KR101347124B1 - Method of managing electronic prescription based on one-time public information and apparatus using the same - Google Patents

Abstract

A method of processing an electronic prescription according to the present invention includes: a step that a hospital terminal generates serial number and authentication code of an electronic prescription to be issued; a step that the hospital terminal generates one-time base key (OTBK) and one-time public information (OTPI); a step that the hospital terminal generates encryption key (EK) and message authentication code key (MACK) for encrypting the electronic prescription using the OTBK; a step that the hospital terminal encrypts the electronic prescription using the encryption key; a step that the hospital terminal generates a message authentication code (MAC) for the electronic prescription using the MACK; a step that the hospital terminal transmits the serial number and authentication code to a mobile terminal of a patient and makes the serial number and authentication code to be used by the patient for requesting the electronic prescription in a drug store; and a step that the hospital terminal transmits the serial number, encrypted electronic prescription, MACK and OTPI to an electronic prescription server. [Reference numerals] (110) Hospital terminal; (111) Authentication code generation unit; (112,134) Encryption key generation unit; (113) Electronic prescription encryption unit; (114) Electronic prescription transmission unit; (115) Authentication code transmission unit; (120) Electronic prescription server; (121) Electronic prescription transmission and reception unit; (122) Electronic prescription processing unit; (123) Electronic prescription storage unit; (130) Drug store terminal; (131) Authentication input unit; (132) Electronic prescription request unit; (133) Electronic prescription reception unit; (135) Electronic prescription decoding unit; (140) Mobile terminal; (141) Authentication code reception unit; (142) Authentication code output unit

Description

Disposable public information based electronic prescription processing method and device using same {METHOD OF MANAGING ELECTRONIC PRESCRIPTION BASED ON ONE-TIME PUBLIC INFORMATION AND APPARATUS USING THE SAME}

The present invention relates to an electronic prescription processing system, and in particular, the use of E2E encryption (End-To-End Encryption) when encrypting the electronic prescription not only provides confidentiality of the electronic prescription, but also prevents information leakage from the electronic prescription server. And an electronic prescription processing technology capable of verifying the integrity of the electronic prescription.

Generally, after a patient visits a hospital and sees a doctor, he or she calculates the bill and is given a paper prescription. Patients who receive prescriptions are presented to the nearest pharmacy near the hospital, and the pharmacist in the pharmacy prepares the medicine according to the prescription received from the patient and then provides the medicine to the patient. As such, when using a paper prescription, it is very cumbersome for a patient to visit a pharmacy with a paper prescription each time.

The electronic prescription processing system is a processing system for issuing and registering an electronic prescription instead of a paper prescription to a patient after in-hospital or telemedicine, and delivering the issued electronic prescription to the pharmacy so that the patient can receive the medicine at the pharmacy. In this case, the patient does not need to deliver the paper prescription to the pharmacy, but there is a possibility that the prescription corresponding to the personal information is leaked to the outside through a server for relaying the electronic prescription.

Korean Laid-Open Patent No. 2012-0026194 discloses a technique of encrypting an electronic prescription and transmitting it directly to a mobile terminal in order to prevent the electronic prescription from leaking through a server. However, Korean Laid-Open Patent No. 2012-0026194 has a problem of increasing wireless data traffic because the electronic prescription is transmitted to the pharmacy terminal through the mobile terminal in fear of information leakage through the server, and according to the data communication performance of the mobile terminal, There is a problem that prescription treatment performance depends.

Therefore, there is an urgent need for a new technology capable of managing the electronic prescription discharge server efficiently and safely while maintaining the framework of the electronic prescription discharge process through the electronic prescription discharge server.

It is an object of the present invention to provide the confidentiality of electronic prescriptions effectively during transmission and reception of electronic prescriptions between communication subjects by using E2E encryption (end-to-end encryption) method for electronic prescriptions, and only the electronic prescriptions properly encrypted in the electronic prescription server. It exists so as to prevent information leakage from the electronic prescription server.

In addition, an object of the present invention is to further improve the strength of security by providing an integrity verification function through a message authentication code (MAC) for the encrypted electronic prescription.

It is also an object of the present invention to improve the key sharing technique of the Diffie-Hellman method to share the One-Time Public Information (OTPI) to the patient after issuing an electronic prescription in a hospital. Even if an individual chooses to autonomously select a desired pharmacy, it is possible to increase the effectiveness of the electronic prescription processing system by ensuring that the prescribed prescription is safely provided.

Electronic prescription processing method according to the present invention for achieving the above object, the hospital terminal, generating the serial number and authentication code of the electronic prescription to be issued; Generating, by the hospital terminal, a one-time base key (OTBK) and one-time public information (OTPI); Generating, by the hospital terminal, an encryption key (EK) and a message authentication code key (MACK) for encrypting the electronic prescription using the disposable base key; Encrypting, by the hospital terminal, the electronic prescription using the encryption key; Generating, by the hospital terminal, a message authentication code (MAC) for the electronic prescription using the message authentication code key; Sending, by the hospital terminal, the serial number and the authentication code to the patient's mobile terminal such that the serial number and the authentication code are used by the patient to request the electronic prescription at the pharmacy; And transmitting, by the hospital terminal, the serial number, the encrypted electronic prescription, the message authentication code, and the disposable public information to an electronic prescription server.

를 갖는 생성자, R은

인 난수)를 계산하여 생성되고, 상기 일회용 베이스 키는 상기 일회용 공개 정보에 대하여 OTPI^X mod p(OTPI는 상기 일회용 공개 정보, X는 상기 일련번호와 상기 인증코드를 입력으로 해쉬 출력한 값에

를 취한 결과 값)를 계산하여 상위 16바이트를 취하여 생성될 수 있다.At this time, the disposable public information is g ^R mod p (p is a decimal number of 2048 bits or more to determine the finite space Z _p , g is an element of Z _p ,

Constructor with R

Is generated by calculating a random number), and the one-time base key is OTPI ^X mod p (OTPI is the one-time disclosure information and X is the hash number outputted as the input of the serial number and the authentication code) with respect to the one-time disclosure information.

It can be generated by taking the upper 16 bytes by calculating the resulting value).

In this case, the size of p is illustrated as a decimal number of 2048 bits or more, but the size of p may be variably applied according to various application environments.

At this time, the step of encrypting the electronic prescription is a Cipher Block Chaining (CBC) encryption method using the upper 16 bytes of the cryptographic hash algorithm outputted as the initial vector (IV) as the input of the encryption key. The electronic prescription can be encrypted by.

At this time, the authentication code is encrypted with the public key of the patient's official certificate before being transmitted to the mobile terminal, it may be digitally signed with the secret key of the doctor's official certificate.

In this case, after the authentication code is received by the mobile terminal, the signature verification for the doctor is performed, and if the signature verification is successful, the authentication code may be decrypted with the private key of the patient's authorized certificate.

At this time, the electronic prescription processing method includes the step of outputting the serial number and the authentication code on the screen by the mobile terminal; Receiving, by the pharmacy terminal provided in the pharmacy, the serial number and the authentication code; Requesting, by the pharmacy terminal, the electronic prescription corresponding to the serial number to the electronic prescription server; Searching, by the electronic prescription server, the encrypted electronic prescription using the serial number; Transmitting, by the electronic prescription server, the encrypted electronic prescription corresponding to the serial number, the message authentication code, and the disposable public information to the pharmacy terminal; Generating, by the pharmacy terminal, the encryption key using the disposable public information; And recovering, by the pharmacy terminal, the electronic prescription by decrypting the electronic prescription encrypted using the encryption key.

At this time, the electronic prescription processing method includes the step of restoring the disposable base key by the pharmacy terminal using the one-time disclosure information before the step of decoding the electronic prescription to restore the electronic prescription; Restoring the message authentication code key using the restored one-time base key; And performing the message authentication code verification of the electronic prescription encrypted using the message authentication code key. At this time, decrypting the electronic prescription and restoring the electronic prescription may restore the electronic prescription by decrypting the electronic prescription only when the message authentication code verification is successful and integrity is verified.

At this time, the hospital terminal performs a user authentication for the doctor through the password input to the doctor's official certificate before generating the disposable base key and the disposable public information, if the user authentication for the doctor is successful The electronic signature is performed on the electronic prescription, and the mobile terminal performs user authentication on the patient by inputting a password for the patient's official certificate. When the user authentication on the patient succeeds, the serial number and decryption are performed. The authentication code is output on the screen, and the pharmacy terminal performs a user authentication for the pharmacist by inputting a password for a certified certificate of the pharmacist, if the user authentication for the pharmacist is successful, the electronic prescription including the serial number Generate request message, generated electronic prescription An electronic signature may be performed on the previous request message and transmitted to the electronic prescription server.

In addition, the hospital terminal according to an embodiment of the present invention, the authentication code generation unit for generating a serial number and the authentication code of the electronic prescription; An encryption key (EK) for generating a one-time base key (OTBK) and one-time public information (OTPI) and encrypting the electronic prescription using the one-time base key. And an encryption key generator for generating a message authentication code key (MACK); An electronic prescription encryption unit for encrypting the electronic prescription using the encryption key; Electronic prescription transmission for transmitting a message authentication code (MAC), the serial number, the encrypted electronic prescription, and the disposable public information generated for the electronic prescription using the message authentication code key to an electronic prescription server. part; And an authentication code transmission unit for transmitting the serial number and the authentication code to the mobile terminal of the patient.

In addition, the pharmacy terminal according to an embodiment of the present invention, the authentication code input unit for receiving the serial number and the authentication code of the electronic prescription displayed through the mobile terminal; An electronic prescription request unit which requests the electronic prescription to an electronic prescription server using the serial number; An electronic prescription receiver configured to receive the encrypted electronic prescription, a message authentication code (MAC) and one-time public information (OTPI) from the electronic prescription server; The one-time base key (OTBK) is generated from the one-time public information using the authentication code, and an encryption key (EK) and a message authentication code key (MACK) are used using the one-time base key. Encryption key generation unit for generating a Message Authentication Code Key); And an electronic prescription decryption unit that performs message verification code verification on the electronic prescription encrypted using the message authentication code key, and decrypts the electronic prescription encrypted using the encryption key when the verification result integrity is verified. do.

In addition, the electronic prescription server according to an embodiment of the present invention, from the hospital terminal, the serial number of the electronic prescription, the encrypted electronic prescription, the Message Authentication Code (MAC) corresponding to the electronic prescription and disposable public information ( An electronic prescription transmission / reception unit configured to receive one-time public information (OTPI) and transmit the encrypted electronic prescription, the message authentication code, and the disposable public information according to a request of a pharmacy terminal; An electronic prescription storage unit for storing the encrypted electronic prescription, the message authentication code, and the disposable public information according to the serial number; And searching the encrypted electronic prescription, the message authentication code, and the disposable public information corresponding to the request of the pharmacy terminal in the electronic prescription storage unit, provide the searched result to the electronic prescription transmitting and receiving unit, and transmitted to the pharmacy terminal. And an electronic prescription processing unit for deleting the information.

According to the present invention, by using the E2E encryption (End-To-End Encryption) method in the electronic prescription encryption, the electronic prescription discharge effectively provides confidentiality when transmitting and receiving electronic prescription discharge between communication subjects and only the electronic prescription discharge properly encrypted in the electronic prescription server Existing information can be prevented from being leaked from the electronic prescription server.

In addition, the present invention can further improve the security strength by providing an integrity verification function through a message authentication code (MAC) for the encrypted electronic prescription.

In addition, the present invention improves the Diffie-Hellman type key sharing technique to share the One-Time Public Information (OTPI), thereby allowing the patient to personalize after the issuance of the electronic prescription in the hospital. Even when autonomously selecting the desired pharmacy, it is possible to increase the effectiveness of the electronic prescription processing system by providing a safe prescription drug.

1 is a block diagram illustrating an electronic prescription processing system according to an embodiment of the present invention in an environment where a certificate-based PKI service is not available.
Figure 2 is a block diagram showing an electronic prescription processing system according to an embodiment of the present invention in an environment capable of certificate-based PKI services.
3 is a flowchart illustrating an electronic prescription processing method according to an embodiment of the present invention.
4 is a flowchart illustrating an example of an encryption key generation step illustrated in FIG. 3.

The present invention will now be described in detail with reference to the accompanying drawings. Hereinafter, a repeated description, a known function that may obscure the gist of the present invention, and a detailed description of the configuration will be omitted. Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art. Accordingly, the shapes and sizes of the elements in the drawings and the like can be exaggerated for clarity.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

The present invention proposes two methods to enable practical use according to two application environments. In other words, each of the communication subjects proposes two methods of application in a general environment where certificate-based Public Key Infrastructure (PKI) services are not possible and in an environment where PKI services are possible.

1 is a block diagram illustrating an electronic prescription processing system according to an embodiment of the present invention in an environment where a certificate-based PKI service is not available.

Referring to FIG. 1, an electronic prescription processing system according to an embodiment of the present invention includes a hospital terminal 110, an electronic prescription server 120, a pharmacy terminal 130, and a mobile terminal 140.

The hospital terminal 110 is a terminal for issuing an electronic prescription in a hospital where a patient is treated, and may be various terminals such as a personal computer, a laptop, and a tablet.

The hospital terminal 110 includes an authentication code generator 111, an encryption key generator 112, an electronic prescription encryption unit 113, an electronic prescription transmission unit 114, and an authentication code transmission unit 115.

Authentication code generation unit 111 generates the serial number and authentication code of the electronic prescription. The details of how to generate a serial number and a verification code are described in detail later.

The encryption key generator 112 generates a one-time base key (OTBK) and one-time public information (OTPI), and encrypts the electronic prescription using the one-time base key. An encryption key (EK) and a message authentication code key (MACK) are generated. A detailed method of generating the keys by the encryption key generator 112 will be described in detail later.

인 난수)를 계산하여 생성되고, 상기 일회용 베이스 키는 상기 일회용 공개 정보에 대하여 OTPI^X mod p(OTPI는 상기 일회용 공개 정보, X는 상기 일련번호와 상기 인증코드를 입력으로 해쉬 출력한 값에

를 취한 결과 값)를 계산하여 상위 16바이트를 취하여 생성될 수 있다. 이 때, p의 크기는 2048비트 이상의 소수로서 예시를 하였으나, 다양한 적용 환경에 따라 p의 크기는 가변적으로 적용될 수 있다.At this time, the disposable public information is g ^R mod p (p is a decimal number of 2048 bits or more that determines the finite space Z _p , g is an element of Z _p , Constructor with R

Is generated by calculating a random number), and the one-time base key is OTPI ^X mod p (OTPI is the one-time disclosure information and X is the hash number outputted as the input of the serial number and the authentication code) with respect to the one-time disclosure information.

It can be generated by taking the upper 16 bytes by calculating the resulting value). In this case, the size of p is illustrated as a decimal number of 2048 bits or more, but the size of p may be variably applied according to various application environments.

The electronic prescription encryption unit 113 encrypts the electronic prescription using the encryption key generated by the encryption key generation unit 112. The detailed method of encrypting the electronic prescription in the electronic prescription encryption unit 113 will also be described later.

At this time, the electronic prescription encryption unit 113 is a CBC (Cipher Block Chaining) encryption method by using the upper 16 bytes of the cryptographic hash algorithm output value as the initial vector (IV) The electronic prescription can be encrypted by.

The electronic prescription transmitter 114 electronically stores the message authentication code (MAC), the serial number, the encrypted electronic prescription, and the disposable public information generated for the electronic prescription using the message authentication code key. Send to the prescription server 120.

In this case, the message authentication code may be used to perform message code verification using the message authentication code key (MACK) restored by the pharmacy terminal 130.

The authentication code transmitter 115 transmits the serial number and the authentication code to the mobile terminal 140 of the patient.

The mobile terminal 140 is a terminal used by a patient who wants to receive an electronic prescription from the hospital terminal 110, and receives an authentication code corresponding to the electronic prescription from the hospital terminal 110, and displays it on the terminal screen together with the serial number. Output The mobile terminal 140 may be various terminals such as a smartphone, a laptop, a tablet, and the like.

The mobile terminal 140 includes an authentication code receiver 141 and an authentication code output unit 142. The authentication code receiving unit 141 receives the serial number and authentication code of the electronic prescription from the hospital terminal 110, the authentication code output unit 142 outputs the received serial number and authentication code on the screen.

The pharmacy terminal 130 receives the serial number and the authentication code of the electronic prescription displayed through the mobile terminal 140 and the electronic prescription server 140 to prepare an electronic prescription for the patient using the mobile terminal 140 Request, and receives the encrypted electronic prescription from the electronic prescription server 140 to decrypt it.

The pharmacy terminal 130 includes an authentication code input unit 131, an electronic prescription request unit 132, an electronic prescription receiver 133, an encryption key generator 134, and an electronic prescription decoder 135.

The authentication code input unit 131 receives the serial number and the authentication code of the electronic prescription displayed through the mobile terminal 140.

The electronic prescription requester 132 requests the electronic prescription to the electronic prescription server 120 using the serial number.

The electronic prescription receiving unit 133 receives the encrypted electronic prescription, message authentication code (MAC) and one-time public information (OTPI) from the electronic prescription server 120.

를 갖는 생성자, R은

인 난수)를 계산하여 생성된 것일 수 있다. 이 때, p의 크기는 2048비트 이상의 소수로서 예시를 하였으나, 다양한 적용 환경에 따라 p의 크기는 가변적으로 적용될 수 있다.At this time, the disposable public information is g ^R mod p (p is a decimal number of 2048 bits or more that determines the finite space Z _p , g is an element of Z _p ,

Constructor with R

Phosphorus random number) may be generated by calculating. In this case, the size of p is illustrated as a decimal number of 2048 bits or more, but the size of p may be variably applied according to various application environments.

The encryption key generation unit 134 generates a one-time base key (OTBK) from the one-time public information using the authentication code, and uses the one-time base key to encrypt an encryption key (EK). And a message authentication code key (MACK).

를 취한 결과 값)를 계산하여 상위 16바이트를 취하여 생성될 수 있다.At this time, the one-time base key is OTPI ^X mod p (OTPI is the one-time disclosure information, X is the hash number outputted as the input of the serial number and the authentication code) with respect to the one-time disclosure information.

It can be generated by taking the upper 16 bytes by calculating the resulting value).

The electronic prescription decoding unit 135 performs a message authentication code verification for the electronic prescription encrypted using the message authentication code key, and if the integrity of the verification result is verified, the electronic prescription encrypted using the encryption key. Decrypt

The electronic prescription server 120 receives and stores information, such as an encrypted electronic prescription, from the hospital terminal 110, and if the pharmacy terminal 130 requests the electronic prescription in a legitimate manner, searching for the electronic prescription for disposable public information, etc. The electronic prescription encrypted with the data of the pharmacy terminal 130 is provided.

The electronic prescription server 120 includes an electronic prescription transceiver 121, an electronic prescription processor 122, and an electronic prescription storage unit 123.

The electronic prescription transmitter / receiver 121 transmits a serial number of an electronic prescription, an encrypted electronic prescription, a message authentication code (MAC) corresponding to the electronic prescription, and disposable public information (OTPI; One-) from the hospital terminal 110. Time Public Information) and transmits the encrypted electronic prescription, the message authentication code, and the disposable public information according to a request of the pharmacy terminal 130.

를 갖는 생성자, R은

인 난수)를 계산하여 생성되고, OTPI^X mod p(OTPI는 상기 일회용 공개 정보, X는 상기 일련번호와 상기 전자 처방전의 인증코드를 입력으로 해쉬 출력한 값에

를 취한 결과 값)를 계산하여 상위 16바이트를 취하여 일회용 베이스 키를 생성하는데 사용될 수 있다. 이 때, p의 크기는 2048비트 이상의 소수로서 예시를 하였으나, 다양한 적용 환경에 따라 p의 크기는 가변적으로 적용될 수 있다.At this time, the disposable public information is g ^R mod p (p is a decimal number of 2048 bits or more to determine the finite space Z _p , g is an element of Z _p ,

Constructor with R

Is generated by calculating a random number), and OTPI ^X mod p (OTPI is the disposable public information, X is a hash output value of the serial number and the authentication code of the electronic prescription).

Can be used to generate a disposable base key by taking the top 16 bytes. In this case, the size of p is illustrated as a decimal number of 2048 bits or more, but the size of p may be variably applied according to various application environments.

The electronic prescription storage unit 123 stores the encrypted electronic prescription, the message authentication code and the disposable public information according to the serial number.

The electronic prescription processing unit 122 searches the encrypted electronic prescription, the message authentication code and the disposable public information corresponding to the request of the pharmacy terminal 130 in the electronic prescription storage unit 123, and retrieves the searched result from the electronic prescription transmitting and receiving unit. Provided to 121, and deletes the information transmitted to the pharmacy terminal 130.

Figure 2 is a block diagram showing an electronic prescription processing system according to an embodiment of the present invention in an environment capable of certificate-based PKI services.

2, the electronic prescription processing system according to an embodiment of the present invention includes a hospital terminal 210, an electronic prescription server 220, a pharmacy terminal 230, a mobile terminal 240, and an authentication server 250. Include.

In particular, the authentication server 250 performs user authentication for the hospital terminal 210, the pharmacy terminal 230 and the mobile terminal 240 to provide certificate-based Public Key Infrastructure (PKI) services for each of the communication subjects. Then, the signature on the electronically signed authentication code, electronic prescription, electronic prescription request message is verified.

The hospital terminal 210 is a terminal for issuing an electronic prescription in a hospital where a patient is treated, and may be various terminals such as a personal computer, a laptop, and a tablet.

The hospital terminal 210 includes an authentication code generator 211, an encryption key generator 212, an electronic prescription encryption unit 213, an electronic prescription transmission unit 214, an authentication code transmission unit 215, and a user authentication unit ( 216).

The user authentication unit 216 allows the doctor to enter a password for his / her authorized certificate to perform the user authentication process.

The authentication code generation unit 211 performs the same function as the authentication code generation unit 111 shown in FIG. 1, but encrypts the randomly generated authentication code with the public key of the patient's certificate, and uses the secret key of the doctor's certificate. do.

The electronic prescription encryption unit 213 performs the same function as the electronic prescription encryption unit 113 shown in FIG. 1, but encrypts the electronic prescription signed with the encryption key EK.

The encryption key generator 212, the electronic prescription transmitter 214, and the authentication code transmitter 215 are the same as described with reference to FIG. 1.

The mobile terminal 240 is a terminal used by a patient who wants to receive an electronic prescription from the hospital terminal 210. The mobile terminal 240 receives an authentication code corresponding to the electronic prescription from the hospital terminal 210, and displays it on the screen of the terminal together with the serial number. Output The mobile terminal 240 may be various terminals such as a smartphone, a laptop, a tablet, and the like.

The mobile terminal 240 includes a user authentication unit 244, an authentication code decoding unit 243, an authentication code receiving unit 241, and an authentication code output unit 242. The authentication code receiving unit 241 receives the serial number and the encrypted authentication code of the electronic prescription from the hospital terminal 210, the authentication code output unit 242 outputs the received serial number and authentication code on the screen.

In particular, in the example shown in FIG. 2, the user authentication unit 244 allows the patient to input a password for his / her authorized certificate to perform a user authentication process. If the authentication process is successful, the authentication code decryption unit 243 performs a doctor's signature verification on the encrypted authentication code received through the authentication code receiver 241. If the doctor's signature verification is successful, the authentication code decryption unit 243 decrypts the encrypted authentication code with the private key of the patient's certificate, and the authentication code output unit 242 may output the serial number and authentication code of the electronic prescription on the screen. Make sure

The pharmacy terminal 230 receives the serial number and the authentication code of the electronic prescription displayed through the mobile terminal 240 and the electronic prescription server 240 to prepare the medicine for the patient using the mobile terminal 240 Request, and receives the encrypted electronic prescription from the electronic prescription server 240 to decrypt it.

The pharmacy terminal 230 includes a user authentication unit 236, an authentication code input unit 231, an electronic prescription request unit 232, an electronic prescription receiver 233, an encryption key generator 234, and an electronic prescription decoder 235. It includes.

The user authentication unit 236 performs a user authentication process by inputting a password for its own certificate. If the authentication process is successful, it receives the serial number and the authentication code of the electronic prescription output to the mobile terminal 240 through the authentication code input unit 231 of the pharmacy terminal 230.

At this time, the authentication code is encrypted with the public key of the patient's official certificate before being transmitted to the mobile terminal 240, digitally signed with the secret key of the doctor's official certificate, received by the mobile terminal 240, and then to the doctor If the signature verification is performed and the signature verification is successful, the signature verification may be decrypted with the private key of the patient's official certificate.

The electronic prescription request unit 232 generates an electronic prescription request message by using the serial number, and performs an electronic signature on the generated electronic prescription request message. Thereafter, the electronic prescription requester 232 transmits the electronic prescription request message electronically signed to the electronic prescription server 220.

The electronic prescription receiver 233 receives the encrypted electronic prescription, a message authentication code (MAC) and one-time public information (OTPI) from the electronic prescription server 220.

를 갖는 생성자, R은

인 난수)를 계산하여 생성된 것일 수 있다. 이 때, p의 크기는 2048비트 이상의 소수로서 예시를 하였으나, 다양한 적용 환경에 따라 p의 크기는 가변적으로 적용될 수 있다.At this time, the disposable public information is g ^R mod p (p is a decimal number of 2048 bits or more that determines the finite space Z _p , g is an element of Z _p ,

Constructor with R

Phosphorus random number) may be generated by calculating. In this case, the size of p is illustrated as a decimal number of 2048 bits or more, but the size of p may be variably applied according to various application environments.

The encryption key generation unit 234 generates a one-time base key (OTBK) from the one-time public information using the authentication code, and uses the one-time base key to encrypt an encryption key (EK). And a message authentication code key (MACK).

를 취한 결과 값)를 계산하여 상위 16바이트를 취하여 생성될 수 있다.At this time, the one-time base key is OTPI ^X mod p (OTPI is the one-time disclosure information, X is the hash number outputted as the input of the serial number and the authentication code) with respect to the one-time disclosure information.

It can be generated by taking the upper 16 bytes by calculating the resulting value).

The electronic prescription decoding unit 235 performs a message authentication code verification on the electronic prescription encrypted using the message authentication code key. When the integrity of the verification result is verified, the electronic prescription decryption unit 235 encrypts the electronic prescription encrypted using the encryption key. Decrypt

The electronic prescription server 220 receives and stores information, such as an encrypted electronic prescription, from the hospital terminal 210, and if the pharmacy terminal 230 requests the electronic prescription legitimately, searches for the electronic prescription, and uses one-time public information. The electronic prescription encrypted with the data of the pharmacy terminal 230 is provided.

The electronic prescription server 220 includes a signature verification unit 224, an electronic prescription transceiver 221, an electronic prescription processing unit 222, and an electronic prescription storage unit 223.

The electronic prescription transceiver 221 is a serial number of the electronic prescription from the hospital terminal 210, encrypted electronic prescription, Message Authentication Code (MAC) corresponding to the electronic prescription and one-time public information (OTPI; One- Time Public Information) and transmits the encrypted electronic prescription, the message authentication code, and the disposable public information according to a request of the pharmacy terminal 230.

The signature verification unit 224 performs signature verification on the electronic prescription request message received through the electronic prescription transceiver 221.

를 갖는 생성자, R은

인 난수)를 계산하여 생성되고, OTPI^X mod p(OTPI는 상기 일회용 공개 정보, X는 상기 일련번호와 상기 전자 처방전의 인증코드를 입력으로 해쉬 출력한 값에

를 취한 결과 값)를 계산하여 상위 16바이트를 취하여 일회용 베이스 키를 생성하는데 사용될 수 있다. 이 때, p의 크기는 2048비트 이상의 소수로서 예시를 하였으나, 다양한 적용 환경에 따라 p의 크기는 가변적으로 적용될 수 있다.At this time, the disposable public information is g ^R mod p (p is a decimal number of 2048 bits or more to determine the finite space Z _p , g is an element of Z _p ,

Constructor with R

Is generated by calculating a random number), and OTPI ^X mod p (OTPI is the disposable public information, X is a hash output value of the serial number and the authentication code of the electronic prescription).

Can be used to generate a disposable base key by taking the top 16 bytes. In this case, the size of p is illustrated as a decimal number of 2048 bits or more, but the size of p may be variably applied according to various application environments.

The electronic prescription storage unit 223 stores the encrypted electronic prescription, the message authentication code and the disposable public information according to the serial number.

The electronic prescription processing unit 222 is the encrypted electronic prescription corresponding to the request of the pharmacy terminal 230 in the electronic prescription storage unit 223, the message authentication code and the only if the signature verification of the signature verification unit 224 is successful The disposable public information is searched for, and the search result is provided to the electronic prescription transceiver 221 and the information transmitted to the pharmacy terminal 230 is deleted.

EMBODIMENT OF THE INVENTION Hereinafter, the electronic prescription processing technique of this invention is demonstrated in detail.

In order to apply the Diffie-Hellman Key Sharing scheme in the encryption key generation in the present invention, the following system parameters are assumed.

p: determines the finite field Z _p as a prime of 2048 bits or more.

를 갖는 생성자이다.g is the element of Z _p ,

Constructor with

The above two system parameters may be shared by the hospital terminal and the pharmacy terminal in advance as public information, or may be stored and used in an electronic prescription server in an environment where integrity is guaranteed depending on the application. In this case, the size of p is illustrated as a decimal number of 2048 bits or more, but the size of p may be variably applied according to various application environments.

Certificate based PKI  Unserviceable Environment

The authentication code generator of the hospital terminal first generates a serial number for identifying the electronic prescription written and input by the doctor, and randomly generates a 16-digit authentication code by a random number generator (RNG).

)을 랜덤하게 생성하고, g^R mod p 를 계산하여 일회용 공개 정보(OTPI; One-Time Public Information)로 하고 사용한다. 이후, 병원 단말기의 암호 키 생성부는 전자 처방전 일련번호와 인증코드를 입력으로 해쉬 출력하고, 그 해쉬 값에

를 취한 결과 값을 X로 표기하고, OTPI^X mod p 를 계산하여 상위 16바이트를 일회용 베이스 키(OTBK; One-Time Base Key)로 사용한다. 또한, 암호화 시 암호 운용모드인 CBC(Cipher Block Chaining)로 암호화하기 위한 초기 벡터(IV; Initial Vector)를 생성하기 위해 암호 키를 입력으로 해쉬(cryptographic hash algorithm) 출력하고 출력된 값 중 상위 16바이트 값을 초기 벡터로 사용한다.Thereafter, the encryption key generation unit of the hospital terminal is executed. The encryption key generator generates a R (

) Is randomly generated, and g ^R mod p is calculated and used as one-time public information (OTPI). Thereafter, the cryptographic key generation unit of the hospital terminal outputs the hash with the input of the electronic prescription serial number and the authentication code, and the hash value

The result is denoted by X, and OTPI ^X mod p is calculated and the upper 16 bytes are used as a one-time base key (OTBK). In addition, in order to generate an initial vector (IV) to encrypt with Cipher Block Chaining (CBC), which is an encryption operation mode during encryption, a cryptographic hash algorithm is output as an input and the top 16 bytes of the output values are output. Use the value as the initial vector.

According to an embodiment, the random number generator may randomly generate a 16-byte key that is the total size of the encryption key and use it as a disposable base key. In this case, an initial vector used for encrypting an intermediate secret key (ISK) and a CBC by using a Key Derivation Function (KDF) defined in Public-Key Cryptography System (PKCS) # 5 as a serial number and an authentication code. A value IV can be derived. Thereafter, the 16-byte result value obtained by performing an exclusive OR operation on an intermediate key and an OTBK, which is a one-time base key, may be used as one-time public information (OTPI). Here, the derivation of the intermediate key and the IV from the serial number and the authentication code is an example of using PKCS # 5, but the derivation method is not limited thereto, and various methods may be applied according to the application.

In addition, an encryption key (EK) and a message authentication code key (MACK) are derived from the disposable base key (OTBK). Derivation of EK and MACK from OTBK can follow the method of ANSI X9.24 Part 1. However, various methods may be applied to derivation of EK and MACK from OTBK.

Thereafter, the electronic prescription encryption unit of the hospital terminal encrypts the electronic prescription with the encryption key EK using the domestic block encryption standard algorithm SBC CBC encryption method. At this time, IV may be used. In addition, MAC (Message Authentication Code) value for the encrypted electronic prescription is generated by applying a Message Authentication Code Key (MACK). MAC generation method can conform to ANSI X9.19 standard method. The encryption of the certificate may be applied to international standard block encryption algorithms other than SEED.

Thereafter, the electronic prescription transmitter of the hospital terminal transmits the serial number of the electronic prescription, the encrypted electronic prescription, the MAC, and OTPI, which is public information, to the electronic prescription server.

Thereafter, the authentication code transmission unit of the hospital terminal transmits the serial number and the authentication code of the electronic prescription to the patient's mobile terminal. The transmission method may be transmitted through SMS, or may be transmitted through an MMS message in the form of an image by using a 1 or 2D barcode.

The electronic prescription transceiver of the electronic prescription server receives the data transmitted from the hospital terminal and stores through the electronic prescription storage. In this case, the electronic prescription storage unit may set an expiration date for the stored information, and the stored information may be automatically deleted when the expiration date has elapsed.

The patient selects and visits the pharmacy by autonomous selection of the individual, and executes an output unit of the mobile terminal to output the serial number and authentication code of the electronic prescription on the screen.

Thereafter, the serial number and authentication code of the electronic prescription outputted to the mobile terminal are received through the authentication code input unit of the pharmacy terminal. In this case, the authentication code input unit may operate in a manner that the user directly inputs the serial number and the authentication code to the terminal, or may be provided by a camera to shoot the serial number and the authentication code in the form of a barcode.

Thereafter, the electronic prescription request unit of the pharmacy terminal transmits the electronic prescription request message together with the serial number to the electronic prescription transmission server.

With respect to the electronic prescription request message received through the electronic prescription transceiver, the electronic prescription processing unit of the electronic prescription server searches for the existence of the corresponding encrypted electronic prescription that matches the serial number in the electronic prescription storage unit. If there is matching electronic prescription data, the encrypted electronic prescription, the message authentication code, and the disposable public information data are sent to the pharmacy terminal. Thereafter, the electronic prescription processing unit of the electronic prescription server deletes all data corresponding to the serial number in the electronic prescription storage unit, and generates a log indicating that the electronic prescription of the serial number has been processed and stored in the electronic prescription storage unit. Here, the log may include an electronic prescription request message including transmission time information and destination information, and may include various information according to an application.

를 취한 결과 값 X를 계산하고, OTPI^X mod p 를 계산하여 상위 16바이트를 일회용 베이스 키인 OTBK로 하고 사용한다. The electronic prescription receiver of the pharmacy terminal receives the data transmitted by the electronic prescription server. After that, the encryption key generation unit of the pharmacy terminal hash output by inputting the serial number and the authentication code to the hash value

Calculate the value X, compute OTPI ^X mod p, and use the upper 16 bytes as the disposable base key OTBK.

When the encryption key generation unit of the hospital terminal generates a 16-byte disposable base key by a random number generator and generates disposable public information by an exclusive OR operation using the same, the encryption key generation unit of the pharmacy terminal inputs a serial number and an authentication code. By using the Key Derivation Function (KDF) defined in PKCS # 5, we derive intermediate keys (ISKs) and IVs (Initial Vectors), and perform OTPI and bitwise exclusive OR operations on intermediate keys and one-off public information. The 16-byte result value taken may be used as a disposable base key (OTBK).

It also derives encryption keys EK and MACK from OTBK. The method of deriving EK and MACK from OTBK is the same as that of the hospital terminal.

Thereafter, the electronic prescription decoder of the pharmacy terminal first verifies the integrity of the transmitted data by performing MAC verification of the electronic prescription encrypted with MACK. If the validation is successful, the patient can be prescribed medication by decrypting the final EK-encoded electronic prescription.

After prescribing the drug at the pharmacy, the processed electronic prescription may be stored in a separate storage in the pharmacy, and may be stored and stored within a certain period by applying various storage security technologies such as file encryption or database encryption. With respect to such storage and data protection, the present invention is not limited to a specific technology, and various protection technologies may be applied.

Certificate based PKI Serviceable  Environment

First, the doctor through the user authentication unit of the hospital terminal performs a user authentication process by entering a password for its own certificate. If the authentication process is successful, an electronic signature is performed for the electronic prescription written and entered by the doctor. The digital certificate method based on the accredited certificate may use the Korea Certification-based Digital Signature Algorithm (KCDSA), a national standard signature algorithm. However, the technical idea of the present invention is not limited to KCDSA, and various signature algorithms known to be safe may be used.

Authentication code generation unit of the hospital terminal generates a serial number for identifying the electronic prescription. In addition, the random number generator randomly generates a 16-digit authentication code. Thereafter, the authentication code generation unit encrypts the randomly generated authentication code with the public key of the patient certificate, and digitally signs it with the secret key of the doctor certificate.

Thereafter, the encryption key generation unit of the hospital terminal is executed. Execution of the encryption key generation unit is performed in the same manner as in a general environment in which PKI service is not available.

In addition, an encryption key (EK) and a message authentication code key (MACK) are derived from the OTBK. The derivation method is performed in the same way as the general environment where PKI service is not available.

Thereafter, the electronic prescription encryption unit of the hospital terminal encrypts the electronic prescription electronically signed with the encryption key EK, and generates a MAC value for the encrypted electronic prescription by applying MACK. Encryption and MAC value generation are performed in the same way as in general environment where PKI service is not available.

Thereafter, the electronic prescription transmitter of the hospital terminal transmits the serial number of the electronic prescription, the encrypted electronic prescription, the MAC, and OTPI, which is public information, to the electronic prescription server.

Thereafter, the authentication code transmission unit of the hospital terminal transmits the serial number and the authentication code of the electronic prescription to the patient's mobile terminal. The transmission method may be transmitted through SMS, or may be transmitted through an MMS in the form of an image using one or two-dimensional barcodes.

The electronic prescription transceiver of the electronic prescription server receives the data transmitted from the hospital terminal and stores through the electronic prescription storage. At this time, the transmitted data is stored only during the set validity period, and can be automatically deleted after the validity period has passed.

The patient visits any pharmacy by autonomous selection of the individual, and enters a password for his / her authorized certificate through the user authentication unit of the mobile terminal to perform a user authentication process. If the authentication process succeeds, signature verification is performed in the process of executing the authentication code decryption unit for the encrypted authentication code received through the authentication code receiver of the mobile terminal. In addition, if the signature verification is successful, the authentication code decryption unit decrypts the encrypted authentication code with the private key of the patient authentication certificate, and the authentication code output unit of the mobile terminal outputs the serial number and authentication code of the electronic prescription on the screen.

Thereafter, the pharmacist performs a user authentication process by inputting a password for his / her official certificate through the user authentication unit of the pharmacy terminal. If the authentication process is successful, the serial number and authentication code of the electronic prescription outputted to the mobile terminal are received through the authentication code input unit of the pharmacy terminal.

Thereafter, the electronic prescription request unit of the pharmacy terminal generates the electronic prescription request message with the serial number, and performs the electronic signature on the generated electronic prescription request message. Thereafter, the electronic prescription requesting unit transmits the electronically signed electronic prescription request message to the electronic prescription transmission server.

The electronic prescription server performs signature verification on the electronic prescription request message received through the electronic prescription transmission and reception unit. If the signature verification succeeds, the electronic prescription processing unit of the electronic prescription server searches for the existence of an encrypted electronic prescription that matches the serial number in the electronic prescription storage. If there is a matching electronic prescription data, the electronic prescription server sends the encrypted electronic prescription, MAC and OTPI data to the pharmacy terminal. Thereafter, the electronic prescription processing unit of the electronic prescription server deletes all data related to the serial number corresponding to the transmitted electronic prescription in the electronic prescription storage unit, generates a log indicating that the electronic prescription of the serial number has been processed, and the electronic prescription storage unit Store in Here, the log may include transmission time information, an electronic prescription request message including destination information, and the like, and may include various information according to an application.

The electronic prescription receiver of the pharmacy terminal receives the data transmitted by the electronic prescription server. After that, the encryption key generation unit of the pharmacy terminal calculates the disposable base key OTBK, encryption key EK and MACK. Each key calculation method is the same as the general environment where PKI service is not available.

Thereafter, the electronic prescription decoder of the pharmacy terminal first verifies the integrity of the transmitted data by performing MAC verification of the MACK-encrypted electronic prescription. If the verification is successful, the electronic prescription encrypted with EK is decrypted. In addition, the electronic signature of the doctor for the decrypted electronic prescription can be verified, and if the signature verification is successful, the patient can be finally prescribed the medicine.

Electronic prescriptions processed after drug prescription in a pharmacy may be stored in a separate storage in the pharmacy, and may be stored for a certain period of time by applying various storage security techniques such as file encryption or database encryption.

3 is a flowchart illustrating an electronic prescription processing method according to an embodiment of the present invention.

Referring to Figure 3, the electronic prescription processing method according to an embodiment of the present invention first generates a serial number and the authentication code corresponding to the electronic prescription in the hospital terminal (S311).

In addition, the hospital terminal generates necessary keys such as an encryption key using the generated serial number and the authentication code (S312).

Thereafter, the hospital terminal encrypts the electronic prescription using the encryption key generated in step S312 and generates a message authentication code using the message authentication code key (S313).

In this case, the step S313 may be performed by the Cipher Block Chaining (CBC) encryption method using an upper vector of the output value of the cryptographic hash algorithm as an initial vector (IV). Can encrypt electronic prescriptions.

Thereafter, the hospital terminal transmits the serial number and the authentication code to the mobile terminal of the patient so that the serial number and the authentication code are used for the patient to request the electronic prescription at the pharmacy (S314).

At this time, the authentication code is encrypted with the public key of the patient's official certificate before being transmitted to the mobile terminal, it can be digitally signed with the secret key of the doctor's official certificate.

In addition, the hospital terminal transmits the serial number, encrypted electronic prescription, message authentication code (MAC) and one-time public information (OTPI) to the electronic prescription server (S315).

The electronic prescription server stores the received serial number, encrypted electronic prescription, message authentication code (MAC) and one-time public information (OTPI) (S321).

The mobile terminal receives the serial number and the authentication code displayed on the screen (S316), the pharmacy terminal receives the serial number and the authentication code displayed on the screen of the mobile terminal (S331) generates an electronic prescription request message to the electronic prescription server It transmits (S332).

The mobile terminal receives the encrypted authentication code, performs signature verification on the doctor, and if the signature verification succeeds, the mobile terminal may decrypt the authentication code encrypted with the private key of the patient's public certificate.

The electronic prescription server searches for an electronic prescription encrypted with a serial number corresponding to the electronic prescription request (S333).

The electronic prescription server transmits the encrypted electronic prescription and related information matching the serial number to the pharmacy terminal, deletes the corresponding data from the DB and stores the log (S334).

The pharmacy terminal generates an encryption key and a message authentication code key using disposable public information received from the electronic prescription server (S335).

In addition, the pharmacy terminal performs MAC verification using the message authentication code key and decrypts the electronic prescription using the encryption key (S336).

In this case, step S336 may include: restoring the disposable base key by the pharmacy terminal using the disposable public information before decrypting the electronic prescription; Restoring the message authentication code key using the restored one-time base key; And performing a message authentication code verification of the electronic prescription encrypted using the message authentication code key.

In this case, step S336 may restore the electronic prescription by decrypting the electronic prescription only when the message authentication code verification is successful and the integrity is verified.

Using the electronic prescription, the pharmacy prescribes the medicine required by the patient (S337).

4 is a flowchart illustrating an example of an encryption key generation step illustrated in FIG. 3.

Referring to FIG. 4, first, a hospital terminal generates one-time public information (OTPI) (S410).

를 갖는 생성자, R은

인 난수)를 계산하여 생성될 수 있다. 이 때, p의 크기는 2048비트 이상의 소수로서 예시를 하였으나, 다양한 적용 환경에 따라 p의 크기는 가변적으로 적용될 수 있다.At this time, the disposable public information is g ^R mod p (p is a decimal number of 2048 bits or more to determine the finite space Z _p , g is an element of Z _p ,

Constructor with R

Phosphorus random number). In this case, the size of p is illustrated as a decimal number of 2048 bits or more, but the size of p may be variably applied according to various application environments.

In addition, the hospital terminal generates a one-time base key (OTBK) using the disposable public information (S420).

를 취한 결과 값)를 계산하여 상위 16바이트를 취하여 생성될 수 있다.At this time, the one-time base key is OTPI ^X mod p (OTPI is the one-time disclosure information, X is the hash number outputted as the input of the serial number and the authentication code) with respect to the one-time disclosure information.

It can be generated by taking the upper 16 bytes by calculating the resulting value).

In addition, the hospital terminal generates an encryption key (EK) and a message authentication code key (MACK) for encrypting the electronic prescription using the disposable base key (S430).

At this time, the method of deriving EK and MACK from OTBK may follow the method of ANSI X9.24 Part 1. However, various methods may be applied to derivation of EK and MACK from OTBK.

The present invention not only provides the confidentiality of the electronic prescription when the electronic prescription is transmitted / received between communication subjects by using E2E encryption (End-To-End Encryption) method when encrypting the electronic prescription, but only the electronic prescription encrypted in the electronic prescription server. Existing prevents information leakage from the electronic prescription server and provides integrity by adding MAC for the encrypted electronic prescription. In addition, by efficiently applying the Diffie-Hellman type Key Sharing technique, after issuing an electronic prescription in the hospital, the patient can autonomously select any pharmacy and receive the medicine safely.

As described above, the electronic prescription processing method and the apparatus using the same according to the present invention are not limited to the configuration and method of the embodiments described as described above, the embodiments are implemented so that various modifications can be made. All or part of the examples may be optionally combined.

110: hospital terminal
111: authentication code generation unit
113: electronic prescription password book
114: electronic prescription transmitter
115: authentication code transmission unit
120: electronic prescription server
121: electronic prescription transceiver
122: electronic prescription processing unit
123: electronic prescription storage
130: pharmacy terminal
131: authentication code input unit
132: electronic prescription request unit
133: electronic prescription receiver
134: encryption key generation unit
135: electronic prescription decoder
140: mobile terminal
141: authentication code receiving unit
142: authentication code output unit

Claims (19)

Generating, by the hospital terminal, a serial number and an authentication code of an electronic prescription to be issued;
Generating, by the hospital terminal, a one-time base key (OTBK) and one-time public information (OTPI);
Generating, by the hospital terminal, an encryption key (EK) and a message authentication code key (MACK) for encrypting the electronic prescription using the disposable base key;
Encrypting, by the hospital terminal, the electronic prescription using the encryption key;
Generating, by the hospital terminal, a message authentication code (MAC) for the electronic prescription using the message authentication code key;
Sending, by the hospital terminal, the serial number and the authentication code to the patient's mobile terminal such that the serial number and the authentication code are used by the patient to request the electronic prescription at the pharmacy; And
Sending, by the hospital terminal, the serial number, the encrypted electronic prescription, the message authentication code, and the disposable public information to an electronic prescription server
Electronic prescription processing method comprising a. The method according to claim 1,
The disposable public information is g ^R mod p (p is a prime to determine the finite space Z _p , g is an element of Z _p ,

Constructor with R

Is generated by calculating a random number), and the one-time base key is OTPI ^X mod p (OTPI is the one-time disclosure information and X is the hash number outputted as the input of the serial number and the authentication code) with respect to the one-time disclosure information.

Electronic prescription processing method characterized in that it is generated by taking the upper 16 bytes by calculating a). The method according to claim 2,
Encrypting the electronic prescription
Encrypting the electronic prescription by CBC (Cipher Block Chaining) encryption method using the upper 16 byte value among the values outputted from the cryptographic hash algorithm as an initial vector (IV) Electronic prescription processing method. The method according to claim 3,
The authentication code is
The electronic prescription processing method, characterized in that the encrypted before the transmission to the mobile terminal with the public key of the patient's public certificate, and digitally signed with the private key of the doctor's public certificate. The method of claim 4,
The authentication code is
And after receiving by the mobile terminal, performing signature verification on the doctor and, if the signature verification succeeds, decrypted with the secret key of the patient's authorized certificate. The method according to claim 5,
The electronic prescription processing method
Outputting, by the mobile terminal, the serial number and the authentication code to a screen;
Receiving, by the pharmacy terminal provided in the pharmacy, the serial number and the authentication code;
Requesting, by the pharmacy terminal, the electronic prescription corresponding to the serial number to the electronic prescription server;
Searching, by the electronic prescription server, the encrypted electronic prescription using the serial number;
Transmitting, by the electronic prescription server, the encrypted electronic prescription corresponding to the serial number, the message authentication code, and the disposable public information to the pharmacy terminal;
Generating, by the pharmacy terminal, the encryption key using the disposable public information; And
Restoring the electronic prescription by decrypting the electronic prescription encrypted using the encryption key by the pharmacy terminal;
Electronic prescription processing method comprising a further. The method of claim 6,
The electronic prescription processing method
Before the step of restoring the electronic prescription by decrypting the electronic prescription, the pharmacy terminal restoring the disposable base key using the disposable public information;
Restoring the message authentication code key using the restored one-time base key; And
Performing message verification code verification of the electronic prescription encrypted using the message verification code key,
Restoring the electronic prescription by decrypting the electronic prescription
And when the message authentication code verification succeeds and integrity is verified, the electronic prescription is decoded to restore the electronic prescription. The method of claim 7,
The hospital terminal performs the user authentication for the doctor by inputting a password for the doctor's official certificate before generating the disposable base key and the disposable public information, and if the user authentication for the doctor is successful, the electronic prescription Perform an electronic signature on,
The mobile terminal performs a user authentication for the patient through a password input for the patient's official certificate, and if the user authentication for the patient is successful, and outputs the serial number and the decrypted authentication code on the screen,
The pharmacy terminal performs a user authentication for the pharmacist by inputting a password for the certified certificate of the pharmacist, if the user authentication is successful for the pharmacist generates an electronic prescription request message including the serial number, the generated electronic prescription An electronic prescription processing method characterized in that the electronic signature to the request message sent to the electronic prescription server. Authentication code generation unit for generating a serial number and the authentication code of the electronic prescription;
An encryption key (EK) for generating a one-time base key (OTBK) and one-time public information (OTPI) and encrypting the electronic prescription using the one-time base key. And an encryption key generator for generating a message authentication code key (MACK);
An electronic prescription encryption unit for encrypting the electronic prescription using the encryption key;
Electronic prescription transmission for transmitting a message authentication code (MAC), the serial number, the encrypted electronic prescription, and the disposable public information generated for the electronic prescription using the message authentication code key to an electronic prescription server. part; And
Authentication code transmission unit for transmitting the serial number and the authentication code to the mobile terminal of the patient
Hospital terminal comprising a. The method of claim 9,
The disposable public information is g ^R mod p (p is a prime to determine the finite space Z _p , g is an element of Z _p ,

Constructor with R

Is generated by calculating a random number), and the one-time base key is OTPI ^X mod p (OTPI is the one-time disclosure information and X is the hash number outputted as the input of the serial number and the authentication code) with respect to the one-time disclosure information.

Hospital terminal, characterized in that it is generated by taking the upper 16 bytes by calculating a). The method of claim 10,
The electronic prescription password section
Encrypting the electronic prescription by CBC (Cipher Block Chaining) encryption method using the upper 16 byte value among the values outputted from the cryptographic hash algorithm as an initial vector (IV) Hospital terminal. The method of claim 11,
The authentication code is
Before being transmitted to the mobile terminal, encrypted with the public key of the patient's public certificate, digitally signed with the private key of the doctor's public certificate, and after received by the mobile terminal, perform signature verification for the doctor and verify the signature. If successful, the hospital terminal, characterized in that the decrypted with the secret key of the patient's official certificate. The method of claim 12,
The message verification code is
And the pharmacy terminal is used to perform message verification code verification using the message verification code key restored. Authentication code input unit for receiving the serial number and the authentication code of the electronic prescription displayed through the mobile terminal;
An electronic prescription request unit which requests the electronic prescription to an electronic prescription server using the serial number;
An electronic prescription receiver configured to receive the encrypted electronic prescription, a message authentication code (MAC) and one-time public information (OTPI) from the electronic prescription server;
The one-time base key (OTBK) is generated from the one-time public information using the authentication code, and an encryption key (EK) and a message authentication code key (MACK) are used using the one-time base key. Encryption key generation unit for generating a Message Authentication Code Key); And
An electronic prescription decoder which performs message authentication code verification on the electronic prescription encrypted using the message authentication code key, and decrypts the electronic prescription encrypted using the encryption key when the verification result integrity is verified
Pharmacy terminal comprising a. The method according to claim 14,
The disposable public information is g ^R mod p (p is a prime to determine the finite space Z _p , g is an element of Z _p ,

Constructor with R

Is generated by calculating a random number), and the one-time base key is OTPI ^X mod p (OTPI is the one-time disclosure information and X is the hash number outputted as the input of the serial number and the authentication code) with respect to the one-time disclosure information.

Pharmacy terminal, characterized in that generated by taking the upper 16 bytes by calculating the result value. 16. The method of claim 15,
The authentication code is
Before being transmitted to the mobile terminal, encrypted with the public key of the patient's public certificate, digitally signed with the private key of the doctor's public certificate, and received by the mobile terminal, the signature verification for the doctor is performed and the signature verification is performed. If successful, the pharmacy terminal, characterized in that decrypted with the secret key of the patient's official certificate. Receiving a serial number of an electronic prescription, an encrypted electronic prescription, a message authentication code (MAC) corresponding to the electronic prescription and a one-time public information (OTPI) from the hospital terminal, An electronic prescription transmission / reception unit configured to transmit the encrypted electronic prescription, the message authentication code, and the disposable public information upon request;
An electronic prescription storage unit for storing the encrypted electronic prescription, the message authentication code, and the disposable public information according to the serial number; And
The electronic prescription storage unit searches for the encrypted electronic prescription, the message authentication code, and the disposable public information corresponding to the request of the pharmacy terminal, and provides the searched result to the electronic prescription transceiver and the information transmitted to the pharmacy terminal. Electronic prescription processor to delete
Electronic prescription server comprising a. 18. The method of claim 17,
The disposable public information is g ^R mod p (p is a prime to determine the finite space Z _p , g is an element of Z _p ,

Constructor with R

Is generated by calculating a random number), and OTPI ^X mod p (OTPI is the disposable public information, X is a hash output value of the serial number and the authentication code of the electronic prescription).

Calculating a result value), and taking the upper 16 bytes to generate a disposable base key. 19. The method of claim 18,
The authentication code is
Before being sent to the mobile terminal, encrypted with the public key of the patient's certificate, digitally signed with the private key of the doctor's certificate, and after being received by the mobile terminal, signature verification is performed on the doctor and the signature verification is successful. When the electronic prescription server, characterized in that the decrypted with the secret key of the patient's official certificate.

Images