Medical clinical data encryption transfer access control method based on smart contract

Abstract

The present application discloses a method, system, device, equipment and storage medium for access control of encrypted circulation of medical clinical data based on smart contracts, which belongs to the field of data security. The method includes determining the target digital label of the target digital entity from the encrypted digital entity through the second request end authority account, and sending the target digital label to the blockchain platform; generating the decryption key of the encrypted digital entity according to the target digital label forwarded from the blockchain platform through the first request end authority account, and sending the decryption key to the blockchain platform; decrypting the encrypted digital entity sent from the data provider through the second request end authority account and the decryption key to obtain the decrypted target digital entity. Through the setting of blockchain and account authority, the present application realizes the isolation of local area network and wide area network, and solves the problem of insufficient data security during the medical data transfer process.

Description

Technical Field

[0001] The present application relates to the field of data security, and specifically relates to a method, system, device, equipment, and storage medium for encrypted transfer access control of medical clinical data based on smart contracts. Background Art

[0002] In modern healthcare, the secure transfer and access control of clinical data is a crucial issue. Clinical data often contains sensitive patient information, such as medical histories, diagnostic results, and treatment plans. This data needs to be shared and transferred across diverse medical institutions to facilitate clinical research, diagnosis, and treatment. However, data transfer faces numerous challenges, including confidentiality, integrity, and availability. Ensuring data security and privacy protection is particularly pressing in data exchange scenarios involving multiple entities.

[0003] Currently, data encryption algorithms and smart contract-based permission access control are primarily used to ensure data security during data transfer. Smart contract-based permission access control ensures that only authorized accounts can perform sensitive operations by defining roles and permissions, using function modifiers, and implementing specific access control modes, thereby enhancing the security and flexibility of contracts.

[0004] However, restrictions on user permissions cannot effectively guarantee that medical data has the required decentralized characteristics during storage, which leads to insufficient data security during medical data transfer. Summary of the Invention

[0005] This application aims to provide a method, system, device, equipment and storage medium for medical clinical data encryption and transfer access control based on smart contracts, at least to solve the problem of insufficient data security during medical data transfer.

[0006] In a first aspect, an embodiment of the present application discloses a method for access control of encrypted transfer of medical clinical data based on smart contracts, which is applied to a data requesting end. The method includes:

[0007] In response to a request to obtain a target digital entity, a target identity authentication application corresponding to the target digital entity is sent to a data provider through a first requester authority account, and an access application for the target digital entity is sent to a blockchain platform; after receiving the target identity authentication application, the data provider is used to determine, through the first provider authority account, an encryption key used to encrypt the target digital entity and a target digital label corresponding to the target digital entity when the target identity authentication application indicates that the identity authentication is successful, and send the encryption key and the target digital label to the blockchain platform; after receiving the access application, the blockchain platform is used to forward the encryption key and the target digital label of the target digital entity sent from the data provider to the data provider;

[0008] In response to the encrypted digital entity sent from the data provider, determining the target digital tag of the target digital entity from the encrypted digital entity through the second requester authority account, and sending the target digital tag to the blockchain platform; the blockchain platform is configured to forward the target digital tag sent from the data requester to the data requester after receiving the target digital tag;

[0009] In response to the target digital tag forwarded from the blockchain platform, generating a decryption key for the encrypted digital entity based on the target digital tag forwarded from the blockchain platform through the first requesting end authority account, and sending the decryption key to the blockchain platform; the blockchain platform is configured to forward the decryption key sent from the data requesting end to the data requesting end after receiving the decryption key;

[0010] In response to the decryption key forwarded from the blockchain platform, the encrypted digital entity sent from the data provider is decrypted using the second requester authority account and the decryption key to obtain the decrypted target digital entity.

[0011] In a second aspect, the present application also discloses a method for access control of encrypted transfer of medical clinical data based on smart contracts, which is applied to the data provider. The method includes:

[0012] In response to a target identity authentication request sent from a data requesting end, determining, through a first provider-end authority account, an encryption key for encrypting a target digital entity and a target digital label corresponding to the target digital entity, if the target identity authentication request indicates successful identity authentication, and sending the encryption key and the target digital label to a blockchain platform; the blockchain platform is configured to forward the encryption key and the target digital label sent from the data provider to the data provider after receiving the encryption key and the target digital label;

[0013] In response to the encryption key and target digital label forwarded from the blockchain platform, the target digital entity corresponding to the target digital label is encrypted according to the received encryption key through the second provider authority account to obtain an encrypted digital entity, and the encrypted digital entity is sent to the data requesting end; the data requesting end is used to determine the target digital label of the target digital entity from the encrypted digital entity through the second requesting end authority account after receiving the encrypted digital entity, and send the target digital label to the blockchain platform.

[0014] In a third aspect, the present application also discloses a method for access control of encrypted transfer of medical clinical data based on smart contracts, which is applied to a blockchain platform. The method includes:

[0015] In response to an access request for a target digital entity sent from a data requesting end, forwarding the encryption key and the target digital label of the target digital entity sent from the data providing end to the data providing end; upon receiving the forwarded encryption key and target digital label, the data providing end is configured to encrypt the target digital entity corresponding to the target digital label using the received encryption key through a second providing end authority account to obtain an encrypted digital entity, and then send the encrypted digital entity to the data requesting end;

[0016] In response to the target digital tag sent from the data requesting end, forward the target digital tag sent from the data requesting end to the data requesting end; after receiving the forwarded target digital tag, the data requesting end is configured to generate a decryption key for the encrypted digital entity based on the target digital tag forwarded from the blockchain platform through the first requesting end authority account, and send the decryption key to the blockchain platform;

[0017] In response to the decryption key sent from the data requesting end, the decryption key sent from the data requesting end is forwarded to the data requesting end; the data requesting end is used to respond to the decryption key forwarded from the blockchain platform through the second requesting end authority account after receiving the forwarded decryption key, and decrypt the encrypted digital entity sent from the data providing end through the decryption key to obtain the decrypted target digital entity.

[0018] In a fourth aspect, the present application also discloses a medical clinical data encryption transfer access control system based on smart contracts, comprising: a data request end, a data provider end, and a blockchain platform;

[0019] The data requesting end is connected to the data providing end and the blockchain platform respectively, and the data providing end is connected to the blockchain platform;

[0020] The data request end and the data providing end are respectively used to connect to a wide area network;

[0021] The data request end is provided with a first local area network isolated from the wide area network, and the data request end is provided with a second local area network isolated from the wide area network;

[0022] The data requesting end is provided with a first requesting end authority account and a second requesting end authority account, the first requesting end authority account is used to log in to the wide area network, and the second requesting end authority account is used to log in to the first local area network;

[0023] The data provider is provided with a first provider authority account and a second provider authority account, the first provider authority account is used to log in to the wide area network, and the second provider authority account is used to log in to the second local area network;

[0024] The data requesting end is used to, in response to a request to obtain a target digital entity, send a target identity authentication application corresponding to the target digital entity to the data providing end through the first requesting end authority account, and send an access application for the target digital entity to the blockchain platform; and in response to the encrypted digital entity sent from the data providing end, determine the target digital label of the target digital entity from the encrypted digital entity through the second requesting end authority account, and send the target digital label to the blockchain platform; and in response to the target digital label forwarded from the blockchain platform, generate a decryption key for the encrypted digital entity based on the target digital label forwarded from the blockchain platform through the first requesting end authority account, and send the decryption key to the blockchain platform; and in response to the decryption key forwarded from the blockchain platform, decrypt the encrypted digital entity sent from the data providing end through the second requesting end authority account and the decryption key to obtain the decrypted target digital entity;

[0025] The data provider is configured to, in response to a target identity authentication application sent from a data requester, determine, through a first provider authority account, an encryption key for encrypting a target digital entity and a target digital label corresponding to the target digital entity when the target identity authentication application indicates successful identity authentication, and send the encryption key and the target digital label to the blockchain platform; and, in response to the encryption key and target digital label forwarded from the blockchain platform, encrypt, through a second provider authority account, the target digital entity corresponding to the target digital label according to the received encryption key to obtain an encrypted digital entity, and send the encrypted digital entity to the data requester;

[0026] The blockchain platform is used to forward the encryption key and the target digital label of the target digital entity sent from the data provider end to the data provider end after receiving the access application, and to forward the target digital label sent from the data request end to the data request end after receiving the target digital label, and to forward the decryption key sent from the data request end to the data request end after receiving the decryption key, and to forward the encryption key and the target digital label sent from the data provider end to the data provider end after receiving the encryption key and the target digital label.

[0027] In a fifth aspect, the present application also discloses a medical clinical data encryption flow access control device based on a smart contract, which is applied to a data request end, and the device includes:

[0028] A task initiation module is configured to, in response to a request to obtain a target digital entity, send a target identity authentication application corresponding to the target digital entity to a data provider through a first requester authority account, and send an access application for the target digital entity to a blockchain platform; upon receiving the target identity authentication application, the data provider is configured to, through the first provider authority account, determine an encryption key used to encrypt the target digital entity and a target digital label corresponding to the target digital entity, if the target identity authentication application indicates successful identity authentication, and send the encryption key and the target digital label to the blockchain platform; upon receiving the access application, the blockchain platform is configured to forward the encryption key and the target digital label of the target digital entity sent from the data provider to the data provider;

[0029] an encrypted file receiving module, configured to, in response to the encrypted digital entity sent from the data provider, determine a target digital tag of the target digital entity from the encrypted digital entity through the second requester authority account, and send the target digital tag to the blockchain platform; the blockchain platform is configured to forward the target digital tag sent from the data requester to the data requester after receiving the target digital tag;

[0030] a decryption initiation module, configured to generate, in response to a target digital tag forwarded from the blockchain platform, a decryption key for the encrypted digital entity based on the target digital tag forwarded from the blockchain platform through a first requesting end authority account, and send the decryption key to the blockchain platform; upon receiving the decryption key, the blockchain platform is configured to forward the decryption key sent from the data requesting end to the data requesting end;

[0031] A decryption module is used to respond to the decryption key forwarded from the blockchain platform, decrypt the encrypted digital entity sent from the data provider through the second requesting end authority account and the decryption key to obtain the decrypted target digital entity.

[0032] In a sixth aspect, the present application also discloses a medical clinical data encryption flow access control device based on a smart contract, which is applied to a data provider, and the device includes:

[0033] An authentication module, configured to respond to a target identity authentication request sent from a data requesting end and, if the target identity authentication request indicates successful identity authentication, determine, through a first provider-end authority account, an encryption key used to encrypt a target digital entity and a target digital label corresponding to the target digital entity, and send the encryption key and the target digital label to a blockchain platform; upon receiving the encryption key and the target digital label, the blockchain platform forwards the encryption key and the target digital label sent from the data provider to the data provider;

[0034] An encrypted file sending module is used to respond to the encryption key and target digital label forwarded from the blockchain platform, encrypt the target digital entity corresponding to the target digital label according to the received encryption key through the second provider-end authority account to obtain an encrypted digital entity, and send the encrypted digital entity to the data requesting end; the data requesting end is used to determine the target digital label of the target digital entity from the encrypted digital entity through the second requesting-end authority account after receiving the encrypted digital entity, and send the target digital label to the blockchain platform.

[0035] In a seventh aspect, the present application also discloses a medical clinical data encryption transfer access control device based on a smart contract, which is applied to a blockchain platform. The device includes:

[0036] a first forwarding module, configured to, in response to an access request for a target digital entity sent from a data requesting end, forward the encryption key and the target digital label of the target digital entity sent from the data providing end to the data providing end; the data providing end, upon receiving the forwarded encryption key and target digital label, encrypt the target digital entity corresponding to the target digital label using the received encryption key through the second providing end authority account to obtain an encrypted digital entity, and send the encrypted digital entity to the data requesting end;

[0037] a second forwarding module, configured to, in response to a target digital tag sent from the data requesting end, forward the target digital tag sent from the data requesting end to the data requesting end; the data requesting end, upon receiving the forwarded target digital tag, generate a decryption key for the encrypted digital entity based on the target digital tag forwarded from the blockchain platform through the first requesting end authority account, and send the decryption key to the blockchain platform;

[0038] The third forwarding module is used to forward the decryption key sent from the data requesting end to the data requesting end in response to the decryption key sent from the data requesting end; the data requesting end is used to respond to the decryption key forwarded from the blockchain platform through the second requesting end authority account after receiving the forwarded decryption key, and decrypt the encrypted digital entity sent from the data providing end through the decryption key to obtain the decrypted target digital entity.

[0039] In an eighth aspect, an embodiment of the present application further discloses an electronic device comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first aspect, the second aspect, or the third aspect are implemented.

[0040] In the ninth aspect, an embodiment of the present application further discloses a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect, the second aspect, or the third aspect are implemented.

[0041] In summary, in the embodiments of the present application, by setting up a local area network isolated from the wide area network, the security of the data transmission process is enhanced to prevent unauthorized access, and by setting up a first permission account and a second permission account at the data request end and the data provider end respectively, access control in different network environments is ensured. Then, by making the blockchain platform play an intermediary role in the entire data flow process, it is ensured that the encryption key and decryption key are transmitted through the blockchain, while the encrypted data itself is transmitted separately, ensuring secure communication between the data request end and the data provider end, and enhancing the overall security of the data flow process. Therefore, the method based on the embodiments of the present application effectively solves the security and privacy protection issues of medical clinical data during the flow process, ensures the confidentiality, integrity and availability of data, and solves the problem of insufficient data security during the medical data transfer process. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In the attached figure:

[0043] Figure 1 This is a flowchart of another method for controlling access to encrypted transfer of medical clinical data based on smart contracts provided in an embodiment of the present application;

[0044] Figure 2 This is a flowchart of another method for controlling access to encrypted transfer of medical clinical data based on smart contracts provided in an embodiment of the present application;

[0045] Figure 3 This is a block diagram of a medical clinical data encryption transfer access control system based on smart contracts provided in an embodiment of the present application;

[0046] Figure 4 It is a software architecture under the method provided in the embodiment of the present application;

[0047] Figure 5 It is a deployment architecture under the method provided in the embodiment of the present application;

[0048] Figure 6 This is a data transfer process under the method provided in the embodiment of the present application;

[0049] Figure 7 This is a block diagram of a medical clinical data encryption flow access control device based on smart contracts provided in an embodiment of the present application;

[0050] Figure 8 This is a block diagram of a medical clinical data encryption flow access control device based on smart contracts provided in an embodiment of the present application;

[0051] Figure 9 This is a block diagram of a medical clinical data encryption flow access control device based on smart contracts provided in an embodiment of the present application.

[0052] Figure 10 is a block diagram of an electronic device according to an embodiment of the present application;

[0053] Figure 11 This is a block diagram of an electronic device according to another embodiment of the present application. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0055] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0056] Figure 1 This embodiment provides a medical clinical data encryption flow access control method based on smart contracts, wherein steps 101, 105, 107, and 109 are applied to the data request end, steps 102 and 104 are applied to the data provider end, and steps 103, 106, and 108 are applied to the blockchain platform.

[0057] The method may include the following steps:

[0058] Step 101, in response to a request to obtain a target digital entity, a target identity authentication application corresponding to the target digital entity is sent to the data provider through the first requester authority account, and an access application for the target digital entity is sent to the blockchain platform.

[0059] Among them, the data provider is used to determine the encryption key used to encrypt the target digital entity and the target digital label corresponding to the target digital entity through the first provider authority account after receiving the target identity authentication application, when the target identity authentication application is characterized as successful identity authentication, and send the encryption key and target digital label to the blockchain platform; the blockchain platform is used to forward the encryption key and target digital label of the target digital entity sent from the data provider to the data provider after receiving the access application.

[0060] In some embodiments of the present application, the data requesting end will perform operations through the first requesting end permission account. Specifically, when the data requesting end needs to obtain the target digital entity, it first sends a target identity authentication application to the data providing end, and at the same time sends an access application for the target digital entity to the blockchain platform. The target identity authentication application is used to verify the identity of the requesting end and ensure that it has the right to access the requested digital entity. After receiving the access application, the blockchain platform will forward the encryption key sent by the data providing end and the target digital tag of the target digital entity to the data providing end. This process ensures the legitimacy and security of the data request, and realizes transparent and tamper-proof records through blockchain technology.

[0061] For example, suppose an ordinary user U from the first institution (data requester) needs to access a medical digital object D from the second institution (data provider). User U can send a target identity authentication request to the second institution through the first requester's authorized account, and send an access request for digital object D to the blockchain platform. After receiving the identity authentication request, the second institution verifies the identity of user U and generates an encryption key K for encrypting digital object D and a target digital tag T corresponding to digital object D. The second institution sends the encryption key K and target digital tag T to the blockchain platform. After receiving the access request, the blockchain platform forwards the encryption key K and target digital tag T to the second institution for subsequent encryption and data transmission operations. In this way, the identity authentication and data security of user U are ensured when accessing digital object D.

[0062] Step 102: In response to the target identity authentication application sent from the data requesting end, the first providing end authority account determines the encryption key used to encrypt the target digital entity and the target digital label corresponding to the target digital entity when the target identity authentication application is characterized as successful identity authentication, and sends the encryption key and the target digital label to the blockchain platform.

[0063] Among them, the blockchain platform is used to forward the encryption key and the target digital label of the target digital entity sent from the data provider to the data provider after receiving the encryption key and the target digital label.

[0064] In some embodiments of the present application, the data provider will perform operations through the first provider's authorized account. When the data requester sends a target identity authentication application, the data provider needs to verify the legitimacy of the application. If the identity authentication is successful, the data provider will generate an encryption key for encrypting the target digital entity and a target digital label corresponding to the target digital entity. Subsequently, the data provider sends this information to the blockchain platform. After receiving the encryption key and target digital label, the blockchain platform will forward this information back to the data provider for subsequent encryption operations. This process ensures the security and integrity of the data during transmission, and realizes transparent and tamper-proof records through blockchain technology.

[0065] For example, assume that following the preceding steps, if identity authentication is successful, the second institution generates an encryption key K for encrypting digital object D and a target digital tag T corresponding to digital object D. The second institution sends this key and tag to the blockchain platform. Upon receiving this information, the blockchain platform forwards these key and tag back to the second institution. This ensures the security and integrity of digital object D during transmission, while also recording the entire process through blockchain technology to prevent data tampering and leakage.

[0066] Step 103 : In response to the access request for the target digital entity sent from the data requesting end, the encryption key sent from the data providing end and the target digital tag of the target digital entity are forwarded to the data providing end.

[0067] Among them, the data provider is used to encrypt the target digital entity corresponding to the target digital label according to the received encryption key through the second provider authority account after receiving the forwarded encryption key and target digital label, so as to obtain the encrypted digital entity, and send the encrypted digital entity to the data requester.

[0068] In some embodiments of the present application, the blockchain platform will forward the encryption key and target digital tag previously sent by the data provider back to the data provider based on the data requester's request for access to the target digital entity. After receiving this information, the data provider performs encryption operations through the second provider's authorized account. Specifically, the data provider uses the received encryption key to encrypt the target digital entity corresponding to the target digital tag, generating an encrypted digital entity. The data provider then sends the encrypted digital entity to the data requester. This process utilizes blockchain technology to isolate the data requester's first local area network from the wide area network, ensuring data security.

[0069] For example, assume that after the preceding steps, the blockchain platform forwards the encryption key K and target digital tag T previously sent by the second organization back to the second organization. After receiving this information through the second provider's authorized account, the second organization uses the encryption key K to encrypt the digital object D, generating an encrypted digital entity D'. The second organization then sends the encrypted digital entity D' to the first organization. This ensures the security and integrity of the digital object D during transmission, while also recording the entire process through blockchain technology to prevent data tampering and leakage.

[0070] Step 104, in response to the encryption key and target digital label forwarded from the blockchain platform, encrypt the target digital entity corresponding to the target digital label according to the received encryption key through the second provider authority account to obtain an encrypted digital entity, and send the encrypted digital entity to the data requesting end.

[0071] Among them, after receiving the encrypted digital entity, the data requesting end is used to determine the target digital tag of the target digital entity from the encrypted digital entity through the second requesting end authority account, and send the target digital tag to the blockchain platform.

[0072] In some embodiments of the present application, the data provider will perform encryption operations through a second provider-authorized account. Specifically, in response to the encryption key and target digital tag forwarded by the blockchain platform, the data provider uses the received encryption key to encrypt the target digital entity corresponding to the target digital tag, generating an encrypted digital entity. The data provider then sends the encrypted digital entity to the data requester. After receiving the encrypted digital entity, the data requester extracts the target digital tag from the encrypted digital entity through the second requester-authorized account and sends the target digital tag to the blockchain platform.

[0073] For example, assume that following the previous steps, the second institution encrypts the medical digital object D using the encryption key K through the second provider's authorized account, generating an encrypted digital entity D'. The second institution then sends the encrypted digital entity D' to the first institution. After receiving the encrypted digital entity D', the first institution extracts the target digital tag T from it through the second requester's authorized account and sends it to the blockchain platform. This ensures the security and integrity of the digital object D during transmission, while also recording the entire process through blockchain technology to prevent data tampering and leakage.

[0074] Step 105, in response to the encrypted digital entity sent from the data provider, the target digital tag of the target digital entity is determined from the encrypted digital entity through the second requester authority account, and the target digital tag is sent to the blockchain platform.

[0075] Among them, the blockchain platform is used to forward the target digital tag sent from the data request end to the data request end after receiving the target digital tag.

[0076] In some embodiments of the present application, when a data requester receives an encrypted digital entity from a data provider, it extracts the target digital tag of the target digital entity from the encrypted digital entity. After extracting the target digital tag, the data requester sends it to the blockchain platform. Upon receiving the target digital tag, the blockchain platform forwards it back to the data requester. This process utilizes blockchain technology to isolate the data requester's second local area network from the wide area network, ensuring data security.

[0077] For example, assume that following the preceding steps, user U extracts the target digital tag T from the encrypted digital object D' using the second requester's authorized account and sends it to the blockchain platform. Upon receiving the target digital tag T, the blockchain platform forwards it back to the first institution. This ensures the security and integrity of the digital object D during transmission, while also recording the entire process through blockchain technology to prevent data tampering and leakage.

[0078] Step 106 : In response to the target digital tag sent from the data requesting end, forward the target digital tag sent from the data requesting end to the data requesting end.

[0079] Among them, after receiving the forwarded target digital label, the data requesting end is used to generate a decryption key for the encrypted digital entity based on the target digital label forwarded from the blockchain platform through the first requesting end authority account, and send the decryption key to the blockchain platform.

[0080] In some embodiments of the present application, the blockchain platform will respond to the target digital tag sent by the data requester and forward it back to the data requester. After receiving the forwarded target digital tag, the data requester performs further operations through the authorized account of the first requester. Specifically, the data requester generates a decryption key for the encrypted digital entity based on the target digital tag forwarded from the blockchain platform and sends this decryption key to the blockchain platform. This process ensures the security and integrity of data during transmission, achieving transparent and tamper-proof records through blockchain technology.

[0081] For example, assume that after the preceding steps, the blockchain platform receives the target digital tag T and forwards it back to the first organization. After receiving the forwarded target digital tag T through the first requester's authorized account, the first organization generates a decryption key K' for decrypting the digital object D'. The first organization then sends the decryption key K' to the blockchain platform. This ensures the security and integrity of the digital object D during transmission, while also recording the entire process through blockchain technology to prevent data tampering and leakage.

[0082] Step 107, in response to the target digital tag forwarded from the blockchain platform, a decryption key for the encrypted digital entity is generated according to the target digital tag forwarded from the blockchain platform through the first requesting end authority account, and the decryption key is sent to the blockchain platform.

[0083] Among them, the blockchain platform is used to forward the decryption key sent from the data request end to the data request end after receiving the decryption key.

[0084] In some embodiments of the present application, when a data requester receives a target digital tag forwarded by a blockchain platform, the data requester needs to generate a decryption key for the encrypted digital entity based on the tag. After generating the decryption key, the data requester sends it to the blockchain platform. After receiving the decryption key, the blockchain platform forwards the key back to the data requester. This process uses blockchain technology to isolate the data requester's second local area network from the wide area network, ensuring data security.

[0085] For example, assume that following the preceding steps, user U, using the first requester's authorized account, generates a decryption key K' based on the target digital tag T for decrypting the medical digital object D'. User U then sends this decryption key K' to the blockchain platform. Upon receiving this key, the blockchain platform forwards it back to the first institution. This ensures the security and integrity of the digital object D during transmission, while also recording the entire process through blockchain technology to prevent data tampering and leakage.

[0086] Step 108 : In response to the decryption key sent from the data requesting end, forward the decryption key sent from the data requesting end to the data requesting end.

[0087] Among them, after receiving the forwarded decryption key, the data requesting end is used to respond to the decryption key forwarded from the blockchain platform through the second requesting end authority account, and decrypt the encrypted digital entity sent from the data providing end through the decryption key to obtain the decrypted target digital entity.

[0088] In some embodiments of the present application, the blockchain platform forwards the decryption key sent by the data requesting end back to the data requesting end. After receiving the forwarded decryption key, the data requesting end performs the decryption operation using the second requesting end's authorized account. Specifically, the data requesting end uses the received decryption key to decrypt the encrypted digital entity from the data providing end, thereby obtaining the decrypted target digital entity.

[0089] For example, assume that after the preceding steps, the blockchain platform receives the decryption key K' and forwards it back to the first institution. After receiving the forwarded decryption key K' through the second requester's authorized account, the first institution uses it to decrypt the encrypted medical digital object D' from the second institution, ultimately obtaining the decrypted medical digital object D. This ensures the security and integrity of the digital object D during transmission, while also recording the entire process through blockchain technology to prevent data tampering and leakage.

[0090] Step 109, in response to the decryption key forwarded from the blockchain platform, decrypt the encrypted digital entity sent from the data provider through the second requesting end authority account and the decryption key to obtain the decrypted target digital entity.

[0091] In some embodiments of the present application, when a data requester receives a decryption key forwarded by a blockchain platform, the data requester needs to use the decryption key to decrypt the encrypted digital entity from the data provider. Through the decryption operation, the data requester can obtain the decrypted target digital entity.

[0092] For example, assume that after the preceding steps, user U uses the decryption key K' through the second requester's authorized account to decrypt the encrypted medical digital object D' from the second institution, ultimately obtaining the decrypted medical digital object D. This ensures the security and integrity of the digital object D during transmission, while also recording the entire process through blockchain technology to prevent data tampering and leakage.

[0093] In summary, in the embodiments of the present application, by setting up a local area network isolated from the wide area network, the security of the data transmission process is enhanced to prevent unauthorized access, and by setting up a first permission account and a second permission account at the data request end and the data provider end respectively, access control in different network environments is ensured. Then, by making the blockchain platform play an intermediary role in the entire data flow process, it is ensured that the encryption key and decryption key are transmitted through the blockchain, while the encrypted data itself is transmitted separately, ensuring secure communication between the data request end and the data provider end, and enhancing the overall security of the data flow process. Therefore, the method based on the embodiments of the present application effectively solves the security and privacy protection issues of medical clinical data during the flow process, ensures the confidentiality, integrity and availability of data, and solves the problem of insufficient data security during the medical data transfer process.

[0094] Figure 2 This is another smart contract-based medical clinical data encryption flow access control method provided by this embodiment, wherein steps 201, 205, 207, and 209 are applied to the data request end, steps 202 and 204 are applied to the data provider end, and steps 203, 206, and 208 are applied to the blockchain platform.

[0095] The method may include the following steps:

[0096] Step 201, in response to a request to obtain a target digital entity, a target identity authentication application corresponding to the target digital entity is sent to the data provider through the first requester authority account, and an access application for the target digital entity is sent to the blockchain platform.

[0097] Among them, the data provider is used to determine the encryption key used to encrypt the target digital entity and the target digital label corresponding to the target digital entity through the first provider authority account after receiving the target identity authentication application, when the target identity authentication application is characterized as successful identity authentication, and send the encryption key and target digital label to the blockchain platform; the blockchain platform is used to forward the encryption key and target digital label of the target digital entity sent from the data provider to the data provider after receiving the access application.

[0098] The method shown in this step has been described in step 101 and will not be repeated here.

[0099] Step 202: In response to the target identity authentication application sent from the data requesting end, the first providing end authority account determines the encryption key used to encrypt the target digital entity and the target digital label corresponding to the target digital entity when the target identity authentication application is characterized as successful identity authentication, and sends the encryption key and the target digital label to the blockchain platform.

[0100] Among them, the blockchain platform is used to forward the encryption key and the target digital label of the target digital entity sent from the data provider to the data provider after receiving the encryption key and the target digital label.

[0101] The method shown in this step has been described in step 102 and will not be repeated here.

[0102] Optionally, step 202 includes the following sub-steps:

[0103] Sub-step 2021: determining the digital tag that matches the target identity authentication application as the target digital tag, and generating an encryption key based on the target digital tag.

[0104] In some embodiments of the present application, after receiving a target identity authentication application, the data provider identifies the digital tag that matches the application as the target digital tag. The target digital tag is a unique identifier used to identify the target digital entity. Based on the determined target digital tag, the data provider generates an encryption key for encrypting the target digital entity. The encryption key is used to encrypt the target digital entity to ensure the security and confidentiality of data during transmission. In this way, only authenticated users can access and decrypt the target digital entity.

[0105] For example, suppose a second institution receives a target identity authentication request from user U of the first institution, requesting access to a medical digital object D. The second institution verifies user U's identity and identifies the digital tag T that matches the request as the target digital tag. Based on the target digital tag T, the second institution generates an encryption key K for encrypting digital object D. Encryption key K is used to encrypt digital object D, ensuring data security and confidentiality during transmission. This ensures that only authenticated user U can access and decrypt digital object D.

[0106] Sub-step 2022, sending the encryption key and target digital tag to the blockchain platform.

[0107] In some embodiments of the present application, after generating an encryption key and a target digital tag, the data provider sends this information to the blockchain platform. The encryption key is used to encrypt the target digital entity, while the target digital tag is a unique identifier used to identify the target digital entity. Sending the encryption key and target digital tag to the blockchain platform ensures the security and integrity of this critical information during transmission. The blockchain platform's immutability and distributed ledger characteristics further enhance data transparency and traceability.

[0108] For example, suppose a second institution has generated an encryption key K for encrypting a medical digital object D and a target digital tag T corresponding to the medical digital object. The second institution then sends the encryption key K and target digital tag T to the blockchain platform. Upon receiving this information, the blockchain platform records it in a distributed ledger, ensuring transparency and immutability. This ensures the security and integrity of the encryption key K and target digital tag T during transmission, while also providing complete audit and traceability capabilities.

[0109] Step 203: In response to the access request for the target digital entity sent from the data requesting end, the encryption key sent from the data providing end and the target digital tag of the target digital entity are forwarded to the data providing end.

[0110] Among them, the data provider is used to encrypt the target digital entity corresponding to the target digital label according to the received encryption key through the second provider authority account after receiving the forwarded encryption key and target digital label, so as to obtain the encrypted digital entity, and send the encrypted digital entity to the data requester.

[0111] The method shown in this step has been described in step 103 and will not be repeated here.

[0112] Step 204, in response to the encryption key and target digital label forwarded from the blockchain platform, the target digital entity corresponding to the target digital label is encrypting according to the received encryption key through the second provider authority account to obtain an encrypted digital entity, and the encrypted digital entity is sent to the data requesting end.

[0113] Among them, after receiving the encrypted digital entity, the data requesting end is used to determine the target digital tag of the target digital entity from the encrypted digital entity through the second requesting end authority account, and send the target digital tag to the blockchain platform.

[0114] The method shown in this step has been described in step 104 and will not be repeated here.

[0115] Step 205, in response to the encrypted digital entity sent from the data provider, the target digital tag of the target digital entity is determined from the encrypted digital entity through the second requester authority account, and the target digital tag is sent to the blockchain platform.

[0116] Among them, the blockchain platform is used to forward the target digital tag sent from the data request end to the data request end after receiving the target digital tag.

[0117] The method shown in this step has been explained in step 105 and will not be repeated here.

[0118] Step 206 : In response to the target digital tag sent from the data requesting end, forward the target digital tag sent from the data requesting end to the data requesting end.

[0119] Among them, after receiving the forwarded target digital label, the data requesting end is used to generate a decryption key for the encrypted digital entity based on the target digital label forwarded from the blockchain platform through the first requesting end authority account, and send the decryption key to the blockchain platform.

[0120] The method shown in this step has been described in step 106 and will not be repeated here.

[0121] Step 207, in response to the target digital tag forwarded from the blockchain platform, a decryption key for the encrypted digital entity is generated according to the target digital tag forwarded from the blockchain platform through the first requesting end authority account, and the decryption key is sent to the blockchain platform.

[0122] Among them, the blockchain platform is used to forward the decryption key sent from the data request end to the data request end after receiving the decryption key.

[0123] The method shown in this step has been described in step 107 and will not be repeated here.

[0124] Optionally, step 207 includes the following sub-steps:

[0125] Sub-step 2071, generating a decryption private key according to the target digital tag.

[0126] In some embodiments of the present application, the data requester generates a decryption private key based on the target digital tag. The target digital tag is a unique identifier used to identify the target digital entity. The decryption private key is the key used to decrypt the encrypted digital entity. By generating the decryption private key based on the target digital tag, only authenticated users can generate the correct decryption key and access and decrypt the target digital entity. This process ensures data security and confidentiality.

[0127] For example, assume that an ordinary user U of the first institution has received the target digital tag T from the blockchain platform. User U generates a decryption private key K based on the target digital tag T through the first request end authority account. priv . Decryption private key K priv It will be used to decrypt the encrypted medical digital object D' from the second institution. In this way, it is ensured that only the authenticated user U can generate the correct decryption key K priv , thereby accessing and decrypting the digital object D, ensuring the security and confidentiality of the data.

[0128] Sub-step 2072: encrypt and decrypt the private key using the preset public key to obtain a decryption key, and send the decryption key to the blockchain platform.

[0129] In some embodiments of this application, the data requester will encrypt the decryption private key using a preset public key to generate a decryption key. The preset public key is a key pair used for encryption and decryption, where the public key is used for encryption and the private key is used for decryption. By encrypting the decryption private key with the public key, the security of the decryption private key during transmission can be ensured. The generated decryption key is then sent to the blockchain platform for subsequent decryption operations. This process ensures the security and confidentiality of data during transmission.

[0130] For example, suppose that the ordinary user U of the first institution has generated a decryption private key K based on the target digital label T. priv User U uses the preset public key K through the first request end authority account pub Decryption private key K priv Encrypt and generate decryption key K enc The encrypted decryption key K enc This ensures security during transmission. User U will decrypt the key K enc Sent to the blockchain platform. The blockchain platform receives the decryption key K enc After that, it is recorded in the distributed ledger to ensure the transparency and non-tampering of the information. In this way, the decryption private key K is guaranteed. priv Security and confidentiality during transmission, while providing complete audit and traceability capabilities.

[0131] Step 208 : In response to the decryption key sent from the data requesting end, forward the decryption key sent from the data requesting end to the data requesting end.

[0132] Among them, after receiving the forwarded decryption key, the data requesting end is used to respond to the decryption key forwarded from the blockchain platform through the second requesting end authority account, and decrypt the encrypted digital entity sent from the data providing end through the decryption key to obtain the decrypted target digital entity.

[0133] The method shown in this step has been described in step 108 and will not be repeated here.

[0134] Step 209, in response to the decryption key forwarded from the blockchain platform, decrypt the encrypted digital entity sent from the data provider through the second requesting end authority account and the decryption key to obtain the decrypted target digital entity.

[0135] The method shown in this step has been explained in step 109 and will not be repeated here.

[0136] Optionally, step 209 includes the following sub-steps:

[0137] Sub-step 2091: decrypt the decryption key using the preset private key to obtain a decryption private key.

[0138] In some implementations of this application, the data requester will use a preset private key to decrypt the decryption key to obtain a decryption private key. The preset private key is a key pair used for encryption and decryption, where the private key is used for decryption. By using the private key to decrypt the decryption key, it is ensured that only authorized users can obtain the decryption private key. The decryption private key is a key used to decrypt encrypted digital entities, ensuring the security and confidentiality of data during transmission.

[0139] For example, suppose that an ordinary user U of the first institution has received the encrypted decryption key K through the blockchain platform enc User U uses the preset private key K through the second request end authority account priv For the decryption key K enc Decrypt and obtain the decryption private key K dec . Decryption private key K dec It will be used to decrypt the encrypted medical digital object D' from the second institution. In this way, it is ensured that only authorized users U can obtain the decryption private key K dec , thereby accessing and decrypting the digital object D, ensuring the security and confidentiality of the data.

[0140] Sub-step 2092: decrypt the encrypted digital entity using the decryption private key to obtain the decrypted target digital entity.

[0141] In some implementations of this application, the data requesting end will use the decryption private key to decrypt the encrypted digital entity to obtain the decrypted target digital entity. The decryption private key is the key for decrypting the encrypted digital entity. By decrypting the encrypted digital entity using the decryption private key, the data requesting end can restore the original target digital entity. This process ensures the security and confidentiality of data during transmission, and only authorized users can access and decrypt the target digital entity.

[0142] For example, suppose that the ordinary user U of the first institution has obtained the decryption private key K through the second request end authority account dec User U uses the decryption private key K dec The encrypted medical digital object D' from the second institution is decrypted to finally obtain the decrypted medical digital object D. In this way, it is ensured that only authorized users U can access and decrypt the digital object D, ensuring the security and confidentiality of the data.

[0143] Optionally, in addition to the above steps, the blockchain platform in the embodiment of the present application also performs the following steps:

[0144] In step 210, the encryption key sent from the data provider and the target digital tag of the target digital entity, the target digital tag sent from the data requester, and the data reception event and data forwarding event corresponding to the decryption key sent from the data requester are recorded in the blockchain respectively.

[0145] In some embodiments of this application, the blockchain platform records the following events on the blockchain: data reception events and data forwarding events corresponding to the encryption key and target digital entity sent from the data provider, the target digital tag sent from the data requester, and the decryption key sent from the data requester. By recording these events on the blockchain, transparency and traceability of the entire data flow process are ensured. The immutability and distributed ledger nature of blockchain technology further enhances data security and integrity.

[0146] For example, when a user U from one institution requests access to a medical digital object D from another institution, the blockchain platform will record the following events: the encryption key K and target digital tag T sent by the second institution, the target digital tag T sent by the first institution, and the decryption key K' sent by the first institution. These events correspond to the data reception and data forwarding operations, respectively. By recording these events on the blockchain, every step of user U's access to digital object D is transparently recorded and tracked, preventing data tampering and leakage while providing comprehensive audit and traceability capabilities.

[0147] It is worth emphasizing that the various public or private keys appearing in the various embodiments of this application, such as decryption private keys, private keys, and encryption keys, and the specific keys involved in the encryption algorithm can be selected as static or dynamic keys based on specific needs. Static keys remain unchanged throughout the data transmission process and are suitable for scenarios with lower security requirements. Dynamic keys, on the other hand, generate new keys for each data transmission and are suitable for scenarios with higher security requirements. The use of dynamic keys can effectively prevent key leakage and replay attacks, further enhancing data security and confidentiality.

[0148] Figure 3 The present invention provides an architecture of a medical clinical data encryption transfer access control system based on smart contracts, including a data request terminal A, a data provider terminal B, and a blockchain platform C.

[0149] Data requester A is connected to data provider B and blockchain platform C respectively, and data provider B is connected to blockchain platform C;

[0150] The data request terminal A and the data provider terminal B are respectively used to connect to the wide area network W;

[0151] The data requesting terminal A is provided with a first local area network A1 isolated from the wide area network W, and the data requesting terminal B is provided with a second local area network B1 isolated from the wide area network W;

[0152] The data requesting end A is provided with a first requesting end authority account and a second requesting end authority account. The first requesting end authority account is used to log in to the wide area network W, and the second requesting end authority account is used to log in to the first local area network A1.

[0153] The data provider B is provided with a first provider authority account and a second provider authority account. The first provider authority account is used to log in to the wide area network W, and the second provider authority account is used to log in to the second local area network B1.

[0154] The data requesting end A is used to respond to a request to obtain the target digital entity, send a target identity authentication application corresponding to the target digital entity to the data providing end through the first requesting end authority account, and send an access application for the target digital entity to the blockchain platform; and in response to the encrypted digital entity sent from the data providing end, determine the target digital tag of the target digital entity from the encrypted digital entity through the second requesting end authority account, and send the target digital tag to the blockchain platform; and in response to the target digital tag forwarded from the blockchain platform, generate a decryption key for the encrypted digital entity based on the target digital tag forwarded from the blockchain platform through the first requesting end authority account, and send the decryption key to the blockchain platform; and in response to the decryption key forwarded from the blockchain platform, decrypt the encrypted digital entity sent from the data providing end through the second requesting end authority account and the decryption key to obtain the decrypted target digital entity;

[0155] The data provider B is configured to, in response to a target identity authentication application sent from the data requester, determine, through the first provider authority account, an encryption key for encrypting the target digital entity and a target digital label corresponding to the target digital entity when the target identity authentication application indicates successful identity authentication, and send the encryption key and the target digital label to the blockchain platform; and, in response to the encryption key and target digital label forwarded from the blockchain platform, encrypt, through the second provider authority account, the target digital entity corresponding to the target digital label according to the received encryption key to obtain an encrypted digital entity, and send the encrypted digital entity to the data requester;

[0156] Blockchain platform C is used to forward the encryption key and the target digital label of the target digital entity sent from the data provider end to the data provider end after receiving the access application, and to forward the target digital label sent from the data request end to the data request end after receiving the target digital label, and to forward the decryption key sent from the data request end to the data request end after receiving the decryption key, and to forward the encryption key and the target digital label sent from the data provider end to the data provider end after receiving the encryption key and the target digital label.

[0157] The present invention discloses a smart contract-based system for the encrypted transfer and access control of medical clinical data. The system includes a data requester A, a data provider B, and a blockchain platform C, all interconnected via a network. Data requester A and data provider B are each connected to a wide area network (WAN) W to facilitate transmission and access by general users; data requester A and data provider B are interconnected to facilitate the transfer of medical data; and data requester A and data provider B are each connected to the blockchain platform C to facilitate the exchange of encrypted medical data information. Furthermore, data requester A and data provider B are configured with local area networks (LANs) A1 and B1, respectively, isolated from WAN W. This isolation design enhances security during data transmission, preventing unauthorized access and data leakage. Data requester A is equipped with two permission accounts: a first requester permission account and a second requester permission account. The first requester permission account is used only for logging into WAN W, while the second requester permission account is used only for logging into LAN A1. Data provider B is similarly equipped with two permission accounts: a first provider permission account and a second provider permission account. The first provider-side permission account is used to log in to the wide area network W, and the second provider-side permission account is used to log in to the local area network B1. This design ensures access control in different network environments, ensures data isolation within the system, and ensures data security.

[0158] refer to Figure 4It is a software architecture under a smart contract-based medical clinical data encryption flow access control method provided in an embodiment of the present application, specifically performing the process of steps S1 to S4:

[0159] S1: Issue access request: The data requester initiates an access request to the smart contract to request access to specific encrypted medical data.

[0160] S2: Access request response: After receiving the access request, the smart contract verifies the legitimacy of the request and decides whether to allow access based on the access control policy.

[0161] S3: Data access request review: The data provider reviews the access request, generates the corresponding encryption key and target digital label, and sends this information to the blockchain platform.

[0162] S4: Request access response: The blockchain platform forwards the encryption key and target digital tag to the data requester, which uses this information to decrypt and access the target digital entity.

[0163] Figure 5 It is a deployment architecture under a medical clinical data encryption flow access control method based on smart contracts provided in an embodiment of the present application. Under this architecture, users initiate data access requests to the system through these terminals through user terminals. Requests from user terminals are received through gateway nodes, and these requests are forwarded to the blockchain network and data storage services. They act as a bridge for data transmission, ensuring the smooth flow of data requests and responses. The blockchain network is the core part of the entire system, responsible for recording and verifying all data access requests and responses. Through smart contracts, the blockchain network ensures the security, transparency and immutability of data. The data storage service is used to store encrypted medical clinical data. Only authorized users can access this data through decryption keys to ensure the security and privacy of the data.

[0164] Figure 6 This is a data transfer process under a smart contract-based medical clinical data encryption transfer access control method provided in an embodiment of the present application, specifically executing steps M1 to M6:

[0165] M1: Access application and target identity authentication application:

[0166] M1(a): Access request: the data requester initiates an access request to the blockchain platform to request access to specific encrypted medical data;

[0167] M1(b): The data requester simultaneously initiates a target identity authentication request to the data provider to verify its access rights;

[0168] M2: Access request response. After receiving the access request, the blockchain platform verifies the organization's authority and account's authority to ensure the legitimacy and compliance of the request.

[0169] M3: Digital object review: the data provider reviews the access request, generates the corresponding encryption key and target digital label, and writes this information into the blockchain platform;

[0170] M4: Write the target digital tag. The blockchain platform records the target digital tag and encryption key in the distributed ledger to ensure the transparency and non-tamperability of the information.

[0171] M5: Write the decryption key. After receiving the encrypted digital entity, the data requester extracts the target digital tag from it through the second requester's authorized account and sends the target digital tag to the blockchain platform. The blockchain platform records the decryption key in the distributed ledger.

[0172] M6: Decryption of encrypted digital entity. The data requesting end uses the decryption key to decrypt the encrypted digital entity and finally obtains the decrypted target digital entity.

[0173] In summary, in the embodiments of the present application, by setting up a local area network isolated from the wide area network, the security of the data transmission process is enhanced to prevent unauthorized access, and by setting up a first permission account and a second permission account at the data request end and the data provider end respectively, access control in different network environments is ensured. Then, by making the blockchain platform play an intermediary role in the entire data flow process, it is ensured that the encryption key and decryption key are transmitted through the blockchain, while the encrypted data itself is transmitted separately, ensuring secure communication between the data request end and the data provider end, and enhancing the overall security of the data flow process. Therefore, the method based on the embodiments of the present application effectively solves the security and privacy protection issues of medical clinical data during the flow process, ensures the confidentiality, integrity and availability of data, and solves the problem of insufficient data security during the medical data transfer process.

[0174] refer to Figure 7 , which shows a medical clinical data encryption flow access control device 30 based on smart contracts provided in an embodiment of the present application, applied to a data request end, including:

[0175] The task initiation module 301 is configured to, in response to a request to obtain a target digital entity, send a target identity authentication application corresponding to the target digital entity to the data provider through the first requester authority account, and send an access request for the target digital entity to the blockchain platform; upon receiving the target identity authentication application, the data provider is configured to, through the first provider authority account, determine an encryption key used to encrypt the target digital entity and a target digital label corresponding to the target digital entity, if the target identity authentication application indicates successful identity authentication, and send the encryption key and target digital label to the blockchain platform; upon receiving the access request, the blockchain platform is configured to forward the encryption key and target digital label sent from the data provider to the data provider;

[0176] The encrypted file receiving module 302 is configured to, in response to the encrypted digital entity sent from the data provider, determine the target digital tag of the target digital entity from the encrypted digital entity through the second requester's permission account, and send the target digital tag to the blockchain platform; after receiving the target digital tag, the blockchain platform is configured to forward the target digital tag sent from the data requester to the data requester;

[0177] The decryption initiation module 303 is configured to generate a decryption key for the encrypted digital entity based on the target digital tag forwarded from the blockchain platform through the first requesting end authority account in response to the target digital tag forwarded from the blockchain platform, and send the decryption key to the blockchain platform; after receiving the decryption key, the blockchain platform is configured to forward the decryption key sent from the data requesting end to the data requesting end;

[0178] The decryption module 304 is used to respond to the decryption key forwarded from the blockchain platform, decrypt the encrypted digital entity sent from the data provider through the second requesting end authority account and the decryption key to obtain the decrypted target digital entity.

[0179] Optionally, the decryption initiation module 303 includes:

[0180] The decryption private key generation submodule is used to generate a decryption private key according to the target digital label.

[0181] The decryption key submodule is used to encrypt and decrypt the private key using the preset public key to obtain the decryption key and send the decryption key to the blockchain platform.

[0182] Optionally, the decryption module 304 includes:

[0183] The private key decryption submodule is used to decrypt the decryption key using the preset private key to obtain the decrypted private key.

[0184] The data decryption submodule is used to decrypt the encrypted digital entity using the decryption private key to obtain the decrypted target digital entity.

[0185] refer to Figure 8 , which shows a medical clinical data encryption flow access control device 31 based on smart contracts provided in an embodiment of the present application, applied to a data provider, including:

[0186] Authentication module 311 is configured to respond to a target identity authentication request sent from a data requesting end and, if the target identity authentication request indicates successful identity authentication, determine, through the first provider's authorized account, an encryption key used to encrypt the target digital entity and a target digital label corresponding to the target digital entity, and send the encryption key and target digital label to the blockchain platform; upon receiving the encryption key and target digital label, the blockchain platform is configured to forward the encryption key and target digital label sent from the data provider to the data provider;

[0187] The encrypted file sending module 312 is used to respond to the encryption key and target digital label forwarded from the blockchain platform, encrypt the target digital entity corresponding to the target digital label according to the received encryption key through the second provider end authority account to obtain the encrypted digital entity, and send the encrypted digital entity to the data request end; the data request end is used to determine the target digital label of the target digital entity from the encrypted digital entity through the second request end authority account after receiving the encrypted digital entity, and send the target digital label to the blockchain platform.

[0188] Optionally, the authentication module 311 includes:

[0189] The encryption generation submodule is used to determine the digital tag that matches the target identity authentication application as the target digital tag, and generate an encryption key based on the target digital tag.

[0190] The authentication sending submodule is used to send the encryption key and target digital label to the blockchain platform.

[0191] refer to Figure 9 , which shows a medical clinical data encryption transfer access control device 32 based on smart contracts provided by an embodiment of the present application, applied to a blockchain platform, including:

[0192] The first forwarding module 321 is configured to forward the encryption key and the target digital label of the target digital entity sent from the data providing end to the data providing end in response to an access request for the target digital entity sent from the data requesting end; the data providing end is configured to, upon receiving the forwarded encryption key and target digital label, encrypt the target digital entity corresponding to the target digital label using the received encryption key through the second providing end authority account to obtain an encrypted digital entity, and then send the encrypted digital entity to the data requesting end;

[0193] The second forwarding module 322 is configured to forward the target digital tag sent from the data requesting end to the data requesting end in response to the target digital tag sent from the data requesting end; the data requesting end is configured to generate a decryption key for the encrypted digital entity based on the target digital tag forwarded from the blockchain platform through the first requesting end authority account after receiving the forwarded target digital tag, and send the decryption key to the blockchain platform;

[0194] The third forwarding module 323 is used to forward the decryption key sent from the data requesting end to the data requesting end in response to the decryption key sent from the data requesting end; after receiving the forwarded decryption key, the data requesting end is used to respond to the decryption key forwarded from the blockchain platform through the second requesting end authority account, and decrypt the encrypted digital entity sent from the data providing end through the decryption key to obtain the decrypted target digital entity.

[0195] Optionally, the device 32 further includes:

[0196] The blockchain recording module is used to record the encryption key sent from the data provider and the target digital label of the target digital entity, the target digital label sent from the data requester, and the data reception event and data forwarding event corresponding to the decryption key sent from the data requester in the blockchain respectively.

[0197] In summary, in the embodiments of the present application, by setting up a local area network isolated from the wide area network, the security of the data transmission process is enhanced to prevent unauthorized access, and by setting up a first permission account and a second permission account at the data request end and the data provider end respectively, access control in different network environments is ensured. Then, by making the blockchain platform play an intermediary role in the entire data flow process, it is ensured that the encryption key and decryption key are transmitted through the blockchain, while the encrypted data itself is transmitted separately, ensuring secure communication between the data request end and the data provider end, and enhancing the overall security of the data flow process. Therefore, the method based on the embodiments of the present application effectively solves the security and privacy protection issues of medical clinical data during the flow process, ensures the confidentiality, integrity and availability of data, and solves the problem of insufficient data security during the medical data transfer process.

[0198] Reference Figure 10 , electronic device 500 may include one or more of the following components: a processing component 502 , a memory 504 , a power component 506 , a multimedia component 508 , an audio component 510 , an input / output (I / O) interface 512 , a sensor component 514 , and a communication component 516 .

[0199] The processing component 502 generally controls the overall operation of the electronic device 500, such as operations associated with display, phone calls, data communications, camera operation, and recording operations. The processing component 502 may include one or more processors 520 to execute instructions to perform all or part of the steps of the above-described method. In addition, the processing component 502 may include one or more modules to facilitate interaction between the processing component 502 and other components. For example, the processing component 502 may include a multimedia module to facilitate interaction between the multimedia component 508 and the processing component 502.

[0200] The memory 504 is used to store various types of data to support operations on the electronic device 500. Examples of such data include instructions for any application or method operating on the electronic device 500, contact data, phone book data, messages, pictures, multimedia, etc. The memory 504 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0201] The power supply assembly 506 provides power to the various components of the electronic device 500. The power supply assembly 506 may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the electronic device 500.

[0202] The multimedia component 508 includes an interface that provides an output interface between the electronic device 500 and the user. In some embodiments, the interface may include a liquid crystal display (LCD) and a touch panel (TP). If the interface includes a touch panel, the interface may be implemented as a touch screen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensor can not only sense the boundaries of touch or slide actions, but also detect the duration and pressure associated with the touch or slide operation. In some embodiments, the multimedia component 508 includes a front camera and / or a rear camera. When the electronic device 500 is in an operating mode, such as a shooting mode or a multimedia mode, the front camera and / or the rear camera can receive external multimedia data. Each front camera and rear camera can be a fixed optical lens system or have focal length and optical zoom capabilities.

[0203] The audio component 510 is used to output and / or input audio signals. For example, the audio component 510 includes a microphone (MIC) that is used to receive external audio signals when the electronic device 500 is in an operating mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal can be further stored in the memory 504 or transmitted via the communication component 516. In some embodiments, the audio component 510 also includes a speaker for outputting audio signals.

[0204] The input / output I / O interface 512 provides an interface between the processing component 502 and peripheral interface modules, such as a keyboard, a click wheel, buttons, etc. These buttons may include but are not limited to: a home button, a volume button, a start button, and a lock button.

[0205] The sensor assembly 514 includes one or more sensors for providing various aspects of status assessment for the electronic device 500. For example, the sensor assembly 514 can detect the open / closed state of the electronic device 500, the relative positioning of components, such as the display and keypad of the electronic device 500. The sensor assembly 514 can also detect changes in the position of the electronic device 500 or a component of the electronic device 500, the presence or absence of user contact with the electronic device 500, the orientation or acceleration / deceleration of the electronic device 500, and temperature changes of the electronic device 500. The sensor assembly 514 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. The sensor assembly 514 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor assembly 514 may also include an accelerometer, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0206] The communication component 516 is used to facilitate wired or wireless communication between the electronic device 500 and other devices. The electronic device 500 can access a wireless network based on a communication standard, such as WiFi, an operator network (such as 2G, 3G, 4G or 5G), or a combination thereof. In an exemplary embodiment, the communication component 516 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 516 also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0207] In an exemplary embodiment, the electronic device 500 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to implement the methods provided in the embodiments of the present application.

[0208] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 504 including instructions, which can be executed by the processor 520 of the electronic device 500 to perform the above method. For example, the non-transitory storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0209] Figure 11 FIG. 6 is a block diagram of an electronic device 600 according to another embodiment of the present invention. For example, the electronic device 600 may be provided as a server. Figure 11 The electronic device 600 includes a processing component 622, which further includes one or more processors, and a memory resource represented by a memory 632 for storing instructions executable by the processing component 622, such as an application. The application stored in the memory 632 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 622 is configured to execute the instructions to perform the method provided in the embodiments of the present application.

[0210] The electronic device 600 may further include a power supply component 626 configured to perform power management of the electronic device 600, a wired or wireless network interface 650 configured to connect the electronic device 600 to a network, and an input / output (I / O) interface 658. The electronic device 600 may operate based on an operating system stored in the memory 632, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or the like.

[0211] It should be noted that the medical data information involved in this application is all medical data information that has been fully authorized by all parties, and the collection, use and processing of relevant medical data information must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0212] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the application disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of the present application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0213] It should be understood that the present application is not limited to the exact structures described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for access control of encrypted transfer of medical clinical data based on smart contracts, characterized in that: When applied to a data requesting end, the method includes: In response to a request to obtain a target digital entity, a target identity authentication application corresponding to the target digital entity is sent to a data provider through a first requester authority account, and an access application for the target digital entity is sent to a blockchain platform; after receiving the target identity authentication application, the data provider is used to determine, through the first provider authority account, an encryption key used to encrypt the target digital entity and a target digital label corresponding to the target digital entity when the target identity authentication application indicates that the identity authentication is successful, and send the encryption key and the target digital label to the blockchain platform; after receiving the access application, the blockchain platform is used to forward the encryption key and the target digital label of the target digital entity sent from the data provider to the data provider; In response to the encrypted digital entity sent from the data provider, determining the target digital tag of the target digital entity from the encrypted digital entity through the second requester authority account, and sending the target digital tag to the blockchain platform; the blockchain platform is configured to forward the target digital tag sent from the data requester to the data requester after receiving the target digital tag; In response to the target digital tag forwarded from the blockchain platform, generating a decryption key for the encrypted digital entity based on the target digital tag forwarded from the blockchain platform through the first requesting end authority account, and sending the decryption key to the blockchain platform; the blockchain platform is configured to forward the decryption key sent from the data requesting end to the data requesting end after receiving the decryption key; In response to the decryption key forwarded from the blockchain platform, decrypting the encrypted digital entity sent from the data provider using the second requesting end authority account and the decryption key to obtain the decrypted target digital entity; When applied to a data provider, the method includes: In response to a target identity authentication request sent from a data requesting end, determining, through a first provider-end authority account, an encryption key for encrypting a target digital entity and a target digital label corresponding to the target digital entity, if the target identity authentication request indicates successful identity authentication, and sending the encryption key and the target digital label to a blockchain platform; the blockchain platform is configured to forward the encryption key and the target digital label sent from the data provider to the data provider after receiving the encryption key and the target digital label; In response to the encryption key and target digital label forwarded from the blockchain platform, the target digital entity corresponding to the target digital label is encrypted according to the received encryption key through the second provider authority account to obtain an encrypted digital entity, and the encrypted digital entity is sent to the data requesting end; the data requesting end is used to determine the target digital label of the target digital entity from the encrypted digital entity through the second requesting end authority account after receiving the encrypted digital entity, and send the target digital label to the blockchain platform.

2. The method according to claim 1, wherein The step of generating, in response to the target digital tag forwarded from the blockchain platform, a decryption key for the encrypted digital entity according to the target digital tag forwarded from the blockchain platform by a first requesting end authority account, and sending the decryption key to the blockchain platform includes: Generate a decryption private key according to the target digital tag; The decryption private key is encrypted by a preset public key to obtain the decryption key, and the decryption key is sent to the blockchain platform.

3. The method according to claim 1, wherein The step of decrypting the encrypted digital entity sent from the data provider using the second requester authority account and the decryption key in response to the decryption key forwarded from the blockchain platform to obtain the decrypted target digital entity includes: Decrypting the decryption key using a preset private key to obtain a decryption private key; The encrypted digital entity is decrypted using the decryption private key to obtain the decrypted target digital entity.

4. The method according to claim 1, wherein The method includes: responding to a target identity authentication application sent from a data requesting end, determining, through a first provider authority account, an encryption key for encrypting a target digital entity and a target digital label corresponding to the target digital entity when the target identity authentication application indicates that the identity authentication is successful, and sending the encryption key and the target digital label to a blockchain platform, including: Determine the digital tag that matches the target identity authentication application as the target digital tag, and generate the encryption key according to the target digital tag; The encryption key and the target digital tag are sent to a blockchain platform.

5. A medical clinical data encryption circulation access control system based on smart contracts, characterized in that: include: Data requester, data provider, and blockchain platform; The data requesting end is connected to the data providing end and the blockchain platform respectively, and the data providing end is connected to the blockchain platform; The data request end and the data providing end are respectively used to connect to a wide area network; The data request end is provided with a first local area network isolated from the wide area network, and the data request end is provided with a second local area network isolated from the wide area network; The data requesting end is provided with a first requesting end authority account and a second requesting end authority account, the first requesting end authority account is used to log in to the wide area network, and the second requesting end authority account is used to log in to the first local area network; The data provider is provided with a first provider authority account and a second provider authority account, the first provider authority account is used to log in to the wide area network, and the second provider authority account is used to log in to the second local area network; The data requesting end is used to, in response to a request to obtain a target digital entity, send a target identity authentication application corresponding to the target digital entity to the data providing end through the first requesting end authority account, and send an access application for the target digital entity to the blockchain platform; and in response to the encrypted digital entity sent from the data providing end, determine the target digital label of the target digital entity from the encrypted digital entity through the second requesting end authority account, and send the target digital label to the blockchain platform; and in response to the target digital label forwarded from the blockchain platform, generate a decryption key for the encrypted digital entity based on the target digital label forwarded from the blockchain platform through the first requesting end authority account, and send the decryption key to the blockchain platform; and in response to the decryption key forwarded from the blockchain platform, decrypt the encrypted digital entity sent from the data providing end through the second requesting end authority account and the decryption key to obtain the decrypted target digital entity; The data provider is configured to, in response to a target identity authentication application sent from a data requester, determine, through a first provider authority account, an encryption key for encrypting a target digital entity and a target digital label corresponding to the target digital entity when the target identity authentication application indicates successful identity authentication, and send the encryption key and the target digital label to the blockchain platform; and, in response to the encryption key and target digital label forwarded from the blockchain platform, encrypt, through a second provider authority account, the target digital entity corresponding to the target digital label according to the received encryption key to obtain an encrypted digital entity, and send the encrypted digital entity to the data requester; The blockchain platform is used to forward the encryption key and the target digital label of the target digital entity sent from the data provider end to the data provider end after receiving the access application, and to forward the target digital label sent from the data request end to the data request end after receiving the target digital label, and to forward the decryption key sent from the data request end to the data request end after receiving the decryption key, and to forward the encryption key and the target digital label sent from the data provider end to the data provider end after receiving the encryption key and the target digital label.

6. A medical clinical data encryption transfer access control device based on smart contracts, characterized in that: When applied to a data requesting end, the device includes: A task initiation module is configured to, in response to a request to obtain a target digital entity, send a target identity authentication application corresponding to the target digital entity to a data provider through a first requester authority account, and send an access application for the target digital entity to a blockchain platform; upon receiving the target identity authentication application, the data provider is configured to, through the first provider authority account, determine an encryption key used to encrypt the target digital entity and a target digital label corresponding to the target digital entity, if the target identity authentication application indicates successful identity authentication, and send the encryption key and the target digital label to the blockchain platform; upon receiving the access application, the blockchain platform is configured to forward the encryption key and the target digital label of the target digital entity sent from the data provider to the data provider; an encrypted file receiving module, configured to, in response to the encrypted digital entity sent from the data provider, determine a target digital tag of the target digital entity from the encrypted digital entity through the second requester authority account, and send the target digital tag to the blockchain platform; the blockchain platform is configured to forward the target digital tag sent from the data requester to the data requester after receiving the target digital tag; a decryption initiation module, configured to generate, in response to a target digital tag forwarded from the blockchain platform, a decryption key for the encrypted digital entity based on the target digital tag forwarded from the blockchain platform through a first requesting end authority account, and send the decryption key to the blockchain platform; upon receiving the decryption key, the blockchain platform is configured to forward the decryption key sent from the data requesting end to the data requesting end; a decryption module, configured to, in response to the decryption key forwarded from the blockchain platform, decrypt the encrypted digital entity sent from the data provider using the second requesting end authority account and the decryption key to obtain the decrypted target digital entity; When applied to a data provider, the device includes: An authentication module, configured to respond to a target identity authentication request sent from a data requesting end and, if the target identity authentication request indicates successful identity authentication, determine, through a first provider-end authority account, an encryption key used to encrypt a target digital entity and a target digital label corresponding to the target digital entity, and send the encryption key and the target digital label to a blockchain platform; upon receiving the encryption key and the target digital label, the blockchain platform forwards the encryption key and the target digital label sent from the data provider to the data provider; An encrypted file sending module is used to respond to the encryption key and target digital label forwarded from the blockchain platform, encrypt the target digital entity corresponding to the target digital label according to the received encryption key through the second provider-end authority account to obtain an encrypted digital entity, and send the encrypted digital entity to the data requesting end; the data requesting end is used to determine the target digital label of the target digital entity from the encrypted digital entity through the second requesting-end authority account after receiving the encrypted digital entity, and send the target digital label to the blockchain platform.

7. An electronic device, characterized in that: include: a processor, a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 4.

8. A computer-readable storage medium, characterized in that When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the method according to any one of claims 1 to 4.

Images