Biosecurity data interconnection and intercommunication method and system based on hybrid encryption

Abstract

The invention discloses a biosecurity data interconnection and intercommunication method and system based on hybrid encryption. The method comprises the following steps: acquiring a minimum data set of biological safety monitoring of a patient; preprocessing the minimum data set to obtain a biological safety data packet; the biological safety data packet is encrypted to obtain an encryption result, and a secret key used for encryption is updated by adopting a dynamic management and regular alternation mechanism; integrating the encryption result, the hash value and the key information to obtain an integration result; and sending the integration result to a receiver, and performing verification, decryption and decompression by the receiver according to the integration result. By implementing the method provided by the invention, the security and privacy protection of the medical data in the collection, transmission and storage processes can be improved.

Description

Technical Field

[0001] The present invention relates to a data transmission method, and more specifically to a biosafety data interconnection method and system based on hybrid encryption. Background Art

[0002] With the rapid development of information technology, the medical industry has made significant progress in data interconnection and interoperability. However, in the process of collecting and sharing biosafety data, there are many challenges, especially in terms of data privacy and security. Such data often contain sensitive information of patients, such as infection history, clinical symptoms and laboratory results. Therefore, how to effectively protect this data and prevent leakage and abuse is an important issue that the medical information system needs to solve urgently.

[0003] At present, the commonly used security measures in medical data management mainly rely on basic encryption technology, but lack comprehensive solutions for complex data environments. The diversity of data and the integration of different information systems make the standardization and cleaning process particularly complicated, further increasing the difficulty of data processing. In addition, existing encryption technologies usually only use a single symmetric or asymmetric encryption method, failing to effectively combine the advantages of both, which leads to security risks in key management and data analysis. At the same time, traditional data analysis methods often require decryption when processing encrypted data, which may expose sensitive information and thus cause the risk of privacy leakage.

[0004] The current biosafety monitoring system is usually divided into three levels: national, regional, and regional hospital. Information sharing and data transmission between each level must ensure security and privacy. However, the existing data management system has the following problems: The information systems of hospitals in different regions are diverse and the data formats are not unified, which makes the integration and standardization process cumbersome and prone to inconsistencies and omissions.

[0005] Biosafety data contains sensitive patient information. Existing encryption technologies are often single and cannot take into account both secure data transmission and privacy protection, making them vulnerable to cyber attacks and data leaks.

[0006] Traditional analysis methods require data decryption, which may expose sensitive information and cannot support effective analysis when the data is encrypted.

[0007] There is a method for secure sharing of medical data based on blockchain, which uses the distributed characteristics of blockchain to build a medical data sharing system to solve the data storage problem of a large number of medical institutions across the country and realize data interconnection. This method stores complete medical data offline and uploads its hash value, patient signature, hospital signature, disease keywords and timestamp information as the first barrier to protect patient medical data from being leaked. At the same time, data sharing is achieved through the EIGamal encryption algorithm and the symmetric encryption algorithm to form a second protection barrier, which can significantly improve efficiency compared to the use of the EIGamal encryption algorithm alone. However, the existing blockchain-based medical data security sharing method has some defects, including the complexity of storage and processing, which may affect system performance, especially when the amount of data is large. In addition, although the data integrity protection is enhanced by hash values ​​and signatures, there is still a risk of privacy leakage when storing complete data offline. The consensus mechanism of the blockchain may also reduce data processing efficiency, especially in high concurrency situations. Although the EIGamal and symmetric encryption algorithms are used, the problem of secure transmission and management of keys has not been effectively solved, which may cause security risks in the process of data sharing.

[0008] Therefore, it is necessary to design a new method to improve the security and privacy protection of medical data during collection, transmission and storage. Summary of the invention

[0009] The purpose of the present invention is to overcome the defects of the prior art and provide a method and system for interconnecting biosafety data based on hybrid encryption.

[0010] To achieve the above-mentioned purpose, the present invention adopts the following technical solution: a method for interconnecting and communicating biosafety data based on hybrid encryption, comprising: Obtaining a minimum data set for patient biosafety monitoring; Preprocessing the minimum data set to obtain a biosafety data package; Encrypting the biosafety data packet to obtain an encryption result, wherein the encryption key is updated by adopting a dynamic management and regular rotation mechanism; Integrate the encryption result, hash value, and key information to obtain an integrated result; The integration result is sent to a receiver, and the receiver verifies, decrypts and decompresses the integration result.

[0011] Its further technical solution is: the minimum data set includes the patient's current and past medical treatment data information, and the medical treatment data information includes the patient's basic information and the medical treatment data generated during outpatient and hospitalization.

[0012] A further technical solution is: the preprocessing of the minimum data set to obtain a biosafety data package includes: Cleaning, standardizing and desensitizing the minimum data set to obtain a processing result; The processing results are integrated into a JSON file and compressed into a compressed file with a timestamp and a sequence number to obtain a biosafety data package.

[0013] A further technical solution is: encrypting the biosafety data packet to obtain an encryption result includes: The biosafety data packet is encrypted using a hash algorithm and a hybrid encryption technique to obtain an encryption result.

[0014] A further technical solution is: the biosafety data packet is encrypted using a hash algorithm and a hybrid encryption technology to obtain an encryption result, including: Generate dynamic symmetric AES keys; Asymmetrically encrypt the symmetric AES key using the recipient's public key to obtain key information; Performing hash calculation on the biosafety data packet using the SHA256 strong hash algorithm to obtain a hash value; The biosafety data packet is encrypted using a multi-round AES encryption technique combined with a symmetric AES key to obtain an encrypted file; The encrypted file is re-encrypted using chain encryption technology to obtain a re-encrypted result; The re-encryption result is processed using homomorphic encryption technology to obtain an encrypted result.

[0015] A further technical solution is: integrating the encryption result, hash value, and key information to obtain an integrated result includes: Combining the encryption result, the hash value and the key information into a data packet to obtain a target data packet; The target data packet is encoded using Base64 encoding to obtain an integration result.

[0016] A further technical solution is: sending the integration result to a receiving party, and the receiving party verifies, decrypts and decompresses the integration result, including: The integration result is sent to the receiver by using the TLS protocol, and the receiver extracts a hash value from the integration result and performs hash value verification; when the hash value verification passes, key information is extracted from the integration result and decrypted to obtain a symmetric AES key; the symmetric AES key is used to decrypt the file to obtain a biosafety data packet, the biosafety data packet is decompressed to obtain a JSON file containing a minimum data set, and the JSON file is stored.

[0017] A further technical solution is that the encryption key is updated by dynamic management and regular rotation mechanism, including: Set a validity period and a valid usage range for the encryption key, and set a rotation date, and update the encryption key based on the validity period, valid usage range, and rotation date.

[0018] The present invention also provides a biosafety data interconnection system based on hybrid encryption, comprising: A data acquisition unit, used to acquire a minimum data set for patient biosafety monitoring; A preprocessing unit, used for preprocessing the minimum data set to obtain a biosafety data packet; An encryption unit, used to encrypt the biosafety data packet to obtain an encryption result, wherein the encryption key is updated by a dynamic management and regular rotation mechanism; An integration unit, used to integrate the encryption result, the hash value, and the key information to obtain an integration result; The sending unit is used to send the integration result to the receiving party, and the receiving party verifies, decrypts and decompresses the integration result.

[0019] The present invention further provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor implements the above method when executing the computer program.

[0020] Compared with the prior art, the present invention has the following beneficial effects: the present invention generates a biosafety data packet by acquiring the minimum data set for patient biosafety monitoring and preprocessing it. The data packet is encrypted, the encryption key is updated using a dynamic management and regular rotation mechanism, and the encryption result, hash value and key information are integrated, and the integrated result is sent to the receiver, who then performs verification, decryption and decompression, thereby improving the security and privacy protection of medical data during collection, transmission and storage.

[0021] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0023] Figure 1 A schematic diagram of an application scenario of a biosafety data interconnection and intercommunication method based on hybrid encryption provided by an embodiment of the present invention; Figure 2 A schematic diagram of a flow chart of a biosafety data interconnection method based on hybrid encryption provided in an embodiment of the present invention; Figure 3 A schematic diagram of a sub-process of a method for interconnecting and communicating biosafety data based on hybrid encryption provided by an embodiment of the present invention; Figure 4 A schematic diagram of a sub-process of a method for interconnecting and communicating biosafety data based on hybrid encryption provided by an embodiment of the present invention; Figure 5 A schematic diagram of a sub-process of a method for interconnecting and communicating biosafety data based on hybrid encryption provided by an embodiment of the present invention; Figure 6 A schematic block diagram of a biosafety data interconnection and intercommunication system based on hybrid encryption provided by an embodiment of the present invention; Figure 7 A schematic block diagram of a pre-processing unit of a biosafety data interconnection and intercommunication system based on hybrid encryption provided in an embodiment of the present invention; Figure 8 A schematic block diagram of an encryption unit of a biosafety data interconnection and intercommunication system based on hybrid encryption provided in an embodiment of the present invention; Fig. 9 A schematic block diagram of an integration unit of a biosafety data interconnection system based on hybrid encryption provided in an embodiment of the present invention; Fig.10 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0026] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0027] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0028] See also Figure 1 and Figure 2 , Figure 1 A schematic diagram of an application scenario of a biosafety data interconnection and intercommunication method based on hybrid encryption provided in an embodiment of the present invention. Figure 2 A schematic flow chart of a method for interconnecting and communicating biosafety data based on hybrid encryption provided in an embodiment of the present invention. A method for interconnecting and communicating biosafety data based on hybrid encryption is applied to a server. The server can exchange data with other servers or terminals, one of which is a sender and the other is a receiver. First, the patient's minimum biosafety monitoring data set is obtained and preprocessed to generate a biosafety data packet. Then, the data packet is encrypted, the key is updated using a dynamic management and regular rotation mechanism, and the encryption result, hash value and key information are integrated. Then, the integrated result is sent to the receiver, who verifies, decrypts and decompresses it. Symmetric AES keys and hash algorithms are used in the encryption process to ensure data security. Finally, the key management mechanism ensures the validity and security of the encryption key, thereby improving the security and privacy protection of medical data during collection, transmission and storage.

[0029] Figure 2 FIG. 1 is a flow chart of a method for interconnecting and communicating biosafety data based on hybrid encryption provided by an embodiment of the present invention. Figure 2 As shown, the method includes the following steps S110 to S150.

[0030] S110. Obtain the minimum data set for patient biosafety monitoring.

[0031] In this embodiment, the minimum data set includes the patient's current and past medical treatment data information, and the medical treatment data information includes the patient's basic information and the medical treatment data generated during outpatient and hospitalization.

[0032] The basic information of patients includes data such as patient ID, age, gender, case identification ID, etc.; the outpatient treatment process data includes outpatient department, consultation time, outpatient diagnosis, outpatient test application, outpatient examination application, outpatient medical order, outpatient test results, outpatient examination results, etc.; the inpatient treatment process data includes patient clinical data information and patient inpatient treatment process data; patient clinical data information includes patient vital signs data (body temperature, pulse, respiratory rate, white blood cell concentration, etc.), surgery-related information, medication information, etc.; the inpatient treatment process data includes inpatient ward, inpatient bed, hospitalization time, transfer time, transfer department, inpatient diagnosis, inpatient test, inpatient examination, outpatient medical order, inpatient bacterial culture results, etc.

[0033] These minimum data sets are mainly obtained from the hospital's information system, which may include HIS (Hospital Information System), LIS (Laboratory Information Management System), RIS (Radiology Information System), EMR (Electronic Medical Record) system, PACS (Picture Archiving And Communication System) and other systems.

[0034] S120, preprocessing the minimum data set to obtain a biosafety data packet.

[0035] In this embodiment, the biosafety data package refers to a compressed file that has been pre-processed.

[0036] In one embodiment, see Figure 3 , the above-mentioned step S120 may include steps S121~S122.

[0037] S121. Clean, standardize and desensitize the minimum data set to obtain a processing result.

[0038] In this embodiment, the processing result refers to the result obtained after cleaning, standardization and desensitization of the minimum data set.

[0039] Specifically, check the raw data, filter out valid data, and delete redundant or irrelevant information. Remove invalid, repeated or erroneous information in the data. Improve data quality, ensure the accuracy of subsequent processing, and reduce the impact of data noise on analysis results.

[0040] Perform unified format conversion for data types such as dates and numbers, for example, unify the date format to YYYY-MM-DD. This facilitates subsequent data processing and analysis, improves system compatibility, and reduces errors caused by format differences.

[0041] Encrypt personal identification information (such as name, ID number) or replace it with an unrecognizable identifier. Ensure compliance with data protection regulations, reduce potential legal risks, and enhance patients' trust in data security.

[0042] S122. Integrate the processing results into a JSON file and compress it into a compressed file with a timestamp and a serial number to obtain a biosafety data package.

[0043] In this embodiment, the cleaned, standardized and desensitized data is organized into a JSON object in the form of a key-value pair. JSON is a lightweight data exchange format that is easy to read and parse and is widely used in network communications and API interfaces.

[0044] Compress the JSON file using a compression algorithm (such as ZIP), and add a timestamp and serial number to the file name to ensure the uniqueness and traceability of the file. Compressed files take up less storage space and improve data transmission efficiency. Timestamps and serial numbers help with version management and data tracking.

[0045] Through these two steps, the biosafety data package not only improves data quality and security, but also lays a solid foundation for subsequent data encryption and transmission. This preprocessing method can effectively protect patient privacy, ensure data accuracy and consistency, and greatly enhance the reliability and security of data interconnection.

[0046] S130. Encrypt the biosafety data packet to obtain an encryption result, wherein the encryption key is updated using a dynamic management and regular rotation mechanism.

[0047] In this embodiment, the encryption result refers to the result formed after encrypting the biosafety data packet.

[0048] Specifically, the biosafety data packet is encrypted using a hash algorithm and a hybrid encryption technique to obtain an encryption result.

[0049] In one embodiment, see Figure 4 , the above-mentioned step S130 may include steps S131~S136.

[0050] S131. Generate a dynamic symmetric AES key.

[0051] In this embodiment, during the encryption process, a dynamic symmetric AES key is first generated, which is used to encrypt the data packet to ensure data security and privacy protection during transmission.

[0052] Specifically, a new symmetric AES key is generated using a secure random number generator. Dynamically generated keys reduce the risk of keys being predicted or reused. They can be updated periodically as needed to improve security.

[0053] S132: Use the public key of the recipient to asymmetrically encrypt the symmetric AES key to obtain key information.

[0054] In this embodiment, the key information is actually an encrypted symmetric AES key, that is, a ciphertext.

[0055] Use the recipient's public key Asymmetric encryption is performed on the generated symmetric AES key to form a ciphertext . , this process ensures that only the recipient can decrypt the AES key and thus securely obtain the encrypted data.

[0056] S133. Use the SHA256 strong hash algorithm to perform hash calculation on the biosafety data packet to obtain a hash value.

[0057] In this embodiment, the SHA256 strong hash algorithm is used to perform hash calculation on the compressed file to generate a unique hash value. The hash value is used for subsequent integrity verification to ensure that the data has not been tampered with during transmission. The hash value can be used to quickly compare and verify data.

[0058] S134. Use multiple rounds of AES encryption technology combined with a symmetric AES key to encrypt the biosafety data packet to obtain an encrypted file.

[0059] In this embodiment, the encrypted file refers to a file formed after the biosafety data packet is encrypted through multiple rounds of AES.

[0060] Through multiple rounds of encryption, the complexity of data is significantly enhanced, the difficulty of cracking is increased, and the security of data is ensured.

[0061] S135, re-encrypting the encrypted file using a chain encryption technique to obtain a re-encrypted result.

[0062] In this embodiment, the re-encryption result refers to multiple files formed after the encrypted file is chain encrypted.

[0063] Specifically, chain encryption is performed on the encrypted file. The file is divided into multiple parts. , using different keys Encryption is performed to further obtain the encrypted part : . Different parts use different keys to increase the difficulty of cracking.

[0064] Flexibility: Different security policies can be set for different data parts.

[0065] S136. Process the re-encrypted result using homomorphic encryption technology to obtain an encrypted result.

[0066] Homomorphic encryption using the RSA algorithm begins by generating a key pair: two large prime numbers are selected and their product is calculated to obtain a value called the modulus. Next, a specific value, called the Euler function, is calculated, which is related to the modulus. A public key exponent is selected, which must be less than the Euler function and coprime to it. The private key exponent is then calculated so that it forms a specific mathematical relationship with the public key exponent. Public and private keys are generated, with the public key consisting of the public key exponent and the modulus, and the private key consisting of the private key exponent and the modulus.

[0067] Convert the data packet that has been encrypted for multiple rounds into an integer and ensure that the integer is smaller than the modulus. Use the public key to encrypt the integer to generate ciphertext. Send the ciphertext to the hospital where the data needs to be received. At this time, the data remains encrypted to ensure privacy.

[0068] Perform the required operation on the ciphertext. For example, for two ciphertexts, a new ciphertext can be generated through multiplication, which corresponds to the sum of the original data. The calculated new ciphertext result is returned to the data owner, still in an encrypted state. The returned ciphertext is decrypted using the private key to obtain the final calculation result.

[0069] In this embodiment, homomorphic encryption technology is applied to enable the recipient to perform statistical analysis on encrypted data without decrypting the data, thereby allowing efficient data analysis while protecting data privacy.

[0070] The encryption process adopts a multi-level biodata security protection mechanism, which not only ensures the confidentiality and integrity of the data, but also provides flexible data processing capabilities, greatly improving the overall security of biosafety data.

[0071] For the key used in the encryption process, you can set the validity period and valid usage range, and set a rotation date. The key used for encryption can be updated based on the validity period, valid usage range, and rotation date.

[0072] Specifically, new AES keys are generated regularly, that is, new keys are used to replace old keys, thereby reducing the risk of key leakage.

[0073] This process can be automated through an encryption service or key management system (KMS). Unique AES keys are generated for each session or data transfer, ensuring that even if one key is compromised, the others remain secure.

[0074] Set up a hardware security module (HSM) to store dynamically generated keys and provide high security. HSM can provide strong encryption and strict access control to ensure that only authorized personnel or systems can access the keys. Physical isolation and dedicated hardware enhance the security of key storage.

[0075] New keys are distributed using a secure TLS channel. After each key is generated, the new key is transmitted to the authorized recipient via a TLS (Transport Layer Security) channel. The data encryption and authentication measures provided by TLS prevent the key from being intercepted or tampered with during transmission.

[0076] Set the usage period and validity range of the key: Each key should have a clear usage period (such as 1 hour, 1 day) and validity range (such as a specific data packet). This strategy can significantly reduce the losses caused by key leakage and limit the operation time of potential attackers.

[0077] Develop a regular key rotation plan: Set a plan to generate new keys periodically (such as monthly or quarterly). Update the key storage and distribution mechanism in a timely manner to ensure that all relevant parties can obtain the latest keys to maintain security.

[0078] Key revocation mechanism: Once a key leak or insecurity is discovered, the key revocation procedure will be initiated immediately.

[0079] Revoked keys should be ensured to be unable to be used again, and new keys should be distributed to relevant parties promptly to reduce potential risks.

[0080] Implement key usage auditing: Record the generation, distribution, and use of keys to ensure that all operations are traceable. Regularly analyze audit logs to identify potential security issues or abnormal behaviors and provide security monitoring and compliance support.

[0081] Strict permission control: Implement strict permission control on users in the key management system to ensure that only authorized users can access or operate keys. Reduce internal threats and ensure that only necessary personnel can access sensitive data.

[0082] Compatibility with encryption protocols: Ensure that the key management mechanism is compatible with encryption protocols (such as public key infrastructure PKI, TLS, etc.) to maintain the security of keys and the integrity of data transmission. This ensures the stability and security of the entire system and avoids vulnerabilities caused by incompatibility.

[0083] Dynamic key management and regular rotation mechanism can effectively improve the overall security of the system through the above steps. Ensure that all aspects of encryption key management are properly handled, from key generation, storage, distribution, to use and revocation, strict regulations should be established to cope with increasingly complex security threats.

[0084] When generating AES keys, specify an expiration date for each key through the key management system (KMS). You can use a configuration file or database to record the time when the key was generated and the length of the expiration date. When the key is generated, record the current timestamp as the start time of the expiration date. Each time the key is used, the system obtains the current time and compares it with the stored start time. If the current time exceeds the start time plus the expiration date, the system will reject the use of the key and trigger the key update process. The system can be set to check the validity of the key regularly and automatically send notifications (via email or system reminders) to the relevant users when it is about to expire. The system can be set to check the validity of the key regularly and automatically send notifications (via email or system reminders) to the relevant users when it is about to expire. Set the scope of application for each key in the KMS. You can define fields to identify the applicable data types, user roles, and operation types. Use tags or classification systems to identify the data types that the key can handle. When encrypting or decrypting data, the system will verify based on the data type to ensure that the key matches the data type. Define different roles (administrator, user, auditor) in the key management system and set permissions for each role. Before using a key, the system needs to verify the identity and role of the current user to ensure that they have permission to use the key. If they do not have permission, the system will deny the operation and prompt the user. In the key configuration, specify the types of operations allowed (encryption or decryption only) and verify them when using them. When the system performs key-related operations, it checks user requests against the set whitelist to ensure that only authorized operations are performed.

[0085] S140: Integrate the encryption result, hash value, and key information to obtain an integrated result.

[0086] In this embodiment, the integration result refers to a file formed by encoding a data packet formed by combining the encryption result, the hash value, and the key information.

[0087] In one embodiment, see Figure 5 , the above-mentioned step S140 may include steps S141~S142.

[0088] S141. Combine the encryption result, hash value and key information into a data packet to obtain a target data packet.

[0089] In this embodiment, the target data packet refers to a structured data packet obtained by combining the three data elements of the encryption result, the hash value and the key information in a certain format (such as JSON, XML, etc.).

[0090] S142, encoding the target data packet using Base64 encoding to obtain an integration result.

[0091] In this embodiment, Base64 is a commonly used encoding method that converts binary data into printable characters, which is suitable for use in network transmission. It converts every three bytes of data into four characters, thereby reducing the risk of data loss during transmission. This embodiment can be implemented using a built-in Base64 encoding library or function in a programming language. After the encoding is completed, an integrated result in the form of a string is obtained. This result can be safely transmitted or stored, ensuring that the data is not damaged during the transmission process, and can be easily decoded and parsed at the receiving end.

[0092] The above steps effectively integrate the encryption results, hash values ​​and key information to generate a secure, structured and easy-to-transfer file. This process not only enhances data security, but also improves data processing efficiency, ensuring that the original information can be quickly and reliably restored in subsequent use.

[0093] S150: Send the integration result to a receiving party, and the receiving party verifies, decrypts and decompresses the integration result.

[0094] In this embodiment, the TLS protocol is used to send the integration result to the receiver, and the receiver extracts a hash value from the integration result and performs hash value verification; when the hash value verification passes, the key information is extracted from the integration result and decrypted to obtain a symmetric AES key; the symmetric AES key is used to decrypt the file to obtain a biosafety data packet, the biosafety data packet is decompressed to obtain a JSON file containing a minimum data set, and the JSON file is stored.

[0095] Specifically, a secure channel is established through the TLS protocol to receive data packets transmitted by the sender. At this time, the data is sent in Base64 encoding format. After receiving it, it is decoded into the original binary format to prepare for subsequent processing.

[0096] The protocol provides encryption and authentication to ensure that data cannot be intercepted or tampered with during transmission. The decoding process lays the foundation for subsequent integrity verification and decryption operations.

[0097] Extract the hash value from the received data packet and use the SHA256 algorithm to hash the decoded encrypted compressed file. Compare the calculated hash value with the received hash value to ensure the integrity of the data during transmission. Verifying the hash value can effectively detect whether the data has been tampered with during transmission, ensuring that the received data is complete and accurate. If the hash value does not match, the problem can be discovered in time and a retransmission can be requested to avoid subsequent problems caused by incorrect data.

[0098] The encrypted AES key is extracted from the data packet and decrypted using the recipient's private key to obtain the original symmetric AES key. This step ensures that the key can be successfully decrypted in preparation for subsequent data decryption. With private key decryption, only authorized recipients can access the AES key, ensuring data confidentiality. Allowing different recipients to use their own private keys for decryption improves the adaptability and security of the system.

[0099] Use the decrypted AES key to decrypt the encrypted compressed file and restore it to the original compressed file format. Through the decryption operation, it can be restored to a usable file format to provide the necessary data for subsequent processing. The encryption and decryption process ensures that sensitive information will not be exposed during transmission and storage.

[0100] Decompress the decrypted compressed file and extract the JSON file containing the patient data, making it readable and usable. The decompressed JSON file facilitates data analysis and processing, improving the usability of the data. The JSON format makes the data structure clear and convenient for subsequent application use.

[0101] Store the processed data in a secure database or storage system and perform data analysis as needed to obtain relevant biosafety monitoring information. Use secure storage solutions to ensure the long-term security of sensitive data. Data analysis can provide strong support for future decision-making and identify potential biosafety risks in a timely manner.

[0102] Overall, these steps work together to build a secure and reliable data transmission and processing process that ensures the confidentiality, integrity, and availability of data.

[0103] In the method of this embodiment, during the data transmission process, a random AES key is first generated for symmetric encryption. This dynamically generated AES key is encrypted by the public key of the recipient and then sent to the recipient. The recipient uses its private key to decrypt the AES key, so that it can use it to decrypt the actual data. This method combines the speed of symmetric encryption and the security of asymmetric encryption to ensure the security and privacy of data during transmission. By adopting homomorphic encryption technology, certain specific calculations can be performed on encrypted data without decrypting the data. This method supports data analysis and processing while protecting the privacy of patients and ensuring that sensitive information is not leaked. For example, medical data analysis can be performed without exposing the patient's personal information, thereby achieving effective use of data. Use a strong hash algorithm (such as SHA256) to perform integrity check on each data packet. Before the data is sent, the hash value of the data is calculated and attached to the data packet. After receiving the data, the recipient calculates the hash value again and compares it with the attached hash value to ensure that the data has not been tampered with during transmission. This process enhances the reliability of the data and provides a guarantee for the use of the data.

[0104] A dynamic key management mechanism is implemented in the system, and a new AES key is generated each time data is transmitted, and it is properly stored and managed. This ensures that even if a key is leaked, the impact is limited to that session, reducing potential security risks.

[0105] Regular key replacement can further improve key security. By setting a time period or triggering key rotation based on specific events, it can prevent the potential security risks caused by long-term use of the same key. This mechanism ensures that the system can respond quickly to potential attacks and reduce losses.

[0106] In the data encryption process, chain encryption is used to connect multiple encryption algorithms in series to increase the complexity of cracking. Each encryption stage processes the data with different algorithms, making it difficult for attackers to recover the original information even if they obtain part of the data.

[0107] When encrypting data, the data protection level is further improved by repeatedly applying the same encryption algorithm (such as AES) with different parameters. Multiple rounds of encryption can effectively increase the computational complexity of cracking, ensuring that data can be better protected even in high-risk environments.

[0108] The system is divided into several independent modules, including data collection, encryption, transmission, receiving processing, key management and auditing. Each module is responsible for a specific function, achieving a highly cohesive and low-coupling system design, which helps improve the maintainability and security of the system.

[0109] The modular architecture not only improves the overall performance of the system, but also allows for individual security audits and monitoring when necessary. Each module interacts through a secure interface to ensure the security and privacy of data during transmission and processing. In addition, any update or improvement of any module will not affect the stability of the entire system, making it easy to flexibly respond to changing security needs.

[0110] Through the above measures, the system can improve data utilization efficiency while ensuring data security and ensuring that patient privacy is effectively protected.

[0111] The above-mentioned method for interconnecting and communicating biosafety data based on hybrid encryption obtains the minimum data set of patient biosafety monitoring and performs preprocessing to generate a biosafety data packet. The data packet is encrypted, the encryption key is updated using a dynamic management and regular rotation mechanism, and the encryption result, hash value and key information are integrated, and the integrated result is sent to the receiver, who verifies, decrypts and decompresses it accordingly, thereby improving the security and privacy protection of medical data during collection, transmission and storage.

[0112] Figure 6 is a schematic block diagram of a biosafety data interconnection system 300 based on hybrid encryption provided by an embodiment of the present invention. Figure 6 As shown, corresponding to the above-mentioned biosafety data interconnection and intercommunication method based on hybrid encryption, the present invention also provides a biosafety data interconnection and intercommunication system 300 based on hybrid encryption. The biosafety data interconnection and intercommunication system 300 based on hybrid encryption includes a unit for executing the above-mentioned biosafety data interconnection and intercommunication method based on hybrid encryption, and the system can be configured in a server. Specifically, please refer to Figure 6 The hybrid encryption-based biosafety data interconnection system 300 includes a data acquisition unit 301, a preprocessing unit 302, an encryption unit 303, an integration unit 304 and a sending unit 305.

[0113] The data acquisition unit 301 is used to acquire the minimum data set for patient biosafety monitoring; the preprocessing unit 302 is used to preprocess the minimum data set to obtain a biosafety data packet; the encryption unit 303 is used to encrypt the biosafety data packet to obtain an encryption result, wherein the key used for encryption is updated using a dynamic management and regular rotation mechanism; the integration unit 304 is used to integrate the encryption result, hash value, and key information to obtain an integration result; the sending unit 305 is used to send the integration result to a recipient, and the recipient verifies, decrypts, and decompresses the integration result.

[0114] In one embodiment, if Figure 7As shown, the pre-processing unit 302 includes a processing sub-unit 3021 and a compression sub-unit 3022 .

[0115] The processing subunit 3021 is used to clean, standardize and desensitize the minimum data set to obtain a processing result; the compression subunit 3022 is used to integrate the processing result into a JSON file and compress it into a compressed file with a timestamp and serial number to obtain a biosafety data package.

[0116] In one embodiment, the encryption unit 303 is used to encrypt the biometric safety data packet using a hash algorithm and a hybrid encryption technique to obtain an encryption result.

[0117] In one embodiment, if Figure 8 As shown, the encryption unit 303 includes a key generation subunit 3031, an asymmetric encryption subunit 3032, a hash calculation subunit 3033, a multi-round encryption subunit 3034, a chain encryption subunit 3035 and a homomorphic encryption subunit 3036.

[0118] The key generation subunit 3031 is used to generate a dynamic symmetric AES key; the asymmetric encryption subunit 3032 is used to use the public key of the recipient to asymmetrically encrypt the symmetric AES key to obtain key information; the hash calculation subunit 3033 is used to use the SHA256 strong hash algorithm to perform hash calculation on the biosafety data packet to obtain a hash value; the multi-round encryption subunit 3034 is used to use multi-round AES encryption technology in combination with a symmetric AES key to encrypt the biosafety data packet to obtain an encrypted file; the chain encryption subunit 3035 is used to re-encrypt the encrypted file using the chain encryption technology to obtain a re-encrypted result; the homomorphic encryption subunit 3036 is used to process the re-encrypted result using the homomorphic encryption technology to obtain an encrypted result.

[0119] In one embodiment, if Fig. 9 As shown, the integration unit 304 includes a combining subunit 3041 and an encoding subunit 3042 .

[0120] The combining subunit 3041 is used to combine the encryption result, hash value and key information into a data packet to obtain a target data packet; the encoding subunit 3042 is used to encode the target data packet using Base64 encoding to obtain an integrated result.

[0121] In one embodiment, the sending unit 305 is used to send the integration result to the receiver using the TLS protocol, and the receiver extracts a hash value from the integration result and performs hash value verification; when the hash value verification passes, the key information is extracted from the integration result and decrypted to obtain a symmetric AES key; the symmetric AES key is used to decrypt the file to obtain a biosafety data packet, the biosafety data packet is decompressed to obtain a JSON file containing a minimum data set, and the JSON file is stored.

[0122] It should be noted that technical personnel in the relevant field can clearly understand that the specific implementation process of the above-mentioned hybrid encryption-based biosafety data interconnection system 300 and each unit can refer to the corresponding description in the aforementioned method embodiment, and for the convenience and conciseness of the description, it will not be repeated here.

[0123] The above-mentioned biosafety data interconnection system 300 based on hybrid encryption can be implemented in the form of a computer program. The computer program can be used in Fig.10 Runs on the computer device shown.

[0124] See also Fig.10 , Fig.10 5 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 may be a server, wherein the server may be an independent server or a server cluster composed of multiple servers.

[0125] See also Fig.10 The computer device 500 includes a processor 502 , a memory and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0126] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, and when the program instructions are executed, the processor 502 can execute a biosafety data interconnection method based on hybrid encryption.

[0127] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

[0128] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a biosafety data interconnection method based on hybrid encryption.

[0129] The network interface 505 is used to communicate with other devices over the network. Fig.10 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0130] The processor 502 is used to run the computer program 5032 stored in the memory to implement the following steps: Acquire a minimum data set for biosafety monitoring of patients; preprocess the minimum data set to obtain a biosafety data packet; encrypt the biosafety data packet to obtain an encryption result, wherein the encryption key is updated using a dynamic management and regular rotation mechanism; integrate the encryption result, hash value, and key information to obtain an integration result; send the integration result to a recipient, and the recipient verifies, decrypts, and decompresses the integration result.

[0131] The minimum data set includes the patient's current and past medical treatment data information, and the medical treatment data information includes the patient's basic information and the medical treatment data generated during outpatient and hospitalization.

[0132] The keys used for the encryption are updated using a dynamic management and regular rotation mechanism, including: Set a validity period and a valid usage range for the encryption key, and set a rotation date, and update the encryption key based on the validity period, valid usage range, and rotation date.

[0133] In one embodiment, when the processor 502 implements the step of preprocessing the minimum data set to obtain the biosafety data packet, the processor 502 specifically implements the following steps: The minimum data set is cleaned, standardized and desensitized to obtain a processing result; the processing result is integrated into a JSON file and compressed into a compressed file with a timestamp and a serial number to obtain a biosafety data package.

[0134] In one embodiment, when the processor 502 implements the step of encrypting the biosafety data packet to obtain an encryption result, the processor 502 specifically implements the following steps: The biosafety data packet is encrypted using a hash algorithm and a hybrid encryption technique to obtain an encryption result.

[0135] In one embodiment, when the processor 502 implements the step of using a hash algorithm and a hybrid encryption technology to encrypt the biosafety data packet to obtain an encryption result, the processor 502 specifically implements the following steps: Generate a dynamic symmetric AES key; use the recipient's public key to asymmetrically encrypt the symmetric AES key to obtain key information; use the SHA256 strong hash algorithm to hash the biosafety data packet to obtain a hash value; use multiple rounds of AES encryption technology in combination with a symmetric AES key to encrypt the biosafety data packet to obtain an encrypted file; use chain encryption technology to re-encrypt the encrypted file to obtain a re-encrypted result; use homomorphic encryption technology to process the re-encrypted result to obtain an encrypted result.

[0136] In one embodiment, when the processor 502 implements the step of integrating the encryption result, the hash value, and the key information to obtain the integrated result, the processor 502 specifically implements the following steps: The encryption result, the hash value and the key information are combined into a data packet to obtain a target data packet; the target data packet is encoded using Base64 encoding to obtain an integration result.

[0137] In one embodiment, when the processor 502 implements the steps of sending the integration result to the receiving party and the receiving party performing verification, decryption and decompression according to the integration result, the processor 502 specifically implements the following steps: The integration result is sent to the receiver by using the TLS protocol, and the receiver extracts a hash value from the integration result and performs hash value verification; when the hash value verification passes, key information is extracted from the integration result and decrypted to obtain a symmetric AES key; the symmetric AES key is used to decrypt the file to obtain a biosafety data packet, the biosafety data packet is decompressed to obtain a JSON file containing a minimum data set, and the JSON file is stored.

[0138] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0139] It can be understood by those skilled in the art that all or part of the processes in the method for implementing the above embodiment can be completed by instructing the relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiment of the above method.

[0140] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein when the computer program is executed by a processor, the processor executes the following steps: Acquire a minimum data set for biosafety monitoring of patients; preprocess the minimum data set to obtain a biosafety data packet; encrypt the biosafety data packet to obtain an encryption result, wherein the encryption key is updated using a dynamic management and regular rotation mechanism; integrate the encryption result, hash value, and key information to obtain an integration result; send the integration result to a recipient, and the recipient verifies, decrypts, and decompresses the integration result.

[0141] The minimum data set includes the patient's current and past medical treatment data information, and the medical treatment data information includes the patient's basic information and the medical treatment data generated during outpatient and hospitalization.

[0142] The keys used for the encryption are updated using a dynamic management and regular rotation mechanism, including: Set a validity period and a valid usage range for the encryption key, and set a rotation date, and update the encryption key based on the validity period, valid usage range, and rotation date.

[0143] In one embodiment, when the processor executes the computer program to implement the step of preprocessing the minimum data set to obtain a biosafety data packet, the processor specifically implements the following steps: The minimum data set is cleaned, standardized and desensitized to obtain a processing result; the processing result is integrated into a JSON file and compressed into a compressed file with a timestamp and a serial number to obtain a biosafety data package.

[0144] In one embodiment, when the processor executes the computer program to implement the step of encrypting the biosafety data packet to obtain an encryption result, the processor specifically implements the following steps: The biosafety data packet is encrypted using a hash algorithm and a hybrid encryption technique to obtain an encryption result.

[0145] In one embodiment, when the processor executes the computer program to implement the step of using a hash algorithm and a hybrid encryption technique to encrypt the biosafety data packet to obtain an encryption result, the processor specifically implements the following steps: Generate a dynamic symmetric AES key; use the recipient's public key to asymmetrically encrypt the symmetric AES key to obtain key information; use the SHA256 strong hash algorithm to hash the biosafety data packet to obtain a hash value; use multiple rounds of AES encryption technology in combination with a symmetric AES key to encrypt the biosafety data packet to obtain an encrypted file; use chain encryption technology to re-encrypt the encrypted file to obtain a re-encrypted result; use homomorphic encryption technology to process the re-encrypted result to obtain an encrypted result.

[0146] In one embodiment, when the processor executes the computer program to implement the step of integrating the encryption result, the hash value, and the key information to obtain the integrated result, the processor specifically implements the following steps: The encryption result, the hash value and the key information are combined into a data packet to obtain a target data packet; the target data packet is encoded using Base64 encoding to obtain an integration result.

[0147] In one embodiment, when the processor executes the computer program to implement the steps of sending the integration result to the receiving party and the receiving party performing verification, decryption and decompression according to the integration result, the following steps are specifically implemented: The integration result is sent to the receiver by using the TLS protocol, and the receiver extracts a hash value from the integration result and performs hash value verification; when the hash value verification passes, key information is extracted from the integration result and decrypted to obtain a symmetric AES key; the symmetric AES key is used to decrypt the file to obtain a biosafety data packet, the biosafety data packet is decompressed to obtain a JSON file containing a minimum data set, and the JSON file is stored.

[0148] The storage medium may be a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk, etc., which are computer-readable storage media that can store program codes.

[0149] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0150] In the several embodiments provided by the present invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of each unit is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0151] The steps in the method of the embodiment of the present invention can be adjusted in order, combined and deleted according to actual needs. The units in the system of the embodiment of the present invention can be combined, divided and deleted according to actual needs. In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0152] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, terminal, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention.

[0153] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A biosafety data interconnection method based on hybrid encryption, characterized in that: include: Obtaining a minimum data set for patient biosafety monitoring; Preprocessing the minimum data set to obtain a biosafety data package; Encrypting the biosafety data packet to obtain an encryption result, wherein the encryption key is updated by adopting a dynamic management and regular rotation mechanism; Integrate the encryption result, hash value, and key information to obtain an integrated result; The integration result is sent to a receiver, and the receiver verifies, decrypts and decompresses the integration result.

2. According to claim 1, a method for interconnecting and communicating biosafety data based on hybrid encryption is characterized in that: The minimum data set includes the patient's current and past medical treatment data information, and the medical treatment data information includes the patient's basic information and the medical treatment data generated during outpatient and hospitalization.

3. According to claim 2, a method for interconnecting and communicating biosafety data based on hybrid encryption is characterized in that: The preprocessing of the minimum data set to obtain a biosafety data package includes: Cleaning, standardizing and desensitizing the minimum data set to obtain a processing result; The processing results are integrated into a JSON file and compressed into a compressed file with a timestamp and a sequence number to obtain a biosafety data package.

4. A method for interconnecting and communicating biosafety data based on hybrid encryption according to claim 3, characterized in that: The step of encrypting the biosafety data packet to obtain an encryption result includes: The biosafety data packet is encrypted using a hash algorithm and a hybrid encryption technique to obtain an encryption result.

5. A method for interconnecting and communicating biosafety data based on hybrid encryption according to claim 4, characterized in that: The biosafety data packet is encrypted using a hash algorithm and a hybrid encryption technology to obtain an encryption result, including: Generate dynamic symmetric AES keys; Asymmetrically encrypt the symmetric AES key using the recipient's public key to obtain key information; Performing hash calculation on the biosafety data packet using the SHA256 strong hash algorithm to obtain a hash value; The biosafety data packet is encrypted using a multi-round AES encryption technique combined with a symmetric AES key to obtain an encrypted file; The encrypted file is re-encrypted using chain encryption technology to obtain a re-encrypted result; The re-encryption result is processed using homomorphic encryption technology to obtain an encrypted result.

6. A method for interconnecting and communicating biosafety data based on hybrid encryption according to claim 5, characterized in that: The step of integrating the encryption result, the hash value, and the key information to obtain an integrated result includes: Combining the encryption result, the hash value and the key information into a data packet to obtain a target data packet; The target data packet is encoded using Base64 encoding to obtain an integration result.

7. A method for interconnecting and communicating biosafety data based on hybrid encryption according to claim 6, characterized in that: The sending of the integration result to the receiving party, and the receiving party verifying, decrypting and decompressing the integration result, includes: The integration result is sent to the receiver by using the TLS protocol, and the receiver extracts a hash value from the integration result and performs hash value verification; when the hash value verification passes, key information is extracted from the integration result and decrypted to obtain a symmetric AES key; the symmetric AES key is used to decrypt the file to obtain a biosafety data packet, the biosafety data packet is decompressed to obtain a JSON file containing a minimum data set, and the JSON file is stored.

8. A method for interconnecting and communicating biosafety data based on hybrid encryption according to claim 1, characterized in that: The keys used for the encryption are updated using a dynamic management and regular rotation mechanism, including: Set a validity period and a valid usage range for the encryption key, and set a rotation date, and update the encryption key based on the validity period, valid usage range, and rotation date.

9. A biosafety data interconnection system based on hybrid encryption, characterized in that: include; A data acquisition unit, used to acquire a minimum data set for patient biosafety monitoring; A preprocessing unit, used for preprocessing the minimum data set to obtain a biosafety data packet; An encryption unit, used to encrypt the biosafety data packet to obtain an encryption result, wherein the encryption key is updated by a dynamic management and regular rotation mechanism; An integration unit, used to integrate the encryption result, the hash value, and the key information to obtain an integration result; The sending unit is used to send the integration result to the receiving party, and the receiving party verifies, decrypts and decompresses the integration result.

10. A computer device, characterized in that: The computer device comprises a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the method according to any one of claims 1 to 8 when executing the computer program.

Images