Clinical data privacy protection method and system based on blockchain

Abstract

The present invention discloses a clinical data privacy protection method and system based on blockchain. The method includes obtaining relevant data of clinical data, converting it into computer-readable data, and obtaining a first generation credential; storing the relevant data in a storage space, obtaining a storage index, and generating a second generation credential; performing a hash calculation based on the relevant data and the first generation credential to obtain a relevant data storage credential; calculating the Kendall rank correlation coefficient based on the second generation credential and the relevant data storage credential, and performing an encryption operation based on the calculation result; storing the verification credential in the storage space to obtain a verification credential storage block, and uploading the verification credential storage block to a blockchain node; authenticating the caller, and when the identity authentication passes, retrieving the relevant data. The method can realize the identity identification of the data caller and the integrity verification of the data when retrieving data, and ensures the security of the authorized data by utilizing the tamper-proof property of the blockchain.

Description

Technical Field

[0001] The present invention relates to the field of blockchain technology, and in particular to a clinical data privacy protection method and system based on blockchain. Background Art

[0002] Blockchain technology, also known as distributed ledger technology, is a decentralized, open, and tamper-proof distributed data storage system that can distribute and replicate data on multiple nodes and ensure that data cannot be tampered with or forged between these nodes through cryptographic methods. In the field of clinical data, blockchain technology can be used to decentralize the storage of clinical data, remove the dependence of patient clinical data on third-party data platforms, and reduce the loss of clinical data due to platform closures and other issues. At the same time, clinical data has the characteristics of potential scientific research value, and the privacy of clinical data and its processing process needs to be protected to avoid data abuse and ensure that clinical data is safe, available, and invisible.

[0003] In existing blockchain technology, an immutable, distributed medical record database is usually created so that patient data can be shared securely and efficiently between different medical institutions. This decentralized data storage method helps improve data accessibility and transparency while protecting patient privacy. However, although blockchain provides encryption and anonymization features, in the medical field, data privacy protection requirements are extremely high, and existing technologies are still difficult to achieve the requirement of distinguishing medical information retrieved by different callers.

[0004] In summary, there is still a need to distinguish the rights of people of different identities to access different information. However, although the existing technology provides encryption and anonymization features, it has not yet met the requirement of distinguishing the identities of the people accessing the information. Summary of the invention

[0005] The present invention provides a clinical data privacy protection method and system based on blockchain, which can verify the association relationship between the verification credentials stored in the blockchain and the associated data corresponding to the verification credentials, and realize the identity identification of the data caller, data acquisition path and data integrity verification when retrieving data, so as to ensure the confidentiality of data during data sharing.

[0006] In the first aspect, in order to solve the above technical problems, the present invention provides a clinical data privacy protection method based on blockchain, comprising:

[0007] Obtaining relevant data of clinical data, converting it into computer-readable data, and obtaining a first generated certificate;

[0008] Storing the relevant data in a storage space to obtain a storage index, and generating a second generation credential according to the storage index;

[0009] Performing a hash calculation based on the relevant data and the first generated credential to obtain a relevant data storage credential;

[0010] Calculate the Kendall rank correlation coefficient based on the second generated credential and the related data storage credential, and perform encryption operation based on the calculation result to obtain a verification credential;

[0011] The verification credential is stored in a storage space to obtain a verification credential storage block, and the verification credential storage block is uploaded to a blockchain node;

[0012] The identity of the caller is authenticated based on the first generated credential, the second generated credential and the verification credential. When the identity authentication is passed, the relevant data related to the clinical data requested by the caller is retrieved.

[0013] Preferably, the relevant data includes data retriever information, information data and associated data.

[0014] Preferably, the information data includes the patient's name, age, gender, address, date of birth, social security, surgery name, surgery time, and surgeon;

[0015] The data retriever information includes ID number, name and ID identification code;

[0016] The associated data includes storage information of medical records, diagnosis and treatment information of medical records, laboratory examination information, physician information, and patient status information.

[0017] Preferably, the storage information of the medical record includes the hospital name, department information, medical record number, and the start time of medical record storage;

[0018] The diagnosis and treatment information includes the name of the operation, the time of the operation, and the surgeon in charge of the operation;

[0019] The experimental inspection information includes inspection content and inspection results;

[0020] The physician information includes the physician's name, physician ID, professional title, and hospital information;

[0021] The patient status information includes the patient's medical results, medication, nursing, follow-up examination items, follow-up date, operation name, operation time, and surgeon.

[0022] Preferably, performing a hash calculation based on the relevant data and the first generated credential to obtain the relevant data storage credential is specifically:

[0023] A hash calculation is performed according to the relevant data and the first generated credential using the SHA 256 algorithm to obtain hash value data of the relevant data, and the hash value data is used as the relevant data storage credential.

[0024] Preferably, the calculating of the Kendall rank correlation coefficient according to the second generation credential and the relevant data storage credential, and performing encryption operation according to the calculation result to obtain the verification credential, comprises:

[0025] assigning a grade to each data point in the second generated credential and the associated data storage credential, respectively, and determining a ranking of the data points based on the assigned grades;

[0026] Determining, according to the data point ranking, the number of consistent data pairs, the number of inconsistent data pairs, and the number of data pairs with a ranking tie of data points in the second generated voucher and the relevant data storage voucher;

[0027] The Kendall rank correlation coefficient is calculated according to the number of consistent data pairs, the number of inconsistent data pairs and the number of tied-rank data pairs;

[0028] Generating a verification credential based on the Kendall rank correlation coefficient and an asymmetric encryption operation;

[0029] The Kendall rank correlation coefficient is calculated by the following formula:

[0030]

[0031] In the formula, is the Kendall rank correlation coefficient, is the number of consistent data pairs, is the number of inconsistent data pairs, is the number of ranked and parallel data pairs in the second generated voucher, Stores the number of ranked and tied data pairs in the relevant data voucher.

[0032] Preferably, the identity authentication of the caller is performed based on the first generated credential, the second generated credential and the verification credential, and when the identity authentication is passed, the relevant data related to the clinical data requested by the caller is retrieved, specifically:

[0033] Obtain the retrieval request from the retrieval person;

[0034] Retrieving the verification credential storage block according to the application retrieval request;

[0035] According to the verification credential storage block, retrieving the relevant data storage credential and the second generated credential;

[0036] Retrieving the first generated credential based on the relevant data storage credential;

[0037] authenticating the caller according to the first generated credential, the second generated credential, and the verification credential;

[0038] When the identity authentication is passed, the relevant data related to the clinical data requested by the caller is retrieved.

[0039] In a second aspect, the present invention provides a clinical data privacy protection system based on blockchain, comprising:

[0040] A data acquisition module, used to acquire relevant data of clinical data, convert it into computer-readable data, and obtain a first generated certificate;

[0041] A data storage module, used to store the relevant data in a storage space, obtain a storage index, and generate a second generation credential according to the storage index;

[0042] A storage credential generation module, configured to perform a hash calculation based on the relevant data and the first generated credential to obtain a relevant data storage credential;

[0043] A verification credential generation module, used to calculate the Kendall rank correlation coefficient according to the second generation credential and the relevant data storage credential, and perform encryption operation according to the calculation result to obtain a verification credential;

[0044] A credential uploading module, used to store the verification credential in a storage space, obtain a verification credential storage block, and upload the verification credential storage block to a blockchain node;

[0045] The identity authentication module is used to authenticate the identity of the caller based on the first generated credential, the second generated credential and the verification credential, and when the identity authentication is passed, retrieve the relevant data related to the clinical data requested by the caller.

[0046] In a third aspect, the present invention also provides an electronic device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the blockchain-based clinical data privacy protection method described above is implemented.

[0047] In a fourth aspect, the present invention also provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned blockchain-based clinical data privacy protection methods.

[0048] Compared with the prior art, the present invention has the following beneficial effects: the embodiment of the present invention provides a clinical data privacy protection method and system based on blockchain. The method includes: obtaining relevant data of clinical data, converting it into computer-readable data, and obtaining a first generation credential; storing the relevant data in a storage space, obtaining a storage index, and generating a second generation credential according to the storage index; performing hash calculation according to the relevant data and the first generation credential to obtain a relevant data storage credential; calculating the Kendall rank correlation coefficient according to the second generation credential and the relevant data storage credential, and performing encryption operation according to the calculation result to obtain a verification credential; storing the verification credential in a storage space to obtain a verification credential storage block, and uploading the verification credential storage block to a blockchain node; performing identity authentication on the caller according to the first generation credential, the second generation credential and the verification credential, and when the identity authentication is passed, retrieving the relevant data related to the clinical data requested by the caller.

[0049] In the present invention, the method can store relevant data of clinical data, convert the relevant data into computer-readable data, generate a first generation credential and a second generation credential according to the computer-readable data, and generate a verification credential through the association relationship between the storage index and the associated data. There is a mapping relationship between the storage index and the verification credential storage block. When the caller requests to retrieve the relevant data, the verification is performed through the association relationship between the verification credential stored in the blockchain and the associated data corresponding to the verification credential. When retrieving data, the identity of the data caller, the data acquisition path and the integrity of the data can be verified, thereby ensuring the confidentiality of the data during the data sharing process and ensuring the security of the authorized data by utilizing the tamper-proof nature of the blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a flowchart of a clinical data privacy protection method based on blockchain provided by the first embodiment of the present invention;

[0051] Figure 2 It is a structural diagram of a clinical data privacy protection system based on blockchain provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] Reference Figure 1The first embodiment of the present invention provides a clinical data privacy protection method based on blockchain, comprising the following steps:

[0054] S11, obtaining relevant data of clinical data, converting it into computer-readable data, and obtaining the first generated certificate.

[0055] S12, storing the relevant data in a storage space, obtaining a storage index, and generating a second generation credential according to the storage index.

[0056] S13, performing hash calculation according to the relevant data and the first generated credential to obtain a relevant data storage credential.

[0057] S14, calculating the Kendall rank correlation coefficient according to the second generated credential and the related data storage credential, and performing encryption operation according to the calculation result to obtain a verification credential.

[0058] S15, storing the verification credential in a storage space to obtain a verification credential storage block, and uploading the verification credential storage block to a blockchain node.

[0059] S16, performing identity authentication on the caller according to the first generated credential, the second generated credential and the verification credential, and when the identity authentication is passed, retrieving the relevant data related to the clinical data requested by the caller.

[0060] It is worth noting that blockchain technology, also known as distributed ledger technology, is a decentralized, open, and tamper-proof distributed data storage system that can distribute and replicate data on multiple nodes and ensure that data cannot be tampered with or forged between these nodes through cryptographic methods. In the field of clinical data, blockchain technology can be used to decentralize the storage of clinical data, remove the dependence of patient clinical data on third-party data platforms, and reduce the loss of clinical data due to platform closures and other issues. At the same time, clinical data has the characteristics of potential scientific research value, and the privacy of clinical data and its processing process needs to be protected to avoid data abuse and ensure that clinical data is safe, available, and invisible.

[0061] In order to facilitate the understanding of the present invention, some preferred embodiments of the present invention are further described below.

[0062] In step S11, the relevant data of clinical data is obtained and converted into computer-readable data to obtain the first generated certificate. Specifically, the relevant data includes data retriever information, information data and related data; wherein the information data includes patient name, patient age, patient gender, patient address, patient date of birth, patient social security, operation name, operation time, and surgeon; the data retriever information includes ID number, name and ID identification code; the related data includes storage information of medical records, diagnosis and treatment information of medical records, laboratory examination information, physician information, and patient status information; wherein the storage information of medical records includes hospital name, department information, medical record number, and start time of medical record storage; the diagnosis and treatment information includes operation name, operation time, and surgeon; the laboratory examination information includes examination content and examination results; the physician information includes doctor name, doctor work number, title, and hospital information; the patient status information includes patient consultation results, medication, nursing, follow-up examination items, follow-up date, operation name, operation time, and surgeon.

[0063] Specifically, all the above data may include structured data (such as experimental results, drug use records) and unstructured data (such as doctor's notes, imaging data). Therefore, when converted into computer-readable data, clinical data from different sources need to be converted into a standardized format. The purpose of data standardization is to convert clinical data from different sources into a consistent format and structure so that computer systems can effectively process and analyze these data. In the medical field, data is usually stored in different formats and may come from different medical institutions and equipment. In order to ensure the consistency of these data in subsequent use, they must be converted into a standard format. Specifically, common medical data standards include: HL7 (HealthLevel 7), which is a widely used standard for the transmission of electronic health information; FHIR (Fast HealthcareInteroperability Resources), a modern data exchange standard designed specifically for medical applications, supporting JSON and XML formats; DICOM (Digital Imaging and Communications in Medicine), a data standard for storing and transmitting medical images. Exemplarily, a patient's diagnosis and treatment information can be formatted as a "Patient" resource in the FHIR standard so that each medical institution can read and understand this data.

[0064] It is worth noting that before converting the relevant data of clinical data into computer-readable data, data cleaning of the relevant data should be performed. Data cleaning is an important step to ensure the quality and consistency of data. Clinical data may contain errors, duplications, null values ​​and other problems during the collection process. The purpose of data cleaning is to minimize these problems. Exemplarily, data cleaning can include: Error correction: There may be errors in the data caused by human input errors or equipment failures. For example, the date format may be inconsistent ("2023-09-20" or "20 / 09 / 2023"), which need to be handled uniformly. Similarly, spelling errors, invalid code values ​​(such as medical codes), etc. need to be automatically corrected or manually repaired by data cleaning tools; Deduplication: Since multiple sources may record the same patient or the same event repeatedly, data cleaning needs to identify and delete these duplicates to avoid repeated counting during data analysis; Data completion: There are often missing values ​​in clinical data. For example, the address or date of birth of some patients may not be fully recorded. At this time, the missing information can be completed through other means, such as searching from the patient's historical data, or it can be clearly marked as null values ​​to ensure that no errors will be caused in the subsequent processing process.

[0065] It is worth noting that the process of obtaining the first generated credential is: clinical data collection and conversion, first, obtain clinical data (such as patient name, age, medical records, etc.) and convert it into a computer-readable format; perform hash calculation, after the data is formatted, use a hash algorithm (such as SHA-256) to process the data and generate the corresponding data hash value. This hash value is used as the first generated credential to uniquely identify the data and ensure its integrity and non-tamperability; generate the first generated credential. The above hash value is the first generated credential. This credential is generated by calculation, which can ensure the security and integrity of the data in the subsequent storage and verification process.

[0066] In step S12, the relevant data is stored in a storage space to obtain a storage index, and a second generation credential is generated according to the storage index.

[0067] It is worth noting that the storage space is a place where processed and encrypted clinical data can be stored and accessed and retrieved. The storage space can be: cloud storage. Modern medical systems can use cloud storage to store large amounts of data. Cloud service providers (such as AWS, Azure, and Google Cloud) can provide secure and scalable storage services to ensure that data is available at any time; blockchain network. The blockchain itself can be used as a decentralized storage space. Although the blockchain is not suitable for storing large-scale data, it can be used to store encrypted and hashed credentials and index information to ensure that the data cannot be tampered with; local or distributed databases. Medical institutions can choose local servers or distributed databases to store clinical data. For example, SQL or NoSQL databases can be used to store patient information, medical records, etc.; medical-specific storage systems. Some specific medical information systems (such as electronic medical record systems EMR) or health information exchange systems (HIE) can be used as the storage space. These systems are usually designed specifically for medical data and have high security and compliance.

[0068] Specifically, the storage index is a key part for locating and retrieving data stored in the storage space, and plays a key role in the identity authentication of the subsequent retriever when retrieving data. The generation process of the storage index can be: data conversion and storage, clinical data is first standardized and structured, converted into a computer-readable format, and then the processed clinical data is stored in the selected storage space (such as cloud storage, database or local system), each data has its storage location, such as the row number of the database, the file path in the object storage, etc.; generate data identifiers, the system generates a unique identifier (such as data ID) for each data to ensure that the data can be accurately located in the storage space. This unique identifier can be randomly generated or based on the hash value of the data content.

[0069] It is worth noting that after generating the storage index, the system should associate the storage index with the relevant generation credentials (first generation credentials, second generation credentials, verification credentials) to ensure that during subsequent retrieval and verification of the identity of the caller, the identity of the data caller, data acquisition path and data integrity verification can be achieved, ensuring data confidentiality during data sharing, and using the immutability of blockchain to ensure data security after authorization.

[0070] Specifically, the process of generating the second generation credential based on the storage index is: generating an index after the data is stored. After the clinical data is stored in the storage space, the system generates a unique storage index (such as through a hash value or a unique ID) to identify the specific location of the data in the storage space; hash calculation generates the second generation credential. The generation of the second generation credential is based on the storage index, using a hash algorithm (such as SHA-256). The hash algorithm can combine the storage indexes to calculate and generate a new unique hash value, and use this new hash value as the second generation credential.

[0071] In step S13, a hash calculation is performed according to the relevant data and the first generated credential to obtain the relevant data storage credential. Specifically, the hash calculation is performed according to the relevant data and the first generated credential to obtain the relevant data storage credential, specifically: a hash calculation is performed according to the relevant data and the first generated credential using the SHA 256 algorithm to obtain the hash value data of the relevant data, and the hash value data is used as the relevant data storage credential.

[0072] It is worth mentioning that SHA-256 is a secure hash algorithm, which belongs to the SHA-2 (Secure HashAlgorithm 2) series and is one of the most widely used hash algorithms. The main function of the SHA-256 algorithm is to perform hash calculations on the input data and generate a 256-bit (32-byte) hash value for data integrity verification, digital signatures, blockchain and other applications. The characteristics of this algorithm are: fixed-length output, no matter how long the input data is, SHA-256 always generates a 256-bit hash value; avalanche effect, a small change to the input data (such as changing a character), the generated hash value will change dramatically, and it is difficult to guess the input data through the hash value; uniqueness, the hash values ​​generated for different input data are different, even if the difference between the data is very small. In summary, SHA-256 is an efficient and secure hash algorithm that is widely used in fields such as data protection, verification and encryption, especially in blockchain and digital signatures. It has key applications.

[0073] It is worth noting that the purpose of step S13, that is, obtaining the relevant data storage credential based on the relevant data and the first generated credential, is to verify the integrity of the data, by performing hash calculation on the relevant data and the first generated credential to generate a unique storage credential, which can be used to verify whether the data has been tampered with. If any clinical data changes, the hash value will be different, indicating that the data is no longer credible; in preparation for subsequent verification, the generated storage credential can be used in subsequent steps (such as identity authentication and data retrieval) to verify whether the retrieved data is consistent with the stored original data. Any tampering with the data will cause the storage credential to not match, thereby indicating a data integrity issue. In general, this step generates a storage credential by performing hash calculation on the data, thereby ensuring the integrity, security and non-tamperability of the data, and also provides reliable protection for subsequent identity authentication and data retrieval.

[0074] In step S14, the Kendall rank correlation coefficient is calculated according to the second generated credential and the related data storage credential, and an encryption operation is performed according to the calculation result to obtain a verification credential.

[0075] It is worth noting that the main purpose of performing hash calculation on the relevant data storage credentials and the second generated credentials to obtain the verification credentials is to further strengthen the integrity verification and identity authentication of the data, ensure that the data has not been tampered with during the entire storage and retrieval process, and provide a basis for the identity authentication of the retrieved data. The relevant data storage credentials and the second generated credentials represent the integrity of the data itself and the storage location, respectively. By combining them together for processing, the generated verification credentials are a double guarantee for these data. In addition, by combining the two key credentials with the Kendall rank correlation coefficient to generate the verification credentials, it is ensured that any changes to the data or storage location will be reflected in the verification process. Only when these two credentials remain unchanged can the verification credentials be consistent with the original data. More importantly, in the subsequent steps, when the caller requests data, the system needs to verify the identity of the caller. As an important credential for retrieving data, the verification credential can be used to ensure that the retrieved data has not been tampered with, and at the same time confirm whether the caller has the right to access the data. By verifying the relationship between the credential and the stored index and credential, the system can ensure that the retrieved data is legal and verified, and that only authorized users can access the data.

[0076] In one embodiment, the calculating of the Kendall rank correlation coefficient according to the second generation credential and the relevant data storage credential, and performing an encryption operation according to the calculation result to obtain the verification credential, includes:

[0077] assigning a grade to each data point in the second generated credential and the associated data storage credential, respectively, and determining a ranking of the data points based on the assigned grades;

[0078] Determining, according to the data point ranking, the number of consistent data pairs, the number of inconsistent data pairs, and the number of data pairs with a ranking tie of data points in the second generated voucher and the relevant data storage voucher;

[0079] The Kendall rank correlation coefficient is calculated according to the number of consistent data pairs, the number of inconsistent data pairs and the number of tied-rank data pairs;

[0080] Generating a verification credential based on the Kendall rank correlation coefficient and an asymmetric encryption operation;

[0081] The Kendall rank correlation coefficient is calculated by the following formula:

[0082]

[0083] In the formula, is the Kendall rank correlation coefficient, is the number of consistent data pairs, is the number of inconsistent data pairs, is the number of ranked and parallel data pairs in the second generated voucher, Stores the number of ranked and tied data pairs in the relevant data voucher.

[0084] Specifically, data preparation is first performed, and the data in the second generated voucher and the related data storage voucher are sorted. For example, if the data is continuous or ordinal data, the data can be sorted or graded. Exemplarily, a grade is selected to be assigned to each data point in the second generated voucher and the related data storage voucher. If it is continuous data, the grade is usually its position in the data set; if it is ordinal data, the ordinal number of the data is directly used.

[0085] Next, consistent pairs and inconsistent pairs in the data set are determined. Exemplarily, if data point i is ranked higher than data point j in both the second generated credential and the relevant data storage credential, or both are lower than j, then the pairing of the two data points i is considered consistent; if data point i is ranked higher than data point j in the second generated credential, but ranked lower than data point j in the relevant data storage credential, then the pairing of the two data points i is considered inconsistent. In the calculation of the Kendall rank correlation coefficient, the number of tied-ranked data pairs refers to the number of data point pairs with the same rank or ranking in the data set. Determining the number of these tied-ranked data pairs is an important part of the calculation, especially when there are identical values ​​in the data, because these tied pairs will affect the final correlation coefficient calculation.

[0086] In this embodiment, after the Kendall rank correlation coefficient is calculated through the above process, the result of the Kendall rank correlation coefficient is used in combination with asymmetric encryption of a secure encryption algorithm to generate a verification credential. For example, a private key can be used to sign data containing the Kendall rank correlation coefficient (Kendall Tau value) to create a verifiable verification credential related to the data feature. During verification, the Kendall Tau value is recalculated and compared with the value contained in the verification credential. If the two are consistent, the verification credential is valid. In addition, the calculation of the Kendall rank correlation coefficient can be implemented by relevant functions in statistical software or programming languages ​​(such as R, Python, etc.), and the present invention is not limited to this.

[0087] It is worth noting that the purpose of this implementation is mainly to further ensure the security and integrity of the data retrieval process, ensure that the data has not been tampered with during the access process, and perform effective identity authentication to protect data privacy. When a user requests to retrieve data, the system needs to verify the legitimacy of the request and ensure that the data has not been tampered with. By generating verification credentials, the system can effectively verify the retrieved data, ensure the security of data retrieval, prevent unauthorized users from obtaining sensitive clinical data, and prevent malicious access. According to the verification credentials generated by this implementation, the system can verify the identity of the person who retrieves it, ensuring that only authorized users can retrieve and access specific data, strengthen the verification of user identities, prevent unauthorized access, and protect patient privacy and data security.

[0088] In step S15, the verification credential is stored in a storage space to obtain a verification credential storage block, and the verification credential storage block is uploaded to a blockchain node.

[0089] It is worth noting that a blockchain node is a participant in a blockchain network, which runs the blockchain protocol, maintains a copy of the entire blockchain, and participates in the consensus and data verification process on the blockchain. Blockchain is a decentralized distributed ledger, where all nodes reach agreement through a consensus algorithm to ensure the accuracy and immutability of the data in the ledger. In the present invention, blockchain nodes can be used to store verification credential storage blocks, which is actually a key function of the blockchain system. The characteristics of blockchain, such as decentralization, immutability, and distributed storage, are very suitable for storing data such as verification credentials.

[0090] Specifically, by storing the verification credentials in the blockchain, the immutability of the blockchain is utilized to ensure that any generated verification credentials cannot be tampered with or deleted. This ensures the integrity of the data, and even malicious users cannot modify the credentials, which enhances the security of the data in the system and ensures that each data storage and retrieval is based on trusted credentials. At the same time, in the subsequent data retrieval process, the verification credentials are used as the core verification tool to confirm the integrity of the data. By storing the verification credentials, the system can verify that the data has not been tampered with based on the credentials when retrieval of data in the future. In addition, by uploading the verification credentials to the blockchain nodes, the distributed storage of the blockchain ensures that even if a single node fails, the verification credentials can still be accessed through other nodes, which greatly improves the reliability of the system. In the process of identity authentication and data access control, the verification credentials are used as a core part to ensure that only legitimate users can retrieve data that matches their identity. By storing the verification credentials securely, the system can verify the permissions of the visitor through the credentials.

[0091] In step S16, the identity of the caller is authenticated based on the first generated credential, the second generated credential and the verification credential. When the identity authentication is passed, the relevant data related to the clinical data requested by the caller is retrieved.

[0092] Specifically, the caller's identity is authenticated based on the first generation credential, the second generation credential and the verification credential. When the identity authentication is successful, the relevant data related to the clinical data requested by the caller is retrieved, specifically as follows: an application retrieval request is obtained; according to the application retrieval request, the verification credential storage block is retrieved; according to the verification credential storage block, the relevant data storage credential and the second generation credential are retrieved; according to the relevant data storage credential, the first generation credential is retrieved; according to the first generation credential, the second generation credential and the verification credential, the caller's identity is authenticated; when the identity authentication is successful, the relevant data related to the clinical data requested by the caller is retrieved.

[0093] In the above implementation, during the data retrieval process, the identity of the person who retrieves the data is verified to ensure that only authorized users can access the relevant data related to the clinical data. The specific process includes retrieving the verification credentials stored in the blockchain, and retrieving the storage credentials and generation credentials associated with the verification credentials in turn, and finally performing identity authentication through these credentials. Obviously, this implementation can ensure that only authorized users can access specific clinical data. By verifying the identity of the person who retrieves the data, unauthorized persons are prevented from accessing sensitive clinical information and protecting patient privacy. The implementation method combines identity authentication and data verification, and gradually completes the verification by retrieving different credentials (first generation credentials, second generation credentials and verification credentials). This multi-level verification ensures that the data at each link is verified, further improving data security. In general, step S16 has four layers of verification - the first layer of verification: verification of the retrieval of the credential storage block, the verification credential storage block is an unalterable record on the blockchain, after retrieving this credential, it can be confirmed that the credential has not been maliciously modified at any time point after storage, this layer of verification provides a starting point guarantee for the retrieval process; the second layer of verification: the retrieval of the storage credential and the second generated credential, the verification credential records the second generated credential and related data, that is, records the data and the storage location or index of the data, this layer of verification verifies the correctness of the storage path; the third layer of verification: the retrieval of the first generated credential, the first generated credential is a hash value generated after the original clinical data is collected, which is used to identify the uniqueness of the data. By retrieving and verifying the first generated credential, the system can confirm that the retrieved data content is consistent with the stored data and has not been tampered with; the final verification: the combination of credentials for identity authentication, after all credentials are verified, the system verifies the identity of the caller through the combination of the first generated credential, the second generated credential and the verification credential, ensuring that only authorized callers can access the data, even if the data has not been tampered with, if the identity of the caller is unauthorized, the data cannot be accessed. Verifying identity through a combination of credentials increases the stringency of access control.

[0094] The following describes the working process of the present invention by taking a relatively common scenario as an example. The working process is as follows:

[0095] A doctor in a medical institution needs to access a patient's medical records, but the medical records involve sensitive clinical data and are stored in a blockchain-based distributed system.

[0096] First, the system collects relevant data from the patient's medical record information, such as the patient's name, age, medical record number, medical records, etc. These clinical data are converted into a computer-readable format and a unique hash value is generated through hash calculation, which is called the first generated credential. The system stores the processed data in a storage space, such as cloud storage or a distributed database, and generates a storage index for this data. Based on the storage index, the system generates a second generated credential through a hash algorithm to identify the storage location. Then, the system performs a hash calculation on the data and the first generated credential to generate relevant data storage credentials to ensure that the data has not been tampered with.

[0097] In one embodiment, the system further performs a hash calculation on the relevant data storage credentials and the second generated credentials to generate a verification credential to ensure the security and integrity of the data retrieval process. The verification credential is stored in the blockchain node, and the immutability of the blockchain is used to ensure the security and traceability of the credential.

[0098] In another implementation, the doctor submits a data retrieval request through the system, including his / her identity information and a specific request for the medical data to be retrieved. After receiving the data retrieval request from the retriever, the system extracts the doctor's identity information (such as ID number, name, etc.) and the medical data related to the request. The system merges the doctor's identity information with the corresponding medical data to generate a new data set. The system performs a hash calculation on the uploaded data set to generate a new verification credential. This new verification credential will be compared with the original verification credential stored in the blockchain in subsequent retrievals to ensure the consistency between the retriever's identity and the requested data.

[0099] When a doctor applies to retrieve a patient's medical records, the system will first retrieve the verification credential storage block stored in the blockchain. The system will retrieve the relevant data storage credentials and the second generated credentials in turn, and compare these credentials to confirm the identity of the person who retrieves the data and the integrity of the data. Finally, the system verifies the identity of the person who retrieves the data to ensure that the doctor has access rights. If successful, the system will retrieve the patient's medical records and provide them to the doctor for use.

[0100] In summary, the present invention provides a clinical data privacy protection method based on blockchain, including: obtaining relevant data of clinical data, converting it into computer-readable data, and obtaining a first generation credential; storing the relevant data in a storage space, obtaining a storage index, and generating a second generation credential based on the storage index; performing a hash calculation based on the relevant data and the first generation credential to obtain a relevant data storage credential; calculating the Kendall rank correlation coefficient based on the second generation credential and the relevant data storage credential, and performing an encryption operation based on the calculation result; storing the verification credential in a storage space to obtain a verification credential storage block, and uploading the verification credential storage block to a blockchain node; performing identity authentication on the caller based on the first generation credential, the second generation credential, and the verification credential, and when the identity authentication is passed, retrieving the relevant data related to the clinical data requested by the caller.

[0101] In the present invention, the method can store relevant data of clinical data, convert the relevant data into computer-readable data, generate a first generation credential and a second generation credential according to the computer-readable data, and generate a verification credential through the association relationship between the storage index and the associated data. There is a mapping relationship between the storage index and the verification credential storage block. When the caller requests to retrieve the relevant data, the verification is performed through the association relationship between the verification credential stored in the blockchain and the associated data corresponding to the verification credential. When retrieving data, the identity of the data caller, the data acquisition path and the integrity of the data can be verified, thereby ensuring the confidentiality of the data during the data sharing process and ensuring the security of the authorized data by utilizing the tamper-proof nature of the blockchain.

[0102] Reference Figure 2 The second embodiment of the present invention provides a clinical data privacy protection system based on blockchain, including:

[0103] A data acquisition module, used to acquire relevant data of clinical data, convert it into computer-readable data, and obtain a first generated certificate;

[0104] A data storage module, used to store the relevant data in a storage space, obtain a storage index, and generate a second generation credential according to the storage index;

[0105] A storage credential generation module, configured to perform a hash calculation based on the relevant data and the first generated credential to obtain a relevant data storage credential;

[0106] A verification credential generation module, used for calculating the Kendall rank correlation coefficient according to the second generation credential and the relevant data storage credential, and performing an encryption operation according to the calculation result;

[0107] A credential uploading module, used to store the verification credential in a storage space, obtain a verification credential storage block, and upload the verification credential storage block to a blockchain node;

[0108] The identity authentication module is used to authenticate the identity of the caller based on the first generated credential, the second generated credential and the verification credential, and when the identity authentication is passed, retrieve the relevant data related to the clinical data requested by the caller.

[0109] In an optional implementation, the storage credential generation module is specifically used to:

[0110] A hash calculation is performed according to the relevant data and the first generated credential using the SHA 256 algorithm to obtain hash value data of the relevant data, and the hash value data is used as the relevant data storage credential.

[0111] In an optional implementation, the identity verification module is specifically used to: obtain a request for a call from a caller;

[0112] Retrieving the verification credential storage block according to the application retrieval request;

[0113] According to the verification credential storage block, retrieving the relevant data storage credential and the second generated credential;

[0114] Retrieving the first generated credential based on the relevant data storage credential;

[0115] authenticating the caller according to the first generated credential, the second generated credential, and the verification credential;

[0116] When the identity authentication is passed, the relevant data related to the clinical data requested by the caller is retrieved.

[0117] It should be noted that the blockchain-based clinical data privacy protection system provided in an embodiment of the present invention is used to execute all the process steps of the blockchain-based clinical data privacy protection method in the above embodiment. The working principles and beneficial effects of the two correspond one to one, so they will not be repeated here.

[0118] The embodiment of the present invention also provides an electronic device. The electronic device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a clinical data privacy protection program based on blockchain. When the processor executes the computer program, the steps in the above-mentioned clinical data privacy protection method embodiments based on blockchain are implemented, such as Figure 1Alternatively, when the processor executes the computer program, the functions of the modules / units in the above-mentioned system embodiments are realized, such as the identity authentication module.

[0119] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the electronic device.

[0120] The electronic device may be a computing device such as a desktop computer, a notebook, a PDA, and a smart tablet. The electronic device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the above components are merely examples of electronic devices and do not constitute a limitation on the electronic device. The electronic device may include more or fewer components than the above components, or may combine certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0121] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the electronic device, and uses various interfaces and lines to connect various parts of the entire electronic device.

[0122] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the electronic device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0123] Wherein, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or system capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0124] It should be noted that the system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the system embodiment provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0125] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A clinical data privacy protection method based on blockchain, characterized in that: include: Obtaining relevant data of clinical data, converting it into computer-readable data, and obtaining a first generated certificate; Storing the relevant data in a storage space to obtain a storage index, and generating a second generation credential according to the storage index; Performing a hash calculation based on the relevant data and the first generated credential to obtain a relevant data storage credential; Calculate the Kendall rank correlation coefficient based on the second generated credential and the related data storage credential, and perform encryption operation based on the calculation result to obtain a verification credential; The verification credential is stored in a storage space to obtain a verification credential storage block, and the verification credential storage block is uploaded to a blockchain node; Performing identity authentication on the caller according to the first generated credential, the second generated credential and the verification credential, and when the identity authentication is passed, retrieving the relevant data related to the clinical data requested by the caller; The step of calculating the Kendall rank correlation coefficient according to the second generated credential and the relevant data storage credential, and performing encryption operation according to the calculation result to obtain the verification credential includes: assigning a grade to each data point in the second generated credential and the associated data storage credential, respectively, and determining a ranking of the data points based on the assigned grades; Determining, according to the data point ranking, the number of consistent data pairs, the number of inconsistent data pairs, and the number of data pairs with a ranking tie of data points in the second generated voucher and the relevant data storage voucher; The Kendall rank correlation coefficient is calculated according to the number of consistent data pairs, the number of inconsistent data pairs and the number of tied-rank data pairs; Generating a verification credential based on the Kendall rank correlation coefficient and an asymmetric encryption operation; The Kendall rank correlation coefficient is calculated by the following formula: In the formula, is the Kendall rank correlation coefficient, is the number of consistent data pairs, is the number of inconsistent data pairs, is the number of ranked and parallel data pairs in the second generated voucher, Stores the number of ranked and tied data pairs in the relevant data voucher.

2. The clinical data privacy protection method based on blockchain according to claim 1 is characterized in that: The relevant data includes data retriever information, information data and associated data.

3. The clinical data privacy protection method based on blockchain according to claim 2 is characterized in that: The information data includes the patient's name, age, gender, address, date of birth, social security, surgery name, surgery time, and surgeon; The data retriever information includes ID number, name and ID identification code; The associated data includes storage information of medical records, diagnosis and treatment information of medical records, laboratory examination information, physician information, and patient status information.

4. The clinical data privacy protection method based on blockchain according to claim 3 is characterized in that: The storage information of the medical record includes the hospital name, department information, medical record number, and the start time of medical record storage; The diagnosis and treatment information includes the name of the operation, the time of the operation, and the surgeon in charge of the operation; The experimental inspection information includes inspection content and inspection results; The physician information includes the physician's name, physician ID, professional title, and hospital information; The patient status information includes the patient's medical results, medication, nursing, follow-up examination items, follow-up date, operation name, operation time, and surgeon.

5. The clinical data privacy protection method based on blockchain according to claim 1 is characterized in that: The step of performing a hash calculation based on the relevant data and the first generated credential to obtain a relevant data storage credential is specifically: A hash calculation is performed according to the relevant data and the first generated credential using the SHA 256 algorithm to obtain hash value data of the relevant data, and the hash value data is used as the relevant data storage credential.

6. The clinical data privacy protection method based on blockchain according to claim 1 is characterized in that: The identity verification of the caller is performed according to the first generated credential, the second generated credential and the verification credential, and when the identity verification is passed, the relevant data related to the clinical data requested by the caller is retrieved, specifically: Obtain the retrieval request from the retrieval person; Retrieving the verification credential storage block according to the application retrieval request; According to the verification credential storage block, retrieving the relevant data storage credential and the second generated credential; Retrieving the first generated credential based on the relevant data storage credential; authenticating the caller according to the first generated credential, the second generated credential, and the verification credential; When the identity authentication is passed, the relevant data related to the clinical data requested by the caller is retrieved.

7. A clinical data privacy protection system based on blockchain, characterized in that: include: A data acquisition module, used to acquire relevant data of clinical data, convert it into computer-readable data, and obtain a first generated certificate; A data storage module, used to store the relevant data in a storage space, obtain a storage index, and generate a second generation credential according to the storage index; A storage credential generation module, configured to perform a hash calculation based on the relevant data and the first generated credential to obtain a relevant data storage credential; A verification credential generation module, used to calculate the Kendall rank correlation coefficient according to the second generation credential and the relevant data storage credential, and perform encryption operation according to the calculation result to obtain a verification credential; A credential uploading module, used to store the verification credential in a storage space, obtain a verification credential storage block, and upload the verification credential storage block to a blockchain node; An identity authentication module, used for authenticating the caller according to the first generated credential, the second generated credential and the verification credential, and when the identity authentication is passed, retrieving the relevant data related to the clinical data requested by the caller; The step of calculating the Kendall rank correlation coefficient according to the second generated credential and the relevant data storage credential, and performing encryption operation according to the calculation result to obtain the verification credential includes: assigning a grade to each data point in the second generated credential and the associated data storage credential, respectively, and determining a ranking of the data points based on the assigned grades; Determining, according to the data point ranking, the number of consistent data pairs, the number of inconsistent data pairs, and the number of data pairs with a ranking tie of data points in the second generated voucher and the relevant data storage voucher; The Kendall rank correlation coefficient is calculated according to the number of consistent data pairs, the number of inconsistent data pairs and the number of tied-rank data pairs; Generating a verification credential based on the Kendall rank correlation coefficient and an asymmetric encryption operation; The Kendall rank correlation coefficient is calculated by the following formula: In the formula, is the Kendall rank correlation coefficient, is the number of consistent data pairs, is the number of inconsistent data pairs, is the number of ranked and parallel data pairs in the second generated voucher, Stores the number of ranked and tied data pairs in the relevant data voucher.

8. An electronic device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the clinical data privacy protection method based on blockchain as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the blockchain-based clinical data privacy protection method as described in any one of claims 1 to 6.

Images