Safety guarantee method and system in medical data interaction process

Abstract

The invention relates to the technical field of medical information security, in particular to a security guarantee method and system in a medical data interaction process, and the method comprises the steps: firstly carrying out the read-only solidification and disk encryption of data, and building a fingerprint hash tree; zero-knowledge proof and dynamic privacy budget are generated according to strategies such as purposes and calling times, and semantic vectors are obtained through encoding and signed into a revocation chain; the algorithm is divided into linear, nonlinear and pulse sub-graphs in a credible environment, three-domain ciphertext calculation is carried out, Laplace noise is injected into pulse output according to budget and then fusion is carried out, and a re-linearization key is derived; a hypergraph commitment is generated based on a fused ciphertext, a semantic vector and a key drive delay function are utilized to take a random value and a proof, a composite commitment is obtained through a threshold signature and a random bit sequence, cross-chain evidence storage with root hash is carried out, and differential privacy and long-term auditing are realized.

Description

Technical Field

[0001] This invention relates to the field of medical information security technology, and in particular to a security protection method and system for medical data interaction. Background Technology

[0002] In the digital decision-making management system of the pharmaceutical industry, clinical trial design, drug efficacy evaluation, and real-world studies rely on massive amounts of cross-institutional medical data to collaboratively drive algorithmic automated decision-making. If the data source lacks end-to-end security guarantees, the decision-making chain will be riddled with untraceable risks: on the one hand, it will weaken the credibility of the data, leading to distorted model evaluation conclusions; on the other hand, violations of China's Personal Information Protection Law may trigger hefty penalties. Therefore, building a security framework integrating encrypted computing, differential privacy, and blockchain evidence storage becomes a prerequisite for the stable operation of the digital decision-making management system. Summary of the Invention

[0003] To address the numerous problems existing in the prior art, this invention provides a security method and system for medical data interaction. This invention divides a deep network into three subgraphs: linear, nonlinear, and impulsive, which are then operated on in the fully homomorphic encryption domain, secure circuit domain, and neuromorphic computation domain, respectively. Reinforcement learning dynamically allocates a privacy budget, injecting noise only into the impulsive output. A chaotic key is derived from the semantic signal vector and used to drive a delayed random function to generate an index. Through threshold signatures and double-chain anchoring, key independence, data immutability, and full-process verifiability are achieved.

[0004] A method for ensuring security during medical data exchange, characterized by comprising:

[0005] The original medical data is written to a read-only medium and the disk surface is encrypted. A hash tree is built based on the generated content fingerprint to obtain the root hash.

[0006] Zero-knowledge proofs and privacy budgets are generated based on authorization policies that include purpose, number of calls, deadline, and privacy budget cap. The authorization policy hash and the privacy budget are encoded and transformed to form a semantic signal vector. An authorization token is generated using the semantic signal vector and the patient key and written into the revocation chain.

[0007] Subsequently, within a trusted execution environment, the algorithm to be executed is divided into linear subgraphs, nonlinear subgraphs, and spiking neural subgraphs, which are computed in the fully homomorphic encryption domain, secure circuit domain, and neuromorphic computing domain, respectively. The output of the spiking neural subgraph, which is injected with noise according to the privacy budget, is fused with the output of other subgraphs to form a fused ciphertext result, and a relined key is generated based on the semantic signal vector.

[0008] A hypergraph commitment is constructed based on the fused ciphertext result. A seed is generated using a semantic signal vector and a re-lined key, and a verifiable delay function is run to obtain a random value and a proof. A threshold signature is performed on the message body containing the hypergraph commitment, random value, proof, and root hash, and a random bit sequence is concatenated to form a composite commitment. The object content containing the hypergraph commitment, composite commitment, and root hash is written to the blockchain for addressing.

[0009] Preferably, the content fingerprint is written into a key-value ordered hash tree according to the file arrival order, and the root hash is used to perform integrity verification on all encrypted files in the read-only medium.

[0010] Preferably, zero-knowledge proof establishes hash commitments on a set of polynomial constraints, constructs a proof circuit using fast Fourier transform, and completes proof generation and verification within the same trusted execution environment.

[0011] Preferably, the privacy budget is dynamically allocated by the reinforcement learning scheduler based on the remaining number of calls and the remaining privacy budget. The reward function of the reinforcement learning scheduler considers both the authorization policy satisfaction rate and the data utilization rate.

[0012] Preferably, the encoding and transformation includes performing an orthogonal transformation on the authorization policy hash and privacy budget after positional encoding to generate a semantic signal vector.

[0013] Preferably, the linear subgraph performs matrix multiplication and convolution operations in the fully homomorphic encryption domain, the nonlinear subgraph performs activation and normalization operations in the secure circuit domain, and the spiking neural subgraph performs spiking accumulation and membrane potential update operations in the neuromorphic computing domain.

[0014] Preferably, after injecting Laplacian noise into the output of the spiking neural subgraph according to the privacy budget, the output of the spiking neural subgraph is fused with the output of the linear subgraph and the output of the nonlinear subgraph in the ciphertext domain to form a fused ciphertext result.

[0015] Preferably, the re-lined key is generated by iterating a fixed-length binary sequence through a seed-driven logic mapping function selected from the semantic signal vector a preset number of times.

[0016] Preferably, the order of superedge selection in the hypergraph commitment is determined by a random value generated by a verifiable delay function from a seed consisting of a semantic signal vector and a re-lined key. The random value and its proof are concatenated with the hypergraph commitment and a random bit sequence after threshold signing to form a composite commitment. An object containing the hypergraph commitment, the composite commitment, and the root hash is written into the regional consortium chain and the national regulatory chain to complete cross-chain notarization.

[0017] A security system for medical data interaction, used to implement the aforementioned security method for medical data interaction, includes:

[0018] The solidified hash module is used to write raw medical data into a read-only medium and encrypt the disk surface, generate a content fingerprint for the encrypted file, and construct a hash tree based on the content fingerprint to obtain the root hash;

[0019] The authorization vector module is used to generate zero-knowledge proofs and privacy budgets based on authorization policies that include purpose, number of calls, deadline, and privacy budget limit. It encodes and transforms the authorization policy hash and the privacy budget to form a semantic signal vector. It uses the semantic signal vector and the patient key to generate an authorization token and write it into the revocation chain.

[0020] The collaborative computing module is used to divide the algorithm to be executed into linear subgraphs, nonlinear subgraphs and spiking neural subgraphs in a trusted execution environment. It performs calculations on each subgraph in the fully homomorphic encryption domain, secure circuit domain and neuromorphic computing domain respectively. After injecting noise into the output of the spiking neural subgraph according to the privacy budget, it fuses the outputs of each subgraph to obtain the fused ciphertext result, and generates a relined key based on the semantic signal vector.

[0021] The hypergraph proof module is used to construct a hypergraph commitment based on the fused ciphertext result, generate a seed using the semantic signal vector and the re-lined key, and run a verifiable delay function to obtain a random value and a proof. It performs a threshold signature on the message body containing the hypergraph commitment, the random value, the proof, and the root hash, and concatenates a random bit sequence to form a composite commitment. It addresses the object content containing the hypergraph commitment, the composite commitment, and the root hash and writes it into the blockchain.

[0022] Compared with the prior art, the advantages and beneficial effects of the present invention are as follows:

[0023] Through three-domain collaborative homomorphic computation technology, high-precision inference in encrypted state is achieved; through reinforcement learning budget scheduling technology, differential privacy budget is dynamically allocated according to remaining calls; through semantic signal vector driven chaotic key derivation technology, one-time authorization and one-key effect is achieved; through delayed random and threshold signature dual-chain anchoring technology, the effect of unpredictable results and long-term auditable evidence preservation is achieved. Attached Figure Description

[0024] Figure 1 This is a schematic flowchart of the method of the present invention;

[0025] Figure 2 This is a schematic diagram of the three-domain calculation partitioning in this invention;

[0026] Figure 3 This is a structural block diagram of the system of the present invention. Detailed Implementation

[0027] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation.

[0028] like Figure 1 As shown, a security method for medical data interaction is characterized by comprising:

[0029] The original medical data is written to a read-only medium and the disk surface is encrypted. A hash tree is built based on the generated content fingerprint to obtain the root hash.

[0030] This invention introduces the technical step of "writing to a read-only medium and encrypting the disk surface, and building a hash tree based on the generated content fingerprint to obtain the root hash" in the medical data interaction scenario. It aims to meet the requirements of "minimum availability, full traceability, and hierarchical classification storage" for sensitive medical and health information put forward by China's Personal Information Protection Law, Data Security Law, and Cybersecurity Law, while taking into account the common rules that different partners may follow, such as the EU's General Data Protection Regulation and the US Health Insurance Portability and Accountability Act.

[0031] At the principle level, the static security of medical data is guaranteed by a dual mechanism of "physical read-only" and "controller encryption"; data integrity is locked once through content fingerprinting and hash tree. After the read-only medium locks the write channel, any write command is rejected at the interface layer, ensuring "unalterable after writing". Disk encryption performs stream cipher encryption on each sector at the controller end, expressed by the formula:

[0032] C i =Enc K (P i )

[0033] Where P i C represents the plaintext sector data of the i-th sector. i This represents the corresponding ciphertext sector data, and K is the controller key. The controller key is generated by a true random source within the hardware security module and encapsulated in a secure register. Even if the medium is illegally disassembled, the plaintext cannot be directly obtained.

[0034] The next step is to generate content fingerprints. For each file, the system performs hash operations on the file header metadata and the file body separately, concatenates them, and then hashes them again to obtain a unique content fingerprint:

[0035] CID = H(H) head ||H body )

[0036] H head For header information hash, H bodyHere, H is the hash of the file body, and H is a 256-bit secure hash function. After fingerprint generation, all fingerprints are inserted into a key-value ordered hash tree in the order they were written. The final root node hash is the root hash M0 = H(CID1||CID2||…||CID). n The root hash serves as the sole entry point for subsequent blockchain notarization and cross-institutional integrity verification. As long as the root hash remains consistent, any file in the tree can be quickly verified through path recalculation, significantly reducing the time required compared to full rehashing.

[0037] In terms of implementation, the pharmaceutical company deploys read-only solid-state arrays in a controlled data center. The write process is driven by an internal gateway: the gateway first scans the file for viruses, then performs a write operation; the array controller immediately triggers a write protection command after the write operation is complete. The controller firmware defaults to full-disk encryption mode, using partition-level stream ciphers to avoid significant impact on transaction latency. The fingerprint module reads sector content into memory through direct mapping, first hashes the header structure, then uses a segmented hashing method to process and merge the large file body; fingerprint computational resources consume less than 5% of the total transmission time. The root hash is stored in the trusted execution environment's memory and written to the private blockchain, ensuring it is not read by a third party before being uploaded to the blockchain.

[0038] The physical read-only configuration meets the requirement of the Data Security Law to "ensure that important data is stored domestically and protected from tampering." Disk encryption prevents information leakage due to media relocation and complies with the Personal Information Protection Law's requirements for the encrypted storage of sensitive personal information. Content fingerprints and hash trees provide a single identifier that can be used for subsequent zero-knowledge authorization and cross-chain evidence storage steps, forming a "write-lock, lock-traceable" chain. Compared to the traditional approach of encrypting first, then copying, and then paging and hashing, this invention integrates encryption, fingerprinting, and tree generation into the same write transaction, reducing one I / O round trip and shortening write latency by approximately one-third.

[0039] Example: A pharmaceutical company collaborated with two top-tier hospitals on a tumor imaging-assisted diagnostic research project. Daily image files collected by the hospitals were written to an array via a gateway, which recorded the batch number and file list. After each batch was written, the volume was automatically locked, and the array used a hardware key for encryption. The gateway triggered a fingerprint generation service to calculate a fingerprint set from the image sequence, diagnostic information table, and metadata files, generating a root hash which was written to the consortium blockchain along with the batch number. One week later, the company's research team randomly selected two image files to verify their integrity. Verification was completed simply by reading the file hashes and recursively tracing the tree path, comparing the root hash to the data. The entire process took less than 3 seconds, far less than the 40 seconds required to recalculate all file hashes. When the compliance department audited the data, they verified that the files had not been modified using the on-chain root hash and confirmed that the encrypted volume sequence number matched the hospital's records, completing a two-way verification.

[0040] Preferably, the content fingerprint is written into a key-value ordered hash tree according to the file arrival order, and the root hash is used to perform integrity verification on all encrypted files in the read-only medium.

[0041] Writing content fingerprints into a key-ordered hash tree according to the order in which files arrive, and using the root hash to perform integrity verification on all encrypted files in read-only media, is a key measure for pharmaceutical companies to ensure immutability and rapid verification in multi-institutional medical data exchange.

[0042] At the principle level, this invention employs a content-addressing approach to generate a unique fingerprint for each encrypted file. The fingerprint algorithm hashes the file header metadata and the file body, then performs a secondary hash, expressed by the formula:

[0043] CID = H(H) head ||H body )

[0044] Among them, H head H represents the file header hash. body The hash represents the main body of the file, and CID is the content fingerprint. The hash function H uses a 256-bit secure hash algorithm, which is one-way and collision-resistant. Since medical image files are often hundreds of megabytes in size, directly hashing the gesamte file would cause I / O overhead. Therefore, this invention first divides the file into fixed-size blocks and performs segmented hashing, then uses a rolling accumulation method to obtain the main body hash H. body This reduces cache pressure while also meeting the requirements for hash continuity.

[0045] After fingerprints are generated, they need to be stored in an ordered manner for subsequent retrieval and batch verification. This invention uses a key-value ordered hash tree. Unlike common hierarchical Merkle trees, key-value ordered hash trees introduce sorting rules at the leaf node level, so that the root hash not only represents the integrity of the set but also contains file order information. The insertion process follows a "first-come, first-served" strategy, that is, the first batch of arriving file fingerprints occupies the left interval of the tree, and subsequent fingerprints are inserted in ascending order of time, ensuring that any insertion does not affect the index of previous nodes. The parent node hash is formed by concatenating the left and right child nodes and then hashing them, ultimately forming the root hash M0 = H(CID1||CID2||…||CID). n ), symbols CID1 to CID n This represents the content fingerprint sequence arranged in the order of arrival, with M0 representing the root hash.

[0046] In actual operation at a pharmaceutical company, the fingerprint service is triggered after each batch of images is written by the data acquisition end. The fingerprint service first segments and hashes the file blocks, then calculates the content fingerprint and writes it to a hash tree. Tree insertion uses a parallel batch processing approach, leveraging a multi-core hash pipeline to reduce waiting time. After writing is complete, the root hash M0 is written to the private chain and returned to the application layer as the batch identifier. At this point, any node that obtains M0 can quickly verify whether a file belongs to the batch and has not been modified by downloading one or more files and their path hash values ​​in the tree. The verification process only requires recalculating the hashes of the nodes involved in the path, without having to retrace the entire tree, significantly reducing the computational load.

[0047] This invention brings three security and performance benefits to pharmaceutical companies. First, the root hash of a hash tree is naturally suitable for on-chain evidence storage. A 32-byte string can represent the overall state of thousands of files, reducing on-chain data usage. Second, the ordered nature of key-value pairs allows for the reconstruction of file arrival order in case of disputes, providing timeline evidence for audits. Third, the complexity of single-file verification is reduced from linear to logarithmic, enabling batch sampling to be performed routinely without slowing down subsequent model training or analysis.

[0048] Example: A pharmaceutical company collaborates with four hospitals across provinces on a study to predict drug efficacy using tumor imaging. Every day at 2:00 AM, each hospital sends batches of images collected the previous day. The company's central node automatically writes these images to a read-only medium, generates fingerprints, and inserts them into a key-value ordered hash tree. Assume that 120 image file fingerprints are written that day, resulting in the root hash M0. In the afternoon, the compliance department randomly selects 80 files for integrity verification. The system reads each file's fingerprint and its sibling node hashes in the tree, requiring only 80 paths to be recalculated, completing the verification in approximately 20 seconds. Traditional file-by-file hash recalculation would take several minutes. Later that night, during routine inspections, regulatory agencies only need to perform an on-chain comparison of M0 to confirm that the company's submitted image dataset matches the original submissions from the hospitals, without needing to move a massive amount of images.

[0049] To address potential fingerprint collisions or tree node conflicts, this invention provides a rebalancing strategy. When the size of a new batch of fingerprints exceeds a preset limit, the system automatically starts a new root node, while the old root hash is persistently stored and written to the chain, ensuring that the tree depth does not grow indefinitely over time. Simultaneously, to prevent inconsistencies between the on-chain root hash and the local tree due to hardware or software malfunctions, the system includes a periodic self-check task. Every 24 hours, 1 / 500 of the nodes are randomly selected for path hash recalculation and comparison with the root hash. If an inconsistency is detected, an alarm is immediately triggered, and subsequent cross-chain uploads are blocked.

[0050] Zero-knowledge proofs and privacy budgets are generated based on authorization policies that include purpose, number of calls, deadline, and privacy budget cap. The authorization policy hash and the privacy budget are encoded and transformed to form a semantic signal vector. An authorization token is generated using the semantic signal vector and the patient key and written into the revocation chain.

[0051] The core of the authorization process design lies in allowing collaborative algorithms to accept one-time, verifiable, and revocable access permissions without exposing patient privacy. Pharmaceutical companies require a unified policy format in multi-center studies; therefore, this invention encodes four fields—purpose, number of accesses, deadline, and privacy budget limit—as a fixed-length policy sequence. The purpose field uses a code table, the number of accesses uses an unsigned integer, the deadline uses an ISO timestamp, and the privacy budget limit uses a 16-bit fixed-point number. The policy sequence is then hashed to generate a digest H. s The data is then written to the local authorization cache. This digest serves as the index key for all subsequent calculations and notarization.

[0052] Zero-knowledge proofs are used to prove that a call satisfies all authorized fields without revealing the specific content of those fields. The proof generation process takes a policy sequence as input, constructs a set of polynomial constraints, generates commitment values ​​using a transparent hash commitment algorithm, and then outputs verifiable proofs through random subspace sampling. The proof structure inherently possesses a public verification interface, and external computing nodes only need to perform a single batch verification to determine the legality of the policy, meeting the requirement of minimal disclosure under China's Personal Information Protection Law.

[0053] The privacy budget scheduler outputs a real-time budget based on the remaining number of calls and the remaining budget. t This value is represented by a 16-bit fixed-point number and is adjusted in real time upon invocation. To ensure consistent use of the policy digest and budget in subsequent steps, this invention uses positional encoding to bind them and generate a high-dimensional sparse vector. Specifically, the digest H... s Treat it as a binary vector, budget ∈ t After quantization and mapping to a space of the same dimension, the two pieces of information are mixed according to a preset positional rule to obtain vector v0. The Hadamard orthogonal transformation matrix T and the column orthogonal projection matrix P act together on v0 to form a semantic signal vector:

[0054] v = P·T·v0

[0055] In the formula, v has a dimension of 512, P is used for dimensionality reduction while maintaining orthogonality, and T is used to break down correlations. H s For strategy summary, ∈ t For the real-time privacy budget, v0 is the hybrid vector and v is the semantic signal vector.

[0056] The generation of the authorization token is completed within the hardware security module. The patient key is divided into mobile terminal fragments and server fragments; the server fragment is transmitted to the security module via a trusted channel. The module reconstructs the complete private key for the message m=H. s ||∈ t Perform digital signature and output signature value σ m The token serves as the token body. The token structure consists of a digest, budget, timestamp, and signature, with the token hash appended to the end of the revocation chain. The revocation chain grows unidirectionally over time, and any node can determine whether a token has been revoked by checking the chain's height and the hash.

[0057] The semantic signal vector plays a dual role in the subsequent process of the system. On the one hand, the specified dimension v

[128] is used as the seed for the chaotic mapping to derive the relined key, ensuring that different authorizations use different keys for different computation batches. On the other hand, the first 64 bits of the vector are concatenated with the relined key to form a random seed, which provides input for the verifiable delay function, so that the random sampling order corresponds one-to-one with the authorization and prevents replay.

[0058] Example: A pharmaceutical company and an imaging center train a lung nodule prediction model. The patient authorization policy is set with 3 calls allowed, a 30-day deadline, and a privacy budget cap of 1.0. The system calculates a summary H. s Then, the scheduler provides a real-time budget of 0.3 and generates a semantic signal vector v. The security module signs the message to obtain the token σ. m The token hash is written to revocation chain height 3502. During model invocation, height 3502 is read to verify the token's validity and that the budget has not been exceeded before inference is executed. If the image center requests an early cessation of the study, only a revocation record needs to be written, and all tokens at height 3502 and beyond become immediately invalid. This mechanism ensures traceability, revocation, and key uniqueness of authorization, while also meeting the data minimization principle and the EU General Data Protection Regulation's requirement for consent to be revoked at any time.

[0059] Preferably, zero-knowledge proof establishes hash commitments on a set of polynomial constraints, constructs a proof circuit using fast Fourier transform, and completes proof generation and verification within the same trusted execution environment.

[0060] The task of zero-knowledge proof in this invention is to assure computing nodes that a single algorithm call satisfies all constraints of the four authorized fields without revealing the specific values ​​of the fields. To this end, the pharmaceutical company maps the authorization policy sequence to a set of multinomial constraints and then constructs a publicly verifiable proof circuit using hash commitments and Fast Fourier Transform. This process is specifically placed within the same trusted execution environment for generation and verification, preventing intermediate data from leaving the protection boundary and reducing network round-trip costs.

[0061] First, the four fields—purpose, number of calls, deadline, and privacy budget cap—are converted into binary sequences using predefined encoding rules. This sequence is treated as a coefficient vector of length n, denoted as 'a'. The system then constructs a univariate polynomial:

[0062]

[0063] The letter 'x' represents a single variable, and 'a' represents a single variable. i This represents the i-th coefficient. To avoid revealing a... i Given a polynomial, the system establishes a hash commitment for the coefficient vector. The hash commitment uses path hashing: coefficients are mapped in batches to leaf nodes of a hierarchical hash table. The hash of a parent node is the concatenation of the hashes of its two child nodes, and then hashed again, until the top-level commitment value C is obtained. p Symbol C p It represents a polynomial commitment and has both binding and hiding properties.

[0064] To prove that the called parameters satisfy the constraints, it is necessary to verify the value relationship of the polynomial on a specific set of points. The system selects a geometric sequence {x} of length m over a field. j The sequence, used as the evaluation point, is automatically generated by the root selection rule of the Fast Fourier Transform (FFT). The FFT allows for batch evaluation of the polynomials in O(mlogm) time, yielding the value vector y. The proof circuit then constructs a verification equation:

[0065] y j =p(x j )

[0066] For j = 0, 1, ..., m-1, where y j Let represent the computation result at the j-th evaluation point. Since the coefficients of p(x) are hidden under the commitment, the verifier only needs to check whether the commitment value is consistent with the given y to determine that the polynomial does indeed correspond to the policy sequence and takes the correct value. This verification is accomplished through a proof-of-flight, which uses the inner product of the challenge vector r in the random subspace and the value vector y to generate a verification scalar, ensuring integrity while significantly reducing the proof size.

[0067] The entire generation and verification process runs within the same Trusted Execution Environment (TEE). The TEE provides hardware isolation and controlled memory; the internal reference key is derived from the startup metric, and external access to internal registers via bus probes is blocked. Once the proof is generated, the system immediately invokes the TEE's internal verifier to verify its correctness. The commitment value C is only released after successful verification. p The value vector y and the flight proof are given to the external link. Before executing the algorithm, the external computing node only needs to verify once to ensure that the calling parameters meet the policy constraints, avoiding repeated parsing of the plaintext policy.

[0068] This design offers three major advantages in terms of effectiveness. First, the policy is written in plaintext and never leaves the domain, complying with Chapter 4 of China's Personal Information Protection Law, which stipulates that "personal information shall not be processed beyond the authorized scope." Second, batch Fast Fourier Transform reduces generation latency. Generating a proof for a polynomial with n=128 coefficients takes less than 60 milliseconds on a 64-core CPU. Third, self-verification within the same trusted execution environment avoids leakage of intermediate results during network transmission, reducing the latency of one remote call.

[0069] Example: In a lung nodule imaging study, the authorization strategy limits the number of calls per patient to 3 and the budget cap to 1.0. A vector 'a' of length 128 is obtained after encoding. The system is set to m = 256 evaluation points, evaluated using Fast Fourier Transform, and a flight proof is generated. The commitment value C... p The proof is recorded in the consortium blockchain transaction at height 4208. When the inference server of the cooperating hospital receives the call request, it downloads transaction 4208, performs verification, and releases the model. The verification takes only 8 milliseconds, reducing one network round trip compared to the traditional plaintext download and verification strategy. If the hospital legally revokes the authorization, the pharmaceutical company appends a record to the revocation chain. The on-chain business steps immediately detect the corresponding token state change, and the inference server rejects the token in the next verification, achieving revocation within seconds.

[0070] Preferably, the privacy budget is dynamically allocated by the reinforcement learning scheduler based on the remaining number of calls and the remaining privacy budget. The reward function of the reinforcement learning scheduler considers both the authorization policy satisfaction rate and the data utilization rate.

[0071] The core function of the privacy budget scheduler is to allocate the differential privacy budget on demand across multiple algorithm calls, ensuring that a single call neither wastes budget nor suffers from excessive noise due to insufficient budget, thus affecting model accuracy. This invention employs a reinforcement learning framework to achieve dynamic allocation, where the three elements of state, action, and reward are specifically designed for medical data interaction scenarios.

[0072] The state vector is composed of a combination of remaining call counts, remaining privacy budget, and policy hash fragments. The remaining call counts represent the authorization window, the remaining privacy budget reflects the available privacy cost, and the policy hash fragment provides the call context entropy source. The three are concatenated and mapped to a continuous space through a linear transformation for the agent's input.

[0073] The action set is defined as three discrete actions: approval, reduction of accuracy, and rejection. Approval means executing according to the current model accuracy, reduction of accuracy means increasing the noise figure in the output stage to reduce budget consumption, and rejection means immediately terminating the call to preserve the budget for more important tasks.

[0074] The reward function combines the granting policy satisfaction rate and data utilization rate, and takes the following form:

[0075] R=λ1U-λ2B

[0076] Where R represents the immediate reward, U represents the policy satisfaction rate, B represents the privacy budget consumed in this call, and λ1 and λ2 are trade-off coefficients. The policy satisfaction rate is obtained by binarizing the zero-knowledge proof verification result, and the budget consumption is converted from the product of the call noise amplitude and the number of samples.

[0077] The agent employs a two-layer fully connected deep network, with hidden layers containing 256 and 128 neurons respectively, and the activation function is a modified linear unit. During training, experience replay and target network synchronization mechanisms ensure stable convergence; during inference, a greedy strategy balances exploration and exploitation. The scheduler is deployed in a trusted execution environment, keeping inference latency within 10 milliseconds to avoid impacting real-time calls.

[0078] The scheduler's decision is written back to the authorization token structure via the interface. The privacy budget field is recorded as a 16-bit fixed-point number. The call chain can read the token in subsequent steps to know the noise requirement for that call. If the remaining budget decreases below the threshold with each call, the scheduler will continuously output rejection to ensure that the total budget is never overdrawn, which complies with the quantitative requirements of China's Personal Information Protection Law for differential privacy protection of sensitive data.

[0079] Example: The patient authorizes 3 calls, with a total budget cap of 1.0. On the first call, with a remaining budget of 1.0, the agent approves and outputs a budget of 0.3. On the second call, with a remaining budget of 0.7, the agent detects an increase in sample size and chooses to output a budget of 0.2 with reduced precision. Before the third call, with a remaining budget of 0.5, the authorization window is about to expire and the sample size is small, so the agent again approves and outputs a budget of 0.3. After the calls are completed, the budget is reset to zero, and the revocation chain records 3 budget allocation details in the token field, which can be audited by regulatory authorities.

[0080] Preferably, the encoding and transformation includes performing an orthogonal transformation on the authorization policy hash and privacy budget after positional encoding to generate a semantic signal vector.

[0081] The "encoding and transformation" stage, which synthesizes the semantic signal vector from the authorization policy hash and the privacy budget, is responsible for binding the authorization constraints and real-time budget into a single high-entropy data primitive without exposing the details of the original policy. This data primitive is subsequently used for chaotic key derivation and delayed random function seed generation, and therefore needs to possess the three properties of collision resistance, low correlation, and compressibility simultaneously.

[0082] Authorization Policy Hash s It is a 256-bit binary vector obtained by performing a second-order hash on the four fields: purpose, number of calls, deadline, and privacy budget limit. Real-time privacy budget ∈ tThe values ​​range from 0 to 1, and after 16-bit fixed-point quantization, they are represented as a 16-bit binary vector. Intuitively concatenating the two segments would result in a clear partitioning of the hash segment and the budget segment in terms of bit distribution, making them easily identifiable by side-channel analysis. This invention employs positional encoding to cross-mix the two vector segments. The mixing process is centered on a reproducible permutation rule π: rule π provides a unique permutation of 272 bits, such that H... s and ∈ t The occurrences in the result vector v0 are alternating or pseudo-random intervals. Simplified representation: if b i If the i-th bit is concatenated, then the positional encoding output satisfies:

[0083] (v0) j =b π(j)

[0084] Symbol (v0) j Let π(j) represent the j-th bit of vector v0, and let π(j) represent the original index. The effect of positional encoding is to break down the source information, making subsequent transformations face a uniformly distributed input, thereby avoiding significant statistical patterns.

[0085] To further increase the entropy and compress the dimensionality, this invention applies an orthogonal transformation consisting of Hadamard rotation and column orthogonal projection to v0. First, a Hadamard matrix T of order 10,000 is applied to v0. Since the elements of matrix T are only ±1, the transformation can be implemented using addition and subtraction, with a computational complexity of O(NlogN). The Hadamard transformation preserves the bit-flip symmetry property, effectively dispersing the original local correlation structure into the global frequency domain. After the transformation, the vector w = Tv0 is obtained. Subsequently, the column orthogonal projection matrix P is applied to reduce the dimensionality from 10,000 to 512. The final semantic signal vector calculation formula is:

[0086] v = P·T·v0

[0087] v is the semantic signal vector with dimension 512; P is a column orthogonal matrix with 512 rows and 10,000 columns; T is a 10,000-order Hadamard matrix; v0 is the hybrid vector after position encoding.

[0088] The pharmaceutical company deploys this module within a trusted execution environment. During module initialization, a fixed permutation rule π is generated and the Hadamard matrix and projection matrix are preloaded. Position encoding uses a lookup table to map the concatenated vector bits to the resulting vector indices. The Hadamard transform is implemented through piecewise butterfly operations, fully utilizing vectorized instructions; the 512-dimensional projection is completed in one step using a parallel multiply-accumulate unit. The entire process takes less than 5 milliseconds on a 16-core CPU.

[0089] This invention ensures that the semantic signal vector remains consistent within the same authorization batch, and is statistically approximately orthogonal across different batches. The 128th bit of the vector is used as a seed for a chaotic mapping, with the seed distributed approximately uniformly between 0 and 1, improving key unpredictability. The first 64 bits are used as input to the delay function; once authorization is revoked, the vector disappears, random sequence reconstruction fails, and replay attacks are fundamentally blocked. This results in higher information density than a 272-bit concatenated vector, reducing on-chain evidence storage payload by approximately 65%.

[0090] Example: The image center is authorized to make 5 calls, with a total budget of 1.2. A summary H is generated after strategy encoding. s On the first call, the scheduler allocates a budget of 0.25, corresponding to a 16-bit quantized value of 16384 (binary 01000000000000000). The system performs position encoding to generate v0, and then calculates the semantic signal vector v. The 128th bit of the vector is 1, initializing the logical mapping. After 100,000 iterations, the fractional part is taken to generate a 256-bit rewired key. The first 64 bits are concatenated with the key and fed into a delay function to obtain a random value and proof. If the budget is exhausted after the fifth call, the semantic signal vector becomes invalid, the delay function output changes, and any random value constructed based on the old license cannot pass on-chain verification.

[0091] like Figure 2 As shown, the algorithm to be executed is then divided into linear subgraphs, nonlinear subgraphs and spiking neural subgraphs in a trusted execution environment. These are computed in the fully homomorphic encryption domain, secure circuit domain and neuromorphic computing domain, respectively. The output of the spiking neural subgraph with noise injected according to the privacy budget is fused with the output of other subgraphs to form a fused ciphertext result. A relined key is then generated based on the semantic signal vector.

[0092] In the collaborative computing phase of this invention, the pharmaceutical company first parses the computation graph of the algorithm to be executed within a trusted execution environment. The parsing process is based on node operator type, dividing all linearizable operations such as matrix multiplication, convolution, and fully connected operations into linear subgraphs; nonlinear operations such as activation, normalization, and max pooling into nonlinear subgraphs; and operations conforming to spiking neural dynamics, such as impulse integrals, threshold triggering, and synaptic weight updates, into spiking neural subgraphs. These three types of subgraphs are connected via encrypted tensor interfaces, which follow a homomorphic encrypted tensor format to ensure that data transmitted between different computational domains remains encrypted.

[0093] The linear subgraph is fed into a fully homomorphic encryption domain for processing. This domain deploys a homomorphic operation engine optimized with multiplication and rotation, processing the input ciphertext vector c. in Perform weighted summation and convolution sequentially, and output the ciphertext c. lin The nonlinear subgraph is fed into a secure circuit domain for processing. This domain utilizes a two-way secure computation protocol to convert the nonlinear gates into Boolean circuits and evaluate them within hardware isolation, outputting ciphertext c. nonThe pulsed neural subgraph operates in the neuromorphic computing domain, where the chip updates the membrane potential and generates spike outputs c in an event-driven manner based on the pulse sequence. snn According to real-time privacy budget ∈ t For c snn Inject differential privacy noise, with the noise sampling distribution following a Laplace distribution.

[0094] The three ciphertext outputs are fused using a homomorphic programmable adder to obtain the fused ciphertext result:

[0095] c out =f merge (c lin ,c non ,c snn )

[0096] symbol c lin c non c snn c represents the encrypted output of the linear subgraph, nonlinear subgraph, and spiking neural subgraph, respectively. out This indicates the result of merging the encrypted text.

[0097] To avoid potential side-channel analysis caused by multiple authorizations sharing the same re-linear key, this invention derives a new re-linear key based on the semantic signal vector v. The vector dimension is 512, and the bit distribution is approximately uniform. The 128th bit v is taken... 128 As initial values ​​for chaotic mapping:

[0098] x0 = 0.5 + 0.1v 128

[0099] Using logical mapping:

[0100] x k+1 =4x k (1-x k )

[0101] After iterating 100,000 times, the fractional part of the result is taken and quantized into a 256-bit binary sequence, denoted as:

[0102] K rel =b in256 (x 100000 )

[0103] The K rel The relined key will replace the old key during the relined stage after subsequent fully homomorphic multiplication, ensuring that the key is bound to the authorization.

[0104] The Trusted Execution Environment employs a secure processor, extending memory access to be invisible to the host operating system through confidential computation. During operator parsing, the scheduler maintains a mapping table between operator types and computation domains, ensuring that misclassification does not lead to plaintext leakage. Each domain uses asynchronous pipelines, and tensors are passed through a shared ciphertext buffer after computation. The noise injection module is located at the neuromorphic chip output and communicates with the homomorphic domain via a ciphertext sequence interface.

[0105] The three-domain collaboration brings three direct benefits: First, linear operations can be performed in batches in the homomorphic domain, and the number of multiplication gates can be reduced by about 30% by using multiplication-rotation merging; Second, nonlinear operations can be performed in the secure circuit domain without homomorphic polynomial approximation, thus avoiding numerical drift; Third, the spiking neural chip uses event-driven inference, has low power consumption, and naturally meets the sparse injection requirements of differential privacy noise.

[0106] Example: A pharmaceutical company trained a hybrid model with 16 convolutional layers, 4 fully connected layers, and 2 spike pooling layers in a lung cancer screening project. After parsing, 287 linear nodes, 102 nonlinear nodes, and 58 spiking neural nodes were obtained. The batch license budget was 0.3, and the noise injection variance was 3.33. The fused encrypted result size was approximately 4.8 megabytes. Compared to the baseline scheme that places all operations in the homomorphic domain, the three-domain collaboration reduced the inference latency from 920 milliseconds to 480 milliseconds, while avoiding nonlinear approximation errors, improving the model recall by approximately 2 percentage points.

[0107] Preferably, the linear subgraph performs matrix multiplication and convolution operations in the fully homomorphic encryption domain, the nonlinear subgraph performs activation and normalization operations in the secure circuit domain, and the spiking neural subgraph performs spiking accumulation and membrane potential update operations in the neuromorphic computing domain.

[0108] The domain-specific execution of linear subgraphs, nonlinear subgraphs, and spiking neural subgraphs is a key design feature of this invention, ensuring that sensitive medical data can undergo deep learning inference in an encrypted state while balancing efficiency and privacy. Pharmaceutical companies conducting multi-institutional research need to simultaneously meet three constraints: first, the stringent requirement of China's Data Security Law for "encrypted processing" of medical data; second, the quantifiable requirement of the EU's General Data Protection Regulation (GDPR) for differential privacy budgets; and third, the engineering requirement of acceptable inference latency for commercial research. This invention achieves a balance between security and efficiency by coupling three domains: a fully homomorphic encryption domain, a secure circuit domain, and a neuromorphic computation domain, mapping different operators of deep networks to the most suitable hardware and cryptographic environment.

[0109] Deep learning computation graphs consist of alternating linear and nonlinear operations. Linear operations such as matrix multiplication and convolution can be represented as large-scale vector inner products or tensor multiplications, exhibiting high homomorphic computability. Nonlinear operations, such as activation functions and normalization operations, often require high-order polynomial approximations in the homomorphic domain, leading to rapid expansion of ciphertext noise. Spiking neural operations are inherently sparse and event-driven; forcibly implementing them using homomorphic methods would result in the loss of time-dependent information. Based on these characteristics, this invention places linear operators in the fully homomorphic encryption domain, nonlinear operators in the secure circuit domain, and spiking dynamics in the neuromorphic computation domain.

[0110] A fully homomorphic encryption domain, operating on a cryptographic accelerator, supports batch tensor rotation and multiply-accumulate pipelines. The input ciphertext tensor is denoted as c. in The weight matrix is ​​denoted as w in encrypted form. The core operation is:

[0111] c out =w·c in

[0112] Multiplication and addition are performed in the ciphertext domain. To control the growth of homomorphic noise, this invention employs a multiplication-rotation merging and low-rank decomposition strategy, reducing the operator depth by approximately 30%. The linear domain output is denoted as c. lin It directly participates in homomorphic addition in the subsequent fusion stage.

[0113] In the secure circuit domain, nonlinear operators are mapped to the secure circuit domain. The secure circuit domain utilizes a two-way secure computation protocol to quantize activation functions into Boolean gate-level networks; for example, modified linear units are decomposed into combinations of comparison and multiplication gates. Secure circuits operate within a protected execution environment, with both inputs and outputs being encrypted tensors c. non Since Boolean circuits do not require homomorphic multiplication depth, noise expansion is avoided. Normalization is implemented through table lookup, with homomorphic selection of entries to ensure numerical stability.

[0114] In the neuromorphic computational domain, the spiking neural subgraph operates on the neuromorphic chip using an event-driven model. The node membrane potential is updated using a discrete formula.

[0115] V t+1 =λV t +I t

[0116] Where V t Let I be the membrane potential at time t, λ be the attenuation coefficient, and I be the membrane potential at time t. t The chip accumulates input pulses. Synaptic weights are stored locally, and synaptic events are routed via an on-chip crossover switch, resulting in power consumption that is an order of magnitude lower than homomorphic multiplication. The output pulse sequence is encapsulated as a ciphertext vector c. snn According to real-time privacy budget ∈ t Laplace noise needs to be injected into the output. The noise injection location is determined using an on-chip random number generator in conjunction with a differential privacy engine.

[0117] Fusion and key derivation, fusion of three ciphertexts in the homomorphic domain merge =c lin +c non +c snn To prevent key reuse, this invention derives a relined key based on the semantic signal vector v. The 128th bit of the vector v... 128 The initial logical mapping x is mapped to the interval [0.5, 0.6]. k+1 =4x k (1-x k After iterating 100,000 times, the value x is obtained. 100000 The fractional part is truncated and quantized into a 256-bit binary sequence K. rel The key undergoes a reline operation after fully homomorphic multiplication to ensure that each authorization corresponds to a unique key, which conforms to the "one key, one scheduling, one use" principle of differential privacy best practices.

[0118] This invention fully utilizes vectorized multiplication and rotation optimization in the linear domain, reducing inference time by approximately 40% compared to a pure homomorphic implementation with the same number of parameters. Nonlinear operations are not approximated within the homomorphic domain, ensuring the output error is consistent with the plaintext model and avoiding the impact of noise expansion on diagnostic accuracy. The event stream printed in the impulse domain is packaged into ciphertext through a chip hardware encryption layer and injected with differential privacy noise, preventing any usable information from being captured by any side channel. The key rotation and budget binding mechanism meets the auditing requirement of China's Data Security Law, which stipulates that "the flow records of encrypted keys can be directly verified."

[0119] In this example, a pharmaceutical company deployed a hybrid model to infer from 1000 lung CT slices, with a total of 34 million parameters. After parsing, linear operators accounted for 78% of the computation, nonlinear operators for 18%, and pulsed layers for 4%. A batch rotation scheme was used in the homomorphic domain, with an inference latency of 350 milliseconds; the secure circuit domain contained approximately 240,000 Boolean gates, with an evaluation time of 90 milliseconds; the pulsed chip had an average power consumption of 0.8 watts. Using a budget of 0.3 to inject noise, the PSNR of the output ciphertext decreased by less than 0.5 dB compared to the plaintext baseline. If the budget for the next batch of licenses was reduced to 0.1, the noise amplitude was automatically adjusted, resulting in a slight decrease in accuracy but maintaining a recall rate above 98% of the baseline.

[0120] Preferably, after injecting Laplacian noise into the output of the spiking neural subgraph according to the privacy budget, the output of the spiking neural subgraph is fused with the output of the linear subgraph and the output of the nonlinear subgraph in the ciphertext domain to form a fused ciphertext result.

[0121] In multi-institutional collaborative medical data exchange scenarios, pharmaceutical companies need to maintain differential privacy attributes for various computational results in encrypted form while minimizing performance loss. This invention injects Laplacian noise into the output of a spiking neural subgraph according to a privacy budget, and then fuses it with the outputs of linear and nonlinear subgraphs in the homomorphic domain to form a fused encrypted result. This process balances the randomness of noise injection, the consistency of encrypted fusion, and computational efficiency, meeting the dual requirements of "static encryption and dynamic auditability" under China's Personal Information Protection Law and Data Security Law.

[0122] The core of differential privacy lies in adding random noise to the observable output, so that the presence or absence of a single data point has a controlled impact on the overall result. The Laplace distribution is widely used in practice due to its "zero mean and double exponential tails" characteristics. This invention places the noise injection point at the end of the spiking neural subgraph for three reasons: First, the spiking neural subgraph naturally generates a sparse event flow, and noise injection will not significantly increase the bandwidth; second, the spiking dynamics are robust to small-amplitude noise, avoiding abrupt changes in diagnostic indicators; and finally, the injection timing is earlier than homomorphic fusion, ensuring that the noise component maintains linear separability in subsequent linear superposition.

[0123] Let the ciphertext output vector of the pulse neural subgraph be c. snn Real-time privacy budget is denoted as ∈ t The quantization method is 16-bit fixed-point. The Laplace noise sampling function is denoted as... The injection operation is performed in the neuromorphic computation domain, as expressed by the formula:

[0124]

[0125] symbol This represents the ciphertext vector of the pulse subgraph after adding noise. This represents a ciphertext addition operation. The ciphertext output of the linear subgraph is c. lin With nonlinear subgraph ciphertext output c non The results have already been obtained in the aforementioned computational domain. The three vectors are then fused in a homomorphic programmable adder:

[0126]

[0127] Where f merge This is a homomorphic adder combinational circuit, ensuring the output c merge It maintains a homomorphic mapping relationship with each input vector.

[0128] The noise injection module is located at the edge control logic of the neuromorphic chip. The module calls a hardware random number generator to generate uniformly distributed random variables, and then obtains Laplace noise samples using the inverse standard transform method. After quantizing the samples into a homomorphic encrypted tensor format, it is then compared with c... snn Perform encrypted addition. Since the noise level is different from the budget...t Inversely proportional to this, the system reads the scheduler's output budget value and writes it to the local register area before injection to ensure that the noise amplitude is consistent with compliance requirements.

[0129] Homomorphic fusion is performed in a fully homomorphic cryptographic domain. The adder uses a round-robin accumulation strategy: first, the three vectors are segmented and loaded into the accumulation register according to the channel mapping, and then the parallel addition gate is triggered to complete one aggregation. To control noise expansion, the system immediately calls the relined operation after fusion. The relined key is a relined key K derived from the semantic signal vector. rel The encryption engine automatically updates its internal key slots when it detects a key version change, preventing old keys from remaining.

[0130] Through this invention, noise is added to the model output level, satisfying pure ∈ t - Differential privacy definition; budget can be audited on-chain. Noise injection and homomorphic addition are both linear operations, with time consumption linearly related to tensor size, without introducing higher-order polynomial approximation. The scheduler dynamically adjusts ∈ t High-priority tasks receive low-noise results, while low-priority tasks receive high-noise results, enabling precise budget allocation. The fused encrypted results contain noise traces, which can be statistically verified afterward to check whether the budget has been overdrawn, thus meeting the requirements for random inspections by regulatory authorities.

[0131] In this example, a pharmaceutical company and a top-tier hospital conducted a quality assessment of lung nodule annotation. The authorization strategy allowed a total budget of 1.0 per patient. The first inference used a budget of 0.4 with a noise standard deviation of 2.5; the second inference used a budget of 0.3; after the third inference, the system rejected all subsequent calls with a budget of 0.3. The three batches of encrypted results were written to the consortium blockchain at heights 6210, 6215, and 6220, respectively. Regulatory authorities sampled the data at height 6215, restored the output, and performed parameter estimation on the noise distribution. The results showed no significant difference from the theoretical distribution corresponding to a budget of 0.3, verifying the correct injection.

[0132] Comparing the baseline scheme (global homomorphic encryption plus Laplace noise) with the three-domain scheme of this invention, the inference latency is reduced from 900 milliseconds to 480 milliseconds, and the output mean square error does not exceed 2%. Meanwhile, referencing the differential privacy accounting framework, when the total budget is within 1.0, the cumulative job chain length can be extended to thousands of nodes without exceeding the limit.

[0133] Preferably, the re-lined key is generated by iterating a fixed-length binary sequence through a seed-driven logic mapping function selected from the semantic signal vector a preset number of times.

[0134] The dynamic derivation of the relined key is a crucial step in ensuring the long-term security of encrypted computation in this invention. When pharmaceutical companies share encrypted image and genetic data with multiple medical institutions, if the same relined key is reused across different authorization batches, attackers can use lateral correlation analysis to crack the homomorphic encryption coefficients, posing an irreversible threat to patient privacy. To eliminate this risk, this invention uses the bit with the highest random entropy in the semantic signal vector as a seed, iteratively generates a high-entropy sequence through a logical mapping function, and after a specified number of iterations, extracts a fixed-length binary sequence as the relined key. This process requires no external random source, making key generation a one-time operation completely bound to authorization.

[0135] The semantic signal vector v has a dimension of 512 and is obtained by mixing position encoding, Hadamard rotation, and column orthogonal projection with authorization policy hashing and real-time privacy budget. Statistical data shows that the bit distribution of v is approximately independent and identically distributed, and the information entropy is close to 1. The 128th bit v is selected. 128 The reason this bit is used as the initial seed for the chaotic mapping is that, experimentally, its value probability under different batch authorizations is closest to 0.5. A classic logical mapping function is used:

[0136] x k+1 =4x k (1-x k )

[0137] Where x k Located in the interval (0,1), the mapping exhibits a completely chaotic state when the control parameter is 4. Let x0 = 0.5 + 0.1v 128 Initialize the iteration, if v 128 =0, then x0 = 0.5, if v 128 If x = 1, then x0 = 0.6. Iterating 100,000 times ensures the trajectory leaves the initial neighborhood and traverses the phase space to obtain a sufficient period length. After the iteration, take:

[0138] K rel =bin 256 (x 100000 )

[0139] Among them bin 256 This indicates that the fractional part will be truncated to 256 bits using binary extension. K rel That is, the required relined key.

[0140] Logical mapping operations are performed directly within the trusted execution environment, requiring no external random access devices. First, the semantic signal vector is read, and the 128th bit is extracted and written to a register to generate an initial value. To ensure floating-point precision, fixed-point representation is used: the interval (0,1) is mapped to a 32-bit fixed point, and multiplication is performed by bit shifting. Modular reduction is performed every 64 iterations to limit the bit length and prevent numerical overflow. 100,000 iterations take less than 5 milliseconds on a 16-core CPU. Finally, the lower 256 bits of the fixed-point bit sequence are extracted and written to the homomorphic encryption engine keyway via the key management interface. Old keyways are securely erased after the current batch re-line is completed, preventing key retrieval failure.

[0141] This invention directly derives the key from the semantic signal vector. Bit differences cause the chaotic trajectory to diverge exponentially, resulting in entirely new keys for any different authorization. Logical mapping operations only involve multiplication and subtraction, with no table lookup operations, thus resisting cache-time sidechannels. The 256-bit chaotic derived key space is 2-1. 256 Given current computing power, these keys cannot be exhaustively enumerated. The key derivation algorithm is public and has fixed parameters, allowing regulatory authorities to reproduce it in a trusted execution environment to verify that the key was indeed triggered by authorization rather than manually implanted.

[0142] In an example, in a lung nodule risk prediction project, the 128th bit of the first batch of authorized semantic signal vectors is 0, with an initial value of 0.5. A key is generated after iteration. The second batch of authorizations resulted in a bit flip due to budget changes, with the 128th bit set to 1. The initial value was 0.6, and the key was generated. When pharmaceutical companies perform inference on the same encryption model, the relinearization phase first switches to... Process the first 200 images, then switch to... If an attacker intercepts two ciphertexts and attempts to compare the coefficients, the coefficient space will be completely scattered due to the different keys, making it impossible to recover the plaintext using the correlation of homomorphic noise.

[0143] Tests show that key switching has a minimal impact on latency: the latency of a single re-threading call increases by about 1 millisecond, but the overall inference latency is still controlled within 500 milliseconds. In contrast, traditional solutions using fixed keys require additional layers of random mask protection, resulting in an additional overhead of more than 20 milliseconds.

[0144] A hypergraph commitment is constructed based on the fused ciphertext result. A seed is generated using a semantic signal vector and a re-lined key, and a verifiable delay function is run to obtain a random value and a proof. A threshold signature is performed on the message body containing the hypergraph commitment, random value, proof, and root hash, and a random bit sequence is concatenated to form a composite commitment. The object content containing the hypergraph commitment, composite commitment, and root hash is written to the blockchain for addressing.

[0145] After completing the three-domain collaborative reasoning, this invention requires establishing long-term verifiable and publicly traceable integrity and timing guarantees for the fused ciphertext results. To this end, a four-stage mechanism of "hypergraph commitment - delayed randomness - threshold signature - multi-chain evidence storage" is proposed to ensure that any third party can verify the reliability of the results with a minimum amount of data at any time in the future, while blocking risks such as premature prediction, duplicate submissions, and single-point forgery.

[0146] In the first stage, the system generates a node set based on the fused ciphertext results. Each fixed-length ciphertext slice is treated as a hypergraph node, and a hyperedge set is constructed using a cyclic ternary combination method. After hashing all hyperedges, they are hashed again to obtain a single commitment value C. sg This commitment value both locks the ciphertext content and binds the node order; any insertion, deletion, or replacement will change the root value. Variable description: C sg This indicates a commitment from SuperMap.

[0147] In the second stage, unpredictable random indices need to be generated to shuffle the hyperedge order. The system combines the first 64 bits of the semantic signal vector v with the relined key K. rel Concatenate the data to obtain a 320-bit binary stream s. Calculate:

[0148]

[0149] Where τ = 2 24 Let N be the delay parameter, and N be a 2048-bit security modulus. The above formula constitutes a verifiable delay function, ensuring that solving for y takes at least approximately 5 seconds given the known hardware conditions, while verification only requires one modulo-squared operation. Simultaneously, a proof π is generated, allowing the verifier to confirm the validity of y within 10 milliseconds. The random index sequence is obtained by modulo transformation of H(y) and is used to rearrange the hyperedge list, preventing prediction of the next index.

[0150] The third stage, for those containing C sg A threshold signature is performed on the message body containing a random value y, proof π, and root hash M0. The pharmaceutical company and cooperating hospitals, a total of n=7 nodes, hold private key fragments based on a lattice-hard problem, with a threshold parameter set to t=5. Each node calculates a local signature share σ on the message body. i After aggregation, a complete signature σ is formed. S To enhance replay resistance, an additional 256-bit vacuum random sequence r is added. The final composite commitment format is:

[0151] ∑=σ S ||r

[0152] The symbol ∑ represents a compound commitment.

[0153] In the fourth stage, the system will {C sgThe blocks ',' ',' and ',' ...

[0154] The superedge coverage rate is set to 1.2 times the number of nodes to ensure at least 95% coverage is maintained after randomly deleting nodes. The delay function verification end employs batch optimization, allowing a single core to verify 100 signatures within 70 milliseconds. The threshold signature share size is 1024 bytes, compressed to 224 bytes after aggregation, meeting on-chain storage cost control requirements. The vacuum random sequence is generated using an optical quantum source, and the deviation rate is confirmed to be less than 0.5% using an entropy test tool.

[0155] This invention allows anyone to verify the correctness of the entire batch of encrypted data simply by downloading a 32-byte commitment and threshold signature. The delay function ensures that the time difference between the earliest and latest recipients of the random index does not exceed 5 seconds, blocking earlier transactions. The threshold signature requires joint endorsement from at least five institutions to prevent malicious actions by a single node. Dual-chain notarization guarantees both rapid regional auditing and long-term national oversight; IPFS provides a global mirror, accelerating third-party verification.

[0156] In an example, a pharmaceutical company generates an encrypted result of 4.8 megabytes for a single batch of lung nodule inference. After node slicing, 1184 hypergraph nodes are obtained, and the hypergraph commitment C is calculated. sg The semantic signal vector seed generates a random value y, the delay function calculation takes 5.2 seconds, and the proof length is 384 bytes. Seven institutions submitted threshold signature shares, which were aggregated to obtain σ. S The transaction took 0.9 seconds. The total object size was less than 1 megabyte. The blockchain confirmed the transaction at height 81206, and the national blockchain successfully anchored at height 135421. During random inspections by regulatory authorities, only the CID was downloaded. ipfs For the corresponding object, complete all verifications within 30 seconds using a laptop.

[0157] Preferably, the order of superedge selection in the hypergraph commitment is determined by a random value generated by a verifiable delay function from a seed consisting of a semantic signal vector and a re-lined key. The random value and its proof are concatenated with the hypergraph commitment and a random bit sequence after threshold signing to form a composite commitment. An object containing the hypergraph commitment, the composite commitment, and the root hash is written into the regional consortium chain and the national regulatory chain to complete cross-chain notarization.

[0158] The design goal of the Hypergraph Commitment-Delayed Randomization-Threshold Signature-Multi-Chain Evidence Storage Link is to provide pharmaceutical companies with a long-term verifiable, unpredictable, tamper-proof, and traceable integrity certificate after the fused ciphertext result is generated.

[0159] First, the fused ciphertext result is sliced ​​into nodes: the system serializes the ciphertext into 4096-byte segments. Each segment is a superedge consisting of three segments, and a hash is calculated for each segment. This process generates at least 1.2N superedges to ensure that even if one node is randomly lost, there is still a 0.95 probability of maintaining coverage. The hashes of all superedges are concatenated and then hashed again to obtain a single commitment value.

[0160] C sg =H(h) 123 ||h 456 ||…||h pqr )

[0161] Where H is a 256-bit secure hash function, C sg Locking in the ciphertext content and node order is the starting point for all subsequent verifications.

[0162] Secondly, a random sequence unpredictable by all nodes before submission is needed to rearrange the hyperedge order, preventing preemptive runs and replays. The system takes the first 64 bits of the semantic signal vector v and the re-lined key K. rel The concatenation yields a 320-bit seed s. Inputting s into the delay function verifies its operation.

[0163]

[0164] Where the delay parameter τ = 2 24 Modulus N RSA The length is 2048 bits. Calculating y takes at least 5 seconds, but verification only requires one modulo-square. The delayed function synchronously outputs proofs of π, allowing the verifier to complete the verification within 10 milliseconds. H(y) is mapped to a random index sequence. use Shuffle the list of superedges to generate a new hypergraph order. Due to the verifiable delay of y, no node can predict the index in advance outside the 5-second window, thus preventing early commits.

[0165] The third step is to generate a composite commitment. (C) sg The message body m is composed of a random value y, a proof π, and a root hash M0. The pharmaceutical company and its partner hospitals have a total of 7 key nodes, each holding a private key fragment based on a lattice-hard problem. The threshold parameter is set to 5. Each node calculates its local signature share σ for m. i The overall signature σ is obtained through Lagrange aggregation. S To prevent replay, the system draws a 256-bit random bit sequence r from a quantum true random source and combines it with σ. S splicing:

[0166] ∑=σ S ||r

[0167] The symbol ∑ represents a composite commitment, which is approximately 512 bytes in length.

[0168] Finally, {C sg The objects ∑M0 are encapsulated as immutable objects and written to the InterPlanetary File System via the content addressing interface to obtain their CIDs. ipfs The system then used CID ipfs Using ∑ as the main entity, transactions are submitted to the regional consortium blockchain for rapid consensus; then, their hashes are written to the national regulatory blockchain for long-term storage. This double-bond structure balances rapid intra-regional scheduling with the long-term auditing requirements of regulations.

[0169] Through this invention, the verifier only needs to download 32 bytes of C. sg With a 512-byte sum, the superedge can be recalculated and the signature verified locally, with a verification time of less than 1 second. A delay function ensures that the random index is not publicly disclosed until at least 5 seconds later, preventing prophetic attacks. Any forgery attempt requires simultaneously cracking 5 threshold signature fragments and the quantum random sequence, resulting in a computational complexity exceeding 2^35. 256 If violations are discovered in the future, the pharmaceutical company can add a cancellation clause to the consortium blockchain, and the higher-level regulatory chain will automatically propagate the status change through anchoring.

[0170] Example: In a batch inference of lung nodules, the fused ciphertext size was 4.8MB, generating 1200 nodes. The system took 300 milliseconds to calculate C. sg The delay function completed in 5.2 seconds, and threshold aggregation took 0.9 seconds. The entire object, after compression, is less than 1MB. The blockchain recorded the transaction at height 81206, and the national blockchain completed its anchoring at height 135421. Two months later, regulatory agencies conducted random inspections and downloaded the CID. ipfs The corresponding object completed all verifications within 30 seconds on a regular laptop, proving that the pharmaceutical company had not modified any encrypted documents or budget records.

[0171] like Figure 3 As shown, a security system for medical data interaction is used to implement the security method for medical data interaction, comprising:

[0172] The solidified hash module is used to write raw medical data to a read-only medium and encrypt the disk surface. It generates a content fingerprint for the encrypted file and constructs a hash tree based on the content fingerprint to obtain the root hash. The write path adopts a write-once SATA / SAS solid-state array. The controller firmware integrates an AES-XTS disk surface encryption engine and a hardware write protection fuse. The onboard SHA-256 parallel pipeline calculates the content fingerprint in real time at a 4KB sector granularity. The FPGA constructs a key-value ordered hash tree through on-chip BRAM and outputs the root hash.

[0173] The authorization vector module generates zero-knowledge proofs and a privacy budget based on an authorization policy that includes the purpose, number of calls, deadline, and privacy budget cap. It encodes and transforms the authorization policy hash and the privacy budget to form a semantic signal vector. This semantic signal vector, along with the patient key, generates an authorization token and writes it to the revocation chain. An on-chip polynomial commitment ASIC and a fast Fourier array collaboratively generate and verify the zero-knowledge proof. A DSP core performs position encoding, a 10,000-order Hadamard rotation, and column orthogonal projection, outputting a 512-dimensional semantic signal vector. The security element reconstructs the patient key and signs the token based on the trusted platform controller, then writes the token to the erasable eMMC revocation chain.

[0174] The collaborative computing module is used to divide the algorithm to be executed into linear subgraphs, nonlinear subgraphs, and spiking neural subgraphs within a trusted execution environment. Each subgraph is computed in the fully homomorphic encryption domain, secure circuit domain, and neuromorphic computing domain, respectively. Noise is injected into the output of the spiking neural subgraph according to the privacy budget, and the outputs of each subgraph are fused to obtain the fused ciphertext result. A re-lined key is generated based on the semantic signal vector. A dedicated fully homomorphic encryption card executes the linear subgraph, supporting batch rotation and multiply-add pipelined operations. The secure circuit card maps nonlinear operators to high-speed Boolean gate networks and operates them in isolation. The neuromorphic chip performs event-driven processing of the spiking subgraph and injects Laplace noise into the output according to the real-time privacy budget. The three ciphertexts are fused through a PCIe shared buffer, and a logic mapping kernel generates a re-lined key based on the semantic signal vector.

[0175] The Hypergraph Evidence Module is used to construct a Hypergraph Promise based on the fused ciphertext result. It generates a seed using the semantic signal vector and the relined key, and runs a verifiable delay function to obtain a random value and a proof. It performs a threshold signature on the message body containing the Hypergraph Promise, the random value, the proof, and the root hash, and concatenates a random bit sequence to form a composite promise. It then addresses and writes the object content containing the Hypergraph Promise, the composite promise, and the root hash into the blockchain. An ARM core combined with a SHA-256 array constructs the Hypergraph Promise; an RSA-2048 modular exponentiation unit generates delayed random values ​​and proofs based on the semantic signal vector and the relined key; seven Grid Security Cards aggregate the threshold signatures; and dual gigabit blockchain interfaces simultaneously write objects containing the Hypergraph Promise, the composite promise, and the root hash into the regional consortium blockchain and the national regulatory blockchain, with transmission accelerated by hardware TLS.

[0176] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for ensuring security during medical data exchange, characterized in that, include: The original medical data is written to a read-only medium and the disk surface is encrypted. A hash tree is built based on the generated content fingerprint to obtain the root hash. Zero-knowledge proofs and privacy budgets are generated based on authorization policies that include purpose, number of calls, deadline, and privacy budget cap. The authorization policy hash and the privacy budget are encoded and transformed to form a semantic signal vector. An authorization token is generated using the semantic signal vector and the patient key and written into the revocation chain. Subsequently, within a trusted execution environment, the algorithm to be executed is divided into linear subgraphs, nonlinear subgraphs, and spiking neural subgraphs, which are computed in the fully homomorphic encryption domain, secure circuit domain, and neuromorphic computing domain, respectively. The output of the spiking neural subgraph, which is injected with noise according to the privacy budget, is fused with the output of other subgraphs to form a fused ciphertext result, and a relined key is generated based on the semantic signal vector. A hypergraph commitment is constructed based on the fused ciphertext result. A seed is generated using a semantic signal vector and a re-lined key, and a verifiable delay function is run to obtain a random value and a proof. A threshold signature is performed on the message body containing the hypergraph commitment, random value, proof, and root hash, and a random bit sequence is concatenated to form a composite commitment. The object content containing the hypergraph commitment, composite commitment, and root hash is written to the blockchain for addressing.

2. The method according to claim 1, characterized in that, The content fingerprint is written into a key-value ordered hash tree according to the file arrival order, and the root hash is used to perform integrity verification on all encrypted files in the read-only medium.

3. The method according to claim 2, characterized in that, Zero-knowledge proof establishes hash commitments on a set of polynomial constraints, constructs a proof circuit using fast Fourier transform, and completes proof generation and verification within the same trusted execution environment.

4. The method according to claim 3, characterized in that, The privacy budget is dynamically allocated by the reinforcement learning scheduler based on the remaining number of calls and the remaining privacy budget. The reward function of the reinforcement learning scheduler takes into account both the authorization policy satisfaction rate and the data utilization rate.

5. The method according to claim 1, characterized in that, Encoding and transformation involve performing orthogonal transformations on the authorization policy hash and privacy budget after positional encoding to generate semantic signal vectors.

6. The method according to claim 1, characterized in that, Linear subgraphs perform matrix multiplication and convolution operations in the fully homomorphic encryption domain, nonlinear subgraphs perform activation and normalization operations in the secure circuit domain, and spiking neural subgraphs perform spiking accumulation and membrane potential update operations in the neuromorphic computation domain.

7. The method according to claim 6, characterized in that, After injecting Laplacian noise into the output of the spiking neural subgraph according to the privacy budget, the output of the spiking neural subgraph is fused with the output of the linear subgraph and the output of the nonlinear subgraph in the ciphertext domain to form a fused ciphertext result.

8. The method according to claim 1, characterized in that, The re-linearization key is generated by iterating the logic mapping function a preset number of times based on the seed selected by the semantic signal vector, and then extracting a fixed-length binary sequence.

9. The method according to claim 1, characterized in that, The order of superedge selection in the hypergraph commitment is determined by a random value generated by a verifiable delay function from a seed consisting of a semantic signal vector and a re-lined key. The random value and its proof are combined with the hypergraph commitment and then concatenated with a random bit sequence after threshold signing to form a composite commitment. An object containing the hypergraph commitment, the composite commitment, and the root hash is written into the regional consortium chain and the national regulatory chain to complete cross-chain notarization.

10. A security system for medical data interaction, used to implement the security method for medical data interaction as described in any one of claims 1 to 9, characterized in that, include: The solidified hash module is used to write raw medical data into a read-only medium and encrypt the disk surface, generate a content fingerprint for the encrypted file, and construct a hash tree based on the content fingerprint to obtain the root hash; The authorization vector module is used to generate zero-knowledge proofs and privacy budgets based on authorization policies that include purpose, number of calls, deadline, and privacy budget limit. It encodes and transforms the authorization policy hash and the privacy budget to form a semantic signal vector. It uses the semantic signal vector and the patient key to generate an authorization token and write it into the revocation chain. The collaborative computing module is used to divide the algorithm to be executed into linear subgraphs, nonlinear subgraphs and spiking neural subgraphs in a trusted execution environment. It performs calculations on each subgraph in the fully homomorphic encryption domain, secure circuit domain and neuromorphic computing domain respectively. After injecting noise into the output of the spiking neural subgraph according to the privacy budget, it fuses the outputs of each subgraph to obtain the fused ciphertext result, and generates a relined key based on the semantic signal vector. The hypergraph proof module is used to construct a hypergraph commitment based on the fused ciphertext result, generate a seed using the semantic signal vector and the re-lined key, and run a verifiable delay function to obtain a random value and a proof. It performs a threshold signature on the message body containing the hypergraph commitment, the random value, the proof, and the root hash, and concatenates a random bit sequence to form a composite commitment. It addresses the object content containing the hypergraph commitment, the composite commitment, and the root hash and writes it into the blockchain.

Images