Secure collection method and system for CRRT equipment data

Abstract

The invention belongs to the technical field of data acquisition, and discloses a method and a system for safely acquiring CRRT equipment data. The method comprises the following steps: a trusted mechanism generates a public and private key pair and signature information, and returns a private key to an edge computing gateway by using a QKD technology; the cloud data center carries out model initialization; the edge computing gateway is used for collecting real-time CRRT equipment data based on an OPC UA information model and performing data analysis by using a data analysis model; encrypting and signing the real-time CRRT equipment data, and uploading the real-time CRRT equipment data to a cloud data center; performing identity authentication and decryption; and writing the decrypted real-time CRRT equipment data into an OPC UA instance, and performing abnormal traffic identification by using an abnormal traffic identification model. According to the invention, the problems of low data security, low data acquisition reliability and complex data processing flow in the prior art are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of data acquisition, and in particular relates to a method and system for safely acquiring data of a CRRT device. Background Art

[0002] Continuous Renal Replacement Therapy (CRRT) equipment is a medical device used to replace damaged kidney function and maintain a stable internal environment in patients with acute renal failure or poisoning. CRRT equipment data includes CRRT equipment operation data, basic patient information, physiological parameter data, treatment data, and blood chemistry and biochemical index data. Therefore, CRRT equipment data involves a large amount of private information and key data. The secure collection of CRRT equipment data is a key development direction in the medical field.

[0003] The existing CRRT equipment data acquisition technology has the following defects:

[0004] 1) The existing CRRT equipment data collection method lacks effective encryption means during data transmission and is vulnerable to hacker attacks, resulting in patient privacy leakage and device data tampering. When using traditional symmetric encryption or asymmetric encryption, the distribution of keys usually relies on insecure channels, which makes it possible for the keys to be intercepted during transmission, thereby reducing the security of data collection;

[0005] 2) With the popularization and use of CRRT equipment, the volume of CRRT equipment data generated and transmitted has increased exponentially, resulting in heavy resource pressure on local databases, prone to network congestion or hardware crashes, and low reliability of data collection;

[0006] 3) Due to the different models, manufacturers or functions of different CRRT devices, there are standard differences in CRRT device data, and the data processing process is complicated, which further increases the amount of calculation. Summary of the invention

[0007] In order to solve the problems of low data security, low data acquisition reliability and complex data processing flow in the prior art, the present invention aims to provide a method and system for securely acquiring CRRT equipment data.

[0008] The technical solution adopted by the present invention is:

[0009] A method for safely collecting CRRT equipment data comprises the following steps:

[0010] The trusted institution generates a public-private key pair and signature information for each edge computing gateway, returns the signature information to the corresponding edge computing gateway, stores the public key in the public-private key pair in a local controlled manner, and uses QKD technology to return the private key in the public-private key pair to the corresponding edge computing gateway;

[0011] The cloud data center initializes the model, obtains the abnormal traffic identification model, the OPC UA information model of the CRRT equipment, the corresponding OPC UA instance, and the data analysis model, and deploys the data analysis model and the OPC UA information model to all edge computing gateways that communicate with the cloud data center;

[0012] The edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects the real-time CRRT equipment data of the CRRT equipment within the communication range, and uses the data analysis model to perform data analysis on the real-time CRRT equipment data to obtain the corresponding real-time data analysis results;

[0013] The edge computing gateway encrypts and signs the real-time CRRT device data according to the private key and signature information of the CRRT device, and uploads the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center;

[0014] The cloud data center calls the trusted organization to authenticate the real-time signature data. After the authentication is passed, the public key of the edge computing gateway controlled by the trusted organization is obtained, and the encrypted real-time CRRT device data is decrypted according to the public key to obtain the decrypted real-time CRRT device data.

[0015] The cloud data center writes the decrypted real-time CRRT equipment data into the corresponding OPC UA instance, collects the real-time access traffic data during the data writing process, and uses the abnormal traffic identification model to identify abnormal traffic in the real-time access traffic data to obtain real-time abnormal traffic identification results.

[0016] Furthermore, the trusted institution generates a public-private key pair and signature information for each edge computing gateway, returns the signature information to the corresponding edge computing gateway, stores the public key in the public-private key pair in a local controlled manner, and uses QKD technology to return the private key in the public-private key pair to the corresponding edge computing gateway, including the following steps:

[0017] The trusted institution collects the gateway identity information of all edge computing gateways that communicate with the cloud data center, and generates a public-private key pair for each edge computing gateway based on the gateway identity information using an asymmetric key generation algorithm;

[0018] Based on the gateway identity information and the private key in the public-private key pair, use the digital identity registration algorithm to generate the signature information of the corresponding edge computing gateway;

[0019] Confirm the public communication line and quantum communication line between the trusted institution and each edge computing gateway, and return the signature information to the corresponding edge computing gateway through the public communication line;

[0020] The public key in the public-private key pair is stored in a local controlled database, and the private key in the public-private key pair is returned to the edge computing gateway through a quantum communication line using QKD technology.

[0021] Furthermore, the public key in the public-private key pair is stored in a local controlled database, and the private key in the public-private key pair is returned to the edge computing gateway through a quantum communication line using QKD technology, including the following steps:

[0022] The trusted institution stores the public key of the public-private key pair in a local controlled database and sets up an identity authentication tool for the controlled database;

[0023] Using QKD technology, converting the private key in the public-private key pair into a private key quantum state, sending the private key quantum state to the corresponding edge computing gateway through a quantum communication line, and measuring the private key quantum state to obtain a first measurement result;

[0024] Through a public communication line, the first measurement result is compared with the second measurement result obtained by measuring the private key quantum state on the edge computing gateway side for public basis vector comparison and error rate estimation, and a private key is generated on the edge computing gateway side.

[0025] Furthermore, the cloud data center initializes the model, obtains the abnormal traffic identification model, the OPC UA information model of the CRRT equipment, the corresponding OPC UA instance and the data analysis model, and deploys the data analysis model and the OPC UA information model to all edge computing gateways that communicate with the cloud data center, including the following steps:

[0026] The cloud data center uses OPC UA information technology to build the corresponding OPC UA information model based on the physical information of the CRRT equipment;

[0027] Based on the OPC UA information model, a corresponding OPC UA instance is created in the cloud data center, some historical CRRT equipment data is collected, and the first model metadata of the OPC UA information model is extracted;

[0028] Based on some historical CRRT equipment data, a deep learning algorithm is used to build a data analysis model, generate some historical model parameter adjustment experience, and extract the second model metadata of the data analysis model;

[0029] Collect some historical access traffic data, and use deep learning algorithms to build an abnormal traffic identification model based on some historical access traffic data;

[0030] Sending the first model metadata and the second model metadata to all edge computing gateways in communication connection with the cloud data center;

[0031] On the edge computing gateway side, the model is reconstructed according to the first model metadata and the second model metadata to obtain a reconstructed data analysis model and a reconstructed OPC UA information model.

[0032] Furthermore, the data analysis model is constructed based on the GCN-MLP-CLA algorithm, and the data analysis model includes a graph structure feature extraction module constructed based on the GCN algorithm, a data analysis module constructed based on the MLP algorithm, and an experience replay pool constructed based on the CLA algorithm, which are sequentially connected;

[0033] The abnormal traffic identification model is constructed based on the ISSA-LSTM algorithm, and the abnormal traffic identification model includes a network parameter optimization module constructed based on the ISSA algorithm and an abnormal traffic identification module constructed based on the LSTM algorithm, which are connected in sequence.

[0034] Furthermore, the edge computing gateway, based on the OPC UA information model, uses the OPC UA communication protocol to collect real-time CRRT device data of the CRRT device within the communication range, and uses the data analysis model to perform data analysis on the real-time CRRT device data to obtain corresponding real-time data analysis results, including the following steps:

[0035] The edge computing gateway, based on the OPC UA information model, uses the OPC UA communication protocol to collect real-time CRRT equipment data from CRRT equipment within the communication range;

[0036] Preprocessing the real-time CRRT device data to obtain preprocessed real-time CRRT device data, and inputting the preprocessed real-time CRRT device data into a data analysis model;

[0037] Using the data analysis model, extracting the real-time CRRT device data features of the pre-processed real-time CRRT device data, and performing data analysis based on the real-time CRRT device data features to obtain corresponding real-time data analysis results;

[0038] If the real-time data analysis result shows that there is data anomaly, the corresponding pre-processed real-time CRRT device data is deleted and data collection is performed again, otherwise, proceed to the next step;

[0039] Extract the real-time model parameters of the data analysis model, and generate real-time model parameter adjustment experience based on the real-time model parameters and real-time CRRT equipment data characteristics;

[0040] Randomly extract a number of historical model parameter adjustment experiences and mix them with the real-time model parameter adjustment experiences to obtain a number of mixed model parameter adjustment experiences;

[0041] According to the experience of adjusting several hybrid model parameters, the data analysis model is updated to obtain an updated data analysis model, and wait for the next data analysis.

[0042] Furthermore, the edge computing gateway encrypts and signs the real-time CRRT device data according to the private key and signature information of the CRRT device, and uploads the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center, including the following steps:

[0043] The edge computing gateway encrypts the real-time CRRT device data according to the private key of the CRRT device to obtain the encrypted real-time CRRT device data;

[0044] According to the signature information of the CRRT device, the encrypted real-time CRRT device data is signed to obtain the corresponding real-time signature data;

[0045] The real-time data analysis results, the encrypted real-time CRRT equipment data obtained, and the corresponding real-time signature data are uploaded to the cloud data center.

[0046] Further, the cloud data center calls the trusted institution to authenticate the real-time signature data. After the authentication is passed, the public key of the edge computing gateway controlled by the trusted institution is obtained, and the encrypted real-time CRRT device data is decrypted according to the public key to obtain the decrypted real-time CRRT device data, including the following steps:

[0047] The cloud data center receives the real-time signature data sent by the edge computing gateway and sends the real-time signature data to the trusted organization;

[0048] On the trusted institution side, the identity authentication tool is called to authenticate the real-time signature data. If the identity authentication is successful, the public key of the corresponding edge computing gateway is extracted from the controlled database and the next step is entered. Otherwise, the corresponding encrypted real-time CRRT device data and real-time data analysis results are blocked.

[0049] After identity authentication is passed, the corresponding encrypted real-time CRRT equipment data and real-time data analysis results sent by the edge computing gateway are received, and the public key of the edge computing gateway sent by the trusted organization is received;

[0050] The encrypted real-time CRRT device data is decrypted according to the public key to obtain the decrypted real-time CRRT device data.

[0051] Furthermore, the cloud data center writes the decrypted real-time CRRT device data into the corresponding OPC UA instance, collects the real-time access traffic data during the data writing process, and uses the abnormal traffic identification model to perform abnormal traffic identification on the real-time access traffic data to obtain the real-time abnormal traffic identification result, including the following steps:

[0052] The cloud data center writes the decrypted real-time CRRT device data to the corresponding OPC UA instance in the OPC UA server;

[0053] Collecting real-time access traffic data during the data writing process, and inputting the real-time access traffic data into the abnormal traffic identification model;

[0054] Using an abnormal traffic identification model, extracting real-time access traffic data features of real-time access traffic data, and performing abnormal traffic identification based on the real-time access traffic data features to obtain real-time abnormal traffic identification results;

[0055] If the real-time abnormal traffic identification result is that abnormal traffic exists, a corresponding real-time alarm signal is generated, the real-time alarm signal is visualized, and the corresponding decrypted real-time CRRT device data and real-time data analysis results are deleted. Otherwise, wait for the next abnormal traffic identification.

[0056] A secure collection system for CRRT equipment data is used to implement a secure collection method. The system includes a cloud data center, a trusted organization, and several edge computing gateways. The cloud data center and the trusted organization are respectively communicated with the several edge computing gateways, and the cloud data center is communicated with the trusted organization.

[0057] The beneficial effects of the present invention are:

[0058] The present invention discloses a method and system for securely collecting data of CRRT equipment. The method adopts QKD technology to distribute keys, which is almost impossible to be intercepted or cracked, thereby ensuring the credibility of the keys. The method combines asymmetric encryption algorithms and digital identity authentication technologies to improve the security of data and the protection level of cloud data centers, and effectively prevents data leakage and tampering. In combination with the edge-cloud collaboration mechanism, data processing and analysis are delegated to the edge computing gateway, which reduces the data storage and processing pressure of the cloud data center, avoids network congestion or hardware crashes, and improves the reliability of data collection. By constructing a unified OPC UA information model, standardized conversion between different CRRT equipment data sources is achieved, the data processing process is simplified, and the processing efficiency is improved. The data analysis model processes CRRT equipment data in real time and efficiently, improves the response speed and data processing capability, and an abnormal traffic identification model is set in the cloud data center to identify abnormal traffic, further improving data security.

[0059] Other beneficial effects of the present invention will be further described in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a flowchart of the method for safely collecting CRRT equipment data in the present invention.

[0061] Figure 2 It is a structural block diagram of the safe acquisition system of CRRT equipment data in the present invention. DETAILED DESCRIPTION

[0062] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments.

[0063] Embodiment 1:

[0064] like Figure 1 As shown, this embodiment provides a method for safely collecting CRRT equipment data, including the following steps:

[0065] S1: The trusted institution generates a public-private key pair and signature information for each edge computing gateway, returns the signature information to the corresponding edge computing gateway, stores the public key in the public-private key pair in a local controlled manner, and uses quantum key distribution (QKD) technology to return the private key in the public-private key pair to the corresponding edge computing gateway, including the following steps:

[0066] S1-1: The trusted institution collects the gateway identity information of all edge computing gateways that communicate with the cloud data center, and generates a public-private key pair for each edge computing gateway based on the gateway identity information using an asymmetric key generation algorithm;

[0067] S1-2: Generate the signature information of the corresponding edge computing gateway using the digital identity registration algorithm based on the gateway identity information and the private key in the public-private key pair;

[0068] S1-3: Confirm the public communication line and quantum communication line between the trusted institution and each edge computing gateway, and return the signature information to the corresponding edge computing gateway through the public communication line;

[0069] S1-4: The public key in the public-private key pair is stored in a local controlled database, and the private key in the public-private key pair is returned to the edge computing gateway through a quantum communication line using QKD technology, including the following steps:

[0070] S1-4-1: The trusted institution stores the public key in the public-private key pair in a local controlled database and sets up an identity authentication tool for the controlled database;

[0071] S1-4-2: Use QKD technology to convert the private key in the public-private key pair into a private key quantum state, send the private key quantum state to the corresponding edge computing gateway through a quantum communication line, and measure the private key quantum state to obtain a first measurement result;

[0072] S1-4-3: Through a public communication line, compare the first measurement result with the second measurement result obtained by measuring the quantum state of the private key on the edge computing gateway side, and estimate the error rate, and generate a private key on the edge computing gateway side;

[0073] S2: The cloud data center initializes the model, obtains the abnormal traffic identification model, the Open Platform Communications Unified Architecture (OPC UA) information model of the CRRT equipment, the corresponding OPC UA instance and the data analysis model, and deploys the data analysis model and the OPC UA information model to all edge computing gateways connected to the cloud data center, including the following steps:

[0074] S2-1: The cloud data center uses OPC UA information technology to build the corresponding OPC UA information model based on the physical information of the CRRT equipment;

[0075] S2-2: Based on the OPC UA information model, a corresponding OPC UA instance is created in the cloud data center, some historical CRRT equipment data is collected, and the first model metadata of the OPC UA information model is extracted;

[0076] S2-3: Based on some historical CRRT equipment data, use deep learning algorithms to build a data analysis model, generate some historical model parameter adjustment experiences, and extract the second model metadata of the data analysis model;

[0077] S2-3-1: The data analysis model is built based on the Graph Convolutional Network (GCN)-Multilayer Perceptron (MLP)-Continuous Learning Algorithm (CLA) algorithm, and the data analysis model includes a graph structure feature extraction module built based on the GCN algorithm, a data analysis module built based on the MLP algorithm, and an experience replay pool built based on the CLA algorithm, which are connected in sequence;

[0078] Since the OPC UA information model includes several object nodes, attribute nodes, node relationships and node attributes, the collected CRRT equipment data is graph structure data. The GCN network performs feature propagation on the CRRT equipment data through operations similar to convolution, extracts the node features of the CRRT equipment data and the edge features between nodes, and forms the graph structure features of the CRRT equipment data; the MLP network, as a fully connected network, can perform accurate and efficient label prediction based on weighted fusion features; the experience replay pool is a database that stores historical model training experience. Adding the experience pool allows the spatiotemporal resource analysis model to store and reuse past experience to improve learning efficiency; the experience replay pool is used for the interactive experience of the model in the environment. The meta-learning experience form of these experiences is usually stored in the form of (s, a, r, s'), where s is the current state and the current model parameters of the model, a is the action taken, including model parameter adjustment, deletion, addition and other actions, r is the reward obtained, which is used to characterize the degree of influence of the action on the state, and s' is the next state, that is, the state after the model parameters are adjusted during the training process;

[0079] S2-3-2: Based on some historical CRRT equipment data, use deep learning algorithms to build a data analysis model, generate some historical model parameter adjustment experiences, and extract the second model metadata of the data analysis model, including the following steps:

[0080] S2-3-3: Use the GCN-MLP algorithm to build an initial data analysis model, and input some historical CRRT equipment data to optimize the initial data analysis model to obtain an optimized data analysis model;

[0081] S2-3-4: extract the historical CRRT equipment data characteristics and the corresponding historical model parameters in the optimization training process, and generate historical model parameter adjustment experience based on the historical CRRT equipment data characteristics and the corresponding historical model parameters;

[0082] S2-3-5: Use the experience replay mechanism of the CLA algorithm to create an experience replay pool in the optimized data analysis model, and store several historical model parameter adjustment experiences in the experience replay pool;

[0083] S2-3-6: Using the elastic weight mechanism of the CLA algorithm, the loss function of the optimized data analysis model with the experience replay pool is adjusted to obtain the final data analysis model with the adjusted loss function;

[0084] S2-4: Collect some historical access traffic data, and use deep learning algorithms to build an abnormal traffic recognition model based on some historical access traffic data;

[0085] The abnormal traffic identification model is constructed based on the Improved Sparrow Search Algorithm (ISSA)-LSTM algorithm, and the abnormal traffic identification model includes a network parameter optimization module constructed based on the ISSA algorithm and an abnormal traffic identification module constructed based on the Long Short-Term Memory (LSTM) algorithm, which are connected in sequence;

[0086] The network parameter optimization module is used to optimize the initial parameters of the LSTM network during the training process, avoiding the defects of the LSTM network being sensitive to initial values ​​and being easily trapped in local optimal values ​​and unable to jump out, thus improving the efficiency of model training and the accuracy of model prediction;

[0087] Collect some historical access traffic data, and use deep learning algorithms to build an abnormal traffic identification model based on some historical access traffic data, including the following steps:

[0088] S2-4-1: Taking minimizing model error as the optimization goal, use ISSA algorithm to build a network parameter optimization module;

[0089] S2-4-2: Use the LSTM algorithm to build an initial abnormal traffic identification module, and use the network parameter optimization module to optimize the initial parameters of the LSTM network in the initial abnormal traffic identification module to obtain an optimized abnormal traffic identification module, including the following steps:

[0090] S2-4-2-1: Use the LSTM algorithm to construct an initial abnormal traffic identification module, and encode the LSTM network initial parameters of the LSTM network in the initial abnormal traffic identification module as the positions of the ISSA individuals of the network parameter optimization module;

[0091] S2-4-2-2: Set the algorithm parameters and maximum number of iterations of the ISSA algorithm, and set the fitness function according to the optimization target of the network parameter optimization module;

[0092] The formula is:

[0093] Fit(x) = minMSE(x)

[0094] Where Fit(x) is the fitness function; MSE is the mean square error function; x is the ISSA individual variable;

[0095] S2-4-2-3: Use the Circle chaotic mapping sequence for initialization to obtain an initial ISSA population including several initial ISSA individuals;

[0096] The formula is:

[0097]

[0098] Where X' c is the initial ISSA individual of the Circle chaos map; X c * is the randomly generated initial ISSA individual; c is the ISSA individual indicator;

[0099] S2-4-2-4: Use the fitness function to obtain the initial fitness values ​​of all initial ISSA populations, and sort the initial ISSA individuals according to the initial fitness values ​​to obtain the initial discoverers, initial joiners, and initial predators;

[0100] S2-4-2-5: update the initial ISSA population to obtain an updated ISSA population; the updated ISSA population includes updated discoverers, updated joiners and updated predators;

[0101] The update formula of the discoverer is:

[0102]

[0103] In the formula, are the cth discoverer ISSA individuals of the t+1th and tth iterations respectively; iter maxis the maximum iteration threshold; ξ is a random number between 0 and 1; Q is a normally distributed random number; L is a 1×D matrix, all elements of which are 1; R2 is the warning value; ST is the safety threshold;

[0104] The update formula for the joiner is:

[0105]

[0106] In the formula, are the cth joiner ISSA individuals in the t+1th and tth iterations respectively; The best position for the exposed person to occupy; is the current worst position; iter max is the maximum iteration threshold; ξ is a random number between 0 and 1; L is a 1×D matrix, whose elements are all 1 or -1; c is the sparrow indicator; h is the total number of ISSA individuals;

[0107] The update formula of the predator is:

[0108]

[0109] In the formula, are the cth predator ISSA individuals of the t+1th and tth iterations respectively; δ is the step size control parameter, and δ=a"·γ", a" is the convergence factor, γ" is a non-zero positive real number for step size control; is the current best position; f c 、f g 、f w are the current, best and worst fitness of the ISSA individual respectively; γ is the minimum constant to prevent the denominator from being 0;

[0110]

[0111] In the formula, a" is the convergence factor; tanh(.) is the hyperbolic tangent function; t is the iteration indicator; t max is the maximum number of iterations; a max 、a min are the maximum and minimum values ​​of the convergence factor, respectively; λ is the decreasing rate parameter, k" is the decreasing period parameter, λ = -2π, k" = π;

[0112] S2-4-2-6: using the fitness function, obtaining the updated fitness value of the updated ISSA individual in the updated ISSA population, and obtaining the optimal individual according to the updated fitness value;

[0113] S2-4-2-7: If the current number of iterations is greater than the maximum iteration test or the fitness value of the optimal individual is less than the fitness threshold, the position of the optimal individual is decoded to obtain the optimal initial parameters of the LSTM network;

[0114] S2-4-2-8: According to the optimal LSTM network initial parameters, the initial abnormal traffic identification module is optimized to obtain an optimized abnormal traffic identification module;

[0115] S2-4-3: Input some historical access traffic data, optimize and train the optimized abnormal traffic identification module, and obtain the final abnormal traffic identification module;

[0116] S2-4-4: Integrate the network parameter optimization module and the final abnormal traffic identification module to obtain an abnormal traffic identification model;

[0117] S2-5: Send the first model metadata and the second model metadata to all edge computing gateways that are in communication with the cloud data center;

[0118] S2-6: On the edge computing gateway side, reconstruct the model according to the first model metadata and the second model metadata to obtain a reconstructed data analysis model and a reconstructed OPC UA information model;

[0119] S3: The edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects the real-time CRRT device data of the CRRT devices within the communication range, and uses the data analysis model to perform data analysis on the real-time CRRT device data to obtain the corresponding real-time data analysis results, including the following steps:

[0120] S3-1: Edge computing gateway, based on the OPC UA information model, uses the OPC UA communication protocol to collect real-time CRRT equipment data from CRRT equipment within the communication range;

[0121] S3-2: preprocessing the real-time CRRT device data to obtain preprocessed real-time CRRT device data, and inputting the preprocessed real-time CRRT device data into the data analysis model;

[0122] S3-3: using the graph structure feature extraction module of the data analysis model to extract the real-time CRRT device data features of the pre-processed real-time CRRT device data, and using the data analysis module to perform data analysis based on the real-time CRRT device data features to obtain corresponding real-time data analysis results;

[0123] S3-4: If the real-time data analysis result shows that there is data anomaly, the corresponding pre-processed real-time CRRT device data is deleted and data collection is performed again, otherwise, proceed to the next step;

[0124] S3-5: Extract the real-time model parameters of the data analysis model, and generate real-time model parameter adjustment experience based on the real-time model parameters and real-time CRRT equipment data characteristics;

[0125] S3-6: Randomly extract a number of historical model parameter adjustment experiences, and mix them with the real-time model parameter adjustment experiences to obtain a number of mixed model parameter adjustment experiences;

[0126] S3-7: updating the data analysis model according to the experience of adjusting the parameters of the mixed model, obtaining an updated data analysis model, and waiting for the next data analysis;

[0127] Since the experience in the experience replay pool is randomly drawn, this helps to break the correlation between consecutive experiences, thereby reducing the variance in model training. By reusing experience, the model can learn more from limited experience, which is especially useful when new data or samples are scarce. Experience replay helps stabilize the learning process and reduce fluctuations during training. Regularly check the size of the experience replay pool. If it exceeds the preset capacity, remove some experience according to preset strategies (such as priority sampling and the longest unvisited).

[0128] S4: The edge computing gateway encrypts and signs the real-time CRRT device data according to the private key and signature information of the CRRT device, and uploads the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center, including the following steps:

[0129] S4-1: The edge computing gateway encrypts the real-time CRRT device data according to the private key of the CRRT device to obtain the encrypted real-time CRRT device data;

[0130] S4-2: Sign the encrypted real-time CRRT device data according to the signature information of the CRRT device to obtain corresponding real-time signature data;

[0131] S4-3: Upload the real-time data analysis results, the encrypted real-time CRRT device data obtained, and the corresponding real-time signature data to the cloud data center;

[0132] S5: The cloud data center calls the trusted institution to authenticate the real-time signature data. After the authentication is passed, the public key of the edge computing gateway controlled by the trusted institution is obtained, and the encrypted real-time CRRT device data is decrypted according to the public key to obtain the decrypted real-time CRRT device data, including the following steps:

[0133] S5-1: The cloud data center receives the real-time signature data sent by the edge computing gateway and sends the real-time signature data to the trusted institution;

[0134] S5-2: On the trusted institution side, the identity authentication tool is called to authenticate the real-time signature data. If the identity authentication is successful, the public key of the corresponding edge computing gateway is extracted from the controlled database and the next step is entered. Otherwise, the corresponding encrypted real-time CRRT device data and real-time data analysis results are blocked;

[0135] S5-3: After identity authentication is passed, the corresponding encrypted real-time CRRT device data and real-time data analysis results sent by the edge computing gateway are received, and the public key of the edge computing gateway sent by the trusted organization is received;

[0136] S5-4: decrypting the encrypted real-time CRRT device data according to the public key to obtain the decrypted real-time CRRT device data;

[0137] S6: The cloud data center writes the decrypted real-time CRRT device data into the corresponding OPC UA instance, collects the real-time access traffic data during the data writing process, and uses the abnormal traffic identification model to identify abnormal traffic on the real-time access traffic data to obtain the real-time abnormal traffic identification result, including the following steps:

[0138] S6-1: The cloud data center writes the decrypted real-time CRRT device data to the corresponding OPC UA instance in the OPC UA server;

[0139] S6-2: Collecting real-time access traffic data during the data writing process, and inputting the real-time access traffic data into an abnormal traffic identification model;

[0140] S6-3: using an abnormal traffic identification module of an abnormal traffic identification model to extract real-time access traffic data features of the real-time access traffic data, and performing abnormal traffic identification based on the real-time access traffic data features to obtain a real-time abnormal traffic identification result;

[0141] S6-4: If the real-time abnormal traffic identification result is that abnormal traffic exists, a corresponding real-time alarm signal is generated, the real-time alarm signal is visualized, and the corresponding decrypted real-time CRRT device data and real-time data analysis results are deleted, otherwise, wait for the next abnormal traffic identification.

[0142] Embodiment 2:

[0143] like Figure 2 As shown, this embodiment provides a secure collection system for CRRT equipment data, which is used to implement a secure collection method. The system includes a cloud data center, a trusted organization, and several edge computing gateways. The cloud data center and the trusted organization are respectively connected to the several edge computing gateways in communication, and the cloud data center is connected to the trusted organization in communication;

[0144] The trusted institution is used to generate the public-private key pair and signature information of each edge computing gateway, return the signature information to the corresponding edge computing gateway, store the public key in the public-private key pair in a local controlled manner, and use QKD technology to return the private key in the public-private key pair to the corresponding edge computing gateway;

[0145] The cloud data center is used to initialize the model, obtain the abnormal traffic identification model, the OPC UA information model of the CRRT equipment, the corresponding OPC UA instance and the data analysis model, and deploy the data analysis model and the OPC UA information model to all edge computing gateways that are connected to the cloud data center; call the trusted organization to authenticate the real-time signature data, and after the authentication is passed, obtain the public key of the controlled edge computing gateway in the trusted organization, and decrypt the encrypted real-time CRRT equipment data according to the public key to obtain the decrypted real-time CRRT equipment data; write the decrypted real-time CRRT equipment data to the corresponding OPC UA instance, collect the real-time access traffic data during the data writing process, and use the abnormal traffic identification model to perform abnormal traffic identification on the real-time access traffic data to obtain the real-time abnormal traffic identification result;

[0146] The edge computing gateway is used to collect real-time CRRT equipment data of CRRT equipment within the communication range based on the OPC UA information model and the OPC UA communication protocol, and use the data analysis model to perform data analysis on the real-time CRRT equipment data to obtain corresponding real-time data analysis results; encrypt and sign the real-time CRRT equipment data according to the private key and signature information of the CRRT equipment, and upload the real-time data analysis results, the encrypted real-time CRRT equipment data and the corresponding real-time signature data to the cloud data center.

[0147] The present invention discloses a method and system for securely collecting data of CRRT equipment. The method adopts QKD technology to distribute keys, which is almost impossible to be intercepted or cracked, thereby ensuring the credibility of the keys. The method combines asymmetric encryption algorithms and digital identity authentication technologies to improve the security of data and the protection level of cloud data centers, and effectively prevents data leakage and tampering. In combination with the edge-cloud collaboration mechanism, data processing and analysis are delegated to the edge computing gateway, which reduces the data storage and processing pressure of the cloud data center, avoids network congestion or hardware crashes, and improves the reliability of data collection. By constructing a unified OPC UA information model, standardized conversion between different CRRT equipment data sources is achieved, the data processing process is simplified, and the processing efficiency is improved. The data analysis model processes CRRT equipment data in real time and efficiently, improves the response speed and data processing capability, and an abnormal traffic identification model is set in the cloud data center to identify abnormal traffic, further improving data security.

[0148] The present invention is not limited to the above optional implementation modes, and anyone can obtain other various forms of products under the enlightenment of the present invention. The above specific implementation modes should not be understood as limiting the scope of protection of the present invention. The scope of protection of the present invention should be based on the definition in the claims, and the description can be used to interpret the claims.

Claims

1. A method for securely collecting CRRT equipment data, characterized in that: The steps include: The trusted institution generates a public-private key pair and signature information for each edge computing gateway, returns the signature information to the corresponding edge computing gateway, stores the public key in the public-private key pair in a local controlled manner, and uses QKD technology to return the private key in the public-private key pair to the corresponding edge computing gateway; The cloud data center initializes the model, obtains the abnormal traffic identification model, the OPC UA information model of the CRRT equipment, the corresponding OPC UA instance, and the data analysis model, and deploys the data analysis model and the OPC UA information model to all edge computing gateways that communicate with the cloud data center; The edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects the real-time CRRT equipment data of the CRRT equipment within the communication range, and uses the data analysis model to perform data analysis on the real-time CRRT equipment data to obtain the corresponding real-time data analysis results; The edge computing gateway encrypts and signs the real-time CRRT device data according to the private key and signature information of the CRRT device, and uploads the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center; The cloud data center calls the trusted organization to authenticate the real-time signature data. After the authentication is passed, the public key of the edge computing gateway controlled by the trusted organization is obtained, and the encrypted real-time CRRT device data is decrypted according to the public key to obtain the decrypted real-time CRRT device data. The cloud data center writes the decrypted real-time CRRT equipment data into the corresponding OPC UA instance, collects the real-time access traffic data during the data writing process, and uses the abnormal traffic identification model to identify abnormal traffic in the real-time access traffic data to obtain real-time abnormal traffic identification results.

2. The method for securely collecting CRRT equipment data according to claim 1, characterized in that: The trusted institution generates a public-private key pair and signature information for each edge computing gateway, returns the signature information to the corresponding edge computing gateway, stores the public key in the public-private key pair in a local controlled manner, and uses QKD technology to return the private key in the public-private key pair to the corresponding edge computing gateway, including the following steps: The trusted institution collects the gateway identity information of all edge computing gateways that communicate with the cloud data center, and generates a public-private key pair for each edge computing gateway based on the gateway identity information using an asymmetric key generation algorithm; Based on the gateway identity information and the private key in the public-private key pair, use the digital identity registration algorithm to generate the signature information of the corresponding edge computing gateway; Confirm the public communication line and quantum communication line between the trusted institution and each edge computing gateway, and return the signature information to the corresponding edge computing gateway through the public communication line; The public key in the public-private key pair is stored in a local controlled database, and the private key in the public-private key pair is returned to the edge computing gateway through a quantum communication line using QKD technology.

3. The method for securely collecting CRRT equipment data according to claim 2, characterized in that: The public key in the public-private key pair is stored in a local controlled database, and the private key in the public-private key pair is returned to the edge computing gateway through a quantum communication line using QKD technology, including the following steps: The trusted institution stores the public key of the public-private key pair in a local controlled database and sets up an identity authentication tool for the controlled database; Using QKD technology, converting the private key in the public-private key pair into a private key quantum state, sending the private key quantum state to the corresponding edge computing gateway through a quantum communication line, and measuring the private key quantum state to obtain a first measurement result; Through a public communication line, the first measurement result is compared with the second measurement result obtained by measuring the private key quantum state on the edge computing gateway side for public basis vector comparison and error rate estimation, and a private key is generated on the edge computing gateway side.

4. The method for securely collecting CRRT equipment data according to claim 3, characterized in that: The cloud data center initializes the model, obtains the abnormal traffic identification model, the OPC UA information model of the CRRT equipment, the corresponding OPC UA instance and the data analysis model, and deploys the data analysis model and the OPC UA information model to all edge computing gateways that communicate with the cloud data center, including the following steps: The cloud data center uses OPC UA information technology to build the corresponding OPC UA information model based on the physical information of the CRRT equipment; Based on the OPC UA information model, a corresponding OPC UA instance is created in the cloud data center, some historical CRRT equipment data is collected, and the first model metadata of the OPC UA information model is extracted; Based on some historical CRRT equipment data, a deep learning algorithm is used to build a data analysis model, generate some historical model parameter adjustment experience, and extract the second model metadata of the data analysis model; Collect some historical access traffic data, and use deep learning algorithms to build an abnormal traffic identification model based on some historical access traffic data; Sending the first model metadata and the second model metadata to all edge computing gateways in communication connection with the cloud data center; On the edge computing gateway side, the model is reconstructed according to the first model metadata and the second model metadata to obtain a reconstructed data analysis model and a reconstructed OPC UA information model.

5. The method for securely collecting CRRT equipment data according to claim 4, characterized in that: The data analysis model is constructed based on the GCN-MLP-CLA algorithm, and the data analysis model includes a graph structure feature extraction module constructed based on the GCN algorithm, a data analysis module constructed based on the MLP algorithm, and an experience replay pool constructed based on the CLA algorithm, which are connected in sequence; The abnormal traffic identification model is constructed based on the ISSA-LSTM algorithm, and the abnormal traffic identification model includes a network parameter optimization module constructed based on the ISSA algorithm and an abnormal traffic identification module constructed based on the LSTM algorithm, which are connected in sequence.

6. The method for securely collecting CRRT equipment data according to claim 5, characterized in that: The edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects the real-time CRRT device data of the CRRT devices within the communication range, and uses the data analysis model to perform data analysis on the real-time CRRT device data to obtain the corresponding real-time data analysis results, including the following steps: The edge computing gateway, based on the OPC UA information model, uses the OPC UA communication protocol to collect real-time CRRT equipment data from CRRT equipment within the communication range; Preprocessing the real-time CRRT device data to obtain preprocessed real-time CRRT device data, and inputting the preprocessed real-time CRRT device data into a data analysis model; Using the data analysis model, extracting the real-time CRRT device data features of the pre-processed real-time CRRT device data, and performing data analysis based on the real-time CRRT device data features to obtain corresponding real-time data analysis results; If the real-time data analysis result shows that there is data anomaly, the corresponding pre-processed real-time CRRT device data is deleted and data collection is performed again, otherwise, proceed to the next step; Extract the real-time model parameters of the data analysis model, and generate real-time model parameter adjustment experience based on the real-time model parameters and real-time CRRT equipment data characteristics; Randomly extract a number of historical model parameter adjustment experiences, mix them with the real-time model parameter adjustment experiences, and obtain a number of mixed model parameter adjustment experiences; According to the experience of adjusting several hybrid model parameters, the data analysis model is updated to obtain an updated data analysis model, and wait for the next data analysis.

7. The method for securely collecting CRRT equipment data according to claim 3, characterized in that: The edge computing gateway encrypts and signs the real-time CRRT device data according to the private key and signature information of the CRRT device, and uploads the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center, including the following steps: The edge computing gateway encrypts the real-time CRRT device data according to the private key of the CRRT device to obtain the encrypted real-time CRRT device data; According to the signature information of the CRRT device, the encrypted real-time CRRT device data is signed to obtain the corresponding real-time signature data; The real-time data analysis results, the encrypted real-time CRRT equipment data obtained, and the corresponding real-time signature data are uploaded to the cloud data center.

8. The method for securely collecting CRRT equipment data according to claim 3, characterized in that: The cloud data center calls the trusted organization to authenticate the real-time signature data. After the authentication is passed, the public key of the edge computing gateway controlled by the trusted organization is obtained, and the encrypted real-time CRRT device data is decrypted according to the public key to obtain the decrypted real-time CRRT device data, including the following steps: The cloud data center receives the real-time signature data sent by the edge computing gateway and sends the real-time signature data to the trusted organization; On the trusted institution side, the identity authentication tool is called to authenticate the real-time signature data. If the identity authentication is successful, the public key of the corresponding edge computing gateway is extracted from the controlled database and the next step is entered. Otherwise, the corresponding encrypted real-time CRRT device data and real-time data analysis results are blocked. After identity authentication is passed, the corresponding encrypted real-time CRRT equipment data and real-time data analysis results sent by the edge computing gateway are received, and the public key of the edge computing gateway sent by the trusted organization is received; The encrypted real-time CRRT device data is decrypted according to the public key to obtain the decrypted real-time CRRT device data.

9. The method for securely collecting CRRT equipment data according to claim 5, characterized in that: The cloud data center writes the decrypted real-time CRRT device data into the corresponding OPC UA instance, collects the real-time access traffic data during the data writing process, and uses the abnormal traffic identification model to identify abnormal traffic on the real-time access traffic data to obtain the real-time abnormal traffic identification result, including the following steps: The cloud data center writes the decrypted real-time CRRT device data to the corresponding OPC UA instance in the OPC UA server; Collecting real-time access traffic data during the data writing process, and inputting the real-time access traffic data into the abnormal traffic identification model; Using an abnormal traffic identification model, extracting real-time access traffic data features of real-time access traffic data, and performing abnormal traffic identification based on the real-time access traffic data features to obtain real-time abnormal traffic identification results; If the real-time abnormal traffic identification result is that abnormal traffic exists, a corresponding real-time alarm signal is generated, the real-time alarm signal is visualized, and the corresponding decrypted real-time CRRT device data and real-time data analysis results are deleted. Otherwise, wait for the next abnormal traffic identification.

10. A secure data collection system for CRRT equipment, used to implement the secure data collection method according to any one of claims 1 to 9, characterized in that: The system includes a cloud data center, a trusted organization, and several edge computing gateways. The cloud data center and the trusted organization are respectively connected to the several edge computing gateways in communication, and the cloud data center is connected to the trusted organization in communication.

Images