Solution Overview Vectored Event Grid Architecture for Real-Time Intelligent Event Management

Transcription

1 Solution Overview Vectored Event Grid Architecture for Real-Time Intelligent Event Management Copyright Nuvon, Inc. 2007, All Rights Reserved.

2 Introduction The need to improve the quality and accessibility of affordable healthcare is widely recognized as a significant challenge faced by the healthcare providers across the globe. Over the past decade, significant improvements in healthcare accessibility, quality, and cost have become possible due to advances in computer networking, informatics systems engineered for specific clinical needs, and miniaturization of diagnostic and point-of-care testing devices. These devices are increasingly deployed in decentralized healthcare settings. However, these advances have created more challenges by adding complexity to the existing IT infrastructure at the point of care. The challenges can be classified as follows: Network Complexity Proliferation of new and legacy equipment Large number of heterogeneous devices and systems Multiple vendor environments, often with closed proprietary architecture Administration Costs Lack of single solution for Operations, Administration & Maintenance (OAM) Direct and indirect costs associated with device failures Limited remote connectivity to manage devices and multiple support systems Access Management Multiple third-party access to systems Lack of split management domains No accountability, auditing, or access intervention Security and Integrity Integrity of discrete and decentralized elements within a healthcare system is of the utmost importance to a healthcare provider. A healthcare provider s network architecture can be subjected to threats directed against the following security goals: Availability of data and service Confidentiality of information and actions Integrity of the computing infrastructure 1 Comprehensive security mechanisms should be deployed to prevent security violations, real-time monitoring, and event notification. The security architecture should compensate for violations to limit the damage to the network elements in real time. 1 Accuracy of data contents; unmodified state of data, programs, and processes; authenticity and non-repudiation of various discrete elements and processes Copyright Nuvon, Inc. 2007, All Rights Reserved. 2

3 Vulnerabilities in Existing Security Architecture Nuvon has identified a number of areas in the security architecture at healthcare facilities that could be further enhanced. They are as follows: Limited Trust Boundary and Coordinated Event Monitoring In the current infrastructure, the trust boundary effectively stops at the firewall appliance or at layer 3 switches or routers with integrated firewalls. There is no single, centralized entity that can provide device level management and integrity checks on discrete elements. Most devices have elementary SNMP-based capabilities. However, there is no single, centralized dashboard for monitoring system-wide operations, coordinated indepth event analysis, or troubleshooting in the event of a failure. The current trust boundary can be extended and the device management issues can be addressed if there is a secure, coordinated, and centralized device management entity. Limited Trust Chain Monitoring There is no single, coordinated mechanism or entity that can verify the integrity of software applications, middleware, and embedded operating systems running on various local elements at the point of care within a healthcare facility. Some devices lack trust chain infrastructure, which implies that the local infrastructure is vulnerable to security breaches. Limited Audit Trail Each medical device has its own vendor-defined audit trail mechanism. There is no single, coordinated mechanism to record a transaction session from end to end for nonrepudiation and archival purposes. Tracing operator errors leading to system failures on any of the discrete elements within the local point of care need an involved, timeconsuming, and coordinated post analysis. Limited Locational Integrity, Authenticity, and Inventory of Discrete Remote Devices There is no way to identify whether any discrete component at the local point of care has been moved from its original and designated deployment location. This is especially true for the devices that are mobile, such as infusion pumps, portable diagnostic equipment, and point-of-care testing devices. There is no centralized or coordinated entity within the healthcare provider s infrastructure that can provide locational integrity coupled with inventory management of the devices. Copyright Nuvon, Inc. 2007, All Rights Reserved. 3

4 Nuvon VEGA Solution Nuvon Vectored Event Grid Architecture (VEGA) has been developed to address and mitigate these challenges for IT and Clinical Engineering departments. Nuvon has created a flexible and highly secure system to monitor and control heterogeneous devices within a healthcare network. Network technicians or operators can identify and resolve a potential failure or a problem with data flow within a device or network element using Nuvon s real-time, intelligent event management solution. VEGA is a software and hardware solution with advanced security parameters that allows IT and Clinical Engineering teams to seamlessly manage a spectrum of devices without the disruption of current configurations and deployments--via proprietary processor-level architecture. The VEGA solution provides a management and monitoring system that lays over the existing IT infrastructure (e.g. servers, telephony, switches, and routers). VEGA also creates a networked infrastructure for heterogeneous clinical medical systems and devices, an array of equipment that includes patient monitoring, treatment, and imaging. Nuvon s VEGA solution is comprised of the following elements: Intelligent Device Manager Medical Grade (IDM-MG), Intelligent Device Controller (IDC), VEGA server, VEGA client, and VEGA Gateway appliance. These components operate in a nonintrusive and secure manner within an existing network environment. The VEGA solution has the following capabilities: Intuitive web-based GUI for monitoring and managing the state of each device within an intranet or a facility Granular view of applications, processes, operating system, and the BIOS within a device or a system within any administrative domain Inbuilt secure and redundant device level access for remote management Device independent and operating system agnostic Scalable and robust security policies for monitoring thousands of devices Split or integrated administrative domains with user-definable parameters for policies and administration Copyright Nuvon, Inc. 2007, All Rights Reserved. 4

5 VEGA Solution Components Nuvon s real-time, intelligent event networking platform is comprised of an IDM-MG appliance that can be deployed on the local LAN. There are two types of IDM-MG appliances: the hardware IDM-MG appliance and the software-based embedded IDM- MG appliance. Both appliance solutions feature identical, small memory footprint software images with asymmetric multiprocessing capabilities. Hardware IDM-MG Appliance The hardware IDM-MG appliance provides connectivity to the managed devices using onboard ethernet interfaces. The appliances do not have moving parts; have low power consumption and heat dissipation characteristics; and come in desktop and rack-mount form factors. The physical connectivity to discrete devices can also be done via wireless LAN, Zigbee, or asynchronous serial interfaces. Embedded IDM-MG Appliance The embedded IDM-MG appliance is a software appliance that can be installed on any existing device or system. The software appliance features a comprehensive Nuvon BIOS and operating system. It is device and operating system agnostic and uses the host system s I/O and network ports for communicating with Nuvon s backend server, the VEGA server. Intelligent Device Controllers Intelligent Device Controllers (IDC) are small, dedicated, and purpose built microprocessors that are interconnected and perform specific tasks. IDCs reside within IDM- MG appliances and are also connected to the backend VEGA server that resides in a service provider s data center. IDCs can analyze, monitor, and provide device management; receive and generate device specific events; and acquire, convert, and transform data streams. The IDCs are set up in a peer-to-peer mode for mutual data exchange. Each IDC can be thought of as a cell in a massive, parallel IDC grid system. An IDC-based grid can monitor and handle sensitive data in a network with thousands of multi-vendor heterogeneous devices. The devices can range from small, legacy devices with vendor specific I/O to computer-hosted and controlled systems. An IDC can execute specific tasks and can feed data to other IDCs on its peer network. The successor IDC can then operate on the data provided by its predecessor. The IDC can also directly send event data to the VEGA server. The IDM-MG appliance autoconfigures the IDCs and securely interconnects the data flow between IDCs, VEGA server, and third-party web services. Copyright Nuvon, Inc. 2007, All Rights Reserved. 5

6 Figure 1 shows a logical IDC-based grid that automatically discovers and monitors the various devices in a healthcare facility Figure 1. VEGA Solution Deployment Scenario with Logical IDC Grid Network Copyright Nuvon, Inc. 2007, All Rights Reserved. 6

7 VEGA Server The VEGA server is the backbone of the Nuvon VEGA solution. The VEGA server is located in the main data center of a service provider or an enterprise network. The system is comprised of applications to manage and control the entire VEGA solution, from network-level communications to security for user access and activity. The VEGA server consists of the following integrated modules, each of which can be configured for redundancy and load balancing: Core Module - Provides secure communication channels between the IDM- MGs and end-user clients using RSA PKE authentication process and encryption. It also provides the infrastructure for auto-configuration and administration of remote appliances. Session Module - Provides logging and session recording services for all management activity on the devices controlled by the IDM-MG appliance. This module uses the standard web interface to view or audit the logs. Web Module - Contains the business logic and the graphical user interface components for the VEGA server system. Authentication Module - Manages and controls the secure peer-to-peer connections between the various elements of the VEGA solution. VEGA Client The VEGA client is the operator software that resides on the technician s workstation, creating secure connections between the workstation and managed devices. The client software has an inbuilt advanced PKE generator. Each generated key is protected with a password that is different from the normal login password for the VEGA system. The VEGA client has the following attributes: Operating system and hardware agnostic Strong security features Private untraceable IP addresses Automatic launch of management application Advanced terminal emulator VEGA Gateway Appliance The VEGA Gateway appliance extends access to intranet devices managed by the VEGA solution to authorized remote users or users who reside outside an enterprise s autonomous system boundary. This appliance works seamlessly with pre-existing firewalls deployed within an intranet. Copyright Nuvon, Inc. 2007, All Rights Reserved. 7

8 VEGA Solution Feature and Benefits The VEGA solution provides network administrators everything needed to securely manage and monitor a heterogeneous network of medical devices, medical systems, and associated applications. The VEGA solution is designed to accommodate complex networking environments comprised of hardware, software, and networking architectures. Clinical engineering departments can start with a simple deployment and scale to a system-wide, enterprise grade, event network with thousands of nodes. Network operators can leverage the inherent scalability of a peer-to-peer architecture to help maximize the total return on investment. Table 1 highlights the features of the VEGA solution and the associated benefits to a healthcare provider s network. Features Device independent & operating system agnostic Mission specific microprocessor grid architecture Wireline and wireless interface options Web-based GUI for device management Integrated or split administrative domains User definable administration policies and dashboards RSS feedback for alarms and notification Auto device recognition and configuration linking sites, devices, and resources Password management and accountability/audit trail for all devices Device level trust chain analytics Encrypted, redundant device level access Real-time event analysis, alarm monitoring, alerting with notification, and logging Device location registration Improved workflow at point of care Benefits Compatibility with legacy and future devices Scalability to monitor thousands of devices Flexible networking and deployment options Intuitive tiered and expandable dashboard for facilities and device level views Flexibility in deploying within existing organizational boundaries Granularity in defining policies within organizations Easy integration with existing web-based GUI and management systems Plug & play deployment Comprehensive non-repudiation capabilities to meet regulatory concerns Comprehensive intrusion detection 2048 bit encryption to provide enhanced security Root cause analysis dashboard for quick and efficient error isolation Identification of patient (via device) location during a critical event Improved locational integrity of devices Enhanced quality of care due to faster response times Table 1. Benefits of the Feature Rich VEGA Solution Copyright Nuvon, Inc. 2007, All Rights Reserved. 8

9 The VEGA solution also features location awareness and integrity checking. If any component in the local LAN is removed from the network and plugged in at an alternate location, the VEGA solution can identify and lock out the rogue element from the network. The IDM-MG appliances can keep elaborate audit trails and provide comprehensive inventory management for the components within the local LAN in a centralized manner. The unique differentiators of the VEGA solution are as follows: Comprehensive network overlay solution for OAM Redundant, scalable enterprise-grade server architecture Non-intrusive and system agnostic Self-forming networked device discovery Graphical Integrated Development Environment (IDE) for custom IDC Network virtualization with split management domains User defined reporting and auditing tools High-performance low-level database transactions Policy-based permissions for user accounts SLA audits and reporting engine for auditing managed devices Table 2 below highlights VEGA solution s return on investment benefits to a healthcare provider s network. Quantitative ROI Leverages existing infrastructure - No forklift upgrades needed Improves clinical engineering capital expenditures - Allows historical & trending data for better spares management Improves clinical engineering OPEX via productivity gains Diminishes response times to device malfunctions Reduces preventive maintenance TCO and increases active life of equipment - TCO represents 3.6 to 18.5 times initial technology cost Qualitative ROI Patient safety Provides root cause analysis transcripts for adverse events, including VEGA appliance events/ supervisory alerts Enhanced patient safety & satisfaction Raises survey scores by improving response time Staff satisfaction & retention Improves processes to reduce workload Improved security for devices Enables intrusion detection, privacy, non-repudiation, and trust chain for devices and locational integrity Table 2. ROI Benefits from VEGA Solution Copyright Nuvon, Inc. 2007, All Rights Reserved. 9

10 Summary Nuvon s VEGA solution is a flexible, scalable, secure, and distributed event management platform that monitors and controls heterogeneous devices and network elements within an enterprise network. VEGA is built around special purpose microprocessors called Intelligent Device Controllers (IDCs). Each IDC can be thought of as one cell in an IDC grid system, each doing specific tasks and triggering other IDCs and servers as needed. An IDC-based grid can monitor and handle sensitive data in a network of thousands of multi-vendor heterogeneous devices ranging from small, legacy devices with vendor specific I/O to computer-hosted and controlled systems. Copyright Nuvon, Inc. 2007, All Rights Reserved. 10