually stored in a medicine shelf 5 and is carried to the vicinity of the patient 1 when the patient 1 is administered. The reading terminal device 130, the security server device 140, the database device 150, and the management device 160 are configured to be communicable via a network 170 such as a LAN (Local Area Network).

FIG. 2 is a block diagram illustrating the configuration of the wireless tag device 110 according to the first embodiment.
As illustrated in FIG. 2, the wireless tag device 110 according to the present embodiment includes a memory 111 (first concealed ID memory), an interface 112 (corresponding to a “first transmission unit”), and a control unit 113. ing. Here, the memory 111 concealed diagnostic therapeutic agent ID information (corresponding to “first ID information”) for identifying a diagnostic therapeutic agent (corresponding to “first management target”). 111ba (corresponding to “first concealed ID information”) and a “key” which is secret information necessary for generating the concealed diagnostic therapeutic agent ID information 111ba and restoring the diagnostic therapeutic agent ID information. And a storage area 111a for storing corresponding key ID information 111aa. The memory 111 can be constituted by a readable / writable memory such as an EEPROM (Electronically Erasable and Programmable Read Only Memory), a FeRAM (Ferroelectric Random Access Memory), a flash memory, or an NV (Nonvolatile) RAM. The interface 112 includes, for example, an encoding / decoding circuit, a modulation / demodulation circuit, an antenna, and the like, and is hardware that transmits and receives signals using a frequency of a long wave band or an ISM band (Industry Science Medical band). is there. The control unit 113 is an integrated circuit or the like that controls processing of the wireless tag device 110.

FIG. 3 is a block diagram illustrating the configuration of the reading terminal device 130 according to the first embodiment.
As illustrated in FIG. 3, the reading terminal device 130 of this embodiment includes a tag reader / writer device 131, a barcode reader device 132, a CPU (Central Processing Unit) 133, a ROM 134, a RAM 135, a liquid crystal display unit, and the like. It includes a display unit 136, a communication unit 137 such as a network card (corresponding to a “reading information transmission unit”), an internal clock 138, and a bus 139 that connects these components so as to communicate with each other. Details of data stored in the RAM 135 and data read by the CPU 133 will be described later.

FIG. 4 is a block diagram illustrating the configuration of the security server device 140 according to the first embodiment.
As illustrated in FIG. 4, the security server device 140 according to this embodiment includes a CPU 141, a RAM 142, a ROM 143, an external storage device 144 such as a hard disk device, a communication unit 145, and a bus 146 that connects these components so as to communicate with each other. And have. The external storage device 144 also includes a read / write unit 144a that reads and writes data and a storage unit 144b that stores various data. Details of data stored in the storage unit 144b and data read by the CPU 141 will be described later.

FIG. 5 is a block diagram illustrating the configuration of the database apparatus 150 according to the first embodiment.
As illustrated in FIG. 5, the database device 150 according to the present embodiment includes a CPU 151, a RAM 152, a ROM 153, an external storage device 154, a communication unit 155, and a bus 156 that connects these components so as to communicate with each other. Yes. The external storage device 154 includes a read / write unit 154a that reads and writes data, and a storage unit 154b that stores various data. Details of data stored in the storage unit 154b and data read by the CPU 151 will be described later.

<Processing>
Next, processing of the information management system 100 will be described.
[Prerequisite / Preprocessing]
Individual IDs for identifying each of the patient 1 and the diagnostic therapeutic agent 4 are given, and they will be referred to as a patient ID and a diagnostic therapeutic agent ID, respectively. Information for specifying the patient ID is referred to as patient ID information, and information for specifying the diagnostic therapeutic agent ID is referred to as diagnostic therapeutic agent ID information. The correspondence between each patient 1 and each diagnostic therapeutic agent ID and the correspondence between each diagnostic therapeutic agent 4 and each diagnostic therapeutic agent ID information are stored in a memory in the management device 160 as a table, for example.

  In the case of this embodiment, each patient 1 carries a wristband 2 individually. The wristband 2 is attached with a bar code presentation unit 120 that displays a bar code indicating patient ID information of the patient 1 who carries the wrist band 2. And it is the structure which outputs patient ID information by this barcode. In this embodiment, patient ID information is output by a barcode, but patient ID information may be output by two-dimensional barcode display, character display, or the like. Further, the barcode or the like for displaying the patient ID information may be fixedly formed by printing or the like, or the display content may be changed using a liquid crystal display or the like. Further, instead of attaching the barcode presentation unit 120 to the patient 1 using the wristband 2, a name tag with the barcode presentation unit 120 may be attached to the patient 1, and the barcode presentation unit is attached to the bed of the patient 1. 120 may be attached.

In the case of this embodiment, the wireless tag device 110 is attached to each container of each diagnostic therapeutic agent 4. The storage area 111b of the memory 111 of the wireless tag device 110 stores concealed diagnostic therapeutic agent ID information 111b in which the diagnostic therapeutic agent ID information corresponding to the diagnostic therapeutic agent 4 to which the wireless tag device 110 is attached is concealed. (See FIG. 2). Here, the concealment diagnostic therapeutic agent ID information 111b is information having the following properties.
(Characteristic 1) Only those who have predetermined secret information can restore diagnostic therapeutic agent ID information, and those who do not have this secret information cannot easily restore diagnostic therapeutic agent ID information from concealed diagnostic therapeutic agent ID information. It is.
(Characteristic 2) When multiple types of concealed diagnostic therapeutic agent ID information are generated for the same diagnostic therapeutic agent ID information, those who do not have the predetermined secret information can generate a plurality of concealed diagnostic therapeutic agent IDs. It is difficult to determine whether the information corresponds to the same diagnostic / treatment agent ID information.

There is no particular limitation on the method for generating the concealed diagnostic therapeutic agent ID information 111b that satisfies (Property 1) and (Property 2). For example, the methods described in References 1 and 2 can be used. .
<Reference Document 1> Japanese Patent Application Laid-Open No. 2004-318478 <Reference Document 2> Kinoshita Shingo et al., “Low-cost RFID Privacy Protection Method,” Informatics vol.45, no.8
<Reference 3> Philippe Golle, Markus Jakobsson, Ari Juels, and Paul Syverson, "Universal re-encryption for mixnets," In Proceedings of the 2004 RSA Conference, Cryptographer's track, San Francisco, USA, February 2004, etc.)>

  In this embodiment, as an example, encrypted diagnostic therapeutic agent ID information is referred to as concealed diagnostic therapeutic agent ID information 111b. The encryption of each diagnosis / treatment agent ID information is performed by, for example, the security device in the preprocessing. In the case of this embodiment, the encryption key used for encrypting each diagnostic therapeutic agent ID information and the corresponding decryption key are associated with the key ID information, and the storage unit 144b of the external storage device 144 of the security server device 140 Is stored as a key table 144ba (see FIG. 4). It is assumed that the information in the key table 144ba is managed safely and that only authorized personnel, such as hospital staff, can read it. In addition, the storage area 111a of the memory 111 of each wireless tag device 110 stores key ID information 111aa corresponding to the concealed diagnostic therapeutic agent ID information 111b stored in the storage area 111b (see FIG. 2). .

  As other preprocessing, the RAM 135 of the reading terminal device 130 stores a control program 135 a for controlling the processing of the tag reader / writer device 131. Specifically, for example, when the reading terminal device 130 is activated, the control program 135a is read from the ROM 134 into the RAM 135. In addition, in the storage unit 144b of the external storage device 144 of the security server device 140, an ID information re-concealing program 144bb for re-concealing (re-encrypting in the example of this embodiment) the concealment diagnostic therapeutic agent ID information. An ID information restoration program 144bc for restoring (decoding in the example of this embodiment) the diagnostic therapeutic agent ID information from the concealed diagnostic therapeutic agent ID information, and a control program 144bd for controlling the processing of the security server device 140 Is stored. Further, the storage unit 154b of the external storage device 154 of the database device 150 stores a control program 154bb for controlling the processing of the database device 150.

[Medication treatment]
Next, processing (referred to as “medicine processing”) associated with the medication action will be described.
In the case of this form, the medical instruction of the doctor in charge (including information such as medication date / time, doctor in charge, nurse in charge, target patient, ward / ward / bed number, medication name, dosage, dosage method, etc.) is electronic The medical record is stored in the memory in the management device 160. In addition, about an electronic medical chart system, what is described in the nonpatent literature 2, for example is used.
When a nurse performs a medication action on a patient, for example, according to a medical instruction displayed on the screen of the management device 160, the nurse takes out the diagnostic therapeutic agent 4 to be dispensed from the medicine shelf 5. At this time, the tag reader / writer device 131 is used to read the concealed diagnostic therapeutic agent ID information 111b stored in the wireless tag device 110 attached to the diagnostic therapeutic agent 4 and check whether the diagnostic therapeutic agent to be taken out is correct. It may be configured to.

  In this case, for example, the reading terminal device 130 uses the tag reader / writer device 131 to read the concealed diagnostic therapeutic agent ID information and the corresponding diagnostic therapeutic agent ID information from the memory 111 of the wireless tag device 110. The reading terminal device 130 transmits the concealed diagnostic therapeutic agent ID information and the diagnostic therapeutic agent ID information to the security server device 140 through the network 170 and requests the decryption of the concealed diagnostic therapeutic agent ID information. The security server device 140 reads the decryption key corresponding to the sent diagnostic therapeutic agent ID from the key table 144ba of the storage unit 144b, and uses it to decrypt the sent concealed diagnostic therapeutic agent ID information to obtain the diagnostic therapeutic agent. ID information is generated and sent back to the reading terminal device 130 via the network 170. (The decryption processing of the concealed diagnostic therapeutic agent ID information is also performed after the medication processing described later (step S5). The concealed diagnostic therapeutic agent. Details of the ID information decryption process will be described at that time.) The reading terminal device 130 further receives diagnostic therapeutic agent ID information corresponding to the diagnostic therapeutic agent to be administered indicated by the medical instruction from the management device 160 via the network 170, and receives the diagnostic therapeutic agent ID received from the security server device 140. Compare with information. If the diagnostic / treatment agent ID information received from the security server device 140 is not included in the diagnostic / treatment agent ID information received from the management device 160, for example, an error display is displayed from the display unit 136 of the reading terminal device 130. Made. Thereby, the nurse 3 can check whether the diagnostic therapeutic agent taken out from the medicine shelf 5 is wrong.

  At this time, the reading terminal device 130 requests the security server device 140 to re-confine the concealed diagnostic therapeutic agent ID information via the network 170, and the security server device 140 uses the original concealed diagnostic therapeutic agent ID information. Reconcealing to other concealed diagnostic therapeutic agent ID information that is difficult to find the relevance to, and concealing the concealed diagnostic therapeutic agent ID information and corresponding key ID information to the corresponding wireless tag A configuration in which the data is overwritten and saved in the memory 111 of the apparatus 110 may be used (the update processing of the concealed diagnostic therapeutic agent ID information is also performed after the medication processing described later (steps S9 to S12 described later). Details of the concealment diagnostic therapeutic agent ID information update process will be described at that time.) Thereby, the attacker reads the concealed diagnostic therapeutic agent ID information from the wireless tag device 110 attached to the container of each diagnostic therapeutic agent 4 stored in the medicine shelf 5 in advance, and the diagnostic therapeutic agent Creates a list consisting of information (diagnostic treatment agent name, etc.) that identifies diagnostic treatments read from the display of 4 containers, and prevents hot list attacks that use this list to obtain information on diagnostic treatments without authorization it can. This is because, by updating the concealed diagnostic therapeutic agent ID information of the wireless tag device 110 before the medication processing, the list generated in advance becomes useless during the medication processing of the diagnostic therapeutic agent 4 to the patient 1 (confidentiality). This is because the correspondence relationship between the diagnostic diagnosis / treatment agent ID information and the diagnosis / treatment agent is not shown).

Next, in order to perform the medication process according to the medical instruction, the nurse 3 puts each diagnostic therapeutic agent 4 taken out from the medicine shelf 5 as described above on a wagon or the like and holds it to the bed where the patient indicated by the medical instruction is present. Go. FIG. 6 is a sequence diagram for explaining processing of the information management system 100 at the time of medication. Hereinafter, processing of the information management system 100 at the time of medication will be described.
First, the nurse 3 operates the reading terminal device 130 in a state where the tag reader / writer device 131 is disposed in the vicinity of the diagnostic and therapeutic agent 4 used for medication, and gives a reading instruction to the reading terminal device 130. On the other hand, in the reading terminal device 130, the tag reader / writer device 131 outputs an ID reading request under the control of the CPU 133 into which the control program 135a has been read (step S1). This ID reading request is received by the interface 112 of the wireless tag device 110 (the wireless tag device attached to the container of the diagnostic therapeutic agent 4 used for medication). The control unit 113 of the wireless tag device 110 that has detected the reception of the ID reading request reads the key ID information 111a and the concealed diagnostic therapeutic agent ID information 111ba stored in the storage areas 111a and 111b of the memory 111, respectively. These are transmitted from the interface 122 (step S2). These are received by the tag reader / writer device 131 of the reading terminal device 130, and stored in the RAM 135 as key ID information 135c and concealed diagnostic therapeutic agent ID information 135d. Next, the nurse 3 operates the bar code reader device 132, and the bar code reader device 132 outputs the bar code information (“patient ID information”) output from the bar code presentation unit 120 to which the patient 1 to be administered is attached. (Corresponding to “)” is read (step S3). The read patient ID information is stored in the RAM 135 as patient ID information 135e.

  A medical practice such as medication is often performed continuously for a plurality of patients, and a plurality of diagnostic and therapeutic agents are often placed on a wagon for a plurality of patients. Therefore, in order to prevent medical errors such as patient misunderstandings, it is desirable that the concealed diagnostic therapeutic agent ID information and the patient ID information are collated with medical instructions immediately before the medication. Specifically, the reading terminal device 130 causes the security server device 140 to decode the concealed diagnostic therapeutic agent ID information to acquire diagnostic therapeutic agent ID information, and further, the diagnostic treatment indicated by the medical instruction from the management device 160 Agent ID information and patient ID information are acquired and compared, thereby verifying whether or not the diagnostic therapeutic agent 4 and the patient 1 to be administered are compatible with medical instructions. In addition, the process which makes the security server apparatus 140 perform decoding of concealment diagnostic therapeutic agent ID information and acquires diagnostic therapeutic agent ID information is demonstrated in detail by below-mentioned step S4-6.

  After the medical action such as medication is completed, the nurse 3 operates the reading terminal device 130 to give an instruction to register the medical action history database in order to record the medical action history. On the other hand, the CPU 133 that has read the control program 135a reads the key ID information 135c and the concealment diagnosis treatment ID information 135d from the RAM 135, and transmits them to the security server device 140 from the communication unit 137 via the network 170. Then, the decryption of the concealment diagnosis treatment ID information 135d is requested (step S4). This request information is received by the communication unit 145 of the security server device 140 (FIG. 4) and stored in the RAM 142. Next, the CPU 141 into which the ID information restoration program 144bc has been read reads the key ID information 135c from the RAM 142, and uses this to search the key table 144ba stored in the storage unit 144b of the external storage device 144, thereby obtaining the key ID information. The decryption key corresponding to 135c is read out. Next, the CPU 141 decrypts the concealed diagnostic treatment ID information 135d read from the RAM 142 by using this decryption key to obtain diagnostic treatment ID information (step S5). The obtained diagnostic treatment ID information is transmitted from the communication unit 145 to the reading terminal device 130 through the network 170 (step S6). The diagnostic treatment ID information is received by the communication unit 137 of the reading terminal device 130 and stored in the RAM 135 as the diagnostic treatment ID information 135f.

  Next, the CPU 133 into which the control program 135a has been read generates processing history information in which the patient ID information 135e read from the RAM 135 is associated with the diagnostic treatment ID information 135f. In addition, information related to the medication action (for example, medication date and time read from the internal clock 138 or the name of the nurse 3 in charge stored in the RAM 135) is associated with the information as processing history information. Good. The generated processing history information is transmitted from the communication unit 137 to the database device 150 through the network 170 (step S7).

  The processing history information is received by the communication unit 155 of the database device 150 and stored in the RAM 152. The CPU 151 into which the control program 154bb has been read stores the processing history information stored in the RAM 152 as one record of the treatment history database (DB) 154ba in the storage unit 154b of the external storage device 154 (step S8). The treatment history DB 154ba of FIG. 5 is an example in the case where “patient ID information”, “confidential diagnosis treatment ID information”, “name of nurse in charge”, and “medication date / time” are elements of the processing history information. Each element of this processing history information is each element of columns “patient”, “administered drug”, “nurse”, and “administration date” of the treatment history DB 154ba. “Patient ID information” is used as a search key. In addition, in the database that keeps records of medical practices, information such as medication dates and times, physicians in charge, nurses in charge, target patients, wards / rooms / bed numbers, names of drugs administered, dosages, dosage methods, etc., as well as medical instructions It is desirable to record. In particular, information related to the administered drug must be recorded in addition to the name of the drug, as well as information such as the production lot number, in order to be used for a follow-up survey when a problem occurs in the administered drug. By assigning diagnostic therapeutic agent ID information to a detailed classification including the lot number, detailed information management is possible. In this embodiment, a table in which information related to a patient such as a patient name and a ward number is associated with patient ID information, and information related to a diagnostic treatment agent such as a drug name and a manufacturing lot number is associated with the diagnostic treatment ID information is stored in the management device 160. By doing so, such detailed management becomes possible.

  Next, the key ID information 135c and the concealment diagnostic therapeutic agent ID information 135d stored in the RAM 135 of the reading terminal device 130 are read by the CPU 133 that has read the control program 135a. Then, the CPU 133 transmits these pieces of information from the communication unit 137 to the security server device 140 via the network 170, and makes a re-confidentiality request (step S9). The key ID information 135c and the concealment diagnostic therapeutic agent ID information 135d are received by the communication unit 145 of the security server device 140 and stored in the RAM 142. The CPU 141 into which the ID information reconcealing program 144bb is read reads the key ID information 135c from the RAM 142, and uses this and the information in the key table 144ba to reconceal the concealment diagnostic therapeutic agent ID information 135d. The therapeutic agent ID information is generated (step S10). Note that the concealed diagnostic treatment agent ID information that has been reconcealed is information that is difficult to find the relevance to the original concealment diagnostic treatment agent ID information 135d unless the information in the key table 144ba is used. As such a re-concealment method, the concealment diagnostic therapeutic agent ID information is characterized by the nature of a stochastic cipher such as ElGamal cipher (the relationship between ciphertexts obtained by encrypting the same plaintext does not have the authority to decrypt A ciphertext having a property that cannot be understood), and using the concealed diagnostic therapeutic agent ID information and the encryption key (public key) corresponding to the key ID information 135c extracted from the key table 144ba, A method of re-encrypting agent ID information can be exemplified (for example, see References 1 to 3). Also, using the decryption key corresponding to the key ID information 135c extracted from the key table 144ba, the concealed diagnostic therapeutic agent ID information is decrypted to obtain diagnostic therapeutic agent ID information, and then new key ID information is selected at random. Then, the encrypted diagnostic therapeutic agent ID information encrypted with the corresponding encryption key may be re-encrypted and concealed diagnostic therapeutic agent ID information.

  The reconcealed concealment diagnostic therapeutic agent ID information is sent to the communication unit 145 together with the corresponding key ID information, and from there to the reading terminal device 130 via the network 170 (step S11). These pieces of information are received by the communication unit 137 of the reading terminal device 130 and stored in the RAM 135. Next, the reconcealed concealed diagnostic therapeutic agent ID information and the corresponding key ID information are sent to the tag reader / writer device 131, from which the original concealed diagnostic therapeutic agent ID information is stored. Transmitted to the wireless tag device 110. The concealed concealed diagnostic therapeutic agent ID information and the corresponding key ID information are received by the interface 112 of the wireless tag device 110, respectively, and are overwritten and stored in the storage areas 111b and 111a of the memory 111, respectively. The

Thereafter, the RFID tag device 110 outputs the updated new concealed diagnostic therapeutic agent ID information in response to the ID reading request. As a result, the list created by the attacker to perform the hot list attack (the list in which the concealed diagnostic therapeutic agent ID information and the diagnostic medical agent name are associated) is actually output from the wireless tag device 110. Therefore, the hotlist attack cannot be performed using the list.
When the used diagnostic therapeutic agent 4 or its container is subsequently discarded, the concealed concealed diagnostic therapeutic agent ID information is not stored in the wireless tag device 110, but the decoded diagnostic therapeutic agent ID information is stored. (Diagnostic treatment agent ID information 135f stored in the RAM 135) may be stored in the wireless tag device 110. In this case, since the diagnostic therapeutic agent ID information can be acquired locally from the wireless tag device 110 without going through the security server device 140, processing such as waste separation and recycling can be efficiently performed using the diagnostic therapeutic agent ID information. It can be carried out.

<Other variations>
In this embodiment, the reading terminal device 130 transmits the concealed diagnostic therapeutic agent ID information to the security server device 140, and reconceals the concealed diagnostic therapeutic agent ID information. However, the reading terminal device 130 transmits the diagnostic therapeutic agent ID information obtained by restoring the concealed diagnostic therapeutic agent ID information to the security server device 140, and the security server device 140 conceals the diagnostic therapeutic agent ID information and re-conceals it. The configuration may be such that the concealed diagnostic therapeutic agent ID information is stored in the wireless tag device 110.

  For example, as described above, the concealment diagnostic therapeutic agent ID information read from the wireless tag device 110 is used to check whether the diagnostic therapeutic agent 4 taken out from the medicine shelf 5 is correct. The issued concealed diagnostic therapeutic agent ID information must be restored to diagnostic therapeutic agent ID information. The diagnostic therapeutic agent ID information obtained at this time is transmitted to the security server device 140, and the security server device 140 conceals the diagnostic therapeutic agent ID information, and the wireless tag is used as the concealed diagnostic therapeutic agent ID information that has been concealed again. It may be stored in the device 110. Further, for example, in step S9, instead of the reading terminal device 130 transmitting the concealment diagnostic therapeutic agent ID information to the security server device 140 and requesting the re-concealment, the reading terminal device 130 causes the security server device 140 to perform the step. The diagnostic therapeutic agent ID information obtained in S6 may be transmitted, the diagnostic therapeutic agent ID information may be concealed by the security server device 140, and the concealed diagnostic therapeutic agent ID information may be concealed again. Furthermore, for example, when requesting the security server device 140 to restore the concealed diagnostic therapeutic agent ID information at any timing, it also requests generation of the most concealed concealed diagnostic therapeutic agent ID information. It may be configured to.

  Further, while the diagnostic therapeutic agent 4 is stored in the medicine shelf 5, only the diagnostic therapeutic agent ID information that is not concealed is stored in the wireless tag device 110 attached to the container of the diagnostic therapeutic agent 4. But you can. In this case, when the nurse 3 takes out the diagnostic therapeutic agent 4 from the medicine shelf 5, the tag reader / writer device 131 is used to obtain diagnostic therapeutic agent ID information from the wireless tag device 110 attached to the container of the diagnostic therapeutic agent 4. read. Then, the reading terminal device 130 transmits this to the security server device 140 to request concealment, and the concealment diagnostic therapeutic agent ID information concealed in the security server device 140 and its key ID information are sent to the tag reader. The data is stored in the wireless tag device 110 using the writer device 131. Conversely, when the nurse 3 puts the diagnostic therapeutic agent 4 in the medicine shelf 5, the tag reader / writer device 131 is used to conceal the diagnostic therapeutic agent from the wireless tag device 110 attached to the container of the diagnostic therapeutic agent 4. ID information and its key ID information are read. Then, the reading terminal device 130 transmits this to the security server device 140 to request the decryption, and the diagnostic therapeutic agent ID information decrypted by the security server device 140 is used by the tag reader / writer device 131 and the wireless tag device 110. To store. Such a configuration may be used.

  In this embodiment, the barcode indicating the patient ID information is displayed on the barcode presenting unit 120. However, the concealed patient ID information obtained by concealing the patient ID information and the key ID information are stored. It may be. In this case, these pieces of information read by the barcode reader device 132 are sent to the security server device 140, where the concealed patient ID information is restored to the patient ID information and collated with the medical instructions immediately before the medication. And history storage in a database after medication.

[Second Embodiment]
Next, a second embodiment of the present invention will be described.
In this embodiment, the “first identification device” is “wireless tag device”, the “second identification device” is “barcode presentation unit”, the “first ID information” is “diagnostic treatment agent ID information”, and the “first identification device” The point that the present invention is applied with “2 ID information” as “patient ID information” is common to the first embodiment. However, instead of storing the history information associating the “diagnostic therapeutic agent ID information” and “patient ID information” corresponding to the “diagnostic therapeutic agent” and “patient” in which the medication has been performed, A database in which “diagnostic agent ID information (first concealment ID information)” concealing “diagnostic agent ID information” and “patient ID information (second ID information)” are associated and patient ID information is used as a search key. It differs from the first embodiment in the point of construction. Below, it demonstrates centering around difference with 1st Embodiment, and abbreviate | omits description about the matter which is common in 1st Embodiment.

<Configuration>
The information management system of this embodiment is obtained by replacing the database device 150 of the information management system 100 of the first embodiment with the database device 250 of FIG. In FIG. 7, the same reference numerals as those in FIG. 5 are given to portions common to the database device 150 of the first embodiment. As shown in FIG. 7, the difference between the database apparatus 250 of this embodiment and the database apparatus 150 of the first embodiment is the data structure of the treatment history DB. Hereinafter, the processing related to the data configuration will be mainly described, and the other processing is the same as that of the first embodiment, and the description thereof will be omitted.

<Processing>
FIG. 8 is a sequence diagram for explaining processing of the information management system of this embodiment at the time of medication. Hereinafter, processing of the information management system at the time of medication will be described.
The process from step S21 to S23 is the same as the process from step S1 to S3 of the first embodiment. However, after that, the concealment diagnostic therapeutic agent ID is not restored as in the first embodiment. That is, the reading terminal device 130 associates the concealed diagnostic therapeutic agent ID information read from the wireless tag device 110 with the patient ID information read from the barcode presenting unit 120 (or further, the information is related to the medication Information related to the action) is used as processing history information, which is transmitted to the database device 250 (step S24). This processing history information is received by the communication unit 155 of the database device 250 and stored in the RAM 152. The CPU 151 into which the control program 154bb has been read stores the processing history information stored in the RAM 152 in the storage unit 154b of the external storage device 154 as one record of the treatment history DB 254ba (step S25). The treatment history DB 154ba in FIG. 7 is an example in the case where “patient ID information”, “confidential diagnosis treatment ID information”, “name of nurse in charge”, and “medication date / time” are elements of the processing history information. Yes, each element of the processing history information is each element of the columns “patient”, “administered drug”, “nurse”, and “administration date” of the treatment history DB 254ba. “Patient ID information” is a search key. In other words, the treatment history DB 254ba of the present embodiment uses the medication processing (corresponding to “information indicating the history of processing related to both the first management target and the second management target”) as one record, and the diagnosis used for the medication processing. Diagnostic treatment agent ID information (“first concealment ID information”) that conceals diagnostic treatment agent ID information (corresponding to “first ID information”) for identifying a treatment agent (“first management target”). This is a database in which patient ID information (“second ID information”) for identifying a patient (“second management target”) who has been administered is associated with each other and patient ID information is set as a search key.

  With such a data structure, even if the treatment history DB 254ba leaks to the outside, the correspondence between the patient ID information and the patient, and the correspondence between the diagnostic treatment agent ID information and the diagnostic treatment agent are known to the outside. Even so, an attacker who cannot restore the concealed diagnostic / therapeutic agent ID information cannot restore the diagnostic / therapeutic agent ID information, and thus cannot specify the medical practice indicated by each record. Thereby, privacy protection can be achieved. Further, the treatment history DB 254ba is configured without concealing the patient ID information, and the patient ID information is used as a search key, so that the treatment history DB 254ba can be easily searched. This is because there is no need to restore the search key during the search.

  Also in this embodiment, the same processing as steps S9 to S12 of the first embodiment is performed (steps S26 to S29), and the concealed diagnostic therapeutic agent ID information in the memory 111 of the wireless tag device 110 is updated. And in this form, the concealment diagnostic therapeutic agent ID information updated in this way is used as an element of the treatment history DB 254ba as it is. Therefore, even in the case of concealment diagnostic therapeutic agent ID information corresponding to the same diagnostic therapeutic agent, another symbol string is recorded as an element in the treatment history DB 254ba. Therefore, even if the data of the treatment history DB 254ba leaks, the patient's medication tendency is not estimated from the identity of the concealed diagnostic treatment agent ID information.

<Other variations>
In this embodiment, the treatment history DB 254ba with the patient ID information associated with the concealed diagnostic therapeutic agent ID information as a record and the patient ID information as a search key is constructed. It is good also as constructing | assembling treatment history DB which uses as a search key the record which linked | related the diagnostic therapeutic agent ID information as a record, and uses diagnostic diagnostic agent ID information as a search key. Further, the concealed diagnostic therapeutic agent ID information stored in the wireless tag device 110 is not used as an element of the treatment history DB 254ba as it is, but is reconcealed into another concealed diagnostic therapeutic agent ID information, and then the element of the treatment history DB 254ba. It is good. Furthermore, as a concealment method at this time, it is possible to prevent an attacker from deriving the relevance between the concealed data by using a cipher having a property like a stochastic cipher. Alternatively, a treatment history DB may be constructed simply by recording the association between the concealed patient ID information and the concealed diagnostic therapeutic agent ID information, or a part other than the patient ID information and the diagnostic therapeutic agent ID information. You may build the database which uses the element of as a search key.

[Third Embodiment]
Next, a third embodiment of the present invention will be described.
In this embodiment, “first identification device” is “wireless tag device”, “second identification device” is also “wireless tag device”, “first ID information” is “diagnostic treatment agent ID information”, and “second ID” The present invention is applied with “information” as “patient ID information”. And the database which uses diagnostic therapeutic agent ID information as a search key, and the database which uses patient ID information as a search key are constructed | assembled. In the following description, differences from the embodiments described above will be mainly described.

<Configuration>
FIG. 9 is a conceptual diagram illustrating the overall configuration of the information management system 300 according to the third embodiment. In the following description, the same reference numerals as those used in the first and second embodiments are assigned to portions common to the first and second embodiments.
As illustrated in FIG. 9, the information management system 300 of this embodiment includes a wireless tag device 110 (corresponding to “first identification device”), a wireless tag device 320 (corresponding to “second identification device”), and a tag reader / writer device. A reading terminal device 330 including 131 (corresponding to “reading reception unit” and “reading input unit”), a security server device 140, database devices 350 and 450, and a management device 160. In the example of this embodiment, the wireless tag device 110 is attached to the container of each diagnostic therapeutic agent 4, and the wireless tag device 320 is attached to the patient 1 by the wristband 2. The reading terminal device 330, the security server device 140, the database devices 350 and 450, and the management device 160 are configured to be communicable via a network 170 such as a LAN (Local Area Network).

FIG. 10A is a block diagram illustrating the configuration of the wireless tag device 320 according to the third embodiment.
As illustrated in FIG. 10A, the wireless tag device 320 of the present embodiment includes a memory 321 (second concealed ID memory), an interface 322 (corresponding to a “second transmission unit”), a control unit 323, have.

FIG. 11 is a block diagram illustrating the configuration of the reading terminal device 330 according to the third embodiment.
As illustrated in FIG. 11, the reading terminal device 330 according to the present embodiment includes a tag reader / writer device 131, a CPU 133, a ROM 134, a RAM 135, a display unit 136 such as a liquid crystal display unit, and a communication unit 137 (“reading information transmission”). An internal clock 138, and a bus 139 that connects these components so as to communicate with each other. Details of data stored in the RAM 135 and data read by the CPU 133 will be described later.

FIG. 12 is a block diagram illustrating a configuration of the database apparatus 350 according to the third embodiment.
As illustrated in FIG. 12, the database device 350 according to the present embodiment includes a CPU 351, a RAM 352, a ROM 353, an external storage device 354, a communication unit 355, and a bus 356 that connects these devices so as to communicate with each other. Yes. The external storage device 354 includes a read / write unit 354a that reads and writes data and a storage unit 354b that stores various data. Details of data stored in the storage unit 354b and data read by the CPU 351 will be described later.

FIG. 13 is a block diagram illustrating the configuration of the database device 450 according to the third embodiment.
As illustrated in FIG. 13, the database device 450 of this embodiment includes a CPU 451, a RAM 452, a ROM 453, an external storage device 454, a communication unit 455, and a bus 456 that connects these components so as to communicate with each other. Yes. The external storage device 454 includes a read / write unit 454a that reads and writes data and a storage unit 454b that stores various data. Details of data stored in the storage unit 454b and data read by the CPU 451 will be described later.

<Processing>
[Preprocessing]
As preprocessing, the patient ID information 321a of the patient 1 to which the wireless tag device 320 is attached is stored in the memory 321 of the wireless tag device 320. The RAM 135 of the reading terminal device 330 stores a control program 135a for controlling the reading terminal device 330, an encryption program 335e for performing encryption, and an encryption key 335f for that purpose. In addition, in the storage unit 354b of the external storage device 354 of the database device 350, a control program 354bb for controlling the processing of the database device 350, a decryption key 354bd corresponding to the encryption key stored in the reading terminal device 330, and decryption A decryption program 354be for decrypting ciphertext using the key 354bd is stored. Further, a control program 454bb for controlling the processing of the database device 450 is stored in the storage unit 454b of the external storage device 454 of the database device 450. Note that the preprocessing of the wireless tag device 110 and the security server device 140 is the same as that in the first embodiment.

[Medication treatment]
Next, the medication process of this embodiment will be described. 14 and 15 are sequence diagrams for explaining processing of the information management system 300 at the time of medication. It is the same as in the first embodiment until the nurse 3 places each diagnostic therapeutic agent 4 taken out from the medicine shelf 5 on a wagon or the like and takes it to the bed with the patient indicated by the medical instruction. Description is omitted. Hereinafter, processing of the information management system 300 at the time of medication will be described.
First, the nurse 3 operates the reading terminal device 330 in a state in which the tag reader / writer device 131 is arranged in the vicinity of the wireless tag devices 110 and 320 attached to the diagnostic and therapeutic agent 4 used for medication and the patient 1 who performs medication, respectively. Then, a reading instruction is given to the reading terminal device 330. On the other hand, in the reading terminal device 330, the tag reader / writer device 331 outputs an ID reading request under the control of the CPU 133 that has read the control program 135a (step S41). This ID reading request is attached to the interface 112 of the wireless tag device 110 (the wireless tag device attached to the container of the diagnostic therapeutic agent 4 used for medication) and the wireless tag device 320 (the patient 1 who is going to perform the medication). Received by the interface 322 of the wireless tag device. The control unit 113 of the wireless tag device 110 that has detected the reception of the ID reading request reads the key ID information 111a and the concealed diagnostic therapeutic agent ID information 111ba stored in the storage areas 111a and 111b of the memory 111, respectively. These are transmitted from the interface 122 (step S42). Further, the control unit 323 of the wireless tag device 320 that has detected the reception of the ID reading request reads out the patient ID information 321a stored in the memory 321 and transmits it from the interface 322 (step S43). These are received by the tag reader / writer device 131 of the reading terminal device 330 and stored in the RAM 135 as key ID information 135c, concealed diagnostic therapeutic agent ID information 135d, and patient ID information 135e. Thereafter, as in the first embodiment, in order to prevent medical errors such as patient misconceptions, preferably, the concealed diagnostic therapeutic agent ID information and the patient ID information are collated with a medical instruction immediately before medication.

  Then, after the medical action such as medication is completed, the nurse 3 operates the reading terminal device 330 to give an instruction to register the medical action history database in order to record the medical action history. On the other hand, the CPU 133 into which the encryption program 335e has been read reads the patient ID information 135e and the encryption key 335f from the RAM 335, and uses the encryption key 335f to encrypt the patient ID information 135e and encrypts the patient ID information 335g. It is generated and stored in the RAM 335 (step S44).

Next, the CPU 133 into which the control program 135a has been read generates processing history information in which the key ID information 135c read from the RAM 335, the concealed diagnostic therapeutic agent ID information 135d, and the encrypted patient ID information 355g are associated with each other. In addition, information related to the medication action (for example, medication date and time read from the internal clock 138 or the name of the nurse 3 in charge stored in the RAM 135) is associated with the information as processing history information. Good.
The generated processing history information is transmitted from the communication unit 137 to the database devices 350 and 450 through the network 170 (step S45).

  The processing history information transmitted to the database device 350 is received by the communication unit 355 and stored in the RAM 352. The CPU 351 that has read the decryption program 354be uses the decryption key 354bd read from the storage unit 354b to decrypt the encrypted patient ID information included in the processing history information stored in the RAM 352, thereby generating patient ID information. The generated patient ID information is stored in the RAM 352 (step S46). Next, the CPU 351 into which the control program 154bb has been read sets the information relating the patient ID information stored in the RAM 352 and the information constituting the processing history information as one record of the treatment history database (DB) 354ba, The data is stored in the storage unit 354b of the external storage device 354 (step S47). In the example of FIG. 12, “patient ID information”, “confidential diagnosis treatment ID information”, “name of nurse in charge”, and “medication date” are shown in columns “patient”, “administered drug”, “nurse”. Each element of “administration date” is used, and “patient ID information” is used as a search key.

  The processing history information transmitted to the database device 450 is received by the communication unit 455 and stored in the RAM 452. Next, the CPU 451 into which the control program 454bb has been read reads the key ID information and the concealment diagnosis treatment ID information constituting the processing history information from the RAM 452, and these are read from the communication unit 455 via the network 170 and the security server device 140. It transmits to address and requests | requires decoding of concealment diagnosis treatment ID information (step S48).

  This request information is received by the communication unit 145 of the security server device 140 (FIG. 4) and stored in the RAM 142. Next, the CPU 141 into which the ID information restoration program 144bc has been read reads the key ID information 135c from the RAM 142, and uses this to search the key table 144ba stored in the storage unit 144b of the external storage device 144, thereby obtaining the key ID information. The decryption key corresponding to 135c is read out. Next, the CPU 141 decrypts the concealed diagnostic treatment ID information 135d read from the RAM 142 by using this decryption key to obtain diagnostic treatment ID information (step S49). The obtained diagnostic treatment ID information is transmitted from the communication unit 145 to the reading terminal device 330 through the network 170 (step S50).

This diagnostic treatment ID information is received by the communication unit 455 of the database device 450 and stored in the RAM 452. The CPU 451 into which the control program 454bb has been read associates the diagnostic treatment ID information stored in the RAM 452 with the encrypted patient ID information constituting the processing history information as one record of the treatment history DB 454ba. The data is stored in the storage unit 454b of the external storage device 454 (step S51). In the example of FIG. 13, “diagnostic treatment ID information”, “encrypted patient ID information”, “nurse name”, “medication date / time” are displayed in columns “patient”, “administered drug”, “nurse”, and “administration date / time”. It is an element, and diagnostic treatment ID information is used as a search key.
Thereafter, also in this embodiment, the same processing as steps S9 to S12 of the first embodiment is performed (steps S52 to S55), and the concealed diagnostic therapeutic agent ID information in the memory 111 of the wireless tag device 110 is updated.

  As described above, in the present embodiment, the processing history is treated as a search key using plain text patient ID information, and the treatment history DB 354ba (stored in the database device 350) in which the diagnostic treatment ID information is concealed, and the plain text diagnostic treatment ID. The treatment history DB 454ba (stored in the database device 450) in which the information is used as a search key and the patient ID information is encrypted is distributedly generated. Thereby, if any database is used, a process history can be easily searched regardless of any of patient ID information and diagnostic therapeutic agent ID as a search condition. Furthermore, even if information in any database leaks, a third party who does not know the decryption key cannot know the combination of the patient ID information and the diagnostic treatment ID information corresponding to each medication process. As a result, it is possible to achieve both convenience in database search and improvement in privacy protection.

  Note that the encryption of the patient ID information performed by the reading terminal device 330 is preferably performed using an encryption method having the property of a stochastic encryption. Thereby, it becomes possible to generate different encrypted patient ID information for the same patient ID information. As a result, even if the treatment history DB 454a of the database device 450 is leaked to the outside, a third party who does not know the decryption key of the encrypted patient ID information can store a plurality of records corresponding to the same patient ID information from the treatment history DB 454a. Finding relevance becomes difficult.

[Modification of Third Embodiment]
Next, a modification of the third embodiment will be described. In this modification, concealment patient ID information is stored in the wireless tag device 320 attached to the patient 1. Hereinafter, the difference from the third embodiment will be mainly described.
<Configuration>
The configuration other than the wireless tag device 320 is the same as that of the third embodiment. Hereinafter, only the configuration of the wireless tag device 320 of this modification will be described.
FIG. 10B is a block diagram illustrating the configuration of the wireless tag device 320 according to a modification of the third embodiment. The difference from the configuration of FIG. 10A described above is that the patient ID information 321a is not stored in the memory 321, but the concealed patient ID information 321ba is stored in the storage area 321b and the concealment is performed. The key ID information 321aa used for conversion is stored in the storage area 321a. Others are the same as the structure of Fig.10 (a). Note that these pieces of information are stored in the memory 321 by preprocessing. Similarly to the case of the wireless tag device 110, the encryption key used for concealing the concealed patient ID information 321ba, and the corresponding key ID information and decryption key are stored in the key table 144ba of the security server device 140. .

<Processing>
Next, the medication process of this embodiment will be described. 16 and 17 are sequence diagrams for explaining the processing of the information management system of the present modification example at the time of medication. It is the same as in the first embodiment until the nurse 3 places each diagnostic therapeutic agent 4 taken out from the medicine shelf 5 on a wagon or the like and takes it to the bed with the patient indicated by the medical instruction. Description is omitted. Hereinafter, the process of the information management system of this modification at the time of medication will be described.

  First, the nurse 3 operates the reading terminal device 330 in a state in which the tag reader / writer device 131 is arranged in the vicinity of the wireless tag devices 110 and 320 attached to the diagnostic and therapeutic agent 4 used for medication and the patient 1 who performs medication, respectively. Then, a reading instruction is given to the reading terminal device 330. On the other hand, in the reading terminal device 330, the tag reader / writer device 331 outputs an ID reading request under the control of the CPU 133 that has read the control program 135a (step S61). This ID reading request is attached to the interface 112 of the wireless tag device 110 (the wireless tag device attached to the container of the diagnostic therapeutic agent 4 used for medication) and the wireless tag device 320 (the patient 1 who is going to perform the medication). Received by the interface 322 of the wireless tag device. The control unit 113 of the wireless tag device 110 that has detected the reception of the ID reading request reads the key ID information 111a and the concealed diagnostic therapeutic agent ID information 111ba stored in the storage areas 111a and 111b of the memory 111, respectively. These are transmitted from the interface 122 (step S62). Further, the control unit 323 of the wireless tag device 320 that has detected the reception of the ID reading request reads the key ID information 321aa and the concealed patient ID information 321ba stored in the memory 321 and transmits them from the interface 322. (Step S63). The key ID information 111a and the concealed diagnostic therapeutic agent ID information 111ba, and the key ID information 321aa and the concealed patient ID information 321ba are received by the tag reader / writer device 131 of the reading terminal device 330 and stored in the RAM 135. Thereafter, as in the first embodiment, in order to prevent medical errors such as patient misconceptions, preferably, the concealed diagnostic therapeutic agent ID information and the patient ID information are collated with a medical instruction immediately before medication.

  Then, after the medical action such as medication is completed, the nurse 3 operates the reading terminal device 330 to give an instruction to register the medical action history database in order to record the medical action history. On the other hand, the CPU 133 into which the encryption program 335e has been read reads the key ID information 111a, the concealed diagnostic therapeutic agent ID information 111ba, the key ID information 321aa, and the concealed patient ID information 321ba from the RAM 335, Generate associated processing history information. In addition, information related to the medication action (for example, medication date and time read from the internal clock 138 or the name of the nurse 3 in charge stored in the RAM 135) is associated with the information as processing history information. Good. The generated processing history information is transmitted from the communication unit 137 of the reading terminal device 330 to the database devices 350 and 450 via the network 170 (step S64).

  The processing history information transmitted to the database device 350 is received by the communication unit 355 and stored in the RAM 352. Next, the CPU 351 into which the control program 354bb has been read reads the key ID information 321aa and the concealed patient ID information 321ba constituting the processing history information from the RAM 352, and these are read from the communication unit 355 via the network 170 to the security server device. 140 is transmitted to request decryption of the concealed patient ID information 321ba (step S65).

  This request information is received by the communication unit 145 of the security server device 140 (FIG. 4) and stored in the RAM 142. Next, the CPU 141 into which the ID information restoration program 144bc has been read reads the key ID information 321aa from the RAM 142, and uses this to search the key table 144ba stored in the storage unit 144b of the external storage device 144, thereby obtaining the key ID information. The decryption key corresponding to 135c is read out. Next, the CPU 141 decrypts the concealed patient ID information 321ba read from the RAM 142 by using this decryption key to obtain patient ID information (step S66). The obtained patient ID information is transmitted from the communication unit 145 to the reading terminal device 330 through the network 170 (step S67).

This patient ID information is received by the communication unit 355 of the database device 350 and stored in the RAM 352. Then, the CPU 351 that has read the control program 354bb associates the patient ID information stored in the RAM 352 with the concealed diagnostic therapeutic agent ID information constituting the processing history information as one record of the treatment history DB 354ba. Then, it is stored in the storage unit 354b of the external storage device 354 (step S68).
Further, the database device 450 to which the processing history information has been transmitted performs diagnostic treatment ID information, concealed patient ID information constituting the processing history information, and the like by the same processing as steps S48 to S51 of the third embodiment. Is stored in the storage unit 454b of the external storage device 454 as one record of the treatment history DB 454ba (steps S69 to S72).

  Thereafter, also in this embodiment, the same processing as steps S9 to S12 of the first embodiment is performed (steps S73 to S75), and the concealed diagnostic therapeutic agent ID information in the memory 111 of the wireless tag device 110 is updated. Further, the concealment of the concealed patient ID information is also performed by the same processing as in steps S9 to S12, and the concealed patient ID information and the corresponding key ID information are included in the wireless tag device 320. The memory areas 321b and 321a of the memory 321 are overwritten respectively (step S76).

  In this way, by concealing the concealed patient ID information stored in the wireless tag device 320 as well, resistance to the hot list attack is further improved. Moreover, in this modification, the updated concealed diagnostic therapeutic agent ID information and concealed patient ID information are used as elements of the treatment history DBs 354a and 454a constructed in the database devices 350 and 450 as they are. Here, it is difficult for a third party who does not know the decryption key to find the relationship between the concealed diagnostic therapeutic agent ID information and the concealed patient ID information before and after the update. Therefore, even if the information of the treatment history DB 354a, 454a leaks to the outside, a third party who does not know the decryption key of the concealed diagnostic therapeutic agent ID information or the concealed patient ID information from the information of the treatment history DB 354a, 454a, The relevance of a plurality of records corresponding to the same patient ID information and the relevance of a plurality of records corresponding to the same diagnosis / treatment agent ID information cannot be found. Thereby, privacy leakage can be prevented. In addition, the same effects as those of the third embodiment can be obtained.

[Modifications, etc.]
The present invention is not limited to the embodiment described above.
For example, in each of the above-described embodiments, the concealment diagnostic therapeutic agent ID information and the concealment patient ID information are reconcealed by re-encryption. However, every time concealed diagnostic therapeutic agent ID information or concealed patient ID information is output from the wireless tag device, the concealed diagnostic therapeutic agent ID information or the concealed patient ID information is stored in a hash chain method. Concealment or re-concealment may be performed. In the case of the hash chain method, every time the confidential diagnosis therapeutic agent ID information (or concealed patient ID information) is output from the wireless tag device, the confidential diagnosis therapeutic agent ID information (or confidential information) is output by each wireless tag device. Updated patient ID information). For the hash chain method, see, for example, M. Ohkubo et al., “Cryptographic Approach to a Privacy Friendly Tag,” RFID Privacy Workshop @ MIT, http://www.rfidprivacy.org/papers/ohokubo.pdf, It is familiar with 2003 etc.

  Further, each ID may be concealed and re-concealed by a method other than encryption or a hash chain method. For example, a random number associated with diagnostic therapeutic agent ID information or patient ID information is used as concealed diagnostic therapeutic agent ID information or concealed patient ID information, and re-concealment is performed by changing the correspondence. Good.

In each embodiment, the present invention is applied to “medical practice of administering a diagnostic therapeutic agent in a patient” as an example of “a process in which different management targets are related to each other”. The present invention may be applied to any application as long as it is an application for managing the history of processes related to each other. The first management target and the second management target are any combination of “person” and “thing”, “person” and “person”, “thing” and “person”, and “thing” and “thing”. There may be. Further, as the “identification device”, an IC card, a mobile phone, a magnetic card, or the like can be used in addition to the wireless tag device and the bar code presentation unit.
In addition, it goes without saying that the timing of re-concealment and the order of processing can be appropriately changed without departing from the spirit of the present invention. In addition, the system may be configured by appropriately combining the above-described embodiments and modifications.

  The programs describing the processing contents of the reading terminal device, the security server device, and the database device can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, the magnetic recording device may be a hard disk device or a flexible Discs, magnetic tapes, etc. as optical disks, DVD (Digital Versatile Disc), DVD-RAM (Random Access Memory), CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), etc. As the magneto-optical recording medium, MO (Magneto-Optical disc) or the like can be used, and as the semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  As a field of use of the present invention, in addition to the application to the medical management system in the medical field as described above, for example, the management of semi-finished products in the manufacturing process, the management system of rental video, and the like can be exemplified.

FIG. 1 is a conceptual diagram illustrating the overall configuration of the information management system according to the first embodiment. FIG. 2 is a block diagram illustrating the configuration of the wireless tag device according to the first embodiment. FIG. 3 is a block diagram illustrating the configuration of the reading terminal device according to the first embodiment. FIG. 4 is a block diagram illustrating the configuration of the security server device according to the first embodiment. FIG. 5 is a block diagram illustrating the database device according to the first embodiment. FIG. 6 is a sequence diagram for explaining processing of the information management system at the time of medication according to the first embodiment. FIG. 7 is a block diagram illustrating a database device according to the second embodiment. FIG. 8 is a sequence diagram for explaining processing of the information management system of the second embodiment at the time of medication. FIG. 9 is a conceptual diagram illustrating the overall configuration of the information management system according to the third embodiment. FIG. 10A is a block diagram illustrating the configuration of the wireless tag device according to the third embodiment. FIG. 10B is a block diagram illustrating the configuration of a wireless tag device in a modification of the third embodiment. FIG. 11 is a block diagram illustrating the configuration of the reading terminal device according to the third embodiment. FIG. 12 is a block diagram illustrating the configuration of the database device according to the third embodiment. FIG. 13 is a block diagram illustrating the configuration of the database device according to the third embodiment. FIG. 14 is a sequence diagram for explaining processing of the information management system according to the third embodiment at the time of medication. FIG. 15 is a sequence diagram for explaining processing of the information management system according to the third embodiment at the time of medication. FIG. 16 is a sequence diagram for explaining processing of the information management system according to the modification of the third embodiment at the time of medication. FIG. 17 is a sequence diagram for explaining processing of the information management system according to the modification of the second embodiment at the time of medication.

Explanation of symbols

100,300 Information management system

Claims (3)

An information management system for managing a history of processes related to different management targets,
A first concealment ID memory for storing the first concealment ID information in which the first ID information for identifying the first management target is concealed; and a first transmission unit for wirelessly transmitting the first concealment ID information. And a first identification device attached to the first management target,
Second ID information for identifying the second management target or second concealment ID information concealing the second ID information can be output, and a second identification device attached to the second management target;
A reading and receiving unit that receives the first concealment ID information wirelessly transmitted from the first identification device, and the second ID information or the second concealment ID information output from the second identification device are input. a reading input unit, and the first privileged ID information and reading terminal comprising a a reading information transmitting unit transmits the process history information associated with the above-described first 2ID information or the second concealed ID information device,
On SL first concealed ID information corresponding to the processing history information, after updating to the first privileged ID information and the first privileged ID information that a new difficulty is to find the relevance, the new stored in association with the first 2ID information corresponding to the first concealed ID information and the processing history information, a first and a database apparatus for constructing a database that the search key the first 2ID information, and
The first concealment ID information stored in the first concealment ID memory is:
Updated to other first concealment ID information that is difficult to find the relevance with the first concealment ID information at an opportunity determined by an arbitrary setting condition;
An information management system characterized by that. The information management system according to claim 1,
The second identification device is
A second concealment ID memory for storing the second concealment ID information; and a second transmission unit for wirelessly transmitting the second concealment ID information,
The reading input unit is
Receiving the second concealment ID information wirelessly transmitted from the second identification device;
The second concealed ID information stored in the second concealed ID memory is
It is updated to other second concealment ID information that is difficult to find the relevance with the second concealment ID information at an opportunity determined by an arbitrary setting condition ,
The information management system
After updating the second concealed ID information corresponding to the process history information to new second concealed ID information that is difficult to find the relevance with the second concealed ID information, the process history information Further comprising a second database device that associates and stores the first ID information corresponding to the new second concealed ID information and constructs a database using the first ID information as a search key.
An information management system characterized by that. An information management method that is executed in an information management system having a first identification device, a second identification device, a reading terminal device, and a first database device, and that manages the history of processes related to different management targets,
A first identification device including a first concealed ID memory storing first concealed ID information in which the first ID information for identifying the first management target is concealed is attached to the first management target. ,
A second identification device for identifying the second management object or a second identification device capable of outputting the second concealed ID information concealing the second ID information is attached to the second management object,
The first concealment ID information stored in the first concealment ID memory is another time when it is difficult to find the relevance with the first concealment ID information when triggered by an arbitrary setting condition. Updated to concealment ID information,
When a process in which the first management target and the second management target are related to each other is performed,
A process in which the first transmitter of the first identification device wirelessly transmits the first concealed ID information;
A process in which the second transmission unit of the second identification device wirelessly transmits the second ID information or the second concealed ID information;
Reading receiver of the reading terminal device, the method comprising: receiving a wireless transmitted the first privileged ID information from the first transmission portion of the first identification device,
Reading input portion of the upper Symbol reading terminal device, the method comprising receiving an input of the second identification device of the above output from the second transmitting unit the 2ID information or the second concealed ID information,
A step of reading information transmitting section of the upper Symbol reading terminal device transmits the process history information that associates with the first privileged ID information and the second 2ID information or the second concealed ID information,
Reading section of the first database device, the processing on the Symbol first concealed ID information corresponding to the history information, the first privileged ID information to the first concealment it is difficult new finding relevance After updating to the ID information, the new first concealed ID information and the second ID information corresponding to the processing history information are associated with each other and stored in the storage unit of the first database device , and the second ID information is stored. The process of building a database as a search key is executed.
An information management method characterized by that.

Images