Multi-party medical privacy data secure sharing method based on privacy protection and tee

Abstract

The application provides a multi-party medical privacy data security sharing method based on privacy protection and TEE. The method comprises the following steps: obtaining local calculation results of multiple participants; the distribution frequency of alleles comprises a first frequency of a first gene appearing at a first site on a SNP, a second frequency of a second gene appearing at a second site, a third frequency of a first genome appearing, and a fourth frequency of a second genome appearing; the local calculation results of each participant are combined to obtain a to-be-analyzed coordinate site of each participant; the to-be-analyzed coordinate site is clustered to obtain a first center point of a first coordinate site and a second center point of a second coordinate site, and the real frequencies of the first gene, the second gene, and the first gene and the second gene appearing at the same time are determined; the real frequencies are used for correlation degree calculation to determine the gene correlation between the genes at the first site and the second site on the SNP. The application determines the gene correlation between the SNP sites, which is convenient for the research on genes.

Description

Technical Field

[0001] This application relates to big data technology, and in particular to a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE. Background Technology

[0002] SNPs (Single Nucleotide Polymorphisms) exist in the genome of all people, and genes at different SNP sites lead to different traits. Therefore, it is necessary to classify and analyze the distribution of genes at SNP sites to achieve efficient gene research.

[0003] In the medical field, SNP locus information is needed for medical research. However, uploading large amounts of SNP locus information to servers during research results in low efficiency for gene studies. Summary of the Invention

[0004] This application provides a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE, which enables the analysis of the association between different genes at SNP loci, and achieves efficient gene research.

[0005] Firstly, this application provides a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE (Technical Exchange Execution Environment). This method is applied on the server side and includes:

[0006] Obtain local computation results from at least two participants; wherein the local computation results include the distribution frequency of alleles on the SNP, the distribution frequency of alleles includes a first frequency of the first gene appearing at the first site on the SNP, a second frequency of the second gene appearing at the second site on the SNP, a third frequency of the first genome appearing on the SNP, and a fourth frequency of the second genome appearing on the SNP, wherein the third frequency includes the frequency of the second gene appearing at the second site when the first gene appears at the first site, and the fourth frequency includes the frequency of the fourth gene appearing at the second site when the first gene appears at the first site;

[0007] The local calculation results of each participant are combined to obtain the coordinate positions to be analyzed for each participant; wherein, the coordinate positions to be analyzed include a first coordinate position composed of the first frequency and the second frequency, and a second coordinate position composed of the third frequency and the fourth frequency;

[0008] Clustering is performed on the coordinate sites to be analyzed for each participant to obtain the first center point of the first coordinate site and the second center point of the second coordinate site, so as to determine the true frequency of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first gene and the second gene;

[0009] The correlation degree is calculated based on the actual frequency to determine the gene association relationship between the genes at the first and second sites on the SNP.

[0010] Secondly, this application provides a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE (Transparent External Equipment). This method is applied to the terminals of the participating parties and includes:

[0011] The user's genetic data is analyzed to obtain local calculation results; wherein, the local calculation results include the distribution frequency of alleles on SNPs, the distribution frequency of alleles includes a first frequency of the first gene appearing at the first site on the SNP, a second frequency of the second gene appearing at the second site on the SNP, a third frequency of the first genome appearing on the SNP, and a fourth frequency of the second genome appearing on the SNP, wherein the third frequency includes the frequency of the second gene appearing at the second site when the first gene appears at the first site, and the fourth frequency includes the frequency of the fourth gene appearing at the second site when the first gene appears at the first site;

[0012] The local calculation results are transmitted to the server, where they are combined based on the local calculation results of each participant to obtain the coordinate sites to be analyzed for each participant. The coordinate sites to be analyzed include a first coordinate site composed of the first frequency and the second frequency, and a second coordinate site composed of the third frequency and the fourth frequency. Clustering is performed based on the coordinate sites to be analyzed for each participant to obtain the first centroid of the first coordinate site and the second centroid of the second coordinate site, thereby determining the true frequencies of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first and second genes. Association degree calculation is performed based on the true frequencies to determine the gene association relationship between the genes at the first and second sites on the SNP.

[0013] Thirdly, this application provides a multi-party medical privacy data secure sharing device based on privacy protection and TEE, which is applied on the server side and includes:

[0014] An information acquisition module is used to acquire local calculation results from at least two participants; wherein, the local calculation results include the distribution frequency of alleles on the SNP, the distribution frequency of alleles includes a first frequency of the first gene appearing at the first site on the SNP, a second frequency of the second gene appearing at the second site on the SNP, a third frequency of the first genome appearing on the SNP, and a fourth frequency of the second genome appearing on the SNP, wherein the third frequency includes the frequency of the second gene appearing at the second site when the first gene appears at the first site, and the fourth frequency includes the frequency of the fourth gene appearing at the second site when the first gene appears at the first site;

[0015] The data combination module is used to combine the local calculation results of each participant to obtain the coordinate positions to be analyzed for each participant; wherein, the coordinate positions to be analyzed include a first coordinate position composed of the first frequency and the second frequency, and a second coordinate position composed of the third frequency and the fourth frequency;

[0016] The frequency determination module is used to cluster the coordinate sites to be analyzed of each participant to obtain the first center point of the first coordinate site and the second center point of the second coordinate site, so as to determine the true frequency of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first gene and the second gene.

[0017] The association determination module is used to calculate the association degree based on the true frequency in order to determine the gene association relationship between the genes at the first and second sites of the SNP.

[0018] Fourthly, this application provides a multi-party medical privacy data secure sharing device based on privacy protection and TEE, which is applied to the terminals of the participating parties and includes:

[0019] The data analysis module is used to analyze the user's genetic data and obtain local calculation results. The local calculation results include the distribution frequency of alleles on SNPs. The distribution frequency of alleles includes a first frequency of the first gene appearing at the first locus on the SNP, a second frequency of the second gene appearing at the second locus on the SNP, a third frequency of the first gene appearing on the SNP, and a fourth frequency of the second gene appearing on the SNP. The third frequency includes the frequency of the second gene appearing at the second locus when the first gene appears at the first locus, and the fourth frequency includes the frequency of the fourth gene appearing at the second locus when the first gene appears at the first locus.

[0020] The data transmission module is used to transmit the local calculation results to the server, so that the server can combine the local calculation results of each participant to obtain the coordinate sites to be analyzed for each participant; wherein, the coordinate sites to be analyzed include a first coordinate site composed of the first frequency and the second frequency, and a second coordinate site composed of the third frequency and the fourth frequency; clustering is performed based on the coordinate sites to be analyzed for each participant to obtain the first center point of the first coordinate site and the second center point of the second coordinate site, so as to determine the true frequency of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first gene and the second gene; the correlation is calculated based on the true frequency to determine the gene association relationship between the genes at the first and second sites on the SNP.

[0021] This application provides a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE (Transmission over Environment). It determines the distribution frequency of alleles at a single SNP locus in each population group by statistically analyzing local calculation results. Based on the statistically analyzed local calculation results, clustering calculations are performed to determine the true frequencies of the occurrence of the first gene, the second gene, and the simultaneous occurrence of the first and second genes. Based on the true frequencies, the gene association relationship between two SNP loci is determined. This facilitates the identification of one SNP locus from two SNP loci based on the gene association relationship, and only the SNP locus information of the identified SNP locus is uploaded to the server, protecting the original data of all parties. This solves the problem in existing technologies where the association relationship between SNP loci cannot be determined, thus affecting gene research, avoiding confusion during information upload, and effectively improving the efficiency of gene research. Attached Figure Description

[0022] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0023] Figure 1 A flowchart illustrating a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE, provided for embodiments of this application;

[0024] Figure 2 A schematic diagram of gene distribution at SNP sites on chromosomes provided in an embodiment of this application;

[0025] Figure 3 A schematic diagram of the first frequency coordinate system provided in the embodiments of this application;

[0026] Figure 4 A flowchart illustrating a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE, provided for embodiments of this application;

[0027] Figure 5 A flowchart illustrating a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE, provided for embodiments of this application;

[0028] Figure 6 A structural block diagram of a multi-party medical privacy data secure sharing device based on privacy protection and TEE provided in this application embodiment;

[0029] Figure 7 A structural block diagram of a multi-party medical privacy data secure sharing device based on privacy protection and TEE provided in this application embodiment;

[0030] Figure 8A structural block diagram of a multi-party medical privacy data secure sharing device based on privacy protection and TEE provided in this application embodiment;

[0031] Figure 9 A structural block diagram of an electronic device provided in an embodiment of this application;

[0032] Figure 10 This is a structural block diagram of an electronic device provided in an embodiment of this application.

[0033] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0035] It should be understood that the described embodiments are merely some, not all, of the embodiments in this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0036] In the following description, when referring to the accompanying drawings, the same numbers in different drawings denote the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0037] In the description of this application, it should be understood that the terms "first," "second," "third," etc., are used only to distinguish similar objects and are not necessarily used to describe a specific order or sequence, nor should they be construed as indicating or implying relative importance. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances. Furthermore, in the description of this application, unless otherwise stated, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0038] It should be noted that, due to space limitations, this application specification does not exhaustively list all possible implementation methods. Those skilled in the art, after reading this application specification, should be able to deduce that, as long as the technical features do not contradict each other, any combination of technical features can constitute an optional implementation method. The following provides a detailed description of each embodiment.

[0039] With the widespread adoption and research of next-generation sequencing (NGS) technology in scientific research, its applications are increasingly focused on DNA sequencing and microarrays. Due to technological advancements and mature applications, microarray prices have gradually decreased, resulting in a large amount of microarray data available to various academic institutions. Microarray data typically contains SNP (Special Novel Participant) information. SNPs exist in the genomes of all individuals, and their large number and relatively small variation impact contribute to the development of complex traits. Genes at different SNP sites may exhibit certain associations, and determining these associations is beneficial for gene research.

[0040] However, gene research is primarily influenced by population size; the larger the population, the closer the research results are to reality, and the higher their reliability and reproducibility. Therefore, large sample sizes are needed to study gene distribution.

[0041] However, because it is difficult for a single center or institution to accumulate a large sample size and invest huge sums of money to complete the corresponding microarray experiments, it is impossible to obtain large sample data. Moreover, each gene study requires uploading gene data of all SNP loci on the chromosome, which results in low data uploading efficiency and accuracy, making gene research quite difficult.

[0042] This application provides a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE, aiming to solve the above-mentioned technical problems of the prior art.

[0043] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0044] Figure 1 This is a flowchart illustrating a method for securely sharing multi-party medical privacy data based on privacy protection and TEE, according to an embodiment of this application. This method is applied to the server side and can be executed by a device for securely sharing multi-party medical privacy data based on privacy protection and TEE. Figure 1 As shown, the method includes the following steps:

[0045] S101. Obtain the local computation results of at least two participants; wherein, the local computation results include the distribution frequency of alleles on the SNP, the distribution frequency of alleles includes the first frequency of the first gene appearing at the first site on the SNP, the second frequency of the second gene appearing at the second site on the SNP, the third frequency of the first genome appearing on the SNP, and the fourth frequency of the second genome appearing on the SNP, the third frequency includes the frequency of the second gene appearing at the second site when the first gene appears at the first site, and the fourth frequency includes the frequency of the fourth gene appearing at the second site when the first gene appears at the first site.

[0046] For example, the server can obtain local computation results sent by terminals of multiple participating parties. These local computation results can be sent to the server by multiple terminals. Each terminal stores a set of user genetic data, which can be analyzed to obtain local computation results. Therefore, the server can obtain local computation results from multiple sets of users. For instance, a terminal could be a hospital client; each hospital stores different patients, therefore, the user genetic data stored in each terminal is different. The genetic data could be genotype data at various SNP loci in the user's genes, such as SNP locus information.

[0047] The local calculation results are data obtained by the terminal based on the SNP locus information of the population stored within it. These results can include the distribution frequencies of alleles at the SNP. The allele distribution frequencies include the first frequency of the first gene appearing at the first locus of the SNP, the second frequency of the second gene appearing at the second locus of the SNP, the third frequency of the first gene appearing at the SNP, and the fourth frequency of the second gene appearing at the SNP. The third frequency includes the frequency of the second gene appearing at the second locus when the first gene appears at the first locus, and the fourth frequency includes the frequency of the fourth gene appearing at the second locus when the first gene appears at the first locus. The distribution frequency can represent the probability of genotypes present at a single SNP locus on a chromosome. For example, the SNP includes a first locus and a second locus, with the first gene being A, the second gene being B, the third gene being a, and the fourth gene being b. The first frequency of the first gene appearing at the first locus on the SNP can be the frequency of the first locus being A, P(A); the second frequency of the second gene appearing at the second locus on the SNP can be the frequency of the second locus being B, P(B); the third frequency of the first gene appearing on the SNP can be the frequency of the second locus being B when the first locus is A, P(AB); the fourth frequency of the second gene appearing on the SNP can be the frequency of the second locus being b when the first locus is A, P(Ab).

[0048] Alleles are genes that can appear at the same locus. For example, A and a can both appear at the first locus; A and a are an allele pair, and B and b are an allele pair. Genes at two SNP loci on a chromosome are not alleles. For example, if the two SNP loci are the first and second loci, the gene at the first locus is either A or a, and the gene at the second locus is either B or b. The non-allelic combinations at the two SNP loci can be AB, Ab, aB, and ab. The terminal can determine the probability distribution of these four genotype combinations at these two SNP loci within the stored population. The distribution frequency of alleles at each SNP locus can be statistically analyzed. Figure 2 A schematic diagram of the gene distribution of SNP sites on chromosomes provided for this implementation. Figure 2 The SNP locus on each chromosome represents one of the two chromosomes in the human body. The alleles at the first locus are A and a, and the alleles at the second locus are B and b. Each SNP locus on each chromosome has only one genotype.

[0049] The server obtains local calculation results from multiple terminals, that is, it obtains local calculation results from multiple groups of people and obtains the allele distribution frequency at each SNP locus in each group of people.

[0050] The terminal can collect SNP locus information from its corresponding population, for example, it can collect SNP locus information from the population within its jurisdiction. SNP locus information can include the sequence location of each SNP locus on the chromosome, as well as the genotype at each SNP locus. The format of the SNP locus information collected by different terminals may differ. A preset data format can be established, and the terminal can convert the collected SNP locus information into the preset data format. For example, the preset data format could be .bed, .bim, or .fam, etc.

[0051] The terminal can also be pre-configured with data quality control rules to clean and process the converted SNP locus information, resulting in local calculation results. For example, data quality control rules can be used to align SNP locus information. Based on the pre-configured rules, the converted SNP locus information is aligned to obtain the information to be statistically analyzed. For instance, it can check for discrepancies in the length of the converted SNP locus information and use default values ​​to pad any missing lengths, yielding the information for statistical analysis. Based on the processed information for statistical analysis, and using pre-configured data statistical applications, the local calculation results are determined from this information. For example, PLINK software can be used for statistical analysis.

[0052] In this embodiment, the method further includes: receiving encrypted local computation results and transmitting them to a trusted execution environment; decrypting the encrypted local computation results in the trusted execution environment to complete the step of determining gene association based on the decrypted local computation results in the trusted execution environment.

[0053] Specifically, after receiving the local computation result, the terminal can encrypt the result using a preset encryption algorithm. The resulting data packet is the encrypted local computation result, which is then sent to the server. Upon receiving the encrypted local computation result, the server can pass it to a TEE (Trusted Execution Environment) for decryption and subsequent steps to determine gene associations. The corresponding decryption algorithm is used to retrieve the local computation result. The encryption keys used by each terminal can be the same or different, and the server can decrypt the encrypted local computation result packets sent by each terminal individually.

[0054] In this embodiment, the processing of SNP locus information of the population by the terminal may include data format conversion, data cleaning, quality control, data alignment and encryption.

[0055] The advantage of this setup is that the data sent from the terminal to the server is encrypted. By encrypting the data at the terminal and decrypting it at the server, data leakage during transmission can be avoided. Furthermore, decryption and subsequent steps are performed within the TEE environment, ensuring information security.

[0056] S102. Combine the local calculation results of each participant to obtain the coordinate positions to be analyzed for each participant; wherein, the coordinate positions to be analyzed include the first coordinate position composed of the first frequency and the second frequency, and the second coordinate position composed of the third frequency and the fourth frequency.

[0057] For example, local computation results are obtained for each population group to determine the distribution frequency of alleles at SNP loci in each group. The local computation results of each participant are then combined to obtain the coordinate loci to be analyzed for each participant. For instance, the first and second frequencies can be combined to form the first coordinate locus, and the third and fourth frequencies can be combined to form the second coordinate locus. The first coordinate locus can be represented as (P(A), P(B)), and the second coordinate locus can be represented as (P(AB), P(Ab)). Each participant can obtain both the first and second coordinate loci.

[0058] For example, if there are 30 people in a population, the first frequency at the first locus is determined based on the genotype of each of these 30 individuals. Specifically, if 15 people in the population have genotype A at the first locus and 15 people have genotype a at the first locus, then the first frequency of genotype A at the first locus in the population can be determined to be 50%.

[0059] For each SNP locus in each population group, there are two corresponding allele frequencies. The sum of the frequencies of the two alleles at each SNP locus is one. For example, if P(A) at the first SNP locus is 50%, then P(a) is also 50%.

[0060] In this embodiment, alleles may include a first gene and a third gene. For example, if the alleles are A and a, where A is the first gene, then a is the third gene corresponding to A. The genotype at the SNP locus where A and a are located can be either A or a. At this SNP locus, the sum of the frequencies of A and a is one.

[0061] Construct a Cartesian coordinate system as the first frequency coordinate system. The coordinate points in the first frequency coordinate system can be used to represent the first frequency of the first gene at the first locus and the second frequency of the second gene at the second locus in the population. The coordinate points in the first frequency coordinate system are the first coordinate loci. For example, if the first gene at the first locus is A and the second gene at the second locus is B, then the first frequency of the first locus A in the population can be used as the x-axis, and the second frequency of the second locus B as the y-axis. If the first frequency of the first locus A is P(A) and the second frequency of the second locus B is P(B), then the first coordinate locus can be represented as (P(A), P(B)).

[0062] A first frequency coordinate system can be constructed for every two SNP loci. For each pair of SNP loci, a corresponding first coordinate locus can be obtained for each population group. The number of first coordinate loci in the first frequency coordinate system is the same as the number of population groups. Figure 3 This is a schematic diagram of the first frequency coordinate system provided in this embodiment. Figure 3 There are a total of 8 coordinate points, which means there are 8 groups of people. Figure 3 The first frequency coordinate system represents the distribution frequency of genotype A at the first locus and genotype B at the second locus. For example, (P(A)1, P(B)1) represents the distribution frequency of genotype A at the first locus and genotype B at the second locus in the first population group.

[0063] For each population group, determine the third frequency of the first gene at the first locus and the second gene at the second locus, as well as the fourth frequency of the first gene at the first locus and the fourth gene at the second locus. For example, we can determine the third frequency of A at the first locus and B at the second locus, and the fourth frequency of A at the first locus and b at the second locus, i.e., determine P(AB) and P(Ab). For example, in a population group with 30 users, 18 of whom have genotype A at the first locus and genotype B at the second locus, then P(AB) can be determined to be 60%.

[0064] Then, construct a Cartesian coordinate system as the second frequency coordinate system, and the coordinate points in the second frequency coordinate system are the second coordinate sites. For example, if the first gene at the first site is A and the second gene at the second site is B, then P(AB) can be used as the abscissa and P(Ab) as the ordinate, and the coordinate point can be represented as (P(AB), P(Ab)).

[0065] For every two SNP loci, each population group can obtain a corresponding second coordinate locus, which is located in the second frequency coordinate system corresponding to the two loci. The number of coordinate points in the second frequency coordinate system is the same as the number of population groups. The horizontal axis of the second frequency coordinate system can represent the third frequency of the first gene at the first locus and the second gene at the second locus, and the vertical axis can represent the fourth frequency of the first gene at the first locus and the fourth gene at the second locus.

[0066] S103. Cluster the coordinate sites to be analyzed for each participant to obtain the first center point of the first coordinate site and the second center point of the second coordinate site, so as to determine the true frequency of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first gene and the second gene.

[0067] For example, according to a preset clustering algorithm, the first coordinate points in the first frequency coordinate system are clustered to obtain the center points in the first frequency coordinate system, which are the cluster centers after clustering. For example, the K-means algorithm can be used for clustering. In this embodiment, no specific limitation is made on the clustering algorithm.

[0068] Determine the coordinates of the center point in the first frequency coordinate system to obtain the x-coordinate and y-coordinate of the center point. Determine the x-coordinate of the center point as the true distribution frequency of the first gene at the first locus, i.e., the true frequency. Determine the y-coordinate of the center point as the true frequency of the second gene at the second locus.

[0069] Since the sum of the true frequencies of the first gene and the corresponding third gene is one, the true frequencies of the third gene at the first locus and the fourth gene at the second locus can be obtained. For example, if the center point coordinates are (0.4, 0.47), then the true frequency of A at the first locus is 0.4, the true frequency of a at the first locus is 0.6, the true frequency of B at the second locus is 0.47, and the true frequency of b at the second locus is 0.53. Let P(A) denote the true frequency of the first gene at the first locus. ， The true frequency of the second gene at the second locus is denoted as P(B). ， The true frequency of the third gene at the first point is denoted as P(a). ， The true frequency of the fourth gene at the second locus is denoted as P(b). ， .

[0070] The advantage of this setup is that it allows for the prediction of the true distribution frequency of genes at each SNP locus using limited data. By setting up a coordinate system, the coordinates of the center point can be quickly found, improving the efficiency of determining the true frequency and thus improving the efficiency of determining gene association relationships.

[0071] Alternatively, a preset clustering algorithm can be used to cluster the second coordinate points in the second frequency coordinate system to obtain the center points in the second frequency coordinate system. For example, the K-means algorithm can be used for clustering. In this embodiment, no specific restrictions are placed on the clustering algorithm.

[0072] Determine the coordinates of the center point in the second frequency coordinate system to obtain the x-coordinate and y-coordinate of the center point. Determine the x-coordinate of the center point as the true frequency of the first gene at the first locus and the second gene at the second locus, and determine the y-coordinate of the center point as the true frequency of the first gene at the first locus and the fourth gene at the second locus.

[0073] In this embodiment, it is not necessary to determine the true frequencies of the third gene at the first locus and the second gene at the second locus, or the true frequencies of the third gene at the first locus and the fourth gene at the second locus. It is sufficient to calculate the true frequencies of the first gene at the first locus and the second gene at the second locus; that is, only the true frequencies of P(AB) need to be calculated. The true frequencies of the first gene at the first locus and the second gene at the second locus are denoted as P(AB). ， This refers to the actual frequency of the simultaneous occurrence of the first and second genes.

[0074] The advantage of this setup is that it allows for the prediction of the true frequency of genes at every two SNP loci using limited data. By setting up a coordinate system, the coordinates of the center point can be quickly found, improving the efficiency of determining the true frequency and thus improving the efficiency of determining gene association relationships.

[0075] S104. Calculate the correlation degree based on the true frequency to determine the gene association relationship between the genes at the first and second loci of the SNP.

[0076] For example, after obtaining the true frequencies of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first and second genes, the association between genes at the first and second SNP sites can be determined. Gene association degree can be used to represent the association between gene distributions at different SNP sites; for example, a higher gene association degree indicates a stronger association.

[0077] A formula for calculating gene association relationships can be predefined. This formula can be used to calculate the gene association degree at different SNP loci. The relationship between genes can include positive association and negative association. Positive association means that if the distribution frequency of a gene at the first locus increases, the distribution frequency of a gene at the second locus also increases; negative association means that if the distribution frequency of a gene at the first locus increases, the distribution frequency of a gene at the second locus decreases.

[0078] Based on gene associations, the SNP loci to be uploaded are determined, and the SNP locus information of the SNP loci to be uploaded is obtained from a preset information storage device; wherein, the preset information storage device is used to upload the SNP locus information of the SNP loci to be uploaded to the server.

[0079] In this embodiment, the method further includes: determining gene uploading rules and gene restoration rules based on gene association relationships, wherein the gene uploading rules are used to determine the genes to be removed from the SNP, and the gene restoration rules are used to restore gene information based on the genes with association relationships in the SNP; issuing the gene uploading rules to the information uploader so that the information uploader can remove the genes with association relationships in the SNP according to the gene uploading rules to form a processed SNP; receiving the processed SNP and restoring the removed genes according to the gene restoration rules, so as to analyze the restored SNP.

[0080] Specifically, the higher the gene association score (representing the gene association between two SNP loci), the greater the similarity between the two SNP loci. After obtaining the gene association score, it can be compared with a preset association score threshold. If the gene association score between SNP loci is greater than the preset threshold, the information storage device can select one SNP locus from the two SNP loci and upload it to the server when transmitting SNP locus information to the server. The information storage device is the information uploader. The selected SNP locus is determined as the SNP locus to be uploaded. The information storage device can be an electronic device with data storage capabilities, which can store SNP locus information to be used for medical research. The gene upload rules can be determined by the information uploader; that is, the information uploader determines the genes to be removed from the SNPs. Genes to be removed are information that does not need to be uploaded to the server.

[0081] The server can send gene correlation scores to an information storage device, which then determines whether a correlation exists between any two SNP loci and, during information transmission, determines whether only one SNP locus's information needs to be uploaded. Alternatively, the server can determine the correlation between two SNP loci based on gene correlation scores. That is, the server can also determine the gene upload rules. Based on these rules, the server retrieves the necessary information from the uploader. The server can also determine gene reconstruction rules based on gene correlations. These rules are used to reconstruct the uploaded gene information based on the correlated gene pairs within the SNPs. When retrieving SNP locus information from the information storage device, if a correlation is determined between two SNP loci, only the information of one SNP locus needs to be retrieved. In this embodiment, the SNP locus corresponding to the SNP locus information to be uploaded to the server can be randomly selected. After obtaining the information of one SNP locus, the server reconstructs the information of the other SNP locus based on the correlation between the two SNP loci, effectively reducing the amount of information uploaded and improving the efficiency and accuracy of information transmission.

[0082] In this embodiment, the method further includes: providing an interactive page and obtaining the first and second sites to be analyzed based on the interactive page; establishing an analysis task for the first and second sites and sending the analysis task to the participants to obtain the local calculation results of each participant.

[0083] Specifically, both the server and the terminal can provide interactive pages, through which the first and second loci to be analyzed can be obtained. For example, staff can click on preset controls on the server's interactive page to acquire information. They can also create analysis tasks for the first and second loci through the interactive page and send these tasks to the participating terminals to obtain the local calculation results from each participant. By setting up interactive pages, staff operations can be facilitated, improving the efficiency of determining correlations.

[0084] The analysis task can include SNP loci required by the server, and these loci are identified as target loci. After the terminal identifies the target loci in the analysis task, it can calculate the local computation results for the target loci, instead of needing to determine the local computation results for all loci, thus improving computational efficiency.

[0085] In this embodiment, the method further includes: obtaining site information with correlation and forming evaluation rules; sending the evaluation rules to each participant so that each participant can calculate the actual relationship between sites with correlation in the sample data locally, and determine that the sample data whose actual relationship does not match the preset correlation relationship is low-quality sample data; and obtaining the local calculation result of the sample data after removing the low-quality sample data.

[0086] Specifically, the process involves identifying related SNP loci and obtaining their locus information. SNP loci that are related to each other are designated as a pair of related loci. For example, if a relationship is pre-defined between locus one and locus two, then locus one and locus two are considered a pair of related loci. The server can generate evaluation rules. These rules are used by the terminal to determine whether its stored gene data meets the evaluation rules before uploading local calculation results to the server. If it does, the local calculation results can be sent to the server; otherwise, the gene data is classified as low-quality sample data, and the local calculation results are not sent to the server. The gene data in the terminal is the locally calculated sample data.

[0087] For example, the evaluation rule could be to determine whether the distribution frequency of associated loci among the people stored on the terminal meets a preset association relationship. If there are people who do not meet the relationship, the number of people who do not meet the relationship is determined. If the number of people is greater than or equal to a preset threshold, the local calculation sample data of that terminal can be identified as low-quality sample data, and the terminal will not encrypt the local calculation results or send them to the server. If the number of people is less than the preset threshold, the local calculation results can be encrypted to obtain an encrypted local calculation result package and sent to the server. Alternatively, people who do not meet the preset association relationship in the population can be removed, and the local calculation results of people whose gene distribution frequency of associated loci meets the preset association relationship can be encrypted to obtain an encrypted local calculation result package and sent to the server. For example, the association relationship between locus one and locus two is that if the genotype of one SNP locus is A, then the genotype of the other SNP locus is B; if the genotype of one SNP locus is a, then the genotype of the other SNP locus is b. Determine whether the genotypes at locus 1 and locus 2 of each individual in the population satisfy the association relationship. If a large number of individuals do not satisfy the association relationship between locus 1 and locus 2, it indicates that the population is highly specific and cannot represent the general population. Therefore, it is not necessary to send the local calculation results of this population to the server.

[0088] The advantage of this setup is that, based on the pre-defined association relationships between SNP loci, it determines whether individuals within a population satisfy these associations, thereby determining the population's specificity. Removing highly specific populations improves data accuracy, while less specific populations are used as the data to be uploaded, resulting in a more accurate representation of gene distribution frequencies and improving the precision of gene association determination.

[0089] This application provides a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE (Transparent Environment). By statistically analyzing local calculations of population groups, the distribution frequency of alleles at a single SNP locus is determined for each group. Based on the statistically analyzed local calculations, clustering is performed to determine the true frequencies of the occurrence of a first gene, a second gene, and the simultaneous occurrence of both genes. Based on the true frequencies, the gene association between two SNP loci is determined. This facilitates the identification of one SNP locus from two SNP loci based on the gene association, and only the SNP information of the identified SNP locus is uploaded to the server. This solves the problem in existing technologies where the association between SNP loci cannot be determined, thus affecting gene research, avoiding confusion during information upload, and effectively improving the efficiency of gene research.

[0090] Figure 4This is a flowchart illustrating a method for securely sharing multi-party medical privacy data based on privacy protection and TEE, which is an optional embodiment based on the above embodiments.

[0091] In this embodiment, clustering is performed based on the coordinate sites to be analyzed of each participant to obtain the first center point of the first coordinate site and the second center point of the second coordinate site, so as to determine the true frequency of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first gene and the second gene. This can be further refined as follows: clustering the first coordinate sites to obtain the first center point, and determining the true frequency of the first gene based on the horizontal coordinate of the first center point, and determining the true frequency of the second gene based on the vertical coordinate of the first center point; clustering the second coordinate sites to obtain the second center point, and determining the true frequency of the simultaneous occurrence of the first gene and the second gene based on the second center point.

[0092] like Figure 4 The method includes the following steps:

[0093] S401. Obtain the local computation results of at least two participants; wherein, the local computation results include the distribution frequency of alleles on the SNP, the distribution frequency of alleles includes the first frequency of the first gene appearing at the first site on the SNP, the second frequency of the second gene appearing at the second site on the SNP, the third frequency of the first genome appearing on the SNP, and the fourth frequency of the second genome appearing on the SNP, the third frequency includes the frequency of the second gene appearing at the second site when the first gene appears at the first site, and the fourth frequency includes the frequency of the fourth gene appearing at the second site when the first gene appears at the first site.

[0094] For example, this step can refer to step S101 above, and will not be repeated here.

[0095] S402. Combine the local calculation results of each participant to obtain the coordinate positions to be analyzed for each participant; wherein, the coordinate positions to be analyzed include the first coordinate position composed of the first frequency and the second frequency, and the second coordinate position composed of the third frequency and the fourth frequency.

[0096] For example, this step can refer to step S102 above, and will not be repeated here.

[0097] S403. Cluster the first coordinate sites to obtain the first centroid, and determine the true frequency of the first gene based on the x-coordinate of the first centroid and the true frequency of the second gene based on the y-coordinate of the first centroid; cluster the second coordinate sites to obtain the second centroid, and determine the true frequency of the first gene and the second gene occurring simultaneously based on the second centroid.

[0098] For example, according to a preset clustering algorithm, the first coordinate points in the first frequency coordinate system are clustered to obtain the center point in the first frequency coordinate system, and the center point in the first frequency coordinate system is determined as the first center point. For example, the K-means algorithm can be used for clustering. In this embodiment, no specific limitation is made on the clustering algorithm.

[0099] Determine the coordinates of the first center point to obtain its x-coordinate and y-coordinate. Use the x-coordinate of the first center point as the true frequency of the first gene and the y-coordinate of the first center point as the true frequency of the second gene.

[0100] According to the preset clustering algorithm, the second coordinate points in the second frequency coordinate system are clustered to obtain the center point in the second frequency coordinate system, and the center point in the second frequency coordinate system is determined as the second center point.

[0101] Determine the coordinates of the second center point to obtain its x-coordinate and y-coordinate. Use the x-coordinate of the second center point as the true frequency of the simultaneous occurrence of the first and second genes, and use the y-coordinate of the second center point as the true frequency of the simultaneous occurrence of the first and fourth genes.

[0102] In this embodiment, it is not necessary to determine the true frequencies of the simultaneous occurrence of the second and third genes, or the true frequencies of the simultaneous occurrence of the third and fourth genes; it is sufficient to calculate the true frequency of P(AB). The true frequency of P(AB) is denoted as P(AB). ， .

[0103] S404. Calculate the correlation degree based on the true frequency to determine the gene association relationship between the genes at the first and second loci of the SNP.

[0104] For example, a formula for calculating gene association can be pre-set, and gene association can be represented by gene association degree. The actual frequencies of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first and second genes are substituted into the pre-set formula to calculate the gene association relationship between the first locus and the second locus. For example, the larger the calculated value, the closer the relationship between the first locus and the second locus.

[0105] A threshold for correlation can be preset. The calculated gene correlation value is compared with the threshold. If the correlation value is less than the threshold, it is determined that there is no correlation between the first and second SNP sites. If the correlation value is equal to or greater than the threshold, it is determined that there is a correlation between the first and second SNP sites. When the terminal subsequently uploads SNP site information to the server, it can upload only the SNP site information of one of the two correlated SNP sites.

[0106] The true frequency at the first locus includes the true frequency P(A) of the first gene at the first locus. ， The target distribution frequency P(a) of the third gene at the first point. ， The true frequency at the second locus includes the target distribution frequency P(B) of the second gene at the second locus. ， The target distribution frequency P(b) of the fourth gene at the second locus. ， .

[0107] The true frequency P(A) of the first gene at the first position can be obtained. ， The true frequency P(a) of the third gene at the first position. ， The true frequency P(B) of the second gene at the second locus. ， The true frequency P(b) of the fourth gene at the second locus. ， And the true frequency P(AB) of the simultaneous occurrence of the first and second genes. ， Substituting these values ​​into a preset gene association calculation formula, the gene association between the first locus and the second locus is calculated. For example, it could be P(A). ， P(a) ， P(B) ， P(b) ， And P(AB) ， Set weights for P(A). ， P(a) ， P(B) ， P(b) ， And P(AB) ， A weighted summation is performed to calculate the gene association between the first and second loci.

[0108] The advantage of this setup is that it allows for the direct calculation of gene associations using the five obtained parameters, thus improving the efficiency of gene association determination. When determining gene associations, it considers both the distribution frequency of a single gene at a single SNP locus and the frequency of simultaneous occurrence between two SNP loci, thereby improving the accuracy of gene association determination.

[0109] In this embodiment, the association degree is calculated based on the true frequency to determine the gene association relationship between the genes at the first and second loci of the SNP, including: determining the true frequency of the third gene based on the true frequency of the first gene, and determining the true frequency of the fourth gene based on the true frequency of the second gene; the gene association relationship between the first and second loci is determined according to the following formula:

[0110] D = P(AB) ， -P(A)， ×P(B) ， ;

[0111]

[0112] Among them, R 2 Let P(A) represent gene association relationships, D be an intermediate parameter for calculating gene association relationships, and P(A) be an intermediate parameter for calculating gene association relationships. ， P(B) represents the true frequency of the first gene at the first locus. ， P(a) represents the true frequency of the second gene at the second locus. ， P(b) represents the true frequency of the third gene at the first locus. ， P(AB) represents the true frequency of the fourth gene at the second locus. ， This represents the true frequency of the simultaneous occurrence of the first and second genes.

[0113] Specifically, first, calculate the true frequencies P(AB) of the first gene at the first locus and the second gene at the second locus. ， Subtract the true frequency P(A) of the first gene at the first position. ， The true frequency P(B) of the second gene at the second locus. ， The product of these factors yields the intermediate parameter D of the gene association relationship. Then, the intermediate parameter D of the gene association relationship is divided by P(A). ， P(B) ， P(a) ， P(b) ， The product of the two factors is divided, and the result is multiplied by the intermediate parameter D of the gene association relationship to obtain the final numerical value of the gene association relationship.

[0114] The advantage of this setup is that the gene association between two SNP loci can be automatically calculated using a formula, improving the efficiency and accuracy of determining gene association. This facilitates the uploading of subsequent SNP locus information based on gene association, thereby reducing the amount of information uploaded and improving the efficiency and accuracy of information uploading.

[0115] This application provides a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE (Transparent Environment). By statistically analyzing local calculations of population groups, the distribution frequency of alleles at a single SNP locus is determined for each group. Based on the statistically analyzed local calculations, clustering is performed to determine the true frequencies of the occurrence of a first gene, a second gene, and the simultaneous occurrence of both genes. Based on the true frequencies, the gene association between two SNP loci is determined. This facilitates the identification of one SNP locus from two SNP loci based on the gene association, and only the SNP information of the identified SNP locus is uploaded to the server. This solves the problem in existing technologies where the association between SNP loci cannot be determined, thus affecting gene research, avoiding confusion during information upload, and effectively improving the efficiency of gene research.

[0116] Figure 5 This is a flowchart illustrating a method for securely sharing multi-party medical privacy data based on privacy protection and TEE, according to an embodiment of this application. The method is applied to the terminals of the participating parties and can be executed by a device for securely sharing multi-party medical privacy data based on privacy protection and TEE. Figure 5 As shown, the method includes the following steps:

[0117] S501. Analyze the user's gene data to obtain local calculation results; wherein, the local calculation results include the distribution frequency of alleles on SNPs, the distribution frequency of alleles includes the first frequency of the first gene appearing at the first site on the SNP, the second frequency of the second gene appearing at the second site on the SNP, the third frequency of the first genome appearing on the SNP, and the fourth frequency of the second genome appearing on the SNP, the third frequency includes the frequency of the second gene appearing at the second site when the first gene appears at the first site, and the fourth frequency includes the frequency of the fourth gene appearing at the second site when the first gene appears at the first site.

[0118] For example, the terminal can collect genetic data of a population, i.e., SNP locus information. For instance, if the terminal is a client of a hospital, when a user goes to the hospital for treatment, the user will input their own SNP locus information. The hospital can collect SNP locus information of various people. The various people collected by the hospital constitute a population group, i.e., obtain the SNP locus information of a population group.

[0119] After collecting SNP locus information, the terminal can perform standardization processing on the collected SNP locus information. Standardization processing means that different terminals may collect SNP locus information in different formats, and each terminal converts its own SNP locus information into a preset data format before sending it to the server. For example, the preset data format may be .bed, .bim, or .fam, thereby generating .bed, .bim, or .fam files.

[0120] According to the preset data quality control rules, the converted SNP locus information is processed to obtain local calculation results. The local calculation results include the distribution frequency of alleles on the SNP. The distribution frequency of alleles includes the first frequency of the first gene appearing at the first locus on the SNP, the second frequency of the second gene appearing at the second locus on the SNP, the third frequency of the first gene appearing on the SNP, and the fourth frequency of the second gene appearing on the SNP. The third frequency includes the frequency of the second gene appearing at the second locus when the first gene appears at the first locus, and the fourth frequency includes the frequency of the fourth gene appearing at the second locus when the first gene appears at the first locus.

[0121] The terminal can be pre-set with data quality control rules to clean and control the SNP locus information after format conversion. The processed data is the local calculation result. For example, the data quality control rule could be to delete SNP locus information corresponding to chromosomes with gene defects, thereby cleaning the data. In this embodiment, no specific limitations are made on the data quality control rules.

[0122] In this embodiment, the converted SNP site information is processed according to preset data quality control rules to obtain local calculation results, including: data alignment of the converted SNP site information according to preset data quality control rules to obtain information to be statistically analyzed; and determination of the distribution frequency of alleles at each SNP site from the information to be statistically analyzed according to preset data statistical applications, as the local calculation result.

[0123] Specifically, data quality control rules can be used to align SNP locus information. Based on preset data quality control rules, the transformed SNP locus information is aligned to obtain the information to be statistically analyzed. For example, if default values ​​for SNP locus information are preset, the converted SNP locus information is checked for discrepancies in length. If such discrepancies exist, the preset default values ​​are used to fill in the missing SNP locus information, resulting in complete information for statistical analysis. Based on preset data statistical applications, local calculation results are determined from the information to be analyzed. For example, PLINK software can be used as the data statistical application to perform local calculations.

[0124] The benefits of this setup are that it aligns SNP locus information, facilitates statistical analysis of SNP loci, standardizes the data, and avoids data errors. Using statistical analysis applications to generate a frequency matrix allows the server to perform subsequent calculations based on local results, improving the efficiency and accuracy of determining gene associations.

[0125] S502. The local calculation results are transmitted to the server, where the server combines the local calculation results of each participant to obtain the coordinate sites to be analyzed for each participant. The coordinate sites to be analyzed include a first coordinate site composed of a first frequency and a second frequency, and a second coordinate site composed of a third frequency and a fourth frequency. Clustering is performed on the coordinate sites to be analyzed for each participant to obtain the first centroid of the first coordinate site and the second centroid of the second coordinate site, so as to determine the true frequency of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first gene and the second gene. The correlation is calculated based on the true frequency to determine the gene association relationship between the genes at the first and second sites on the SNP.

[0126] For example, the local calculation results are encrypted to obtain an encrypted local calculation result package and sent to the server; wherein, the server is used to obtain the local calculation results of at least two groups of people and determine the gene association relationship at the two SNP sites based on the local calculation results.

[0127] An encryption algorithm is pre-set; in this embodiment, no specific restrictions are placed on the encryption algorithm. The pre-set encryption algorithm is used to encrypt the local calculation results. That is, the generated frequency matrix is ​​encrypted to obtain an encrypted packet of the local calculation results, which is then sent to the server.

[0128] After receiving the encrypted packet of local calculation results, the server decrypts it using a preset decryption algorithm to obtain the local calculation results of each group of people sent by each terminal. Based on the local calculation results of each group of people, the coordinate sites to be analyzed for each participant are obtained; wherein, the coordinate sites to be analyzed include a first coordinate site composed of a first frequency and a second frequency, and a second coordinate site composed of a third frequency and the fourth frequency. Clustering is performed on the coordinate sites to be analyzed for each participant to obtain the first centroid of the first coordinate site and the second centroid of the second coordinate site, so as to determine the true frequency of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first gene and the second gene. Based on the true frequency, the correlation is calculated to determine the gene association relationship between the genes at the first and second sites on the SNP.

[0129] In this embodiment, the local calculation results are encrypted to obtain an encrypted local calculation result package and sent to the server. This includes: determining the target site to be uploaded to the server based on the gene distribution analysis task issued by the server; encrypting the allele distribution frequency of the target site and sending it to the server.

[0130] Specifically, the server can send gene distribution analysis tasks to the terminal at any time. These tasks can include SNP loci for which the server needs to perform association analysis, and each SNP locus can be represented by a unique identifier. Upon receiving the gene distribution analysis task, the terminal determines the SNP loci for which the server needs to perform association analysis, i.e., it identifies the SNP loci to be uploaded to the server as the target loci. For example, if the gene distribution analysis task indicates that the server needs to analyze the first to tenth SNP loci on the chromosome, then the target loci are the first to tenth SNP loci.

[0131] The local calculation results of the target locus are determined, that is, the allele distribution frequency of the target locus is determined, the allele distribution frequency of the target locus is encrypted, and the encrypted data is sent to the server.

[0132] The advantage of this setup is that the server can manage the analysis tasks, generate gene distribution analysis tasks and send them to each terminal. Each terminal then uploads the local calculation results of the target loci to the server for analysis based on the received tasks. This allows users to set SNP loci according to their needs, improving the flexibility of gene association determination.

[0133] In this embodiment, the local calculation results are encrypted to obtain an encrypted local calculation result package and sent to the server. This includes: determining whether there is a preset association between SNP sites; if so, the SNP sites with the preset association are identified as associated sites; if there are SNP site information of associated sites of people with a preset number threshold, and the preset association is not satisfied, then the local calculation results of the population are not encrypted and sent.

[0134] Specifically, associations between different SNP loci can be pre-defined. An association can be represented as a strong correlation between two SNP loci, or the locus information relationship between them. For example, the association between two SNP loci could be that if the genotype of one SNP locus is A, then the genotype of the other SNP locus is B. If the association between two SNP loci is known in advance, this association can be stored in the terminal.

[0135] After generating the local calculation result, the terminal determines whether it stores a preset association relationship between any two SNP sites. If not, the local calculation result is encrypted and sent to the server. If so, the SNP sites that are associated with each other are identified and designated as a pair of associated sites. For example, there is a preset association relationship between site 1 and site 2, and site 1 and site 2 are a pair of associated sites.

[0136] The algorithm determines whether the gene distribution frequency of the associated loci for each individual in the population satisfies a preset association relationship. If so, the local calculation result is encrypted, and an encrypted local calculation result package is sent to the server. If not, the algorithm determines the number of individuals whose gene distribution frequency at the associated loci does not satisfy the preset association relationship. If this number is greater than or equal to a preset threshold, the population is identified as a special population, and the local calculation results for this population are deleted; that is, the terminal does not encrypt its own local calculation results, nor does it send them to the server. If this number is less than the preset threshold, the local calculation results can continue to be encrypted, and an encrypted local calculation result package can be sent to the server. Alternatively, individuals in the population who do not satisfy the preset association relationship can be removed, and the local calculation results for individuals whose gene distribution frequency at the associated loci satisfies the preset association relationship can be encrypted, and an encrypted local calculation result package can be sent to the server. For example, the association relationship between loci one and loci two is that if the genotype of one SNP locus is A, then the genotype of the other SNP locus is B; if the genotype of one SNP locus is a, then the genotype of the other SNP locus is b. Determine whether the genotypes at locus 1 and locus 2 of each individual in the population satisfy the association relationship. If a large number of individuals do not satisfy the association relationship between locus 1 and locus 2, it indicates that the population is highly specific and cannot represent the general population. Therefore, it is not necessary to send the local calculation results of this population to the server.

[0137] The advantage of this setup is that, based on pre-defined associations between SNP loci, it determines whether individuals within a population satisfy those associations, thereby establishing population specificity. Removing highly specific populations improves data accuracy, while less specific populations are used as the data to be uploaded, resulting in a more accurate representation of gene distribution frequencies and improving the precision of gene association determination.

[0138] This application provides a method for secure sharing of multi-party medical privacy data based on privacy protection and TEE (Transparent External Equipment). The terminal collects SNP (Single Novel Coronavirus) locus information from a population, processes the SNP information to obtain local calculation results, achieving a unified data format for easy server-side analysis. The terminal encrypts the local calculation results before sending them to the server, improving data transmission security. The server determines the association relationships between SNP loci based on the local calculation results. This helps reduce the amount of data collected and transmitted in subsequent studies. By determining the gene association relationships between SNP loci, further research on genes at SNP loci can be achieved, improving the efficiency of gene research and information transmission.

[0139] Figure 6This diagram illustrates a structural block diagram of a multi-party medical privacy data secure sharing device based on privacy protection and TEE (Technical Equipment for External Data), provided as an embodiment of this application. This device is applied on a server-side basis. For ease of explanation, only the parts relevant to the embodiments of this disclosure are shown. (Refer to...) Figure 6 The device includes: an information acquisition module 601, a data combination module 602, a frequency determination module 603, and a correlation determination module 604.

[0140] The information acquisition module 601 is used to acquire the local calculation results of at least two participants; wherein, the local calculation results include the distribution frequency of alleles on the SNP, the distribution frequency of alleles includes a first frequency of the first gene appearing at the first site on the SNP, a second frequency of the second gene appearing at the second site on the SNP, a third frequency of the first genome appearing on the SNP, and a fourth frequency of the second genome appearing on the SNP, wherein the third frequency includes the frequency of the second gene appearing at the second site when the first gene appears at the first site, and the fourth frequency includes the frequency of the fourth gene appearing at the second site when the first gene appears at the first site;

[0141] The data combination module 602 is used to combine the local calculation results of each participant to obtain the coordinate positions to be analyzed for each participant; wherein, the coordinate positions to be analyzed include a first coordinate position composed of the first frequency and the second frequency, and a second coordinate position composed of the third frequency and the fourth frequency;

[0142] The frequency determination module 603 is used to perform clustering based on the coordinate sites to be analyzed of each participant to obtain the first center point of the first coordinate site and the second center point of the second coordinate site, so as to determine the true frequency of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first gene and the second gene.

[0143] The association determination module 604 is used to calculate the association degree based on the true frequency in order to determine the gene association relationship between the genes at the first and second sites of the SNP.

[0144] Figure 7 This application provides a structural block diagram of a multi-party medical privacy data secure sharing device based on privacy protection and TEE, in an embodiment of the present application. Figure 6 Based on the illustrated embodiments, as Figure 7 As shown, the frequency determination module 603 includes a first clustering unit 6021 and a second clustering unit 6022.

[0145] The first clustering unit 6021 is used to cluster the first coordinate sites to obtain the first center point, and to determine the true frequency of the first gene based on the horizontal coordinate of the first center point, and to determine the true frequency of the second gene based on the vertical coordinate of the first center point.

[0146] The second clustering unit 6022 is used to cluster the second coordinate sites to obtain the second center point, and to determine the true frequency of the simultaneous occurrence of the first gene and the second gene based on the second center point.

[0147] In one example, the association determination module 604 is specifically used for:

[0148] The true frequency of the third gene is determined based on the true frequency of the first gene, and the true frequency of the fourth gene is determined based on the true frequency of the second gene.

[0149] The gene association between genes at the first locus and the second locus is determined using the following formula:

[0150] D = P(AB) ， -P(A) ， ×P(B) ， ;

[0151]

[0152] Among them, R 2 Let P(A) represent gene association relationships, where D is an intermediate parameter for calculating gene association relationships. ， P(B) represents the true frequency of the first gene at the first locus. ， P(a) represents the true frequency of the second gene at the second locus. ， P(b) represents the true frequency of the third gene at the first locus. ， P(AB) represents the true frequency of the fourth gene at the second locus. ， This represents the true frequency of the simultaneous occurrence of the first and second genes.

[0153] In one example, the device also includes:

[0154] The data receiving module is used to receive encrypted local computation results and pass them into the trusted execution environment;

[0155] The decryption module is used to decrypt the encrypted local computation results in a trusted execution environment, so as to complete the step of determining the gene association relationship based on the decrypted local computation results in the trusted execution environment.

[0156] In one example, the device also includes:

[0157] The rule determination module is used to determine gene uploading rules and gene restoration rules based on the gene association relationship. The gene uploading rules are used to determine the genes to be removed in the SNP, and the gene restoration rules are used to restore gene information based on the genes with association relationships in the SNP.

[0158] The rule distribution module is used to distribute gene upload rules to the information uploader, so that the information uploader can remove the related genes in the SNP according to the gene upload rules to form a processed SNP;

[0159] The restoration module is used to receive the processed SNPs and restore the removed genes according to the gene restoration rules, so as to perform analysis based on the restored SNPs.

[0160] In one example, the device also includes:

[0161] The interactive module is used to provide an interactive page and obtain the first and second loci to be analyzed based on the interactive page;

[0162] The task sending module is used to establish analysis tasks for the first and second points and send the analysis tasks to the participants to obtain the local calculation results of each participant.

[0163] In one example, the device also includes:

[0164] The evaluation rule generation module is used to obtain information on related loci and form evaluation rules;

[0165] The evaluation rule sending module is used to send the evaluation rules to each participant, so that each participant can calculate the actual relationship between the related sites in the sample data locally, and determine the sample data that does not match the preset relationship as low-quality sample data.

[0166] The results acquisition module is used to obtain the local calculation results of the sample data after removing low-quality sample data.

[0167] Figure 8 This diagram illustrates a structural block diagram of a multi-party medical privacy data secure sharing device based on privacy protection and TEE (Technical Equipment for External Data), provided as an embodiment of this application. This device is applied to the terminals of the participating parties. For ease of explanation, only the parts relevant to the embodiments of this disclosure are shown. (Refer to...) Figure 8 The device includes a data analysis module 801 and a data transmission module 802.

[0168] The data analysis module 801 is used to analyze the user's genetic data and obtain local calculation results. The local calculation results include the distribution frequency of alleles on SNPs. The distribution frequency of alleles includes a first frequency of the first gene appearing at the first site of the SNP, a second frequency of the second gene appearing at the second site of the SNP, a third frequency of the first gene appearing on the SNP, and a fourth frequency of the second gene appearing on the SNP. The third frequency includes the frequency of the second gene appearing at the second site when the first gene appears at the first site, and the fourth frequency includes the frequency of the fourth gene appearing at the second site when the first gene appears at the first site.

[0169] The data transmission module 802 is used to transmit the local calculation results to the server, so that the server can combine the local calculation results of each participant to obtain the coordinate sites to be analyzed for each participant; wherein, the coordinate sites to be analyzed include a first coordinate site composed of the first frequency and the second frequency, and a second coordinate site composed of the third frequency and the fourth frequency; clustering is performed on the coordinate sites to be analyzed for each participant to obtain the first center point of the first coordinate site and the second center point of the second coordinate site, so as to determine the true frequency of the occurrence of the first gene, the occurrence of the second gene, and the simultaneous occurrence of the first gene and the second gene; the correlation is calculated based on the true frequency to determine the gene association relationship between the genes at the first and second sites on the SNP.

[0170] Figure 9 A structural block diagram of an electronic device provided in an embodiment of this application, such as... Figure 9 As shown, the electronic device includes: a memory 91 and a processor 92; the memory 91 is a memory used to store instructions executable by the processor 92.

[0171] The processor 92 is configured to perform the methods provided in the embodiments described above.

[0172] The electronic device also includes a receiver 93 and a transmitter 94. The receiver 93 is used to receive instructions and data sent by other devices, and the transmitter 94 is used to send instructions and data to external devices.

[0173] Figure 10 This is a block diagram illustrating an electronic device according to an exemplary embodiment. The device may be a mobile phone, computer, digital broadcasting terminal, messaging device, game console, tablet device, medical device, fitness device, personal digital assistant, etc.

[0174] Device 1000 may include one or more of the following components: processing component 1002, memory 1004, power supply component 1006, multimedia component 1008, audio component 1010, input / output (I / O) interface 1012, sensor component 1014, and communication component 1016.

[0175] Processing component 1002 typically controls the overall operation of device 1000, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 1002 may include one or more processors 1020 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 1002 may include one or more modules to facilitate interaction between processing component 1002 and other components. For example, processing component 1002 may include a multimedia module to facilitate interaction between multimedia component 1008 and processing component 1002.

[0176] Memory 1004 is configured to store various types of data to support the operation of device 1000. Examples of this data include instructions for any application or method operating on device 1000, contact data, phonebook data, messages, pictures, videos, etc. Memory 1004 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0177] Power supply component 1006 provides power to various components of device 1000. Power supply component 1006 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to device 1000.

[0178] Multimedia component 1008 includes a screen that provides an output interface between the device 1000 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 1008 includes a front-facing camera and / or a rear-facing camera. When the device 1000 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.

[0179] Audio component 1010 is configured to output and / or input audio signals. For example, audio component 1010 includes a microphone (MIC) configured to receive external audio signals when device 1000 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 1004 or transmitted via communication component 1016. In some embodiments, audio component 1010 also includes a speaker for outputting audio signals.

[0180] I / O interface 1012 provides an interface between processing component 1002 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.

[0181] Sensor assembly 1014 includes one or more sensors for providing state assessments of various aspects of device 1000. For example, sensor assembly 1014 may detect the on / off state of device 1000, the relative positioning of components such as the display and keypad of device 1000, changes in the position of device 1000 or a component of device 1000, the presence or absence of user contact with device 1000, the orientation or acceleration / deceleration of device 1000, and temperature changes of device 1000. Sensor assembly 1014 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 1014 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 1014 may also include an accelerometer, a gyroscope, a magnetometer, a pressure sensor, or a temperature sensor.

[0182] Communication component 1016 is configured to facilitate wired or wireless communication between device 1000 and other devices. Device 1000 can access wireless networks based on communication standards, such as WiFi, 2G, or 3G, or combinations thereof. In one exemplary embodiment, communication component 1016 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 1016 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0183] In an exemplary embodiment, device 1000 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.

[0184] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 1004 including instructions, which can be executed by a processor 1020 of device 1000 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.

[0185] A non-transitory computer-readable storage medium, when the instructions in the storage medium are executed by the processor of a terminal device, enables the terminal device to perform the aforementioned method for secure sharing of multi-party medical privacy data based on privacy protection and TEE.

[0186] This application also discloses a computer program product, including a computer program that, when executed by a processor, implements the method described in this embodiment.

[0187] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or electronic device.

[0188] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0189] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0190] The systems and technologies described herein can be implemented in computing systems that include back-end components (e.g., as data electronic devices), or computing systems that include middleware components (e.g., application electronic devices), or computing systems that include front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0191] Computer systems can include client and electronic devices. Clients and electronic devices are generally geographically separated and typically interact via communication networks. The client-electronic device relationship is created by computer programs running on the respective computers and having a client-electronic device relationship with each other. The electronic device can be a cloud electronic device, also known as a cloud computing electronic device or cloud host, a host product within the cloud computing service system, addressing the shortcomings of traditional physical hosts and VPS services ("Virtual Private Server," or simply "VPS") in terms of management difficulty and weak business scalability. The electronic device can also be an electronic device in a distributed system or an electronic device incorporating blockchain technology. It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application is achieved, and this is not limited herein.

[0192] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0193] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A privacy protection and TEE-based multi-party medical privacy data secure sharing method, characterized in that, The method is applied to a server, and the method comprises: obtaining local calculation results of at least two participants; wherein the local calculation results comprise distribution frequencies of alleles on SNPs, the distribution frequencies of the alleles comprising a first frequency of a first gene appearing at a first locus on the SNPs, a second frequency of a second gene appearing at a second locus on the SNPs, and a third frequency of a first genome appearing on the SNPs, and a fourth frequency of a second genome appearing on the SNPs, the third frequency comprising a frequency of the second gene appearing at the second locus when the first gene appears at the first locus, and the fourth frequency comprising a frequency of the fourth gene appearing at the second locus when the first gene appears at the first locus; combining the local calculation results of the participants to obtain coordinate sites to be analyzed of the participants; wherein the coordinate sites to be analyzed comprise first coordinate sites combined from the first frequency and the second frequency, and second coordinate sites combined from the third frequency and the fourth frequency; clustering the coordinate sites to be analyzed of the participants to obtain a first center point of the first coordinate sites and a second center point of the second coordinate sites, to determine real frequencies of the first gene appearing, the second gene appearing, and the first gene and the second gene appearing simultaneously; performing correlation degree calculation according to the real frequencies, to determine a gene correlation between the genes at the first locus and the second locus on the SNPs; clustering the coordinate sites to be analyzed of the participants to obtain a first center point of the first coordinate sites and a second center point of the second coordinate sites, to determine real frequencies of the first gene appearing, the second gene appearing, and the first gene and the second gene appearing simultaneously, comprising: clustering the first coordinate sites to obtain the first center point, and determining the real frequency of the first gene according to an abscissa of the first center point, and determining the real frequency of the second gene according to an ordinate of the first center point; clustering the second coordinate sites to obtain the second center point, and determining the real frequency of the first gene and the second gene appearing simultaneously according to the second center point.

2. The method of claim 1, wherein, performing correlation degree calculation according to the real frequencies, to determine a gene correlation between the genes at the first locus and the second locus on the SNPs, comprising: determining a real frequency of a third gene according to the real frequency of the first gene, and determining a real frequency of a fourth gene according to the real frequency of the second gene; determining the gene correlation between the genes at the first locus and the second locus according to the following formula: ； ； wherein, represents a genetic association relationship, D is an intermediate parameter for calculating the genetic association relationship, is a true frequency of a first gene at the first locus, is a true frequency of a second gene at the second locus, is a true frequency of a third gene at the first locus, is a true frequency of a fourth gene at the second locus, is a true frequency of the simultaneous occurrence of the first gene and the second gene.

3. The method of claim 1, wherein, The method further comprises: receiving encrypted local calculation results, and transmitting the encrypted local calculation results into a trusted execution environment; decrypting the encrypted local calculation results in the trusted execution environment, to complete, in the trusted execution environment, the step of determining the gene correlation according to the decrypted local calculation results.

4. The method of claim 1, wherein, The method further comprises: determining a gene uploading rule and a gene restoration rule according to the gene correlation, the gene uploading rule being used to determine genes to be removed from the SNPs, and the gene restoration rule being used to restore gene information according to genes having a correlation in the SNPs; The gene uploading rule is sent to the information uploading party, so that the information uploading party removes the genes having the correlation relationship in the SNP according to the gene uploading rule, and forms the processed SNP; The processed SNP is received, and the removed genes are restored according to the gene restoration rule, so that the SNP after restoration is analyzed.

5. The method of claim 1, wherein, The method further comprises: An interactive page is provided, and a first locus and a second locus to be analyzed are obtained according to the interactive page; An analysis task of the first locus and the second locus is established, and the analysis task is sent to the participants to obtain local calculation results of each participant.

6. The method of claim 1, wherein, The method further comprises: Locus information having a correlation relationship is obtained, and an evaluation rule is formed; The evaluation rule is sent to each participant, so that each participant calculates the actual relationship between the loci having the correlation relationship in the sample data locally, and determines sample data in which the actual relationship does not match the preset correlation relationship as low-quality sample data; Local calculation results of sample data after removing the low-quality sample data are obtained.

7. A privacy protection and TEE-based multi-party medical privacy data secure sharing method, characterized in that, The method is applied to a terminal of a participant, and the method comprises: Genetic data of a user are analyzed to obtain local calculation results; wherein the local calculation results comprise distribution frequencies of alleles on a SNP, the distribution frequencies of the alleles comprise a first frequency of a first locus appearing on the SNP, a second frequency of a second locus appearing on the SNP, a third frequency of a first gene group appearing on the SNP, and a fourth frequency of a second gene group appearing on the SNP, the third frequency comprises a frequency of the second locus appearing when the first locus appears, and the fourth frequency comprises a frequency of the fourth locus appearing when the first locus appears; The local calculation results are transmitted to a server, so that the server combines the local calculation results of each participant to obtain coordinate loci to be analyzed of each participant; wherein the coordinate loci to be analyzed comprise a first coordinate locus combined from the first frequency and the second frequency, and a second coordinate locus combined from the third frequency and the fourth frequency; clustering is performed according to the coordinate loci to be analyzed of each participant to obtain a first center point of the first coordinate locus and a second center point of the second coordinate locus, so as to determine real frequencies of the first locus appearing, the second locus appearing, and the first locus and the second locus appearing at the same time; correlation degree calculation is performed according to the real frequencies, so as to determine a gene correlation relationship between genes on the first locus and the second locus on the SNP; The clustering according to the coordinate loci to be analyzed of each participant to obtain the first center point of the first coordinate locus and the second center point of the second coordinate locus, so as to determine real frequencies of the first locus appearing, the second locus appearing, and the first locus and the second locus appearing at the same time, comprises: The first coordinate locus is clustered to obtain the first center point, and a real frequency of the first locus is determined according to an abscissa of the first center point, and a real frequency of the second locus is determined according to an ordinate of the first center point. The second coordinate points are clustered to obtain the second center point, and the true frequency of simultaneous appearance of the first gene and the second gene is determined according to the second center point.

8. A privacy protection and TEE-based multi-party medical privacy data secure sharing device, characterized in that, The device is applied to a server, and the device comprises: An information acquisition module is configured to acquire local calculation results of at least two participants; wherein the local calculation results comprise distribution frequencies of alleles on SNPs, and the distribution frequencies of the alleles comprise a first frequency of appearance of a first gene at a first locus on an SNP, a second frequency of appearance of a second gene at a second locus on the SNP, a third frequency of appearance of a first gene group on the SNP, and a fourth frequency of appearance of a second gene group on the SNP, the third frequency comprising a frequency of appearance of the second gene at the second locus when the first gene appears at the first locus, and the fourth frequency comprising a frequency of appearance of the fourth gene at the second locus when the first gene appears at the first locus; A data combination module is configured to combine the local calculation results of the participants to obtain to-be-analyzed coordinate points of the participants; wherein the to-be-analyzed coordinate points comprise first coordinate points combined from the first frequency and the second frequency, and second coordinate points combined from the third frequency and the fourth frequency; A frequency determination module is configured to cluster the to-be-analyzed coordinate points of the participants to obtain a first center point of the first coordinate points and a second center point of the second coordinate points, so as to determine true frequencies of appearance of the first gene, appearance of the second gene, and simultaneous appearance of the first gene and the second gene; An association relationship determination module is configured to perform correlation degree calculation according to the true frequencies, so as to determine a gene association relationship between genes at the first locus and the second locus on the SNP; The frequency determination module comprises: A first clustering unit is configured to cluster the first coordinate points to obtain the first center point, and determine a true frequency of the first gene according to an abscissa of the first center point and a true frequency of the second gene according to an ordinate of the first center point; A second clustering unit is configured to cluster the second coordinate points to obtain the second center point, and determine a true frequency of simultaneous appearance of the first gene and the second gene according to the second center point.

9. An electronic device, comprising: Comprise: A processor, and a memory in communication connection with the processor; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory, so as to implement the privacy protection and TEE-based multi-party medical privacy data secure sharing method according to any one of claims 1-6 or 7.

Images