医疗卫生领域商用密码安全的评估与建设

Evaluation and Construction of Commercial Cryptographic Security in Medical and Health Field

目的为规范医疗卫生领域商用密码安全的评估与建设,解决商用密码建设不能在医疗环境和生命周期全流程广覆盖等问题,达成商用密码不断迭代完善的目标。方法遵循以评促建、以评促用、以评促改和三同步、一评估的原则,使用密码技术和管理、基础和部署相结合的方法,落实统筹规划、分布建设、运行与密评深度结合的措施,建立密码安全建设的基础支撑、技术保障、统筹管理方法,完成密码产品的部署。结果通过密码安全保护持续改进,使医院网络安全具备态势感知的能力,数据安全具备证书授权电子签名防篡改的能力。提高了密码安全的保护能力,实现医疗业务的可信互联、安全互通,保障系统的稳定运行、数据安全无泄露。结论发挥商用密码在网络安全防护中的重要作用,筑牢智慧医院密码安全的最后一道防线屏障,切实保障患者医疗数据安全。

Objective To standardize the evaluation and construction of commercial cryptographic security in medical and health field,and to solve the problems that commercial cryptographic construction can not be widely covered in the medical environment and the whole process of life cycle,to achieve the goal of iterative refinement of commercial ciphers.Methods Following the principles of promoting construction by evaluation,promoting application by evaluation,promoting reform by evaluation,three-step,and one-evaluation,the method of combining cryptography and management,foundation and deployment was used.The measures was implemented for the deep integration of overall planning,distributed construction,operation and cryptographic evaluation.The method of basic support,technical support,and overall management of cryptographic security construction was established.And then the deployment of cryptographic products was completed.Results Through the continuous improvement of cryptographic security,the hospital network security had the ability of situation awareness,and the data security had the ability of certificate authority electronic signature tamper-proof.The ability of cryptographic security protection has been improved,the medical business interconnection,security interworking have been achieved,and the stable operation of the system and data security without leakage were ensured.Conclusion Commercial cryptographic plays an important role in network security protection,which can build up the last defense line of cryptographic security in intelligent hospital and ensure the security of patients’medical data.