Filtering data requiring confidentiality in monitor mirroring

[0001] This application claims the benefit of priority to U.S. Provisional Application No. 60/657,902, filed, Mar. 2, 2005, which is incorporated herein by reference.

[0002] The application relates to processing data sets, which include data requiring confidentiality, and the display of such data on a display device.

[0003] In various applications, besides openly accessible data sets, data sets that are meant to be made available to only a restricted group of people must also be handled. Such applications may include medical applications, in which patient-specific data may be required to be protected against unauthorized access, as well as in financial or other privacy-related applications.

[0004] One aspect of working with a computer-supported data is that not only a single person, but a relatively large number of people, may work in front of a display device or monitor. To facilitate this, so-called monitor mirroring is provided. This is, a remote desktop connection is provided where one computer system can be connected to another. Particularly in remote desktop sharing, it is possible to mirror the screen content in a local system onto a second monitor, so that a larger number of people can track the same screen content. Particularly in a medical application, for instance in a hospital system, when a finding is made, it is appropriate for a team of physicians to be able to view the results of a CT scan or an X-ray or other diagnostic data. It is also desired for all these persons to have the same basis for assessment and thus identical screen content may be on all of the monitors. Commonly this is accomplished by a remote desktop connection between two devices.

[0005] However, this may result in a problem where the data requires confidentiality. In previous systems, all the data displayed locally on the monitor were also shown on the remote workstation or remote monitor. In many jurisdictions, this may be prohibited by law or regulation for certain types of data.

[0006] A method and apparatus are disclosed where an expanded monitor capacity can be made available by means of further monitors, while permitting conformance with regulations and rules regarding data requiring confidentiality.

[0007] A method is described for monitor mirroring in the display of data sets that include data requiring confidentiality, in which at least two monitors that are associated with one or more computer systems are provided. The method may include the steps of:

[0008] identifying data requiring confidentiality from the data sets that are to be displayed;

[0009] filtering the data requiring confidentiality before the data is displayed; displaying the filtered data on at least one monitor; and

[0010] performing the monitor mirroring with the filtered data.

[0011] Since the protection of data requiring confidentiality may be considered a priority in the display of data, the identification and filtering operation may be performed before every display of data. In an aspect, the identification and filtering may be performed upstream of the graphical interface, regardless of which display device will display the data. That is, identification and filtering of data is performed even if the data are to be displayed on a local monitor.

[0012] In another embodiment, the data on the local system or on the local monitor are not filtered (so that thus even the data requiring confidentiality need not be identified), and the filtering (and the prior identification) are done only on or for one or more remote monitors. This embodiment may be used when a user must first become authorized to use the applicable local system by way of a password, and with the further condition that the authorized user is also authorized to read data requiring confidentiality. The authorization may be accomplished by a login procedure or an authorization for the particular application program, to establish that a particular user is also authorized to view data requiring confidentiality. In this circumstance, a filtering process may not need to be performed at the local monitor.

[0013] However, if a further monitor is to be connected to the local monitor for monitor mirroring, then the system administrator may specify whether the filtering operation is to be done for all monitors in every case, or only for the remote monitors. In an embodiment where all of the monitor displays are filtered, all of the users have an identical basis for assessment, and the same screen content is shown on all of the monitors. This makes communication easier between users about the particular screen content, especially when the monitors are not collocated.

[0014] In an embodiment, a hardware—and/or software-based product is located upstream of the various monitors, interacting with the data transmission and copying and repeating—display screen content. The operations of identifying and filtering may be performed independently of the computer system (including any associated databases and operating systems).

[0015] The operation of filtering can be performed in a variety of ways. The user or the system administrator may specify certain filtering criteria. As an example, but not by way of limitation, only the patient name and/or other information identifying individual patients may be removed from the display. In another aspect, the quantity of data requiring confidentiality may be greater, so that all personal and/or demographic data are included, and for example the name of the patient, date of birth, address, banking information, insurance number, and so forth, are excluded. Where the method, system or apparatus is used for a financial application, for example, the confidentiality requirements may be different possibly involving additional data requiring confidentiality (such as a PIN, social security number and the like).

[0016] There are various possible methods of altering the screen content with regard to the data requiring confidentiality so that the data requiring confidentiality are excluded from display. In an aspect, the data requiring confidentiality may be deleted. Such data may not be intrinsically deleted in the computer system or in a database that is referenced, but only from the representation of the data that is intended for display on the monitor. In another aspect, the data requiring confidentiality may be made anonymous and/or pseudonymous. When making the data anonymous, the existing applicable data structure may be maintained intact, and only the field content (for instance, for the field “patient's name”) may be deleted or replaced by some consistent indication (such as “XXX. In the case of pseudonymizing, each datum requiring confidentiality is assigned a pseudonymous datum with a unique assignment prefix. In the field “patient's name”, all that is shown may be, for instance, “sample name”.

[0017] It is also possible to modify the data structure for filtered data and to show only the data not requiring confidentiality. In that situation, the fields for the data requiring confidentiality (for instance for the patient's name, birth date, and so forth) would no longer appear on the display. This method has the advantage that the user is not presented with information which may not be relevant and can concentrate the data being displayed.

[0018] Monitor mirroring may be performed by connecting an additional monitor, which may be a remote monitor, to a local monitor. The circle of observers may be widened still further by mirroring the local monitor, or its contents, onto a plurality of monitors. The monitor or monitors on which the monitor mirroring is to be executed may belong to the same computer system or different computer systems. Moreover, they may be connected to the local system by way of any data communications method (cord connection, wireless connection, local area network, wide area network, virtual private network, other interfaces, online or offline connections, and so forth). The identification and/or the filtering of data requiring confidentiality may be performed automatically. Thus, when the task of displaying certain data sets is assigned, the identification and/or filtering operation is initiated automatically. Both operations may be executed automatically, so that misuse can be reliably avoided.

[0019] It may be appropriate, in some circumstances, for the filtering operation to be deactivated. This may occur whenever it can be assured, by a specific authorizing process, that user of a display is authorized to read data requiring confidentiality. The filtering process may then be switched off, so that the user may view the data requiring confidentiality.

[0020] The filtering property may also be deactivated whenever the remote desktop connection is disconnected, so that only one local monitor is present. In that case, the screen content may be generated anew, so that the data requiring confidentiality now becomes visible.

[0021] In hospital use, then the filtering operation may be performed by a search process in predefined standardized data structures. For example, data are typically represented in DICOM (Digital Imaging and Communications in Medicine) format, and the patient information that requires confidentiality may be contained in the DICOM header.

[0022] When a filtering operation is performed so that data not requiring confidentiality and filtered data are displayed, the filtered data may be stored in memory. This makes error correction provisions easier and allows for analysis of the viewed material subsequent to the display thereof.

[0023] The method and system may automatically recognize the connection of a remote service. When another monitor service is connected, the filtering operation may be triggered automatically.

[0024] The above-described embodiments of the method may also be embodied as a computer program product wherein the program code instructions for performing the functions of the method described herein are embodied in a computer readable medium, and the program code is executed by a processor. The computer readable medium may be any device capable of storing computer readable program code and being accessed directly or indirectly by a processor.

[0025] The hardware and software may be embodied in a single device or in multiple devices to be used either while co-located or in a distributed configuration. In another aspect, a shared system of devices including performing some of the operations of the method at one device and the remaining operations of the method at one or more second device, so that, in combination, all of the steps are performed. A product, such as a computer system or monitor, may include some or all of the code for performing the filtering and/or mirroring. By connecting the product for mirroring, the filtering automatically occurs. The product is used as the primary or local monitor or as the secondary or auxiliary monitor.

[0026] In the following detailed description of the drawings, exemplary embodiments, which are not intended to be limiting, are discussed along with their characteristics and further advantages. In the drawings:

[0027] FIG. 1 is an overview of a monitor mirroring system with filtering of confidential data in one embodiment; and FIG. 2 is a; and

[0028] FIG. 2 is an overview of a known monitor mirroring from the prior art.

[0029] Exemplary embodiments may be better understood with reference to the drawings, but these embodiments are not intended to be of a limiting nature. Like numbered elements in the same or different drawings perform equivalent functions.

[0030] A computer system RS includes a display device or monitor M. If the screen content of the monitor M is to be made available on a further display device M′, then until now it has been known to make a connection, which may optionally have data filters 12, between the two display devices M, M′. This is shown in FIG. 2 for the method known from the prior art.

[0031] It is disadvantageous that data requiring confidentiality are filtered only on the mirrored monitor M′, while they are still shown on the local monitor M. This may create a data security risk and has the further disadvantage that the user of the monitor M and the user of the mirrored monitor M′ do not have an identical view available.

[0032] In FIG. 1, shows an example of another system and apparatus. The computer system RS may include only one local workstation, or it may be a complex network system, comprising a plurality of workstations, which may, optionally, access a database DB. Monitor M is assigned to the local system.

[0033] When the monitor M is to be mirrored onto at least one further monitor M′, then an identification unit 10, a filter unit 12, and a mirroring module 14 are provided.

[0034] The identification unit 10, the filter unit 12 and the mirroring module 14 may be embodied as a heterogeneous product and located in part, or entirely, in the form of hardware and/or software. In an aspect, the components may be embodied separately as independent units or combined into a more-comprehensive product. In an example, the identification unit 10, the filter unit 12, and the mirroring module 14 are embodied as a unitary product. This is represented in FIG. 1 by the dashed line around those components.

[0035] The identification unit 10, the, filter unit 12 and the mirroring module 14 are located downstream of the computer system RS and upstream of the monitors M and M′. Thus, data requiring confidentiality are filtered before being shown on a monitor M, M′. Even on the local monitor M, only filtered data are displayed.

[0036] In another example, the filter unit 12 is located upstream of the graphical interface. Access to the filter unit 12 occurs after database access. These accesses can be executed internally or externally.

[0037] A monitor mirroring itself can be performed during an ongoing display operation. That is, if a request for data sets to be displayed on the monitor M is executed, then the data sets are shown on the monitor M. Whenever necessary, they can be filtered by the filter unit 12. When the screen content of the monitor M is mirrored onto a further monitor M′, this operation can also be done during the ongoing display of the screen content on the monitor M. When the other screen M′ or the remote service is connected or actuated, the system automatically recognizes that fact. In that event, both the screen content of the monitor M and the screen content of the monitor M′ are re-constructed (or constructed for the first time in the case of the monitor M′). This reconfiguration is based on the filtering operation. As a result, only publicly accessible data, and not data requiring protection, are displayed.

[0038] If the screen view of the original local monitor M also included data requiring confidentiality, then after the remote service has been activated, this screen content of the monitor M may be shown altered, so that after the filtering operation, it includes no data requiring protection and now includes only publicly accessible data. The identical screen content can then be mirrored onto the second monitor M′.

[0039] If a change is then to be made from one screen content format to another, such a change is accomplished on the condition that the data to be displayed pass through the filtering operation of. Therefore, the same screen content is made available on the monitors M and M′.

[0040] In an aspect, if the remote service connection (or the monitor mirroring) is terminated, then a reconfiguration is performed on the local monitor M. Depending on the specific design requirements, this newly constructed data screen display may also include data requiring confidentiality, if the user is authorized to view such data.

[0041] The filtering operation is performed in every case automatically, so that regardless of the choice of monitor M, M′, a filtering of data requiring confidentiality takes place. This contributes to the security of the entire system.

[0042] In another example, either before or after the connection of the remote service, a deactivation of the filter mechanism causes a data display area to be incorporated into the screen display requesting information to establish the authorization of the user, for example by the entry of a password.

[0043] All or some of the data that are intended for display on a display device M, M′ pass through the filter unit 12, regardless of the origin of the data. The data may originate in an internal source of the computer system RS or external sources, such as a network, an external database, or the like.

[0044] The data is displayed on a monitor M, M′. However, it is also possible for this to be accomplished with other display means having the same or similar functions, such as laptop computers, handheld devices, wireless devices, video projectors or the like. This may be useful particularly when the embodiment is not employed in medical systems in the general field of hospitals, but in general is used for technical devices that are meant to be subjected to maintenance by maintenance technicians. In this respect, the maintenance technician may track the process remotely. The display devices of the maintenance technician in this case may connect to the particular local monitor M by way of communications connections such as infrared, BLUETOOTH, communications cable local area network, the Internet, or the like.

[0045] The system and method may be used with computer systems and displays of varying manufacture when the interfaces that the system employs are compatible with the used hardware interfaces, communications protocols and data formats.

[0046] In the medical field, the data may be present in DICOM format. In this circumstance, the identification of data requiring confidentiality may be simplified, as only one search operation has to be performed, in a known data format. Overall, this leads to faster processing and a faster display of the data.

[0047] Incorporation of the present system, apparatus or method into existing systems is practical as the input and output protocols and data format may be adapted to the requirements of the existing system components. Thus, the capabilities and functions described herein may be furnished as part of a complete system or be added later.

[0048] Although only a few exemplary embodiments of this invention have been described in detail above, those skilled in the art will readily appreciate that many modifications are possible in the exemplary embodiments without materially departing from the novel teachings and advantages of the invention. Accordingly, all such modifications are intended to be included within the scope of this invention as defined in the following claims. In the claims, means-plus-function clauses are intended to cover the structures described herein as performing the recited function, their structural equivalents and equivalent structures.