Data protection method and device for medical and health record management system

Abstract

The present invention provides a data protection method and device for a medical health record management system. The method includes: collecting user medical data; performing standardization processing on the user medical data to obtain a numerical user data set; encrypting the data of the numerical user data set by using the HiLL reversible matrix encryption algorithm, and storing the encrypted data in a database; performing restoration processing on the data stored in the database, and converting the restored data into desensitized data by using an improved algorithm based on K-anonymous clustering, so as to publish it to a front-end display interface for visual display. The present invention adopts two different data encryption schemes according to the characteristics of different stages of the data life cycle: the privacy protection of front-end data adopts an improved algorithm based on k anonymity; the encryption of background data adopts reversible matrix encryption, thereby realizing efficient privacy protection for medical data starting from the data life cycle.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy data protection, and in particular to a data protection method and device for a medical health record management system. Background Art

[0002] With the continuous development of emerging technologies such as the Internet of Things, the Internet, and cloud computing, many new forms of generation and sharing of information resources have emerged. As a carrier for recording users' various health data and a management platform for various medical activities, the medical health record management system has gradually become the focus of Internet + medical construction.

[0003] Building a personalized medical health record system can assist in medical treatment and users' health management. However, due to the openness of the system, the characteristics of high privacy, high sensitivity, and high value of medical data will expose many security risks. If the data is leaked or misused, it will cause huge losses and harm to individuals and relevant collectives / institutions. Therefore, for the data security research of the medical health record system, we cannot only focus on the storage security of the data, but also need to consider the security of the data throughout its life cycle. How to reasonably analyze and utilize users' health data on the basis of considering privacy protection is of great significance for the design and construction of the medical health record system.

[0004] Common privacy protection technologies include: data distortion, data encryption, and restricted release. Among them, data distortion technology mainly refers to disturbing the original data by means such as adding random noise, data exchange, and value change. The distorted data still maintains certain properties unchanged, but there is a certain degree of information loss; data encryption technology is to transform the sensitive data in the number field by means of encryption to achieve a hidden effect, which is mostly used in distributed application environments and has a relatively large amount of calculation; restricted release technology will conditionally release the data according to specific situations, and there is a certain degree of information loss in the released data.

[0005] Specifically for the data release scenario, the attack methods for attackers to obtain privacy data can generally be divided into two categories: one is the linkage attack. At this time, in a centralized dataset, the column attributes are divided into quasi-identifiers and sensitive information. The attacker links the external dataset through the quasi-identifiers to identify the individual identities in the released dataset, so as to obtain the sensitive information corresponding to the patient individuals, represented by K-Anonymity, L-Diversity, T-Closeness; the other is the probability attack, where the attacker guesses the unknown information in the dataset based on his own known information to obtain the sensitive information that the data publisher wants to protect. In this case, there is no longer a distinction between quasi-identifiers and sensitive information for the column attributes in the centralized dataset, and the attacker's identification target is the unknown individual information tuple.

[0006] At present, the data stored in the medical and health record system has the characteristics of large data volume and various types. How to perform efficient privacy protection on medical data from the perspective of the data life cycle is the current research focus. Summary of the Invention

[0007] The purpose of the present invention is to provide a data protection solution for a medical and health record management system to solve the problem of being unable to perform efficient privacy protection on medical data from the perspective of the data life cycle.

[0008] The first aspect of the present invention provides a data protection method for a medical and health record management system.

[0009] Among them, the method includes:

[0010] Collect user medical data, where the user medical data includes user basic information, user basic medical information, and user complete privacy information;

[0011] Perform standardization processing on the user medical data to obtain a numerical user data set;

[0012] Use the HiLL reversible matrix encryption algorithm to encrypt the data in the numerical user data set, and store the encrypted data in the database;

[0013] Perform restoration processing on the data stored in the database, and use an improved algorithm based on K-anonymous clustering to convert the restored data into de-sensitized data for visualization display on the front-end display interface.

[0014] According to the method provided in the first aspect of the present invention, performing standardization processing on the user medical data to obtain a numerical user data set specifically includes:

[0015] Establish a data conversion dictionary according to the intermediate conversion rules;

[0016] Use the data conversion dictionary to convert the text data or boolean data in the user medical data into numerical data.

[0017] According to the method provided in the first aspect of the present invention, using the HiLL reversible matrix encryption algorithm to encrypt the data in the numerical user data set specifically includes:

[0018] Generate a reversible matrix with a corresponding dimension according to the scale of the numerical user data set;

[0019] Select a key matrix with the same matrix dimension as the reversible matrix from the key set;

[0020] Performing matrix operation on the invertible matrix using the key matrix to obtain an encryption matrix;

[0021] Wherein, the encryption operation formula is: M = P·A, where M is the encryption matrix, P is the invertible matrix, and A is the key matrix.

[0022] According to the method provided in the first aspect of the present invention, performing restoration processing on the data stored in the database, specifically including:

[0023] Performing decryption processing on the data stored in the database using the invertible matrix, wherein the decryption operation formula is: P = M·A -1 , where M is the encryption matrix, P is the invertible matrix, and A is the key matrix.

[0024] According to the method provided in the first aspect of the present invention, converting the restored data into desensitized data using an improved algorithm based on K - anonymity clustering, specifically including:

[0025] Performing generalization processing on the quasi - identifier columns and sensitive data columns in the data set D composed of the restored data to divide into equivalence classes;

[0026] Setting the equivalence class number parameter threshold K and the sensitive attribute parameter threshold L;

[0027] Calculating the similarity between data objects in the data set D using Fisher transformation and constructing a similarity matrix D1. In the initial state, each data object is a cluster, that is, D1 = {A1, A2,..., A n};

[0028] Selecting two clusters A i and A j with the largest similarity from the similarity matrix D1; if |A i | + |A j | < 2K, where |A i | represents the total number of nodes in cluster A i , |A j | represents the total number of nodes in cluster A j , then merging the two clusters A i and A j into A p , otherwise, after merging the two clusters A i and A j , splitting them into two clusters such that |A i | and |A j | are both in the range of [K, 2K); repeating the execution until the total number of nodes in all clusters in the similarity matrix D1 is not less than K;

[0029] Check whether each cluster in the similarity matrix D1 meets the requirement of the sensitive attribute parameter threshold L; if not, under the condition that each cluster meets the equivalence class number parameter threshold K, set the privacy protection parameter b = L / K, calculate the value of the privacy protection parameter b in each cluster respectively, and if the privacy protection parameter of the cluster is less than b, then add or reduce the data objects in the cluster to make the cluster meet the requirement of the sensitive attribute parameter threshold L;

[0030] Generate de-sensitized data and output it.

[0031] After the step of encrypting the data of the numerical user dataset by using the reversible matrix encryption algorithm according to the method provided in the first aspect of the present invention and storing the encrypted data in the database, the following steps are further included:

[0032] Add differential privacy noise to the data queried from the database and then perform analysis processing.

[0033] According to the method provided in the first aspect of the present invention, adding differential privacy noise to the data queried from the database and then performing analysis processing specifically includes:

[0034] Read the privacy budget value from the data table in the database;

[0035] Determine the local sensitivity value jointly according to the query function and the query result data;

[0036] Calculate the differential privacy noise data according to the privacy budget value and the local sensitivity value;

[0037] Perform analysis processing on the data obtained by adding the query result data and the differential privacy noise data.

[0038] According to the method provided in the first aspect of the present invention, the privacy budget value e should satisfy the following range:

[0039]

[0040] Δv = max|q(d) - q(d′)|

[0041] Wherein, q is the query function, d, d' ∈ D', D' is a set of any n - 1 object combinations, p is the probability that the attacker obtains the correct result, Δf is the sensitivity of the query function on the dataset, Δv refers to the global sensitivity of the algorithm, n refers to the n tuples of the dataset, and d and d’ refer to adjacent datasets.

[0042] According to the method provided in the first aspect of the present invention, the step of encrypting the data of the numerical user dataset by using the HiLL reversible matrix encryption algorithm and storing the encrypted data in the database further includes:

[0043] Execute the data hot backup script to synchronously store the encrypted data in the backup database.

[0044] The second aspect of the present invention provides a data protection device for a medical health record management system.

[0045] The device includes:

[0046] A data acquisition module configured to acquire user medical data, where the user medical data includes user basic information, user basic medical information, and user complete privacy information;

[0047] A normalization processing module configured to perform normalization processing on the user medical data to obtain a numerical user data set;

[0048] An encryption processing module configured to encrypt the data in the numerical user data set using the HiLL reversible matrix encryption algorithm and store the encrypted data in a database;

[0049] And a data publishing module configured to perform restoration processing on the data stored in the database and convert the restored data into desensitized data using an improved algorithm based on K-anonymity clustering for visualization display on a front-end display interface.

[0050] In summary, according to the different stages of the data life cycle, privacy protection can be divided into: privacy protection in data publishing, privacy protection in data storage, privacy protection in data mining, and privacy protection in data use; for the different characteristics of different stages of the data life cycle, two different data encryption schemes are adopted: the privacy protection of front-end data is more inclined to improve the readability of data on the premise of ensuring security, and an improved algorithm based on k-anonymity is used; the encryption of background data is inclined to improve the value utilization rate of data during the import and export process, and reversible matrix encryption is used, so as to achieve efficient privacy protection for medical data starting from the data life cycle. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0052] Figure 1 It is a flowchart of a data protection method for a medical health record management system according to an embodiment of the present invention;

[0053] Figure 2 It is a specific flowchart of a data protection method for a medical and health record management system according to an embodiment of the present invention;

[0054] Figure 3 It is a structural diagram of a data protection device for a medical and health record management system according to an embodiment of the present invention. Specific embodiments

[0055] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0056] The first aspect of the present invention provides a data protection method for a medical and health record management system. Figure 1 It is a flowchart of a data protection method for a medical and health record management system according to an embodiment of the present invention; as Figure 1 shown, wherein the method includes:

[0057] S1: Collect user medical data, where the user medical data includes user basic information, user basic medical information, and user complete privacy information;

[0058] S2: Perform standardization processing on the user medical data to obtain a numerical user data set;

[0059] S3: Use the HiLL reversible matrix encryption algorithm to encrypt the data in the numerical user data set, and store the encrypted data in a database;

[0060] S4: Perform restoration processing on the data stored in the database, and use an improved algorithm based on K-anonymous clustering to convert the restored data into de-identified data for publication to a front-end display interface for visual display.

[0061] Specifically, for data collection in S1, the data collection scope includes the basic information of ordinary users, the basic medical information of ordinary users, and complete privacy information. After obtaining the data from the front end, it is transmitted to the background.

[0062] Specifically, for data standardization processing in S2, it means that after the background obtains the data sent from the front end, it standardizes different types of data, and converts text-type, boolean-type and other numerical-type data into numerical values by setting intermediate conversion rules.

[0063] Specifically, the data storage in S3 refers to storing the data in the data service center after standardization processing. The reversible matrix encryption algorithm is mainly used, and the privacy management agency can make relevant selections and settings for the matrix used for encryption.

[0064] Specifically, for data publishing in S3, the data processed and stored in the background is restored to the original data, and then published to the front end for visualization display after being processed by the privacy protection method. The displayed data are all desensitized data after processing. The specific content includes preview and display of anonymized data, etc., and an improved algorithm of k-anonymity is adopted.

[0065] In some embodiments, the standardization processing of the user medical data in S2 is performed to obtain a numerical user data set, which specifically includes:

[0066] Establish a data conversion dictionary according to the intermediate conversion rules;

[0067] Use the data conversion dictionary to convert the text-type data or boolean-type data in the user medical data into numerical data.

[0068] Specifically, the types of structured data entered by ordinary users through the medical and health record management system are rich, including text type, numerical type or boolean type, etc. Therefore, a data dictionary is needed to uniformly convert the data into numerical type. It is equivalent to setting an intermediate table that can uniformly convert other types of data into numerical type and then perform reversible matrix encryption.

[0069] In some embodiments, the HiLL reversible matrix encryption algorithm is used in S3 to encrypt the data in the numerical user data set, which specifically includes:

[0070] Generate a reversible matrix with a corresponding dimension according to the scale of the numerical user data set;

[0071] Select a key matrix with the same matrix dimension as the reversible matrix from the key set;

[0072] Use the key matrix to perform matrix operations on the reversible matrix to obtain an encryption matrix;

[0073] Among them, the encryption operation formula is: M = P·A, where M is the encryption matrix, P is the reversible matrix, and A is the key matrix.

[0074] Specifically, after the data is collected and processed, the medical and health record management system will encrypt and store the data set. Using a reversible matrix, a reversible matrix P with a corresponding dimension is generated according to the scale of the numerical user data set, and a key matrix A with the same matrix dimension is selected from the key set to perform matrix operations on P to generate an encryption matrix M, which is stored in the data table.

[0075] In some embodiments, the restoration process of the data stored in the database in S4 specifically includes:

[0076] Use the reversible matrix to decrypt the data stored in the database, where the decryption operation formula is: P = M·A -1 , where M is the encryption matrix, P is the reversible matrix, and A is the key matrix.

[0077] Specifically, when the data stored in the third-party medium is imported into the medical health record management system for reverse operation, first, the corresponding key matrix A is matched in the system, and then the reverse decryption operation is performed.

[0078] In some embodiments, in S4, the improved algorithm based on K-anonymous clustering is used to convert the restored data into desensitized data, specifically including:

[0079] Perform generalization processing on the quasi-identifier columns and sensitive data columns in the data set D composed of the restored data to divide equivalent classes;

[0080] Set the equivalent class number parameter threshold K and the sensitive attribute parameter threshold L;

[0081] Use the Fisher transform to calculate the similarity between data objects in the data set D and construct a similarity matrix D1. Initially, each data object is a cluster, that is, D1 = {A1, A2,..., A n};

[0082] Select two clusters A i and A j with the greatest similarity from the similarity matrix D1; if |A i | + |A j | < 2K, where |A i | represents the total number of nodes in cluster A i , |A j | represents the total number of nodes in cluster A j , then merge the two clusters A i and A j into A p , otherwise, after merging the two clusters A i and A j , split them into two clusters so that |A i | and |A j | are both in the range of [K, 2K); repeat the execution until the total number of nodes in all clusters in the similarity matrix D1 is not less than K;

[0083] Check whether each cluster in the similarity matrix D1 meets the requirement of the sensitive attribute parameter threshold L; if not, under the condition that each cluster meets the equivalence class number parameter threshold K, set the privacy protection parameter b = L / K, calculate the value of the privacy protection parameter b for each cluster respectively, and if the privacy protection parameter of the cluster is less than b, add or reduce the data objects in the cluster to make the cluster meet the requirement of the sensitive attribute parameter threshold L;

[0084] Generate de-sensitized data and output it.

[0085] Specifically, data publishing privacy protection mainly aims at link attacks published by the front end, and uses an improved algorithm KL based on K-anonymous clustering. Based on the K-anonymous algorithm, the sensitive attribute tuples SA are partitioned, and the number of sensitive attribute items in the same group of equivalence classes does not exceed L. In this way, the original simple generalization measure is changed to generalization specific to a certain sensitive value attribute, which can ensure that the probability of privacy leakage does not exceed 1 / L. The specific steps of the algorithm execution are as follows: ①Perform equivalence class partitioning (cluster partitioning) on QA, and the partitioning basis is the clustering algorithm; ②Perform equivalence class partitioning on SA; ③Perform local generalization according to the partitioning results; ④Calculate the information loss degree according to the distance function; ⑤Output encrypted data. In the actual operation of the system, the parameters that need to be provided and adjusted by relevant professionals are the values of K and L. Among them, the K value standardizes the number of attribute groups, and the L value ensures the richness of sensitive information in the equivalence class. By adjusting the values of K and L, appropriate encrypted data is generated. After the parameters are set in the system, anonymization will be completed and then displayed on the page. The page executes an automatic refresh script so that the data can be updated at any time.

[0086] In some embodiments, after the step of S3, it further includes: S5: Add differential privacy noise to the data queried from the database and then perform analysis and processing.

[0087] In some embodiments, adding differential privacy noise to the data queried from the database and then performing analysis and processing in S5 specifically includes:

[0088] Read the privacy budget value from the data table of the database;

[0089] Determine the local sensitivity value according to the query function and the query result data;

[0090] Calculate the differential privacy noise data according to the privacy budget value and the local sensitivity value;

[0091] Perform analysis and processing on the data obtained by adding the query result data and the differential privacy noise data.

[0092] Specifically, data analysis privacy protection mainly targets probabilistic attacks on front-end data analysis, adds noise using differential privacy, and finally analyzes the returned results. For clustering algorithms, the main function of the differential privacy protection mechanism is to query the corresponding data in the database according to the query function provided by the clustering algorithm. This process mainly consists of two steps. First, the value of the privacy budget is read from the database table, and then the magnitude of the local sensitivity is jointly determined based on the data and the query function. The magnitude of the noise is calculated through the privacy budget and the local sensitivity, and the previously true query result is added to the obtained noise to return the noisy query result.

[0093] In some embodiments, the privacy budget value e described in S5 should satisfy the following range:

[0094]

[0095] Δv = max|q(d) - q(d')|

[0096] Where q is the query function, d, d' ∈ D', D' is a set of any n - 1 object combinations, p is the probability that the attacker obtains the correct result, Δf is the sensitivity of the query function on the data set, Δv refers to the global sensitivity of the algorithm, n refers to the n tuples of the data set, and d and d’ refer to adjacent data sets.

[0097] In some embodiments, the step of encrypting the data of the numerical user data set using the HiLL reversible matrix encryption algorithm in S3 and storing the encrypted data in the database further includes:

[0098] Execute a data hot backup script to synchronously store the encrypted data in the backup database.

[0099] To ensure the security of the data storage medium, it is necessary to execute a data hot backup script to ensure that the data generated during the operation of the system is stored not only on the main server but also synchronized on the backup server.

[0100] Specifically, the users of the medical and health record management system mainly involve the following four roles: ① Ordinary users, that is, the owners of health records, have full access to the data belonging to individuals and can manage the access objects of their own health records; ② Medical professionals, mainly the users and analysts of data, including doctors, nurses, medical institution staff, researchers, etc., can access the health data within their permissions and perform certain data mining, downloading, etc.; ③ Data service center: The data service center provides data storage, computing, and analysis functions. It stores all electronic health record data and can perform specific calculations and analyses on the encrypted health data; ④ Privacy management agency: mainly responsible for the management of privacy protection.

[0101] Figure 2 The specific flowchart of the data protection method for the medical and health record management system according to the embodiments of the present invention is shown, and the specific implementation process of its privacy protection is as follows:

[0102] 1. Data collection:

[0103] The information of ordinary users can be divided into explicit identifiers (EI), quasi-identifier attribute sets (QA), and sensitive attributes (SA). EI can directly identify an individual, such as ID number, name, etc. QA is the smallest set of attributes that can be linked to an external table to identify an individual, such as postal code, birthday, gender, etc. Sensitive attributes (SA): SA are data that users do not want others to know, such as salary, disease history, purchase preferences, etc. When designing relevant information filling for ordinary users, the system can define the level of information attributes or directly make a judgment based on semantics.

[0104] 2. Data preprocessing:

[0105] The types of structured data entered by ordinary users through the management system are rich, including text type, numerical type, or boolean type, etc. Therefore, a data dictionary is needed to uniformly convert the data into numerical type. It is equivalent to setting up an intermediate table that can uniformly convert other types of data into numerical type and then perform reversible matrix encryption.

[0106] 3. Back-end data storage and import:

[0107] The implementation of the reversible matrix encryption algorithm is divided into two parts. In the encryption stage, the plaintext data D needs to generate a plaintext matrix P, and then select a key A with the same matrix dimension in the key set to perform matrix operations on P to generate an encrypted matrix M. In the decryption stage, perform matrix multiplication operations on M and A -1 to obtain P.

[0108] 1) Encryption stage

[0109] M = P · A

[0110] 2) Decryption stage

[0111] P = M · A -1

[0112] The specific process can be simulated as follows: The sender needs to encrypt the data and send it to the receiver. First, an N-dimensional vector X (the UTF-8 code value of each character) needs to be generated according to the size of the plaintext. Randomly select an N*N matrix A of the same dimension from the key matrix library. According to the rules of the reversible encryption algorithm, the ciphertext M = AX is formed. When importing, X is calculated using A, and finally, the corresponding plaintext is found according to the UTF-8 code values in X.

[0113] 4. Front-end data publishing and analysis:

[0114] Data publishing

[0115] The privacy protection of data publishing mainly deals with quasi-identifier attributes, which is the smallest set of non-identifier attributes in data attributes that can uniquely identify an individual when connected to external data. A set of tuples in a database table that contain the same values on an attribute set is called a cluster / group. For example, the attribute set {number, gender, age} in Table 1(a) is a quasi-identifier. In Table 1(b), record 2 and record 3 form a cluster with respect to the quasi-identifier {number, gender, age}, and they have the same attribute values.

[0116] Table 1(a) Original data table

[0117]

[0118]

[0119] Table 1(b) Anonymized data table

[0120] Number Gender Age Disease 4352* Male [41-45] Cancer 4352* Person [21-25] Flu 4255* Person [21-25] Cancer 4227* Male [26-30] Flu

[0121] The basic idea of implementing KL based on clustering is to find any cluster smaller than k and merge it with the cluster with the greatest similarity to form a larger cluster. Repeat this process iteratively until each cluster contains at least k (k ≤ n) data points and the sensitive values of at least l data objects are different from each other, while ensuring that the total information loss of all clusters is minimized. The clustering-based algorithm merges the cluster objects with the highest similarity and has less information loss. Therefore, clustering is used for implementation. The specific algorithm process is as follows:

[0122]

[0123]

[0124] Example of data analysis: Application of differential privacy in clustering

[0125] When initially clustering, a reference k value is given. The first clustering will use the given reference value. The classical K-means algorithm is used to preprocess the data, divide the data into clusters, and provide data support for the calculation of local sensitivity.

[0126] The privacy budget value e should satisfy the following range:

[0127]

[0128] Δv=max|q(d)-q(d′)}

[0129] Where Q is the query function, p is the probability that the attacker obtains the correct result, and Δf is the sensitivity of the query function on the dataset. For multiple queries on the same dataset, and each query satisfies m i - differential privacy.

[0130] The specific algorithm process is as follows:

[0131]

[0132]

[0133] For the method of the first aspect, first, user medical data is collected; then, the user medical data is standardized to obtain a numerical user dataset; then, the data of the numerical user dataset is encrypted using the HiLL reversible matrix encryption algorithm, and the encrypted data is stored in the database; finally, the data stored in the database is restored, and the restored data is converted into desensitized data using an improved algorithm based on K-anonymous clustering and published to the front-end display interface for visual display. According to the different stages of the data life cycle in the present invention, privacy protection can be divided into: privacy protection in data publishing, privacy protection in data storage, privacy protection in data mining, and privacy protection in data use. The present invention mainly adopts two different data encryption schemes according to the characteristics of different stages of the data life cycle: the privacy protection of front-end data is more inclined to improve the readability of data on the premise of ensuring security, and an improved algorithm based on k-anonymity is adopted; the encryption of background data is inclined to improve the value utilization rate of data during the import and export process, and reversible matrix encryption is adopted, so as to realize efficient privacy protection for medical data starting from the data life cycle.

[0134] The second aspect of the present invention provides a data protection device for a medical health record management system. Figure 3 For the structural diagram of the data protection device for a medical health record management system according to an embodiment of the present invention, as Figure 3 shown, the device 100 includes:

[0135] A data collection module 1, configured to collect user medical data, where the user medical data includes user basic information, user basic medical information, and user complete privacy information;

[0136] The standardization processing module 2 is configured to perform standardization processing on the user medical data to obtain a numerical user data set;

[0137] The encryption processing module 3 is configured to encrypt the data in the numerical user data set by using the HiLL reversible matrix encryption algorithm and store the encrypted data in the database;

[0138] And, the data publishing module 4 is configured to perform restoration processing on the data stored in the database, and convert the restored data into desensitized data by using an improved algorithm based on K-anonymous clustering, so as to publish it to the front-end display interface for visual display.

[0139] In summary, the technical solutions in various aspects of the present invention adopt two different data encryption schemes according to the characteristics of different stages of the data life cycle: the privacy protection of the front-end data is more inclined to improve the readability of the data on the premise of ensuring security, and an improved algorithm based on k-anonymity is adopted; the encryption of the background data is inclined to improve the value utilization rate of the data during the import and export process, and reversible matrix encryption is adopted, so as to realize efficient privacy protection for medical data from the perspective of the data life cycle.

[0140] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A data protection method for a medical and health record management system, characterized in that, The method includes: Collecting user medical data, where the user medical data includes user basic information, user basic medical information, and user complete privacy information; Performing standardization processing on the user medical data to obtain a numerical user data set; Using the HiLL reversible matrix encryption algorithm to encrypt the data in the numerical user data set, and storing the encrypted data in a database; Performing restoration processing on the data stored in the database, and using an improved algorithm based on K-anonymous clustering to convert the restored data into de-sensitized data for publishing to a front-end display interface for visual display; Among them, using the HiLL reversible matrix encryption algorithm to encrypt the data in the numerical user data set specifically includes: Generating a reversible matrix with a corresponding dimension according to the scale of the numerical user data set; Selecting a key matrix with the same matrix dimension as the reversible matrix from a key set; Performing matrix operations on the reversible matrix using the key matrix to obtain an encryption matrix; Among them, the encryption operation formula is: M = P·A, where M is the encryption matrix, P is the reversible matrix, and A is the key matrix; Among them, performing restoration processing on the data stored in the database specifically includes: Use the invertible matrix to decrypt the data stored in the database. The decryption operation formula is: P = M·A -1 , where M is the encryption matrix, P is the invertible matrix, and A is the key matrix; Among them, using an improved algorithm based on K-anonymous clustering to convert the restored data into de-sensitized data specifically includes: Performing generalization processing on the quasi-identifier columns and sensitive data columns in the data set D composed of the restored data to divide into equivalence classes; Setting an equivalence class number parameter threshold K and a sensitive attribute parameter threshold L; Calculate the similarity between data objects in the dataset D using the Fisher transformation and construct a similarity matrix D1. Initially, each data object is a cluster, i.e., D1 = {A1, A2, …, A n}; Select two clusters A with the greatest similarity from the similarity matrix D1 i and A j ; if |A i | + |A j | < 2K, where |A i | represents the total number of nodes in cluster A i and |A j | represents the total number of nodes in cluster A j , then merge the two clusters A i and A j into A p , otherwise, after merging the two clusters A i and A j , split them into two clusters such that |A i | and |A j | are both in the range [K, 2K); repeat until the total number of nodes in all clusters in the similarity matrix D1 is not less than K; Checking whether each cluster in the similarity matrix D1 meets the requirement of the sensitive attribute parameter threshold L; if not, under the condition that each cluster meets the equivalence class number parameter threshold K, setting the privacy protection parameter b = L / K, calculating the value of the privacy protection parameter b in each cluster respectively, and if the privacy protection parameter of the cluster is less than b, then adding or reducing the data objects in the cluster to make the cluster meet the requirement of the sensitive attribute parameter threshold L; Generating de-sensitized data and outputting it.

2. A data protection method for a medical and health record management system according to claim 1, characterized in that, Among them, Performing standardization processing on the user medical data to obtain a numerical user data set specifically includes: Establishing a data conversion dictionary according to intermediate conversion rules; Using the data conversion dictionary to convert text-type data or boolean-type data in the user medical data into numerical data.

3. A data protection method for a medical and health record management system according to claim 2, characterized in that, Among them, After the step of using the reversible matrix encryption algorithm to encrypt the data in the numerical user data set and storing the encrypted data in the database, the following steps are further included: Performing analysis processing on the data queried from the database after adding differential privacy noise.

4. A data protection method for a medical health record management system according to claim 3, characterized in that, Among them, Performing analysis processing on the data queried from the database after adding differential privacy noise specifically includes: Reading a privacy budget value from a data table in the database; Determining a local sensitivity value according to a query function and query result data; Calculating differential privacy noise data according to the privacy budget value and the local sensitivity value; Performing analysis processing on the data obtained by adding the query result data and the differential privacy noise data.

5. A data protection method for a medical and health record management system according to claim 4, characterized in that, The privacy budget value e should satisfy the following range: Δv = max|q(d) - q(d')| where q is the query function, d, d′ ∈ D', D′ is a set of any n - 1 combinations of objects, p is the probability that the attacker gets the correct result, Δf is the sensitivity of the query function on the dataset, Δv refers to the global sensitivity of the algorithm, n refers to the n tuples of the dataset, and d and d’ refer to adjacent datasets.

6. A data protection method for a medical and health record management system according to claim 5, characterized in that, where The steps of encrypting the data of the numerical user dataset using the HiLL reversible matrix encryption algorithm and storing the encrypted data in the database further include: Executing a data hot backup script to synchronously store the encrypted data in a backup database.

7. A data protection device for a medical and health record management system, characterized in that, The device includes: A data collection module configured to collect user medical data, where the user medical data includes user basic information, user basic medical information, and user complete privacy information; A normalization processing module configured to normalize the user medical data to obtain a numerical user dataset; An encryption processing module configured to encrypt the data of the numerical user dataset using the HiLL reversible matrix encryption algorithm and store the encrypted data in the database; and a data publishing module configured to restore the data stored in the database and convert the restored data into de - sensitized data using an improved algorithm based on K - anonymity clustering for visualization on a front - end display interface; where encrypting the data of the numerical user dataset using the HiLL reversible matrix encryption algorithm specifically includes: Generating a reversible matrix with a corresponding dimension according to the scale of the numerical user dataset; Selecting a key matrix with the same matrix dimension as the reversible matrix from a key set; Performing matrix operations on the reversible matrix using the key matrix to obtain an encryption matrix; where the encryption operation formula is: M = P·A, M is the encryption matrix, P is the reversible matrix, and A is the key matrix; where restoring the data stored in the database specifically includes: Decrypt the data stored in the database using the reversible matrix, where the decryption operation formula is: P = M·A -1 , where M is the encryption matrix, P is the reversible matrix, and A is the key matrix; where converting the restored data into de - sensitized data using an improved algorithm based on K - anonymity clustering specifically includes: Performing generalization processing on the quasi - identifier columns and sensitive data columns in the dataset D composed of the restored data to divide equivalent classes; Setting the equivalent class number parameter threshold K and the sensitive attribute parameter threshold L; Calculate the similarity between data objects in the dataset D using the Fisher transformation and construct a similarity matrix D1. Initially, each data object is a cluster, i.e., D1 = {A1, A2, …, A n}; Select two clusters A with the greatest similarity from the similarity matrix D1 i and A j ; if |A i | + |A j | < 2K, where |A i | represents the total number of nodes in cluster A i and |A j | represents the total number of nodes in cluster A j , then merge the two clusters A i and A j into A p ; otherwise, merge the two clusters A i and A j and then split them into two clusters such that |A i | and |A j | are both in the range [K, 2K); repeat the execution until the total number of nodes in all clusters in the similarity matrix D1 is not less than K; Checking whether each cluster in the similarity matrix D1 meets the requirement of the sensitive attribute parameter threshold L; if not, under the condition that each cluster meets the equivalent class number parameter threshold K, setting the privacy protection parameter b = L / K, calculating the value of the privacy protection parameter b for each cluster respectively, and if the privacy protection parameter of the cluster is less than b, then adding or reducing the data objects within the cluster to make the cluster meet the requirement of the sensitive attribute parameter threshold L; Generating and outputting de - sensitized data.

Images