A privacy preserving method for medical frameworks based on an oblivious transfer protocol

Abstract

The application discloses a privacy protection method based on an inadvertent transmission protocol suitable for a medical framework, and comprises the following steps: a sensor is registered on a mobile phone end through a physically unclonable function, and a doctor is registered on a server end. The sensor and the mobile phone end are verified with each other after registration is completed, so that data can be transmitted only when the devices are in a trusted state. The mobile phone end obtains original data, encrypts the original data, and uploads the encrypted data to the server end. In the data access stage, the doctor verifies his / her identity to the server end, and the server end re-encrypts original ciphertext by using a proxy re-encryption technology. The doctor and the server end interact with each other by using the inadvertent transmission protocol, so that the doctor obtains corresponding ciphertext. Finally, the doctor decrypts the ciphertext to obtain the original data of the sensor. The application provides a solution capable of realizing privacy protection for the sensor and the doctor under the premise of having a legal identity.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a privacy protection method based on an unintentional transmission protocol applicable to the medical framework. Background Technology

[0002] The Internet of Things in Healthcare (IoMT) is an Internet of Things (IoT) that includes patients and medical sensors. Patients can share real-time medical data collected within the IoMT with healthcare professionals. Typically, the IoMT consists of three layers: a data acquisition layer, a data processing layer, and a healthcare service layer. The data acquisition layer mainly includes physiological data (heart rate, body temperature, blood oxygen, etc.), motion data, and environmental data collected by various wearable sensors, which are then transmitted to a mobile phone. In the data processing layer, servers store the data and perform calculations and analyses. The healthcare service layer allows doctors to interact with the server to ensure they can access patient data and provide timely diagnoses or advice. The IoMT effectively helps doctors understand patients' real-time health status and serves as an early warning system for potential diseases. However, at every stage of collection, transmission, and interaction, it involves the potential for sensitive data leakage. To achieve secure information transmission and sharing, we designed a data privacy transmission method based on an unintentional transmission protocol suitable for the medical framework. The method employs proxy re-encryption and an unintentional transmission protocol. Proxy re-encryption utilizes a third party to re-encrypt the ciphertext, ensuring data confidentiality. Data stored on the server can be decrypted using only the user's private key, without needing the server's key. The unintentional transmission protocol provides bidirectional privacy protection for both the server and client. The server only wants the client to receive selected messages, and the client doesn't want the server to know other messages, thus guaranteeing the privacy of both parties.

[0003] To facilitate timely treatment for patients, (IoMT) is constantly evolving. It can rapidly collect patients' physiological data and provide it to doctors, who can then analyze and diagnose patients' symptoms promptly. Subsequently, a medical framework is being gradually established to standardize the various stages of smart healthcare. In 2009, Wendt et al. identified three forms of healthcare system transformation, which also addressed the need to establish a comprehensive conceptual framework to analyze healthcare systems and their transformation. With the continuous improvement of wearable sensors, the amount of data that can be collected is growing exponentially. In 2013, Chalwa et al. proposed a patient-centered framework that introduces big data into personalized healthcare, demonstrating its applicability to patient-centered outcomes and reducing readmission rates. To protect privacy, Sharma et al. proposed a privacy-preserving scheme for healthcare applications based on WSNs in 2018, which employs the concepts of secret sharing and hash functions. Then, in the same year, Yang et al. proposed an efficient and privacy-preserving e-health disease risk prediction scheme that combines super-increasing sequences with homomorphic cryptographic algorithms. In 2020, Huang et al. proposed a responsible and efficient industrial IoT data sharing scheme that decentralizes the k-out-n unintentional transmission protocol and zero-knowledge proof technology to enable the private keys of data recipients. In 2021, Alie et al. proposed a novel medical monitoring framework based on a cloud environment and big data analytics engine, enabling precise storage and analysis of medical data and improving classification accuracy. In the same year, Wang et al. proposed a forward privacy protection scheme for IoT medical systems, primarily including searchable encryption schemes to achieve privacy protection and searchability. In 2022, Joseph et al. proposed applying blockchain to improve medical record management, reducing the complexity and cost characteristics of healthcare systems and providing a distributed transaction database. Their approach is essentially a system that uses IoT modules to intercept and retrieve data generated by patient wearable devices. The proposed blockchain system is well-suited for storing and preserving patient data in the form of multiple transactions and providing access control for all parties involved in the protocol. In 2023, Rajadevi et al. proposed using a Blockchain-Assisted Secure Data Management Framework (BSDMF) and a Proof-of-Activity (PoA) protocol with a malware detection algorithm to improve data security on healthcare systems. Malware is detected through a degradation mechanism, thus providing security in data records. The algorithm provides efficient data communication within the blockchain network, offering high security and large storage capacity. Degradation techniques further improve computational resource utilization and betting generation. By identifying node attacks early, the security of the blockchain and the IoMT model is enhanced, allowing malware detection technology to function perfectly. Summary of the Invention

[0004] Purpose of the invention: To address the problems existing in the prior art, this invention discloses a privacy protection method based on an unintentional transmission protocol applicable to the medical framework. It achieves physical security of the device through a physically unclonable function, and the proxy re-encryption enables the decryption of data stored on the server using its own private key. Furthermore, the use of the unintentional transmission protocol ensures the privacy of both communicating parties.

[0005] Technical Solution: This invention discloses a privacy protection method based on an unintentional transmission protocol applicable to the medical framework, comprising the following steps:

[0006] Step 1: System initialization phase: Given a security parameter k, set two multiplication cyclic groups G and G T p is a group G and G T Given that p is a prime number and the bilinear mapping e: G×G→G T Let g be a generator of group G. Randomly select another generator g1∈G and compute Z=e(g,g1); define two secure cryptographic hash functions. Mapping a bit string of length n onto a finite field, Mapping from a finite field to a multiplicative cyclic group G; selecting a random value on the mobile device. As the private key sk p =(x p,1 ,x p,2 ), and calculate the corresponding public key. Mobile client publicly discloses system parameters {G,G T ,e,g,g1,Z,H1,H2,pk p}, and save its own private key sk p ;

[0007] Step 2: The sensor uses Physically Unclonable Function (PUF) and non-interactive zero-knowledge proof to obtain identity verification π. i Register with the mobile device to become a legitimate device and include the sensor's identity information (c i ,pk i Send to the mobile device; the doctor confirms the public key PK. d Subsequently, a non-interactive zero-knowledge proof method was used to obtain identity verification Π proof Register as a legitimate user on the server, along with the doctor's public key and identity information (pk). d D id Send them together to the server;

[0008] Step 3: The sensor and the mobile device complete mutual verification to ensure that the device is in a trusted state;

[0009] Step 4: The raw sensor data obtained from the mobile device is uploaded to the server using a proxy re-encryption method, and a corresponding tag is generated for each data point;

[0010] Step 5: After the doctor is authenticated by the server, the doctor obtains the patient's medical data when diagnosing the patient; the server sends the doctor's public key to the mobile device and generates a conversion key using the private key proxy re-encryption algorithm. After receiving the conversion key, the server encrypts it using the private key proxy re-encryption algorithm to generate a new ciphertext.

[0011] Step 6: The server and the doctor execute an unintentional transmission protocol. Assume the server stores n encrypted CT scans. d.y Where 1≤y≤n, each ciphertext ct d.y Each corresponds to a unique label ω y The data is transmitted in the channel after being encrypted; the server publishes the encryption parameters, the doctor selects the sensor data to be acquired by the tag, calculates the mask value of the corresponding tag, and then sends it to the server. The server calculates the corresponding parameter value and sends it to the doctor. The doctor decrypts the ciphertext, obtains the encryption parameters corresponding to the sensor data, and uses the encryption parameters to determine the ciphertext.

[0012] Step 7: Doctors obtain encrypted CT scans d Decryption is performed after =(t′1,t′2): Doctor calculates

[0013] Furthermore, the specific operations for the sensor and doctor to register as legitimate users with the mobile phone and server respectively in step 2 are as follows:

[0014] S2.1: The sensor first selects a random value. The response value of the Physically Unclonable Function (PUF) is used as the input to the PUF and is then used as the private key sk. i And use this to calculate the sensor's public key. Next, in order to complete the registration on the mobile device, a non-interactive zero-knowledge proof method is required, in which the sensor selects a random value. And construct commitment values ​​for identity verification respectively. Challenge value H i =H1(c i ||pk i ||V i ||ID), response value W i =H i ·r i Finally, the above numerical values ​​are combined to form the identity verification π. i Send to mobile device;

[0015] S2.2: After receiving the identity verification sent by the sensor for registration, the mobile device calculates the challenge value H′. i And check the formula The system checks whether the formula is valid to verify the legitimacy of the identity verification. If the formula is invalid, registration fails and an error symbol ⊥ is output; otherwise, the mobile device will send the sensor's identity information (c i ,pk i ) Stored in its own data list;

[0016] S2.3: The doctor first selects a random value. As the private key sk d And use this to calculate the corresponding public key. Using a non-interactive zero-knowledge proof method, the doctor selects a random value. And calculate the commitment value respectively. Challenge value K = H1(D id ‖pk d Committ1 and Committ2) and the response value R1 = x d,1 ·(r1+K), R2=x d,2 ·(r²+K); Finally, synthesize the above values ​​into identity verification Π proof And the doctor's public key and identity information (pk) d D id Send them together to the server;

[0017] S2.4: After receiving the identity verification sent by the doctor for registration, the server calculates the challenge value K' and checks the formula. The system checks whether the formula is valid to verify the legitimacy of the identity verification. If the formula is invalid, registration fails and an error symbol ⊥ is output; otherwise, the server will send the doctor's identity information (pk) to the server. d D id It is stored in its own data list.

[0018] Furthermore, the specific process of mutual verification between the sensor and the mobile phone in step 3 is as follows:

[0019] S3.1: The sensor first actively sends an authentication request to the mobile device, sending the sensor's ID to the mobile device. After receiving the authentication request, the mobile device randomly selects a pair of data (c', pk') from the data list and signs the data using the Pointcheval signature method; the mobile device then selects a random value. Calculate separately The two are combined to form a signature σ(c') = (h,s); finally, the mobile device sends c' and the signature σ(c') to the sensor.

[0020] S3.2: After receiving the identity verification value c' and signature σ(c') sent by the mobile phone, the sensor calculates the identity verification value. And check the formula Check if the formula is true; if the formula is false, output the error symbol ⊥; if the formula is true, it means that the mobile phone has verified the identity through the sensor, and continue to step S3.3.

[0021] S3.3: The sensor uses c' as input to the Physically Unclonable Function (PUF) and obtains the function's response value as the verification private key sk'. s And calculate the corresponding verification public key. Then, select a random value. Then, construct the commitment value V', challenge value H', and response value W' respectively, and finally, generate the identity verification certificate π' from the above verification information;

[0022] S3.4: The sensor selects a random value calculate Y=y·g, Z=x·Y, α=H2(d), T=H1(x‖Y‖Z‖α), in The XOR operator is used, where m is the plaintext raw data from the sensor. Finally, the authentication certificate π' and the encrypted data information (d, Y, M') are sent to the mobile phone.

[0023] S3.5: The mobile device first determines the data in its own data list. Check if the condition is true or false. If they are not equal, output an error symbol ⊥. If they are equal, continue to step S3.6.

[0024] S3.6: Mobile App Check Formula Check if the formula is true or false. If the formula is false, output the error symbol ⊥. If the formula is true, it means that the sensor has passed the identity verification of the mobile phone. Continue to step S3.7.

[0025] S3.7: After verification, the mobile phone decrypts the ciphertext and calculates... Z=x·Y, α=H2(d), T=H1(x‖Y‖Z‖α), At this point, the mobile device obtains the raw sensor data m.

[0026] Furthermore, the specific operation in step 4 is as follows:

[0027] S4.1: The mobile device generates a unique label ω for each piece of raw data m in order to reduce time complexity and communication overhead during unintentional transmission.

[0028] S4.2: Select a random value on the mobile device Each original data m is encrypted, and the ciphertext is calculated. Finally, combine the tag and ciphertext (ω, ct) p Package and upload to the server.

[0029] Furthermore, the specific operation in step 5 is as follows:

[0030] S5.1: The doctor will present his / her identification document. proof and public key and identity information (pk) d D id Together, they are sent to the server for verification, including the identity verification Π proof It includes commitment values ​​Committ1 and Committ2, challenge value K, and response values ​​R1 and R2;

[0031] S5.2: The server receives the doctor's identification document. proof Then calculate the corresponding challenge value K' and check the formula. Check if the formula is true; if it is false, output an error symbol ⊥; if it is true, the server checks the tuple identity information (pk). d D id If it is stored in its own data list, proceed to step S5.3;

[0032] S5.3: The server will perform a key-based authentication (PK) on the doctor's public key. d Send to the mobile device to generate the conversion key; the mobile device selects a random value. The conversion key for data access is calculated using a private key proxy re-encryption algorithm. Finally, the mobile device will generate the conversion key tk p→d Send to the server;

[0033] S5.4: The server receives the conversion key tk generated by the mobile device. p→d Then select a random value And all encrypted ct files stored locally p Perform private key proxy re-encryption to generate new ciphertext. Where c = (x p,1 +r)·k+ss'.

[0034] Furthermore, the specific operations of the server and doctor executing the unintentional transmission protocol in step 6 are as follows:

[0035] S6.1: The server selects a random value. Calculate encryption parameter A = g a B = g b , The ciphertext is then encrypted according to the encryption parameters, and calculations are performed. Where 1≤y≤n, The XOR operator is used to expose all encrypted parameters (A, B, P) on the server side. y );

[0036] S6.2: Doctors use the tag ω j Select k sensor data points that you want to acquire, where 1 ≤ j ≤ k, and then select random values. And calculate ω for the selected k labels. j mask value Finally, the k mask values ​​A j Send to the server;

[0037] S6.3: The server receives k mask values ​​A from the doctor. j Then, calculate the corresponding k parameters. Finally, the k parameters D j Send to the doctor;

[0038] S6.4: The doctor receives the information about the mask value A sent by the server. j Parameter D j Then, the ciphertext is decomposed, and k parameters are calculated. This allows you to obtain the encrypted parameters corresponding to the sensor data you want; finally, you can use the encrypted parameter Y′ j Calculate the ciphertext Where 1≤j≤k.

[0039] Beneficial effects:

[0040] This invention constructs a privacy protection method based on an unintentional transfer protocol suitable for the medical framework. Our solution combines the advantages of unintentional transfer protocols and physical non-cloning capabilities, achieving user and doctor authentication and privacy-preserving data transmission while ensuring physical security. Since servers storing data are highly vulnerable to third-party attacks, potentially leading to the leakage of user privacy data, we utilize proxy re-encryption to effectively mitigate this security vulnerability. Proxy re-encryption is effective because it re-encrypts ciphertext, allowing doctors to decrypt it without needing the user's private key, thus ensuring user data security. Furthermore, we employ an unintentional transfer protocol for data interaction between the doctor and the server, preventing the server from determining the user data selected by the doctor, and preventing the doctor from knowing the data of other users on the server, while still ensuring the confidentiality and integrity of shared messages. Compared to recent solutions, our solution is more efficient. Therefore, our solution is suitable for application in smart healthcare environments with high security requirements. Attached Figure Description

[0041] Figure 1 This is a system model diagram of the present invention. Detailed Implementation

[0042] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0043] This invention discloses a privacy protection method based on an unintentional transmission protocol applicable to the medical framework, comprising the following steps:

[0044] S1: System initialization phase: Given a security parameter k, set two multiplication cyclic groups G and G0. T p is a group G and G T Given that p is a prime number and the bilinear mapping e: G×G→G T Let g be a generator of group G. Randomly select another generator g1 ∈ G and compute Z = e(g, g1). Define two secure cryptographic hash functions. Mapping a bit string of length n onto a finite field. Mapping from a finite field to the multiplicative cyclic group G. (Mobile device selects random value.) As the private key sk p =(x p,1 ,x p,2 ), and calculate the corresponding public key. Mobile client publicly discloses system parameters {G,G T ,e,g,g1,Z,H1,H2,pk p}, and save its own private key sk p .

[0045] S2: Registration Phase: The sensor needs to register with the mobile app to become a legitimate device, and the doctor needs to register with the server to become a legitimate user. This includes the following steps:

[0046] S2.1: The sensor first selects a random value. The response value of the Physically Unclonable Function (PUF) is used as the input to the PUF and is then used as the private key sk. i And use this to calculate the sensor's public key. Next, in order to complete the registration on the mobile device, a non-interactive zero-knowledge proof method is required, in which the sensor selects a random value. And construct commitment values ​​for identity verification respectively. Challenge value H i =H1(c i ||pk i ||V i ||ID), response value W i =H i ·r i Finally, the above numerical values ​​are combined to form the identity verification π. iSend to mobile device.

[0047] S2.2: After receiving the identity verification sent by the sensor for registration, the mobile device calculates the challenge value H′. i And check the formula The system checks whether the formula is valid to verify the legitimacy of the identity verification. If the formula is invalid, registration fails and an error symbol ⊥ is output. Otherwise, the mobile device will send the sensor's identity information (c i ,pk i It is stored in its own data list.

[0048] S2.3: The doctor first selects a random value. As the private key sk d And use this to calculate the corresponding public key. Next, to complete the registration on the server side, a non-interactive zero-knowledge proof method is also required. Then, the doctor selects a random value. And calculate the commitment value respectively. Challenge value K = H1(D id ‖pk d Committ1 and Committ2) and the response value R1 = x d,1 ·(r1+K), R2=x d,2 ·(r²+K). Finally, the above values ​​are combined to form the identity certificate Π. proof And the doctor's public key and identity information (pk) d D id They are sent together to the server.

[0049] S2.4: After receiving the identity verification sent by the doctor for registration, the server calculates the challenge value K' and checks the formula. Is the verification valid? This verifies the legitimacy of the identity verification. If the formula is invalid, registration fails and an error symbol ⊥ is output. Otherwise, the server will send the doctor's identity information (pk) to the server. d D id It is stored in its own data list.

[0050] S3: Mutual Authentication Phase: In smart healthcare systems, because the data contains sensitive patient information, data can only be transmitted after the sensors and the mobile device have completed mutual authentication to ensure the device is in a trusted state. This includes the following steps:

[0051] S3.1: The sensor first actively sends an authentication request to the mobile device (sending the ID to the mobile device). After receiving the authentication request, the mobile device randomly selects a pair of data (c', pk') from the data list and signs the data using the Pointcheval signature method. The mobile device selects a random value. Calculate separately The two are combined to form a signature σ(c') = (h,s). Finally, the mobile device sends c' and the signature σ(c') to the sensor.

[0052] S3.2: Sensor authentication with the mobile phone. After receiving the authentication value c' and signature σ(c') sent by the mobile phone, the sensor calculates the authentication value. And check the formula Check if the formula is true. If the formula is false, output an error symbol ⊥. If the formula is true, it means that the mobile device has successfully authenticated the user through the sensor, and continue to step S3.3.

[0053] S3.3: The sensor uses c' as input to the Physically Unclonable Function (PUF) and obtains the function's response value as the verification private key sk'. s And calculate the corresponding verification public key. Then, in order to verify one's identity on the mobile device, a random value needs to be selected. The commitment value V', challenge value H', and response value W' are constructed respectively. Finally, the above verification information is used to generate the identity verification certificate π'.

[0054] S3.4: Sensor data encryption. The sensor selects random values. calculate Y=y·g, Z=x·Y, α=H2(d), T=H1(x‖Y‖Z‖α), in The XOR operator is used, where m is the plaintext raw data from the sensor. Finally, the authentication certificate π' and the encrypted data information (d, Y, M') are sent to the mobile device.

[0055] S3.5: Mobile device authentication of sensors. The mobile device first checks its own data list... Check if the condition is true or false. If not, output an error symbol ⊥. If they are equal, continue to step S3.6.

[0056] S3.6: Mobile App Check Formula Check if the formula is true. If it is false, output an error symbol ⊥. If the formula is true, it means the sensor has passed the identity verification on the mobile phone, and continue to step S3.7.

[0057] S3.7: Data decryption on the mobile device. After verification, the mobile device decrypts the ciphertext and calculates... Z=x·Y, α=H2(d), T=H1(x‖Y‖Z‖α), At this point, the mobile device obtains the raw sensor data m.

[0058] S4: Data Encryption Stage: The raw sensor data acquired by the mobile device is not stored locally. Instead, it is uploaded to the server using a proxy re-encryption method, and a corresponding tag is generated for each data point. This includes the following steps:

[0059] S4.1: The mobile device generates a unique label ω for each piece of raw data m in order to reduce time complexity and communication overhead during unintentional transmission.

[0060] S4.2: Select a random value on the mobile device Each original data m is encrypted, and the ciphertext is calculated. Finally, combine the tag and ciphertext (ω, ct) p Package and upload to the server.

[0061] S5: Data Access Phase. Sensor data is stored on the server. Doctors need to access a patient's medical data when diagnosing them. Before accessing the data, doctors must be authenticated by the server. This includes the following steps:

[0062] S5.1: Doctors need to present their identification documents when they want to obtain data from the corresponding sensors. proof and public key and identity information (pk) d D id Together, they are sent to the server for verification. The identity verification document (Π) is included. proof It includes commitment values ​​Committ1 and Committ2, challenge value K, and response values ​​R1 and R2.

[0063] S5.2: The server receives the doctor's identification document. proof Then calculate the corresponding challenge value K' and check the formula. Check if the formula is true. If the formula is false, output an error symbol ⊥. If the formula is true, the server checks the tuple (pk). d D id If it is stored in its own data list, proceed to step S5.3.

[0064] S5.3: The server will perform a key-based authentication (PK) on the doctor's public key. d Send to the mobile device to generate the conversion key. The mobile device selects a random value. The conversion key for data access is calculated using a private key proxy re-encryption algorithm. Finally, the mobile device will generate the conversion key tk p→d Send to the server.

[0065] S5.4: The server receives the conversion key tk generated by the mobile device. p→d Then select a random value And all encrypted ct files stored locally p Perform private key proxy re-encryption to generate new ciphertext. Where c = (x p,1 +r)·k+ss'.

[0066] S6: Inadvertent transmission phase, the server and the doctor execute an inadvertent transmission protocol. Assume the server stores n encrypted CT scans. d.y Where 1≤y≤n, each ciphertext ct d.y Each corresponds to a unique label ω y Data can be transmitted over the channel after being encrypted. This includes the following steps:

[0067] S6.1: The server selects a random value. Calculate encryption parameter A = g a B = g b , The ciphertext is then encrypted according to the encryption parameters, and calculations are performed. Where 1≤y≤n, This is the XOR operator. Finally, the server discloses all encrypted parameters (A, B, P). y ).

[0068] S6.2: Doctors use the tag ω j Select k sensor data points that you want to acquire, where 1 ≤ j ≤ k, and then select random values. And calculate ω for the selected k labels. j mask value Finally, the k mask values ​​A j Send to the server.

[0069] S6.3: The server receives k mask values ​​A from the doctor. j Then, calculate the corresponding k parameters. Finally, the k parameters D j Send it to the doctor.

[0070] S6.4: The doctor receives the information about the mask value A sent by the server. j Parameter D j Next, the ciphertext will be decrypted, and k parameters will be calculated. This allows you to obtain the encrypted parameters corresponding to the sensor data you want. Finally, you can use the encrypted parameter Y′ j Calculate the ciphertext Where 1≤j≤k.

[0071] S7: Decryption phase, doctor obtains encrypted CT scan. d Decryption is performed after t'1, t'2 is calculated. This includes the following steps:

[0072] S7.1: Doctor's Calculation

[0073] Table 1 summarizes the main symbols used in the implementation of this scheme.

[0074] Table 1. Symbol Explanation

[0075]

[0076] This invention constructs a privacy protection method based on an unintentional transfer protocol suitable for the medical framework. Our solution combines the advantages of unintentional transfer protocols and physical non-cloning capabilities, achieving user and doctor authentication and privacy-preserving data transmission while ensuring physical security. Since servers storing data are highly vulnerable to third-party attacks, potentially leading to the leakage of user privacy data, we utilize proxy re-encryption to effectively mitigate this security vulnerability. Proxy re-encryption is effective because it ensures user data security by re-encrypting ciphertext. Furthermore, our solution offers the following advantages: 1) All participating parties must register in the system, ensuring the legitimacy of the data source. 2) For convenience and ease of use, doctors can decrypt ciphertext using their own private key without needing to possess the user's private key. 3) Doctors and the server use an unintentional transfer protocol for data interaction, ensuring the confidentiality and integrity of shared messages. 4) Compared to solutions in recent years, our solution is more efficient. Therefore, our solution is suitable for application in smart healthcare environments with high security requirements.

[0077] The above embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it accordingly. They should not be construed as limiting the scope of protection of the present invention. All equivalent transformations or modifications made in accordance with the spirit and essence of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A method for privacy protection based on an oblivious transfer protocol suitable for medical frameworks, characterized in that, Includes the following steps: Step 1: System initialization phase: Given a security parameter k, set two multiplication cyclic groups. and p is a group and The order of p is a prime number, and the bilinear mapping is... , It is a group The generator randomly selects another generator. and calculate Define two secure cryptographic hash functions. , consisting of a length of The bit string is mapped onto a finite field. Mapping from a finite field to a multiplicative cyclic group On the mobile device, select a random value. As a private key And calculate the corresponding public key. Mobile terminal publicly discloses system parameters And save your own private key ; Step 2: The sensor adopts a physically non-clonable function. Non-interactive zero-knowledge proof methods for obtaining identity verification Register on the mobile device to become a legitimate device and include the sensor's identity information. Send to the mobile device; doctor confirms the public key. Subsequently, a non-interactive zero-knowledge proof method was adopted to obtain identity verification. Register as a legitimate user on the server, along with the doctor's public key and identity information. Send them together to the server; Step 3: The sensor and the mobile device complete mutual verification to ensure that the device is in a trusted state; Step 4: The raw sensor data obtained from the mobile device is encrypted using a proxy re-encryption method and then uploaded to the server. A corresponding tag is generated for each data point. Step 5: After the doctor is authenticated by the server, the doctor obtains the patient's medical data when diagnosing the patient; the server sends the doctor's public key to the mobile device and generates a conversion key using the private key proxy re-encryption algorithm. After receiving the conversion key, the server encrypts it using the private key proxy re-encryption algorithm to generate a new ciphertext. Step 6: The server and the doctor execute an unintentional transmission protocol. Assume the server stores [data / data / etc.]. A ciphertext ,in Each ciphertext Each corresponds to a unique tag The data is transmitted in the channel after being encrypted; the server publishes the encryption parameters, the doctor selects the sensor data to be acquired by the tag, calculates the corresponding tag mask value, and then sends it to the server. The server calculates the corresponding parameter value and sends it to the doctor. The doctor decrypts the ciphertext, obtains the encryption parameters corresponding to the sensor data, and uses the encryption parameters to determine the ciphertext. Step 7: The doctor obtains the encrypted message Then decryption: Doctor calculates ,in One of the random values ​​chosen when obtaining the private key for the doctor.

2. The privacy protection method based on an unintentional transmission protocol applicable to the medical framework according to claim 1, characterized in that, In step 2, the specific steps for the sensor and the doctor to register as legitimate users with the mobile phone and server respectively are as follows: S2.1: The sensor first selects a random value. As a physically unclonable function The input is used to obtain the function's response value as the private key. And use this to calculate the sensor's public key. Next, in order to complete the registration on the mobile device, a non-interactive zero-knowledge proof method is required, and the sensor selects a random value. And construct commitment values ​​for identity verification respectively. Challenge value Response value Finally, the above values ​​are combined to form an identity certificate. Send to mobile device; S2.2: After receiving the identity verification sent by the sensor for registration, the mobile device calculates the challenge value. And check the formula , The system checks whether the formula is valid to verify the legitimacy of the identity document. If the formula is invalid, registration fails and an error message is output. ; Otherwise, the mobile device will display the sensor's identity information. Stored in its own data list; S2.3: The doctor first selects a random value. As a private key And use this to calculate the corresponding public key. A non-interactive zero-knowledge proof method is used, where doctors select random values. And calculate the commitment value respectively. , Challenge value and response value , Finally, the above values ​​are combined to form an identity certificate. And the doctor's public key and identity information Send them together to the server; S2.4: After receiving the identity verification sent by the doctor for registration, the server calculates the challenge value. And check the formula , The system checks whether the formula is valid to verify the legitimacy of the identity document. If the formula is invalid, registration fails and an error message is output. ; Otherwise, the server will store the doctor's identity information. It is stored in its own data list.

3. The privacy protection method based on an unintentional transmission protocol applicable to the medical framework according to claim 1, characterized in that, The specific process of mutual verification between the sensor and the mobile device in step 3 is as follows: S3.1: The sensor first actively sends an authentication request to the mobile device, transmitting the sensor's... The request is sent to the mobile device. Upon receiving the verification request, the mobile device randomly selects a pair of data from the data list. The data is then signed using the Pointcheval signature method; a random value is selected on the mobile device. Calculate separately , Combine the two to form a signature Finally, the mobile app will... and signature Send to the sensor; S3.2: The sensor receives the authentication information sent by the mobile phone. and signature Then, the authentication value is calculated. And check the formula Check if the formula is true; if the formula is false, output an error symbol. If the formula is true, it means that the mobile phone has verified the identity through the sensor, and the process continues to step S3.

3. S3.3: The sensor will As a physically unclonable function The input is used to obtain the function's response value, which serves as the verification private key. And calculate the corresponding verification public key. Then, select a random value. And construct commitment values ​​respectively. Challenge value Response value Finally, the above verification information is used to generate an identity verification certificate. ; S3.4: The sensor selects a random value ,calculate , , , , , ,in The XOR operator. It is the plaintext raw data from the sensor; finally, the authentication certificate will be used. and encrypted data information Send to mobile device; S3.5: The mobile device first determines the data in its own data list. If the condition is not met, output an error symbol. If they are equal, continue to step S3.6; S3.6: Mobile App Check Formula , Check if the formula is true; if it is false, output an error symbol. If the formula is true, it means that the sensor has passed the identity verification on the mobile phone, and the process continues to step S3.

7. S3.7: After verification, the mobile phone decrypts the ciphertext and calculates... , , , , At this time, the mobile phone obtains the raw sensor data. .

4. The privacy protection method based on an unintentional transmission protocol applicable to the medical framework according to claim 1, characterized in that, The specific operation in step 4 is as follows: S4.1: Mobile device for each raw data Generate corresponding unique tags This aims to reduce time complexity and communication overhead during the unintentional transmission phase. S4.2: Select a random value on the mobile device and for each raw data Encrypt and calculate the ciphertext. Finally, the tag and ciphertext Package and upload to the server.

5. The privacy protection method based on an unintentional transmission protocol applicable to the medical framework according to claim 1, characterized in that, The specific operation in step 5 is as follows: S5.1: The doctor will provide his / her identification. public key and identity information Together they are sent to the server for verification, including identity verification. Includes commitment value , Challenge value and response value , ; S5.2: The server receives the doctor's identification. Then calculate the corresponding challenge value. And check the formula , Check if the formula is true; if the formula is false, output an error symbol. ; If the formula is true, the server checks the tuple's identity information. Is it stored in its own data list? If so, continue to step S5.3; S5.3: The server will store the doctor's public key. Send to the mobile device to generate the conversion key; the mobile device selects a random value. The conversion key for data access is calculated using a private key proxy re-encryption algorithm. Finally, the mobile device will generate the conversion key. Send to the server; S5.4: The server receives the conversion key generated by the mobile device. Then select a random value and all ciphertext stored locally. Perform private key proxy re-encryption to generate new ciphertext. ,in .

6. The privacy protection method based on an unintentional transmission protocol applicable to a medical framework according to any one of claims 1 to 5, characterized in that, The specific operations for the server and doctor to execute the unintentional transmission protocol in step 6 are as follows: S6.1: The server selects a random value. Calculate encryption parameters , , And encrypt the ciphertext according to the encryption parameters, and calculate ,in , The XOR operator exposes all encrypted parameters on the server side. ; S6.2: Doctors use labels choose The sensor data that the user wants to acquire, among which Then, select a random value. And calculate the selected Tag mask value Finally, mask value Send to the server; S6.3: The server receives a message from the doctor. mask value Then, calculate the corresponding Parameters Finally, Parameters Send to the doctor; S6.4: The doctor receives the mask value sent by the server. parameters Then, the ciphertext was decrypted, and the following calculations were performed. Parameters , This allows you to obtain the encrypted parameters corresponding to the sensor data you want; finally, you can use the encrypted parameters... Calculate the ciphertext ,in .

Images