In the same network, there are often co-existences:
Doctor ' s workstations
Nurse station computer
Image Terminal
PCS Server
HIS system
Mobile care PDA
Doctor's phone.
Patients and family terminals
Large number of medical items network devices
Any out-of-control link could have a direct impact on business continuity.
So what the hospital really needs is not.“It's online.”But:
Controllable, auditable, isolated and retrospective access systems.
Enterprise Portal certification is the core entry point for building this system.
I. THE REAL QUESTION OF INSTITUTIONAL NETWORK
Among the many hospital projects, the following problems are prevalent:
-
Wired, wireless mixed access and not uniformly certified
-
Combining medical personnel with patient networks
-
Medical equipment cannot be certified in complexity
-
Outsourcing of the transport account is long-standing
-
The audit of complete access is difficult to provide for medical clearances and safety.
The essence of these issues is one:
Lack of a unified access control and identity system.
II. Overall structure: enterprise Portal certification + NAC access gateway + unified accreditation platform
Hospital access governance is based on a three-tier structure:
First level: Access layer equipment (exchange/ AP)
Second floor: NAC access gateway
Level 3: Unified Certification Platform (business Portal Accreditation Platform)
Structure division of labour
Access device:
Forward terminal access requests.
NAC access gateway:
Responsible for Portal Page Interactive
802.1X authentication interactive
MAC authentication INTERACTIVE
Harmonized accreditation platform:
Check the account.
Policy Calculating
Permissions to send
Log Audit
This structure can support large-scale and multi-hospital deployment.
Access of health personnel: 802.1X + Corporate Portal Certification Co-ordination
1. Certification process
Medical personnel office computers:
Open 802.1X.
Launch authentication to switchboard
Request forwarded to NAC
NAC interacts with the Unified Accreditation Platform
After certification:
Return of unified authentication platform:
Account
Role
Section
And send out a strategy.
2. Strategic content
-
Autoassign VLAN
-
ACL
-
Lower Speed Limit Strategy
For example:
Doctor's account number → Medical operations VLAN
Nurse's account. → Care business VLAN
The realization of identity is the network.
IV. DOCTOR ' S PHONE AND MOVE RADIO: PORTAL APPROACH
Doctor's phone, tablet:
Connect to Wireless
Auto-eject enterprise Portal authentication page
Enter the account number password or docking to the AD domain account.
After certification:
Access to the medical wireless network area.
Physical isolation from the patient's network.
V. Access to medical equipment: MAC Certification + White List of Equipment
Substantial medical equipment:
Not supported Portal
802.1X not supported
Uniform use of MAC certification.
Means of implementation
In the corporate Portal certification platform:
Import Device MAC
Type of equipment tied to the section
When the device is connected:
NAC Read MAC
Submit to Unified Certification Platform validation
After the validation:
Release to the corresponding medical device VLAN.
VI. INTERVIEWING OF VOICES AND FAMILY: INDEPENDENT PORTAL VOICE SYSTEM
Patient networks must be completely isolated from the medical operations network.
Process
Connect Wireless
Popup Enterprise Portal Authentication Page
Support:
Text authentication
Two-dimensional code authentication
After certification, visitors VLAN are allowed to access the Internet only.
Access to any address on the Internet is prohibited.
VII. Outsourcing of the carrier: TACCS+Devi certification
A large amount of network equipment is maintained by the manufacturer or integrator.
Uniformly:
TACCS+ Agreement
Access to the Unified Certification Platform
Achieved:
One account for one person.
Command authorization
Operational audit
The shared administrator account is prohibited.
VIII. CUT- CONTROL MODEL DESTRUCTION
Corporate Portal Certification Platform support:
Account → Role → Policy → Network resources
Four-level map.
For example:
Account number: Zhang San
Role: cardiologist
Strategy: Allow access to HIS, PACS
Network resources: Heart vLAN
The access is exclusively centralized by the Platform.
IX. JUDGE AND AUDIT CAPACITY
Platform records:
Authentication Log
Online Log
Underline Log
Device Login
Command Audit Log
Supported by:
Account
IP
MAC
Time
Multiple conditions.
:: Meet audit requirements for insurance and medical safety.
X. Synergy and stability design
Front-end NAC cluster deployment
Backend certification platform master or cluster
A single node malfunction does not affect overall authentication.
Support horizontal expansion.
XI. WHY THE HOSPITAL PROJECT IS A CLIMATE PAP
Characteristics of hospital projects:
Cycle length
Weight
The stability is very high.
The NatShell deep-farm network certification and billing area has developed, over 22 years, a mature product system with adequate functionality, mature structure and high value for money in the areas of enterprise Portal certification, wireless Wireless authentication, network access, network billing, and transport-related auditing.
For the integrated agent:
Programme matured
Low delivery risk
Sustainable expansion.
Enterprise Portal Certification, which is the core hub of hospital access governance system
When:
Medical personnel
Medical equipment
Patient terminals
Outsourcing of the carrier
The project is a tool for the development of a corporate system of Portal certification.
The hospital network is truly available:
Controllability
Auditability
Retroactivity
Extendability.