医疗行业无线技术方案

1、医疗行业 无线处理方案第1页企业介绍第2页HPE and ArubaBetter Together“Clients globally should consider HP Aruba for all wired / WLAN access layer opportunities.” Gartner MQ for Wired and Wireless LAN Access Infrastructure, August Source: Gartner Magic Quadrant for the Wired and Wireless LAN Access Infrastructure Septem

2、ber . Tim Zimmerman, Bill Menezes, Andrew Lerner, ID Number: G00277052 This Magic Quadrant graphic was published by Gartner Inc. as part of a larger research note and should be evaluated in the context of the entire report. The Gartner report is available upon request from HP. The Magic Quadrant is

3、a graphical representation of a marketplace at and for a specific time period. It depicts Gartners analysis of how certain vendors measure against criteria for that marketplace, as defined by Gartner. Gartner does not endorse any vendor, product or service depicted in the Magic Quadrant, and does no

4、t advise technology users to select only those vendors placed in the Leaders quadrant. The Magic Quadrant is intended solely as a research tool, and is not meant to be a specific guide to action. Gartner disclaims all warranties, express or implied, with respect to this research, including any warra

5、nties of merchantability or fitness for a particular purpose. Leader in Campus Networks第3页 关键能力汇报 Wired and Wireless LAN Access InfrastructureEnterprise Unified Wired and WLAN AccessHPE Aruba 4.14Cisco4.14Avaya3.64Extreme3.63Enterprise Wired-Only ConnectivityCisco4.24HPE Aruba4.15Juniper3.91Brocade3

6、.74Enterprise Wireless-Only ConnectivityHPE Aruba4.11Cisco4.06Aerohive3.82Avaya3.55SMB and/or Small or Remote Branch OfficeHPE Aruba4.12Cisco4.11Avaya3.62Extreme3.61Voice Over WLANHPE Aruba4.10Cisco4.05Aerohive3.81Avaya3.53IaaS or Managed ServiceHPE Aruba4.14Cisco4.11Aerohive3.63Avaya3.61Source: Gar

7、tner Critical Capabilities for the Wired and Wireless LAN Access Infrastructure September . Bill Menezes, Tim Zimmerman, Andrew Lerner, Michelle A. Brosnahan, ID Number: G00270164. The data used in creation of this table was published by Gartner Inc. as part of a larger research note and should be e

8、valuated in the context of the entire report. The Gartner report is available upon request from HP. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other desig

9、nation. Gartner research publications consist of the opinions of Gartners research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a parti

10、cular purpose.第4页全球超出500家高端医院正在使用Aruba无线处理方案第5页是多家专业医疗厂商合作处理方案提供商New IEC 80001-2 StandardRecommends against multiple SSIDSStresses airtime fairnessHighlights spectrum analysisDropouts as low as 0.02% 第6页方案设计介绍第7页医疗行业正在革新LocationMobile EngagementGuestAccessMobileEHRDigital ImagingIoT第8页查房，以前第9页护理，以前第

11、10页现在天线Skype话机行动护理计算机药品盒针头盒垃圾袋键盘Web护理信息系统电池椅子第11页新生儿防盗第12页整体网络架构INTERNETAC7210-1AC7210-2关键交换机关键交换机POE接入交换机POE接入交换机APAP医疗内网防火墙/网闸防火墙关键交换机AC7000医疗外网WAN/4GRAP-3家/酒店/救护车服务器群第13页内外网融合方案内网流量INTERNETAC7200-1AC7200-2关键交换机关键交换机POE接入交换机POE接入交换机AP-325AP-325医疗内网防火墙/网闸防火墙关键交换机AC7000医疗外网WAN/4GRAP-3家/酒店/救护车服务器群第14

12、页内外网融合方案外网流量INTERNETAC7200-1AC7200-2关键交换机关键交换机POE接入交换机POE接入交换机AP-325AP-325医疗内网防火墙/网闸防火墙关键交换机AC7000医疗外网WAN/4GRAP-3家/酒店/救护车服务器群GRE隧道第15页案例：中山大学从属肿瘤医院，无线外网应用GRE控制器认证系统GRE隧道第16页新一代控制器OS -Multizone AP 3-node ClusterPrimary ZoneMobility Master/StandbyStandalone中国电信Standalone中国移动Standalone中国联通Standalone迈外迪

13、第17页远程VPN访问方案如远程会诊INTERNETAC7200-1AC7200-2关键交换机关键交换机POE接入交换机POE接入交换机AP-325AP-325医疗内网防火墙/网闸防火墙关键交换机AC7000医疗外网WAN/4GRAP-3家/酒店/救护车服务器群GRE隧道IPSEC隧道第18页点位设计多层布署第19页点位设计多层布署第20页SSID 设计内部员工SSID认证方式802.1x认证，EAP-PEAP或EAP-TLS医生护士移动终端、医疗设备和语音视频终端外网SSID认证方式MAC+portal双原因认证首次portal认证成功后，后台自动将用户名和MAC地址绑定后续连接做无感知认证

14、（MAC认证）住院病人MAC地址绑定使用期为5天，每个帐号只能绑定一个终端病人家眷经过注册手机号接收密码短信或微信认证， MAC地址绑定使用期为1天，每个帐号只能绑定一个终端医生MAC地址绑定使用期为1个月，每个帐号可绑定两个终端部分医生和病人及家眷终端启用终端隔离第21页不间断无线医疗网络接入智能优化终端与AP之间无线连接非优化连接问题消除 = 大幅降低医生护士投诉基于802.11标准，不需要安装任何终端软件实时射频校准DEVICE TYPEINTERFERENCELOCATIONCONGESTIONMU-MIMO AwareAruba ClientMatch专利技术漫游优化设计第22页Ar

15、uba ClientMatch 极大改进“粘滞”终端问题 终端漫游后自动优化到最正确AP终端漫游后依然“粘滞”在原来AP上不具备CLIENTMATCH第23页案例：上海儿童医院，卓越漫游及定位效果第24页第三方测试评定项目主要有：射频稳定性（ping包延迟）连续漫游（挑选其中14个AP，Ping + RSSI统计）无线定位（评定准确度、延迟）移动查房系统评定项目主要有：漫游下系统访问速度故障排查工具（AirWave）测试点位第25页漫游测试用例：一共14个AP，终端为thinkpad x201（测试机构提供），以低于正常步行速度连续移动，观察切换过程，并统计丢包情况和信号强度漫游切换次数：Ci

16、sco 7/8次vs Aruba 13次（100%）切换时RSSI： Cisco -70dBm左右 vs Aruba -50至-65 dBm（Aruba结果见上图）测试结果第26页传统安全架构Enterprise PerimeterEmployeesEmployeesWANBranch OfficeBranch EmployeesInternetData CenterVisitorsContractorsEnterprise PerimeterHome OfficesPartner Sites第27页Aruba基于角色和内容感知策略执行Data CenterBillTammyPartnersB

17、ranch EmployeesSteveBobJaneScottKimContractorsVisitorsJane第28页实现基于角色用户接入控制ApplicationServices 外来访客 医生护士医疗设备患者、家眷 医院领导Virtual AP 1SSID: HospitalVirtual AP 2SSID: GUESTDMZRADIUSLDAPADCaptive Portal基于角色接入控制接入权限Secure TunnelTo DMZ基于SSID接入控制医院领导医生护士医疗设备患者、家眷外来访客第29页愈加直观用户体验Aruba方法：基于角色动态策略传统方法： 基于SSID实现权

18、限分离第30页SSID：SYSUCC-In作用：医院内网无线终端接入无线网络认证方式：采取MAC认证和802.1X认证结合认证方式MAC认证（经过） = 802.1X认证 = 账号身份匹对 = 匹配对应策略MAC认证（失败） = 拒绝接入隔离功效：启用二层隔离功效，即同个VLAN下终端无法相互访问SSID广播：隐藏SSID案例：中山大学从属肿瘤医院，内网接入认证方式第31页ClearPass Policy Manager NAC 处理方案CLEARPASS POLICY MGROnboardGuest内置:策略引擎RADIUS/CoA/TACACS终端识别计费/报表身份存放Expandable

19、 ApplicationsREMOTE LOCATIONBYOD onboarding简单访客接入健康检验OnGuard第32页ClearPass 关键功效NETWORK EDGEMulti-VendorWired/Wireless/VPNNETWORK COREProfilerAAA/RADIUSNACCert. AuthorityOnboardingGuestDevice RegistrationVisitorEmployeeEmployee BYODHeadless DevicesContractorAdministratorUSERSPolicy Visibility - Workfl

20、owAD/LDAPSQLTokenPKIIDENTITYSOURCESClearPassUser/RoleTime/DayLocationDevice Type/HealthCONTEXT第33页Adaptive Trust for end-to-end policyBest of breed security and productivity systemsClearPassUsers, Device and App trafficClearPass Exchange第34页ClearPass 交换生态系统InfrastructureMDM / EMM使用实时终端数据进行网络控制基于位置和时

21、间颗粒化控制Next-Gen Perimeter Defense SIEM, Automation, MFA基于用户和终端颗粒化流量控制可视化和交互式控制功效第35页例子: 准入风险保护 Firewall / IPSLAN/WLANUser connects and downloads threatNGFW/IPS sends event to ClearPassClearPass isolates clientOffers enhanced user experience as ClearPass can initiate user notifications, help-desk tick

22、ets, and update third-party security solutionsDevice in step 2 can be MDM/EMM, SIEM, etc.123第36页为了保护移动查房iPad安全，医院采取了MDM厂商MobileIron处理方案；每个iPad有独立证书；经过Aruba CPPM与MobileIron服务器联动，CPPM实时同时终端信息，确保仅允许有效终端接入网络中；ClearPassCPPM依据终端属性下发策略给AC，由AC决定是否允许终端接入网络及访问权限1.2.服务器ACAP案例：北京宣武医院，iPad移动查房MDM应用第37页BYOD证书分发Do

23、mainKey & Certificate企业 PKI and CA内置 ClearPass CACertificateAuthorityValidation AuthorityRegistrationAuthorityActiveDirectoryIT-ManagedDevicesDomainUserDeviceKey & Unique CertificatePersonalDevicesCACertificateAuthorityADRAVACA第38页针对患者、家眷自注册访客接入页面可定制化，嵌入医院推广信息可引导患者下载医院APP支持社交网络登录支持无感知认证登录 ClearPass

24、Guest第39页智能应用流量控制 AppRFEHR and communication prioritizedBandwidth allocated to Healthcare applicationsAppRFMedium priority healthcare appsHigh priority real-timeLow priority personal第40页AppRF 策略执行防火墙Block/Unblock, Throttle, QoSEnable/Disable Firewall Visibility第41页AppRF Web内容分类Simple ControlSelect b

25、y: Web categoryURLRoleApply policy (block,throttle, prioritize)Web reputation scores第42页无线安全控制经过AirWave RAPIDS阻止非法AP- 自动探测& 抑制扫描无线+ 有线网络判定全部连接设备集合 & 关联结果降低误报威胁分类定义 & 自定义规则警告 & 报表警告安全团体抑制自动或手动第43页2.1.1: Dont Use Defaults2.2: Standard Config4.1.1: Better Than WEP6.1: Get latest patches 7.2:Role-based

26、Access10: Monitor Access1.1.2: Inventory WLAN1.2.3: Firewall WLAN9.1.3: Physical Security11.1: Wireless Scanning/NAC11.1: Wireless Scanning/NAC11.1: Wireless Scanning/NAC1.1.2: Inventory WLAN1.2.3: Firewall WLAN9.1.3: Physical SecurityPCI v2.0 标准Wireless LAN Is Considered A Public NetworkCategory 1N

27、o WLANCategory 2No cardholder data over WLANCategory 3Cardholder data over WLANPCI Security Controls With ArubaAPs for scanning onlyAirWave to log/reportAPs in hybrid modeBuilt-in Firewall segments WLAN AirWave to log/reportAPs in hybrid modeSupplement with AMsWPA2 EnterpriseBuilt-in Firewall segmen

28、ts WLAN AirWave to mitigate rogues, log & report第44页电磁兼容性设计对电子医疗设备无电磁干扰认证机构：TUV Rheinland of North AmericaTUV Rheinland of North America是一家著名对全球产品提供美国和加拿大市场准入认证服务企业，拥有美国职业安全与健康管理局（OSHA）授权全国公认测试试验室（Nationally Recognized Testing Laboratory），NRTL对特定产品或材料进行测定，并担保这些产品或材料满足OSHA所要求相关安全标准，以确保这些产品在美国市场使用是足够安

29、全。TUV有权依据美国国家标准为全球产品提供正当认证，成功经过测试并取得美国市场准入证书产品将取得TUVus标识。加拿大标准委员会（Standards Council of Canada）也授权TUV Rheinland of North America依据加拿大国家标准对产品进行测试和认证，成功经过测试并取得加拿大市场准入证书产品将取得cTUV标识。成功经过测试并取得美国市场和加拿大市场认证产品将取得cTUVus标识，表示该产品能够同时满足两国规范。认证标准：EN 60601-1-2:EN 60601-1-2:（医用电气设备 第1-2部分：安全通用要求 并列标准：电磁兼容性 要求和试验）为欧

30、洲标准，较国际标准IEC 60601-1-2:更为严格。 第45页ARUBA取得TUV认证经过第46页为医院量身订做组网架构终端接入管理ClearPassHIS (Oracle)电子病历(DB2)控制器(Standby)控制器(Active)网络管理AirWave有线内网住院留院输液内部专线Internet网管数据认证数据无线控制(Master)总院有线内网分院有线内网分院分门诊IAP(虚拟AC)IPSec VPN远程诊疗院领导、教授客户端RAP3G/4G，ADSL3G/4GADSL控制器控制器第47页Aruba AirWave时刻看护移动医疗网络健康终端网络端到端可视化无线射频环境质量可视化

31、网络历史统计数据可视化无线网络应用质量可视化RADIUS, DHCP, DNS IP网络关键服务可视化第48页全方面网络可视化性能和故障可视化管理终端网络端到端可视化无线射频环境质量可视化有线网络关键服务可视化无线网络应用质量可视化第49页全方面网络可视化性能和故障可视化管理终端网络端到端可视化无线射频环境质量可视化有线网络关键服务可视化无线网络应用质量可视化第50页全方面网络可视化性能和故障可视化管理终端网络端到端可视化无线射频环境质量可视化有线网络关键服务可视化无线网络应用质量可视化第51页全方面网络可视化性能和故障可视化管理终端网络端到端可视化无线射频环境质量可视化有线网络关键服务可视化

32、无线网络应用质量可视化第52页基于位置服务，带来不一样体验wave2全系列AP内置Beacons第53页产品介绍第54页Broad Portfolio of WLAN ConnectivityHospitality Access Points103H2 ports11n dual205H3 ports11ac dualPSEIndoor Access Points330 Series 11 ac WAVE 2Highest Density4x4 MU-MIMO2.5 Gbps, Dual uplinkSmart Rate (2.5GBASE-T)Outdoor Access Points270

33、 SeriesOutdoor3x3 11acHardened Access Points228 SeriesIndustrial grade3x3 11acBroad Portfolio of WLAN Connectivity310 Series 11ac WAVE 2Carpeted space3x3 MU-MIMO 2.1 Gbps320 Series 11ac WAVE 2Highest Density4x4 MU-MIMO 2.5 Gbps, Dual uplink200 SeriesLower density2x2 11ac MIMO 1.2 Gbps103 SeriesLower

34、 cost2x2 11n 600 MbpsRemote Access PointsRAP-32 ports, 2.4GHz, PSERAP-108/1091 port, 11n dual radioRAP-1554 ports, 11n dual radio, PSE210 Series 11ac WAVE 1Carpeted space3x3 MIMO1.9 Gbps220 Series 11ac WAVE 1High Density3x3 MIMO1.9 Gbps, Dual uplink第55页 Controllers scale from branch to campus7030Lar

35、ge branchUp to 64 APs and up to 8Gbps throughputMidsize branch with integrated switch12 or 24 ports of PoE+ for unified branches Up to 32 APsSmall branchVirtualized or PoE-powered controllersMidsize CampusHigh performance, fixed form factorUp to 256 APs, 12 Gbps throughputLarge CampusHigh performanc

36、e, redundant power/fan512 2048 APs, up to 40Gbps throughput72407220721072057024 (24 PoE+)7010 (12 PoE+)VMC-TACT (8/16 AP)7005/7008 (16 AP) Branch Campus7024 32 AP/2K Devices, 24 PoE, 4 Gbps第56页案例介绍第57页Customer Requirement国立成大医院成立于1981年，是南台湾主要医学中心，当前员工约2,400位并提供1100个病床及每日约4,000人门诊服务。本项目拟建置壹套无线马上寻址系统(

37、RTLS)来作为并病患及仪器设备追纵，而且能扩充使用无线语音(VoIP)服务来作为内部语音沟通，所以整套无线网络需具备稳定信息存取和高质量语音整合服务。Solution成大医院选择了Aruba无线网络，因为测试后Aruba能与AeroScout WiFi-tag整合并达成精准位置追纵能力，成大医院并使用3.5G网卡搭配Aruba AP来作为小区服务远距联机需求，且透过无线入侵防护(WIPS)功效与暨有资安网关搭配，以增加成大医院整体资安防护能力。Deployment本案使用了Aruba A6000无线总控器及300多颗AP61及AP70无线AP，为了达成整体资安考虑，成大医院使用了无线防火墙(PEF)与无线入侵防护(WIPS)和远程访问AP服务之功效，作为医护人员与行动护理推车和访客都能含有独立无线存取管制能力，以及保护全部使用者防止恶意无线攻击问题，而远程访问功效(RAP)则提供医疗人员远距存取HIS机动能力。第58页昆明医学院第一从属医院昆明医学院第一从属医院是一所集医疗、教学、科研、干部保健于一体大型综合医院。始建于1941年，原为“国立云南大学医学院从属医院”（即云大医院），是昆明医学院最早设置从属医院。挂牌为第一临床医学院。1993年1月被国家卫生部首批评定为