Attribute-based function encryption system and online medical diagnosis encryption access method

Abstract

The application relates to an attribute-based function encryption system and an online medical diagnosis encryption access method, which comprises four modules: a user information management module, a verification module, a storage module and an encryption module. In combination with the characteristics of attribute encryption and function encryption, the basic information of patients and doctors is protected when the patients and doctors use online medical diagnosis, so that the privacy of the patients and doctors cannot be cracked and leaked in the transmission process on the Internet. The information of the patients in the online medical field is protected by adopting a function encryption method for hierarchical protection. The identity information of users (doctors and patients) is protected, and the diagnosis information of the patients is protected.

Description

TECHNICAL FIELD

[0001] The present application relates to a network information security technology, in particular to an attribute-based function encryption system and an online medical diagnosis encryption access method. BACKGROUND

[0002] With the rapid development of computer and network technology, the demand for secure communication is more and more extensive, and the personal privacy information of patients is easily leaked when they perform online diagnosis and treatment.

[0003] In order to enable the disease and treatment information to be shared among doctors, especially for some difficult diseases, so as to have certain medical reference value and promote the progress of medical technology, online medical treatment is a trend. The traditional hierarchical encryption is to split the same file into different parts and encrypt them respectively, which causes certain resource waste. SUMMARY

[0004] In view of the security problem of online medical treatment, an attribute-based function encryption system and an online medical diagnosis encryption access method are proposed. When a user (patient) performs online medical consultation and treatment in an Internet environment, the medical record of the patient is protected, and only specific groups (attending doctors and general doctors) can access it, and the user (patient) must give permission to view the relevant information. The information of the user (patient) is divided into different privacy levels, and the privacy protection of the information of the user (patient) is realized, so as to prevent irrelevant personnel from stealing and spreading.

[0005] The technical scheme of the present application is: an attribute-based function encryption system, comprising a user information management module, a verification module, a storage module and an encryption module;

[0006] User information management module: the user is mainly divided into three types including patient, attending doctor and general doctor, the user registers and logs in the system,

[0007] Verification module: the doctor applies to access the medical record of the patient, the medical institution verifies the identity of the doctor, and after verification, the medical institution sends the function encryption function to the trusted center, and the trusted center sends the function decryption private key to the doctor; the patient applies to save the medical record, and sends the encrypted data to the medical institution, which is verified by the medical institution, and then the medical institution sends the function encryption function to the trusted center, and the trusted center sends the user public and private keys to the patient, which is encrypted by the user public and private keys and sent to the storage module; the patient or doctor as an access person obtains different parts of the encrypted file according to his own attributes;

[0008] The doctor downloads the medical record in the storage module by the function decryption private key, gets the medical record, and diagnoses the patient according to the medical record, and transmits the treatment scheme and diagnosis result to the storage module through the encryption module;

[0009] Storage module: the patient uploads the medical record data to the cloud server of this system through function encryption;

[0010] Encryption module: responsible for the generation, distribution, update and revocation of user keys in the trusted center; responsible for the storage of user private keys; users encrypt data through the public key distributed by the trusted center; encryption adopts the structure of access tree, and the access tree structure is constructed by using user attributes.

[0011] An online medical diagnosis privacy protection method, specifically comprising the following steps:

[0012] 1) Establish an attribute-based function encryption system, and register and log in the system as users by patients and doctors;

[0013] 2) The trusted center sends public and private keys to the patient user, and the patient user uploads the medical record to the storage module through the public and private key function encryption;

[0014] 3) The doctor applies to access the medical record, the medical institution verifies the legitimacy of the doctor's identity, calculates the access strategy value, determines whether it is the patient's attending doctor by the patient user, and sends the corresponding encryption function to the medical institution;

[0015] 4) The medical institution sends the encryption function and the access strategy value to the trusted center, and the trusted center sends the function decryption private key to the applicant doctor;

[0016] 5) The applicant doctor downloads the file to the storage module and decrypts it with the decryption private key to obtain the corresponding level of plaintext.

[0017] An online medical diagnosis encryption access method, the access control method based on an attribute-based function encryption system comprises the following steps:

[0018] (1) Initialization: execute Setup(1 λ ), which is completed by the trusted center, to generate the system public key PK and the master private key MSK;

[0019] (2) User public and private key generation: execute KeyGen1(MSK, Attr), which is completed by the trusted center, to generate the public key PK i and the private key SK i of all users participating in the system, wherein MSK is the system master private key, and Attr is the user attribute set;

[0020] (3) Decryption private key generation: execute KeyGen2(MSK, f, T Attr ), which is completed by the trusted center, to generate the decryption private key SK fi of the doctor user, wherein MSK is the system master private key, f is the function encryption function selected by the patient user, and T AttrThe access value of the attribute of the doctor is generated by accessing the strategy T;

[0021] (4) Medical record data encryption: performing Encrypt f (M, PK i ), which is completed by the patient user, to generate an encrypted medical record data file CT, wherein M is the medical record data of the user, and PK i is the public key of the user;

[0022] (5) Medical record data decryption: performing Decrypt f (CT, SK fi ), which is completed by the doctor user, to output the plaintext M' corresponding to the level of the doctor, wherein CT is the medical record data encryption file, and SK fi is the function decryption key generated by the trusted center for the doctor.

[0023] The present application has the beneficial effect that the attribute-based function encryption system and the online medical diagnosis encryption access method protect the basic information of the patient and the doctor when they use the online medical diagnosis, and ensure that the privacy of the patient and the doctor will not be cracked and leaked in the transmission process on the Internet. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 is a relationship diagram of the attribute-based function encryption system of the present application;

[0025] Figure 2 is an example diagram of the access control tree structure of the online medical privacy protection of the present application. DETAILED DESCRIPTION

[0026] The present application will be described in detail below in combination with the drawings and specific embodiments. The present embodiment is implemented on the premise of the technical solution of the present application, and detailed implementation modes and specific operation processes are given, but the protection scope of the present application is not limited to the following embodiments.

[0027] The attribute-based function encryption online medical diagnosis encryption access method adopts the idea of hierarchical encryption to protect the medical records of the patient in different degrees while sharing the disease and treatment information without causing the leakage of personal identity privacy. The function encryption is adopted, the patient user encrypts once, and the doctor user decrypts different parts of the medical record file according to the attributes owned by himself to meet different attribute access structures.

[0028] In attribute-based cryptography system, a user does not only have a unique public key, or an identity, but instead it has a corresponding attribute (gender, age, position, department, etc.). Messages are encrypted with various access policies and stored in the server in the form of ciphertext. In this application, one party can encrypt a document to multiple people with the same attribute, so that the ciphertext can be shared by multiple parties, improving the access efficiency of the system.

[0029] As Figure 1 The attribute-based function encryption system includes four modules: user information management module, verification module, storage module and encryption module.

[0030] User information management module: the users of this scheme are mainly divided into three categories: patients, attending doctors and general doctors. Among them, the attending doctors can access the personal information of their patient users, and the general doctors can only access the medical record information. Users can register and log in to the system.

[0031] Verification module: doctors apply to access patient medical records, and medical institutions verify the identity of doctors. After verification, the medical institutions send function encryption functions to the trusted center, and the trusted center sends function decryption private keys to the doctors. Patients apply to save medical records, and send encrypted data to medical institutions. After verification, the medical institutions send function encryption functions to the trusted center, and the trusted center sends user public and private keys to the patients. The user encrypts the data after the user public and private keys and sends it to the storage module. The patient or doctor as an access user obtains different parts of the encrypted file according to his own attribute. Among them, the doctor downloads the medical record in the storage module through the function decryption private key, gets the medical record, and diagnoses the patient according to the patient's condition. The treatment plan, diagnosis result, etc. are encrypted by the encryption module and transmitted to the storage module.

[0032] Storage module: the patient uploads the medical record data to the cloud server of this system through function encryption.

[0033] Encryption module: responsible for the generation, distribution, update and revocation of user keys in the trusted center CA. Responsible for the storage of user private keys. The user encrypts the data through the public key distributed by the trusted center CA. The encryption adopts the structure of access tree, and the access tree structure is constructed by using the user attribute.

[0034] The online medical diagnosis encrypted access method process is as follows: First, the trusted center sends public and private keys to the patient user, who then encrypts and uploads the medical records to the storage module using the public and private key functions. Second, the doctor requests access to the medical records. The medical institution verifies the doctor's identity and calculates the access policy value. The patient user confirms whether the doctor is their attending physician and sends the corresponding encryption function to the medical institution. Third, the medical institution sends the encryption function and access policy value to the trusted center, which then sends the function decryption private key to the requesting doctor. Fourth, the requesting doctor downloads the file from the storage module and decrypts it using the decryption private key to obtain the plaintext at the appropriate level.

[0035] A function encryption access control method based on medical record data, comprising the following steps:

[0036] (1) Initialization: Execute Setup(1 λ This part is completed by the Trusted Center (CA), which generates the system public key (PK) and master private key (MSK).

[0037] (2) User public and private key generation: Execute KeyGen1(MSK, Attr). This part is completed by the CA and generates the public key PK of all users participating in this system. i Private key SK i MSK is the system master private key, and Attr is a set of user attributes.

[0038] (3) Decryption private key generation: Execute KeyGen2(MSK, f, T) Attr This part is completed by the CA, which generates the decryption private key SK for doctor users (attending physicians, general practitioners). fi (different SK) fi (Different parts of the ciphertext can be decrypted), where MSK is the system master private key, f is the encryption function selected by the patient user, and T Attr Access values ​​generated by access strategy T for the attributes of doctors (attending physicians, general practitioners).

[0039] (4) Encrypt medical record data: Execute Encrypt f (M,PK i This part is completed by the patient user, generating an encrypted medical record data file CT, where M represents the user's medical record data, and PK... i This is the user's public key.

[0040] (5) Decrypting medical record data: Execute Decrypt f (CT,SK fi This part is completed by the doctor user, outputting plaintext M' corresponding to the doctor's level, where CT is an encrypted medical record data file, and SK... fiThe trusted center generates a function decryption key for the doctors (attending doctors, general doctors).

[0041] As shown in Figure 2 An access structure control tree example diagram is accessed, wherein the leaf nodes are doctor user attributes (gender, age, position, department, etc.), and the non-leaf nodes are arithmetic operator operations, such as Figure 2 The value of s1 in the above formula is a1+a2, a1 is obtained by transforming attribute 1 through a certain algorithm, and finally, whether the doctor is an attending doctor is judged by calculating the root node value s0 (s0=s1*s2) of the whole tree, and s0 is the access value generated by the attribute through the access strategy T.

[0042] The above-described embodiments only express several embodiments of the present application, and the description is relatively specific and detailed, but it cannot be understood as a limitation on the scope of the patent. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. An attribute-based function encryption system, characterized by, It comprises a user information management module, a verification module, a storage module and an encryption module. The user information management module: the user is divided into three categories including a patient, a treating doctor and a common doctor, the user registers and logs in the system, The verification module: the doctor applies to access the patient's medical record, the medical institution verifies the doctor's identity, the verification is passed, the medical institution sends the function encryption function to the trusted center, the trusted center sends the function decryption private key to the doctor; the patient applies to save the medical record, the patient sends the encrypted data to the medical institution, the medical institution verifies, then the medical institution sends the function encryption function to the trusted center, the trusted center sends the user public and private key to the patient, the user encrypts the data through the user public and private key and sends it to the storage module; the patient or the doctor obtains different parts of the encrypted file according to his own attribute; The doctor downloads the medical record in the storage module through the function decryption private key, obtains the medical record, and the doctor diagnoses the patient according to the medical record, and transmits the treatment scheme and the diagnosis result to the storage module through the encryption module; The storage module: the patient uploads the medical record data to the cloud server of the system through the function encryption; The encryption module: it is responsible for the generation, distribution, update and revocation of the user key in the trusted center; it is responsible for the storage of the user private key; the user encrypts the data through the public key distributed by the trusted center; the encryption adopts the structure of access tree, and the access tree structure is constructed by using the user attribute; wherein the treating doctor can access the personal information of the patient user, and the common doctor can only access the medical record diagnosis information.

2. An online medical diagnosis privacy protection method, characterized in that, Specifically, the following steps are included: 1) establishing the attribute-based function encryption system according to claim 1, the patient and the doctor register and log in the system as users; 2) the trusted center sends the public and private key to the patient user, the patient user uploads the medical record to the storage module through the public and private key function encryption; 3) the doctor applies to access the medical record, the medical institution verifies the legality of the doctor's identity, calculates the access strategy value, determines whether the patient user is the treating doctor, and sends the corresponding encryption function to the medical institution; 4) the medical institution sends the encryption function and the access strategy value to the trusted center, and the trusted center sends the function decryption private key to the applying doctor; 5) the applying doctor downloads the file to the storage module and decrypts it with the decryption private key to obtain the corresponding level of plaintext.

3. An online medical diagnosis encryption access method, characterized in that, The access control method on the attribute-based function encryption system in claim 1 comprises the following steps: (1) Initialization: Perform , this part is completed by the trusted center, generating the system public key PK and the master private key MSK ; (2) User public and private key generation: execute KeyGenl(MSK, Attr), this part is completed by the trusted center, to generate the public key PK i and private key SK i of all users participating in this system, where MSK is the system master private key, and Attr is the user attribute set; (3) Decryption private key generation: execute KeyGen2(MSK, f, T Attr ), which is completed by the trusted center, to generate the decryption private key SK fi of the doctor user, wherein MSK is the system master private key, f is the function selected by the patient user for function encryption, and T Attr is the access value generated by the attribute of the doctor through the access strategy T; (4) Medical record data encryption: Execute Encrypt f (M, PK i ), this part is completed by the patient user, generating an encrypted medical record data file CT, where M is the user's medical record data, and PK i is the user's public key; (5) Medical record data decryption: Execute Decrypt f (CT, SK fi ), this part is completed by the doctor user, and the output is the plaintext M ’ corresponding to the doctor's level, where CT is the medical record data encrypted file, and SK fi is the function decryption key generated by the trusted center for the doctor.

Images