JP6708086B2 - Operation information recording program, operation information recording device, and operation information recording method - Google Patents

Description

The present invention relates to an operation information recording program, an operation information recording device, and an operation information recording method.

Conventionally, in a fraud monitoring system, a technique is known in which identification information of an operator who operates the information processing apparatus and event contents such as logon and logoff to the information processing apparatus are associated and recorded as an audit log. In this technique, for example, the identification information of the account logged in to the information processing device is treated as the identification information of the operator.

There is also known a technique of identifying a client terminal that has accessed data to be tracked based on an access log stored in a server.

There is also known a technique of identifying an unauthorized event by collating time-series data of an operation history of an operator with respect to an information processing device and a pattern of abnormal processing.

JP, 2006-195634, A JP, 2007-048266, A JP, 2005-222216, A

When information leakage occurs in the information processing system, for example, the administrator investigates which operator has operated each information processing apparatus constituting the information processing system from the operation log or the like.

For example, when a plurality of operators share a certain information processing apparatus and operate the information processing apparatus, after logging in once with a shared account of the operating system, logout and logon to the information processing apparatus are performed every time the operator changes. May not be. That is, in this case, even if the operator of the information processing device changes, the account logged in to the information processing device does not change. Therefore, in this case, if the account logged in to the information processing device is treated as the operator of the information processing device, it becomes difficult to identify the actual operator of the information processing device from the operation log or the like.

An object of one aspect of the present invention is to easily specify an operator who has performed a specific operation on an information processing device.

According to one aspect of the present invention, information for identifying an operation on an information processing device is acquired. Further, when the input of the identification information of the operator to the specific area included in the screen of the software operating on the operating system of the information processing device is received, the following information among the information specifying the acquired operation is displayed. Extract. That is, from the acquired information that specifies the operation, information that specifies the operation corresponding to the period corresponding to the time when the input is received is extracted. Then, the information for identifying the extracted operation is recorded in association with the received identification information of the operator.

As one aspect, there is an effect that an operator who has performed a specific operation on the information processing apparatus can be easily specified.

It is a block diagram showing a schematic structure of a medical information system concerning each embodiment. It is a figure which shows an example of the screen of the electronic medical record software which operates on the operating system of a terminal. It is a functional block diagram of an operation information recording device according to the first embodiment. It is a figure which shows an example of an operation table. It is a figure which shows an example of a person in charge table. It is a figure which shows an example of an operator table. It is a figure which shows the modification of an operator table. It is a block diagram showing a schematic structure of a computer which functions as an operation information recording device concerning each embodiment. 7 is a flowchart showing an example of operation information recording processing according to each embodiment. 6 is a flowchart showing an example of an operator recording process according to the first embodiment. It is a functional block diagram of an operation information recording device concerning a 2nd embodiment. It is a figure which shows an example of an authentication login table. It is a figure which shows an example of a connection table. It is a figure which shows an example of a 1st operator table. It is a figure which shows an example of a 2nd operator table. It is a figure which shows an example of an event log table. It is a figure which shows an example of a position information table. It is a figure which shows an example of a 3rd operator table. 9 is a flowchart illustrating an example of a person-in-charge recording process according to the second embodiment. It is a flow chart which shows an example of attestation recording processing concerning a 2nd embodiment. It is a flow chart which shows an example of amendment processing concerning a 2nd embodiment. It is a flowchart which shows an example of the log table update process which concerns on 2nd Embodiment.

Hereinafter, an example of an embodiment of the present invention will be described in detail with reference to the drawings. In each of the following embodiments, a case where the present invention is applied to a medical information system will be described as an example.

[First Embodiment]
First, the configuration of the medical information system 10 according to the present embodiment will be described with reference to FIG. As shown in FIG. 1, the medical information system 10 includes a plurality of terminals 12 and an operation information recording device 14. The terminal 12 and the operation information recording device 14 are connected to the network 16. The terminal 12 is an example of an information processing apparatus, and an example of the terminal 12 is a personal computer. A server computer is an example of the operation information recording device 14.

When the operator operates the terminal 12, the terminal 12 transmits information (hereinafter, referred to as “operation information”) specifying the operation on the terminal 12 to the operation information recording device 14 via the network 16. In the present embodiment, the terminal 12 transmits, as the operation information, the date and time when the operation on the terminal 12 is performed (hereinafter, referred to as “operation date and time”) and the operation type such as the keyboard and the mouse to the operation information recording device 14. ..

In addition, the terminal 12 transmits the operator identification information input to the specific area included in the screen of the software operating on the operating system (OS) of the terminal 12 to the operation information recording device 14 via the network 16. .. In the present embodiment, as shown in FIG. 2 as an example, in the terminal 12, when the person-in-charge name is input in the person-in-charge input area 18 included in the screen of the electronic medical record software operating on the OS of the terminal 12, The following processing is performed. In this case, the terminal 12 transmits the person-in-charge name input to the input area 18 to the operation information recording device 14 as identification information of the operator of the terminal 12. Further, in this case, the terminal 12 also transmits to the operation information recording device 14 the date and time when the person in charge is input in the input area 18 (hereinafter referred to as “person input date and time”).

Next, with reference to FIG. 3, a functional configuration of the operation information recording device 14 according to the present embodiment will be described. As shown in FIG. 3, the operation information recording device 14 includes an acquisition unit 20, an extraction unit 22, and a recording unit 24. In addition, in the predetermined storage area of the operation information recording device 14, each of the operation table 40, the person-in-charge table 42, and the operator table 44 is individually stored for each terminal 12.

The acquisition unit 20 acquires the operation information transmitted from the terminal 12. Then, the acquisition unit 20 records the acquired operation information in the operation table 40 corresponding to the terminal 12 that is the transmission source of the operation information.

FIG. 4 shows an example of the operation table 40. As shown in FIG. 4, the operation table 40 records the operation date and time included in the operation information and the information indicating the operation type performed on the terminal 12.

The acquisition unit 20 also acquires the person-in-charge input date and time transmitted from the terminal 12 and the person-in-charge name input in the input area 18. Then, the acquisition unit 20 records the acquired person input date and time and the acquired person name in the person table 42 corresponding to the terminal 12 that is the sender of the person input date and time and the person name.

FIG. 5 shows an example of the person-in-charge table 42. As shown in FIG. 5, the person-in-charge table 42 records the person-in-charge input date and time, and records the person-in-charge name entered in the input area 18 as the operator of the terminal 12.

When the acquisition unit 20 acquires the person-in-charge input date and time and the person-in-charge name, the extraction unit 22 selects the record corresponding to the period corresponding to the acquired person-input date and time from the records recorded in the operation table 40. Extract. In the present embodiment, the extraction unit 22 extracts records within the predetermined period (for example, 1 minute) before and after the person-in-charge input date and time acquired by the acquisition unit 20 from the records recorded in the operation table 40. To do.

The recording unit 24 records the record extracted by the extraction unit 22 in the operator table 44 in association with the corresponding person-in-charge name. In the present embodiment, the recording unit 24 sets, in the operator table 44, the date and time of a record that is earlier than the person-in-charge input date and time among the records extracted by the extraction unit 22 as the start date and time when the operation of the terminal 12 is started. Record. Further, the recording unit 24 records, in the operator table 44, the date and time of the record that is later than the person-in-charge input date and time, among the records extracted by the extraction unit 22, as the end date and time when the operation of the terminal 12 is finished. Then, the recording unit 24 records the name of the person in charge in the operator table 44 as the operator of the terminal 12 in association with the start date and time and the end date and time.

In the present embodiment, when the extraction unit 22 extracts a plurality of records with a date and time earlier than the person-in-charge input date and time, the recording unit 24 sets the earliest date and time among the extracted records as the start date and time for the operator. Record in table 44. Further, in the present embodiment, when the extraction unit 22 extracts a plurality of records having a date and time later than the person-in-charge input date and time, the recording unit 24 sets the latest date and time among the extracted records as the end date and time for the operator. Record in table 44.

Further, in the present embodiment, when the extraction unit 22 does not extract the record of the date and time within the predetermined period before the person-in-charge input date and time, the recording unit 24 sets the person-in-charge input date and time as the start date and time in the operator table 44. Record. Further, when the extraction unit 22 does not extract the record of the date and time within the predetermined period after the person-in-charge input date and time, the recording unit 24 records the person-in-charge input date and time as the end date and time in the operator table 44.

FIG. 6 shows an example of the operator table 44. As shown in FIG. 6, the operator table 44 records the start date and time, the end date and time, and the operator in time series. In addition, the recording unit 24, when records of the same operator are consecutive in the operator table 44 and the difference between the end date and time of the previous record and the start date and time of the subsequent record is within a predetermined period (for example, 30 minutes), You may perform the process shown below. That is, in this case, the recording unit 24 sets the records in which the same operator continues as one record with the start date and time of the record with the earliest start date and time as the start date and time and the end date and time of the record with the latest end date and time as the end date and time. May be recorded in the operator table 44 as FIG. 7 shows an example of the operator table 44 in the case where the same operator of the operator table 44 shown in FIG. 6 records consecutive records as one record.

The operation information recording device 14 can be realized by, for example, the computer 60 shown in FIG. The computer 60 includes a Central Processing Unit (CPU) 61, a memory 62 as a temporary storage area, and a non-volatile storage unit 63. The computer 60 also includes an input/output device 64 such as a display device and an input device. The computer 60 also includes a Read/Write (R/W) unit 65 that controls reading and writing of data from the recording medium 68, and a network I/F 66 connected to the network. The CPU 61, the memory 62, the storage unit 63, the input/output device 64, the R/W unit 65, and the network I/F 66 are connected to each other via a bus 67.

The storage unit 63 can be realized by a hard disk drive (HDD), a solid state drive (SSD), a flash memory, or the like. An operation information recording program 70 for causing the computer 60 to function as the operation information recording device 14 is stored in the storage unit 63 as a storage medium. The operation information recording program 70 has an acquisition process 71, an extraction process 72, and a recording process 73. The storage unit 63 also includes an information storage area 74 in which the operation table 40, the person-in-charge table 42, and the operator table 44 are stored.

The CPU 61 reads the operation information recording program 70 from the storage unit 63, expands it in the memory 62, and executes the process included in the operation information recording program 70. The CPU 61 operates as the acquisition unit 20 illustrated in FIG. 3 by executing the acquisition process 71. The CPU 61 operates as the extraction unit 22 illustrated in FIG. 3 by executing the extraction process 72. The CPU 61 operates as the recording unit 24 illustrated in FIG. 3 by executing the recording process 73. As a result, the computer 60 that executes the operation information recording program 70 functions as the operation information recording device 14.

Further, the function realized by the operation information recording program 70 can also be realized by, for example, a semiconductor integrated circuit, more specifically, an application specific integrated circuit (ASIC) or the like.

Next, the operation of the operation information recording device 14 according to the present embodiment will be described. When the operation information recording device 14 executes the operation information recording program 70, the operation information recording process shown in FIG. 9 and the operator recording process shown in FIG. 10 are executed. The operation information recording process shown in FIG. 9 and the operator recording process shown in FIG. 10 are executed by the CPU 61, for example, when the power of the operation information recording device 14 is turned on.

In step S10 of the operation information recording process illustrated in FIG. 9, the acquisition unit 20 waits until the operation information transmitted from the terminal 12 is received. When the acquisition unit 20 acquires the operation information transmitted from the terminal 12 via the network I/F 66, the determination in step S10 becomes a positive determination, and the process proceeds to step S12.

In the next step S12, the acquisition unit 20 records the operation information acquired in step S10 in the operation table 40 corresponding to the terminal 12 that is the transmission source of the operation information. When the process of step S12 ends, the process returns to step S10.

On the other hand, in step S20 of the operator recording process illustrated in FIG. 10, the acquisition unit 20 waits until it receives the person-in-charge input date and time transmitted from the terminal 12 and the person-in-charge name input in the input area 18. When the acquisition unit 20 acquires the person input date and time and the person name transmitted from the terminal 12 through the network I/F 66, the determination in step S20 is affirmative, and the process proceeds to step S22. .

In step S22, the acquisition unit 20 records the person-in-charge input date and time and the person-in-charge name acquired in step S20 in the person-in-charge table 42 corresponding to the terminal 12 that is the sender of the person-in-charge input date and time and the person-in-charge name. In the next step S24, the extraction unit 22 extracts the record corresponding to the period corresponding to the person input date and time acquired in step S20 from the records recorded in the operation table 40, as described above.

In the next step S26, the recording unit 24 records the record acquired in step S24 in the operator table 44 in association with the corresponding person-in-charge name, as described above. When the process of step S26 ends, the process returns to step S20.

As described above, according to the present embodiment, the operation information recording device 14 acquires the information specifying the operation on the terminal 12. Further, when the operation information recording device 14 receives the input of the identification information of the operator to the input area 18 included in the screen of the software operating on the OS of the terminal 12, the operation information recording device 14 among the acquired information for specifying the operation is Extract the information shown below. That is, in this case, the operation information recording device 14 extracts, from the acquired information specifying the operation, information specifying the operation corresponding to the period corresponding to the time when the input is received. Then, the operation information recording device 14 records the information specifying the extracted operation in the operator table 44 in association with the received identification information of the operator.

Therefore, for example, the administrator of the medical information system 10 can easily identify the operator who performed a specific operation on the terminal 12 by referring to the operator table 44.

[Second Embodiment]
Next, a second embodiment will be described. In the medical information system according to this embodiment, the same parts as those of the medical information system 10 according to the first embodiment are designated by the same reference numerals, and detailed description thereof will be omitted.

As shown in FIG. 1, the medical information system 210 according to this embodiment includes a plurality of terminals 212 and an operation information recording device 214.

Similar to the terminal 12 according to the first embodiment, the terminal 212 transmits the operation date and time and the operation type such as the keyboard and the mouse to the operation information recording device 214 as the operation information. Further, like the terminal 12 according to the first embodiment, the terminal 212 transmits the person-in-charge name and the person-in-charge date and time to the operation information recording device 214 when the person-in-charge name is input to the input area 18.

In addition, the terminal 212 records the operation date and time (hereinafter, referred to as “authentication date and time”) when the operator is authenticated by software such as scheduler software that authenticates the operator operating on the OS. Device 214. Further, in this case, the terminal 212 further transmits the identification information of the operator used for the authentication to the operation information recording device 214.

Next, the functional configuration of the operation information recording device 214 according to the present embodiment will be described with reference to FIG. As shown in FIG. 11, the operation information recording device 214 includes an acquisition unit 220, an extraction unit 222, and a recording unit 224. Further, each of the operation table 40, the person-in-charge table 42, the authentication login table 246, the combined table 248, the first operator table 250, and the second operator table 252 is stored in a predetermined storage area of the operation information recording device 214. It is individually stored for each terminal 212. Further, in the predetermined storage area of the operation information recording device 214, the event log table 254 and the third operator table 258 are individually stored for each terminal 212. Further, a position information table 256 is stored in a predetermined storage area of the operation information recording device 214.

FIG. 12 shows an example of the authentication login table 246. As shown in FIG. 12, the date and time and the operator are recorded in the authentication login table 246. FIG. 13 shows an example of the combination table 248. As shown in FIG. 13, the date and time and the operator are recorded in the combination table 248. The combined table 248 is a table in which the records of the person-in-charge table 42 and the authentication login table 246 are recorded.

FIG. 14 shows an example of the first operator table 250. As shown in FIG. 14, the first operator table 250 records the start date and time, the end date and time, and the operator. The first operator table 250 is a table in which records based on the records of the combined table 248 are recorded. FIG. 15 shows an example of the second operator table 252. As shown in FIG. 15, the start date and time, the end date and time, and the operator are recorded in the second operator table 252. The second operator table 252 is a table in which a record obtained by correcting the record of the first operator table 250 is recorded.

FIG. 16 shows an example of the event log table 254. As shown in FIG. 16, the event log table 254 records the date and time, the operation content, and the operator. In the present embodiment, as the operation content of the event log table 254, the operation content by the operator is recorded by the log recording software when the login and logout operations are performed on the terminal 212, for example.

Further, in the operation content of the event log table 254, the operation content by the operator is recorded by the log recording software when the operation of starting and ending the software on the OS of the terminal 212 is performed. Further, in the operation content of the event log table 254, the operation content by the operator is recorded by the log recording software when a file operation such as copying and deleting of a file on the OS of the terminal 212 is performed. Further, in the operation content of the event log table 254, the operation content by the operator is recorded by the log recording software when a login operation and a logout operation for the Web system are performed. Further, as the date and time of the event log table 254, the date and time when the above-described various operations are performed by the operator are recorded by the log recording software.

FIG. 17 shows an example of the position information table 256. As shown in FIG. 17, in the location information table 256, the network address of the network segment to which the terminal 212 is connected is recorded in advance for each installation location of the terminal 212.

FIG. 18 shows an example of the third operator table 258. As shown in FIG. 18, the start date and time, the end date and time, and the operator are recorded in the third operator table 258. The third operator table 258 is a table in which a record obtained by correcting the record of the second operator table 252 is recorded.

Note that in the present embodiment, among the tables shown in FIG. 11, each table other than the position information table 256 is associated with the Internet Protocol (IP) address of the corresponding terminal 212. That is, in the present embodiment, the installation location of the terminal 212 corresponding to each table can be specified by referring to the location information table 256. Instead of the IP address of the terminal 212, other identification information such as the host name of the terminal 212 may be used to specify the installation location of the terminal 212.

Similar to the acquisition unit 20 according to the first embodiment, the acquisition unit 220 acquires the operation information transmitted from the terminal 212, and acquires the acquired operation information from the operation table 40 corresponding to the terminal 212 that is the transmission source of the operation information. To record. Further, the acquisition unit 220 acquires the person-in-charge input date and time transmitted from the terminal 212 and the person-in-charge name input in the input area 18, similarly to the acquisition unit 20 according to the first embodiment. Then, the acquisition unit 220, in the same manner as the acquisition unit 20 according to the first embodiment, assigns the acquired person input date and time and the person name corresponding to the person input date and time and the terminal 12 that is the sender of the person name. It records in the person table 42.

The acquisition unit 220 also acquires the authentication date and time transmitted from the terminal 212 and the identification information of the operator used for the authentication. Then, the acquisition unit 220 records the acquired authentication date and time and identification information in the authentication login table 246 corresponding to the authentication date and time and the terminal 12 that is the transmission source of the identification information.

The extraction unit 222 extracts, from the records recorded in the operation table 40, the records corresponding to the period corresponding to the start date and time and the end date and time of the records recorded in the first operator table 250. In the present embodiment, the extraction unit 222 selects, from the records recorded in the operation table 40, records within a predetermined period (for example, 1 minute) before the start date and time of the record recorded in the first operator table 250. Extract. Further, the extraction unit 222 extracts, from the records recorded in the operation table 40, the records within a predetermined period (for example, 1 minute) after the end date and time of the record recorded in the first operator table 250.

The recording unit 224 reads all the records in the person-in-charge table 42 and the authentication login table 246, rearranges them in chronological order using the date/time column, and records them in the combined table 248. As an example, FIG. 13 shows a combined table 248 in which all records of the person-in-charge table 42 shown in FIG. 5 and the authentication login table 246 shown in FIG. 12 are sorted in time series and recorded. ..

In addition, the recording unit 224 sets the earliest date and time as the start date and time and the latest date and time as the end date and time for the records in which the same operator continues in the combination table 248, and sets the start date and time, the end date and time, and the operator as the first operator. Record in table 250. FIG. 14 shows, as an example, a first operator table 250 in which the start date and time, the end date and time, and the operator are recorded based on the combination table 248 shown in FIG. Note that in the present embodiment, the recording unit 224 sets the start date and time, the end date and time, and the operator to the first record for the records in which the same operator in the combination table 248 is not consecutive, with the date and time of the record as the start date and time and the end date and time. Record in the operator table 250.

Further, the recording unit 224 reads each record of the first operator table 250, corrects the start date and time and the end date and time of each record to the date and time of the corresponding record (operation information) extracted by the extraction unit 222, This is recorded in the second operator table 252. In the present embodiment, when a plurality of records are extracted by the extraction unit 222, the recording unit 224 sets the start date and time to the earliest date and time record among the records extracted by the extraction unit 222 corresponding to the start date and time. Correct to the date and time of. When a plurality of records are extracted by the extraction unit 222, the recording unit 224 sets the end date and time to the date and time of the record with the latest date and time among the records extracted by the extraction unit 222 corresponding to the end date and time. to correct. If the extraction unit 222 does not extract a record corresponding to the start date/time and the end date/time, the recording unit 224 records the record on the second operator table 252 without correcting the start date/time and the end date/time.

In FIG. 15, as an example, the start date and time and the end date and time of the first operator table 250 are corrected and recorded based on the operation table 40 shown in FIG. 4 and the first operator table 250 shown in FIG. The second operator table 252 is shown. As shown in FIG. 15, for example, the start date and time of the first record in FIG. 14 is the date and time of a record (third record from the top in FIG. 4) within 1 minute before the start date and time in the operation table 40. It is corrected and recorded in the second operator table 252.

The recording unit 224 also reads each record of the second operator table 252 and corrects the start date and time and the end date and time of each record based on the operation table 40, the event log table 254, and the position information table 256. 3 Record in the operator table 258. Hereinafter, this correction process will be described.

In addition, here, in order to avoid the complication, as an example, a case where the second operator table 252 corresponding to the terminal 212 (hereinafter, referred to as “target terminal 212”) installed in the internal medicine on the first floor is corrected will be described. To do. Further, here, each table such as the operation table 40 corresponding to the target terminal 212, the second operator table 252, and the third operator table 258 will be described with the word “target” added at the beginning. .. In addition, here, regarding each table such as the event log table 254 corresponding to the terminal 212 (for example, the terminal installed in the office on the fifth floor) that is separated from the target terminal 212 by a predetermined distance or more, “other” is added at the head. Will be explained.

Further, here, a record whose date and time in the target operation table 40 is not included within the range of the start date and time and the end date and time of each record in the target second operator table 252 is referred to as an unprocessed record.

In the present embodiment, the recording unit 224 extracts the operator of the other event log table 254 recorded at the date and time within a predetermined period (for example, 1 minute) before and after the date and time of the unprocessed record. The recording unit 224 also determines that the extracted operator cannot operate the target terminal 212 at the date and time of the unprocessed record. Then, the recording unit 224 corrects the end date and time of the record immediately before the date and time of the unprocessed record or the start date and time of the record immediately after the date and time of the unprocessed record in the second operator table 252.

Specifically, the record of the operation table 40 of FIG. 4 whose date and time is “2015/12/16 08:46:38” will be described as an example. Further, in the other event log table 254, a record in which the operator is “A” is recorded at a date and time within a predetermined period (for example, 1 minute) after “2015/12/16 08:46:38”. The case will be described as an example.

In this case, as shown in FIG. 14, among the records before and after “2015/12/16 08:46:38” of the target second operator table 252, the operator of the previous record is the other event log table 254. Will be recorded in. In this case, the recording unit 224 determines that “A” cannot operate the target terminal 212 at “2015/12/16 08:46:38”. That is, the recording unit 224 is the “C” recorded by the operator of the subsequent record of the records before and after the record of the operator of the target terminal 212 of “2015/12/16 08:46:38”. To determine. Then, the recording unit 224 corrects the start date and time of the subsequent record to “2015/12/16 08:46:38” and records it in the third operator table 258.

As described above, the recording unit 224 determines whether it is impossible to operate the target terminal 212 by using the record of the other event log table 254, but the present invention is not limited to this. For example, the recording unit 224 cannot operate the target terminal 212 by using the records of the table in which the date and the operator are recorded such as the other second operator table 252 and the third operator table 258. May be determined.

The recording unit 224 also records the operator in the record of the event log table 254 based on the third operator table 258. In the present embodiment, the recording unit 224 determines the operator of the record of the third operator table 258 that includes the date and time of the record of the event log table 254 from the start date and time to the end date and time of the record of the event log table 254. Record to the operator.

The operation information recording device 214 can be realized by, for example, the computer 60 shown in FIG. An operation information recording program 270 for causing the computer 60 to function as the operation information recording device 214 is stored in the storage unit 63. The operation information recording program 270 has an acquisition process 271, an extraction process 272, and a recording process 273. The storage unit 63 also has an information storage area 274 in which the operation table 40, the person-in-charge table 42, the authentication login table 246, the connection table 248, and the first operator table 250 are stored. The information storage area 274 also stores a second operator table 252, an event log table 254, a position information table 256, and a third operator table 258.

The CPU 61 reads the operation information recording program 270 from the storage unit 63, expands it in the memory 62, and executes the process of the operation information recording program 270. The CPU 61 operates as the acquisition unit 220 illustrated in FIG. 11 by executing the acquisition process 271. The CPU 61 operates as the extraction unit 222 illustrated in FIG. 11 by executing the extraction process 272. The CPU 61 operates as the recording unit 224 shown in FIG. 11 by executing the recording process 273. As a result, the computer 60 that executes the operation information recording program 270 functions as the operation information recording device 214.

Further, the function realized by the operation information recording program 270 can also be realized by, for example, a semiconductor integrated circuit, more specifically, an ASIC or the like.

Next, with respect to the operation of the operation information recording device 214 according to the present embodiment, differences from the operation information recording device 14 according to the first embodiment will be described. When the operation information recording device 214 executes the operation information recording program 270, the operation information recording process shown in FIG. 9, the person-in-charge recording process shown in FIG. 19, the authentication recording process shown in FIG. 20, the correction process shown in FIG. And the log table update process shown in FIG. 22 is executed. The operation information recording process shown in FIG. 9, the person-in-charge recording process shown in FIG. 19, and the authentication recording process shown in FIG. 20 are executed by the CPU 61, for example, when the power of the operation information recording device 214 is turned on. .. The correction process shown in FIG. 21 is executed by the CPU 61 at regular timings such as once a day at midnight. Further, the log table update process shown in FIG. 22 is executed by the CPU 61 after the correction process shown in FIG. 21, for example.

The correction process shown in FIG. 21 may be executed serially or in parallel for the tables corresponding to the terminals 212. Further, the log table update process shown in FIG. 22 may be executed serially or in parallel for the tables corresponding to each terminal 212.

In step S40 of the person-in-charge recording process illustrated in FIG. 19, the acquisition unit 220 waits until the person-in-charge input date and time transmitted from the terminal 212 and the person-in-charge name input in the input area 18 are received. When the acquiring unit 220 acquires the person-in-charge input date and time and the person-in-charge name transmitted from the terminal 212 by receiving the person-in-charge via the network I/F 66, the determination in step S40 becomes affirmative, and the process proceeds to step S42. .

In step S42, the acquisition unit 220 records the person-in-charge input date and time and the person-in-charge name acquired in step S40 in the person-in-charge table 42 corresponding to the terminal 212 that is the sender of the person-in-charge input date and time and person-in-charge name. When the process of step S42 ends, the process returns to step S40.

In step S50 of the authentication recording process illustrated in FIG. 20, the acquisition unit 220 waits until the authentication date and time transmitted from the terminal 212 and the operator identification information used for the authentication are received. When the acquisition unit 220 acquires the authentication date and time and the identification information transmitted from the terminal 212 by receiving them via the network I/F 66, the determination in step S50 becomes a positive determination, and the process proceeds to step S52.

In step S52, the acquisition unit 220 records the authentication date and time and the identification information acquired in step S50 in the authentication login table 246 corresponding to the terminal 212 that is the sender of the authentication date and time and the identification information. When the process of step S52 ends, the process returns to step S50.

In step S60 of the correction process shown in FIG. 21, the recording unit 224 reads all the records in the person-in-charge table 42 and the authentication login table 246, rearranges them in chronological order using the date and time column, and records them in the combined table 248. In the next step S62, as described above, the recording unit 224 sets the earliest date and time as the start date and time and the latest date and time as the end date and time, and the start date and time and the end date and time for the records in which the same operator in the combination table 248 continues. , And the operator are recorded in the first operator table 250. In addition, the recording unit 224 sets the start date and time, the end date and time, and the operator in the first operator table 250 for the records in which the same operator in the combination table 248 is not consecutive as the start date and the end date and time. Record.

In the next step S64, the recording unit 224 substitutes "1" for the variable N used as a counter. In the next step S66, the recording unit 224 reads the Nth record of the first operator table 250. In the next step S68, the extraction unit 222 determines whether or not the operation table 40 has a record with a date and time within a predetermined period before the start date and time of the record read in step S66. If the determination is negative, the process proceeds to step S74, and if the determination is positive, the process proceeds to step S70.

In step S70, the extraction unit 222 extracts, from the operation table 40, records having a date and time within a predetermined period before the start date and time of the record read in step S66. In the next step S72, the recording unit 224 corrects the start date and time of the record read in step S66 to the date and time of the record extracted in step S70. In the present embodiment, when a plurality of records are extracted in step S70, the recording unit 224 sets the start date and time of the record read in step S66 to the earliest date and time among the plurality of extracted records. Correct to the date and time of the record.

In step S74, the extraction unit 222 determines whether or not there is a record in the operation table 40 whose date and time is within a predetermined period after the end date and time of the record read in step S66. If the determination is negative, the process proceeds to step S80, and if the determination is positive, the process proceeds to step S76.

In step S76, the extraction unit 222 extracts, from the operation table 40, records having a date and time within a predetermined period after the end date and time of the record read in step S66. In the next step S78, the recording unit 224 corrects the end date and time of the record read in step S66 to the date and time of the record extracted in step S76. In addition, in the present embodiment, when a plurality of records are extracted in step S76, the recording unit 224 sets the end date and time of the record read in step S66 to the latest date and time of the plurality of extracted records. Correct to the date and time of the record.

In step S80, the recording unit 224 records in the second operator table 252 the record read in step S66 and subjected to the processes of steps S68 to S78. In the next step S82, the recording unit 224 adds “1” to the variable N. In the next step S84, the recording unit 224 determines whether or not the processes of steps S66 to S82 have been completed for all the records of the first operator table 250. If the determination is negative, the process returns to step S66, and if the determination is positive, the process proceeds to step S86.

In the next step S86, the recording unit 224 reads each record of the second operator table 252 as described above. Then, as described above, the recording unit 224 corrects the start date and time and the end date and time of each read record based on the operation table 40, the other event log table 254, and the position information table 256, and the third operator Record in table 258. When the process of step S86 ends, the correction process ends.

In step S100 of the log table updating process illustrated in FIG. 22, the recording unit 224 substitutes “1” into the variable M used as the counter. In the next step S102, the recording unit 224 reads the Mth record of the third operator table 258.

In the next step S104, the recording unit 224 determines whether or not there is a record of the date and time included in the period from the start date and time to the end date and time of the record read in step S102 in the event log table 254. If the determination is negative, the process proceeds to step S108, and if the determination is positive, the process proceeds to step S106.

In step S106, the operator of the record read in step S102 is recorded as the operator of the record of the date and time included in the period from the start date and time to the end date and time of the record read in step S102 in the event log table 254. To do.

In step S108, the recording unit 224 adds “1” to the variable M. In the next step S110, the recording unit 224 determines whether or not the processes from step S102 to step S108 have been completed for all the records in the third operator table 258. If the determination is negative, the process returns to step S102, and if the determination is positive, the log table update process ends.

As described above, according to the present embodiment, when the person-in-charge name input to the input area 18 continuously shows the same person-in-charge name, the operation information recording device 214 continuously receives the input time. Among these, the operation information within a predetermined period before the earliest time is extracted. Further, in this case, the operation information recording device 214 extracts the operation information within a predetermined period after the latest time among the times when the input is continuously received.

Further, the operation information recording device 214 uses the time of the operation information corresponding to the earliest time as the start time when the operation on the terminal 212 is started, and the time of the operation information corresponding to the latest time as the operation for the terminal 212. The end time is the end time. Then, the operation information recording device 214 records the start time and the end time in association with the operator identification information. Therefore, the operator who has performed the specific operation on the terminal 212 can be easily specified.

Further, according to the present embodiment, the operation information recording device 214 corresponds to the period according to the authenticated time when the operator is authenticated by the software that operates on the OS of the terminal 212. The operation information to be extracted is further extracted. Therefore, the operator who has performed the specific operation on the terminal 212 can be accurately specified.

In each of the above-described embodiments, a case has been described in which each table other than the position information table 256 is prepared for each terminal 12 (212), but the present invention is not limited to this. For example, a configuration may be used in which each table other than the position information table 256 is prepared one by one. In this case, an example is given in which each table is provided with an identification information string that uniquely identifies the terminal 12 (212) and the record of each table is identified to which terminal 12 (212).

Further, in each of the above embodiments, the case where the acquisition unit 20 (220) acquires the person-in-charge input date and time and the person-in-charge name transmitted from the terminal 12 (212) has been described, but the present invention is not limited to this. For example, the acquisition unit 20 (220) may acquire the person-in-charge input date and time and the person-in-charge name from the log output by the electronic medical record software.

Moreover, in the said 2nd Embodiment, although the acquisition part 220 demonstrated the case where the authentication date and time and the identification information of the operator used for authentication were transmitted from the terminal 212, it is not limited to this. For example, the acquisition unit 220 may acquire the authentication date and time and the identification information of the operator used for the authentication from the log output by the software that authenticates the operator.

Further, in each of the above embodiments, the date and time of each table in which the date and time are recorded may be omitted and the time may be recorded.

Further, in each of the above-described embodiments, the mode in which the operation information recording programs 70 and 270 are stored (installed) in the storage unit 63 in advance has been described, but the present invention is not limited to this. The operation information recording programs 70 and 270 can be provided in a form recorded in a recording medium such as a CD-ROM, a DVD-ROM, a USB memory, and a memory card.

With respect to each of the above embodiments, the following supplementary notes are further disclosed.

(Appendix 1)
Acquire information that identifies the operation on the information processing device,
When the input of the identification information of the operator to the specific area included in the screen of the software operating on the operating system of the information processing device is received, the information specifying the operation is acquired at the time when the input is received. Extract the information that identifies the operation corresponding to the corresponding period,
Information for identifying the extracted operation is recorded in association with the received identification information of the operator,
An operation information recording program that causes a computer to execute a process.

(Appendix 2)
When the identification information of the operator input to the specific area indicates the same operator continuously, the operation is identified within a predetermined period before the earliest time among the times when the input is continuously received. To extract the information to specify, and the information specifying the operation within a predetermined period after the latest time,
The time of the information specifying the operation corresponding to the earliest time is set as a start time when the operation for the information processing apparatus is started, and the time of the information specifying the operation corresponding to the latest time is set in the information processing apparatus. As the end time when the operation for is ended, the start time and the end time are recorded in association with the identification information of the operator,
The operation information recording program described in appendix 1.

(Appendix 3)
When a plurality of pieces of information identifying the operation corresponding to the earliest time are extracted, the time of the information identifying the operation at the earliest time is set as the start time, and the information identifying the operation corresponding to the latest time When a plurality of is extracted, the time of the information specifying the operation at the latest time is set as the end time, and the start time and the end time are recorded in association with the operator's identification information,
The operation information recording program described in appendix 2.

(Appendix 4)
When the operator is authenticated by the software that authenticates the operator operating on the operating system of the information processing device, further extracting information that identifies the operation corresponding to the period according to the authenticated time,
Information for identifying the extracted operation is further recorded in association with the identification information of the authenticated operator.
The operation information recording program according to any one of appendices 1 to 3, characterized in that

(Appendix 5)
An acquisition unit that acquires information that specifies an operation on the information processing device;
When the input of the identification information of the operator to the specific area included in the screen of the software operating on the operating system of the information processing device is received, the input among the information specifying the operation acquired by the acquisition unit is performed. An extraction unit that extracts information that identifies an operation corresponding to a period corresponding to the time when
A recording unit that records the information identifying the operation extracted by the extraction unit in association with the received identification information of the operator,
An operation information recording device comprising:

(Appendix 6)
When the identification information of the operator input to the specific area indicates the same operator continuously, the extraction unit is within a predetermined period before the earliest time among the times when the input is continuously received. Of the information identifying the operation, and extracting the information identifying the operation within a predetermined period after the latest time,
The recording unit sets the time of the information identifying the operation corresponding to the earliest time as the start time when the operation on the information processing apparatus is started, and the time of the information identifying the operation corresponding to the latest time. Is recorded as the end time when the operation on the information processing device is finished, in association with the start time and the end time in association with the identification information of the operator,
The operation information recording device as described in appendix 5, characterized in that

(Appendix 7)
When a plurality of pieces of information identifying the operation corresponding to the earliest time are extracted, the recording unit sets the time of the information identifying the operation at the earliest time to the start time, and corresponds to the latest time. When a plurality of pieces of information identifying the operation are extracted, the start time and the end time are recorded in association with the operator's identification information, with the time of the information specifying the operation at the latest time as the end time. To do
The operation information recording device as described in appendix 6, characterized in that

(Appendix 8)
When the operator is authenticated by software that authenticates the operator operating on the operating system of the information processing apparatus, the extraction unit provides information that identifies an operation corresponding to a period corresponding to the authenticated time. Extract further,
The recording unit further records information identifying the operation extracted by the extraction unit in association with identification information of the authenticated operator.
8. The operation information recording device according to any one of appendices 5 to 7, characterized in that.

(Appendix 9)
Acquire information that identifies the operation on the information processing device,
When the input of the identification information of the operator to the specific area included in the screen of the software operating on the operating system of the information processing device is received, the information specifying the operation is acquired at the time when the input is received. Extract the information that identifies the operation corresponding to the corresponding period,
Information for identifying the extracted operation is recorded in association with the received identification information of the operator,
A method for recording operation information, characterized in that a computer executes the processing.

(Appendix 10)
When the identification information of the operator input to the specific area indicates the same operator continuously, the operation is identified within a predetermined period before the earliest time among the times when the input is continuously received. To extract the information to specify, and the information specifying the operation within a predetermined period after the latest time,
The time of the information specifying the operation corresponding to the earliest time is set as a start time when the operation for the information processing apparatus is started, and the time of the information specifying the operation corresponding to the latest time is set in the information processing apparatus. As the end time when the operation for is ended, the start time and the end time are recorded in association with the identification information of the operator,
The operation information recording method as described in appendix 9, wherein:

(Appendix 11)
When a plurality of pieces of information identifying the operation corresponding to the earliest time are extracted, the time of the information identifying the operation at the earliest time is set as the start time, and the information identifying the operation corresponding to the latest time When a plurality of is extracted, the time of the information specifying the operation at the latest time is set as the end time, and the start time and the end time are recorded in association with the operator's identification information,
11. The operation information recording method as set forth in appendix 10, characterized in that.

(Appendix 12)
When the operator is authenticated by the software that authenticates the operator operating on the operating system of the information processing device, further extracting information that identifies the operation corresponding to the period according to the authenticated time,
Information for identifying the extracted operation is further recorded in association with the identification information of the authenticated operator.
12. The operation information recording method according to any one of appendices 9 to 11, characterized in that.

(Appendix 13)
Acquire information that identifies the operation on the information processing device,
When the input of the identification information of the operator to the specific area included in the screen of the software operating on the operating system of the information processing device is received, the information specifying the operation is acquired at the time when the input is received. Extract the information that identifies the operation corresponding to the corresponding period,
Information for identifying the extracted operation is recorded in association with the received identification information of the operator,
A storage medium storing an operation information recording program, which causes a computer to execute a process.

10, 210 Medical information system 12, 212 Terminal 14, 214 Operation information recording device 18 Input area 20, 220 Acquisition section 22, 222 Extraction section 24, 224 Recording section 40 Operation table 42 Person table 44 Operator table 61 CPU
62 memory 63 storage unit 68 recording medium 70, 270 operation information recording program 246 authentication login table 248 connection table 250 first operator table 252 second operator table 254 event log table 256 position information table 258 third operator table

Claims (6)

Acquire information that identifies the operation on the information processing device,
When the input of the identification information of the operator to the specific area included in the screen of the software operating on the operating system of the information processing device is received, the information specifying the operation is acquired at the time when the input is received. Extract the information that identifies the operation corresponding to the corresponding period,
Information for identifying the extracted operation is recorded in association with the received identification information of the operator,
An operation information recording program that causes a computer to execute a process. When the identification information of the operator input to the specific area indicates the same operator continuously, the operation is identified within a predetermined period before the earliest time among the times when the input is continuously received. To extract the information to specify, and the information specifying the operation within a predetermined period after the latest time,
The time of the information specifying the operation corresponding to the earliest time is set as a start time when the operation for the information processing apparatus is started, and the time of the information specifying the operation corresponding to the latest time is set in the information processing apparatus. As the end time when the operation for is ended, the start time and the end time are recorded in association with the identification information of the operator,
The operation information recording program according to claim 1, wherein When a plurality of pieces of information identifying the operation corresponding to the earliest time are extracted, the time of the information identifying the operation at the earliest time is set as the start time, and the information identifying the operation corresponding to the latest time. When a plurality of is extracted, the time of the information specifying the operation at the latest time is set as the end time, and the start time and the end time are recorded in association with the operator's identification information,
The operation information recording program according to claim 2, wherein When the operator is authenticated by the software that authenticates the operator operating on the operating system of the information processing device, further extracting information that identifies the operation corresponding to the period according to the authenticated time,
Information for identifying the extracted operation is further recorded in association with the identification information of the authenticated operator.
The operation information recording program according to any one of claims 1 to 3, wherein An acquisition unit that acquires information that specifies an operation on the information processing device;
When the input of the identification information of the operator to the specific area included in the screen of the software operating on the operating system of the information processing device is received, the input among the information specifying the operation acquired by the acquisition unit is performed. An extraction unit that extracts information that identifies an operation corresponding to a period corresponding to the time when
A recording unit that records the information identifying the operation extracted by the extraction unit in association with the received identification information of the operator,
An operation information recording device comprising: Acquire information that identifies the operation on the information processing device,
When the input of the identification information of the operator to the specific area included in the screen of the software operating on the operating system of the information processing device is received, the information specifying the operation is acquired at the time when the input is received. Extract the information that identifies the operation corresponding to the corresponding period,
Information for identifying the extracted operation is recorded in association with the received identification information of the operator,
A method for recording operation information, characterized in that a computer executes the processing.