JP5675372B2 - Virus monitoring system and virus monitoring method - Google Patents

Description

  The present invention relates to a virus monitoring system suitable for medical facilities and the like.

  A medical diagnostic apparatus is an apparatus used for diagnosis of a living body, such as an X-ray CT apparatus, an MRI apparatus, and an ultrasonic diagnostic apparatus. In order to operate the medical diagnostic apparatus so as not to impair its functions and effects, the medical diagnostic apparatus is strongly subject to legal regulations regarding changes and modifications. The medical diagnostic apparatus uses a PC or the like and is in danger of a computer virus (hereinafter, virus). It is common for normal PCs to have anti-virus software installed and to check for virus infections along with regular virus definition file updates. Also, in remodeling, it must be strictly managed. In addition, the delay in updating the virus definition file becomes a threat to new viruses, and it is important to regularly check the virus infection status and update the virus definition file on a daily basis.

Under such circumstances, as described in Patent Document 1, conventionally, removal after being infected with a virus has been mainly performed.
Further, although a method for detecting a file in binary data format, which is often a virus, is disclosed in Patent Document 2, no consideration is given to a virus whose data format is different from binary.

JP 2007-213239 A JP 2009-223478 A

  In a virus monitoring system in a medical facility, since a medical diagnostic device or the like cannot be changed or modified, the virus definition file cannot be updated and there is a risk of being infected with a new virus. In addition, in order to avoid remodeling of the medical diagnostic apparatus, the latest virus definition file is installed in an external device such as a USB device, and this is connected to the medical diagnostic apparatus so that virus scanning can be performed periodically. Yes, but it must be done manually for each medical diagnostic device, such as attaching / detaching an external device or importing the latest virus definition file to a USB device. It was difficult to make a check. Furthermore, since the load on the medical diagnostic apparatus is heavy during virus scan execution, there is a problem that it is difficult and inefficient to manually adjust the timing for executing virus scan every day.

  The present invention has been made in view of the above-described problems, and the object of the present invention is to periodically update a virus definition file remotely from a plurality of medical diagnostic apparatuses that cannot be changed or modified. It is to provide a virus monitoring system, a virus monitoring method, and the like that can easily monitor the infection status of a virus, prevent infection, and efficiently perform maintenance.

In order to achieve the above-described object, the first invention includes at least one medical diagnostic apparatus, a monitoring terminal connected to the medical diagnostic apparatus via a local network, and a router arranged in the local network. A maintenance server communicably connected to the monitoring terminal via the router and a public line, wherein the monitoring terminal is remotely connected to the medical diagnostic apparatus and notifies the start of virus scanning Start notification means, disk mounting means for performing disk mount processing on the storage device and external storage device of the medical diagnostic apparatus, and virtually making the external storage unit of the monitoring terminal, and whether virus scanning can be performed or not Executability acceptance means for displaying a screen for accepting selection on the medical diagnostic apparatus, and a result of a response to the screen, Other comprises a start or interrupt scan performing means a virus scan in accordance with the presence or absence of a response, and a result transmission means for transmitting the presence or absence of execution results and viral infections of the virus scan on the maintenance server, the maintenance server , Ru virus monitoring system der characterized in that it comprises a means for storing and managing the execution result of the virus scan.

According to a second aspect of the present invention, there is provided at least one medical diagnostic apparatus, a monitoring terminal connected to the medical diagnostic apparatus via a local network, a router disposed on the local network, the router and a public line A virus monitoring method executed by a virus monitoring system including a maintenance server connected to the monitoring terminal , wherein the monitoring terminal remotely connects to the medical diagnostic apparatus and notifies the start of virus scanning ; , A step of performing a disk mount process on the storage device and the external storage device of the medical diagnostic device and virtually setting the external storage unit of the monitoring terminal, and a screen for accepting selection of whether or not virus scanning can be performed. Depending on the step of displaying on the diagnostic device, the result of the response to the screen, or the presence or absence of a response. And starting or discontinuing the scan scan, the running and sending virus scan execution result and the presence or absence of virus infection to the maintenance server, the process comprising, the maintenance server, the execution result of the virus scan Ru virus monitoring method der, characterized in that to execute a process comprising the step of storing and managing.

  According to the present invention, in a virus monitoring system in a medical facility, a virus definition file is regularly updated remotely for a plurality of medical diagnostic devices that cannot be changed or modified, thereby easily monitoring a virus infection status. In this way, infection can be prevented and maintenance can be performed efficiently.

The figure which shows the structural example of the virus monitoring system as embodiment of this invention The figure which shows the example of a structure of a monitoring terminal Sequence diagram explaining router virus monitoring processing Sequence diagram for explaining virus monitoring processing by the scheduling function of the monitoring terminal Sequence diagram for explaining virus monitoring processing by the scheduling function of the maintenance terminal Sequence diagram explaining virus definition file update and deletion processing

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
As shown in FIG. 1, a virus monitoring system 1 includes a router 102, a router 102 connected to a monitoring terminal 100 in a facility 10 and at least one medical diagnostic apparatus 101 via a LAN (Local Area Network) 103. Is composed of a maintenance server 300 and a maintenance terminal 301 connected via a public line 200. The number of LANs 103 in the facility 10 to which the maintenance server 300 is connected is arbitrary, and is not limited to one facility as shown in FIG.

The monitoring terminal 100 is a CPU (Central
Processing Unit), ROM (Read Only
Memory), RAM (Random Access)
Memory), HDD (Hard Disc Drive), and other computer systems with anti-virus software installed. Also, a remote service agent that accepts commands from the remote service software of the maintenance server 300 that is set to remotely operate and execute a virus monitoring program, or that communicates with anti-virus software or a virus monitoring target device is set. ing. The monitoring terminal 100 remotely connects to one or more medical diagnostic apparatuses 101 to be monitored for viruses via the LAN 103, and executes a virus monitoring program.

The medical diagnostic apparatus 101 is an apparatus used for living body diagnosis such as an X-ray CT apparatus, an MRI apparatus, and an ultrasonic diagnostic apparatus, and is a computer system in which a CPU, a ROM, a RAM, an HDD, and the like are mounted. In FIG. 1, the monitoring terminal 100 and the medical diagnostic apparatus 101 are shown as separate components, but may be operated by the same computer system.
The router 102 is an anti-virus router that detects a virus by performing packet filtering processing on data entering the LAN 103 in the facility 10 from the public line 200.

The public line 200 may be either wired or wireless such as a network such as the Internet, a private network, or digital satellite broadcasting.
The maintenance server 300 is a computer system in which a CPU, ROM, RAM, HDD, and the like are mounted, and manages all virus infection statuses and virus definition files of one or more medical diagnostic apparatuses 101 that are subject to virus monitoring. In response to a request from 301, managed data can be extracted. Further, remote service software for remotely operating the virus monitoring program is installed, and an operation command is received from the maintenance terminal 301. In addition, it has a function to send and receive electronic mail (hereinafter, mail), and sends the results of virus scan and virus definition file update processing to the maintenance terminal by mail.

  The maintenance terminal 301 is a computer system in which a CPU, ROM, RAM, HDD, and the like are mounted, and is remotely connected to the maintenance server 300 via the public line 200. For example, the remote software service of the maintenance server 300 can be accessed using a WEB browser and the management screen can be operated, and an instruction to execute a virus scan or virus definition file update program for the medical diagnostic apparatus 101 is issued to the maintenance server 300. Can be sent to. Also, it has a function to send and receive mail, and receives confirmation of execution results and management status of the medical diagnostic apparatus 101 by mail. The number of maintenance terminals 301 is arbitrary, and is not limited to one as shown in FIG.

  As shown in FIG. 2, the monitoring terminal 100 includes a CPU 150, a setting unit 110, a storage unit 120, a display unit 130, an external storage unit 140, and the like. The CPU 150 is remotely connected to the medical diagnostic apparatus 101, virtually reads the storage device of the medical diagnostic apparatus 101 as the external storage unit 140 of the monitoring terminal 100, and executes a virus scan based on a signal from the setting unit 110 The program is read from the storage unit 120 and a virus scan is executed on the external storage unit 140. Furthermore, the monitoring terminal 100 records the virus scan result of the medical diagnostic apparatus 101 in the storage unit 120 and transmits it to the maintenance server 300.

The CPU 150 of the monitoring terminal 100 performs various controls based on the input signal from the setting unit 110, reads out the program and data stored in the external storage unit 140, loads them into the storage unit 120, and reads out the program Based on the command, a series of processes such as data calculation or processing is executed.
The setting unit 110 is configured by an input device such as a keyboard and a mouse through which an administrator of the monitoring terminal 100 inputs various operations. The setting unit 110 generates an input signal based on the operation of the administrator, and inputs and outputs via an input / output interface and bus. To the CPU 11.

The external storage unit 140 is configured with a magnetic disk or the like, and stores programs and data executed by the CPU 150. The external storage unit 140 stores anti-virus software executed by the CPU 150, a remote service agent program, a virus definition file update program, and the like.
The storage unit 120 is configured by a semiconductor memory or the like, and expands programs and data in the external storage unit 140 in accordance with instructions from the CPU 150.
The display unit 130 is a liquid crystal display, for example, and displays a processing result of the CPU 150 based on a signal received from the CPU 150 via a bus and an input / output interface. The monitoring terminal 100 is set so that the display unit of the remotely connected medical diagnostic apparatus 101 can be virtually handled as the display unit 130 of the monitoring terminal 100.
The hardware configuration of the maintenance server 300 and the maintenance terminal 301 is the same as that of the monitoring terminal 100. The monitoring terminal 100 and the maintenance terminal 301 can be a desktop PC, a notebook PC, a tablet terminal, a smartphone, or the like.

With reference to the sequence diagram of FIG. 3, a series of processing of virus detection and discovery notification of the router 102 in the virus monitoring system will be described.
In step S1, the router 102 performs a filtering process on packets entering the LAN 103 in the facility 10 and detects a virus. In step S2, the router 102 transmits a virus detection notification to the remote service agent of the monitoring terminal 100. Next, the remote service agent of the monitoring terminal 100 transmits a virus detection notification to the remote service software of the maintenance server 300 (step S3). In step S4, the remote service software of the maintenance server 300 transmits a virus detection notification mail to the maintenance terminal 301. In step S5, the maintenance staff 30 checks the virus detection notification in the maintenance terminal 301 by the received mail and performs processing. Exit.

Next, with reference to the sequence diagram of FIG. 4, a series of processes of virus scanning and notification of the result in the virus monitoring system will be described.
The anti-virus software of the monitoring terminal 100 has a scheduling function for setting the date and time of execution of virus scanning and the target device, and the schedule for each of the plurality of medical diagnostic apparatuses 101 that execute virus scanning in advance is a facility. Is set by an administrator (not shown).

In step S6, the anti-virus software of the monitoring terminal 100 activates the anti-virus software scheduling function. In step S7, the anti-virus software makes a remote connection to the medical diagnostic apparatus 101 and notifies the start of virus scanning.
In step S <b> 8, the anti-virus software of the monitoring terminal 100 performs a disk mount process using the storage device and the external storage device of the medical diagnostic apparatus 101 virtually as the external storage unit of the monitoring terminal 100.
Further, a virus scan start message is displayed on the display unit of the virtualized medical diagnostic apparatus 101 as the display unit 130, and then a screen for accepting selection of whether or not virus scan can be executed is displayed.

Here, the disk mounting process may be executed as a function of the OS (operating system) of the monitoring terminal 100. In this case, before step S8, for example, when the monitoring terminal 100 is activated, the OS automatically executes the disk mount process.
On the other hand, as described above, by providing the anti-virus software of the monitoring terminal 100 with the disk mount processing function, even when the medical diagnostic apparatus 101 is turned off, the monitoring terminal 100 can detect the medical diagnosis apparatus 101. A command to turn on the power source is notified, and a series of processes from a remote connection process, a virus scan start notification process, a disk mount process, and a scan execution process to be described later can be executed continuously.

  In step S <b> 9, the medical diagnostic apparatus 101 transmits the selection result to the antivirus software of the monitoring terminal 100. At this time, the anti-virus software of the monitoring terminal 100 suspends the process when accepting the impossibility of execution. If execution is accepted, or if the medical diagnostic apparatus does not respond even after a certain period of time, it is determined that virus scanning can be executed, and processing is continued. In step S <b> 10, the monitoring terminal 100 performs virus scanning on the storage device and the external storage device of the medical diagnostic apparatus 101 virtualized as the external storage unit 140.

Thereby, even a plurality of medical diagnostic apparatuses 101 that cannot be changed or modified can be collectively scanned from the monitoring terminal 100. In addition, since there is a virus scan execution pre-process from step S7 to step S9, it is possible to execute virus scan in consideration of the influence of the load on the medical diagnostic apparatus 101. Note that the virus countermeasure software of the monitoring terminal 100 can execute a virus scan not only on the medical diagnosis apparatus 101 but also on the external storage unit 140 of the monitoring terminal 100.
Further, the virus scan may be executed by starting the anti-virus software of the monitoring terminal 100 from the medical diagnostic apparatus 101 instead of performing the schedule set in advance by the anti-virus software of the monitoring terminal 100.

When the virus scan is completed, the anti-virus software transmits a completion notification to the remote service agent (step S11), and the remote service agent sends the result of the virus scan process of the medical diagnostic apparatus 101 and the virus infection to the remote service software of the maintenance server 300. The presence or absence is notified (step S12). The maintenance server 300 records and stores in the database all the devices to be monitored for viruses, the date and time when the virus scan was executed, and the processing result.
In step S13, the remote service software of the maintenance server 300 transmits the virus scan processing result to the maintenance terminal 301 by mail. In step S11, when the remote service agent of the monitoring terminal 100 receives the virus scan completion notification from the anti-virus software, it transmits a virus scan completion notification to the medical diagnostic apparatus 101 (step S14), and turns on the power of the medical diagnostic apparatus 101. Send a command to turn off.

In step S15, when the medical diagnostic apparatus 101 receives a power-off command from the monitoring terminal 100, the medical diagnostic apparatus 101 transmits a notification of turning off and ending to the remote service agent of the monitoring terminal 100 (step S16), and turns off the power. .
Thereby, the virus scan of the medical diagnostic apparatus 101 can be automatically executed in a time zone not used in normal business, and the influence of the load on the medical diagnostic apparatus 101 due to the virus scan execution can be minimized. .
A means for turning off the power of the medical diagnostic apparatus 101 directly from the monitoring terminal 100 may be provided. For example, hardware or software having a function of turning off the power of the medical diagnostic apparatus 101 that is remotely connected to the monitoring terminal 100 may be provided.

In step S <b> 17, the maintenance staff 30 requests a management screen for displaying the virus scan processing result of the medical diagnostic apparatus 101 from the maintenance terminal 301. The maintenance terminal 301 requests a virus scan processing result from the maintenance server 300 (step S18), and the maintenance server 300 displays the stored virus scan processing result on the screen of the maintenance terminal 301. For example, the maintenance terminal 301 accesses the maintenance server using a WEB browser or the like, requests a virus scan result, or refers to the result.
As a result, the maintenance staff 30 can check the presence / absence of virus infection status of the device to be managed whenever there is a maintenance terminal 301 that can be connected to the maintenance server 300.

With reference to the sequence diagram of FIG. 5, a series of processes when the maintenance terminal 301 performs the series of processes in which the virus scanning start instruction is issued from the monitoring terminal 100 in FIG. 4 will be described.
Similar to the anti-virus software of the monitoring terminal 100, the remote service software of the maintenance server 300 has a scheduling function for setting the date and time for executing virus scanning and the target device.
In step S <b> 20, the maintenance staff 30 sets a virus scan execution schedule of the medical diagnostic apparatus 101 to be monitored by the scheduling function of the maintenance server 300. At this time, the maintenance staff 30 may access and operate the maintenance server 300 using the maintenance terminal 301.

In step S21, the remote service software of the maintenance server 300 requests the remote service agent of the monitoring terminal 100 to execute a virus scan based on the set schedule. In step S22, the remote service agent of the monitoring terminal 100 makes a remote connection to the medical diagnostic apparatus 101 and notifies the start of virus scanning.
The processing from step S22 to step S26 is performed in steps S7 to S10 performed in the anti-virus software of the monitoring terminal 100 and the medical diagnosis apparatus 101 in FIG. 4 with the remote service agent and medical diagnosis apparatus 101 of the monitoring terminal 100. Is the process between.

In step S <b> 23, the remote service agent of the monitoring terminal 100 performs a disk mount process using the storage device and the external storage device of the medical diagnostic apparatus 101 virtually as the external storage unit of the monitoring terminal 100. Further, a virus scan start message is displayed on the display unit of the virtualized medical diagnostic apparatus 101 as the display unit 130, and then a screen for accepting selection of whether or not virus scan can be executed is displayed.
In step S <b> 24, the medical diagnostic apparatus 101 transmits the selection result to the remote service agent of the monitoring terminal 100. At this time, the remote service agent of the monitoring terminal 100 interrupts the process when accepting the impossibility of execution. If execution is accepted, or if the medical diagnostic apparatus does not respond even after a certain period of time, it is determined that virus scanning can be executed, and processing is continued.

When the remote service agent of the monitoring terminal 100 accepts execution, it instructs the anti-virus software to start the virus scan execution program (step S25), and in step S26, the monitoring terminal 100 virtualizes the medical diagnosis as the external storage unit 140. A virus scan is executed for the storage device of the device 101 and the external storage device.
Thereby, even if it is the medical diagnostic apparatus 101 which cannot be changed or modified, a virus scan can be easily performed from a remote terminal outside the facility.
As for the result notification process after the virus scan is completed, the same processes as steps S11 to S19 in FIG. 4 are performed as steps S27 to S35, and the process ends.

A series of processes for updating and deleting the virus definition file of the monitoring terminal 100 in the virus monitoring system will be described with reference to the sequence diagram of FIG.
If there is a new virus definition file corresponding to the medical diagnostic apparatus 101 subject to virus monitoring, the maintenance staff 30 uploads the virus definition file to the maintenance server 300 using means such as FTP (File Transfer Protocol) in step S36. . You may upload from the maintenance terminal 301 to the maintenance server 300.

In step S37, the maintenance staff 30 starts a management screen for operating the remote service software of the maintenance server 300 from the maintenance terminal 301, and presses a button for requesting transfer of the virus definition file uploaded in S36.
The maintenance terminal 301 transmits a virus definition file transfer request to the remote service software of the maintenance server 300 (step S38), and the maintenance server 300 transfers the corresponding virus definition file to the remote service agent of the monitoring terminal 100 (step S39).
Next, in step S40, the maintenance person 30 selects a virus definition file to be updated or deleted on the management screen on the maintenance terminal 301, and presses a button for requesting update or deletion of the virus definition file.
In step S <b> 41, the maintenance terminal 301 transmits a virus definition file update or deletion request to the remote service software of the maintenance server 300.

The remote service software of the maintenance server 300 requests the remote service agent of the monitoring terminal 100 to start a virus definition file update or deletion program (step S42), and the remote service agent of the monitoring terminal 100 updates the virus definition file. Alternatively, a deletion program is started (step S43).
Further, the remote service agent updates or deletes the corresponding virus definition file (step S44), and checks whether there is no problem with the updated or deleted virus definition file (step S45).

In step S46, the remote service agent of the monitoring terminal 100 sends a virus definition file update or deletion processing result notification to the remote service software of the maintenance server 300, and the remote service software sends the received result to the maintenance terminal 301 by mail. Then, the process ends.
As a result, it is possible to easily update or delete virus definition files from multiple remote medical diagnosis devices 101, etc. that cannot be changed or modified, and efficiently infect the latest viruses. Can be prevented.
[Modification]

4 and 5, when the monitoring terminal 100 is executing a virus scan on the medical diagnostic apparatus 101, both the monitoring terminal 100 and the medical diagnostic apparatus 101 can interrupt the ongoing virus scan.
When the user of the medical diagnostic apparatus 101 interrupts the medical diagnostic apparatus 101, the medical diagnostic apparatus 101 transmits to the monitoring terminal 100 that virus scanning has been interrupted.
When the administrator interrupts the monitoring terminal 100 or receives an interruption notification from the medical diagnostic apparatus 101, the monitoring terminal 100 transmits a virus scan interruption to the maintenance server 300.
[Effects of the embodiment of the invention]

1. As described above, it is possible to periodically execute virus scanning collectively from the monitoring terminal 100 that can be remotely connected to a plurality of medical diagnostic apparatuses 101 that cannot be changed or modified.
2. Before executing the virus scan, the monitoring terminal 100 displays a message as to whether or not the virus scan can be executed on the medical diagnostic apparatus 101, and executes the virus scan only when it is possible. This can be done in consideration of the load.
3. By turning off the power of the medical diagnostic apparatus 100 after the virus scan is executed, the virus scan can be automatically executed in a time zone that is not used in normal business.

4). The presence or absence of the virus infection status of the monitoring target device can always be confirmed from the maintenance terminal 301 that can be connected to the maintenance server 300.
5. It is possible to easily update or delete the virus definition file collectively from a plurality of medical diagnostic apparatuses 101 that cannot be changed or modified, and to efficiently prevent infection even for the latest virus. I can do it.

  The preferred embodiments of the virus monitoring system and the like according to the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to such examples. It will be apparent to those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea disclosed in the present application, and these naturally belong to the technical scope of the present invention. Understood.

100 ......... Monitoring terminal 101 ......... Medical diagnostic apparatus 300 ......... Maintenance server 301 ......... Maintenance terminal

Claims (7)

At least one medical diagnostic apparatus, a monitoring terminal that is connected to the medical diagnostic apparatus via a local network, a router that is disposed on the local network, and a communication connection that is connected to the monitoring terminal via the router and a public line A virus monitoring system comprising a maintenance server,
The monitoring terminal is
A start notification means for remotely connecting to the medical diagnostic apparatus and notifying the start of virus scanning;
Disk mounting means for performing disk mount processing on the storage device and the external storage device of the medical diagnostic apparatus, and virtually serving as an external storage unit of the monitoring terminal;
Executability accepting means for causing the medical diagnostic apparatus to display a screen for accepting selection of whether or not virus scan can be performed;
Scan execution means for starting or interrupting virus scanning according to the result of the response to the screen or the presence or absence of a response;
A result transmitting means for transmitting the execution result of the virus scan and the presence / absence of virus infection to the maintenance server,
The maintenance server
A virus monitoring system comprising means for storing and managing the execution result of the virus scan.   The scan execution means starts virus scanning when it is selected that virus scanning can be executed on the screen, interrupts processing when it is selected impossible, and if no response is received after a certain period of time, The virus monitoring system according to claim 1, wherein virus scanning is started.   2. The virus monitoring system according to claim 1, wherein the disk mounting unit notifies an instruction to turn on the power of the medical diagnostic apparatus when the power of the medical diagnostic apparatus is turned off. The monitoring terminal has a function as anti-virus software and a remote service agent of the maintenance server,
The anti-virus software comprises the functions of the start notification means, the disk mounting means, the execution permission / reception means, and the scan execution means,
The virus monitoring system according to claim 1, wherein the remote service agent has a function of the result transmission unit. The monitoring terminal has a function as anti-virus software and a remote service agent of the maintenance server,
The remote service agent comprises the functions of the start notification means, the disk mount means, the execution availability acceptance means, the scan execution means, and the result transmission means,
In the scan execution means, the remote service agent notifies the antivirus software of activation of virus scanning, and the antivirus software performs virus scanning of the medical diagnostic apparatus in response to the notification. Item 2. The virus monitoring system according to Item 1. The monitoring terminal is
Means for transmitting a command to turn off the power to the medical diagnostic apparatus after performing a virus scan on the medical diagnostic apparatus;
The medical diagnostic apparatus comprises:
The virus monitoring system according to claim 1, further comprising means for turning off the power when receiving a power-off command from the monitoring terminal. At least one medical diagnostic apparatus, a monitoring terminal that is connected to the medical diagnostic apparatus via a local network, a router that is disposed on the local network, and a communication connection that is connected to the monitoring terminal via the router and a public line A virus monitoring method executed by a virus monitoring system comprising:
The monitoring terminal is
Remotely connecting to the medical diagnostic device and notifying the start of virus scanning;
Performing a disk mount process on the storage device and the external storage device of the medical diagnostic device, and virtually setting the external storage unit of the monitoring terminal;
Displaying on the medical diagnostic apparatus a screen for accepting selection of whether or not virus scanning can be performed;
Starting or interrupting virus scanning according to the result of the response to the screen or the presence or absence of a response;
Sending the virus scan execution result and the presence or absence of virus infection to the maintenance server,
The maintenance server is
A virus monitoring method, comprising: executing a process including a step of storing and managing the execution result of the virus scan.

Images