Electronic medical record secure sharing method and system based on restricted purifiable signature

Abstract

The present invention relates to a method and system for securely sharing electronic medical records based on restricted purifiable signatures, the system comprising: a trusted institution for generating signature keys for signers and purifiers; a signer for generating and signing electronic medical records of patients, and also for defining modifiable content, the upper limit of the number of modifiable fields, and the expiration time of modifiable content; a purifier for modifying the part of the medical record that is allowed to be modified within a certain period of time, and generating a new valid signature for the modified data, and the generated signature can still be successfully verified; and a verifier for verifying the validity of the medical record submitted by the purifier, the verifier can access the medical data but cannot modify it. The method and system are conducive to improving the security of electronic medical records.

Description

Technical Field

[0001] The present invention belongs to the technical field of medical data sharing, and in particular relates to a method and system for securely sharing electronic medical records based on restricted purifiable signatures. Background Art

[0002] Electronic health records (EHR) are widely used in medical management, scientific research, and insurance claims as an effective solution to improve the quality and satisfaction of patient healthcare. Digital signature technology is currently often used to protect the authenticity and integrity of medical information. Any slight modification to the signed data will invalidate the signature, making it impossible to verify the validity of the data. However, for some scenarios where complete electronic health records are not required, allowing patients to delete certain sensitive data from the original data will help protect personal privacy. For example, when electronic health records are provided to other medical institutions or scientific institutions for research and analysis, personal information that is not related to the disease (such as address, medical insurance card number, etc.) needs to be hidden. When electronic health records are provided to insurance companies for medical claims, hiding other sensitive diseases that are not related to the claims can avoid discrimination against patients with certain diseases. One solution that can be adopted is to require doctors to sign only the part of the information that needs to be shared. However, this solution requires doctors to re-sign every time a new subset of the electronic health record is shared, which will result in high computational costs. Therefore, how to grant patients appropriate permissions to change signed medical records is an important research issue. Ideally, a signed message can be modified without even interacting with the original signer and maintaining the validity of the signature.

[0003] Sanitizable Signature Schemes (SSS) were proposed by Ateniese et al. in 2005. They allow a designated third party (Sanitizer) to change the signed data in a controlled and non-interactive way, and the generated signature can still be successfully verified. Compared with traditional digital signatures, they are more suitable for some scenarios where complete electronic medical records are not required. They grant patients certain modification rights to their own medical records and allow patients to delete certain sensitive data from the original data to protect personal privacy. Ateniese et al. introduced the security properties of SSS, including unforgeability, untamperability, privacy, transparency, and auditability. These properties are necessary for the secure sharing of medical data. Among them, unforgeability ensures that users cannot generate valid signatures without the corresponding key. Untamperability ensures that the purifier cannot modify the content without the signer's permission. Privacy ensures that no one can recover the part of the message that has been purified. Transparency ensures that the signatures calculated by the signer and the purifier are indistinguishable. Auditability ensures that malicious signers and purifiers cannot deny the message signature pairs generated by themselves. At present, most of the sanitizable signature schemes that meet auditability only allow the signer to generate proof about the generator of the message signature pair. This results in the inability to determine whether the message has been sanitized when the signer cannot generate proof due to loss of key or other reasons. Brzuska et al. proposed non-interactive public auditability, which can infer the responsible party for generating the message signature pair without the signer or purifier providing any information, solving the problem that the original scheme requires the signer's private key to reveal the responsible party. However, this auditability is too strong and cannot be satisfied at the same time as transparency. Therefore, how to define auditability of appropriate strength, while not affecting transparency, while allowing the signer and purifier to generate proofs independently is an important issue.

[0004] While purifiable signatures provide flexible and efficient operational support for medical data sharing, they can also lead to abuse of purifiers' modification permissions, which can cause fraud. For example, patients may forge medical records to defraud high insurance premiums, and fraud in the medical insurance and commercial insurance fields will seriously endanger the industry order and bring burdens to society. Therefore, limiting the permissions of purifiers is another important issue.

[0005] At present, only a few works focus on limiting the rights of purifiers. They propose extended purifiable signature schemes (Extened SSS), which reduce the ability of purifiers to modify messages by fixing the modified content to a specific set, making the same modification to different message blocks, and limiting the number of modified message blocks and the number of versions of signed messages. However, most of these schemes are not suitable for medical scenarios because the signature algorithm requires interaction or does not take into account unlinkability and invisibility. In the secure sharing of electronic medical records, unlinkability and invisibility are very important. Brzuska et al. proposed the concept of unlinkability in 2010 and used group signatures to implement a purifiable signature scheme that additionally meets unlinkability. Unlinkability ensures that the purified signature cannot be linked to the original signature. Signatures that meet unlinkability can prevent recipients of electronic medical records from colluding with each other to reconstruct complete electronic medical records.

[0006] The concept of invisibility was formally proposed by Camenisch et al. Invisibility ensures that the information on whether a message block is allowed to be modified is kept confidential to external parties that do not have the signer key and the purifier key, that is, the verifier cannot determine which message blocks are modifiable, thereby preventing the verifier from inferring the patient's sensitive information. The SaS scheme uses Equivalence Class Signature (EQS) to construct SSS, re-randomizes the message and signature to simultaneously satisfy the above two properties, and limits the number of modifiable message blocks to no more than . Purifiers falsifying medical records usually involves modifying a large number of medical record fields. Therefore, limiting the number of modifiable medical record fields, that is, the number of message blocks, can prevent purifiers from forging medical records to a certain extent.

[0007] However, none of the above works provide a time-limited purifiable signature solution. If the patient still has the right to modify the electronic medical record after being discharged from the hospital, it will lead to inconsistent medical records or cause medical disputes. Therefore, in order to further ensure the security and correctness of medical data and prevent the abuse of modification permissions, it is necessary to introduce time limits into the purifiable signature, add an expiration time to the modification operation, and only allow the medical record to be modified before the expiration time. Summary of the invention

[0008] The purpose of the present invention is to provide a method and system for securely sharing electronic medical records based on restricted purifiable signatures, which method and system are conducive to improving the security of electronic medical records.

[0009] To achieve the above purpose, the technical solution adopted by the present invention is: a method for securely sharing electronic medical records based on restricted purifiable signatures, comprising:

[0010] (1) During the system establishment phase, the trusted authority TA runs the Setup algorithm to generate the system public parameters mpk and the master key msk; and uses mpk as input to run KGen sig and KGen san algorithm, generates a key pair (pk S ,sk S ) and (pk Z ,sk Z ) and send it to the signer and the purifier respectively;

[0011] (2) In the signing phase, the signer generates the electronic medical record m of the purifier and runs the Sign algorithm to generate a signature σ for the message m at the current time t. At the same time, the signer specifies which fields in the medical record are allowed to be modified, the upper limit of the number of modifiable fields γ, and the time limit τ for the modification operation.

[0012] (3) In the purification phase, the purifier purifies the message m; the purifier specifies the message block MOD to be modified, generates a new message m′, and runs the Sanit algorithm to generate a signature σ′ for the message m′ at the current time t′;

[0013] (4) In the verification phase, the verifier runs the Verify algorithm to verify the validity of the message signature pair (m, σ). The Verify algorithm outputs a bit b, where b = 1 indicates that (m, σ) is valid, and b = 0 indicates that it is invalid.

[0014] (5) If a dispute occurs regarding the generator of the message signature pair, the signer and the purifier each generate a proof and send it to the purifier; the signer and the purifier each run Proof sig and Proof san Algorithm, generate proof π sig , π san , send it to TA to prove that he is or is not the generator of the message signature pair (m,σ); for the proof π sent by the signer sig , TA runs Judge sig Algorithm, determine the identity of the generator; if it is proved that π san From the Purifier, he / she runs Judge san Algorithm; Judge sig and Judge san The algorithm outputs the judgment d∈{Signer,Sanitizer,⊥}, d=Signer means that the message signature pair (m,σ) is generated by the signer, d=Sanitizer means that the message signature pair (m,σ) is generated by the purifier, and d=⊥ means proof π sig , π san is invalid.

[0015] Furthermore, in step (1), the Setup algorithm is expressed as: ; Input security parameter λ, equivalence class representative size l and time length , TA selects bilinear pairings in and is a multiplicative cyclic group of prime order p; the generators are chosen randomly Choosing a hash function Then, TA generates a BBS+ key pair and randomly selects calculate TA publishes system public parameters Secret master key msk = x TA ;

[0016] KGen sig The algorithm is expressed as: (pk S ,sk S )←KGen sig (mpk); input the system public parameter mpk, TA generates a key pair for the signer (pk S ,sk S ); the key pair (pk S ,sk S ) includes key pairs for equivalence class signatures, key pairs for verifiable ring signatures, and key pairs for BBS+ signatures;

[0017] KGen san The algorithm is expressed as: (pk Z ,sk Z )←KGen san (mpk); input the system public parameter mpk, TA generates a key pair for the purifier (pk Z ,sk Z ); the key pair (pk Z ,sk Z ) includes a key pair for public key encryption and a key pair for verifiable ring signature.

[0018] Furthermore, the key pair (pk S ,sk S ), the key pair for the equivalent class signature is generated by randomly selecting Definition of sk EQS =(x i ) i∈[1,l] ,

[0019] The key pair for verifiable ring signature is generated by randomly selecting Definition of sk VRS =a,pk VRS =ga ;

[0020] The method for generating the key pair for BBS+ signature is: random selection As the private key, calculate the public key

[0021] The output key pair (pk S ,sk S ), pk S =(pk EQS ,pk VRS ,vk Sig ), sk S =(sk EQS ,sk VRS ,x Sig ).

[0022] Furthermore, the key pair (pk Z ,sk Z ), the method for generating the key pair for public key encryption is: randomly select Definition of ssk PKE =β,

[0023] The key pair for verifiable ring signature is generated by randomly selecting definition

[0024] The output key pair (pk Z ,sk Z ), pk Z =(spk PKE ,spk VRS ), sk Z =(ssk PKE ,ssk VRS ).

[0025] Furthermore, in step (2), the signer generates a signature σ for the message m at the current time t; the signer generates a commitment C and proofs π1 and π2 about the commitment for the message content and restrictions, as well as proof π3 that the current time does not exceed the expiration time, that is, t<τ. The above proofs use non-interactive zero-knowledge proofs; then, the signer performs an equivalence signature on the commitment C, encrypts some information required by the purifier, and finally performs a ring signature on the above content;

[0026] The Sign algorithm is expressed as: (m,σ)←Sign(mpk,sk S ,pk Z ,m,ADM,γ,τ,t); its specific implementation method is:

[0027] (1) The signer divides the message m into n blocks m1||…||m n ; Generate message block m i and commitments with restrictions γ; random selection Calculate C1 = H(γ) δ ; For each message block m i , calculate C 2,i =H(i||m i ) δ ; If i∈ADM, calculate C 3,i =F(i) δ , otherwise C 3,i =F(i||m i ) δ ;

[0028] (2) Prove that the purified message block is a message block that allows modification, that is, for each message block m i , C 3,i =F(i) δ or C 3,i =F(i||m i ) δ ; Generate proof:

[0029]

[0030] Random Selection If C 3,i =F(i) δ , randomly selected calculate Otherwise, randomly select remember

[0031] (3) Prove that the number of purified message blocks does not exceed γ, that is, prove So that C1=H(i) δ , and there is a message block set J of size ni among the n message blocks, for Satisfy C 2,j =H(j||m j ) δ ; Generate proof:

[0032]

[0033] Where, [n] = {1, 2, ..., n};

[0034] For i = γ, randomly select calculate Select the first ni that satisfy C 2,j =H(j||m j ) δmessage blocks, randomly selected calculate For the remaining i message blocks, randomly select calculate

[0035] For i≠γ, randomly choose calculate Randomly select i message blocks, assuming they are the first i, for j∈[1,i], randomly select calculate Use i+1 points and Construct the Lagrange polynomial P of degree i i (x); for j∈[i+1,n], calculate Random Selection calculate get

[0036] calculate

[0037] For i = γ, use i + 1 points and Construct the Lagrange polynomial P of degree i i (x); for j∈J, calculate get

[0038] get

[0039] (4) Set the expiration time of the signature to τ, and prove that the current time t does not exceed the expiration time τ; the signer calculates the BBS+ signature of τ, first calculating , then calculate ,in Order expiration time information ;

[0040] The signer requests the information of the current time t from TA; TA calculates , and calculate the BBS+ signature of t ,in TA command current time information , send it to the signer;

[0041] If t<τ, then there exists , so that τ k =t k , then The signer calculates the k ,B k,t Commitment, randomly selected calculate The signer sets β1 = ρ1ξ k , β2=ρ2ξ′ k,t , generate proof

[0042]

[0043] Random Selection calculate calculate calculate get

[0044] (5) For commitment C = (C1, {C 2,i} i∈[1,n] ,{C 3,i} i∈[1,n] ) to perform equivalence class signature; map C to the equivalence class representative Random Selection calculate Get the equivalence class signature

[0045] (6) Encrypted signature expiration time information ei, commitment C, exponent δ and equivalence class signature σ EQS ; Remember M PKE =(ei,C,δ,σ EQS ), randomly select u←{0,1} λ ,calculate get in

[0046] (7) Perform a verifiable ring signature on the above content; record M VRS =(m||C||π1||π2||π3||σ EQS ||e); Random selection Calculate h = H (M VRS ||r), Generate about or Proof of; Random Selection calculate remember Get a verifiable ring signature σ VRS =(r,w,π4);

[0047] Output signature σ = (C, π1, π2, π3, σ EQS ,σ VRS ,e).

[0048] Furthermore, in step (3), the purifier purifies the message m to obtain a new message m′, and generates a signature σ′ for the message m′ at the current time t′; the purifier first decrypts the ciphertext e, obtains the partial information required for purification and re-encrypts it; then re-randomizes the commitment and updates the equivalence class signature; then, the purifier proves that the purified message block is a message block that is allowed to be modified, the number of purified message blocks does not exceed γ, and the current time t′ does not exceed the expiration time τ, and generates proofs π′1, π′2, π′3, and finally the purifier performs a ring signature on the above content;

[0049] The Sanit algorithm is expressed as: (m′,σ′)←Sanit(mpk,pk S ,sk Z ,m,σ,MOD,t′); its specific implementation method is:

[0050] (1) The purifier purifies the message to obtain m′←MOD(m);

[0051] (2) Decryption obtains the expiration time information, the original commitment and its exponent, and the equivalent class signature; Calculation if but Otherwise return ⊥;

[0052] (3) Re-randomization commitment; random selection Let δ′ = μ·δ, calculate , we get C′=(C′1,{C′ 2,i} i∈[1,n] ,{C′ 3,i} i∈[1,n] );

[0053] (4) Update the equivalence class signature; the new equivalence class is represented by Random Selection Generate a new signature

[0054] (5) Re-encrypt the expiration time information ei, the original commitment C and its exponent δ, and the equivalent class signature σ EQS ; Random selection Calculated

[0055] (6) Prove that the purified message block is a message block that allows modification, that is, for each message block m i , C′ 3,i =F(i) δ′ or C′ 3,i =F(i||m′ i ) δ′ ; Prove the same signing process; get

[0056] (7) Prove that the number of purified message blocks does not exceed γ, that is, prove So that C′1=H(i) δ′ , and there is a message block set J of size ni among the n message blocks, for Satisfy C′ 2,j =H(j||m′ j ) δ′ ; Prove the same signing process; get

[0057] (8) Prove that the current time t′ does not exceed the expiration time τ; the purifier requests the information of the current time t′ from TA ; The purifier proves t′<τ, proving the same signing process; get

[0058] (9) Perform a verifiable ring signature on the above content; record M′ VRS =(m′||C′||π′1||π′2||π′3||σ′ EQS ||e′), randomly selected Calculate h′=H(M′ VRS ||r′), Generate about or Proof of; Random Selection calculate remember Get a verifiable ring signature σ′ VRS =(r′,w′,π′4);

[0059] Output signature σ′=(C′,π′1,π′2,π′3,σ′ EQS ,σ′ VRS ,e′).

[0060] Furthermore, in step (4), the Verify algorithm is expressed as: b←Verify(mpk,pk S ,pk Z ,m,σ,t); its specific implementation method is:

[0061] (1) Verification For each message block m i ,if If not, the proof is invalid and 0 is returned;

[0062] (2) Verification

[0063] ①For i∈[1,n], verify P i(x) whether it is an i-th degree polynomial;

[0064] ②For i∈[1,n], verify whether

[0065] ③For i∈[1,n], j∈[1,n], verify whether and

[0066] ④Verify whether it meets

[0067] If any of the above conditions is not met, the proof is invalid and 0 is returned;

[0068] (3) Verification Recalculate

[0069] if If not, the proof is invalid and 0 is returned;

[0070] (4) Verify the equivalence class signature if If not, the signature is invalid and 0 is returned;

[0071] (5) Verify the ring signature σ VRS =(r,w,π4); calculate h =(M VRS ||r), if If not, the signature is invalid and 0 is returned;

[0072] If all the above conditions are met, the message signature pair is valid and 1 is returned.

[0073] Furthermore, in step (5), if there is a dispute regarding the generator of the message signature pair, the signer and the purifier each generate a certificate and send it to TA, and TA determines the identity of the generator based on the certificate;

[0074] Proof sig The algorithm is expressed as: sig ←Proof sig (mpk,sk S ,pk S ,m,σ); the specific implementation method is: the signer parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); Calculate and Generate about Proof of; Random Selection calculate s π =r π -sk VRS ·c π , output

[0075] Proof san The algorithm is expressed as: san ←Proof san (mpk,sk Z ,pk Z ,m,σ); the specific implementation method is: the purifier parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); Calculate and Generate about Proof of; Random Selection calculate s π =r π -ssk VRS ·c π , output

[0076] Judge sig The algorithm is expressed as: d←Judge sig (mpk,pk S ,m,σ,π sig ); Its specific implementation method is: TA parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); TA analysis to obtain calculate Verify Proof π sig Validity: If This means that π sig is valid, that is, π sig Generated by the signer; if This means that the generator of signature σ and π sig If the generator is consistent, return Signer, otherwise return Sanitizer;

[0077] Judge san The algorithm is expressed as: d←Judge san (mpk,pk Z ,m,σ,π san ); Its specific implementation method is: TA parses the signature σ and obtains σVRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); TA analysis to obtain calculate Verify Proof π san Validity: If This means that π san is valid, that is, π san Generated by the Purifier; if This means that the generator of signature σ and π san If the generator is consistent, return Sanitizer, otherwise return Signer.

[0078] The present invention also provides an electronic medical record secure sharing system based on restricted purgeable signatures for implementing the above method, comprising:

[0079] Trusted authority, used to generate signing keys for signers and purifiers;

[0080] Signer, used to generate and sign the patient's electronic medical record, and also used to define the content that can be modified, the upper limit of the number of fields that can be modified, and the deadline for modification;

[0081] Purifiers, which are used to modify the allowed parts of the medical records within a certain period of time and generate new valid signatures for the modified data, and the generated signatures can still be successfully verified; and

[0082] Verifier, used to verify the validity of medical records submitted by purifiers. Verifiers can access medical data but cannot modify it.

[0083] Furthermore, the signer is a doctor's terminal, the purifier is a semi-trusted third-party terminal authorized by the signer, including a patient terminal and an electronic medical record information system administrator terminal, and the verifier is a sharing entity of medical data, including medical institutions, insurance companies and scientific research institutions.

[0084] Compared with the prior art, the present invention has the following beneficial effects: In view of the problems that the existing purifiable signature schemes do not impose time limits on the purifier's authority, cannot simultaneously meet multiple security attributes (including immutability, transparency, unlinkability, invisibility and auditability of appropriate strength), and are not suitable for medical data sharing scenarios, the present invention proposes a method and system for secure sharing of electronic medical records based on restricted purifiable signatures, which supports patients' controllable modification of their own electronic medical records: in the system, doctors generate and sign patients' medical records, allowing patients to modify certain specific fields of the medical records specified by the doctor within the expiration time τ, and the number of modified fields does not exceed γ; patients can convert the signature of the original medical record into a new signature of the modified medical record without interacting with the doctor, and the new signature is indistinguishable from the original signature. Moreover, the purifiable signature of the present invention supports time and quantity restrictions: the signer can decide which fields' data can be modified and decide the upper limit of the number of modified fields; on the other hand, the purifier can only modify the data of some allowed fields before a limited time point. The present invention satisfies the requirements of tamper-proof, transparency, unlinkability and invisibility at the same time: patients can only modify medical records within the scope specified by doctors. The recipients of the purified medical records (scientific research institutions, insurance companies, etc.) cannot determine whether the medical records have been purified, whether the medical records they obtained are from the same patient, or which fields of the medical records are modifiable. This protects the privacy and security of patients. In addition, the present invention satisfies strong auditability: the system allows signers and purifiers to independently generate proofs to prove whether they are or are not the generators of the message signature pairs, that is, neither doctors nor patients can deny the message signature pairs generated by themselves. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] Figure 1 It is a schematic diagram of the system model architecture of an embodiment of the present invention. DETAILED DESCRIPTION

[0086] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0087] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0088] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0089] This embodiment provides a method and system for securely sharing electronic medical records based on restricted purgeable signatures. The system model is as follows: Figure 1 As shown, the system includes four types of entities, namely: trusted authority, signer, purifier and verifier.

[0090] (1) Trusted Authority (TA)

[0091] The trusted authority is completely honest and is responsible for generating signing keys for signers and purifiers.

[0092] (2) Signer

[0093] The signer is responsible for generating and signing the patient's electronic medical record. The signer can define the modifiable content, the upper limit of the number of modifiable fields, and the modifiable deadline. In this embodiment, the signer is the terminal where the doctor is located.

[0094] (3) Sanitizer

[0095] The purifier can modify the allowed parts of the medical record within a certain period of time and generate a new valid signature for the modified data, and the signature can still be successfully verified. The purifier is usually a semi-trusted third-party terminal authorized by the signer, such as the terminal where the patient is located, or the terminal where the administrator of the EHR information system is located.

[0096] (4) Verifier

[0097] Verifiers can verify the validity of medical records submitted by patients. Verifiers can access medical data but cannot modify it. Verifiers are usually other entities that share medical data, such as medical institutions, insurance companies, and scientific research institutions.

[0098] The method for securely sharing electronic medical records based on restricted purgeable signatures provided in this embodiment includes:

[0099] (1) During the system establishment phase, the trusted authority TA runs the Setup algorithm to generate the system public parameters mpk and the master key msk; and uses mpk as input to run KGen sig and KGen san algorithm, generates a key pair (pkS ,sk S ) and (pk Z ,sk Z ) and sends it to the signer and purifier respectively.

[0100] (2) In the signing phase, the signer generates the electronic medical record m of the purifier and runs the Sign algorithm to generate a signature σ for the message m at the current time t. At the same time, the signer specifies which fields in the medical record are allowed to be modified (setting ADM), the upper limit γ on the number of fields that can be modified, and the time limit τ for the modification operation.

[0101] (3) In the purification phase, the purifier purifies the message m; the purifier specifies the message block MOD to be modified, generates a new message m′, and runs the Sanit algorithm to generate a signature σ′ for the message m′ at the current time t′.

[0102] (4) In the verification phase, the verifier runs the Verify algorithm to verify the validity of the message signature pair (m, σ); the Verify algorithm outputs a bit b, b = 1 indicates that (m, σ) is valid, and b = 0 indicates that it is invalid.

[0103] (5) If a dispute occurs regarding the generator of the message signature pair, the signer and the purifier each generate a proof and send it to the purifier; the signer and the purifier each run Proof sig and Proof san Algorithm, generate proof π sig , π san , send it to TA to prove that he is or is not the generator of the message signature pair (m,σ); for the proof π sent by the signer sig , TA runs Judge sig Algorithm, determine the identity of the generator; if it is proved that π san From the Purifier, he / she runs Judge san Algorithm; Judge sig and Judge san The algorithm outputs the judgment d∈{Signer,Sanitizer,⊥}, d=Signer means that the message signature pair (m,σ) is generated by the signer, d=Sanitizer means that the message signature pair (m,σ) is generated by the purifier, and d=⊥ means proof π sig , π san is invalid.

[0104] 1. System establishment

[0105] The system establishment phase includes three algorithms: Setup, KGen sig and KGen san , all executed by TA.

[0106] The Setup algorithm is expressed as: ; Input security parameter λ, equivalence class representative size l and time length , TA selects bilinear pairings in and is a multiplicative cyclic group of prime order p; the generators are chosen randomly Choosing a hash function Then, TA generates a BBS+ key pair and randomly selects calculate TA publishes system public parameters Secret master key msk = x TA .

[0107] KGen sig The algorithm is expressed as: (pk S ,sk S )←KGen sig (mpk); input the system public parameter mpk, TA generates a key pair for the signer (pk S ,sk S ); the key pair (pk S ,sk S ) includes key pairs for equivalence class signatures, key pairs for verifiable ring signatures, and key pairs for BBS+ signatures.

[0108] Key pair (pk S ,sk S ), the key pair for the equivalent class signature is generated by randomly selecting Definition of sk EQS =(x i ) i∈[1,l] ,

[0109] The key pair for verifiable ring signature is generated by randomly selecting Definition of sk VRS =a,pk VRS =g a .

[0110] The method for generating the key pair for BBS+ signature is: random selection As the private key, calculate the public key

[0111] The output key pair (pk S ,sk S ), pk S =(pk EQS ,pk VRS ,vkSig ), sk S =(sk EQS ,sk VRS ,x Sig ).

[0112] KGen san The algorithm is expressed as: (pk Z ,sk Z )←KGen san (mpk); input the system public parameter mpk, TA generates a key pair for the purifier (pk Z ,sk Z ); the key pair (pk Z ,sk Z ) includes a key pair for public key encryption and a key pair for verifiable ring signature.

[0113] Key pair (pk Z ,sk Z ), the method for generating the key pair for public key encryption is: randomly select Definition of ssk PKE =β,

[0114] The key pair for verifiable ring signature is generated by randomly selecting definition

[0115] The output key pair (pk Z ,sk Z ), pk Z =(spk PKE ,spk VRS ), sk Z =(ssk PKE ,ssk VRS ).

[0116] 2. Signature

[0117] The signer generates a signature σ for the message m at the current time t; the signer generates a commitment C and proofs π1 and π2 about the commitment for the message content and restrictions, as well as proof π3 that the current time does not exceed the expiration time, that is, t<τ. The above proofs use non-interactive zero-knowledge proofs; then, the signer performs an equivalence class signature on the commitment C, encrypts some information required by the purifier, and finally performs a ring signature on the above content.

[0118] The Sign algorithm is expressed as: (m,σ)←Sign(mpk,sk S ,pk Z ,m,ADM,γ,τ,t); its specific implementation method is:

[0119] (1) The signer divides the message m into n blocks m1||…||m n ; Generate message block m i and commitments with restrictions γ; random selection Calculate C1 = H(γ) δ ; For each message block m i , calculate C 2,i =H(i||m i ) δ ; If i∈ADM, calculate C 3,i =F(i) δ , otherwise C 3,i =F(i||m i ) δ .

[0120] (2) Prove that the purified message block is a message block that allows modification, that is, for each message block m i , C 3,i =F(i) δ or C 3,i =F(i||m i ) δ ; Generate proof:

[0121]

[0122] Random Selection If C 3,i =F(i) δ , randomly selected calculate Otherwise, randomly select remember

[0123] (3) Prove that the number of purified message blocks does not exceed γ, that is, prove So that C1=H(i) δ , and there is a message block set J of size ni among the n message blocks, for Satisfy C 2,j =H(j||m j ) δ ; Generate proof:

[0124]

[0125] Where [n] = {1, 2, ..., n}.

[0126] For i = γ, randomly select calculate Select the first ni that satisfy C 2,j =H(j||m j ) δmessage blocks, randomly selected calculate For the remaining i message blocks, randomly select calculate

[0127] For i≠γ, randomly choose calculate Randomly select i message blocks, assuming they are the first i, for j∈[1,i], randomly select calculate Use i+1 points and Construct the Lagrange polynomial P of degree i i (x); for j∈[i+1,n], calculate Random Selection calculate get

[0128] calculate

[0129] For i = γ, use i + 1 points and Construct the Lagrange polynomial P of degree i i (x); for j∈J, calculate get

[0130] get

[0131] (4) Set the expiration time of the signature to τ, and prove that the current time t does not exceed the expiration time τ; the signer calculates the BBS+ signature of τ, first calculating , then calculate ,in Order expiration time information .

[0132] The signer requests the information of the current time t from TA; TA calculates , and calculate the BBS+ signature of t in TA command current time information , and send it to the signer.

[0133] If t<τ, then there exists , so that τ k =t k , then The signer calculates the k ,B k,t Commitment, randomly selected calculate The signer sets β1 = ρ1ξ k , β2=ρ2ξ′ k,t , generate proof

[0134]

[0135] Random Selection calculate calculate calculate get

[0136] (5) For commitment C = (C1, {C 2,i} i∈[1,n] ,{C 3,i} i∈[1,n] ) to perform equivalence class signature; map C to the equivalence class representative Random Selection calculate Get the equivalence class signature

[0137] (6) Encrypted signature expiration time information ei, commitment C, exponent δ and equivalence class signature σ EQS ; Remember M PKE =(ei,C,δ,σ EQS ), randomly select u←{0,1} λ ,calculate get in

[0138] (7) Perform a verifiable ring signature on the above content; record M VRS =(m||C||π1||π2||π3||σ EQS ||e); Random selection Calculate h = H (M VRS ||r), Generate about or Proof of; Random Selection calculate remember Get a verifiable ring signature s VRS =(r,w,π4).

[0139] Output signature σ = (C, π1, π2, π3, σ EQS ,σ VRS ,e).

[0140] 3. Purification

[0141] The purifier purifies the message m to obtain a new message m′, and generates a signature σ′ for the message m′ at the current time t′; the purifier first decrypts the ciphertext e, obtains part of the information required for purification and re-encrypts it; then re-randomizes the commitment and updates the equivalence class signature; then, the purifier proves that the purified message block is a message block that is allowed to be modified, the number of purified message blocks does not exceed γ, and the current time t′ does not exceed the expiration time τ, generates proofs π′1, π′2, π′3, and finally the purifier ring signs the above content.

[0142] The Sanit algorithm is expressed as: (m′,σ′)←Sanit(mpk,pk S ,sk Z ,m,σ,MOD,t′); its specific implementation method is:

[0143] (1) The purifier purifies the message and obtains m′←MOD(m).

[0144] (2) Decryption obtains the expiration time information, the original commitment and its exponent, and the equivalent class signature; Calculation if but Otherwise return ⊥.

[0145] (3) Re-randomization commitment; random selection Let δ′ = μ·δ, calculate We get C′=(C′1,{C′ 2,i} i∈[1,n] ,{C′ 3,i} i∈[1,n] ).

[0146] (4) Update the equivalence class signature; the new equivalence class is represented by Random Selection Generate a new signature

[0147] (5) Re-encrypt the expiration time information ei, the original commitment C and its exponent δ, and the equivalent class signature σ EQS ; Random selection Calculated

[0148] (6) Prove that the purified message block is a message block that allows modification, that is, for each message block m i , C′ 3,i =F(i) δ′ or C′ 3,i =F(i||m′ i ) δ′ ; Prove the same signing process; get

[0149] (7) Prove that the number of purified message blocks does not exceed γ, that is, prove So that C′1=H(i) δ′ , and there is a message block set J of size ni among the n message blocks, for Satisfy C′ 2,j =H(j||m′ j ) δ′ ; Prove the same signing process; get

[0150] (8) Prove that the current time t′ does not exceed the expiration time τ; the purifier requests the information of the current time t′ from TA ; The purifier proves t′<τ, proving the same signing process; get

[0151] (9) Perform a verifiable ring signature on the above content; record M′ VRS =(m′||C′||π′1||π′2||π′3||σ′ EQS ||e′), randomly selected Calculate h′=H(M′ VRS ||r′), Generate about or Proof of; Random Selection calculate remember Get a verifiable ring signature σ′ VRS =(r′,w′,π′4).

[0152] Output signature σ′=(C′,π′1,π′2,π′3,σ′ EQS ,σ′ VRS ,e′).

[0153] 4. Verification

[0154] The verifier verifies the validity of the message signature pair (m,σ).

[0155] The Verify algorithm is expressed as: b←Verify(mpk,pk S ,pk Z ,m,σ,t); its specific implementation method is:

[0156] (1) Verification For each message block m i ,if If not, the proof is invalid and 0 is returned.

[0157] (2) Verification

[0158] ①For i∈[1,n], verify P i (x) whether it is an i-th degree polynomial;

[0159] ②For i∈[1,n], verify whether

[0160] ③For i∈[1,n], j∈[1,n], verify whether and

[0161] ④Verify whether it meets

[0162] If any of the above conditions is not met, the proof is invalid and 0 is returned.

[0163] (3) Verification Recalculate if If not, the proof is invalid and 0 is returned.

[0164] (4) Verify the equivalence class signature if If not, the signature is invalid and 0 is returned.

[0165] (5) Verify the ring signature σ VRS =(r,w,π4); calculate h =(M VRS ||r), if If not, the signature is invalid and 0 is returned.

[0166] If all the above conditions are met, the message signature pair is valid and 1 is returned.

[0167] 5. Message signature arbitration for the identity of the generator

[0168] If a dispute occurs regarding the generator of the message signature pair, the signer and the purifier each generate a proof and send it to TA, who then determines the identity of the generator based on the proof.

[0169] Proof sig The algorithm is expressed as: sig ←Proof sig (mpk,sk S ,pk S ,m,σ); the specific implementation method is: the signer parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); Calculate and Generate about Proof of; Random Selection calculate s π =r π -sk VRS ·c π , output

[0170] Proof san The algorithm is expressed as: san ←Proof san (mpk,sk Z ,pk Z ,m,σ); the specific implementation method is: the purifier parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); Calculate and Generate about Proof of; Random Selection calculate s π =r π -ssk VRS ·c π , output

[0171] Judge sig The algorithm is expressed as: d←Judge sig (mpk,pk S ,m,σ,π sig ); Its specific implementation method is: TA parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); TA analysis to obtain calculate Verify Proof π sig Validity: If This means that π sig is valid, that is, π sig Generated by the signer; if This means that the generator of signature σ and π sig If the generator is consistent, return Signer, otherwise return Sanitizer.

[0172] Judge san The algorithm is expressed as: d←Judge san (mpk,pk Z,m,σ,π san ); Its specific implementation method is: TA parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); TA analysis to obtain calculate Verify Proof π san Validity: If This means that π san is valid, that is, π san Generated by the Purifier; if This means that the generator of signature σ and π san If the generator is consistent, return Sanitizer, otherwise return Signer.

[0173] The variable symbols and their meanings involved in the implementation of the above method are shown in Table 1 below.

[0174] Table 1 Symbolic variables

[0175]

[0176]

[0177]

[0178] The following is a further explanation of the relevant technical contents involved in the implementation of the above method.

[0179] 1. Bilinear group mapping

[0180] Let the bilinear pairing in and is a multiplicative cyclic group of order p, with g1, g2 and g as their generators. Meet the following characteristics:

[0181] Bilinearity:

[0182] Non-degeneracy:

[0183] if and and If there is no valid computable isomorphism between It belongs to Type-3 pairing.

[0184] 2. Non-Interactive Zero-Knowledge Proof (NIZKP)

[0185] language The non-interactive zero-knowledge proof consists of a pair of algorithms (Prove, Verify):

[0186] Prove(s,w): Input evidence w, output about Proof of π.

[0187] Verify(s,π): Checks whether π is about Valid proof.

[0188] Non-interactive zero-knowledge proofs must satisfy the following properties:

[0189] Soundness: No adversaries It can output (x,π) with non-negligible probability, where Verify(x,π)=1 ​​and

[0190] Completeness: For any statement And its evidence w, Verify(s,Prove(s,w))=1.

[0191] Zero-Knowledge: For any statement The verifier does not know any other information except that the statement is correct. If an honest prover uses the PPT simulator Sim to forge a statement about Proof, then it is indistinguishable from the real proof process, that is, Verify(s,Prove(s,w))≈Sim(s).

[0192] 3. Equivalence Class Signature (EQS)

[0193] The equivalence class signature algorithm defines a message as an equivalence class representative on a group element vector. Different equivalence class representatives can be obtained by randomizing the message. It allows users to modify the signature on a certain equivalence class representative to a new signature on another representative of the same equivalence class without holding the key, and the signatures on different equivalence class representatives are difficult to distinguish from the signatures on random messages. The formal definition of the equivalence class signature is as follows:

[0194] (pk,sk)←KeyGen(BG,1 l ): Key generation algorithm, input bilinear group description The equivalence class represents the length l (l>1), and outputs the public and private key pair (pk, sk).

[0195] Signature algorithm, input message and private key sk, output equivalence class The signature σ on .

[0196] Signature verification algorithm, input message Signature σ and public key pk, if the signature σ is valid, then output b=1, otherwise output b=0.

[0197] Represents modification of the algorithm, input message Signature σ, scalar m and public key pk, output equivalence class The new signature σ′ on .

[0198] b←VKey(sk,pk): key verification algorithm, input public key pk and private key sk, if the public and private keys are consistent, then output b=1, otherwise output b=0.

[0199] 4. Verifiable Ring Signature (VRS)

[0200] The verifiable ring signature algorithm allows users in a group to sign messages anonymously, and users can prove to the verifier that they are / are not the signer of a given message. The formal definition of a verifiable ring signature is as follows:

[0201] pp←Init(1 k ): Initialize the algorithm, input security parameter k, and output public parameter

[0202] (pk,sk)←Gen(pp): key generation algorithm, input public parameter pp, output public-private key pair (pk,sk).

[0203] σ←Sig(L,m,sk): Signature algorithm, which inputs the ring L, the message m and the private key sk of a user in the ring, and outputs the signature σ.

[0204] b←Ver(L,m,σ): verification algorithm, input ring L, message m and signature σ, if the signature σ is valid, then output b=1, otherwise output b=0.

[0205] π←Proof(L,m,σ,pk,sk): Evidence generation algorithm, which inputs ring L, message m, signature σ, and the user's public key pk and private key sk, and outputs evidence π.

[0206] b←Judge(L,m,σ,pk,π): The judgment algorithm takes the ring L, message m, signature σ, user’s public key pk and evidence π as input. If the signature σ is generated by the user corresponding to pk, then the output is b=1, otherwise the output is b=0.

[0207] 5. 0 / 1 encoding technology

[0208] make for -bit binary string, where t [i] represents the i-th bit of t. The zero encoding of t is defined as the set , the 1-coding of t is defined as the set . If and only if and There is exactly one common element, x>y.

[0209] For example, x=11012, y=01102, then {“0111”, “1”}←0-ENC(y), {“1101”, “11”, “1”}←1-ENC(x). Set (or ) have different lengths, so we need to align them first and then determine whether they have the same elements. After alignment, we get {0111,xxx,xx,1} and {1101,yyy,11,1}, where "xx", "xxx", and "yyy" are virtual strings just for visual alignment. We can see that since x=11012>y=01002, the two sets have a common element "1". In order to apply this encoding scheme to this scheme, we need to map the binary string to , and the mapping must be one-to-one.

[0210] Theorem 1: x>y if and only if two sets and There happens to be one common element.

[0211] 6. BBS+Signature (Boneh-Boyen+Signature)

[0212] The BBS+ signature scheme allows signing L messages and is unforgeable against chosen message attacks under the q-SDH assumption. Let g,h0,h1,…,g L yes The generator of yes The generator of It is a bilinear map. It is proved that the BBS+ signature under q-SDH assumption satisfies the unforgeability against the adaptive selected message attack.

[0213] The BBS+ signature scheme is as follows:

[0214] Key generation: Random selection make Verification key vk=w, secret key sk=γ.

[0215] Signature: For the message Random Selection And calculate Output signature σ = (A, ξ, ζ).

[0216] Verification: For a signature σ=(A,ξ,ζ) and a message (m1,…,m L ),if If true, output 1, otherwise output 0.

[0217] The electronic medical record secure sharing method and system based on restricted purifiable signatures provided by the present invention have the following advantages:

[0218] (1) Support flexible modification operations. The system allows a designated third party to make controlled changes to the signed message and generate a new signature, and the new signature can still be successfully verified. In medical scenarios, this feature can conveniently and safely achieve secondary use of medical data. When the doctor is the signer and the patient is the purifier, the patient can desensitize or anonymize his or her electronic medical record before submitting it to a third party such as a scientific research institution or insurance company for use.

[0219] (2) Strict modification control. The system allows signers to regulate the modification behavior of purifiers and restrict the modification permissions of purifiers. Signers can specify which message blocks are allowed to be modified, and determine the upper limit of the number of message blocks that can be modified, as well as the deadline for modification operations. These restrictions prevent purifiers from abusing modification permissions and generating false messages.

[0220] (3) Complete security properties. The purifiable signature proposed by the system satisfies the properties of immutability, transparency, unlinkability and invisibility at the same time, which are very important for medical data sharing. Immutability ensures that the purifier can only change the message within a limited range. Transparency ensures that the verifier cannot determine whether the message has been purified. Unlinkability ensures that the verifier cannot collude with each other to reconstruct the original message. Invisibility ensures that the verifier cannot determine which message blocks are modifiable, nor can it infer the expiration time of the purification operation. The equivalence class signature scheme and BBS+ signature scheme adopted by the present invention meet the unforgeability, and the zero-knowledge proof used meets the robustness, so the system has immutability. The present invention uses the same method to calculate each part of the signature and uses the ring signature scheme to sign anonymously, so it meets transparency. The present invention uses the equivalence class signature scheme to sign the commitment. According to the properties of the equivalence class signature, it can be seen that the purifier can re-randomize the commitment (recalculate the index) and update the equivalence class signature. In addition to the commitment and equivalence signature, the other parts of the signature (proof, verifiable ring signature, ciphertext) are also regenerated, so the signatures before and after purification cannot be linked, satisfying the unlinkability. The present invention hides the information about whether the message block is allowed to be modified and the restrictions in the commitment, and encrypts the expiration time information. Due to the use of zero-knowledge proof and public key encryption scheme, this information will not be leaked to the verifier, thus satisfying the invisibility.

[0221] (4) Signature traceability. The present invention satisfies strong auditability. When a dispute occurs, the identity of the generator of the message signature pair can be arbitrated by the TA. Strong auditability is also suitable for medical data sharing, as it allows the signer and the purifier to independently prove that they are / are not the generator of the message signature pair, and does not conflict with transparency.

[0222] For some situations in which complete electronic medical records are not required in medical data sharing scenarios, there are currently many solutions that use purifiable signatures to achieve privacy protection. However, these studies generally do not consider the problem of abuse of modification permissions by purifiers, and there is a risk of fraud. At the same time, the security properties of these solutions are lacking. The present invention provides a method and system for secure sharing of electronic medical records based on restricted purifiable signatures, which has modification restrictions, including modification quantity and modification time restrictions. The original signer can not only decide which message blocks are allowed to be modified, but also decide the upper limit of the number of modifications of the message blocks and the deadline for the modification operation, which largely regulates the purification behavior of the purifier and prevents abuse of authority. At the same time, the present invention meets multiple security properties, ensuring that the recipient cannot infer the sensitive information of the shared file, further ensuring privacy security, and is more suitable for medical data sharing. The present invention achieves strong auditability, and the signer and the purifier can independently prove whether they are or are not the generator of the message signature pair, thereby preventing disputes. If there is malicious modification behavior, the purifier will not be able to deny it, and the system can hold it accountable.

[0223] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0224] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0225] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1A function specified in one or more boxes.

[0226] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0227] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims

1. A method for securely sharing electronic medical records based on restricted purgeable signatures, characterized in that: include: (1) During the system establishment phase, the trusted authority TA runs the Setup algorithm to generate system public parameters mpk and master key msk; And run KGen respectively with mpk as input sig and KGen san algorithm, generates a key pair (pk S ,sk S ) and (pk Z ,sk Z ) and send it to the signer and the purifier respectively; (2) In the signing phase, the signer generates the electronic medical record m of the purifier and runs the Sign algorithm to generate a signature σ for the message m at the current time t. At the same time, the signer specifies which fields in the medical record are allowed to be modified, the upper limit of the number of modifiable fields γ, and the time limit τ for the modification operation. (3) In the purification phase, the purifier purifies the message m; the purifier specifies the message block MOD to be modified, generates a new message m′, and runs the Sanit algorithm to generate a signature σ′ for the message m′ at the current time t′; (4) In the verification phase, the verifier runs the Verify algorithm to verify the validity of the message signature pair (m, σ). The Verify algorithm outputs a bit b, where b = 1 indicates that (m, σ) is valid, and b = 0 indicates that it is invalid. (5) If a dispute occurs regarding the generator of the message signature pair, the signer and the purifier each generate a proof and send it to the purifier; the signer and the purifier each run Proof sig and Proof san Algorithm, generate proof π sig , π san , send it to TA to prove that he is or is not the generator of the message signature pair (m,σ); for the proof π sent by the signer sig , TA runs Judge sig Algorithm, determine the identity of the generator; if it is proved that π san From the Purifier, he / she runs Judge san Algorithm; Judge sig and Judge san The algorithm outputs the judgment d∈{Signer,Sanitizer,⊥}, d=Signer means that the message signature pair (m,σ) is generated by the signer, d=Sanitizer means that the message signature pair (m,σ) is generated by the purifier, and d=⊥ means proof π sig , π san is invalid; In step (1), the Setup algorithm is expressed as: Input security parameter λ, equivalence class representative size l and time length TA selects bilinear pairings in and is a multiplicative cyclic group of prime order p; the generators are chosen randomly Choosing a hash function Then, TA generates a BBS+ key pair and randomly selects calculate TA publishes system public parameters Secret master key msk = x TA ; KGen sig The algorithm is expressed as: (pk S ,sk S )←KGen sig (mpk); input the system public parameter mpk, TA generates a key pair for the signer (pk S ,sk S ); the key pair (pk S ,sk S ) includes key pairs for equivalence class signatures, key pairs for verifiable ring signatures, and key pairs for BBS+ signatures; KGen san The algorithm is expressed as: (pk Z ,sk Z )←KGen san (mpk); input the system public parameter mpk, TA generates a key pair for the purifier (pk Z ,sk Z ); the key pair (pk Z ,sk Z ) includes a key pair for public key encryption and a key pair for verifiable ring signature; In step (2), the signer generates a signature σ for the message m at the current time t; the signer generates a commitment C and proofs π1 and π2 about the commitment for the message content and restrictions, as well as proof π3 that the current time does not exceed the expiration time, that is, t<τ. The above proofs use non-interactive zero-knowledge proofs; then, the signer performs an equivalence signature on the commitment C and encrypts some information required by the purifier, and finally performs a ring signature on the above content; The Sign algorithm is expressed as: (m,σ)←Sign(mpk,sk S ,pk Z ,m,ADM,γ,τ,t); its specific implementation method is: (1) The signer divides the message m into n blocks m1||…||m n ; Generate message block m i and commitments with restrictions γ; random selection Calculate C1 = H(γ) δ ; For each message block m i , calculate C 2,i =H(i||m i ) δ ; If i∈ADM, calculate C 3,i =F(i) δ , otherwise C 3,i =F(i||m i ) δ ; Wherein, ADM represents a message block description that can be modified; (2) Prove that the purified message block is a message block that allows modification, that is, for each message block m i , C 3,i =F(i) δ or C 3,i =F(i||m i ) δ ; Generate proof: Random Selection If C 3,i =F(i) δ , randomly selected calculate Otherwise, randomly select remember (3) Prove that the number of purified message blocks does not exceed γ, that is, prove So that C1=H(i) δ , and there is a message block set J of size ni among the n message blocks, for Satisfy C 2,j =H(j||m j ) δ ; Generate proof: Where, [n] = {1, 2, ..., n}; For i = γ, randomly select calculate Select the first ni that meets C 2,j =H(j||m j ) δ message blocks, randomly selected calculate For the remaining i message blocks, randomly select calculate For i≠γ, randomly choose calculate Randomly select i message blocks, assuming they are the first i, for j∈[1,i], randomly select calculate Use i+1 points and Construct the Lagrange polynomial P of degree i i (x); for j∈[i+1,n], calculate Random Selection calculate get calculate For i = γ, use i + 1 points and Construct the Lagrange polynomial P of degree i i (x); for j∈J, calculate get get (4) Set the expiration time of the signature to τ, and prove that the current time t does not exceed the expiration time τ; the signer calculates the BBS+ signature of τ, first calculating Then calculate in Order expiration time information The signer requests the information of the current time t from TA; TA calculates And calculate the BBS+ signature of t in TA command current time information Send it to the signer; If t<τ, then there exists So that τ k =t k , then The signer calculates the k ,B k,t Commitment, randomly selected calculate The signer sets β1 = ρ1ξ k , β2=ρ2ξ′ k,t , generate proof Random Selection calculate calculate calculate get (5) For commitment C = (C1, {C 2,i } i∈[1,n] ,{C 3,i } i∈[1,n] ) to perform equivalence class signature; map C to the equivalence class representative Random Selection calculate Get the equivalence class signature (6) Encrypted signature expiration time information ei, commitment C, exponent δ and equivalence class signature σ EQS ; Remember M PKE =(ei,C,δ,σ EQS ), randomly select υ←{0,1} λ ,calculate get in (7) Perform a verifiable ring signature on the above content; record M VRS =(m||C||π1||π2||π3||σ EQS ||e); Random selection Calculate h = H (M VRS ||r), Generate about or Proof of; Random Selection calculate remember Get a verifiable ring signature σ VRS =(r,w,π4); Output signature σ=(C,π1,π2,π3,σ EQS ,s VRS ,e); In step (3), the purifier purifies the message m to obtain a new message m′, and generates a signature σ′ for the message m′ at the current time t′; the purifier first decrypts the ciphertext e, obtains the partial information required for purification and re-encrypts it; then re-randomizes the commitment and updates the equivalence class signature; then, the purifier proves that the purified message block is a message block that is allowed to be modified, the number of purified message blocks does not exceed γ, and the current time t′ does not exceed the expiration time τ, and generates proofs π′1, π′2, π′3. Finally, the purifier performs a ring signature on the above content; The Sanit algorithm is expressed as: (m′,σ′)←Sanit(mpk,pk S ,sk Z ,m,σ,MOD,t′); its specific implementation method is: (1) The purifier purifies the message and obtains m′←MOD(m); (2) Decryption obtains the expiration time information, the original commitment and its exponent, and the equivalent class signature; Calculation if but Otherwise return ⊥; (3) Re-randomization commitment; random selection Let δ′ = μ·δ, calculate get (4) Update the equivalence class signature; the new equivalence class is represented by Random Selection Generate a new signature (5) Re-encrypt the expiration time information ei, the original commitment C and its exponent δ, and the equivalent class signature σ EQS ; Random selection Calculated (6) Prove that the purified message block is a message block that allows modification, that is, for each message block m i , C′ 3,i =F(i) δ′ or C′ 3,i =F(i||m′ i ) δ′ ; Prove the same signing process; get (7) Prove that the number of purified message blocks does not exceed γ, that is, prove So that C′1=H(i) δ′ , and there is a message block set J of size ni among the n message blocks, for Satisfy C′ 2,j =H(j||m′ j ) δ′ ; Prove the same signing process; get (8) Prove that the current time t′ does not exceed the expiration time τ; the purifier requests the information of the current time t′ from TA The purifier proves t′<τ, proving the same signing process; we get (9) Perform a verifiable ring signature on the above content; record M′ VRS =(m′||C′||π′1||π′2||π′3||σ′ EQS ||e′), randomly selected Calculate h′=H(M′ VRS ||r′), Generate about or Proof of; Random Selection calculate remember Get a verifiable ring signature σ′ VRS =(r′,w′,π′4); Output signature σ′=(C′,π′1,π′2,π′3,σ′ EQS ,s′ VRS ,e′); In step (4), the Verify algorithm is expressed as: b←Verify(mpk,pk S ,pk Z ,m,σ,t); its specific implementation method is: (1) Verification For each message block m i ,if If not, the proof is invalid and 0 is returned; (2) Verification ①For i∈[1,n], verify P i (x) whether it is an i-th degree polynomial; ②For i∈[1,n], verify whether ③For i∈[1,n], j∈[1,n], verify whether and ④Verify whether it meets If any of the above conditions is not met, the proof is invalid and 0 is returned; (3) Verification Recalculate if If not, the proof is invalid and 0 is returned; (4) Verify the equivalence class signature if If not, the signature is invalid and 0 is returned; (5) Verify the ring signature σ VRS =(r,w,π4); calculate h =(M VRS ||r), if If not, the signature is invalid and 0 is returned; If all the above conditions are met, the message signature pair is valid and 1 is returned; In step (5), if there is a dispute about the generator of the message signature pair, the signer and the purifier each generate a certificate and send it to TA, and TA determines the identity of the generator based on the certificate; Proof sig The algorithm is expressed as: sig ←Proof sig (mpk,sk S ,pk S ,m,σ); the specific implementation method is: the signer parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); Calculate and Generate about Proof of; Random Selection calculate s π =r π -sk VRS ·c π , output Proof san The algorithm is expressed as: san ←Proof san (mpk,sk Z ,pk Z ,m,σ); the specific implementation method is: the purifier parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); Calculate and Generate about Proof of; Random Selection calculate s π =r π -ssk VRS ·c π , output Judge sig The algorithm is expressed as: d←Judge sig (mpk,pk S ,m,σ,π sig ); Its specific implementation method is: TA parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); TA analysis to obtain calculate Verify Proof π sig Validity: If This means that π sig is valid, i.e. π sig Generated by the signer; if This means that the generator of signature σ and π sig If the generator is consistent, return Signer, otherwise return Sanitizer; Judge san The algorithm is expressed as: d←Judge san (mpk,pk Z ,m,σ,π san ); Its specific implementation method is: TA parses the signature σ and obtains σ VRS =(r,w,π4),M VRS =(m||C||π1||π2||π3||σ EQS ||e); TA analysis to obtain calculate Verify Proof π san Validity: If This means that π san is valid, i.e. π san Generated by the Purifier; if This means that the generator of signature σ and π san If the generator is consistent, return Sanitizer, otherwise return Signer.

2. The method for securely sharing electronic medical records based on restricted purgeable signatures according to claim 1, characterized in that: Key pair (pk S ,sk S ), the key pair for the equivalent class signature is generated by randomly selecting Definition of sk EQS =(x i ) i∈[1,l] , The key pair for verifiable ring signature is generated by randomly selecting Definition of sk VRS =α, pk VRS =g α ; The method for generating the key pair for BBS+ signature is: random selection As the private key, calculate the public key The output key pair (pk S ,sk S ), pk S =(pk EQS ,pk VRS ,vk Sig ), sk S =(sk EQS ,sk VRS ,x Sig ).

3. The method for securely sharing electronic medical records based on restricted purgeable signatures according to claim 1, characterized in that: Key pair (pk Z ,sk Z ), the method for generating the key pair for public key encryption is: randomly select Definition of ssk PKE =β, The key pair for verifiable ring signature is generated by randomly selecting definition The output key pair (pk Z ,sk Z ), pk Z =(spk PKE ,spk VRS ), sk Z =(ssk PKE ,ssk VRS ).

4. A system for securely sharing electronic medical records based on restricted purgeable signatures for implementing the method according to any one of claims 1 to 3, characterized in that: include: Trusted authority, used to generate signing keys for signers and purifiers; Signer, used to generate and sign the patient's electronic medical record, and also used to define the content that can be modified, the upper limit of the number of fields that can be modified, and the deadline for modification; Purifier, used to modify the allowed parts of the medical record within a certain period of time and generate a new valid signature for the modified data, and the generated signature can still be successfully verified; as well as Verifier, used to verify the validity of medical records submitted by purifiers. Verifiers can access medical data but cannot modify it.

5. The electronic medical record secure sharing system based on restricted purgeable signatures according to claim 4 is characterized in that: The signer is a doctor's terminal, the purifier is a semi-trusted third-party terminal authorized by the signer, including a patient terminal and an electronic medical record information system administrator terminal, and the verifier is a medical data sharing entity, including medical institutions, insurance companies and scientific research institutions.

Images