다중 환자 정보 저장소에 대한 웹기반 보안 접근 = Web-based Secure Access from Multiple Patient Reservoirs

다국어 초록 (Multilingual Abstract)

Objective:For the ubiquity of medical service, when user who has proper authority want to access medical data, user accessability should be assured. And the security of the disclosed medical data is important. This paper presents single user access interface on multiple patient reservoirs and elaborate access control using the Role-Based Access Control(RBAC) system.
Methods:Proposed system consists of 4-tier architecture that is client application, Access Control Central(ACC) agent, Local Access Control(LAC) agent and Hospital Information Systems(HIS). User requests medical data with client application. ACC notarizes user identity and controls access of user request and selectively encrypts medical data. LAC charges data conversion for communication between ACC and HIS. HIS has repositories of medical datum. System provides security service with digital certificate, X.509v3, of user.
Results:User requests medical data of several HIS approaching single ACC not by each HIS. Through conversion process of LAC, data that is described XML and is used for communication inter system enables information exchange with single common data format that is independent to several HIS.
Conclusion:In the proposed system, user accesses medical datum of several HIS regardless of location and has consistent access interface. And using independent format against each HIS makes easy information exchange between several HIS. Transferred data maintains security about significant datum by selective encryption and increases encryption efficiency. Unified access control about multiple patient reservoirs that are scattered in other places provides unified and precise diagnosis of patient information. And it functions the portal of collaborate treatment in inter-HIS.

참고문헌 (Reference)

1 Dournaee B, "XML Security. 1st ed" McGraw-Hill 107-278, 2002July

2 Takase T,, "XML Digital Signature System Independent of Existing Applications Symposium on Applications and the Internet" 150-7, 2002

3 Weiss G, "Welcome To The" 39 (39): 44-49, March2002

4 Coile RC, "The Paperless Hospital Healthcare in a Digital Age" Health Admin Press 2002

5 Tzelepi S, "Security of medical multimedia" 27 (27): 169-184, 2002

6 Ehikioya SA, "Security middleware infrastructure for DICOM images in health information systems" 356-364, 2003

7 Ferraiolo DF, "Role-Based Access Control.1st ed^" Artech House 16-18, 2003

8 "Available at:http://www.w3.org/TR/soap12/. Accessed July 10, 2004" 2004July

9 "Available at:http://www.w3.org/TR/1999/REC-xpath-19991116/. Accessed July 10, 2004" 2004July

10 Blobel B, "Authorisation and access control for electronic health record systems" 73 (73): 251-257, 2004

11 Scott RE, "Access and authorisation in a Glocal e-Health Policy context" 73 (73): 259-266, 2004

12 Bhatti R, "Access Control in Dynamic XML-based Web-Service with X-RBAC" ACM 2003

13 Gritzalis D,, "A security architecture for interconnecting health information systems" l73 (l73): 305-309, 2004

14 ".Available at:http://www.ietf.org/rfc/rfc3280.txt. Accessed July 10, 2004" 2004July