WO2007090466A1

WO2007090466A1 - Computer system and method for storing data

Info

Publication number: WO2007090466A1
Application number: PCT/EP2006/050777
Authority: WO
Inventors: Werner Rodorff; Jürgen Riebling
Original assignee: Vita-X Ag
Priority date: 2006-02-08
Filing date: 2006-02-08
Publication date: 2007-08-16

Abstract

The invention relates to a computer system comprising: a reading appliance (122, 422) for a portable data carrier (124; 424, 10 424', 425) for reading a first code (126; 426, 426') and a first pointer (128; 428, 428') of the carrier; means (114, 116, 118; 414, 416, 418) for encoding data (112; 412) with a second code; means (120; 420) for sending the data encoded with the second code to a first server (106; 406); means (120; 420) for receiving a second pointer (134; 434) from the first server in response to the encoded data (112; 412); means (114, 116; 414, 416) for encoding the second code and the second pointer using the first code; and means (120; 420) for sending the second code encoded with the first code and the second pointer (136; 436) to a second server (108; 408) for storing in a memory region of the second server, which is identified by the first pointer. Preferably, the second code is regenerated for each input into the second server.

Description

Computer system and method for storing data

description

The invention relates to a computer system, a data processing system, a method for storing data and a method for retrieving data and corresponding computer program products.

So-called smart cards are known from the prior art. Smart cards generally have a relatively limited storage capacity. An overview of known chip cards are "Handbook of Chip Cards", Wolfgang Rankl, Wolfgang Effing, Carl Hanser Verlag 1999.

Chip cards are used in the medical field as so-called patient cards. Such patient cards are primarily used to store the name and place of residence of the patient as well as the health insurance, in which the patient is insured. The storage of further data, such as digital X-ray images or other diagnostic data on the chip card is due to the limited storage capacity of prior art smart cards for technical and / or cost reasons not possible.

For this purpose, EP 0 781 428 B1 proposes the use of a mass storage medium in addition to a chip card. A major disadvantage of this approach is that the patient next to his smart card the mass storage medium, for example, at a doctor's visit, must carry with him. Further applications of chip cards for patient data are known from WO 03/034294 A2, WO 02/07040 A1 and WO 01/06468 A1.

The invention is based on the object to provide an improved computer system, data processing system, methods for storing data and methods for retrieving data and corresponding computer program products.

The objects underlying the invention are each achieved with the features of the independent claims. Preferred embodiments of the invention are indicated in the dependent claims.

The invention provides a computer system having a portable data carrier reading device for reading a first key and a first pointer from the data carrier. The computer system has means for encrypting data with a second key, means for sending the data encrypted with the second key to a first server, means for Receiving a second pointer from the first server in response to the encrypted data, means for encrypting the second key and the second pointer with the first key, and means for sending the first key encrypted second key and the second pointer to a second server for storing the encrypted second key and the second pointer in a storage area of the second server identified by the first pointer.

The invention is of particular advantage, since it enables the creation of a computer system with which even large amounts of data can be stored and retrieved using a portable data carrier of limited storage capacity, such as a chip card, at the same time the data against manipulation and / or Spying can be protected.

Advantageously, the present invention can therefore be used for the storage of confidential, in particular personal data, such as medical data. In particular, the invention makes it possible to store a so-called electronic patient file, wherein the mass data belonging to the patient file can be stored on a data server and an index on the electronic patient record on a directory server. Due to this separation of the index and the mass data, on the one hand a special protection of the confidentiality of the data is given and on the other hand also an efficient handling of the accruing amounts of data.

According to one embodiment of the invention, unencrypted meta-information is stored for the index entries on the directory server. This meta-information can contain descriptive information about the individual entries in the electronic patient record, so that not in every case the complete amount of data has to be downloaded, but a selection can be made. According to one embodiment of the invention, the data server is designed to store the mass data as a so-called BLOB server, that is to say for storing so-called Binary Large Object (BLOB) data. This is advantageous in particular when at least part of the data is image data, such as digital X-ray images, ultrasound images or the like.

In further preferred embodiments of the invention will be explained in more detail with reference to the drawings. Show it:

FIG. 1 shows a block diagram of a first embodiment of a data processing system according to the invention,

FIG. 2 shows a flow chart of a preferred embodiment of a method according to the invention for storing the data,

FIG. 3 is a flowchart of a preferred embodiment of the invention for retrieving the data;

FIG. 4 shows a block diagram of a development of the embodiment of FIG. 1,

FIG. 5 shows a flow chart of a representation of a use of a chip card, in particular a patient card.

FIG. 1 shows a data processing system 100 with a computer 102, which can be connected via a network 104 to a data server 106 and a directory server 108. The network 104 is a wired or wireless telecommunications network, such as a computer network, a virtual private network (VPN), an intranet, extranet, or the Internet. The computer 102 has a memory 110, such as a random access memory, for storing data 112. For example, the data 112 is a patient's medical data, such as diagnostic image data, prescription data, diagnoses, findings, etc. The data 112 for example, may be entered into the computer 102 by a treating physician.

Alternatively or additionally, the computer 102 is networked with a practice computer system of the doctor's practice and automatically receives the data 112 via the network. It is also possible to insert into the computer 102 a medical device, such as an x-ray device, for example. Computer tomographs, magnetic resonance tomographs or ultrasound device to feed supplied digital image data. This in turn can be done automatically via a network or by reading stored on, for example, a CD-ROM or DVD mass data in the computer 102. Furthermore, it is also possible for the computer 102 to be integrated into a device or to be connected directly to such a device that generates the data 112.

The computer 102 has at least one processor 114 for executing a program 116 and a component 118 for storing and / or generating a data key. Further, the computer 102 has an interface 120 through which the computer 102 can communicate with the data server 106 and the directory server 108 via the network 104.

At the computer 102, a card reader 122 is connected or integrated in this. The card reader 122 is for reading a smart card 124. On the smart card 124, an index key 126 and an index pointer 128 are stored. The index pointer 128 identifies an entry address 130 of the directory server 108 and thus a memory area assigned to the smart card 124. The index pointer 128 is assigned once upon registration of the patient and then stored on the smart card 124. The same applies to the index key 126, which is also generated during the registration of the patient and stored on the chip card. te 124 is stored persistently. The index key 126 is for encrypting index entries on the directory server 108.

The chip card 124 enables the storage of a virtual patient record on the data server 106 or an index on the electronic patient record in the directory server 108, wherein the electronic patient record can be accessed and stored only with the chip card 124.

To store the data 112, for example, proceed as follows:

The smart card 124 is inserted into the card reader 122. The computer 102 reads the index key 126 and the index pointer 128 from the smart card 124. Further, a data key is retrieved from the component 118. Preferably, component 118 generates a new data key for each poll.

With the aid of the data key, the data 112 is encrypted and transmitted from the computer 102 to the data server 106 via the interface 120 and the network 104. The data server 106 stores the encrypted data in a free memory area identified by an entry address 132. Preferably, the storage of the encrypted data 112 on the data server 106 is done so that the data received from the data server is sequentially "stacked". The storage of the data on the data server 106 thus takes place unsorted and unstructured in the order of the incoming data.

In order nevertheless to allow later access to the data, the data server 106 responds to the encrypted data 112 received by it with a data pointer 134, which for example indicates the entry address 132, about the memory area on the data server 106 on which the encrypted data 112 is stored. The data pointer 134 and the data key provided by the component 118, with which the data 112 has been encrypted, are then encrypted with the index key 126. The encrypted data key and the encrypted data pointer are then transmitted as index entry 136 from the computer 102 via its interface 120 and the network 104 to the directory server 108. The corresponding memory request from the computer 102 to the directory server 108 for storing the index entry 136 includes the index pointer 128 as a parameter. The directory server 108 thus receives an indication of in which memory area the index entry 136 is to be stored, that is to say in the example case considered here into the memory area with the entry address 130 identified by the index pointer 128 becomes.

As a result, the encrypted data 112 is stored on the data server 106, and the index entry 136, which contains the information necessary for accessing the data, is stored on the directory server. Access to the data 112 stored on the data server as well as to the index entry 136 of the directory server 108 is possible only with the aid of the chip card 124.

At a later time, for example, the data of the patient record may be recalled by another computer 102 of another treating physician, hospital, or other medical facility. The procedure is as follows:

The smart card 124 is inserted into the card reader 122. Program 116 reads index key 126 and index pointer 128 from smart card 124. The program 116 then generates a request to the directory server 108 to query the index records of the patient record stored in the storage area of the directory server 108 identified by the index pointer 128. For this purpose, the program 116 uses the index pointer 128 read from the chip card 124. The directory server 108, in response to the request received from the computer 102, provides the index records of the patient record stored in the memory area specified in the request of the computer 102 to the computer 102. The program 116 then decrypts the one or more Index entries 136 with the index key 126. This causes the program 116 to retrieve the data key and data pointer 134 from the index entry 136 in plain text.

With the data pointer 134, the program 116 then accesses the data server 106 via the interface 120 and the network 104. The data server 106 then returns the encrypted data 112 stored in the memory area identified by the data pointer 134 to the computer 102 via the network 104. The program 116 then decrypts the encrypted data 112 with the data key from the index entry 136. The decrypted data 112 is stored by the program 116 in the memory 110 and displayed on a screen, for example.

Preferably, the smart card 124 is a smart card with an integrated microprocessor. In this case, it is possible to perform various encryption and decryption functions at least partially on the smart card 124. In particular, this makes it possible that the index key 126 does not have to be read from the chip card 124. Rather, the index key 126 can be stored in a protected memory area of the smart card 124, which can only be accessed by the microprocessor of the smart card.

In this case, the procedure for uploading data is as follows: The program 116 transfers the data key supplied by the component 118 and the data pointer 134 to the chip card 124. The chip card microprocessor 128 then encrypts the data key and the data Pointer 134 using the index key 126 and passes the encrypted index entry 136 to the computer 102, which sends it to the directory server 108. In this embodiment is advantageous that only the index pointer 128, but not the index key 126 has to be read from the chip card 124.

Preferably, in addition to the encrypted portion of the index entry 136, unencrypted meta-information about the index entry 136 is stored. For example, the meta-information indicates soft category of data 112 is indexed entry 136. For example, the meta-information of an index entry 136 indicates whether it is dental, urological, gynecological or other specialist-specific data.

Furthermore, the meta-information can indicate whether it is, for example, recipe data, diagnostic data or image data.

The meta-information, by encoding in a 512-bit field prior to downloading the encrypted data from the data server 106, enables selection of the data of interest. For example, in a dental office, typically only the index entries 136, which have the indication "dental medical data" as meta-information, would be selected for download from the data server 106.

Furthermore, access permissions can also be stored in or to an index entry 136. The storage of access authorizations preferably takes place in the unencrypted part of the index entry 136. The access rights can be stored in the index entry 136, for example in a bit field of a predefined length, for example 512 bits.

For example, if bit # 3 of the bit field is set to one, it means that all physicians and dentists have access to the data to which index entry 136 refers. If, on the other hand, bit # 4 is set to logical "1", this means that, although all physicians, but not dentists, are entitled to access, if bit # 5 is set to "1", this means that are entitled to access; if bit # 7 is set to "1", it means that only dentists are authorized to access etc.

In this case, only those index entries 136 stored for a patient on the directory server 108 are offered by the program 116 for download selection by the data server 106, which correspond to the authorization of the user of the computer 102. The user rights of the user of the computer 102 can be permanently stored in the computer 102; Preferably, the user of the computer 102, for example the attending physician, has his own chip card, which he or she first has to enter into the card reader 122 for his authentication and determination of his authorizations. A corresponding development of the data processing system 100 of FIG. 1 will be explained in more detail below with reference to FIG.

FIG. 2 shows a corresponding flow chart. In step 200, the data is either input or generated. For example, the entry of the data is done manually by the attending physician or an assistant; Alternatively, the data may also be generated by a device, such as a medical device. In step 202, the data key for encrypting the data generated or input in step 202 is queried or generated. Preferably, the data key is a symmetric key. However, it can also be an asymmetric key pair.

In step 204, the data is encrypted with the data key. In the event that an asymmetric encryption method is used, the encryption of the data is done with the public key of the asymmetric key pair.

In step 206, the encrypted data is sent to the data server. The computer then receives a data pointer from the data server identifying the memory area in which the data has been stored on the data server (step 208). In step 210, an index key and a Index pointer read from the patient chip card. The index key is preferably a symmetric key. However, it may also be a key pair of an asymmetric encryption method.

In step 212, the encryption of the data key and the data pointer with the index key is performed. If an asymmetric encryption method is used, the encryption is done with the public key of the key pair.

The encryption of the data key and the data pointer generates an index entry. The index entry is sent to an index server to store the index entry in a memory area of the index server identified by the index pointer. In step 216, the index entry is stored on the index server.

FIG. 3 shows a flow chart for requesting data from the virtual electronic patient file. In step 300, the patient inserts his smart card into the card reader of the computer, for example his treating physician. The computer then reads at least the index pointer or both the index pointer and the index key from the patient smart card. In step 302, the computer retrieves the index entry (s) stored on the directory server for that particular patient using the index pointer. In step 304, the decryption of the index entry (s) is performed using the index key. Depending on the embodiment, this decryption is carried out either by the chip card by the computer.

By decrypting, the computer obtains the data key and the data pointer to the data stored encrypted on the data server, to which the index entry refers. These data are retrieved by the data server at step 306 using the data pointer. The computer then receives the encrypted data from the data server. These are calculated using the data Key decrypted (step 308) and output in step 310, for example, on a screen of the computer.

FIG. 4 shows a further development of the data processing system of FIG. 1. Elements of the embodiment of FIG. 4 which correspond to elements of the embodiment of FIG. 1 are identified by corresponding reference symbols. In the embodiment of the data processing system 400 of Figure 4, two different types of patient smart cards may be used:

The smart card 424 has a relatively small storage capacity, which is sufficient for storing the index key 426 and the index pointer 428. On the other hand, the chip card 424 'of another patient has a larger memory area which allows both the index key 426', the index pointer 428 'and the index entry 436 and a plurality of index records of the electronic health record on the smart card 424 ' save. For example, index entries are stored on smart card 424 'until the memory location of smart card 424' is exhausted. For storing further entries, the directory server can be used.

In the embodiment considered here, the user of the computer 402, that is, for example, the attending physician, has a chip card 425. The chip card 425 is used to store a secret key 438, to which a public key 440 belongs. The public key 440 is stored, for example, on a logon server 442. The login server 442 provides a so-called public key retrieval directory of the registered users, as well as other services for authenticating the registered users and the registered patients or the smart cards.

In addition, the smart cards 424, 424 'and / or 425 may be protected by a PIN or a biometric feature. To secure access by means of a PIN, a so-called PIN-PAD is connected to the computer 402, via which the PIN of the respective chip card can be entered. Only if the entered PIN with the PIN stored on the smart card, the smart card is allowed for further use.

During operation of the data processing system 400, the patient inserts his chip card 424 or 424 'into the card reader 422. Program 416 then attempts to read index entries 436 stored on the particular smart card. If the chip card is a chip card with a small storage capacity, that is to say a chip card 424, then the access attempt to the index entry (s) 436 fails since these are not stored on the chip card 424. In this case, the program 416 accesses the directory server 408 to read the index entries 436.

However, if the patient has a larger memory chip card 424 ', then the program 416 may read the index entry 436 directly from the smart card 424'.

The index entries 436 stored on the chip card 424 'may preferably include the encrypted parts of the index entry 436.

Preferably, in the embodiment of Figure 4, prior to uploading to the data server 406 and / or index entry 436, the data 412 is uploaded to the directory server 408 by the user of the computer, e.g., the attending physician, digitally signed. This is done using the secret key stored on the user's smart card 425. In this case, the data loaded by the data server 406 at a later time and / or the index entries 436 loaded from the directory server are verified using the public key 440 stored on the logon server 442.

FIG. 5 shows a method for the use according to the invention of a chip card, for example a patient card. In step 500, the patient smart card is inserted into the card reader of the computer. Thereafter, in step 502 a read attempt by the computer to read any index entries stored on the patient smart card. If the read attempt succeeds (step 504), in step 506, the data is requested / decrypted from the data server using the data pointer and the data key, respectively, from the index entry. On the other hand, if the read attempt was unsuccessful, then in step 508, the index server is first accessed to read the index entries.

This allows the optional use of cost-optimized chip cards with small storage space and comfort chip cards with larger storage space.

LIST OF REFERENCE NUMBERS

100 data processing system

102 computers

104 network

106 data server

108 directory server

110 memory

112 data

114 processor

116 program

118 component

120 interface

122 card reader

124 chip card

126 index key

128 index pointer

130 entry address

132 Entry address

134 data pointer

136 Index entry

400 data processing system

402 computers

404 network

406 data servers

408 directory server

410 memory

412 dates

414 processor

416 program

418 component 420 interface

422 card reader

424 chip card

424 ¹ chip card

425 chip card

426 index keys

426 ¹ index key

428 index pointer

428 ¹ index pointer

430 Entry address

432 Entry address

434 data pointer

436 Index entry

438 secret key

440 public key

442 login servers

Claims

Patent claims

1. Computer system with

a portable data carrier (124; 424, 424 ', 425) reader (122; 422) for reading a first key (126; 426, 426') and a first pointer (128; 428, 428 ') from the data carrier, Means (114, 116, 118, 414, 416, 418) for encrypting data (112, 412) with a second key,

Means (120; 420) for sending the second key encrypted data to a first server (106; 406), means (120; 420) for receiving a second pointer (134; 434) from the first server in response to the encrypted one Data (112; 412), means (114, 116; 414, 416) for encrypting the second key and the second pointer with the first key, means (120; 420) for transmitting the second key encrypted with the first key, and second pointer (136; 436) to a second server (108; 408) for storage in a storage area of the second server identified by the first pointer i.

The computer system of claim 1, wherein the portable data carrier is a smart card.

3. Computer system according to one of claims 1 or 2, wherein the data is medical data, text and / or image data.

4. Computer system for querying data stored on a first server (106; 406) a portable data carrier (124; 424, 424 ', 425) reader (122; 422) for reading a first key (126; 426, 426') and a first pointer (128; 428, 428 ') from the data carrier, - means (114, 116, 120; 414, 416, 420) for polling a second key encrypted with the first key and one with the first

A key encrypted second pointer from a memory area of a second server (108; 408) identified by the first pointer, means (114, 116; 414, 416) for decrypting the second key and the second pointer with the first key, - means (114, 116, 120, 414, 416, 420) for polling the data (112; 412) stored encrypted on a first server (106; 406) from a memory area of the first server identified by the second pointer, means (114, 116; 414, 416) for decrypting the data with the second key.

A data processing system comprising at least one computer system as claimed in any one of the preceding claims, wherein the second server is adapted to store an index consisting of one or more index entries (136; 436) for an electronic patient record and the mass data (112; 412) are stored encrypted on the first server.

6. Data processing system according to claim 5, wherein the first server is designed to store the data as encrypted BLOB data.

The data processing system of claim 5 or 6, wherein the second server is associated with a plurality of first pointers, each of the first pointers identifying a memory card associated with a smart card.

8. Method for storing data with the following steps:

Reading a first key (126; 426) and a first pointer (128; 428) from a portable data carrier (124; 424, 424 '),

Encrypting data (112; 412) with a second key, sending the data encrypted with the second key to a first server (106; 406), receiving a second pointer (134; 434) from the first server in response to the first encrypted data,

Encryption of the second key and the second pointer with the first key,

Sending the second key encrypted with the first key and the second pointer encrypted with the first key to a second server (108; 408) for storage in one by the first one

Pointer identified storage area of the second server.

9. The method of claim 8, wherein the data is detected using a medical device.

A method of querying data (112; 412) stored on a first server (106; 406), comprising the steps of:

Reading a first key (126; 426, 426 ') and a first pointer (128; 428, 428') from a portable data carrier (124; 424, 424 ')

Retrieving a second key encrypted with the first key and a second pointer encrypted with the first key from a storage area of a second server (108; 408) identified by the first pointer, decrypting the second key and the second pointer with the first key, Retrieving the encrypted data stored on the first server from a storage area of the first server identified by the second pointer,

Decrypt the encrypted data with the second key.

11. Computer program product with computer-executable instructions for performing the following steps:

Encryption of the second key and the second pointer with the first key,

Sending the second key encrypted with the first key and the second pointer encrypted with the first key to a second server (108; 408) for storage in one by the first

Pointer identified storage area of the second server.

A computer program product having computer-executable instructions for performing the following steps for retrieving data (112; 412) stored on a first server (106; 406):

Reading a first key (126, 426, 426 ') and a first pointer (128; 428, 428') from a portable data carrier (124; 424, 424 ') interrogating a second key encrypted with the first key and one with the first one Key encrypted second pointer from a storage area of a second server (108; 408) identified by the first pointer, Decryption of the second key and the second pointer with the first key,

Retrieving the encrypted data stored on the first server from a storage area of the first server identified by the second pointer,

Decrypt the encrypted data with the second key.

13. Chip card with a key (126, 426, 426 ') stored in the chip card and a pointer (128, 428, 428') stored in the chip card, the key and the pointer being permanently assigned to an authorized user of the chip card, Pointer to an index entry (136, 436) of a directory server (108, 408), wherein the index entry is encrypted and the key is for decrypting the index entry.