Electronic medical data anonymous sharing and tracing method fusing ring signature and block chain technology

Abstract

Aiming at the problem existing in medical data sharing at present, the invention provides a linkable and traceable ring signature based on a double-ring signature. A signer is allowed to sign anonymously, and the real identity of the signer is traced for a group of signature links of the same signer if necessary. And a traceable medical data sharing model is provided based on an alliance chain in combination with an attribute encryption technology.

Description

Technical Field

[0001] The present invention relates to the application of ring signature and blockchain technology in electronic medical data, and specifically to a method for pseudonymous sharing and tracing of electronic medical data that integrates ring signature and blockchain technology. Background Art

[0002] With the development of computer technology, the medical field has become more and more information-based, generating a large amount of health and medical data. These data include personal attribute data, health status data, such as patients' personal information, electronic medical records, or health-related data collected by wearable devices. These data have brought great convenience to patients' medical treatment, doctors' analysis of their conditions, and scientific research. Data sharing has become one of the key components of these data utilization. The current medical data sharing scheme is affected by the trust crisis and is usually established by each institution on its own. Data is shared internally, resulting in data islands and making it impossible to share data among multiple institutions. In addition, medical data contains patients' personal privacy data. When shared among multiple institutions, there is also a risk of personal privacy data leakage and medical data tampering.

[0003] The alliance chain is a type of blockchain. Unlike the blockchain, it is non-public. Only authorized nodes can join the network. The ledger information is only public in the alliance. It is an authorized joining, chain storage, decentralized, and tamper-proof super ledger. The alliance chain composed of multiple institutions can solve the data island problem of medical data sharing. Medical data circulates on the chain, and its tamper-proof feature prevents data from being maliciously tampered with and deleted. However, the alliance chain itself cannot guarantee the confidentiality of the data. It needs to be combined with encryption technology to implement access control to ensure the integrity and confidentiality of the data.

[0004] Ring signatures enable data owners to sign information anonymously. When verifying a signature, the verifier only knows that the signature is generated by a member of the group, but does not know who signed it. A ring signature can be created by a user with a group containing his public key and the public keys of others. Then the signer can use his private key and the public keys of others in the signature set to independently generate a signature without the help of others, which can ensure that the ring signature is completely anonymous. The use of ring signatures can prevent the leakage of patients' identity information and ensure the integrity of the data. However, in the use of medical data, it is sometimes necessary to know the true identity of the patient. For example, in electronic medical services, a group of patients upload their blood pressure and blood lipid information to a medical center. When multiple high values ​​are not from a single user, they are insignificant. However, when they belong to one person, the situation may become urgent. Linkability can help us link the signature data of the same user. When a large number of red flags appear for the same user, we need to trace the true identity of the user. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides an electronic medical data pseudonym sharing and tracing method that integrates ring signature and blockchain technology.

[0006] The present invention solves the above technical problems by adopting the following technical solutions:

[0007] A method for sharing and tracing electronic medical data pseudonyms by integrating ring signature and blockchain technology, comprising the following steps:

[0008] (1) Initialization

[0009] Enter the security parameter λ, and the trusted center executes DDRSIT.Setup(1 λ ,n)→pp,CPABE.Setup(1 λ )→(cpp,MPK,MSK), generate the system's ring signature public parameter pp and attribute encryption public parameter cpp, attribute public key MPK and master key MSK; perform blockchain and IPFS storage initialization;

[0010] (2) Registration

[0011] When a patient registers, the trusted center executes DDRSIT.KeyGen(pp)→(Ssk,Spk) to generate the public key Spk and private key Ssk of the ring signature. The trusted center keeps the patient's signature private key and public key. The data owner and data user request the attribute key from the trusted center. The trusted center inputs their attribute set u respectively and executes CPABE.Keygen(cpp,u,MPK,MSK)→usk to generate the attribute private key usk for them respectively.

[0012] (3) Upload data

[0013] When a patient visits a hospital, the doctor generates an electronic medical record, selects the patient's private key and a group of other users' public keys, and executes DDRSIT.Sign(pp,sk i ,ppr, pk ,m)→(σ,tsk,I,TK), sign the electronic medical record, obtain the signature σ, pseudonym I, traceability key tsk and traceability tag TK, and then return it to the hospital server together with the medical record;

[0014] The hospital server generates a symmetric key csk, and uses symmetric encryption to encrypt the electronic medical record AES.Enc(csk,m)→ct to obtain the ciphertext ct, then executes IPFS.Upload(ct)→h to upload the ciphertext data to IPFS, and returns the hash storage address h of the file. Subsequently, different access policies T1 and T2 are set to encrypt the symmetric key and the traceability key respectively. According to the access policy T1, csk is encrypted, and CPABE.Enc(cpp,csk,MPK,T1)→ct1 is executed to obtain the ciphertext ct1. According to the access policy T2, the traceability key tsk is encrypted, and CPABE.Enc(cpp,tsk,MPK,T2)→ct2 is executed to obtain the ciphertext ct2.

[0015] Call the upload smart contract upload_contract to write the case's keywords, signature, pseudonym, traceability tag, hash address, access policy T1, T2, and ciphertext ct1, ct2 into the blockchain;

[0016] (4) Data download

[0017] When the patient needs to retrieve his medical history, the doctor will call him according to his pseudonym. i The hospital calls the search smart contract search_contract using the pseudonym I i After querying the patient's case, use the file hash address to download the ciphertext data IPFS.download(h)→ct, use the attribute key to decrypt the symmetric key CPABE.Dec(cpp,ct1,MPK,usk)→csk, execute the symmetric encryption and decryption algorithm to decrypt the ciphertext data AES.Dec(csk,ct)→m, and get the plaintext m of the case. Verify the signature and execute DDRSIT.Verify(pp,ppr, pk ,m,σ)→1 / 0, verify the data integrity, and finally return the case to the patient;

[0018] In the e-health service, the research institution uses the search smart contract search_contract, enters the keywords of interest, retrieves the data of interest, and then uses the attribute key to decrypt the symmetric key, decrypts the ciphertext data, and verifies the signature. When necessary, they can link the data of the same signer and use the traceability smart contract to trace the true identity of the signer in an emergency;

[0019] (5) Links

[0020] The signatures corresponding to the data belonging to the same signer are linked together, DDRSIT.Link(σ,σ')→link / unlink, proving that they are the same signer;

[0021] (6) Tracing

[0022] The data owner sets the access structure control to trace the real identity of the signer; the user uses his own attribute private key to decrypt the traceability key CPABE.Dec(cpp,ct2,MPK,usk)→tsk and executes the traceability algorithm DDRSIT.Track( pk ,σ,tsk)→i / ⊥, find out the true identity of the signer.

[0023] The content of the ring signature algorithm DDRSIT is as follows:

[0024] DDRSIT.Setup(1 λ ,n)→pp: Input security parameter 1 λ and the size of the ring n, generating the public parameters is a cyclic group of order p, The generator of is P, The generator of is Q, e: is a bilinear map, Γ , represents a vector, Select H: H': Two hash functions;

[0025] DDRSIT.KeyGen(pp)→(sk,pk): signer j is randomly selected Output (sk j ,pk j );

[0026] in pk represents the vector of all public keys in the ring, in Output

[0027] DDRSIT.Sign(pp,sk i ,ppr, pk ,m)→(σ,y,I,T): pk :=(pk1,…,pk n ), m∈{0,1} * , signer j is randomly selected Set pseudonym Set the traceability label T←H'(pk j ) y .calculate Random Selection choose The generator P of definition calculate Generate Commitment Output signature σ:=(X,y,C,ψ1,ψ2), traceability key y, pseudonym I, traceability tag T;

[0028] DDRSIT.Verify(pp,ppr,pk,m,σ)→1 / 0:

[0029] in, σ: = (X, y, C, ψ1, ψ2, I, T), calculate

[0030] Verify V Dory (pp,(A,C,D),ψ1),V Dory (pp,(B,D,E),ψ2), if both verifications return true, return 1, otherwise return 0;

[0031] DDRSIT.Link(σ,σ')→link / unlink:

[0032] Where σ:=(X,y,C,ψ1,ψ2,I,T),σ':=(X',y',C',ψ1',ψ2',I',T'); if I=I', return link, otherwise return unlink;

[0033] DDRSIT.Trace( pk ,σ,y)→i / ⊥:

[0034] in pk :=(pk1,…,pk n ), σ: = (X, y, C, ψ1, ψ2, I, T), traverse and calculate T' = H' (pk i ) y , if T = T', return i, otherwise return ⊥.

[0035] In view of the existing problems in medical data sharing, the present invention proposes a linkable and traceable ring signature based on a double ring signature. The signer is allowed to sign anonymously, and a group of signatures of the same signer are linked when necessary to trace the true identity of the signer. In addition, a traceable medical data sharing model is proposed based on the alliance chain combined with attribute encryption technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is the system architecture of the present invention.

[0037] Figure 2 It is the overall flow chart of the present invention. DETAILED DESCRIPTION

[0038] The present invention will be further explained and illustrated below in conjunction with specific embodiments.

[0039] Example

[0040] A blockchain-based data sharing system for electronic medical data and a ring signature scheme that supports linkability and traceability. The system architecture is shown in the figure below. Figure 1 The entities involved in the scenario are described below.

[0041] Trusted center: Usually managed and maintained by the hospital, performs system initialization, initializes the public parameters of ring signature and attribute encryption, generates attribute public key and master key, and generates ring signature public and private keys for patients when they register, which are managed and stored by the hospital.

[0042] Data owner: usually a doctor or hospital. The electronic medical record generated by the patient's visit is signed by the doctor using the patient's private key. After generating the signature, pseudonym, traceability key and traceability label, the electronic medical record is encrypted using symmetric encryption to generate ciphertext, which is uploaded to IPFS storage to obtain the returned hash address. Use attribute encryption to set different access policies to encrypt the symmetric key and traceability key respectively, and obtain the symmetric key ciphertext and traceability key ciphertext. Finally, the ring signature, pseudonym, traceability label, keyword, IPFS address of the file, key ciphertext and related access policies are uploaded to the blockchain.

[0043] Data users: usually patients or scientific research institutions. When a patient needs to query his or her historical case, the doctor uses the search smart contract based on his or her pseudonym to query the data corresponding to the pseudonym on the blockchain, uses the IPFS address on the blockchain to retrieve the ciphertext data on IPFS, uses the attribute key to decrypt the symmetric key, and then uses the symmetric key to decrypt the ciphertext data. Scientific research institutions hope to use massive amounts of health data for analysis and research. They hope that the data is true and complete. They only know the data itself, not the true identity of the data owner. They search for keywords of interest on the blockchain, find the IPFS hash address of the data ciphertext, retrieve the ciphertext data on IPFS, use the attribute key to decrypt the symmetric key, and then use the symmetric key to decrypt the ciphertext data. When necessary, use the pseudonym to link the data and request the traceability smart contract to decrypt the traceability key to trace the data.

[0044] Blockchain: used to store ring signatures, pseudonyms, traceability tags, keywords, IPFS addresses, key ciphertexts, and access policies. When a user requests data, it provides a data link function to trace the patient's true identity. These functions are implemented by building search smart contracts, link smart contracts, and trace smart contracts. The search smart contract retrieves data on the blockchain ledger based on the keywords or pseudonyms provided by the requester and returns it to the user. The link smart contract retrieves all data corresponding to the pseudonyms based on the pseudonyms provided by the requester. In the trace smart contract, the requester enters his attribute private key, decrypts the trace key, and then calls the signed trace(ring,σ,tsk)→i / ⊥. If i is returned, the smart contract returns the true identity of the owner of the data.

[0045] IPFS: Maintained by trusted nodes, it stores data and returns the hash storage address of the file. When the user requests data, it retrieves the file based on the hash address of the file and returns it to the user.

[0046] VI. Implementation Instructions

[0047] (I) Specific description of signature algorithm

[0048] We use DualRing-EC universal ring signature, which is based on discrete logarithm construction, to combine the construction method of ring signature with knowledge proof to construct an efficient ring signature. It consists of two parts. The first part is a dual-ring ring signature structure with a signature size of O(n). Select a set of public keys. pk =(pk1,…,pk n ) It is known that pk j The corresponding private key is sk j , the signer randomly chooses Then calculate Where A:g r ,V2:pk c , then calculate and the response z = rc j sk j , signed as (c 1, …,c n ,z), verify the signature, calculate c'=H(M, pk ,R'), verify whether c' is equal to The signature satisfies the following equation:

[0049]

[0050] The second part is the knowledge argument. In the above signature, R / P in Equation 2 z is under the commitment key (pk1,…,pkn ) to (c 1, …,c n ) of the Pedersen commitment, using and knowledge proof that the signer publicly n ,R,m) proves knowledge (c 1, …,c n ), and knowledge proof can reduce the signature size to O(logn).

[0051] We add link tags and traceability tags based on DualRing-EC signatures. The signer is randomly selected. As a secret key, public key Select the user's public key pk1,…,pk n , which contains the public key of the signer j∈n. H: H': Two hash functions. The signer sets a pseudonym Random Selection Set the traceability label to H'(pk j ) y , bind the tag to the public key to get a new public key set Our signature satisfies the following equation:

[0052]

[0053] The scheme uses Dory commitment to prove two equations. Dory commitment is based on a bilinear commitment scheme, which can use the commitment key Message Vector Promise, get promise (Same for the message and key ). The prover can prove knowledge and satisfy B=e( Γ , Ω '),C=e( Ω , Ω '), because the commitment key is disclosed and target value It can reduce the signature size to O(logn). At the same time, the commitment keys can be preprocessed, and then the verifier only needs to use concise commitments on these keys to achieve O(logn) time cost, assuming that equations 3 and 4 are both in the bilinear group Execute on, introduce Map them into a bilinear group We get the equation:

[0054]

[0055] The following is a detailed description of our ring signature algorithm DDRSIT.

[0056] DDRSIT.Setup(1 λ ,n)→pp: Input security parameter 1 λ and the size of the ring n, generating the public parameters is a cyclic group of order p, The generator of is P, The generator of is Q, e: is a bilinear map, Γ , represents a vector, Select H: H': Two hash functions.

[0057] DDRSIT.KeyGen(pp)→(sk,pk): signer j is randomly selected Output (sk j ,pk j ).

[0058] in pk represents the vector of all public keys in the ring, in Output

[0059] DDRSIT.Sign(pp,sk i ,ppr, pk ,m)→(σ,y,I,T): pk :=(pk1,…,pk n ), m∈{0,1} * , signer j is randomly selected Set pseudonym Set the traceability label T←H'(pk j ) y .calculate Random Selection choose The generator P of definition calculate Generate Commitment Output signature σ:=(X,y,C,ψ1,ψ2), traceability key y, pseudonym I, traceability tag T.

[0060] DDRSIT.Verify(,ppr, pk ,m,σ)→1 / 0: where σ: = (X, y, C, ψ1, ψ2, I, T), calculate Verify V Dory (pp,(A,C,D),ψ1),V Dory (pp,(B,D,E),ψ2), if both verifications return true, return 1, otherwise return 0.

[0061] DDRSIT.Link(σ,σ')→link / unlink: where σ:=(X,y,C,ψ1,ψ2,I,T), σ':=(X',y',C',ψ1',ψ2',I',T'). If I=I', return link, otherwise return unlink.

[0062] DDRSIT.Trace( pk ,σ,y)→i / ⊥:where pk :=(pk1,…,pk n ), σ: = (X, y, C, ψ1, ψ2, I, T), traverse and calculate T' = H' (pk i ) y , if T = T', return i, otherwise return ⊥.

[0063] (II) Program Process

[0064] This solution provides a health data sharing solution that supports linkability and traceability. We divide it into 6 steps; the system process is as follows Figure 2 shown.

[0065] (1) Initialization, input security parameter λ, and the trusted center executes DDRSIT.Setup(1 λ ,n)→pp,CPABE.Setup(1 λ )→(cpp,MPK,MSK), generate the system's ring signature public parameter pp and attribute encryption public parameter cpp, attribute public key MPK and master key MSK. Perform blockchain and IPFS storage initialization. We assume that the blockchain and IPFS network are operated by hospitals, governments, and some interested institutions.

[0066] (2) Registration. When a patient registers, the trusted center executes DDRSIT.KeyGen(pp)→(Ssk,Spk) to generate the public key Spk and private key Ssk of the ring signature. The trusted center keeps the patient's signature private key and public key. The data owner and data user request the attribute key from the trusted center. The trusted center inputs their attribute set u respectively and executes CPABE.Keygen(cpp,u,MPK,MSK)→usk to generate the attribute private key usk for them respectively.

[0067] (3) Upload data. When the patient goes to the hospital for treatment, the doctor generates an electronic medical record, selects the patient's private key and a group of other users' public keys, and executes DDRSIT.Sign(pp,sk i ,ppr, pk ,m)→(σ,tsk,I,TK), sign the electronic medical record, obtain the signature σ, pseudonym I, traceability key tsk and traceability tag TK, and then return it to the hospital server together with the case. The hospital server generates a symmetric key csk, uses symmetric encryption to encrypt the electronic medical record AES.Enc(csk,m)→ct, obtains the ciphertext ct, and then executes IPFS.Upload(ct)→h to upload the ciphertext data to IPFS, returns the hash storage address h of the file, and then sets different access policies T1 and T2 to encrypt the symmetric key and traceability key respectively. According to the access policy T1, csk is encrypted, and CPABE.Enc(cpp,csk,MPK,T1)→ct1 is executed to obtain the ciphertext ct1. According to the access policy T2, the traceability key tsk is encrypted, and CPABE.Enc(cpp,tsk,MPK,T2)→ct2 is executed to obtain the ciphertext ct2. Call the upload smart contract upload_contract to write the case's keywords, signature, pseudonym, traceability label, hash address, access policy T1, T2, and ciphertext ct1, ct2 into the blockchain.

[0068] (4) Data download: When a patient needs to retrieve his medical history, the doctor will download the patient's medical history according to his pseudonym. i The hospital calls the search smart contract search_contract using the pseudonym I i After querying the patient's case, use the file hash address to download the ciphertext data IPFS.download(h)→ct, use the attribute key to decrypt the symmetric key CPABE.Dec(cpp,ct1,MPK,usk)→cks, execute the symmetric encryption and decryption algorithm to decrypt the ciphertext data AES.Dec(csk,ct)→m, and get the plaintext m of the case. Verify the signature and execute DDRSIT.Verify(pp,ppr, pk,m,σ)→1 / 0, verify the data integrity, and finally return the case to the patient. In the electronic medical service, the research institution uses the search smart contract search_contract, enters the keyword of interest, retrieves the data of interest, and then uses the attribute key to decrypt the symmetric key, decrypt the ciphertext data, and verify the signature. When necessary, they can link the data of the same signer and use the traceability smart contract to trace the true identity of the signer in an emergency.

[0069] (5) Linking: If these data belong to the same signer, the signatures of a set of data can be linked together, DDRSIT.Link(σ,σ')→link / unlink, proving that they are signed by the same signer.

[0070] (6) Traceability: The data owner can set up access structure control to trace the true identity of the signer. The user can use his own attribute private key to decrypt the traceability key CPABE.Dec(cpp,ct2,MPK,usk)→tsk and execute the traceability algorithm DDRSIT.Trace( pk ,σ,tsk)→i / ⊥, find out the true identity of the signer.

Claims

1. A method for sharing and tracing electronic medical data pseudonyms by integrating ring signature and blockchain technology, characterized in that: It includes the following steps: (1) Initialization Enter the security parameter λ, and the trusted center executes DDRSIT.Setup(1 λ ,n)→pp,CPABE.Setup(1 λ )→(cpp,MPK,MSK), generate the system's ring signature public parameter pp and attribute encryption public parameter cpp, attribute public key MPK and master key MSK; perform blockchain and IPFS storage initialization; (2) Registration When a patient registers, the trusted center executes DDRSIT.KeyGen(pp)→(Ssk,Spk) to generate the public key Spk and private key Ssk of the ring signature. The trusted center keeps the patient's signature private key and public key. The data owner and data user request the attribute key from the trusted center. The trusted center inputs their attribute sets u respectively and executes CPABE.Keygen(cpp,u,MPK,MSK)→usk to generate attribute private keys usk for them respectively. (3) Upload data When a patient visits a hospital, the doctor generates an electronic medical record, selects the patient's private key and a group of other users' public keys, and executes DDRSIT.Sign(pp,sk i ,ppr, pk ,m)→(σ,tsk,I,TK), sign the electronic medical record, obtain the signature σ, pseudonym I, traceability key tsk and traceability tag TK, and then return it to the hospital server together with the medical record; The hospital server generates a symmetric key csk, and uses symmetric encryption to encrypt the electronic medical record AES.Enc(csk,m)→ct to obtain the ciphertext ct, then executes IPFS.Upload(ct)→h to upload the ciphertext data to IPFS, and returns the hash storage address h of the file. Subsequently, different access policies T1 and T2 are set to encrypt the symmetric key and the traceability key respectively. According to the access policy T1, csk is encrypted, and CPABE.Enc(cpp,csk,MPK,T1)→ct1 is executed to obtain the ciphertext ct1. According to the access policy T2, the traceability key tsk is encrypted, and CPABE.Enc(cpp,tsk,MPK,T2)→ct2 is executed to obtain the ciphertext ct2. Call the upload smart contract upload_contract to write the case's keywords, signature, pseudonym, traceability tag, hash address, access policy T1, T2, and ciphertext ct1, ct2 into the blockchain; (4) Data download When the patient needs to retrieve his medical history, the doctor will call him according to his pseudonym. i The hospital calls the search smart contract search_contract using the pseudonym I i After querying the patient's case, use the file hash address to download the ciphertext data IPFS.download(h)→ct, use the attribute key to decrypt the symmetric key CPABE.Dec(cpp,ct1,MPK,usk)→csk, execute the symmetric encryption and decryption algorithm to decrypt the ciphertext data AES.Dec(csk,ct)→m, and get the plaintext m of the case. Verify the signature and execute DDRSIT.Verify(pp,ppr, pk ,m,σ)→1 / 0, verify the data integrity, and finally return the case to the patient; In the e-health service, the research institution uses the search smart contract search_contract, enters the keywords of interest, retrieves the data of interest, and then uses the attribute key to decrypt the symmetric key, decrypts the ciphertext data, and verifies the signature. When necessary, they can link the data of the same signer and use the traceability smart contract to trace the true identity of the signer in an emergency; (5) Links The signatures corresponding to the data belonging to the same signer are linked together, DDRSIT.Link(σ,σ')→link / unlink, proving that they are the same signer; (6) Tracing The data owner sets the access structure control to trace the real identity of the signer; the user uses his own attribute private key to decrypt the traceability key CPABE.Dec(cpp,ct2,MPK,usk)→tsk and executes the traceability algorithm DDRSIT.Trace( pk ,σ,tsk)→i / ⊥, find out the true identity of the signer.

2. According to claim 1, a method for sharing and tracing electronic medical data pseudonyms by integrating ring signature and blockchain technology is characterized by: The content of the ring signature algorithm DDRSIT is as follows: DDRSIT.Setup(1 λ ,n)→pp: Input security parameter 1 λ and the size of the ring n, generate the public parameters is a cyclic group of order p, The generator of is P, The generator of is Q, is a bilinear map, Γ , represents a vector, choose Two hash functions; DDRSIT.KeyGen(pp)→(sk,pk): signer j is randomly selected Output (sk j ,pk j ); in pk represents the vector of all public keys in the ring, in Output DDRSIT.Sign(pp,sk i ,ppr, pk ,m)→(σ,y,I,T): pk :=(pk1,…,pk n ), m∈{0,1} * , signer j is randomly selected Set pseudonym Set the traceability label T←H'(pk j ) y .calculate Random Selection choose The generator P of definition calculate Generate Commitment Output signature σ:=(X,y,C,ψ1,ψ2), traceability key y, pseudonym I, traceability tag T; DDRSIT.Verify(pp,ppr, pk ,m,σ)→1 / 0: in, σ:=(X,y,C,ψ1,ψ2,I,T), calculate Verify V Dory (pp,(A,C,D),ψ1),V Dory (pp,(B,D,E),ψ2), if both verifications return true, return 1, otherwise return 0; DDRSIT.Link(σ,σ')→link / unlink: Where σ:=(X,y,C,ψ1,ψ2,I,T),σ':=(X',y',C',ψ1',ψ2',I',T'); if I=I', return link, otherwise return unlink; DDRSIT.Trace( pk ,σ,y)→i / ⊥: in pk :=(pk1,…,pk n ), σ:=(X,y,C,ψ1,ψ2,I,T), traverse and calculate T'=H'(pk i ) y , if T = T', return i, otherwise return ⊥.

Images