WO2018229867A1 - Personal information protection system - Google Patents

Abstract

A public key and a secret key are generated at a medical institute terminal 100 and are provided to one of node devices 300, and the public key is dispersed and saved only when a consensus is reached among all the node devices 300. A patient terminal 200 acquires the public key from one of the node devices 300, encrypts biological information, provides the encrypted biological information to said one of the node devices 300, and the encrypted biological information is dispersed and saved only when a consensus is reached among all the node devices 300. The medical institute terminal 100 acquires the encrypted biological information from one of the node devices 300, and decrypts the biological information by using the secret key generated together with the public key. Thus, authenticity (inability to falsify) and secrecy (inability to identify a person by somebody other than permitted person) of biological information supplied from a patient to a medical institution can be realized.

Description

Personal information protection system

The present invention relates to a personal information protection system, and in particular, is suitable for use in a system for enabling exchange between a patient and a medical institution while protecting biometric information and medical record information, which are personal information of a patient. is there.

In recent years, electronic medical records are spreading in the medical industry. What is an electronic medical record?
1497319278228_0
Of the paper on which the patient's medical information was written
1497319278228_1
Is replaced with electronic data. By adopting an electronic medical record, for example, the following realization is expected.

(1) Secondary use of electronic medical record data Medical data recorded in the electronic medical record is a record of medical care performed for each patient, and also serves as a case database. In other words, it is expected that electronic medical records relating to various cases are accumulated in a database and shared to help improve medical quality.

(2) Regional medical cooperation By building a regional medical network system that can share medical information of patients via electronic medical records, it is possible to improve the convenience of patients who wish to receive medical care at multiple medical institutions. Expected.

(3) Telemedicine Connect doctors and doctors with patients via a network, and exchange medical information on patients via electronic medical records, so that patients can visit a medical institution for medical care and health consultations. It is expected to be received.

As described above, there are various application examples of the electronic medical record, but the authenticity of the information recorded in the electronic medical record is strictly required. Therefore, it is necessary to introduce a mechanism for preventing falsification of information recorded in the electronic medical record. In addition, when constructing a telemedicine system in which a doctor and a patient are connected via a network, not only the electronic medical record provided by the doctor is prevented from being altered, but also the patient's biological information provided by the patient to the doctor. It is also necessary to prevent falsification of information (such as information measured by a medical device placed in the patient's home). In addition, since the patient's biological information is personal information, the realization of confidentiality that is not disclosed to anyone other than authorized persons is also required.

Note that Patent Documents 1 and 2 disclose inventions related to systems for the purpose of preventing falsification of medical record data into which patient medical data has been input.

In the security ensuring method described in Patent Document 1, when a medical institution creates a new electronic chart, adds, changes, or deletes a medical chart content, the medical institution communicates the information to a trust organization. The trusting organization gives a date time stamp to the medical institution that has communicated. Thereafter, the medical institution sends the electronic medical record data including new creation / change / addition / deletion items of the electronic medical record data and the time stamp given by the trusting organization to the trusting organization. The trust organization periodically obtains a fixed date from a notary for the medium storing the time stamp and data, and seals and stores it.

The electronic medical record recording system described in Patent Document 2 is made for the purpose of suppressing falsification of the electronic medical record without using a time stamp whose reliability is uncertain. In the electronic medical record recording system described in Patent Document 2, the electronic medical record transmitted from the user terminal and recorded in the electronic medical record reception memory includes the contents of the electronic medical record recorded in the storage electronic medical record database. Only when it is determined that all are included, the electronic medical record in the storage electronic medical record database is overwritten.

However, Patent Documents 1 and 2 describe a mechanism for preventing falsification of an electronic medical record, but describe a mechanism for preventing falsification of patient biometric information provided from a patient to a medical institution doctor via a network. It has not been. In addition, there is no description of a mechanism for realizing confidentiality that is not disclosed to anyone other than those who are permitted to receive patient biometric information as personal information.

Japanese Patent Laid-Open No. 10-320491 JP 2011-103055 A

The present invention has been made in view of the circumstances described above, and is intended to realize the authenticity (impossibility of falsification) and confidentiality of patient biometric information provided from a patient to a medical institution. Objective.

In order to solve the above-described problems, a personal information protection system of the present invention includes a medical institution terminal used in a medical institution, a patient terminal used by a patient, and a plurality of node devices connected by a distributed network. The public key and the secret key are generated at the medical institution terminal and provided to one node device. Then, a consensus formation process for sharing the public key among the plurality of node devices is performed, and the public keys are stored in the plurality of node devices only when the consensus is formed. In addition, the patient terminal obtains a public key from one node device, and the obtained public key encrypts patient biometric information or information that can identify an individual added to the biometric information, and is generated thereby Encrypted biometric information is provided to one node device. Then, a consensus building process for sharing the encrypted biometric information among the plurality of node devices is performed, and the encrypted biometric information is stored in the plurality of node devices only when the consensus is formed. In the medical institution terminal, the encrypted biometric information is acquired from one node device and decrypted with the secret key generated together with the public key.

According to the present invention configured as described above, the patient biometric information provided from the patient to the medical institution is encrypted with the public key by itself or information that can identify an individual added to the biometric information. By doing so, it is concealed. The concealed biometric information can be decrypted and used only by a medical institution having a secret key.

Moreover, since the public key is distributed and stored in each node device only when it is verified that it is valid by the consensus building process executed between the plurality of node devices, for example, the public key is malicious to the node device. By setting the program, it is possible to prevent the public key itself from being falsified. Since the public key is prevented from being falsified, it is possible to prevent the biometric information and the like from being encrypted with the illegal public key that has been falsified and decrypted with the illegal private key.

Furthermore, biometric information or the like encrypted with a public key is stored in a distributed manner in each node device only when it is verified that it is valid by a consensus building process executed between a plurality of node devices. For example, it is possible to prevent the encrypted biometric information from being tampered with by installing a malicious program on the node device.

As described above, according to the present invention, it is possible to realize the authenticity (impossibility of falsification) and confidentiality of patient biometric information provided from a patient to a medical institution.

It is a figure showing the example of whole composition of the personal information protection system by a 1st embodiment. It is a block diagram which shows the function structural example of the medical institution terminal by 1st Embodiment. It is a block diagram which shows the function structural example of the patient terminal by 1st Embodiment. It is a block diagram which shows the function structural example of the node apparatus by 1st Embodiment. It is a flowchart which shows the operation example at the time of transmitting and memorize | storing a public key from a medical institution terminal to a node apparatus. It is a flowchart which shows the operation example at the time of encrypting a patient's biometric information, transmitting and storing to a node apparatus from a patient terminal. It is a flowchart which shows the operation example at the time of a medical institution terminal acquiring encrypted biometric information from a node apparatus, and decoding. It is a figure which shows the example of whole structure of the personal information protection system by 2nd Embodiment. It is a block diagram which shows the function structural example of the 1st medical institution terminal by 2nd Embodiment. It is a block diagram which shows the function structural example of the 2nd medical institution terminal by 2nd Embodiment. It is a block diagram which shows the function structural example of the node apparatus by 2nd Embodiment.

(First embodiment)
DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, a first embodiment of the invention will be described with reference to the drawings. FIG. 1 is a diagram showing an example of the overall configuration of a personal information protection system according to the first embodiment. As shown in FIG. 1, the personal information protection system according to the first embodiment includes a medical institution terminal 100 used in a medical institution, a patient terminal 200 used by a patient, and a plurality of node devices connected by a distributed network. 300 _-1 to 300 _-3 (hereinafter sometimes collectively referred to as the node device 300).

The medical institution terminal 100 and the node device 300 are configured to be connectable via a communication network such as the Internet. FIG. 1 shows a state where the medical institution terminal 100 is connected to the node device _300-3 . However, the medical institution terminal 100 is arbitrarily connected to any one of the node devices _300-1 to _{300-3 in} the distributed network. It is possible to connect.

In addition, the patient terminal 200 and the node device 300 are configured to be connectable via a communication network such as the Internet. Although FIG. 1 shows a state in which the patient terminal 200 is connected to the node device _300-2 , the patient terminal 200 is arbitrarily connected to any one of the node devices _300-1 to _{300-3 in} the distributed network. It is possible.

The patient terminal 200 is a terminal capable of inputting patient's biological information, and is configured by, for example, a smartphone, a personal computer, a tablet or the like. The biometric information is information measured by a medical device (not shown) placed at the patient's home, for example. Here, the medical device and the patient terminal 200 are connected by wire or wirelessly, and the biological information measured by the medical device is transmitted to the patient terminal 200 so that the patient terminal 200 inputs the biological information. Is possible. Alternatively, the patient may input biological information measured by the medical device to the patient terminal 200 by operating an operation interface such as a touch panel or a keyboard of the patient terminal 200.

Note that biological information is not limited to information related to human physiology measured by medical equipment. For example, information on human psychology and behavior such as information on psychological aspects such as sensation and sensitivity, behavioral ability such as reaction and follow-up, and information on daily life behavior may be used. Such biological information can be input by the patient operating an operation interface such as a touch panel or a keyboard of the patient terminal 200, for example. Alternatively, by executing an application program installed in the patient terminal 200, it is also possible to input information on human psychology and behavior as a function of the application program.

A block chain technology is introduced into a plurality of node devices 300 _-1 to 300 _-3 connected by a distributed network. That is, as will be described later, data such as a public key and biometric information is stored in a manner shared by a plurality of node devices 300 _-1 to 300 _-3 by the block chain technology. For simplicity of illustration, only three node devices 300 _-1 to 300 _-3 are shown in FIG. 1, but more than this may be used.

In the personal information protection system of this embodiment, the medical institution terminal 100 generates a public key and a secret key, and provides them to one of the node devices 300 _-1 to 300 _-3 . Then, a consensus process for sharing a public key across the plurality of node devices 300 _-1 to 300 _-3, only if it is consensus, published in a plurality of node devices 300 _-1 to 300 _-3 Remember the key.

In patient terminal 200, acquires a public key from a node device among the plurality of node devices 300 _-1 to 300 _-3, the public key the acquired individual being added to the biological information or the biometric information of the patient Encrypt information that can be specified. Then, the encrypted biometric information generated thereby is provided to one of the node devices 300 _-1 to 300 _-3 . Since the patient's biometric information is related to personal information, the biometric information is encrypted and the encrypted biometric information is provided to the node device 300 in order to ensure confidentiality.

In medical institutions that use patient biometric information, it is necessary to know who the biometric information belongs to. Therefore, the biometric information provided from the patient terminal 200 to the node device 300 is added with information that can identify the individual of the patient (information such as the patient's name, sex, age, address, etc., hereinafter referred to as patient information). Is done. Since the patient information is also related to the personal information, the patient information may be encrypted in order to ensure confidentiality. The biometric information and the entire patient information added thereto may be encrypted, or only the biometric information or only the patient information may be encrypted.

When the encrypted biometric information is provided from the patient terminal 200 to one of the node devices 300 _-1 to 300 _-3 , the encrypted biometric information is sent to the plurality of node devices 300 _-1 to 300 _-3. The consensus building process for sharing the whole is performed, and the encrypted biometric information is stored in the plurality of node devices 300 _-1 to 300 _-3 only when the consensus is formed.

The medical institution terminal 100 acquires the encrypted biometric information from one of the plurality of node devices 300 _-1 to 300 _-3 and decrypts it with the secret key generated along with the public key. The private key is held only in the medical institution terminal 100 that has generated this together with the public key. Thereby, the patient biometric information related to the personal information can be used only in the specific medical institution terminal 100 that knows the secret key.

Next, specific configurations of the medical institution terminal 100, the patient terminal 200, and the node device 300 will be described in order. FIG. 2 is a block diagram illustrating a functional configuration example of the medical institution terminal 100 according to the first embodiment. As illustrated in FIG. 2, the medical institution terminal 100 according to the first embodiment includes a key generation unit 11, a public key provision unit 12, a biometric information acquisition unit 13, and a decryption processing unit 14 as functional configurations. The medical institution terminal 100 according to the first embodiment includes a key storage unit 10 as a storage medium.

The functional blocks 11 to 14 can be configured by any of hardware, DSP (Digital Signal Processor), and software. For example, when configured by software, each of the functional blocks 11 to 14 actually includes a CPU, RAM, ROM, etc. of a computer, and is stored in a recording medium such as RAM, ROM, hard disk, or semiconductor memory. Is realized by operating.

The key generation unit 11 generates a public key and a secret key. A known technique can be applied to the key generation. A public key and a secret key (hereinafter, collectively referred to as key information) generated by the key generation unit 11 are stored in the key storage unit 10.

The public key providing unit 12 provides the public key generated by the key generating unit 11 to one node device among the plurality of node devices 300 _-1 to 300 _-3 . Which node device provides the public key is arbitrary. The public key provided to the node device 300 is distributed and stored in the plurality of node devices 300 _-1 to 300 _-3 through a consensus process described later. Then, after the public key stored in the node device 300 is acquired by the patient terminal 200 and the patient's biometric information is encrypted with the public key, the encrypted biometric information generated thereby is transferred from the patient terminal 200 to the node device. 300 is provided. The encrypted biometric information provided to the node device 300 is distributed and stored in the plurality of node devices 300 _-1 to 300 _-3 through a consensus process described later.

The biometric information acquisition unit 13 acquires encrypted biometric information from one node device among the plurality of node devices 300 _-1 to 300 _-3 . That is, the biometric information acquisition unit 13 transmits a biometric information acquisition request to one node device, and acquires the encrypted biometric information transmitted from the one node device in response to this request.

The decryption processing unit 14 decrypts the encrypted biometric information acquired by the biometric information acquisition unit 13 with the secret key generated by the key generation unit 11 and stored in the key storage unit 10. In the present embodiment, only the medical institution terminal 100 that generated the key information can decrypt the encrypted biometric information. Thereby, a patient's biometric information can be exchanged in the state which ensured confidentiality only between a specific medical institution and the specific patient who is receiving medical treatment, treatment, etc. of the medical institution.

FIG. 3 is a block diagram illustrating a functional configuration example of the patient terminal 200 according to the first embodiment. As shown in FIG. 3, the patient terminal 200 according to the first embodiment includes a biometric information input unit 21, a public key acquisition unit 22, an encryption processing unit 23, and a biometric information provision unit 24 as functional configurations.

The above functional blocks 21 to 24 can be configured by any of hardware, DSP, and software. For example, when configured by software, each of the functional blocks 21 to 24 is actually configured by including a CPU, RAM, ROM, and the like of a computer, and is stored in a recording medium such as RAM, ROM, hard disk, or semiconductor memory. Is realized by operating.

The biometric information input unit 21 inputs patient biometric information. As described above, the biological information is any one or more of information related to the patient's physiology, psychology, and behavior. For example, information measured by a medical device (not shown) placed in the patient's home is input. To do. Alternatively, biometric information is input as a function of the application program through execution of the application program installed in the patient terminal 200. This application program may be the same program as the program that executes the functions of the public key acquisition unit 22, the encryption processing unit 23, and the biometric information providing unit 24, or may be a different program.

The biometric information input unit 21 adds patient information that can identify an individual patient to the input biometric information. The patient information to be added is input and stored in advance by the patient operating an operation interface such as a touch panel or a keyboard of the patient terminal 200. The biometric information input unit 21 adds patient information stored in advance to the biometric information. Note that patient information may be input each time in accordance with the input of biometric information.

The public key acquisition unit 22 acquires public keys stored in the plurality of node devices 300 _-1 to 300 _-3 from one node device. That is, the public key acquisition unit 22 transmits a public key acquisition request to one node device, and acquires the public key transmitted from the one node device in response to this request.

The encryption processing unit 23 generates encrypted biometric information by encrypting at least one of the patient biometric information and the patient information added to the biometric information with the public key acquired by the public key acquiring unit 22. . The biometric information providing unit 24 provides the encrypted biometric information generated by the encryption processing unit 23 to one node device among the plurality of node devices 300 _-1 to 300 _-3 .

FIG. 4 is a block diagram illustrating a functional configuration example of the node device 300 according to the first embodiment. Although here is shown an example of the functional configuration of the node device 300 _-1, it is configured similarly other node devices 300 _-2 to 300 _-3.

As shown in FIG. 4, the node device 300 _-1 of the first embodiment, as a functional structure, the public key reception unit 31, the first consensus processing unit 32, a public key storage control unit 33, the biological information receiving unit 34, a second consensus processing unit 35, a biological information storage control unit 36, a public key transmission unit 37, and a biological information transmission unit 38. Also, the node device 300 _-1 of the first embodiment, as the storage medium, and a data storage unit 30.

The functional blocks 31 to 38 can be configured by any of hardware, DSP, and software. For example, when configured by software, each of the functional blocks 31 to 38 is actually configured by including a CPU, RAM, ROM, etc. of a computer, and a program stored in a recording medium such as RAM, ROM, hard disk, or semiconductor memory. Is realized by operating.

The public key receiving unit 31 receives the public key provided by the public key providing unit 12 of the medical institution terminal 100. The first consensus processing unit 32 shares the public key provided by the medical institution terminal 100 (the public key received by the public key receiving unit 31) among the plurality of node devices _300-1 to _300-3. The consensus building process is performed. That is, the first consensus processor 32 of the node device 300 _-1 transmits the public key received by the public key receiver unit 31 to the other node devices 300 _-2 to 300 _-3, a predetermined consensus process Do.

As the consensus building process performed by the first consensus processing unit 32, it is possible to use a consensus algorithm known in the blockchain technology. For example, the first consensus processing unit 32 verifies the validity of the public key provided from the medical institution terminal 100 by performing consensus building processing using a PBFT (Practical Byzantine Fault Tolerance) consensus algorithm.

The public key storage control unit 33 stores the public key in the data storage unit 30 provided in each of the plurality of node devices 300 _-2 to 300 _-3 only when an agreement is formed by the first consensus processing unit 32. As a result, the consensus public keys are distributed and stored in the plurality of node devices 300 _-1 to 300 _-3 .

The biometric information receiving unit 34 receives the encrypted biometric information provided by the biometric information providing unit 24 of the patient terminal 200. The second consensus processing unit 35 transmits the encrypted biometric information (encrypted biometric information received by the biometric information receiving unit 34) provided from the patient terminal 200 to the plurality of node devices 300 _-1 to 300 _{-3 as} a whole. Perform consensus building process for sharing. A consensus algorithm known in blockchain technology can also be used for the consensus building process performed by the second consensus processing unit 35.

The biometric information storage control unit 36 stores the encrypted biometric information in the data storage unit 30 provided in each of the plurality of node devices 300 _-1 to 300 _-3 only when an agreement is formed by the second consensus processing unit 35. . As a result, the encrypted biometric information formed in agreement is distributed and stored in the plurality of node devices 300 _-1 to 300 _-3 .

The public key transmission unit 37 transmits the public key stored in the data storage unit 30 to the patient terminal 200 in response to the public key acquisition request sent from the public key acquisition unit 22 of the patient terminal 200. The biometric information transmission unit 38 sends the encrypted biometric information stored in the data storage unit 30 to the medical institution terminal 100 in response to the biometric information acquisition request sent from the biometric information acquisition unit 13 of the medical institution terminal 100. Send.

Next, the operation of the personal information protection system according to the first embodiment configured as described above will be described. FIG. 5 is a flowchart illustrating an operation example when a public key is transmitted from the medical institution terminal 100 to the node device 300 and stored.

First, the key generation unit 11 of the medical institution terminal 100 generates a public key and a secret key (step S1), and stores the generated key information in the key storage unit 10 (step S2). Next, the public key providing unit 12 provides the public key generated by the key generating unit 11 to one node device among the plurality of node devices 300 _-1 to 300 _-3 (step S3).

On the other hand, in the node device 300, when the public key receiving unit 31 receives the public key transmitted from the medical institution terminal 100 (step S11), the first consensus processing unit 32 uses the received public key as a plurality of public keys. Consensus building processing is performed for sharing _among the node devices 300 _-1 to 300 _-3 (step S12).

Next, the public key storage control unit 33 determines whether or not the consensus formation by the first consensus processing unit 32 is successful (step S13), and only when the consensus is formed, the plurality of node devices 300 ₋₁ to 300 _-3 stores the public key in the data storage unit 30 with each (step S14). Thereby, the process of the flowchart shown in FIG. 5 is completed.

FIG. 6 is a flowchart showing an operation example when the patient biometric information is encrypted, transmitted from the patient terminal 200 to the node device 300, and stored. First, the public key acquisition unit 22 of the patient terminal 200 transmits a public key acquisition request to the node device 300 (step S21). When receiving the public key acquisition request from the patient terminal 200 (step S31), the public key transmission unit 37 of the node device 300 transmits the public key stored in the data storage unit 30 to the patient terminal 200 (step S32). . In response to this, the public key acquisition unit 22 acquires the public key transmitted from the node device 300 (step S22).

The biometric information input unit 21 inputs the biometric information of the patient (Step S23). And the encryption process part 23 produces | generates encryption biometric information by encrypting at least one of a patient's biometric information and patient information with the public key acquired by the public key acquisition part 22 (step S24). The biometric information providing unit 24 provides the encrypted biometric information generated by the cryptographic processing unit 23 to one of the node devices 300 _-1 to 300 _-3 (Step S25).

The public key acquisition in steps S21, S22, S31, and S32 and the biometric information input in step S23 may be performed in the reverse order. Further, in the case where the patient repeatedly provides biometric information to the node device 300, if the public key has already been acquired, the acquisition of the public key in steps S21, S22, S31, and S32 can be omitted. It is.

In the node device 300, when the encrypted biometric information transmitted from the patient terminal 200 is received by the biometric information receiving unit 34 (step S33), the second consensus processing unit 35 transmits the received encrypted biometric information to a plurality of nodes. A consensus building process is performed for sharing _among the devices 300 _-1 to 300 _-3 (step S34).

Next, the biological information storage control unit 36 determines whether or not the consensus formation by the second consensus processing unit 35 is successful (step S35), and only when the consensus is formed, the plurality of node devices 300 ₋₁ to 300 _-3 stores the encrypted biometric information in the data storage unit 30 with each (step S36). Thereby, the process of the flowchart shown in FIG. 6 is completed.

FIG. 7 is a flowchart showing an operation example when the medical institution terminal 100 acquires the encrypted biometric information from the node device 300 and decrypts it. First, the biometric information acquisition unit 13 of the medical institution terminal 100 transmits a biometric information acquisition request to the node device 300 (step S41). When receiving the biometric information acquisition request from the medical institution terminal 100 (step S51), the biometric information transmitting unit 38 of the node device 300 transmits the encrypted biometric information stored in the data storage unit 30 to the medical institution terminal 100. (Step S52). In response to this, the biometric information acquisition unit 13 acquires the encrypted biometric information transmitted from the node device 300 (step S42).

Next, the decryption processing unit 14 acquires the secret key stored in the key storage unit 10 (step S43), and decrypts the encrypted biometric information acquired by the biometric information acquisition unit 13 using the secret key (step S43). S44). Thereby, the process of the flowchart shown in FIG. 7 is completed.

As described above in detail, according to the first embodiment, the patient biometric information provided from the patient terminal 200 to the medical institution terminal 100 is either itself or patient information added to the biometric information by a public key. It is concealed by being encrypted. The concealed biometric information can be decrypted and used only by the medical institution that generated the secret key.

In addition, since the public key is distributed and stored in each node device 300 only when it is verified that the public key is valid by the consensus building process executed between the plurality of node devices 300, for example, the node device 300 It is possible to prevent the public key itself from being falsified by setting a malicious program on the computer. Since the public key is prevented from being falsified, it is possible to prevent the biometric information and the like from being encrypted with the illegal public key that has been falsified and decrypted with the illegal private key.

Furthermore, biometric information or the like encrypted with the public key is distributed and stored in each node device 300 only when it is verified that it is valid by the consensus building process executed between the plurality of node devices 300. Therefore, for example, it is possible to prevent the encrypted biometric information from being falsified by setting a malicious program on the node device 300.

As described above, according to the first embodiment, it is possible to realize the authenticity (impossibility of falsification) and confidentiality of patient biometric information provided from the patient terminal 200 to the medical institution terminal 100.

(Second Embodiment)
Next, a second embodiment of the present invention will be described with reference to the drawings. FIG. 8 is a diagram showing an example of the overall configuration of the personal information protection system according to the second embodiment. In FIG. 8, the same reference numerals as those shown in FIG. 1 have the same functions, and therefore redundant description is omitted here.

As shown in FIG. 8, the personal information protection system according to the second embodiment includes two medical institution terminals 100A and 100B as terminals used in two medical institutions. The first medical institution terminal 100A and the node device 300 'and the second medical institution terminal 100B and the node device 300' can be connected by a communication network such as the Internet.

FIG. 8 shows a state in which the first medical institution terminal 100A is connected to the node device _300-3 ′ and the second medical institution terminal 100B is connected to the node device _300-1 ′. The engine terminals 100A and 100B can be arbitrarily connected to any one of the node devices _300-1 'to _300-3 ' in the distributed network.

FIG. 9 is a block diagram illustrating a functional configuration example of the first medical institution terminal 100A according to the second embodiment. In FIG. 9, components having the same reference numerals as those shown in FIG. 2 have the same functions, and thus redundant description is omitted here.

As shown in FIG. 9, the first medical institution terminal 100A further includes a chart information input unit 15, a chart encryption processing unit 16, and a chart information providing unit 17 as its functional configuration. These functional blocks 15 to 17 can also be configured by any of hardware, DSP, and software.

The chart information input unit 15 inputs patient chart information. The medical record information is a record of various information related to the medical treatment and treatment of the patient, and is written and stored as necessary information every time the doctor in charge of the patient performs the medical treatment and treatment. The created chart information is stored in a local terminal used by the doctor in charge or a shared server in the hospital network. The chart information input unit 15 inputs chart information stored in a local terminal or a shared server.

The medical record encryption processing unit 16 encrypts the medical record information input by the medical record information input unit 15 with the public key generated by the key generation unit 11 and stored in the key storage unit 10, thereby obtaining the encrypted medical record information. Generate. Note that the encryption of the chart information may be performed on the entire chart information or only on the part of the patient information included in the chart information.

The chart information providing unit 17 provides the encrypted chart information generated by the chart encryption processing unit 16 to one of the node devices 300 _-1 to 300 _-3 among the plurality of node devices.

FIG. 10 is a block diagram illustrating a functional configuration example of the second medical institution terminal 100B according to the second embodiment. As shown in FIG. 10, the second medical institution terminal 100 </ b> B includes a chart information acquisition unit 41, a chart decryption processing unit 42, and a secret key acquisition unit 43 as its functional configuration. Further, the second medical institution terminal 100B includes a secret key storage unit 40 as a storage medium. These functional blocks 41 to 43 can also be configured by any of hardware, DSP, and software.

The medical chart information acquisition unit 41 acquires encrypted medical chart information from one of the plurality of node devices 300 _-1 ′ to 300 _-3 ′. That is, the chart information acquisition unit 41 transmits a chart information acquisition request to one node apparatus, and acquires encrypted chart information transmitted from the one node apparatus in response to this request.

The secret key acquisition unit 43 acquires the secret key generated by the first medical institution terminal 100A via another secure route that does not pass through the node device 300 '. For example, the secret key acquisition unit 43 is connected from the first medical institution terminal 100A via a VPN (Virtual Private Network) or a dedicated line set between the first medical institution terminal 100A and the second medical institution terminal 100B. It is possible to obtain a secret key. Or you may make it mail the thing which output the secret key to the paper medium or the information storage medium.

Another method may be as follows. That is, the second medical institution terminal 100B generates a set of another public key and another secret key, and discloses another public key. Then, the secret key generated by the first medical institution terminal 100A is encrypted with another public key generated by the second medical institution terminal 100B, and the encrypted secret key is transferred from the first medical institution terminal 100A to the first key. To the second medical institution terminal 100B. The secret key acquisition unit 43 decrypts the secret key acquired from the first medical institution terminal 100 </ b> A with another secret key and stores it in the secret key storage unit 40.

The chart decryption processing unit 42 decrypts the encrypted chart information acquired by the chart information acquisition unit 41 with the secret key stored in the secret key storage unit 40. In the present embodiment, the encrypted medical record information can be decrypted only by the second medical institution terminal 100B that has acquired the secret key by a secure route from the first medical institution terminal 100A that has generated the secret key.

FIG. 11 is a block diagram illustrating a functional configuration example of the node device 300 ′ according to the second embodiment. Incidentally, 'it is shown an example of the functional configuration of the other nodes 300 _{- 2'} where the node device 300 _-1 to 300 _-3 'are similarly constructed.

As illustrated in FIG. 11, the node device 300 _-1 ′ according to the second embodiment includes, as its functional configuration, a chart information receiving unit 51, a third consensus processing unit 52, a chart information storage control unit 53, and a chart information transmission. A portion 54 is further provided. These functional blocks 51 to 54 can also be configured by any of hardware, DSP, and software.

The chart information receiving unit 51 receives the encrypted chart information provided by the chart information providing unit 17 of the first medical institution terminal 100A. The third consensus processing unit 52 uses the encrypted medical record information (the encrypted medical record information received by the medical record information receiving unit 51) provided from the first medical institution terminal 100A as a plurality of node devices 300 _-1 ′ to 300. _-3 'Consensus building process to share with the whole. A consensus algorithm known in block chain technology can also be used for the consensus building process performed by the third consensus processing unit 52.

The medical record information storage control unit 53 stores the encrypted medical record information in the data storage unit 30 provided in each of the plurality of node devices 300 _-1 ′ to 300 _-3 ′ only when an agreement is formed by the third consensus processing unit 52. Remember me. As a result, consensus-formed encrypted medical record information is distributed and stored in the plurality of node devices 300 _-1 ′ to 300 _-3 ′.

The medical record information transmission unit 54 receives the encrypted medical record information stored in the data storage unit 30 in response to the medical record information acquisition request sent from the medical record information acquisition unit 41 of the second medical institution terminal 100B. To the medical institution terminal 100B.

According to the second embodiment configured as described above, between the first medical institution terminal 100A and the second medical institution terminal 100B, the authenticity (impossibility of falsification) and confidentiality of patient chart information. It is possible to share medical chart information while ensuring the above.

That is, the patient chart information provided from the first medical institution terminal 100A to the second medical institution terminal 100B is concealed by encrypting the whole or part of the patient information with the public key. The confidential medical record information can be decrypted and used only by the second medical institution that has obtained the secret key from the first medical institution.

Also, since the public key is distributed and stored in each node device 300 ′ only when it is verified that it is valid by the consensus building process executed between the plurality of node devices 300 ′, for example, the node By setting a malicious program on the device 300 ′, it is possible to prevent the public key itself from being falsified. Since falsification of the public key is suppressed, it is possible to prevent the chart information and the like from being encrypted by the illegal public key that has been falsified and decrypted by the illegal secret key.

Furthermore, the medical record information encrypted with the public key is also distributed to each node device 300 ′ only when it is verified that it is valid by the consensus building process executed between the plurality of node devices 300 ′. Since it is stored, for example, it is possible to prevent the encrypted medical record information from being falsified by installing a malicious program on the node device 300 ′.

As described above, according to the second embodiment, the authenticity (impossibility of falsification) and confidentiality of patient chart information provided and shared from the first medical institution terminal 100A to the second medical institution terminal 100B. Can be realized.

In addition, although the example which provides the 2nd medical institution terminal 100B with the medical chart information encrypted with the 1st medical institution terminal 100A was demonstrated here, it is not limited to this. For example, the second medical institution terminal 100B further includes the biometric information acquisition unit 13 and the decryption processing unit 14, thereby providing the second medical institution terminal 100B with the biometric information encrypted by the patient terminal 200. You may be able to do it.

In the second embodiment, the second medical institution terminal 100B includes a key storage unit 10, a key generation unit 11, a public key provision unit 12, and a biometric information acquisition unit 13 in addition to the configuration shown in FIG. A decryption processing unit 14, a chart information input unit 15, a chart encryption processing unit 16, and a chart information providing unit 17 may be provided. The first medical institution terminal 100A may include a secret key storage unit 40, a chart information acquisition unit 41, a chart decryption processing unit 42, and a secret key acquisition unit 43 in addition to the configuration illustrated in FIG.

In the second embodiment, the patient terminal 200 may further include a secret key storage unit 40, a chart information acquisition unit 41, a chart decryption processing unit 42, and a secret key acquisition unit 43. In this way, sharing of medical chart information is realized between the first medical institution terminal 100A and the patient terminal 200 while ensuring the authenticity (impossibility of falsification) and confidentiality of the patient's medical chart information. be able to.

In this case, the medical record information created in the first medical institution terminal 100A is encrypted with the public key generated in the first medical institution terminal 100A, and the secret key generated in the first medical institution terminal 100A is used. The first medical institution terminal 100A provides the patient terminal 200 with a safe route. On the other hand, you may comprise as follows.

That is, the patient terminal 200 generates a set of the second public key and the second secret key, and provides the second public key to the node device 300 ′. The node device 300 ′ performs consensus processing on the second public key, and distributes and stores the second public key only when an agreement is formed. Then, the medical record information created in the first medical institution terminal 100A is encrypted with the second public key acquired from the node device 300 ′ by the first medical institution terminal 100A, and the encrypted medical record information is converted into the first medical institution information. Provided from the engine terminal 100A to the node device 300 ′. The node device 300 ′ performs consensus processing on the encrypted medical record information, and distributes and stores the encrypted medical record information only when an agreement is formed. The patient terminal 200 obtains the encrypted medical record information from the node device 300 ′ and decrypts it with the second secret key generated together with the second public key.

The personal information protection system in this case is a personal information protection system comprising a medical institution terminal used in a medical institution, a patient terminal used by a patient, and a plurality of node devices connected by a distributed network, Specifically, it is configured as follows.

The patient terminal
A second key generation unit for generating a second public key and a second secret key;
A second public key providing unit that provides the second public key generated by the second key generating unit to one node device among the plurality of node devices;
A chart information acquisition unit that acquires encrypted chart information from one of the plurality of node apparatuses;
A second decryption processing unit that decrypts the encrypted medical record information acquired by the medical record information acquisition unit with the second secret key generated by the second key generation unit.

In addition, the plurality of node devices
A fourth consensus processing unit that performs consensus building processing for sharing the second public key provided from the patient terminal with the whole of the plurality of node devices;
A second public key storage control unit that stores the second public key in the data storage unit included in each of the plurality of node devices only when an agreement is formed by the fourth consensus processing unit;
A fifth consensus processing unit for performing consensus formation processing for sharing the encrypted medical record information provided from the medical institution terminal with the plurality of node devices as a whole;
Only when an agreement is formed by the fifth consensus processing unit, a medical record information storage control unit that stores the encrypted medical record information in the data storage unit provided in each of the plurality of node devices.

In addition, medical institution terminals
A second public key acquisition unit that acquires the second public key stored in the plurality of node devices from one node device;
A second encryption processing unit that generates the encrypted medical record information by encrypting the medical record information with the second public key acquired by the second public key acquisition unit;
And a medical record information providing unit that provides the encrypted medical record information generated by the second cryptographic processing unit to one of the plurality of node devices.

In each of the above embodiments, an example using PBFT as an example of a consensus algorithm has been described, but the present invention is not limited to this. For example, other consensus algorithms such as Proof of Work, Proof of Stake, Paxos, Raft, and Sieve may be used.

In addition, each of the above-described embodiments is merely an example of a specific example for carrying out the present invention, and the technical scope of the present invention should not be construed as being limited thereto. . That is, the present invention can be implemented in various forms without departing from the gist or the main features thereof.

DESCRIPTION OF SYMBOLS 11 Key generation part 12 Public key provision part 13 Biometric information acquisition part 14 Decryption processing part 15 Medical record information input part 16 Medical record encryption process part 17 Medical record information provision part 21 Biometric information input part 22 Public key acquisition part 23 Cryptographic process part 24 Biometric information Providing unit 30 Data storage unit 31 Public key receiving unit 32 First consensus processing unit 33 Public key storage control unit 34 Biometric information receiving unit 35 Second consensus processing unit 36 Biometric information storage control unit 37 Public key transmitting unit 38 Biometric information Transmission unit 41 Medical record information acquisition unit 42 Medical record decryption processing unit 43 Secret key acquisition unit 51 Medical record information reception unit 52 Third consensus processing unit 53 Medical record information storage control unit 54 Medical record information output unit 100, 100A, 100B Medical institution terminal 200 Patient Terminal 300, 300 'node device

Claims (3)

A personal information protection system comprising a medical institution terminal used in a medical institution, a patient terminal used by a patient, and a plurality of node devices connected by a distributed network,
The medical institution terminal
A key generation unit for generating a public key and a private key;
A public key providing unit that provides the public key generated by the key generating unit to one of the plurality of node devices;
A biometric information acquisition unit that acquires encrypted biometric information from one of the plurality of node devices;
A decryption processing unit that decrypts the encrypted biometric information acquired by the biometric information acquisition unit with the secret key generated by the key generation unit;
The plurality of node devices are:
A first consensus processing unit that performs consensus building processing for sharing the public key provided from the medical institution terminal with the entirety of the plurality of node devices;
A public key storage control unit that stores the public key in a data storage unit included in each of the plurality of node devices only when an agreement is formed by the first consensus processing unit;
A second consensus processing unit that performs consensus building processing for sharing the encrypted biometric information provided from the patient terminal with the whole of the plurality of node devices;
A biometric information storage control unit that stores the encrypted biometric information in the data storage unit provided in each of the plurality of node devices only when an agreement is formed by the second consensus processing unit,
The patient terminal
A public key acquisition unit for acquiring the public key stored in the plurality of node devices from one node device;
An encryption processing unit that generates the encrypted biometric information by encrypting the patient's biometric information or information that can identify an individual added to the biometric information with the public key acquired by the public key acquiring unit. When,
A personal information protection system, comprising: a biometric information providing unit that provides the encrypted biometric information generated by the cryptographic processing unit to one of the plurality of node devices. The medical institution terminal
A chart encryption processing section for generating encrypted chart information by encrypting chart information with the public key generated by the key generation section;
A chart information providing unit that provides the encrypted chart information generated by the chart encryption processing unit to one of the plurality of node devices;
The plurality of node devices are:
A third consensus processing unit that performs consensus building processing for sharing the encrypted medical record information provided from the medical institution terminal with the plurality of node devices as a whole;
A medical record information storage control unit that stores the encrypted medical record information in the data storage unit provided in each of the plurality of node devices only when an agreement is formed by the third consensus processing unit. The personal information protection system according to claim 1. The patient terminal
A second key generation unit for generating a second public key and a second secret key;
A second public key providing unit that provides the second public key generated by the second key generating unit to one node device among the plurality of node devices;
A chart information acquisition unit that acquires encrypted chart information from one of the plurality of node apparatuses;
A second decryption processing unit that decrypts the encrypted medical record information acquired by the medical record information acquisition unit with the second secret key generated by the second key generation unit;
The plurality of node devices are:
A fourth consensus processing unit that performs consensus building processing for sharing the second public key provided from the patient terminal with the whole of the plurality of node devices;
A second public key storage control unit that stores the second public key in the data storage unit included in each of the plurality of node devices only when an agreement is formed by the fourth consensus processing unit;
A fifth consensus processing unit for performing consensus formation processing for sharing the encrypted medical record information provided from the medical institution terminal with the plurality of node devices as a whole;
A medical record information storage control unit that stores the encrypted medical record information in the data storage unit provided in each of the plurality of node devices only when an agreement is formed by the fifth consensus processing unit,
The medical institution terminal
A second public key acquisition unit that acquires the second public key stored in the plurality of node devices from one node device;
A second encryption processing unit that generates the encrypted medical record information by encrypting the medical record information with the second public key acquired by the second public key acquisition unit;
The medical record information providing unit that provides the encrypted medical record information generated by the second cryptographic processing unit to one of the plurality of node devices. Personal information protection system.

Images