臺灣博碩士論文加值系統

本論文針對醫療環境提出一個電子病歷存取控制的方法，其存取權限來自特定的安全政策。本方法植基於傳統所使用的IC卡作為數位簽章的裝置，並進一步地增加一個使用者所選擇的通行碼與一個RFID標籤作為額外的識別資訊，如此可為傳統所使用的方法增加彈性。在無損於隱私權的情形下，一個相同的RFID標籤可在不同的時間由不同的病患配戴，而在醫療環境中所增加的彈性符合存取控制的需求且亦能降低成本。

This thesis presents a method for access control in a healthcare environment where privileges to access electronic medical records are granted to individuals according to certain security policies. The method is based on conventional approach that uses IC cards as a device for digital signature. The method adds flexibility to the conventional approach by further including a user-chosen password and a code retrieved from a RFID tag as additional identification information. Without weakening privacy protection, an identical RFID tag can be used to identify a different patient at a different time. Such flexibility meets the need for access control in the healthcare environment and also reduces the cost.

目 次
摘要............................................................... I
Abstract......................................................... II
誌謝............................................................. III
目次............................................................ IIII
圖目次............................................................ VI
表目次.......................................................... VIII
第一章 緒論........................................................ 1
1.1 研究背景.................................................... 1
1.2 研究動機.................................................... 3
1.3 研究目的.................................................... 5
1.4 研究方法.................................................... 7
1.5 章節規劃.................................................... 8

第二章 文獻探討................................................... 10
2.1 基本密碼................................................... 10
2.1.1密碼法................................................. 10
2.1.2雜湊函數............................................... 10
2.1.3數位簽章............................................... 11
2.1.4 RSA.................................................. 11
2.1.5多重簽章............................................... 13
2.1.6 PBE.................................................. 13
2.2 國內現行健保認證機制......................................... 15
2.3 電子病歷安全存取的相關研究.................................... 17
2.4 ＲＦＩＤ之介紹.............................................. 21

第三章 使用ＩＣ卡與通行碼跨院存取電子病歷............................. 25
3.1 可驗證之數位秘密分割與回復.................................... 25
3.2 健保卡初始化................................................ 28
3.3 參與者與應用情境............................................ 31
3.4 使用IC卡與通行碼進行跨院電子病歷存取........................... 34
3.5 金鑰更新................................................... 38


第四章 使用ＩＣ卡、通行碼與標籤分級存取電子病歷....................... 41
4.1 標籤的配發程序.............................................. 42
4.2 回復私密金鑰................................................ 44
4.3 第一次與第二次秘密分割....................................... 47
4.4 使用IC卡與標籤存取就診醫院資訊................................ 50
4.5 使用IC卡、通行碼與標籤跨院存取醫療資訊......................... 54
4.6 回收tag.................................................... 58

第五章 實作驗證與分析.............................................. 61
5.1 使用IC卡與通行碼跨院存取病歷.................................. 62
5.2 配發標籤................................................... 66
5.3 住院後的兩種病歷存取應用情境.................................. 68
5.4 安全性與特性分析............................................ 72
5.5 效能分析................................................... 77

第六章 結論與未來展望.............................................. 79
6.1 結論與研究貢獻.............................................. 79
6.2 未來展望................................................... 81

參考文獻.......................................................... 82

[1] ，電子商務導航，第七卷，第六期。

[2]小小智慧型腕帶 RFID醫療應用無限。
http://www.digitimes.com.tw/n/article.asp?id=3C6956AA69CDA27548257029004765F8

[3]王岳川，張鈞皓，劉立，吳啟誠，<運用RFID辨識技術提升病人安全及與隱私議題之研究>，《國際醫學資訊研討會論文集》，頁114~119，民國94年。

[4]行政院衛生署醫療憑證管理中心－醫事憑證IC卡發放作業說明。

[5]林玉玲，<我國電子病歷發展現況與趨勢的調查研究>，台灣大學，碩士論文，民國91年。

[6]林縣城，資策會資工所，<台灣RFID產業發展與實務應用發展現況>，RFID International Conference-The Application and Future Development，2005。

[7]張音，趙健明，賴溪松，謝江清，陳澤生，譚伯群，陽澤泉，<建置一個以PC/SC為基礎之電子病歷資訊安全小型試驗>，《國際醫學資訊研討會論文集》，頁114~119，2001。

[8]財團法人醫院評鑑暨醫療品質策進會。
http://www.tjcha.org.tw/safe/safe_body01.asp

[9]陳秀雯，<電子病歷資訊共享效益分析之研究>，私立中原大學，碩士論文，民國92年。

[10]D. Baker, D. Masys, “PCASSO: a design for secure communication of personal health information via the internet”, International Journal of Medical Informatics, pp.97-104, 1999.

[11]C. Boyd, “Digital Multisignatures,” in Cryptography and Coding (H. J. Becker and F.C. Piper Eds.), Oxford University Press, pp. 241-246, 1989.

[12]D. Henrici and P. Muller, “Hash-based Enhancement of Location Privacy for Radio-Frequency Identification Devices using Varying Identifiers”, Workshop on Pervasive Computing and Communications Security, pp.149-153, 2004.

[13]C. H. Hsieh, C. J. Lee, L. Liu, C. C. Wu, “The Medication Safety System Applying RFID to Improve the Safe Use and Distribution of High-Risk Drugs”, Medical Informatics Symposium in Taiwan, 2005.

[14]J. J. Hwang, “Partition and Recovery of a Verifiable digital Secret”, US patent pending, Application No.2005/081041, April 14, 2005.

[15]J. J. Hwang, “RSA with Personalized Secret”, US Patent Pending, Application Publication No. 2006/0083370, July 1, 2005.

[16]A. Juels, “Minimalist Cryptography Low-Cost RFID Tags”, The Fourth International Conference on Security in Communication Networks, volume 3352 of Lecture Notes in Computer Science, Springer-Verlag , 149-164, 2004.

[17]A. Juels, “RFID Security and Privacy: A Research Survey”, To Appear in the Proceedings of IEEE, pp.201-212, 2006

[18]R. Rivest, A. Shamir, L. Adleman, “A method for obtaining digital signatures and public key cryptosystems”, Communications of the ACM, pp.120-126, 1978.

[19]S. E. Sarma, S. A. Weis and D. W. Engels, “Radio-Frequency Identification Security Risks and Challenges”, RSA Laboratories Cryptobytes Volume 6, No.1, Spring 2003.

[20]W. J. Song, B. H. Ahn, W. H. Kim, “Healthcare information systems using digital signature and synchronized smart cards via the Internet”, Proceedings of the International Conference on Information Technology: Coding and Computing, 177- 182, 2002.

[21]H. Takeda , Y. Matsumura , S. Kuwata , H. Nakano , J. Shanmai , Z. Qiyan , C. Yufen , H. Kusuoka and M. Matsuoka, “Healthcare Public Key Infrastructure(HPKI) and Non-profit Organization(NPO): Essetials for Healthcare Data Exchange”, International Journal of Medical Informatics, pp.311-316, 2004.

[22]I. Vajda and L. Buttyan, “Lightweight Authentication Protocols for Low-Cost RFID Tags”, Workshop on Security in Ubiquitous Computing, 2003.