Biological information processing system and relay device

Abstract

To provide a biological information processing system with enhanced network security and a relay device.SOLUTION: A biological information processing system 1 includes: a first information processing device 200 that processes biological information; at least one of second information processing devices 300, 400; and a relay device 100 that controls network communication between the first information processing device 200 and the second information processing devices 300, 400. The relay device 100 has a communication control unit that controls network communication between the first information processing device 200 and the second information processing devices 300, 400 based on at least one of first apparatus information included in a packet transmitted from the first information processing device 200 and second apparatus information set in an apparatus information setting unit.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a biometric information processing system and a relay device. [Background technology]

[0002] In medical institutions, various information devices, including medical devices, are used in a network environment. Since medical devices are used on the human body, secure system management is required in the network environment.

[0003] For example, Patent Document 1 discloses a management system that notifies alarm information when a specific event occurs in an encryption protocol for network communication of medical devices, such as an incorrect password entry. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] U.S. Patent No. 11,558,261 Summary of the Invention [Problem to be solved by the invention]

[0005] Meanwhile, recent legal regulations require strengthening the network security of medical devices against external cyber attacks. Specifically, medical devices are required to meet three requirements: confidentiality, authenticity, and integrity. To meet these requirements, medical devices must have the functionality to adequately protect network communications against DDoS (Distributed Denial of Service) attacks, which send a large number of communication packets at once.

[0006] An object of the present disclosure is to provide a biometric information processing system and a relay device with enhanced network security. [Means for solving the problem]

[0007] A biological information processing system according to one aspect of the present disclosure includes: A first information processing device that processes biometric information; at least one second information processing device; A relay device that controls network communication between the first information processing device and the second information processing device; Equipped with The relay device has a communication control unit that controls the network communication between the first information processing device and the second information processing device based on at least one of first device information included in a packet transmitted from the first information processing device and second device information set in a device information setting unit.

[0008] In addition, in a biological information processing system according to an aspect of the present disclosure, The communication control unit may limit an amount of packet communication between the first information processing device and the second information processing device based on at least one of the first device information and the second device information.

[0009] In addition, in a biological information processing system according to an aspect of the present disclosure, The communication control unit may set a first threshold value for the packet communication volume based on at least one of the first device information and the second device information, and may cut off the network communication if the packet communication volume between the first information processing device and the second information processing device exceeds the first threshold value within a predetermined time.

[0010] In addition, in a biological information processing system according to an aspect of the present disclosure, The relay device may include an error notification unit that notifies of an error in the network communication when the communication control unit cuts off the network communication.

[0011] In addition, in a biological information processing system according to an aspect of the present disclosure, The communication control unit may set a second threshold value for packet size, and discard the packet if the packet size of the packet transmitted between the first information processing device and the second information processing device exceeds the second threshold value.

[0012] In addition, in a biological information processing system according to an aspect of the present disclosure, The second information processing device may process biometric information.

[0013] A relay device according to one aspect of the present disclosure includes: A relay device that relays network communication between a first information processing device that processes biometric information and a second information processing device, The device has a communication control unit that controls network communication between the first information processing device and the second information processing device based on at least one of first device information included in a packet transmitted from the first information processing device and second device information set in a device information setting unit. Effect of the Invention

[0014] According to the present disclosure, it is possible to provide a biometric information processing system and a relay device with enhanced network security. [Brief description of the drawings]

[0015] [Figure 1] 1 is a configuration diagram of a biological information processing system according to an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a block diagram of a relay device. [Diagram 3] FIG. 2 is a diagram illustrating the configuration of a communication packet. [Figure 4] 13 is a schematic diagram of a user operation screen for setting device information. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0017] FIG. 1 is a configuration diagram of a biometric information processing system according to an embodiment of the present disclosure. As shown in FIG. 1, the biometric information processing system 1 includes a relay device 100, biometric information processing devices 200 and 300, and a peripheral device 400. The biometric information processing device 300 and the peripheral device 400 are directly connected to a network N, and the biometric information processing device 200 is connected to the network N via the relay device 100. The network N is, for example, a local area network (LAN) and is configured by one or both of wired and wireless. In addition, the communication protocol of the network N may be, for example, a general-purpose communication protocol such as TCP / IP (Transmission Control Protocol / Internet Protocol), or may be a communication protocol dedicated to the medical field such as DICOM (Digital Imaging and Communications in Medicine). The biometric information processing devices 200 and 300 and the peripheral device 400 transmit and receive communication packets to each other using any one of unicast, multicast, and broadcast communication methods.

[0018] The bioinformation processing devices 200 and 300 are, for example, a central monitor, a bedside monitor, a central unit, a medical telemeter, etc., and are medical devices that process bioinformation. The peripheral device 400 is, for example, a printer, a server, etc., and is a device that does not fall under the category of medical devices. Hereinafter, the bioinformation processing device 200 is also referred to as a first information processing device, and the bioinformation processing device 300 and the peripheral device 400 are collectively referred to as a second information processing device. In this example, the second information processing device includes the bioinformation processing device 300 and the peripheral device 400, but may include only one of the bioinformation processing device 300 or the peripheral device 400. In this example, the bioinformation processing device 300 and the peripheral device 400 are connected to the network N, but may be connected to a plurality of bioinformation processing devices 300 or a plurality of peripheral devices 400. The relay device 100 is a repeater that controls network communication between the first information processing device and the second information processing device. In the case where the first information processing device does not have a monitoring system for the packet traffic and packet size of communication packets, the relay device 100 has the function of the system. <Packet traffic monitoring system>

[0019] 2 is a block diagram of the relay device 100. The relay device 100 includes a communication control unit 10, a first packet receiving unit 20, a first packet transmitting unit 30, a second packet receiving unit 40, a second packet transmitting unit 50, a device information setting unit 60, and an error notifying unit 70. The communication control unit 10 includes a packet referring unit 11 and a packet monitoring unit 12.

[0020] The first packet receiving unit 20 receives a communication packet from the biometric information processing device 200, which is a first information processing device. The first packet transmitting unit 30 transmits the communication packet received by the first packet receiving unit 20 to at least one of the biometric information processing device 300 and the peripheral device 400, which are second information processing devices. The second packet receiving unit 40 receives a communication packet from at least one of the biometric information processing device 300 and the peripheral device 400. The second packet transmitting unit 50 transmits the communication packet received by the second packet receiving unit 40 to the biometric information processing device 200.

[0021] Here, the configuration of a communication packet will be described with reference to Fig. 3. As shown in Fig. 3, a communication packet is composed of multiple fields, one of which contains a device type that indicates the device information of the first information processing device that is the source of the packet. The device type indicates, for example, the product name of the first information processing device.

[0022] Returning to the explanation of Fig. 2, the packet reference unit 11 refers to the communication packet received by the first packet receiving unit 20 from the first information processing device, and acquires the device type. The communication control unit 10 sets a first threshold value for the packet communication amount, based on the device type acquired by the packet reference unit 11.

[0023] After the network link is established, the first information processing device and the second information processing device periodically receive communication packets by broadcasting in order to notify other devices of their own device information and operating status. Therefore, it is preferable to include a device type in the communication packet in the broadcast so that the relay device 100 can perform the initial setting and update setting of the first threshold at an appropriate timing.

[0024] The device information setting unit 60 is an interface that allows a user to set device information of the first information processing device. Specifically, as shown in FIG. 4, on a user operation screen for setting device information, the device type of the first information processing device can be set or changed by a pull-down method or the like. The device type indicates, for example, the product name and model of the first information processing device. Therefore, the device type indicates more detailed device information than the device type shown in FIG. 3. The communication control unit 10 sets a first threshold value related to the packet communication amount based on the device type set in the device information setting unit 60. Note that, when the communication control unit 10 sets the first threshold value based on the device type and also sets the first threshold value based on the device type, the communication control unit 10 may preferentially set the first threshold value based on the device type, or may set the lower threshold value of the first threshold value based on the device type and the first threshold value based on the device type as the first threshold value.

[0025] The packet monitoring unit 12 constantly monitors communication packets transmitted from the second information processing device, and controls network communication based on at least one of the device type and the device type set in the device information setting unit 60. Specifically, the packet monitoring unit 12 determines whether the amount of packet communication from the second information processing device to the first information processing device exceeds a first threshold within a predetermined time, and when the amount of packet communication exceeds the first threshold, limits the amount of packet communication, for example, by blocking network communication. In this way, by limiting an excessive amount of packet communication, it is possible to prevent a system down of the first information processing device and to strengthen network security against cyber attacks. In addition, since the first threshold for the amount of packet communication is set based on the device information included in the communication packet from the first information processing device, it is possible to set a limit on the amount of packet communication corresponding to the specifications of the first information processing device.

[0026] When the packet monitoring unit 12 restricts network communication, the error notification unit 70 notifies the user of a network communication error. Specific notification methods include, for example, displaying an error on a UI operation screen (not shown), notifying the error by voice, etc. This allows the user to recognize that network communication has been cut off due to an excessive amount of packet communication. <Packet size monitoring system>

[0027] The communication control unit 10 sets a second threshold value for the packet size of the communication packet based on the device type included in the communication packet shown in Fig. 3. The communication control unit 10 also sets the second threshold value for the packet size based on the device type set in the device information setting unit 60. When the communication control unit 10 sets the second threshold value based on the device type and also based on the device type, the communication control unit 10 may preferentially set the second threshold value based on the device type, or may set the lower of the second threshold value based on the device type and the second threshold value based on the device type as the second threshold value.

[0028] The packet monitoring unit 12 constantly monitors the packet size of the communication packet transmitted from the second information processing device. Specifically, the packet monitoring unit 12 determines whether the packet size of the packet communication from the second information processing device to the first information processing device exceeds a second threshold, and when the packet size exceeds the second threshold, restricts the communication packet of an excessive packet size, for example, by discarding the packet. In this way, by restricting the packet communication of an excessive packet size, it is possible to prevent the system down of the first information processing device and to strengthen the network security against cyber attacks. In addition, since the first threshold regarding the packet communication amount is set based on the device information included in the communication packet from the first information processing device, it is possible to set a restriction on the packet communication amount corresponding to the specifications of the first information processing device.

[0029] When the packet monitor 12 restricts a communication packet, the error notification unit 70 notifies the user of a packet size error. Specific notification methods include, for example, displaying an error on a UI operation screen, notifying the error by voice, etc. This allows the user to recognize that a communication packet has been discarded due to an excessive packet size.

[0030] As described above, the biometric information processing system and the relay device according to the embodiment of the present disclosure can prevent the system from going down in the first information processing device and strengthen network security against cyber attacks by limiting excessive packet communication volume and packet size. In addition, since a threshold value for the packet communication volume and packet size is set based on device information included in a communication packet from the first information processing device, it is possible to set a limit on the packet communication volume and packet size corresponding to the specifications of the first information processing device.

[0031] Although the embodiment of the present disclosure has been described above, it goes without saying that the technical scope of the present disclosure should not be interpreted as being limited by the description of the embodiment. The present embodiment is merely an example, and it is understood by those skilled in the art that various modifications of the embodiment are possible within the scope of the invention described in the claims. The technical scope of the present disclosure should be determined based on the scope of the invention described in the claims and its equivalents.

[0032] Moreover, each process in the biological information processing system 1 according to this embodiment can be realized as a computer program that runs on the relay device 100. That is, the relay device 100 is assumed to include a processor such as a CPU and a memory.

[0033] The program can be stored in a non-transitory computer-readable medium and read by the computer. Examples of the non-transitory computer-readable medium include a magnetic recording medium, a magneto-optical recording medium, a CD-ROM, a CD-R, a CD-R / W, and a semiconductor memory (including an EPROM and a flash ROM). The program may also be read by the computer by various types of temporary computer-readable media. Examples of the temporary computer-readable medium include an electric signal, an optical signal, and an electromagnetic wave. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or via a wireless communication path. [Explanation of symbols]

[0034] 1: Biological information processing system 10: Communication control unit 11: Packet reference section 12: Packet monitoring section 20: First packet receiver 30: First packet transmitter 40: Second packet receiving unit 50: Second packet transmitter 60:Device information setting section 70: Error notification section 100: Relay device 200, 300: Biometric information processing device 400: Peripheral devices N: Network

Claims

1. A first information processing device that processes biometric information; At least one second information processing device; a relay device that controls network communication between the first information processing device and the second information processing device; Equipped with The relay device has a communication control unit that controls the network communication between the first information processing device and the second information processing device based on at least one of first device information contained in a packet transmitted from the first information processing device and second device information set in a device information setting unit.

2. The biometric information processing system according to claim 1 , wherein the communication control unit limits the amount of packet communication between the first information processing device and the second information processing device based on at least one of the first device information and the second device information.

3. The bioinformation processing system of claim 2, wherein the communication control unit sets a first threshold value for the packet communication volume based on at least one of the first device information and the second device information, and cuts off the network communication if the packet communication volume between the first information processing device and the second information processing device exceeds the first threshold value within a predetermined time.

4. The biological information processing system according to claim 3 , wherein the relay device includes an error notification unit that notifies the relay device of an error in the network communication when the communication control unit cuts off the network communication.

5. The biometric information processing system of claim 1 , wherein the communication control unit sets a second threshold for packet size, and discards the packet when the packet size of the packet transmitted between the first information processing device and the second information processing device exceeds the second threshold.

6. The biological information processing system according to claim 1 , wherein the second information processing device processes biological information.

7. A relay device that relays network communication between a first information processing device that processes biometric information and a second information processing device, A relay device having a communication control unit that controls network communication between the first information processing device and the second information processing device based on at least one of first device information included in a packet transmitted from the first information processing device and second device information set in a device information setting unit.

Images