Medical data fine-grained security sharing method based on blockchain structure

Abstract

The application belongs to the technical field of blockchain and data security protection, and discloses a medical data fine-grained security sharing method based on a blockchain structure, which comprises the following steps: step 1, system initialization; after the initialization is completed, a supervision consortium publishes public parameters to a data sharing chain; step 2, user registration; step 3, data authentication and publication; step 4, index distributed storage; step 5, submission of a search request; step 6, parallel search; step 7, hybrid consensus; and step 8, data decryption. The application improves the redundant storage and computing overhead of a single blockchain structure for the same data and tasks, avoids resource waste, and improves the defects of a traditional consensus mechanism; a hybrid consensus mechanism from local consensus to global consensus and a blockchain architecture combining a consortium chain and a public chain are formed, the advantages of the blockchain technology are fully utilized, the patient privacy can be effectively protected, and safe, efficient and controllable data sharing in a medical scenario can be realized.

Description

Technical Field

[0001] This invention belongs to the fields of blockchain and data security protection technology, specifically relating to a fine-grained secure sharing method for medical data based on a blockchain structure. Background Technology

[0002] To advance healthcare informatization, countries worldwide have gradually introduced information technology into the medical industry since the last century. However, to date, it has primarily been used for internal billing and management systems within hospitals and organizations, creating isolated "data silos" that cannot effectively interconnect. This leads to repeated examinations for referred patients, resulting in time and financial losses. Furthermore, hospitals and research institutions struggle to leverage big data technology to improve medical standards. Therefore, data sharing is a crucial aspect of building smart healthcare. However, medical data contains a significant amount of patient privacy information, and protecting and securely sharing this information remains a challenge and pain point for the industry. In addition, the traditional healthcare industry faces difficulties in oversight. Preventing parties from falsifying or altering data, and thus effectively handling medical disputes, is an essential requirement for improving healthcare management.

[0003] In recent years, searchable encryption and attribute-based encryption have provided advanced solutions for secure data sharing, offering users secure and efficient retrieval capabilities and robust, flexible access control while ensuring data confidentiality. Doctors and research institutions can retrieve target data through encrypted indexes without decrypting cloud data, and patients can set data access policies to manage decryption permissions. However, existing solutions often incur significant overhead to achieve this goal, and users in medical settings typically use resource-constrained devices and have high requirements for data retrieval response speeds, making these solutions difficult to implement in practice.

[0004] Blockchain technology, with its decentralized, tamper-proof, traceable, and smart contract-automated execution characteristics, has been widely used by researchers to improve data sharing solutions. Deploying data security sharing algorithms as smart contracts within the blockchain ensures automatic and correct execution, resolving trust issues in medical data sharing and avoiding single points of failure that may arise in traditional client / server architectures. The immutability of on-chain data also facilitates liability determination between regulatory agencies and users in case of disputes. However, existing solutions, when applying blockchain technology, do not fully consider the advantages and disadvantages of different types of blockchains, such as public blockchains and consortium blockchains. Furthermore, system performance is often constrained by traditional consensus mechanisms and the computing power of consensus nodes. All consensus nodes need to store a complete encrypted index table of medical data, generating significant redundant storage and computational overhead, which cannot meet the high response speed requirements of medical scenarios. Summary of the Invention

[0005] To address the aforementioned technical challenges, this invention proposes a fine-grained secure sharing method for medical data based on a blockchain structure. It utilizes cryptographic techniques such as searchable encryption and attribute-based encryption to achieve privacy protection and fine-grained secure sharing of patient medical data. A parallel blockchain structure of "one main chain and multiple sub-chains" is designed, improving upon the redundant storage and computational overhead of existing blockchain structures for single data and tasks, making it more suitable for real-world medical scenarios. For the proposed blockchain structure, a local consensus algorithm and incentive mechanism called "Lottery Consensus" is designed. This transforms the numerous useless hash operations in traditional Proof-of-Work (PoW) into necessary linear equation solving operations in secure data sharing schemes. It also incorporates the advantages of Proof-of-Stake (PoS) and Delegated Proof-of-Stake (DPoS), and combines them with existing consortium blockchain consensus algorithms to form a hybrid consensus mechanism from local to global consensus, improving upon the shortcomings of traditional consensus mechanisms. Finally, based on the proposed blockchain structure, efficient, secure, and supervised data sharing in real-world medical scenarios is achieved.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solution:

[0007] This invention is a method for fine-grained secure sharing of medical data based on a blockchain structure, comprising the following steps:

[0008] S1. System Initialization: Local medical regulatory agencies form a regulatory consortium, acting as a logically trusted execution center. This consortium generates relevant security parameters and initializes the medical regulatory chain and data sharing chain. The medical regulatory chain is a consortium blockchain, providing services such as identity authentication, authorization management, and medical behavior supervision. The data sharing chain is a public blockchain, consisting of a main chain and multiple sub-chains, serving as a platform for user transfers, data publishing, and paid search. After initialization, the regulatory consortium publishes public parameters to the data sharing chain.

[0009] S2. User Registration: Data users and data owners register their data sharing chain account public key addresses with the Medical Custodian Chain to authenticate their real identities and obtain corresponding permissions. The Medical Custodian Chain issues decryption keys related to their attributes to the authenticated data users through a secure channel, and the data users use them to generate outsourced decryption keys.

[0010] S3. Data Authentication and Publication: After a patient's medical data is generated during a hospital visit, the attending physician performs initial encryption and authentication on the data, generates an encrypted index, and uploads the encrypted data to the cloud server. The physician then notifies the patient via a transaction. Upon receiving the notification, the patient retrieves the data according to the transaction information, performs secondary authentication on the medical data, and uses Ciphertext Policy Attribute Base Encryption (CP-ABE) for access control management. The patient then notifies the regulatory consortium via a transaction to store the encrypted index.

[0011] S4. Distributed Index Storage: The regulatory consortium maintains an encrypted index table. Each entry in the encrypted index table represents the correspondence between the encrypted index, the unique identifier of the medical data, the storage address of the encrypted medical data in the cloud server, and the access structure generated by attribute-based encryption. The regulatory consortium distributes the stored encrypted index table to multiple data-sharing sub-chains for storage. The block difficulty of each sub-chain determines the share of the encrypted index table allocated to that sub-chain.

[0012] S5. Submit a search request: Data users generate an intermediate search token using the keywords they want to search for, submit a paid search request to the data sharing chain, and after the regulatory consortium checks the legality of the request, it generates a complete search token to form a paid search transaction. This transaction is then packaged with other types of transactions into a block on the data sharing main chain and uploaded to the chain.

[0013] S6. Parallel Search: For search transactions contained in the main chain blocks of the data sharing mechanism, the consensus nodes in each data sharing sub-chain use the complete search token to search a portion of the index table stored in their respective sub-chain, simultaneously generating a set of unsolved problems matching the data, which is added to the unsolved problem pool of their respective sub-chain. Each sub-chain executes the above search process in parallel.

[0014] S7. Hybrid Consensus: Consensus nodes in each data-sharing subchain independently solve the unsolved problem pool for their respective subchain and achieve local consensus on search results through a lottery-like consensus mechanism, generating new subchain blocks and uploading them to the chain. After all subchains have reached local consensus on search results, the regulatory consortium uses a consortium blockchain consensus mechanism to blend the local consensus into a global consensus, awarding block-producing nodes in the subchains block production, paying shared data rewards to data owners, creating a search result transaction, and finally packaging it with other types of transactions into a data-sharing main chain block and uploading it to the chain.

[0015] S8. Data Decryption: The cloud server locates the corresponding ciphertext through information in the data sharing main chain, recovers the intermediate ciphertext using an outsourced decryption key, and sends it to the data user. The data user then uses their private key to recover the plaintext data.

[0016] A further improvement of the present invention is that the specific steps of S1 are as follows:

[0017] S1-1, M medical regulatory agencies AA i Form a regulatory consortium As a logically trusted execution center, it generates the necessary security parameters. The regulatory consortium selects two multiplicative cyclic groups of order p. and A generator and bilinear mapping Four hash functions H:{0,1} * →{0,1} 256 , A data user is identified by several attributes, let the plaintext attribute domain of the system be S = {att1, att2, ...}, f att =H f If (att) is the cryptographic fingerprint of attribute att, then the global attribute set is: A piece of medical data is identified by several keywords, making the global keyword set in the system as follows:

[0018] S1-2, Each node in the regulatory consortium executes the Pedersen secret-sharing algorithm to synthesize the system master secret α, β, δ, ε. Where γ x It is a random number related to attribute x, used to calculate e(g,g) in the final step of the algorithm. α g β g δ g ε ,

[0019] S1-3. The regulatory consortium initializes a medical regulatory chain. This chain is a consortium chain, and each node in the regulatory consortium acts as a consensus node. The consortium chain consensus mechanism is used to maintain the operation of the consortium chain. The chain stores the real information of users and provides services for user identity authentication, authorization management, and medical behavior supervision.

[0020] S1-4. The regulatory consortium initializes the data sharing chain. This chain is a public chain, consisting of a main chain and multiple parallel sub-chains. The main chain provides a platform for transactions such as transfers, data publishing, and paid search for various entities in the system. Each node in the regulatory consortium acts as a consensus node, using a hybrid consensus mechanism to maintain the operation of the main chain. The sub-chains are used for distributed storage of encrypted indexes and parallel computation of searches. Distributed computing nodes that provide computing power to earn revenue act as consensus nodes, using a lottery consensus mechanism to maintain the operation of the sub-chains. Any entity can generate its own public chain account and freely join the data sharing chain.

[0021] S1-5, The regulatory consortium publishes system public parameters to the data sharing main chain.

[0022] A further improvement of the present invention is that the specific steps of S2 are as follows:

[0023] S2-1, Order As a global identity space, data users possess a unique identity identifier. The data owner has a unique identifier.

[0024] S2-2, Data user selects random number As the private key USK of the data sharing chain account, generate the account's public key address. And register your UID and UPK with the medical supervision chain; similarly, the data owner selects a random number. As the private key OSK of the data sharing chain account, generate the account public key address. And register its own uid and OPK with the medical supervision chain, where uid is the data user's uid. The unique identifier in the data, oid: represents the data owner. A unique identifier within.

[0025] S2-3. For authenticated data users, the regulatory consortium randomly selects... Based on his attribute set Calculate D0 = g α g βt D1 = g t , Will As the attribute decryption key, it is sent to the data user via a secure channel. Used to describe data users whose identity is identified by uid, where UAK represents the set of attributes associated with the data user. The relevant key is used to recover the ciphertext generated by the ciphertext policy attribute-based encryption mechanism.

[0026] S2-4. After receiving the UAK, the data user randomly selects... As an outsourced decryption private key, calculate Obtain the outsourced decryption key UAK Proxy The outsourced decryption key generated by UAK allows the cloud server to pre-decrypt data without obtaining the plaintext data.

[0027] A further improvement of the present invention is that the specific steps of S3 are as follows:

[0028] S3-1. After a patient receives medical data EHR at the hospital, the attending physician generates a unique identifier for the plaintext of this data, EID = H(EHR). The physician then signs the EID with their private key USK to generate SIG. doctor This indicates acceptance of the data content.

[0029] S3-2, The attending physician extracts the keyword set for the EHR according to industry standards. For each keyword Select random number And calculate The encrypted index of the keyword w is I w = (I1, I2), the encrypted index of this data EHR is then...

[0030] S3-3, The attending physician randomly selects a symmetric key K. sym Encrypt the EHR and generate the EHR ciphertext C. EID =Enc sym (EHR,K sym ), using the patient's public key OPK to pair K sym Encrypt and generate Then CT=(C EID C0) is uploaded to the cloud server CS. The storage address of CT in CS is addr EID K sym This represents the key used in the symmetric cryptography system to encrypt actual medical data. CT represents the ciphertext set generated by EHR, including the ciphertext of the actual data and the symmetric key protected by attribute-based encryption mechanisms.

[0031] S3-4. The doctor submits an authentication request to the data sharing main chain, informing the patient that the medical data has been uploaded, including EID and addr. EID I EID SIG doctor Once the necessary information is included in the request, and the regulatory consortium verifies the request's legitimacy, it will send the EID and address... EID SIG doctor Information such as TX is used to create a transaction signature1 It is packaged together with other types of transactions into a data-sharing main chain block, index I. EID Then it is saved to the medical supervision chain cache area, addr EID This indicates the actual storage address of the encrypted CT identified by EID in the cloud server.

[0032] S3-5, The patient receives the transaction TX on the main chain. signature1 Then, according to addr EID Obtain the encrypted CT from CS and calculate... Thus, the plaintext data EHR=Dec is recovered. sym (C EID ,K sym The patient calculates EID = H(EHR) and verifies the signature validity using the doctor's public key to ensure the data has not been tampered with. After confirming that the data content and signature are correct, the patient signs the EID using the private key OPK to generate SIG. owner This indicates acceptance of the data content.

[0033] S3-6. After the patient approves the data, first randomly select the symmetric key K. sym Encrypt the EHR and regenerate the ciphertext C of the EHR. EID ′=Enc sym(EHR,K sym Then, the ciphertext policy attribute base encryption (CP-ABE) mechanism is used to implement access control management for the data.

[0034] S3-7, Patient-based Define the access policy for this EHR, and the set of attributes involved in the policy is as follows: The number of attributes is l, thus yielding the final access structure. in It is an l×n LSSS matrix associated with the access strategy, where ρ:[row]→x is a set of... The row number row∈[1,l] to the attribute The mapping, representing the matrix The row number is related to the attribute x.

[0035] S3-8, The patient randomly selects a column vector. and a set of random numbers calculate in Representation matrix Given the row-th vector, calculate C0′=K. sym ′·e(g,g) αs C1 = g s , Ciphertext CT′=(C EID ′,C0′,C1,{C 2,row},{C 3,row}).

[0036] S3-9. The patient submits an authentication request to the data sharing main chain, informing the doctor that the medical data has been retrieved and signed, EID, SIG. owner A EID Included in the request. After the regulatory consortium verifies the request's legitimacy, it will include the EID and SIG. owner Information such as TX is used to create a transaction signature2 Packaged with other types of transactions into the main chain block, and access structure A EID The encrypted index of this data in the cache is added to the encrypted index table stored in the regulatory consortium. The patient uploads the CTv to CS, and the previously stored data in addr... EID The encrypted CT is replaced with CT′, completing the two-way authentication and release of the data.

[0037] A further improvement of the present invention is that the specific steps of S4 are as follows:

[0038] S4-1. When initializing the data sharing chain, the regulatory consortium should reasonably specify the number of data sharing sub-chains (num) and the block difficulty of each sub-chain.j , The complete encrypted index table is divided into num parts, and the proportion of the data in each part to the complete list is equal to the block difficulty.

[0039] S4-2. The regulatory consortium maintains an encrypted index table. Each entry in the encrypted index table represents the correspondence between the encrypted index, the unique identifier of the medical data, the storage address of the encrypted medical data in the cloud server, and the access structure generated by attribute-based encryption. The regulatory consortium distributes the encrypted index table to the consensus nodes in each subchain for storage. The consensus nodes in each subchain store a portion of the index table that is the same, and there is no need to store portions of the index tables of other subchains. Newly generated encrypted indexes are also distributed to the corresponding subchains according to this rule to maintain the balance between subchain data share and block difficulty.

[0040] S4-3. Distributed computing nodes that wish to provide computing power to obtain block rewards can, after generating public and private keys for the data sharing chain account, choose to join subchains of different difficulties based on their own computing power and obtain relevant data from other nodes in the subchain.

[0041] A further improvement of the present invention is that the specific steps of S5 are as follows:

[0042] S5-1, Data users are randomly selected. Calculate UTK1 = g τ UTK2=H1(w)·(g ε ) τ The intermediate search token is UTK = (UTK1, UTK2). Data users submit paid search requests to the data sharing main chain, specifying the fuel price per unit (gas). price And pay in full in advance as compensation for data owners to share data and as a reward for distributed computing nodes.

[0043] S5-2. After the regulatory consortium's inspection request is deemed legitimate, the complete search token is calculated. Create a paid search transaction TX search It is packaged into the main chain block along with other types of transactions.

[0044] A further improvement of the present invention is that the specific steps of S6 are as follows:

[0045] S6-1. The consensus nodes in each data-sharing subchain act as observer nodes of the main chain, observing search transactions in the main chain blocks. For a search transaction on the main chain, the subchain consensus node uses the complete search token CTK to search the partial index list stored in this subchain. By calculating whether H2(e(I1,CTK)) is equal to I2, it is determined whether the keywords in the search token match the encrypted index keywords.

[0046] S6-2. For a set of matching data, the subchain consensus node extracts the attribute set from the search transaction. Access structure A with matching data EID Calculate the intersection matrix All of the above satisfy row vectors As a new matrix row vectors The number of row vectors l′ in the new matrix is ​​less than or equal to the number of row vectors l in the old matrix, and the row number correspondence between the new and old matrices is saved as <row, row′>.

[0047] S6-3. Define a problem to be solved as: finding a set of constants o1, o2, ..., o l′ , making That is, solving a system of linear equations. in The coefficient matrix, To solve.

[0048] S6-4. The subchain consensus node will solve this system of linear equations as a problem to be solved for matching data. EID The unsolved problems generated by all matching data in the subchain index table of a search transaction constitute the unsolved problem set Q of that search transaction. search ={question EID The subchain consensus node will Q. searcch Add it to the pool of unsolved problems for this node.

[0049] S6-5. Each subchain executes the above search process in parallel to generate a pool of unsolved problems for that subchain.

[0050] A further improvement of the present invention is that the specific steps of S7 are as follows:

[0051] S7-1, Consensus nodes in a sub-chain solve problems in a pool of unsolved problems. For a given question... EID The answer can be found using methods such as Gaussian elimination. EID If the system of linear equations has no solution, then answer EID If the system of linear equations is perpendicular, and it has a solution, find a particular solution. From the previously saved row number correspondence <row, row'>, the correspondence between the old matrix row numbers and constants can be obtained as <row, o row′ >. Then the answer EID For {<row,o row′ ,ρ(row)>} row′∈[1，l′]The consensus node that first finds all the answers in the pool of unsolved problems packages its public chain account address, search results, and answers into a block and submits it to the regulatory consortium. It then broadcasts the block to other consensus nodes in its subchain, claiming that it has won, thus generating a subchain block.

[0052] S7-2. When other consensus nodes in the subchain receive the block notification, for linear equation systems that the block-producing node claims have a solution, they can verify the correctness of the answer by substituting the particular solution from the answer into the corresponding linear equation system. For linear equation systems that the block-producing node claims have no solution, the correctness of the answer can also be determined by calculating the rank of the coefficient matrix and the augmented matrix. If all answers in the block are correct, it is added to the end of the current subchain, and the subchain is broadcast that the block has been accepted. When a majority of consensus nodes in the subchain accept the block, a local consensus on the search transactions in this round is achieved in the subchain.

[0053] S7-3. When the regulatory consortium observes that a subchain has reached partial consensus and produced a block, it awards a block-producing node a reward for the answer to each unsolved problem set in the subchain block. EID If the answer is not ⊥, then the fuel price per unit (gas) is determined according to the data owner's specifications. price The reward, calculated as reward = gas, is distributed to block-producing nodes after deducting the data user's prepayment from the problem size l′. price If the answer is ⊥, then l′ of the subchain contribution reward = contribution × l′ is issued to the block-producing node. If multiple consensus nodes of a subchain claim to produce a block, the regulatory consortium only recognizes the block-producing node of the first received block of the same subchain as the winner.

[0054] S7-4. To incentivize continuous participation of subchain consensus nodes in computation, for questions with an answer of ⊥, the block-producing node is rewarded with contribution points for that subchain. These contribution points can be used to bid for the right to produce blocks on that subchain. Every four blocks produced by a subchain, the right to produce the next block is determined through an auction. The regulatory consortium accepts bids from subchain consensus nodes before the fourth block is produced. The auction is conducted in a "blind auction" format, and the results of each subchain's auction are announced on the fourth main chain block. The three nodes with the highest bids receive the gas reward for the next subchain block according to their respective bid proportions, and do not receive any further contribution rewards for that block.

[0055] S7-5. Whether a problem has a solution and what the solution value is are random. Only when a subchain consensus node obtains the correct result through honest computation can it receive the corresponding reward. The problem is similar to a lottery in real life, and the consensus node's solution process is equivalent to purchasing and drawing the lottery. Any node can provide computing power to participate in the lottery, and the greater the computing power provided, the greater the probability of winning, ensuring fairness. Therefore, the method used in the above local consensus process is named the lottery consensus mechanism.

[0056] S7-6. After all subchains have reached local consensus, the regulatory consortium merges them into a global consensus for the search results. The regulatory consortium then uses TX... search Based on the search results, construct a transaction TX result In the transaction, the prepaid fees of data users are deducted as block rewards for subchain block-producing nodes and compensation for data sharing by data owners. The remaining prepaid fees are refunded, and the search results are included in the transaction. Finally, the consortium blockchain consensus mechanism is used to process the transaction. result It is packaged with other types of transactions into the main chain block and uploaded to the chain.

[0057] A further improvement of the present invention is that the specific steps of S8 are as follows:

[0058] S8-1, Cloud Server CS based on data sharing main chain TX result addr in the transaction EID Find the corresponding CT and use the transaction TX. result UAK in Proxy and {<row,o row′ ,ρ(row)>} row′∈[1，l′] ,calculate Send the intermediate ciphertext to the data user. Proxy This indicates that the cloud server uses UAK. Proxy The recovered intermediate ciphertext can be decrypted by the data user without complex calculations.

[0059] S8-2, The data user receives the intermediate ciphertext and recovers the symmetric key. Then, using a symmetric key, the ciphertext is decrypted to obtain the plaintext EHR = Dec. sym (C EID K sym ).

[0060] The beneficial effects of this invention are:

[0061] 1. This invention employs attribute-based searchable encryption technology to provide data users with efficient and secure search capabilities for encrypted medical data stored by patients in the cloud without decryption. Patients can formulate data access policies to manage decryption permissions, thereby achieving fine-grained access control.

[0062] 2. This invention employs a blockchain structure combining consortium blockchains and public blockchains, fully leveraging the advantages of consortium blockchains (strong controllability, fast transaction speed) and public blockchains (complete decentralization, transparency, and tamper-proof nature). This makes blockchain more suitable for secure data sharing solutions in medical scenarios.

[0063] 3. This invention improves the original blockchain structure into a parallel blockchain structure of "one main chain and multiple sub-chains". The encrypted index table is divided into multiple parts and stored in different sub-chains. Each sub-chain only needs to retrieve the data of its own chain for the same search task, and the sub-chains search in parallel, which greatly reduces redundant storage and computing overhead and further improves the response speed of search operations.

[0064] 4. The lottery consensus mechanism designed in this invention transforms the large number of useless hash operations in traditional proof-of-work into the necessary linear equation solving operations in the data security sharing scheme, avoiding resource waste and further reducing the decryption overhead for data users. At the same time, it absorbs the advantages of Proof-of-Stake (PoS) and Delegated Proof-of-Stake (DPoS) and designs corresponding incentive mechanisms to attract distributed computing nodes to provide computing power to participate in the search. Regardless of the strength of computing power, their enthusiasm can be fully mobilized. Attached Figure Description

[0065] Figure 1 This is a schematic diagram of the system of the present invention.

[0066] Figure 2 This is a flowchart illustrating the solution of the present invention.

[0067] Figure 3 This is a schematic diagram of the parallel search and hybrid consensus process of this invention.

[0068] Figure 4 This is a schematic diagram of the structure of various transactions in the data sharing chain of this invention. Detailed Implementation

[0069] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0070] The key terms and constraints of this invention are as follows:

[0071] Consortium blockchain: A consortium blockchain is a blockchain jointly managed by multiple organizations. Each organization or institution manages one or more nodes, and its data can only be read, written and sent by different institutions within the system. Its main characteristics are weak centralization, strong controllability and fast transaction speed, making it more suitable for applications with high requirements for privacy protection, transaction speed and internal supervision.

[0072] Public blockchain: A public blockchain is a blockchain in which anyone in the world can enter the system at any time to read data, send verifiable transactions, and compete for ledger recording. It is suitable for scenarios that have high requirements for trustworthiness and security, but low requirements for transaction speed.

[0073] Practical Byzantine Fault Tolerance (PBFT) is a practical consensus mechanism that implements Byzantine fault tolerance. In this system, one node is designated as the master node, while all other nodes are child nodes. All nodes communicate with each other, and the ultimate goal is to achieve data consensus based on the principle of majority rule. PBFT requires that, given a total of n nodes, it can accommodate a maximum of (n-1) / 3 Byzantine nodes. It is commonly used as a consensus mechanism in consortium blockchains.

[0074] Digital signature: It can be regarded as the digital form of traditional handwritten signature. It exists in data information or as an attachment or logically related data. It is unforgeable and is used to identify the identity of the data signer and verify the content of the signed message. It mainly includes signature algorithm and signature verification algorithm.

[0075] The invention can be applied to the paid sharing of electronic medical records.

[0076] This invention is a method for fine-grained secure sharing of medical data based on a blockchain structure. This method includes the following seven entities, such as... Figure 1 As shown.

[0077] Patients, also known as data owners, have ownership and control over their own medical data. They need to register their own data sharing chain account with the medical regulatory chain to bind the account to their real identity. They work with their doctors to complete the data authentication and release process. They can formulate data access policies based on the attributes of data users to achieve fine-grained access control. They can also profit by sharing their own medical data.

[0078] The attending physician must be an entity recognized by a formal institution and possess a valid medical practitioner's license. They need to register their own data-sharing account with the medical regulatory chain to bind the account to their real identity, generate encrypted indexes of medical data according to industry standards, and jointly complete the data authentication and release process with the patient.

[0079] Data users can be entities such as doctors, hospitals, and research institutions that need to use medical data. Their real identities are described by several attributes. They need to register their own data sharing chain account with the medical regulatory chain to bind the account to their real identity, obtain keys related to their own attribute set, generate corresponding outsourced decryption keys, submit search requests to the data sharing chain and pay the corresponding fees. They can then obtain pre-decrypted medical data that matches the search keywords from the cloud server and that they have the right to decrypt.

[0080] Regulatory consortium: Composed of medical regulatory agencies at all levels and in all regions, it is a logically credible authority that possesses real information about patients and data users, is responsible for the initialization of the system, and serves as a consensus node in the medical regulatory chain and the data sharing main chain.

[0081] Cloud servers are typically semi-trusted entities with powerful computing and storage capabilities, responsible for storing encrypted medical data and using outsourced decryption keys from data users to assist in decryption.

[0082] Medical Supervision Chain: This is a consortium blockchain that provides services such as identity authentication, authorization management, and medical behavior supervision. The regulatory consortium acts as the consensus node and adopts the PBFT consensus mechanism.

[0083] Data Sharing Chain: This is a public blockchain consisting of a main chain and multiple sub-chains. The main chain serves as a platform for user transfers, data publishing, and paid searches. The sub-chains are responsible for the distributed storage of encrypted index tables and parallel computation for searches. Distributed computing nodes that provide computing power in exchange for rewards act as consensus nodes on the sub-chains, employing a lottery consensus mechanism to achieve local consensus. A regulatory consortium acts as the consensus node on the main chain, employing a PBFT consensus mechanism to achieve global consensus.

[0084] The present invention discloses a method for fine-grained secure sharing of medical data based on a blockchain structure, and the system model diagram is shown below. Figure 1 As shown, the specific process is as follows: Figure 2 As shown, the steps are as follows:

[0085] S1. System Initialization: Local medical regulatory agencies form a regulatory consortium, acting as a logically trusted execution center. This consortium generates relevant security parameters and initializes the medical regulatory chain and data sharing chain. The medical regulatory chain is a consortium blockchain, providing services such as identity authentication, authorization management, and medical behavior monitoring. The data sharing chain is a public blockchain, consisting of a main chain and multiple sub-chains, serving as a platform for user transfers, data publishing, and paid search. After initialization, the regulatory consortium publishes public parameters to the data sharing chain. The specific implementation steps are as follows:

[0086] S1-1, M medical regulatory agencies AA i Form a regulatory consortium As a logically trusted execution center, it generates the necessary security parameters. The regulatory consortium selects two multiplicative cyclic groups of order p. and A generator and bilinear mapping Four hash functions H: {0, 1} * →{0,1} 256 , A data user is identified by several attributes. For example, researcher Wang Wu is described by the following set of plaintext attributes: {Jiangsu, People's Hospital, Surgery, Chief Physician, ...}. Let the global plaintext attribute domain of the system be S = {att1, att2, ...}. att =H f If (att) is the cryptographic fingerprint of attribute att, then the global attribute set is: A piece of medical data is identified by several keywords, making the global keyword set in the system as follows:

[0087] S1-2, Each node in the regulatory consortium executes the Pedersen secret-sharing algorithm to synthesize the system master secret α, β, δ, ε. Where γ x It is a random number related to attribute x, used to calculate e(g, g) at the node in the last step of the algorithm. α g β g δ g ε ,

[0088] S1-3. The regulatory consortium initializes a medical regulatory chain. This chain is a consortium chain, and each node in the regulatory consortium acts as a consensus node. The chain uses the PBFT consensus mechanism to maintain the operation of the consortium chain. The chain stores the real information of users and provides services for user identity authentication, authorization management, and medical behavior supervision.

[0089] S1-4. The regulatory consortium initializes the data sharing chain, a public chain consisting of a main chain and multiple parallel sub-chains. The main chain provides a platform for transactions such as transfers, data publishing, and paid search for various entities within the system. Each node in the regulatory consortium acts as a consensus node, using a hybrid consensus mechanism to maintain the main chain's operation. The sub-chains are used for distributed storage of encrypted indexes and parallel computation of searches. Distributed computing nodes that provide computing power to earn rewards act as consensus nodes, using a lottery consensus mechanism to maintain the sub-chains' operation. Any entity can generate its own public chain account and freely join the data sharing chain.

[0090] S1-5, The regulatory consortium publishes system public parameters to the data sharing main chain.

[0091] S2. User Registration: Patient Zhang San, attending physician Li Si, and researcher Wang Wu each register their data sharing chain account public key addresses with the medical supervision chain to authenticate their real identities and obtain corresponding permissions. The medical supervision chain issues decryption keys related to their attributes to the authenticated Li Si and Wang Wu through a secure channel. Li Si and Wang Wu use these keys to generate their own outsourced decryption keys. The specific implementation steps are as follows:

[0092] S2-1, Order This constitutes a global identity space. Assume patient Zhang San possesses a unique identity identifier. The attending physician, Li Si, possesses a unique identification identifier. Researcher Wang Wu possesses a unique identifier.

[0093] S2-2, The attending physician, Li Si, selects a random number. As the private key USK1 of the data sharing chain account, generate the account's public key address. And registered their uid1 and UPK1 with the medical supervision chain. Similarly, researcher Wang Wu registered his uid2 and UPK2 with the medical supervision chain. Patient Zhang San selected a random number. As the private key OSK1 of the data sharing chain account, generate the account public key address. And register its own oid1 and OPK1 with the medical supervision chain.

[0094] S2-3. For researcher Wang Wu, whose identity has been verified, the regulatory consortium randomly selects... Based on his attribute set calculate D1 = gt, Will As the attribute decryption key, it is sent to the data user via a secure channel. In this embodiment, Li Si only acts as a doctor, so his actions as a data user will not be discussed.

[0095] S2-4. After receiving UAK2, researcher Wang Wu randomly selected... As an outsourced decryption private key, calculate Obtain the outsourced decryption key

[0096] S3. Data Authentication and Publication: After patient Zhang San's medical data is generated during his hospital visit, the attending physician Li Si performs initial encryption and authentication on the data, generates an encrypted index, and uploads the encrypted data to the cloud server. Subsequently, Zhang San is notified via a transaction. Upon receiving the notification, Zhang San retrieves the data according to the transaction information, performs secondary authentication on the medical data, and uses Ciphertext Policy Attribute Base Encryption (CP-ABE) for access control management. Finally, the physician notifies the regulatory consortium via a transaction to store the encrypted index. The specific implementation steps are as follows:

[0097] S3-1. After patient Zhang San receives medical treatment at the hospital and generates medical data EHR, the attending physician Li Si generates a unique identifier for the plaintext of this data, EID = H(EHR). Li Si then uses his private key USK1 to sign the EID to generate SIG. doctor This indicates acceptance of the data content.

[0098] S3-2, Li Si extracts the keyword set for this EHR according to industry standards. For each keyword Select random number And calculate The encrypted index of the keyword w is I w = (I1, I2), the encrypted index of this data EHR is then...

[0099] S3-3, Li Si randomly selects the symmetric key K. sym Encrypt the EHR and generate the EHR ciphertext C. EID =Enc sym (EHR, K) sym Using the patient's public key OPK1 to target K sym Encrypt and generate Then CT=(C EID C0) is uploaded to the cloud server CS, and the storage address of CT in CS is addr EID .

[0100] S3-4, Li Si submits an authentication request to the data sharing main chain, informing Zhang San that his medical data has been uploaded, EID, addr EID I EID SIG doctor Once the necessary information is included in the request, and the regulatory consortium verifies the request's legitimacy, it will send the EID and address... EID SIG doctor Information such as TX is used to create a transaction signature1 Transaction structure as follows Figure 4 As shown, it is packaged together with other types of transactions into a data-sharing main chain block, index I. EID It is then saved to the medical supervision chain cache area.

[0101] S3-5, Zhang San received the transaction TX on the main chain. signature1 Then, according to addr EID Obtain the encrypted CT from CS and calculate... Thus, the plaintext data EHR=Dec is recovered. sym (C EID K sym Zhang San calculates EID = H(EHR) and verifies the signature validity using Li Si's public key to ensure the data has not been tampered with. After confirming that the data content and signature are correct, he signs the EID with his private key OPK1 to generate SIG. owner This indicates acceptance of the data content. If Zhang San does not accept the validity of the medical data, he can submit a review request to the medical regulatory chain, allowing the relevant regulatory agencies to intervene and supervise the medical process.

[0102] S3-6. After Zhang San approves the data, he first randomly selects the symmetric key K. sym Encrypt the EHR and regenerate the ciphertext C of the EHR. EID ′=Enc sym (EHR, K) sym Then, the ciphertext policy attribute base encryption (CP-ABE) mechanism is used to implement access control management for the data.

[0103] S3-7, Zhang San based on Define the access policy for this EHR, and the set of attributes involved in the policy is as follows: The number of attributes is l, thus yielding the final access structure. in It is an l×n LSSS matrix associated with the access strategy, ρ: [row]→x is a set of... The row number row∈[1, l] to the attribute The mapping, representing the matrix The row number is related to the attribute x.

[0104] S3-8, Zhang San randomly selects a column vector. and a set of random numbers calculate in Representation matrix Given the row-th vector, calculate C0′=K. sym ′·e(g,g) αs C1 = g s , Ciphertext CT′=(C EID ′,C0′,C1,{C 2，row}, {C 3，row}).

[0105] S3-9, Zhang San submits an authentication request to the data sharing main chain, informing Li Si that the medical data has been retrieved and signed, EID, SIG. owner A EID Information such as EID and SIG is included in the request. After the regulatory consortium verifies the validity of the request, it will... owner Information such as TX is used to create a transaction signature2 Transaction structure as follows Figure 4 As shown, it is packaged with other types of transactions into the main chain block, and access structure A is included. EID The encrypted index of this data in the cache is added to the encrypted index table stored in the regulatory consortium. Zhang San uploads CT' to CS, and adds the previously stored data to the encrypted index table in addr. EID The encrypted CT is replaced with CT', completing the two-way authentication and release of the data. In the future, if Zhang San and Li Si have a medical dispute, or if a data user questions the content of the purchased data, the regulatory consortium can check the relevant information on the chain to determine liability. If Zhang San subsequently needs to modify the data access policy, he can also re-execute the encryption process in S3-6 to S3-8, submit an update request to the data sharing chain, and replace the old encrypted text with the new encrypted text.

[0106] S4. Distributed Index Storage: The regulatory consortium maintains an encrypted index table. Each entry in the encrypted index table represents the correspondence between the encrypted index, the unique identifier of the medical data, the storage address of the encrypted medical data in the cloud server, and the access structure generated by attribute-based encryption. The regulatory consortium distributes the stored encrypted index table to multiple data-sharing sub-chains for storage. The block difficulty of each sub-chain determines the share of the encrypted index table allocated to that sub-chain. The specific implementation steps are as follows:

[0107] S4-1. When initializing the data sharing chain, the regulatory consortium should reasonably specify the number of data sharing sub-chains (num) and the block difficulty of each sub-chain. j , The complete encrypted index table is divided into *num* parts, with each part's data size representing a proportion of the complete list equal to the block difficulty. For example, if the data-sharing chain has 10 child chains, and the block difficulties for child chains 1-10 are set to 0.4, 0.2, 0.2, 0.1, 0.05, 0.04, 0.004, 0.003, 0.002, and 0.001 respectively, then all encrypted index tables are also divided into 10 parts, with the proportion of the index table allocated to each child chain equal to the block difficulty. Determining the optimal performance for the number and difficulty of child chains is beyond the scope of this invention; it is merely a reference setting.

[0108] S4-2. The regulatory consortium maintains an encrypted index table. Each entry in the encrypted index table represents the correspondence between the encrypted index, the unique identifier of the medical data, the storage address of the encrypted medical data in the cloud server, and the access structure generated by attribute-based encryption. The regulatory consortium distributes the encrypted index table to the consensus nodes in each subchain for storage. The consensus nodes in each subchain store a portion of the index table identically, eliminating the need to store portions of the index tables from other subchains. Newly generated encrypted indexes are also distributed to the corresponding subchains according to this rule to maintain a balance between subchain data share and block difficulty.

[0109] S4-3. Distributed computing nodes that wish to provide computing power to obtain block rewards can, after generating public and private keys for the data sharing chain account, choose to join subchains of different difficulties based on their own computing power and obtain relevant data from other nodes in the subchain.

[0110] S5. Submit a search request: Suppose researcher Wang Wu wants to purchase a batch of medical data for research. He generates an intermediate search token using the desired keywords and submits a paid search request to the data sharing chain. After the regulatory consortium verifies the request's legality, it generates a complete search token, creating a paid search transaction. This transaction is then packaged with other types of transactions into a block on the data sharing main chain and uploaded to the chain. The specific implementation steps are as follows:

[0111] S5-1, Researcher Wang Wu randomly selected Calculate UTK1 = g τ UTK2=H1(w)·(g ε ) τ The intermediate search token for this search is UTK = (UTK1, UTK2). Wang Wu sends the intermediate search token UTK and the external key. Attribute Collection Submit a paid search request to the data-sharing main chain, specifying the unit price of gas. price And prepay the full amount as compensation for the data owner to share the data and as a reward for the distributed computing nodes. S5-2, After the regulatory consortium verifies the legitimacy of the request, calculate the complete search token. Create a paid search transaction TX search Transaction structure as follows Figure 4 As shown, it is packaged into the main chain block along with other types of transactions.

[0112] S6. Parallel Search: such as Figure 3 As shown, for paid search transactions contained in the data-sharing main chain block, such as the transaction TX generated by Wang Wu in S5... searchIn each data-sharing subchain, the consensus nodes use the complete search token to search a portion of the index table stored in that subchain, simultaneously generating a set of unsolved problems that match the data, which is then added to the unsolved problem pool of that subchain. Each subchain executes the above search process in parallel. The specific implementation steps are as follows:

[0113] S6-1. Consensus nodes in each data-sharing sub-chain act as observer nodes on the main chain, observing search transactions in the main chain blocks. For a search transaction on the main chain, such as Wang Wu's paid search transaction TX... search The subchain consensus node uses the complete search token CTK to search the partial index list stored in this subchain. By calculating whether H2(e(I1,CTK)) equals I2, it is determined whether the keywords in the search token match the keywords in the encrypted index. In this embodiment, it is assumed that the keywords of the medical data previously published by patient Zhang San happen to match the keywords searched by Wang Wu.

[0114] S6-2. For matching data, such as the encrypted data previously released by Zhang San, the subchain consensus node extracts the search transaction TX. search Attribute collection in Access structure A with matching data EID Calculate the intersection matrix All of the above satisfy row vectors As a new matrix row vectors The number of row vectors l′ in the new matrix is ​​less than or equal to the number of row vectors l in the old matrix, and the correspondence between the row numbers of the new and old matrices is saved.<row,row′> .

[0115] S6-3. Define a problem to be solved as: finding a set of constants o1, o2, ..., o l′ , making That is, solving a system of linear equations. in The coefficient matrix, To find the solution. If the system of linear equations has a solution, it means that the attribute set of the person submitting the search request satisfies the access strategy for the matching data. In particular, in this embodiment, it is assumed that Wang Wu's attribute set satisfies the access strategy for the data previously published by Zhang San.

[0116] S6-4. The subchain consensus node will solve this system of linear equations as a problem to be solved for matching data. EID The unsolved problems generated by all matching data in the subchain index table of a search transaction constitute the unsolved problem set Q of that search transaction. search ={question EID The subchain consensus node will Q. searcchAdd it to the pool of unsolved problems for this node.

[0117] S6-5. Each subchain executes the above search process in parallel to generate a pool of unsolved problems for that subchain.

[0118] S7, Hybrid Consensus: such as Figure 3 As shown, consensus nodes in each data-sharing subchain independently solve the problem pool for their respective subchain and achieve local consensus on search results through a lottery-like consensus mechanism, generating new subchain blocks and uploading them to the chain. After all subchains have reached local consensus on search results, the regulatory consortium uses the PBFT consensus mechanism to combine the local consensus into a global consensus, awarding block-producing nodes in the subchains block production, paying data owners for shared data, and creating search result transactions. Finally, these transactions are packaged with other types of transactions into a data-sharing main chain block and uploaded to the chain. The specific implementation steps are as follows:

[0119] S7-1, Consensus nodes in a sub-chain solve problems in a pool of unsolved problems. For a given question... EID Use Gaussian elimination to find the answer. EID If the system of linear equations has no solution, then answer EID If the system of linear equations is perpendicular, and it has a solution, find a particular solution. From the previously saved row number correspondence <row, row′>, the correspondence between the row numbers of the old matrix and the constants can be obtained as follows: <row,o row ′>, then answer EID for{ <row,o row′ ,ρ(row)>} row′v[1,l′] The consensus node that first finds all the answers in the pool of unsolved problems packages its public chain account address, search results, and answers into a block and submits it to the regulatory consortium. It also broadcasts the block to other consensus nodes in its subchain, claiming that it has won the prize, which means that a subchain block has been generated.

[0120] S7-2. When other consensus nodes in the subchain receive the block notification, for linear equation systems that the block-producing node claims have a solution, the correctness of the answer can be verified by simply substituting the particular solution in the answer into the corresponding linear equation system. For linear equation systems that the block-producing node claims have no solution, the correctness of the answer can also be determined by calculating the rank of the coefficient matrix and the augmented matrix. If all the answers in the block are correct, it is added to the end of the current subchain, and the block is broadcast in the subchain that it has been accepted. When most consensus nodes in the subchain accept the block, a local consensus on the search transactions in this round is achieved in the subchain.

[0121] S7-3. When the regulatory consortium observes that a subchain has reached partial consensus and produced a block, it awards a block-producing node a reward. This reward is given for the answer to each set of unsolved questions in the subchain block. EIDIf the answer is not ⊥, then the fuel price per unit (gas) is determined according to the data owner's specifications. price The reward, calculated as reward = gas, is distributed to block-producing nodes after deducting the data user's prepayment from the problem size l′. price ×l′. If the answer is ⊥, then l′ of the subchain's contribution reward = contribution × l′ is issued to the block-producing node. If multiple consensus nodes claim to produce a block on a subchain, the regulatory consortium only recognizes the block-producing node that first receives the block from the same subchain as the winner.

[0122] S7-4. To incentivize continuous participation of subchain consensus nodes in computation, for questions with an answer of ⊥, the block-producing node is rewarded with contribution points for that subchain. These contribution points can be used to bid for the right to produce blocks on that subchain. Every four blocks produced by a subchain, the right to produce the next block is determined by auction. The regulatory consortium accepts bids from subchain consensus nodes before the fourth block is produced. The auction is conducted in a "blind auction" format, and the results of each subchain's auction are announced on the fourth main chain block. The three nodes with the highest bids receive the gas reward for the next subchain block according to their respective bid proportions, and do not receive any further contribution rewards for that block.

[0123] S7-5. Whether a problem has a solution and what the solution value is are random. Only when a subchain consensus node obtains the correct result through honest computation can it receive the corresponding reward. The problem is similar to a lottery in real life, and the consensus node's solution process is equivalent to purchasing and drawing the lottery. Any node can provide computing power to participate in the lottery, and the greater the computing power provided, the greater the probability of winning, ensuring fairness. Therefore, the method used in the above local consensus process is named the lottery consensus mechanism.

[0124] S7-6. After all subchains have reached local consensus, the regulatory consortium merges them into a global consensus for the search results. The regulatory consortium then uses TX... search Based on the search results, construct a transaction TX result Transaction structure as follows Figure 4 As shown. In the transaction, Wang Wu's prepaid fees are deducted as block rewards for subchain block-producing nodes and compensation for data sharing by data owners. The remaining prepaid fees are refunded, and the search results are included in the transaction. Finally, the PBFT consensus mechanism is used to transfer the transaction between TX and TX. result It is packaged with other types of transactions into the main chain block and uploaded to the chain.

[0125] S8. Data Decryption: The cloud server locates the corresponding ciphertext through information in the data sharing main chain, recovers the intermediate ciphertext using Wang Wu's outsourced decryption key, and sends it to researcher Wang Wu. Wang Wu ultimately uses his private key to recover the plaintext data. The specific implementation steps are as follows:

[0126] S8-1, Cloud Server CS based on data sharing main chain TX result addr in the transaction EID Find the corresponding CT and use the transaction TX. result UAK in Proxy and{<row,o row′ ,ρ(row)>} row′∈[1,l′] ,calculate Send the encrypted message to Wang Wu.

[0127] S8-2, Wang Wu receives the intermediate ciphertext and recovers the symmetric key. Then, using a symmetric key, the ciphertext is decrypted to obtain the plaintext EHR = Dec. sym (C EID ,K sym ).

[0128] This invention can effectively protect patient privacy and achieve safe, efficient, and controllable data sharing in medical settings.

Claims

1. A method for fine-grained secure sharing of medical data based on a blockchain structure, characterized in that: The method for secure, granular sharing of medical data specifically includes the following steps: Step 1: System Initialization: Local medical regulatory agencies form a regulatory consortium, which acts as a trusted execution center. It generates relevant security parameters and initializes the medical regulatory chain and the data sharing chain. The medical regulatory chain is a consortium chain that provides services such as identity authentication, authorization management, and medical behavior supervision. The data sharing chain is a public chain, consisting of a main chain and multiple sub-chains. It serves as a platform for user transfers, data publication, and paid search. After initialization, the regulatory consortium publishes public parameters to the data sharing chain. Step 2, User Registration: Data users and data owners register their data sharing chain account public key addresses with the Medical Custodian Chain to authenticate their real identities and obtain corresponding permissions. The Medical Custodian Chain issues decryption keys related to their attributes to the authenticated data users through a secure channel, and the data users use them to generate outsourced decryption keys. Step 3, Data Authentication and Release: After a patient's medical data is generated during their visit to the hospital, the attending physician performs initial encryption and authentication on the medical data, generates an encrypted index, and uploads the encrypted medical data to the cloud server. Subsequently, the patient is notified through a transaction. After receiving the notification, the patient retrieves the data according to the transaction information, performs secondary authentication on the medical data, and uses encrypted policy attribute base encryption to implement access control management. Then, the patient is notified through a transaction to the regulatory consortium to save the encrypted index. Step 4, Distributed Index Storage: The regulatory consortium maintains an encrypted index table. Each entry in the encrypted index table represents the correspondence between the encrypted index, the unique identifier of the medical data, the storage address of the encrypted medical data in the cloud server, and the access structure generated by attribute base encryption. The regulatory consortium distributes the stored encrypted index table to the sub-chains of multiple data sharing chains for storage. The block difficulty of each sub-chain determines the size of the encrypted index table share allocated to the sub-chain. Step 5: Submit a search request: Data users generate an intermediate search token using the keywords they want to search for, submit a paid search request to the data sharing chain, and after the regulatory consortium checks the legality of the request, it generates a complete search token to form a paid search transaction. This transaction is then packaged with other types of transactions into a block on the data sharing main chain and uploaded to the chain. Step 6, Parallel Search: For the search transactions contained in the main chain blocks of the data sharing chain, the consensus nodes in the sub-chains of each data sharing chain use the complete search token to search the partial index table stored in the sub-chain, and at the same time generate a set of unsolved problems with matching data, which are added to the unsolved problem pool of the sub-chain. Each sub-chain executes the above search process in parallel. Step 7, Hybrid Consensus: Consensus nodes in the sub-chains of each data sharing chain independently solve the unsolved problem pool of their respective sub-chains and reach a local consensus on the search results through a lottery consensus mechanism, generating new sub-chain blocks and uploading them to the chain. After all sub-chains have reached a local consensus on the search results, the regulatory consortium uses the consensus mechanism of the consortium chain to mix the local consensus into a global consensus, giving block-producing nodes of the sub-chains block rewards, paying shared data rewards to data owners, and creating a search result transaction. Finally, it is packaged with other types of transactions into a data sharing main chain block and uploaded to the chain. Step 8, Data Decryption: The cloud server finds the corresponding ciphertext through the information in the main chain of the data sharing chain, recovers the intermediate ciphertext using the outsourced decryption key, and sends it to the data user. The data user finally uses the private key to recover the plaintext data.

2. The method for fine-grained secure sharing of medical data based on a blockchain structure according to claim 1, characterized in that: Step 1 specifically includes the following steps: Step 1-1, M medical regulatory agencies AA i Form a regulatory consortium As a trusted execution center, it generates security parameters, and the regulatory consortium selects two multiplicative cyclic groups of prime number p. and A generator and bilinear mapping e: Four hash functions H:{0,1} * →{0,1} 256 H1: H2: H f : A data user is identified by several attributes, making the system's plaintext attribute global scope as follows: f att =H f If (att) is the cryptographic fingerprint of attribute att, then the global attribute set is: A piece of medical data is identified by several keywords, making the global keyword set in the system as follows: Steps 1-2: Each node in the regulatory consortium executes the Pedersen secret-sharing algorithm to synthesize the system master secret α, β, δ, ε. Where γ x It is a random number related to attribute x, used to calculate e(g,g) in the final step of the Pedersen secret sharing algorithm. α g β g δ g ε , Steps 1-3: The regulatory consortium initializes a medical regulatory chain. The medical regulatory chain is a consortium blockchain. Each node in the regulatory consortium acts as a consensus node and uses the consortium blockchain consensus mechanism to maintain the operation of the consortium blockchain. The consortium blockchain stores the user's real information and provides services for user identity authentication, authorization management, and medical behavior supervision. Steps 1-4: The regulatory consortium initializes the data sharing chain. The data sharing chain is a public chain consisting of a main chain and multiple parallel sub-chains. The main chain provides a trading platform for various entities in the system for transfers, data publishing, and paid search. Each node in the regulatory consortium acts as a consensus node and uses a hybrid consensus mechanism to maintain the operation of the main chain. The sub-chains are used for distributed storage of encrypted indexes and parallel computation of searches. Distributed computing nodes that provide computing power to obtain revenue act as consensus nodes and use a lottery consensus mechanism to maintain the operation of the sub-chains. Any entity can generate its own public chain account and freely join the data sharing chain. Steps 1-5: The regulatory consortium publishes the system's public parameters to the main chain of the data sharing chain.

3. The method for fine-grained secure sharing of medical data based on a blockchain structure according to claim 1, characterized in that: Step 2 specifically includes the following steps: Step 2-1, let As a global identity space, data users possess a unique identity identifier. The data owner has a unique identifier. Step 2-2: Data user selects random numbers As the private key USK of the data sharing chain account, generate the account's public key address. Register your UID and UPK with the medical supervision chain, and the data owner selects a random number. As the private key OSK of the data sharing chain account, generate the account public key address. And register its own OID and OPK with the medical supervision chain; Steps 2-3: For authenticated data users, the regulatory consortium randomly selects... Based on his attribute set Calculate D0 = g α g βt , Will As the attribute decryption key, it is sent to the data user via a secure channel; Steps 2-4: After receiving the UAK, the data user randomly selects... As an outsourced decryption private key, calculate Obtain the outsourced decryption key 4. The method for fine-grained secure sharing of medical data based on a blockchain structure according to claim 1, characterized in that: Step 3 specifically includes the following steps: Step 3-1: After a patient receives medical data EHR at the hospital, the attending physician generates a unique identifier for the plaintext of this data, EID = H(EHR). The physician then signs the EID with their private key USK to generate SIG. doctor This indicates acceptance of the data content; Step 3-2: The attending physician extracts the keyword set for the EHR according to industry standards. For each keyword Select random number And calculate The encrypted index of the keyword w is I w = (I1, I2), the encrypted index of this data EHR is then... Step 3-3: The attending physician randomly selects a symmetric key K. sym Encrypt the EHR and generate the EHR ciphertext C. EID =Enc sym (EHR,K sym Using the patient's public key OPK to pair K sym Encrypt and generate Then CT=(C EID C0) is uploaded to the cloud server CS. The storage address of CT in CS is addr. EID ; Steps 3-4: The doctor submits an authentication request to the main chain of the data sharing chain, informing the patient that the medical data has been uploaded, including EID and address. EID I EID SIG doctor The necessary information is included in the request. After the regulatory consortium verifies the validity of the request, it will send the EID, address... EID SIG doctor Information to make a transaction TX signature1 It is packaged together with other types of transactions into a main chain block of the data sharing chain, index I. EID Then it is saved to the cache area under the medical supervision chain; Steps 3-5: The patient receives the transaction (TX) on the main chain. signature1 Then, according to addr EID Obtain the encrypted CT from CS and calculate... Thus, the plaintext data EHR=Dec is recovered. sym (C EID ,K sym The patient calculates EID = H(EHR) and verifies the signature validity using the doctor's public key to ensure the data has not been tampered with. After confirming that the data content and signature are correct, the patient signs the EID using the private key OPK to generate SIG. owner This indicates acceptance of the data content; Steps 3-6: After the patient approves the data, first randomly select the symmetric key K. sym Encrypt the EHR and regenerate the ciphertext C of the EHR. EID ′=Enc sym (EHR,K sym Then, the ciphertext policy attribute base encryption mechanism is used to implement access control management of the data; Steps 3-7, patient based on Define the access policy for this EHR, and the set of attributes involved in the policy is as follows: The number of attributes is l, thus yielding the final access structure. in It is an l×n LSSS matrix associated with the access strategy, where ρ:[row]→x is a set of... The row number row∈[1,l] to the attribute The mapping, representing the matrix The row number is related to attribute x; Steps 3-8: The patient randomly selects a column vector. and a set of random numbers calculate in Representation matrix Given the row-th vector, calculate C0′=K. sym ′·e(g,g) αs C1 = g s , Ciphertext CT′=(C EID ′,C0′,C1,{C 2,row },{C 3,row }); Steps 3-9: The patient submits an authentication request to the main chain of the data sharing chain, informing the doctor that the medical data has been retrieved and signed, EID, SIG. owner A EID Included in the request, after the regulatory consortium verifies the request's legitimacy, it will be subject to EID and SIG. owner Information to make a transaction TX signature2 Packaged with other types of transactions into the main chain block, and access structure A EID The encrypted index of this data in the cache is added to the encrypted index table stored in the regulatory consortium. The patient uploads the CT scan to CS, and the previously stored data in addr is added to the encrypted index table. EID The encrypted CT is replaced with CT′, completing the two-way authentication and release of the data.

5. The method for fine-grained secure sharing of medical data based on a blockchain structure according to claim 1, characterized in that: Step 4 specifically includes the following steps: Step 4-1: When initializing the data sharing chain, the regulatory consortium should reasonably specify the number of sub-chains (num) and the block difficulty (difficulty) of each sub-chain. j , The complete encrypted index table is divided into num parts, and the proportion of the data in each part to the complete list is equal to the block difficulty. Step 4-2: The regulatory consortium maintains an encrypted index table. Each entry in the encrypted index table represents the correspondence between the encrypted index, the unique identifier of the medical data, the storage address of the encrypted medical data in the cloud server, and the access structure generated by attribute-based encryption. The regulatory consortium distributes the encrypted index table to the consensus nodes in each subchain for storage. The consensus nodes in each subchain store the same part of the index table, so there is no need to store the part of the index table of other subchains. Newly generated encrypted indexes are also distributed to the corresponding subchains according to this rule to maintain the balance between the data share and block difficulty of the subchain. Step 4-3: Distributed computing nodes that wish to provide computing power to obtain block rewards generate public and private keys for the data sharing chain account. Based on their own computing power, they can choose to join subchains of different difficulties and obtain relevant data from other nodes in the subchain.

6. The method for fine-grained secure sharing of medical data based on a blockchain structure according to claim 1, characterized in that: Step 5 specifically includes the following steps: Step 5-1: Data users are randomly selected. Calculate UTK1 = g τ UTK2=H1(w)·(g ε ) τ The intermediate search token is UTK = (UTK1, UTK2). Data users submit paid search requests to the main chain of the data sharing chain, specifying the fuel price (gas) within the request. price And pay in full in advance as compensation for data owners to share data and as a reward for distributed computing nodes; S5-2. After the regulatory consortium's inspection request is deemed legitimate, the complete search token is calculated. Create a paid search transaction TX search It is packaged into the main chain block along with other types of transactions.

7. The method for fine-grained secure sharing of medical data based on a blockchain structure according to claim 1, characterized in that: Step 6 specifically includes the following steps: Step 6-1: The consensus nodes in the sub-chains of each data sharing chain act as observer nodes of the main chain, observing the search transactions in the main chain blocks. For a search transaction on the main chain, the sub-chain consensus node uses the complete search token CTK to search the partial index list stored in its sub-chain. By calculating whether H2(e(I1,CTK)) is equal to I2, it is determined whether the keywords in the search token match the encrypted index keywords. Step 6-2: For a set of matching data, the subchain consensus node extracts the attribute set from the search transaction. Access structure A with matching data EID Calculate the intersection matrix All of the above satisfy row vectors As a new matrix row vectors The number of row vectors l′ in the new matrix is ​​less than or equal to the number of row vectors l in the old matrix, and the row number correspondence between the new and old matrices is saved as <row,row′>. Step 6-3: Define a problem to be solved as: find a set of constants o1, o2, ..., o l′ , making That is, solving a system of linear equations in The coefficient matrix, To solve; Step 6-4: The subchain consensus node will solve this system of linear equations as a problem to be solved for matching data. EID The unsolved problems generated by all matching data in the subchain index table of a search transaction constitute the unsolved problem set Q of that search transaction. search ={question EID The subchain consensus node will Q searcch Add it to the unsolved problem pool of this node; Step 6-5: Each subchain executes the above search process in parallel to generate a pool of unsolved problems for that subchain.

8. The method for fine-grained secure sharing of medical data based on a blockchain structure according to claim 1, characterized in that: Step 7 specifically includes the following steps: Step 7-1: Consensus nodes in a sub-chain solve problems in the unsolved problem pool. For a question... EID The answer can be found using Gaussian elimination. EID If the system of linear equations has no solution, then answer EID If the system of linear equations is perpendicular, and it has a solution, find a particular solution. The mapping between row numbers and constants in the old matrix is ​​obtained from the previously saved row number mapping <row,row′>. row ′>, then answer EID For {>row,o row＜ ,ρ(row)>} row′∈[1,l′] The consensus node that first finds all the answers in the pool of unsolved problems packages its public chain account address, search results, and answers into a block and submits it to the regulatory consortium. It also broadcasts the block to other consensus nodes in its sub-chain, claiming that it has won the prize and that a sub-chain block has been generated. Step 7-2: Other consensus nodes in the subchain receive the block notification. For linear equation systems that the block-producing node claims have a solution, the correctness of the answer can be verified by simply substituting the particular solution in the answer into the corresponding linear equation system. For linear equation systems that the block-producing node claims have no solution, the correctness of the answer is determined by calculating the rank of the coefficient matrix and the augmented matrix. If all answers in the block are correct, it is added to the end of the current subchain, and the block is broadcast in the subchain as accepted. When most consensus nodes in the subchain accept the block, a local consensus on the search transactions in this round is achieved in the subchain. Step 7-3: When the regulatory consortium observes that a subchain has reached partial consensus and produced a block, it awards a block-producing node a reward for the answer to each unsolved problem set in the subchain block. EID If the answer is not ⊥, then the fuel price per unit (gas) is determined according to the data owner's specifications. price The reward, calculated as reward = gas, is distributed to the block-producing nodes after deducting the data user's prepayment from the problem size l′. price If the answer is ⊥, then l′ of the subchain contribution reward is issued to the block-producing node. If multiple consensus nodes of a subchain claim to produce a block, the regulatory consortium only recognizes the block-producing node of the first received block of the same subchain as the winner. Step 7-4: To incentivize subchain consensus nodes to continuously participate in computation, for questions with the answer ⊥, the block-producing node is rewarded with contribution points for that subchain. Subchain contribution points are used to bid for the right to produce blocks in that subchain. Every four blocks produced by a subchain, the right to produce the next block is determined by auction. The regulatory consortium accepts bids from subchain consensus nodes before the fourth block is produced. The auction is conducted in a "blind auction" format, and the auction results for each subchain are announced in the fourth main chain block. The three nodes with the highest bids receive the gas reward in the next subchain block according to their respective bid proportions, and no longer receive the contribution reward for that block. Step 7-5: Whether a problem has a solution and what the solution value is are random. Only when a subchain consensus node obtains the correct result through honest calculation can it receive the corresponding reward. The problem is similar to a lottery in real life. The solution process of the consensus node is equivalent to the lottery purchase and draw. Any node can provide computing power to participate in the lottery purchase. The greater the computing power provided, the greater the probability of winning, thus ensuring fairness. Therefore, the method used in the above local consensus process is named the lottery consensus mechanism. Step 7-6: After all subchains have reached a local consensus, the regulatory consortium mixes them into a global consensus for the search results. The regulatory consortium then uses TX as the basis for this consensus. search Based on the search results, construct a transaction TX result In the transaction, the prepaid fees of data users are deducted as block rewards for subchain block-producing nodes and compensation for data sharing by data owners. The remaining prepaid fees are refunded, and the search results are included in the transaction. Finally, the consortium blockchain consensus mechanism is used to process the transaction. result It is packaged with other types of transactions into the main chain block and uploaded to the chain.

9. The method for fine-grained secure sharing of medical data based on a blockchain structure according to claim 1, characterized in that: Step 8 specifically includes the following steps: Step 8-1: The cloud server CS follows the main chain TX of the data sharing chain. result addr in the transaction EID Find the corresponding CT and use the transaction TX. result UAK in Proxy and{<row,o row′ ,ρ(row)>} row′∈[1,l′] ,calculate Send the intermediate ciphertext to the data user; Step 8-2: The data user receives the intermediate ciphertext and recovers the symmetric key. Then, using a symmetric key, the ciphertext is decrypted to obtain the plaintext EHR = Dec. sym (C EID ,K sym ).

Images