Internet of Things medical equipment fragmentation encryption system and method

Abstract

The invention discloses an Internet of Things medical equipment fragmentation encryption system and method, and particularly relates to the technical field of fragmentation encryption, and the method comprises the steps: dividing medical equipment according to a use scene, and endowing data information of different scenes with different scene weights; calculating the priority of each piece of data information according to the information entropy and the scene weight; dynamically adjusting fragmentation parameters according to the network signals and the priority of each piece of data information; different fragmentation strategies can better adapt to different data information; the transmission process is smoother; a local differential privacy technology is used, a random response mechanism is used in extracted data information features, data information subjected to fragmentation disturbance is transmitted through multiple paths, scores of all the paths are calculated according to network signals, and fragmentation-path mapping is formed; different paths correspondingly upload the fragment data of different fragment parameters.

Description

Technical Field

[0001] The present invention relates to the technical field of shard encryption, and more specifically, to a shard encryption system and method for Internet of Things medical equipment. Background Art

[0002] With the rapid development of IoT technology, IoT medical devices are increasingly being used in the healthcare sector. These devices typically collect, transmit, and store large amounts of sensitive data. This data not only affects patient privacy but also has a close relationship with their life safety. Therefore, protecting the security and privacy of this data has become extremely important.

[0003] However, with the widespread deployment of IoT devices, security issues are gradually emerging. Because IoT devices typically have limited computing power and storage resources, traditional encryption methods may not be suitable for all devices. This is especially true when efficient and resource-efficient encryption is required between devices. Sharded encryption technology has been proposed and applied to IoT medical devices as an innovative security measure. Sharded encryption divides sensitive data into multiple small parts (called "data shards") and then independently encrypts each shard. Even if an attacker is able to obtain part of the data shards, the individual data shards are meaningless for recovering the original data, effectively preventing the risk of data leakage.

[0004] When sharding data in the prior art, a fixed shard size is used, which cannot be well adapted to different scenarios, resulting in poor sharding effect.

[0005] In order to solve the above-mentioned defects, a technical solution is now provided. Summary of the Invention

[0006] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a fragmented encryption system and method for IoT medical devices to solve the problems raised in the above-mentioned background technology.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A fragmented encryption system and method for Internet of Things medical devices, comprising the following steps:

[0009] First, medical devices are divided according to usage scenarios, and data information in different scenarios is assigned different scenario weights. The priority of each data information is calculated based on information entropy and scenario weights.

[0010] The sharding parameters are dynamically adjusted according to the network signal and the priority of each data information. By using local differential privacy technology and a random response mechanism in the extracted data information features, the sharded data information is transmitted through multiple paths, and the scores of each path are calculated according to the network signal to form a shard-path mapping. Different paths correspond to uploading sharded data with different sharding parameters.

[0011] In a preferred embodiment, after determining the priority of each data message, the fragmentation parameters are dynamically adjusted according to the network signal and the priority of each data message; the network signal includes the current bandwidth and delay rate.

[0012] In a preferred embodiment, sharding parameters are determined, data information is sharded according to the sharding parameters, and a random response mechanism is used for the sharded data information by using local differential privacy technology.

[0013] In a preferred embodiment, each path score is calculated based on the network signal to form a fragment-path mapping; paths with high path scores are used to upload fragment data with small fragment parameters; different paths are used to upload fragment data information with different fragment parameters;

[0014] The path scoring formula is as follows: ;in, represents the bandwidth of path k; represents the path score of path k; Represents the maximum bandwidth; represents the delay of path k; represents the packet loss rate of path k.

[0015] In a preferred embodiment, the path status is checked every 5 seconds, and a path switch is triggered when the packet loss rate exceeds 5%. Only the lost fragments are retransmitted, not the entire data stream.

[0016] In a preferred embodiment, after the sharded data information is transmitted to the cloud or edge node through different paths using local differential privacy technology; the cloud or edge node uses secure multi-party computing to aggregate the shards and restore the data.

[0017] In a preferred embodiment, smart contracts are used to implement functions such as aggregator and verification group selection.

[0018] In a preferred embodiment, the system includes the following modules: a dynamic sharding control module, a privacy protection processing module, a multi-path transmission scheduling module, and a security aggregation and decryption module;

[0019] The dynamic sharding control module is used to dynamically adjust the sharding parameters according to the network signal and the priority of each data information; the dynamic sharding control module includes a data priority calculation module;

[0020] The data priority calculation module is used to calculate the priority of each data information based on the information entropy and the data source scene weight; the data priority calculation module internally includes a scene division and weight management module;

[0021] The scenario division and weight management module is used to divide the medical equipment usage scenarios and assign weights to the data information obtained in different scenarios;

[0022] The privacy protection processing module is used to use local differential privacy technology on the sharded data information and a random response mechanism on the sharded data information;

[0023] The multi-path transmission scheduling module is used to calculate the score of each path based on the network signal, forming a shard-path mapping; the private shard data information is transmitted to the cloud or edge node through different paths;

[0024] The secure aggregation and decryption module is used to receive encrypted fragmented data from multi-path transmission, restore the complete data stream through a secure multi-party computing protocol, and implement dynamic access control based on key management of smart contracts.

[0025] In a preferred embodiment, the dynamic sharding control module includes a data priority calculation module; the data priority calculation module is used to calculate the priority of each data information based on information entropy and data source scenario weight.

[0026] In a preferred embodiment, the data priority calculation module includes a scenario division and weight management module; the scenario division and weight management module is used to divide the medical device usage scenarios and assign weights to the data information obtained in each different scenario.

[0027] Technical effects and advantages of the present invention:

[0028] The present invention first divides medical devices according to usage scenarios, assigns different scenario weights to data information of different scenarios, calculates the priority of each data information based on information entropy and scenario weights, and divides different scenarios so that the shard size is more suitable for different scenarios.

[0029] Then, the sharding parameters are dynamically adjusted according to the network signal and the priority of each data information; different sharding strategies can better adapt to different data information, making the transmission process smoother; by using local differential privacy technology, a random response mechanism is used in the extracted data information features, and the sharded perturbation data information is transmitted through multiple paths. The score of each path is calculated according to the network signal to form a shard-path mapping; different paths correspond to uploading sharded data with different sharding parameters. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings;

[0031] Figure 1 This is a timing diagram of a fragmented encryption method for Internet of Things medical devices of the present invention;

[0032] Figure 2 This is a structural diagram of a shard encryption system for Internet of Things medical devices of the present invention. DETAILED DESCRIPTION

[0033] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0034] The present invention first divides medical devices according to usage scenarios, assigns different scenario weights to data information of different scenarios, and calculates the priority of each data information based on information entropy and scenario weights;

[0035] Then, the sharding parameters are dynamically adjusted according to the network signal and the priority of each data information; different sharding strategies can better adapt to different data information, making the transmission process smoother; by using local differential privacy technology, a random response mechanism is used in the extracted data information features, and the sharded perturbation data information is transmitted through multiple paths. The score of each path is calculated according to the network signal to form a shard-path mapping; different paths correspond to uploading sharded data with different sharding parameters.

[0036] Example 1

[0037] The present invention provides a fragment encryption method for Internet of Things medical equipment, such as Figure 1 As shown, the specific steps include:

[0038] First, medical devices are divided according to usage scenarios, and data information in different scenarios is assigned different scenario weights. The priority of each data information is calculated based on information entropy and scenario weights.

[0039] The sharding parameters are dynamically adjusted according to the network signal and the priority of each data information. By using local differential privacy technology and a random response mechanism in the extracted data information features, the sharded data information is transmitted through multiple paths, and the scores of each path are calculated according to the network signal to form a shard-path mapping. Different paths correspond to uploading sharded data with different sharding parameters.

[0040] specific;

[0041] First, medical devices are divided according to usage scenarios, specifically into portable, household, and hospital use. Data information for different scenarios is assigned different weights; for example, portable is weighted 1, household is weighted 2, and hospital use is weighted 3. Priority is calculated for each piece of data based on information entropy and the weight of the data source scenario.

[0042] Furthermore, the priority of each data information is calculated by weighted summation: Y=c*ly+d*EN; where Y represents the priority of each data information, ly represents the weight of the data source scenario; EN represents the information entropy of each data; c and d are the weight coefficients of the data source scenario weight and information entropy, respectively.

[0043] Furthermore, information entropy quantifies privacy. To automatically discover privacy constraints, it's necessary to quantify private information. In other communication fields, information entropy has proven to be an effective tool for measuring information. Privacy, as a form of information, can naturally be measured using entropy.

[0044] First, assume that the relation to be sharded is R, which consists of attributes a1, a2, a3, ...an, and has m records r1, r2, ...rm. This way, the entropy of the entire relation table can be calculated: ; In the above formula, EN(A) represents the entropy value of the relational table, which represents the number of unique records in all records in the relation. It represents the probability of the corresponding non-repeated record, and the sum of all different record probabilities is 1.

[0045] For example, there are 6 records (r1 to r6) in the patient information table. Since there are no duplicate records, then s=6, and we have: , ; In the above formula, since there are no repeated records, the probabilities of all non-repeated records are the same.

[0046] It is easy to prove that when there are no duplicate records, the entropy of the entire relation R is .about Calculation of random variables is a record in the relational database R, then the record The probability is: ; In the above formula, the attribute is a random variable, and the symbol # represents the number of data elements in the set.

[0047] For example, in the patient information form, there is: , ;

[0048] Define the property like this The entropy of is: ; For example, in the patient information table, the calculation of the relevant attribute entropy is as follows: ; Multiple attributes together form the joint entropy, which is calculated in the same way as relations. By treating multiple attributes as a new relation, the joint entropy is equivalent to treating them as a single attribute. Only when all the values of the original attributes are equal will the corresponding records in the joint entropy be equal. This shows that the joint entropy is independent of the order of the attributes.

[0049] After determining the priority of each data message, the sharding parameters are dynamically adjusted according to the network signal and the priority of each data message. Dynamic adjustment of the sharding parameters achieves the optimal balance between transmission efficiency and security through intelligent perception of network status and data priority. Among them, the network signal includes the current bandwidth and delay rate.

[0050] Furthermore, the sharding parameters are calculated using the following formula; ;F represents the fragmentation parameter. The data fragmentation size is adjusted according to the value of the fragmentation parameter. The larger the value of the fragmentation parameter, the larger the data fragmentation size. Represents the benchmark size, which can be set according to regulations; Represents the priority of each data; Represents the current bandwidth; Equal to 100Mbps; is the current delay; a and b are dynamic coefficients, where a=0.7 and b=0.05.

[0051] Shard the data information according to the sharding parameters, and use the local differential privacy technology to apply a random response mechanism to the sharded data information, thus ensuring the privacy of user data information during the data sharing process. The specific steps include:

[0052] Step 1: Feature extraction. During the implementation of the solution, the convolution layer and pooling layer of CNN are used to extract the features of the data after sharding, and finally a one-dimensional vector of length t is obtained. .

[0053] Step 2: Vector encoding. The encoding process is mainly divided into two parts. First, the feature vectors extracted from the dataset are normalized using the Z-score normalization technique.

[0054] The process is as follows: ; ;in, represents the mean of vector α, is a real number The result after processing. Thus, we can get Next, all the real numbers in the normalized vector β are converted to binary.

[0055] The specific formula is as follows: ; i = k + m + 1; where n is the binary number of the integer part of the real value, and m is the binary number of the decimal part of the real value, represents any normalized real value in vector β, and f(i) represents the i-th number in the binary code string. After the above conversion formula, all real numbers in vector β are converted into binary code strings of n+m+1 bits.

[0056] Furthermore, due to the requirement for training accuracy, the number of digits in the integer part is usually set to be smaller and the number of digits in the decimal part is set to be larger during encoding.

[0057] Step 3: Add random response perturbations. After encoding, we can obtain t binary code strings of length n+m+1. Due to the limitation of the privacy budget ε, it is not possible to perform random responses to all binary codes converted from real values. Therefore, it is necessary to concatenate these t binary code strings to form a new binary code string g of length t*(m+n+1), where g*g(j) represents the jth number in the new binary code string. The random response mechanism is applied to the entire new string. This is shown in the following formula: .

[0058] Step 4: Decode the perturbation code. After the above processing, a binary code string of length t*(m+n+1) will be obtained for each data sample. Next, each binary code string needs to be decoded to obtain the final required perturbed data set features. First, the binary code string is split into lengths of n+m+1 to obtain the corresponding binary string of the perturbed real number vector. Then, the sign bit is decoded according to the rule that the negative sign is 1 and the positive sign is 0, and the remaining bits are decoded. Decoding is performed in the following way, and the implementation process is as follows: ; After decoding, the perturbed one-dimensional feature vector will be obtained .

[0059] The private fragmented data information is transmitted through multiple paths (such as multi-channel routing controlled by SDN) to avoid blocking or interception of a single path.

[0060] The score of each path is calculated based on the network signal to form a fragment-path mapping; paths with high path scores are used to upload fragment data with small fragment parameters; different paths correspond to uploading fragment data information with different fragment parameters.

[0061] Furthermore, the path scoring formula is as follows: ;in, represents the bandwidth of path k; represents the path score of path k; Represents the maximum bandwidth; represents the delay of path k; represents the packet loss rate of path k.

[0062] After determining the scores of each path, the shard parameter values are mapped to the path scores. The path with the highest path score is used to upload shard data with a smaller shard parameter; different paths are used to upload shard data with different shard parameters.

[0063] Furthermore, the path status is checked every 5 seconds, and path switching is triggered when the packet loss rate exceeds 5%. Only the lost fragments are retransmitted, not the entire data stream, to reduce bandwidth waste.

[0064] The data of the different privacy-protected shards is transmitted via different paths to the cloud or edge nodes. The cloud or edge nodes use secure multi-party computation (SMPC) to aggregate the shards and restore the data, ensuring controllable decryption permissions. The underlying blockchain platform used is Ethereum, where transactions between ordinary accounts do not allow parameters. Therefore, a smart contract is required to upload model parameters to the blockchain. Smart contracts are also used to implement functions such as aggregator and validation group selection. The data upload contract. The implemented model upload function mainly includes uploading initial model parameters, uploading local encrypted model parameters, and uploading global encrypted model parameters. Different model parameter uploads use different upload functions. For simplicity and because all upload functions are similar, the uploadModel function will be used to refer to all model upload functions. In the implemented aggregator selection contract, the task publisher randomly selects one of the participating edge servers (ES) as the aggregator for this round. Furthermore, n ESs are randomly selected as validation group members, where n is less than the number of edge servers minus 1.

[0065] Furthermore, aggregated operation logs are uploaded to the chain (Hyperledger Fabric) to support joint audits by multiple institutions.

[0066] The layered communication architecture of the present invention is as follows:

[0067] Perception layer: Medical equipment data collection and lightweight upload, core tasks include data collection, protocol adaptation, and preliminary security packaging;

[0068] Sharding layer: Dynamic sharding and encryption protection. Core tasks include data sharding, priority classification, and encryption policy execution.

[0069] Transport layer: Multi-path reliable transmission. The core task includes selecting different transmission strategies based on the fragmentation parameter value and path score.

[0070] Aggregation layer: security aggregation and permission control, core tasks include shard aggregation, data restoration, and access control.

[0071] Example 2

[0072] The present invention provides a fragmented encryption system for medical devices in the Internet of Things, such as Figure 2 As shown, it includes the following modules: dynamic sharding control module, privacy protection processing module, multi-path transmission scheduling module, and security aggregation and decryption module;

[0073] The dynamic sharding control module is used to dynamically adjust the sharding parameters according to the network signal and the priority of each data information; the dynamic sharding control module includes a data priority calculation module;

[0074] The data priority calculation module is used to calculate the priority of each data information based on the information entropy and the data source scene weight; the data priority calculation module internally includes a scene division and weight management module;

[0075] The scenario division and weight management module is used to divide the medical equipment usage scenarios and assign weights to the data information obtained in different scenarios;

[0076] The privacy protection processing module is used to use local differential privacy technology on the sharded data information and a random response mechanism on the sharded data information;

[0077] The multi-path transmission scheduling module is used to calculate the score of each path based on the network signal, forming a shard-path mapping; the private shard data information is transmitted to the cloud or edge node through different paths;

[0078] The secure aggregation and decryption module is used to receive encrypted fragmented data from multi-path transmission, restore the complete data stream through a secure multi-party computing protocol, and implement dynamic access control based on key management of smart contracts.

[0079] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0080] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0081] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0082] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0083] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A fragmented encryption system and method for Internet of Things medical devices, characterized in that: The following steps are involved: First, medical devices are divided according to usage scenarios, and data information in different scenarios is assigned different scenario weights. The priority of each data information is calculated based on information entropy and scenario weights. The sharding parameters are dynamically adjusted according to the network signal and the priority of each data information. By using local differential privacy technology and a random response mechanism in the extracted data information features, the sharded data information is transmitted through multiple paths, and the scores of each path are calculated according to the network signal to form a shard-path mapping. Different paths correspond to uploading sharded data with different sharding parameters.

2. The shard encryption system and method for Internet of Things medical devices according to claim 1, characterized in that: After determining the priority of each data message, the fragmentation parameters are dynamically adjusted according to the network signal and the priority of each data message; the network signal includes the current bandwidth and delay rate.

3. The shard encryption system and method for Internet of Things medical devices according to claim 2, characterized in that: Determine the sharding parameters, shard the data information according to the sharding parameters, and use a random response mechanism for the sharded data information by using local differential privacy technology.

4. The shard encryption system and method for Internet of Things medical devices according to claim 2, characterized in that: Calculate the score of each path based on the network signal to form a fragment-path mapping; paths with high path scores are used to upload fragment data with small fragment parameters; different paths are used to upload fragment data information with different fragment parameters; The path scoring formula is as follows: ;in, represents the bandwidth of path k; represents the path score of path k; Represents the maximum bandwidth; represents the delay of path k; represents the packet loss rate of path k.

5. The shard encryption system and method for Internet of Things medical devices according to claim 4 is characterized in that: The path status is checked every 5 seconds, and path switching is triggered if the packet loss rate exceeds 5%. Only the lost fragments are retransmitted, not the entire data stream.

6. The fragmented encryption system and method for Internet of Things medical devices according to claim 1 is characterized in that: After using local differential privacy technology, the sharded data information is transmitted to the cloud or edge nodes through different paths. The cloud or edge nodes use secure multi-party computing to aggregate the shards and restore the data.

7. The shard encryption system and method for Internet of Things medical devices according to claim 6, characterized in that: Use smart contracts to complete functions such as aggregator and verification group selection.

8. A fragmented encryption system for medical devices in the Internet of Things, characterized in that: It includes the following modules: dynamic sharding control module, privacy protection processing module, multi-path transmission scheduling module, and security aggregation and decryption module; The dynamic sharding control module is used to dynamically adjust sharding parameters according to network signals and the priority of each data information; The dynamic sharding control module includes a data priority calculation module; The data priority calculation module is used to calculate the priority of each data information based on the information entropy and the data source scene weight; the data priority calculation module internally includes a scene division and weight management module; The scenario division and weight management module is used to divide the medical equipment usage scenarios and assign weights to the data information obtained in different scenarios; The privacy protection processing module is used to use local differential privacy technology on the sharded data information and a random response mechanism on the sharded data information; The multi-path transmission scheduling module is used to calculate the score of each path based on the network signal, forming a shard-path mapping; the private shard data information is transmitted to the cloud or edge node through different paths; The secure aggregation and decryption module is used to receive encrypted fragmented data from multi-path transmission, restore the complete data stream through a secure multi-party computing protocol, and implement dynamic access control based on key management of smart contracts.

9. The IoT medical device shard encryption system according to claim 8, characterized in that: The dynamic sharding control module internally includes a data priority calculation module; the data priority calculation module is used to calculate the priority of each data information based on information entropy and data source scenario weight.

10. The Internet of Things medical device shard encryption system according to claim 9, characterized in that: The data priority calculation module includes a scenario division and weight management module; the scenario division and weight management module is used to divide the medical equipment usage scenarios and assign weights to the data information obtained in each different scenario.

Images