Medical data analysis system based on cloud computing

Abstract

A cloud computing-based medical data analysis system disclosed by the present invention comprises a management design module, an analysis processing module and a data control module, the management design module is in network connection with the analysis processing module, and the analysis processing module is in network connection with the data control module. The management design module is used for carrying out management design on the medical data system, the analysis processing module is used for carrying out optimization analysis processing on the medical data system, and the data control module is used for carrying out control management on data information. The management design module comprises a scheme composition module, an operation processing module and an architecture design module, the scheme composition module is electrically connected with the operation processing module, the operation processing module is in network connection with the architecture design module, and the scheme composition module is used for performing composition management of a medical data analysis management and control scheme. The system has the characteristics of high safety and intelligent management and analysis.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis, and in particular to a medical data analysis system based on cloud computing. Background Art

[0002] The development of science and technology has promoted the continuous progress of health information technology (HIT). Emerging technologies represented by big data, artificial intelligence, 5G, and blockchain have added new impetus to the development of medical health. However, with the development of HIT, the scale of domestic medical data has grown rapidly. At the same time, electronic health records contain all the health data of patients, such as diagnostic information, medication information, test reports, etc., and are therefore widely used by medical institutions. At present, electronic medical records are stored in the internal servers of medical institutions and are only managed by internal full-time personnel, which has caused the following problems. On the one hand, the electronic medical record data between different medical institutions are not interoperable, which has caused the data island effect. Patients need to carry multiple electronic health records when undergoing cross-medical institution diagnosis and treatment, which brings inconvenience to patients. On the other hand, some internal personnel of medical institutions use electronic medical records without the patient's consent, which may lead to the leakage of patient privacy such as allergy history and genetic disease history. In addition, electronic health record data is also very likely to become the target of malicious attacks by criminals because of its high commercial value. Therefore, it is necessary to design a cloud computing-based medical data analysis system with high security and intelligent management and analysis. Summary of the invention

[0003] The purpose of the present invention is to provide a medical data analysis system based on cloud computing to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: a medical data analysis system based on cloud computing, comprising: a management design module, an analysis and processing module and a data control module, the management design module and the analysis and processing module are connected to the network, the analysis and processing module and the data control module are connected to the network, the management design module is used to perform management design of the medical data system, the analysis and processing module is used to perform optimization analysis and processing of the medical data system, and the data control module is used to control and manage data information.

[0005] According to the above technical solution, the management design module includes a solution composition module, an operation processing module and an architecture design module. The solution composition module is electrically connected to the operation processing module, and the operation processing module is network-connected to the architecture design module. The solution composition module is used to perform composition management of the medical data analysis and control solution, the operation processing module is used to perform operation processing of the medical data system, and the architecture design module is used to perform institutional design and management of the medical data system.

[0006] According to the above technical solution, the analysis and processing module includes an execution management module, a blockchain processing module and a data sharing module. The execution management module is network-connected to the blockchain processing module, and the blockchain processing module is network-connected to the data sharing module. The execution management module is used to perform system process execution control management, the blockchain processing module is used to perform blockchain processing of the medical data system, and the data sharing module is used to perform sharing control of medical data.

[0007] According to the above technical solution, the data control module includes an upload and download module and a statistical transmission module, the upload and download module and the statistical transmission module are connected to the network, the upload and download module is used to manage the upload and download of data information, and the statistical transmission module is used to perform statistical transmission control of data information.

[0008] According to the above technical solution, the operation method of the medical data analysis system based on cloud computing includes the following steps:

[0009] Step S1: during the process of medical data analysis and processing, the composition and operation control processing of the medical data management and control plan are performed;

[0010] Step S2: After completing the composition and operation control processing of the medical data management and control plan, the architecture design and management of the medical data system are carried out;

[0011] Step S3: further analyzing and optimizing the medical data system;

[0012] Step S4: Manage and control the data upload and download and feedback data information of the medical data system.

[0013] According to the above technical solution, step S1 further includes the following steps:

[0014] Step S11: Design and manage the medical data management and control plan, which includes the following five roles: alliance chain, data owner (Data Owner, DO), peer-to-peer hypermedia protocol (IPFS), cloud service provider (Cloud Server Provider, CSP), data user (Data User, DU), where the alliance chain is composed of corresponding institutions including regulatory departments and scientific research departments, responsible for generating and managing system master keys and user private keys. In addition, it is also responsible for allocating outsourced decryption and retrieval tasks, and recording all user operations on the chain. The data owner is the owner of the medical data, which can be patients, doctors and medical institutions. The data user is the data user in the system, which can be doctors in other hospitals and staff of the regulatory department. If the access key (access control policy set) of the DU meets the attributes set by the patient, the patient's data can be obtained, and the DU can also use the searchable encryption trapdoor to realize ciphertext retrieval on the cloud service;

[0015] Step S12: In the designed medical data management and control solution, all nodes on the alliance chain execute the generated global public key PK and master key MK, and the master key MK is generated by the alliance chain node through the smart contract executing the PSS secret sharing protocol. Other nodes cannot know the exact value of the master key, and the patient to whom the medical data belongs can choose a suitable set of keywords for his personal privacy data according to his own wishes. Then, the original data is encrypted using the set algorithm, and the ciphertext file is uploaded to IPFS to obtain the hash address of the file. Then, the ciphertext is obtained and a ciphertext index is generated. The ciphertext and index are further submitted to the blockchain to record one's own operations, which is convenient for subsequent ciphertext retrieval.

[0016] According to the above technical solution, step S2 further includes the following steps:

[0017] The medical data system is further designed and processed. The system architecture includes data center servers and cloud services. The data center server refers to the internal server of the medical institution. After the data generated by the patient or the testing machine is symmetrically encrypted, the data will be uploaded to the data center server for storage. The cloud service can be provided by a third party or built by medical institutions themselves.

[0018] According to the above technical solution, step S3 further includes the following steps:

[0019] Step S31: In the medical data system, define G1 and G2 as p-order multiplication groups, g as the generator of G1, and p as a random prime number. Then, use G1 and G2 as global public parameters of the system to further generate the user's public key pair and private key pair, which are SK d With PK d , so that the system randomly generates a random number sd , and calculate Y d =s d g, the private key in the system is SK d =s d , the public key is PK d =Y d To ensure that private medical data can only be searched in the specified cloud service, repeat the steps in this step to generate a public-private key pair SK for the cloud service. c With PK c , where SK c =s c , PK c =s c g. Finally, the public keys of all medical data system users and the global public parameters of the system are forwarded;

[0020] Step S32: After receiving the corresponding encryption file public and private key data pair generated and processed by the system, the corresponding ciphertext index (I1, I2) is set for the medical file to be encrypted, where I1 = (SK d , gx)(gr j , S.K. d PK c ), I2=(gr j ), where r j The j random numbers generated by the data center server are used to generate corresponding ciphertext indexes for each medical data file that needs to be encrypted. When other medical institution personnel want to retrieve encrypted files, they first need to apply to the owner of the encrypted file data. After the application is verified, the user's private key data is fed back. Based on the private key data and public key data fed back by the user, the corresponding index of the encrypted medical file is obtained to retrieve and check the encrypted file.

[0021] Step S33: During the medical data sharing process, symmetric encryption and attribute encryption are combined to ensure the security of the patient's privacy data. Specifically, symmetric encryption is used to directly encrypt the user's original data to obtain symmetric encrypted ciphertext, and the encrypted ciphertext is directly uploaded to IPFS. The blockchain and the set relational database only store the IPFS address of the ciphertext, while attribute encryption acts on the symmetric encryption key;

[0022] According to the above technical solution, step S4 further includes the following steps:

[0023] Step S41: Control and manage the upload and download of medical data in the system. The medical data upload page is used by the medical data owner to specify the attribute requirements of the uploaded medical data and searchable encryption keywords. The uploaded medical data supports text type data and binary data. The medical data download interface is a display interface of the ciphertext database, which displays all the shared data in the current shared network. The user can select the specified medical data to download;

[0024] Step S42: After receiving the statistical information indicating that the medical data has been maliciously tampered with, it is transmitted to the staff for corresponding control and management.

[0025] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention, by providing a management design module, an analysis and processing module and a data control module, effectively improves the access and retrieval security of medical encrypted data files, so that the corresponding data owner can open and allow the corresponding medical data file retrieval according to his own wishes, and effectively avoids the use of electronic medical records by internal personnel of medical institutions without the patient's consent, thereby causing the leakage of patient privacy such as allergy history and genetic disease history, and further indirectly improves the access and retrieval security of medical encrypted files, avoiding malicious access attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0027] Figure 1 It is a schematic diagram of the system module composition of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] See also Figure 1 The present invention provides a technical solution: a medical data analysis system based on cloud computing, including: a management design module, an analysis and processing module and a data control module, the management design module and the analysis and processing module are connected to the network, the analysis and processing module and the data control module are connected to the network, the management design module is used to perform management design of the medical data system, the analysis and processing module is used to perform optimization analysis and processing of the medical data system, and the data control module is used to control and manage data information.

[0030] The management design module includes a solution composition module, an operation processing module and an architecture design module. The solution composition module is electrically connected to the operation processing module, and the operation processing module is network connected to the architecture design module. The solution composition module is used for composition management of the medical data analysis and control solution, the operation processing module is used for operation processing of the medical data system, and the architecture design module is used for institutional design and management of the medical data system.

[0031] The analysis and processing module includes an execution management module, a blockchain processing module and a data sharing module. The execution management module is connected to the blockchain processing module through a network, and the blockchain processing module is connected to the data sharing module through a network. The execution management module is used to perform process execution control management of the system, the blockchain processing module is used to perform blockchain processing of the medical data system, and the data sharing module is used to perform sharing control of medical data.

[0032] The data control module includes an upload and download module and a statistical transmission module. The upload and download module and the statistical transmission module are connected to the network. The upload and download module is used to manage the upload and download of data information, and the statistical transmission module is used to control the statistical transmission of data information.

[0033] A method for operating a medical data analysis system based on cloud computing comprises the following steps:

[0034] Step S1: during the process of medical data analysis and processing, the composition and operation control processing of the medical data management and control plan are performed;

[0035] Step S2: After completing the composition and operation control processing of the medical data management and control plan, the architecture design and management of the medical data system are carried out;

[0036] Step S3: further analyzing and optimizing the medical data system;

[0037] Step S4: Manage and control the data upload and download and feedback data information of the medical data system.

[0038] Step S1 further comprises the following steps:

[0039] Step S11: Design and manage the medical data control plan, including the following five roles: alliance chain, data owner (DO), peer-to-peer hypermedia protocol (IPFS), cloud service provider (CSP), data user (CSP), and data management system. In this step, the alliance chain is composed of corresponding institutions including regulatory departments and scientific research departments, which is responsible for generating and managing system master keys and user private keys. In addition, it is also responsible for allocating outsourced decryption and retrieval tasks, and recording all user operations on the chain. The data owner is the medical data owner, which can be patients, doctors and medical institutions. The data user is the data user in the system, which can be doctors in other hospitals and staff of regulatory departments. If the access key (access control policy set) of DU meets the attributes set by the patient, the patient's data can be obtained, and DU can also use searchable encryption trapdoors to realize ciphertext retrieval on cloud services; in this step, CSP is a cloud service provider, which can be a third-party cloud service provider. It is responsible for executing the ciphertext retrieval and pre-decryption tasks assigned by the alliance chain, and executing the tasks submitted by the alliance chain and returning the correct results. At the same time, it saves the intermediate parameters of each retrieval and pre-decryption process, and mines out information that meets the set requirements. IPFS is jointly built by multiple medical institutions and is a distributed storage service similar to blockchain. IPFS avoids single point failures associated with centralized storage;

[0040] Step S12: In the designed medical data management and control scheme, all nodes on the alliance chain execute the generated global public key PK and master key MK, and the master key MK is generated by the alliance chain node through the smart contract executing the PSS secret sharing protocol. Other nodes cannot know the exact value of the master key, and the patient to whom the medical data belongs can choose a suitable keyword set for his personal privacy data according to his own wishes. Then, after the original data is encrypted using the set algorithm, the ciphertext file is uploaded to IPFS to obtain the hash address of the file. Specifically, the user encrypts the medical data file to be uploaded to obtain the ciphertext, and compares the encrypted file and the keyword set {kw1, kw2, ..., kw n}, generate the ciphertext index Index, and upload it to the cloud server together with the encrypted ciphertext, and perform a search on the submitted search keywords {kw1, kw2, ..., kw n}, generate the corresponding search trap Td, the cloud server matches the received Td and Index, and returns the corresponding ciphertext if the match is successful. After receiving the ciphertext from the cloud server, the master key MK is used to decrypt it to obtain the original file, and then the ciphertext is executed and the ciphertext index is generated, and the ciphertext and index are further submitted to the blockchain to record their own operations, which is convenient for subsequent ciphertext retrieval.

[0041] Step S2 further comprises the following steps:

[0042] The medical data system is further designed and processed. The system architecture includes data center servers and cloud services. The data center server refers to the internal server of the medical institution. After the data generated by the patient or the inspection machine is symmetrically encrypted, the data will be uploaded to the data center server for storage. The cloud service can be provided by a third party or built by the medical institution itself. In the current system, cloud services are considered to always provide services to the outside world and have unlimited computing power and storage capacity. In the current solution, the data center is not responsible for long-term data storage, but only for storing the data to a set scale, and then interacting with the alliance chain to upload data. In addition to patients, there are many inspection and examination equipment in the medical system, and the data they generate also needs to be stored. If these devices are allowed to interact directly with the blockchain, it will bring a communication burden to the blockchain network. Therefore, through this step, the operation stability and efficiency of the medical data system can be effectively improved, and the system failure caused by the overload of the system can be avoided.

[0043] Step S3 further comprises the following steps:

[0044] Step S31: In the medical data system, define G1 and G2 as p-order multiplication groups, g as the generator of G1, and p as a random prime number. Then, use G1 and G2 as global public parameters of the system to further generate the user's public key pair and private key pair, which are SK d With PK d , so that the system randomly generates a random number s d , and calculate Y d =s d g, the private key in the system is SK d =s d , the public key is PK d =Y d To ensure that private medical data can only be searched in the specified cloud service, repeat the steps in this step to generate a public-private key pair SK for the cloud service. c With PK c , where SK c =s c , PK c =s c g. Finally, the public keys of all medical data system users and the global public parameters of the system are forwarded;

[0045] Step S32: After receiving the corresponding encryption file public and private key data pair generated and processed by the system, the corresponding ciphertext index (I1, I2) is set for the medical file to be encrypted, where I1 = (SK d , gx)(gr j, S.K. d PK c ), I2=(gr j ), where r j The j random numbers generated by the data center server are processed to generate a corresponding ciphertext index for each medical data file that needs to be encrypted. When other medical institution personnel want to retrieve the encrypted file, they first need to apply to the owner of the encrypted file data. After the application is verified, the user's private key data is fed back. According to the private key data and public key data fed back by the user, the corresponding index of the encrypted medical file is obtained to retrieve and consult the encrypted file; in this step, a public-private key pair is generated for the encrypted medical file data information, all public keys will be placed in the corresponding public space for all users to query, and the private key will be saved by the owner of the encrypted medical file data himself. The selected searchable encryption process is executed to generate a corresponding ciphertext index for the encrypted file, which effectively improves the access and retrieval security of the medical encrypted data file, so that the corresponding data owner can perform the corresponding medical data file retrieval according to his own wishes. Open permission, and effectively avoid the use of electronic medical records by internal personnel of medical institutions without the consent of the patient, thereby causing the leakage of patient privacy such as allergy history and genetic disease history, and further indirectly improves the access and retrieval security of medical encrypted files, avoiding malicious access attacks;

[0046] Step S33: During the medical data sharing process, a combination of symmetric encryption and attribute encryption is used to ensure the security of the patient's privacy data. Specifically, symmetric encryption is used to directly encrypt the user's original data to obtain a symmetric encrypted ciphertext. The encrypted ciphertext is directly uploaded to IPFS. The blockchain and the set relational database only store the IPFS address of the ciphertext, while attribute encryption acts on the symmetric encryption key. Through this step, the complexity of the attribute encrypted ciphertext can be effectively reduced, and the space occupied by the attribute encrypted ciphertext storage can be reduced.

[0047] Step S4 further comprises the following steps:

[0048] Step S41: Control and manage the upload and download of medical data in the system. The medical data upload page is used by the medical data owner to specify the attribute requirements of the uploaded medical data and searchable encryption keywords. The uploaded medical data supports text type data and binary data. The medical data download interface is a display interface of the ciphertext database, which displays all the shared data in the current shared network. The user can select the specified medical data to download;

[0049] Step S42: After receiving the statistical information indicating that the medical data has been maliciously tampered with, it is transmitted to the staff for corresponding control and management.

[0050] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0051] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A medical data analysis system based on cloud computing, comprising: A management design module, an analysis and processing module and a data control module, characterized in that: the management design module and the analysis and processing module are connected to the network, the analysis and processing module and the data control module are connected to the network, the management design module is used to perform management design of the medical data system, the analysis and processing module is used to perform optimization analysis and processing of the medical data system, and the data control module is used to perform control and management of data information.

2. The cloud computing-based medical data analysis system according to claim 1, characterized in that: The management design module includes a solution composition module, an operation processing module and an architecture design module. The solution composition module is electrically connected to the operation processing module, and the operation processing module is network-connected to the architecture design module. The solution composition module is used to perform composition management of the medical data analysis and control solution, the operation processing module is used to perform operation processing of the medical data system, and the architecture design module is used to perform institutional design and management of the medical data system.

3. The cloud computing-based medical data analysis system according to claim 1, characterized in that: The analysis and processing module includes an execution management module, a blockchain processing module and a data sharing module. The execution management module is network-connected to the blockchain processing module, and the blockchain processing module is network-connected to the data sharing module. The execution management module is used to perform system process execution control management, the blockchain processing module is used to perform blockchain processing of the medical data system, and the data sharing module is used to perform sharing control of medical data.

4. The cloud computing-based medical data analysis system according to claim 1, characterized in that: The data control module includes an upload and download module and a statistical transmission module. The upload and download module is connected to the statistical transmission module through a network. The upload and download module is used to manage the upload and download of data information, and the statistical transmission module is used to control the statistical transmission of data information.

5. The cloud computing-based medical data analysis system according to claim 1, characterized in that: The method for operating the medical data analysis system based on cloud computing comprises the following steps: Step S1: during the process of medical data analysis and processing, the composition and operation control processing of the medical data management and control plan are performed; Step S2: After completing the composition and operation control processing of the medical data management and control plan, the architecture design and management of the medical data system are carried out; Step S3: further analyzing and optimizing the medical data system; Step S4: Manage and control the data upload and download and feedback data information of the medical data system.

6. The cloud computing-based medical data analysis system according to claim 5, characterized in that: The step S1 further comprises the following steps: Step S11: Design and manage the medical data management and control plan, which includes the following five roles: alliance chain, data owner (DO), peer-to-peer hypermedia protocol (IPFS), cloud service provider (CSP), and data user (DU). The alliance chain is composed of corresponding institutions including regulatory departments and scientific research departments, and is responsible for generating and managing system master keys and user private keys. In addition, it is also responsible for allocating outsourced decryption and retrieval tasks, and recording all user operations on the chain. The data owner is the owner of the medical data, which can be patients, doctors, and medical institutions. The data user is the data user in the system, which can be doctors in other hospitals and staff of regulatory departments. If the access key (access control policy set) of the DU meets the attributes set by the patient, the patient's data can be obtained, and the DU can also use the searchable encryption trapdoor to realize ciphertext retrieval on the cloud service; Step S12: In the designed medical data management and control solution, all nodes on the alliance chain execute the generated global public key PK and master key MK, and the master key MK is generated by the alliance chain node through the smart contract executing the PSS secret sharing protocol. Other nodes cannot know the exact value of the master key, and the patient to whom the medical data belongs can choose a suitable set of keywords for his personal privacy data according to his own wishes. Then, the original data is encrypted using the set algorithm, and the ciphertext file is uploaded to IPFS to obtain the hash address of the file. Then, the ciphertext is obtained and a ciphertext index is generated. The ciphertext and index are further submitted to the blockchain to record one's own operations, which is convenient for subsequent ciphertext retrieval.

7. The cloud computing-based medical data analysis system according to claim 5, characterized in that: The step S2 further comprises the following steps: The medical data system is further designed and processed. The system architecture includes data center servers and cloud services. The data center server refers to the internal server of the medical institution. After the data generated by the patient or the testing machine is symmetrically encrypted, the data will be uploaded to the data center server for storage. The cloud service can be provided by a third party or built by medical institutions themselves.

8. The cloud computing-based medical data analysis system according to claim 5, characterized in that: The step S3 further comprises the following steps: Step S31: In the medical data system, define G1 and G2 as p-order multiplication groups, g as the generator of G1, and p as a random prime number. Then, use G1 and G2 as global public parameters of the system to further generate the user's public key pair and private key pair, which are SK d With PK d , so that the system randomly generates a random number s d , and calculate Y d =s d g, the private key in the system is SK d =s d , the public key is PK d =Y d To ensure that private medical data can only be searched in the specified cloud service, repeat the steps in this step to generate a public-private key pair SK for the cloud service. c With PK c , where SK c =s c , PK c =s c g. Finally, the public keys of all medical data system users and the global public parameters of the system are forwarded; Step S32: After receiving the corresponding encryption file public and private key data pair generated and processed by the system, the corresponding ciphertext index (I1, I2) is set for the medical file to be encrypted, where I1 = (SK d , gx)(gr j , S.K. d PK c ), I2=(gr j ), where r j The j random numbers generated by the data center server are used to generate corresponding ciphertext indexes for each medical data file that needs to be encrypted. When other medical institution personnel want to retrieve encrypted files, they first need to apply to the owner of the encrypted file data. After the application is verified, the user's private key data is fed back. Based on the private key data and public key data fed back by the user, the corresponding index of the encrypted medical file is obtained to retrieve and check the encrypted file. Step S33: During the medical data sharing process, a combination of symmetric encryption and attribute encryption is used to ensure the security of the patient's privacy data. Specifically, symmetric encryption is used to directly encrypt the user's original data to obtain a symmetric encrypted ciphertext. The encrypted ciphertext is directly uploaded to IPFS. The blockchain and the set relational database only store the IPFS address of the ciphertext, while attribute encryption acts on the symmetric encryption key.

9. The cloud computing-based medical data analysis system according to claim 5, characterized in that: The step S4 further comprises the following steps: Step S41: Control and manage the upload and download of medical data in the system. The medical data upload page is used by the medical data owner to specify the attribute requirements of the uploaded medical data and searchable encryption keywords. The uploaded medical data supports text type data and binary data. The medical data download interface is a display interface of the ciphertext database, which displays all the shared data in the current shared network. The user can select the specified medical data to download; Step S42: After receiving the statistical information indicating that the medical data has been maliciously tampered with, it is transmitted to the staff for corresponding control and management.

Images