A secure data collection method and system for CRRT equipment

Abstract

The present invention belongs to the field of data acquisition technology and discloses a method and system for securely acquiring CRRT equipment data. The method comprises the following steps: a trusted institution generates a public-private key pair and signature information, and uses QKD technology to return the private key to an edge computing gateway; a cloud data center performs model initialization; the edge computing gateway acquires real-time CRRT equipment data based on the OPC UA information model and uses a data analysis model to perform data analysis; the real-time CRRT equipment data is encrypted and signed and uploaded to the cloud data center; identity authentication and decryption are performed; the decrypted real-time CRRT equipment data is written to an OPC UA instance, and an abnormal traffic identification model is used to identify abnormal traffic. The present invention solves the problems of low data security, low data acquisition reliability, and complex data processing procedures in the prior art.

Description

Technical Field

[0001] The present invention belongs to the technical field of data acquisition, and in particular relates to a method and system for safely acquiring CRRT equipment data. Background Art

[0002] Continuous Renal Replacement Therapy (CRRT) devices are medical devices used to replace damaged kidney function and maintain a stable internal environment in critically ill patients suffering from acute renal failure or poisoning. CRRT device data includes CRRT device operating data, basic patient information, physiological parameters, treatment data, and blood chemistry and biochemical indicators. Therefore, CRRT device data involves a large amount of private and critical information. Securely collecting CRRT device data is a key development direction in the medical field.

[0003] The existing CRRT equipment data acquisition technology has the following defects:

[0004] 1) Existing CRRT equipment data collection methods lack effective encryption during data transmission, making them vulnerable to hacker attacks, leading to patient privacy leaks and device data tampering. Traditional symmetric or asymmetric encryption methods often rely on insecure channels for key distribution, making it possible for the key to be intercepted during transmission, thereby reducing the security of data collection.

[0005] 2) With the popularization and use of CRRT equipment, the volume of CRRT equipment data generated and transmitted has increased exponentially, resulting in heavy resource pressure on local databases, prone to network congestion or hardware crashes, and low data collection reliability;

[0006] 3) Due to the different models, manufacturers or functions of different CRRT devices, there are standard differences in CRRT device data, the data processing process is complicated, and the calculation amount is further increased. Summary of the Invention

[0007] In order to solve the problems of low data security, low data acquisition reliability and complex data processing flow in the prior art, the present invention aims to provide a method and system for securely acquiring CRRT equipment data.

[0008] The technical solution adopted in the present invention is:

[0009] A method for securely collecting CRRT equipment data comprises the following steps:

[0010] The trusted institution generates a public-private key pair and signature information for each edge computing gateway, returns the signature information to the corresponding edge computing gateway, stores the public key in the public-private key pair in a locally controlled manner, and uses QKD technology to return the private key in the public-private key pair to the corresponding edge computing gateway;

[0011] The cloud data center initializes the model to obtain the abnormal traffic identification model, the OPC UA information model of the CRRT equipment, the corresponding OPC UA instance, and the data analysis model. The data analysis model and OPC UA information model are then deployed to all edge computing gateways connected to the cloud data center.

[0012] The edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects real-time CRRT device data from CRRT devices within the communication range and uses the data analysis model to analyze the real-time CRRT device data to obtain corresponding real-time data analysis results.

[0013] The edge computing gateway encrypts and signs the real-time CRRT device data based on the private key and signature information of the CRRT device, and uploads the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center;

[0014] The cloud data center calls the trusted organization to authenticate the real-time signature data. After the authentication is passed, the cloud data center obtains the public key of the edge computing gateway controlled by the trusted organization and decrypts the encrypted real-time CRRT device data based on the public key to obtain the decrypted real-time CRRT device data.

[0015] The cloud data center writes the decrypted real-time CRRT equipment data into the corresponding OPC UA instance, collects the real-time access traffic data during the data writing process, and uses the abnormal traffic identification model to identify abnormal traffic in the real-time access traffic data to obtain real-time abnormal traffic identification results.

[0016] Furthermore, the trusted institution generates a public-private key pair and signature information for each edge computing gateway, returns the signature information to the corresponding edge computing gateway, stores the public key in the public-private key pair in a locally controlled manner, and uses QKD technology to return the private key in the public-private key pair to the corresponding edge computing gateway, including the following steps:

[0017] The trusted institution collects the gateway identity information of all edge computing gateways communicating with the cloud data center, and uses an asymmetric key generation algorithm to generate a public-private key pair for each edge computing gateway based on the gateway identity information;

[0018] Based on the gateway identity information and the private key in the public-private key pair, use the digital identity registration algorithm to generate the corresponding edge computing gateway signature information;

[0019] Confirm the public communication line and quantum communication line between the trusted institution and each edge computing gateway, and return the signature information to the corresponding edge computing gateway through the public communication line;

[0020] The public key in the public-private key pair is stored in a local controlled database, and the private key in the public-private key pair is returned to the edge computing gateway through a quantum communication line using QKD technology.

[0021] Furthermore, the public key in the public-private key pair is stored in a local controlled database, and the private key in the public-private key pair is returned to the edge computing gateway via a quantum communication line using QKD technology, including the following steps:

[0022] The trusted institution stores the public key in the public-private key pair in a local controlled database and sets up identity authentication tools for the controlled database;

[0023] Using QKD technology, the private key in the public-private key pair is converted into a private key quantum state, the private key quantum state is sent to the corresponding edge computing gateway through a quantum communication line, and the private key quantum state is measured to obtain a first measurement result;

[0024] Through a public communication line, the first measurement result is compared with the second measurement result obtained by measuring the private key quantum state on the edge computing gateway side for public basis vector comparison and error rate estimation, and a private key is generated on the edge computing gateway side.

[0025] Furthermore, the cloud data center initializes the model to obtain the abnormal traffic identification model, the OPC UA information model of the CRRT equipment, the corresponding OPC UA instance, and the data analysis model. The data analysis model and the OPC UA information model are then deployed to all edge computing gateways connected to the cloud data center, including the following steps:

[0026] The cloud data center uses OPC UA information technology to build the corresponding OPC UA information model based on the physical information of the CRRT equipment.

[0027] Based on the OPC UA information model, a corresponding OPC UA instance is created in the cloud data center, some historical CRRT equipment data is collected, and the first model metadata of the OPC UA information model is extracted;

[0028] Based on some historical CRRT equipment data, a deep learning algorithm is used to build a data analysis model, generate some historical model parameter adjustment experience, and extract the second model metadata of the data analysis model;

[0029] Collect some historical access traffic data and use deep learning algorithms to build an abnormal traffic identification model based on the historical access traffic data;

[0030] Sending the first model metadata and the second model metadata to all edge computing gateways in communication with the cloud data center;

[0031] On the edge computing gateway side, the model is reconstructed according to the first model metadata and the second model metadata to obtain a reconstructed data analysis model and a reconstructed OPC UA information model.

[0032] Furthermore, the data analysis model is constructed based on the GCN-MLP-CLA algorithm, and the data analysis model includes a graph structure feature extraction module constructed based on the GCN algorithm, a data analysis module constructed based on the MLP algorithm, and an experience replay pool constructed based on the CLA algorithm, which are connected in sequence;

[0033] The abnormal traffic identification model is constructed based on the ISSA-LSTM algorithm, and the abnormal traffic identification model includes a network parameter optimization module constructed based on the ISSA algorithm and an abnormal traffic identification module constructed based on the LSTM algorithm, which are connected in sequence.

[0034] Furthermore, the edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects real-time CRRT device data from CRRT devices within the communication range, and uses the data analysis model to perform data analysis on the real-time CRRT device data to obtain corresponding real-time data analysis results, including the following steps:

[0035] The edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects real-time CRRT device data from CRRT devices within the communication range;

[0036] Preprocessing the real-time CRRT device data to obtain preprocessed real-time CRRT device data, and inputting the preprocessed real-time CRRT device data into a data analysis model;

[0037] Using a data analysis model, extracting real-time CRRT device data features of pre-processed real-time CRRT device data, and performing data analysis based on the real-time CRRT device data features to obtain corresponding real-time data analysis results;

[0038] If the real-time data analysis result shows that there is data anomaly, the corresponding pre-processed real-time CRRT device data is deleted and data collection is performed again. Otherwise, proceed to the next step;

[0039] Extract the real-time model parameters of the data analysis model and generate real-time model parameter adjustment experience based on the real-time model parameters and real-time CRRT equipment data characteristics;

[0040] Randomly extract a number of historical model parameter adjustment experiences and mix them with the real-time model parameter adjustment experiences to obtain a number of mixed model parameter adjustment experiences;

[0041] According to the experience of adjusting the parameters of several hybrid models, the data analysis model is updated to obtain an updated data analysis model, and wait for the next data analysis.

[0042] Furthermore, the edge computing gateway encrypts and signs the real-time CRRT device data based on the private key and signature information of the CRRT device, and uploads the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center, including the following steps:

[0043] The edge computing gateway encrypts the real-time CRRT device data according to the private key of the CRRT device to obtain the encrypted real-time CRRT device data;

[0044] According to the signature information of the CRRT device, the encrypted real-time CRRT device data is signed to obtain the corresponding real-time signature data;

[0045] The real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data are uploaded to the cloud data center.

[0046] Furthermore, the cloud data center calls the trusted organization to authenticate the real-time signature data. After the authentication is passed, the cloud data center obtains the public key of the edge computing gateway controlled by the trusted organization and decrypts the encrypted real-time CRRT device data based on the public key to obtain the decrypted real-time CRRT device data. The steps include:

[0047] The cloud data center receives the real-time signature data sent by the edge computing gateway and sends the real-time signature data to the trusted organization;

[0048] On the trusted institution side, the identity authentication tool is called to authenticate the real-time signature data. If the identity authentication is successful, the public key of the corresponding edge computing gateway is extracted from the controlled database and the next step is entered. Otherwise, the corresponding encrypted real-time CRRT device data and real-time data analysis results are blocked.

[0049] After identity authentication is passed, the corresponding encrypted real-time CRRT device data and real-time data analysis results sent by the edge computing gateway are received, and the public key of the edge computing gateway sent by the trusted organization is received;

[0050] The encrypted real-time CRRT device data is decrypted according to the public key to obtain the decrypted real-time CRRT device data.

[0051] Furthermore, the cloud data center writes the decrypted real-time CRRT device data into the corresponding OPC UA instance, collects the real-time access traffic data during the data writing process, and uses the abnormal traffic identification model to identify abnormal traffic in the real-time access traffic data to obtain real-time abnormal traffic identification results, including the following steps:

[0052] The cloud data center writes the decrypted real-time CRRT device data to the corresponding OPC UA instance in the OPC UA server;

[0053] Collect real-time access traffic data during the data writing process and input the real-time access traffic data into the abnormal traffic identification model;

[0054] Using an abnormal traffic identification model, extracting real-time access traffic data features of the real-time access traffic data, and performing abnormal traffic identification based on the real-time access traffic data features to obtain a real-time abnormal traffic identification result;

[0055] If the real-time abnormal traffic identification result is that abnormal traffic exists, a corresponding real-time alarm signal is generated, the real-time alarm signal is visualized, and the corresponding decrypted real-time CRRT device data and real-time data analysis results are deleted. Otherwise, wait for the next abnormal traffic identification.

[0056] A secure data collection system for CRRT equipment is used to implement a secure data collection method. The system includes a cloud data center, a trusted organization, and several edge computing gateways. The cloud data center and the trusted organization are respectively connected to the several edge computing gateways, and the cloud data center is connected to the trusted organization.

[0057] The beneficial effects of the present invention are:

[0058] The present invention discloses a method and system for securely collecting CRRT equipment data. The method adopts QKD technology for key distribution, which is almost impossible to be intercepted or cracked, thereby ensuring the credibility of the key. Combined with asymmetric encryption algorithm and digital identity authentication technology, the data security and the protection level of the cloud data center are improved, and data leakage and tampering are effectively prevented. Combined with the edge-cloud collaboration mechanism, data processing and analysis are decentralized to the edge computing gateway, which reduces the data storage and processing pressure of the cloud data center, avoids network congestion or hardware crash, and improves the reliability of data collection. By constructing a unified OPC UA information model, standardized conversion between different CRRT equipment data sources is achieved, the data processing process is simplified, and processing efficiency is improved. The data analysis model processes CRRT equipment data in real time and efficiently, improves the response speed and data processing capability, and an abnormal traffic identification model is set in the cloud data center to identify abnormal traffic, further improving data security.

[0059] Other beneficial effects of the present invention will be further described in the detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a flowchart of the method for safely collecting CRRT equipment data in the present invention.

[0061] Figure 2 This is a structural block diagram of the safe acquisition system for CRRT equipment data in the present invention. DETAILED DESCRIPTION

[0062] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments.

[0063] Example 1:

[0064] like Figure 1 As shown, this embodiment provides a method for securely collecting CRRT equipment data, including the following steps:

[0065] S1: The trusted institution generates a public-private key pair and signature information for each edge computing gateway, returns the signature information to the corresponding edge computing gateway, stores the public key in the public-private key pair locally under controlled storage, and uses quantum key distribution (QKD) technology to return the private key in the public-private key pair to the corresponding edge computing gateway. This includes the following steps:

[0066] S1-1: The trusted institution collects the gateway identity information of all edge computing gateways communicating with the cloud data center and generates a public-private key pair for each edge computing gateway based on the gateway identity information using an asymmetric key generation algorithm.

[0067] S1-2: Generate the signature information of the corresponding edge computing gateway using the digital identity registration algorithm based on the gateway identity information and the private key in the public-private key pair;

[0068] S1-3: Confirm the public communication line and quantum communication line between the trusted institution and each edge computing gateway, and return the signature information to the corresponding edge computing gateway through the public communication line;

[0069] S1-4: The public key in the public-private key pair is stored in a local controlled database, and the private key in the public-private key pair is returned to the edge computing gateway via a quantum communication line using QKD technology. This includes the following steps:

[0070] S1-4-1: The trusted institution stores the public key in the public-private key pair in a local controlled database and sets up identity authentication tools for the controlled database;

[0071] S1-4-2: Using QKD technology, convert the private key in the public-private key pair into a private key quantum state, send the private key quantum state to the corresponding edge computing gateway via a quantum communication line, and measure the private key quantum state to obtain a first measurement result;

[0072] S1-4-3: Compare the first measurement result with the second measurement result obtained by measuring the quantum state of the private key on the edge computing gateway through the public communication line, perform a public basis comparison and estimate the error rate, and generate a private key on the edge computing gateway.

[0073] S2: The cloud data center initializes the model to obtain the abnormal traffic identification model, the Open Platform Communications Unified Architecture (OPC UA) information model of the CRRT equipment, the corresponding OPC UA instance, and the data analysis model. The data analysis model and OPC UA information model are then deployed to all edge computing gateways connected to the cloud data center. This includes the following steps:

[0074] S2-1: The cloud data center uses OPC UA information technology to build the corresponding OPC UA information model based on the physical information of the CRRT equipment;

[0075] S2-2: Based on the OPC UA information model, a corresponding OPC UA instance is created in the cloud data center, some historical CRRT equipment data is collected, and the first model metadata of the OPC UA information model is extracted;

[0076] S2-3: Based on some historical CRRT equipment data, use deep learning algorithms to build a data analysis model, generate some historical model parameter adjustment experiences, and extract the second model metadata of the data analysis model;

[0077] S2-3-1: The data analysis model is built based on the Graph Convolutional Network (GCN)-Multilayer Perceptron (MLP)-Continuous Learning Algorithm (CLA) algorithm. The data analysis model includes a graph structure feature extraction module based on the GCN algorithm, a data analysis module based on the MLP algorithm, and an experience replay pool based on the CLA algorithm.

[0078] Since the OPC UA information model includes several object nodes, attribute nodes, node relationships, and node attributes, the collected CRRT equipment data is graph-structured data. The GCN network performs feature propagation on the CRRT equipment data through operations similar to convolution, extracting the node features of the CRRT equipment data and the edge features between nodes to form the graph structure features of the CRRT equipment data; the MLP network, as a fully connected network, can accurately and efficiently predict labels based on weighted fusion features; the experience replay pool is a database that stores historical model training experience. Adding the experience pool allows the spatiotemporal resource analysis model to store and reuse past experience to improve learning efficiency; the experience replay pool is used for the model's interactive experience in the environment. The meta-learning experience form of these experiences is usually stored in the form of (s, a, r, s'), where s is the current state and the current model parameters of the model; a is the action taken, including model parameter adjustment, deletion, addition, etc.; r is the reward obtained, which is used to characterize the impact of the action on the state; and s' is the next state, that is, the state after the model parameters are adjusted during training.

[0079] S2-3-2: Based on some historical CRRT equipment data, use a deep learning algorithm to build a data analysis model, generate some historical model parameter adjustment experience, and extract the second model metadata of the data analysis model, including the following steps:

[0080] S2-3-3: Use the GCN-MLP algorithm to build an initial data analysis model, and input some historical CRRT equipment data to optimize and train the initial data analysis model to obtain an optimized data analysis model;

[0081] S2-3-4: Extract historical CRRT device data features and corresponding historical model parameters during the optimization training process, and generate historical model parameter adjustment experience based on the historical CRRT device data features and corresponding historical model parameters;

[0082] S2-3-5: Use the experience replay mechanism of the CLA algorithm to create an experience replay pool in the optimized data analysis model, and store several historical model parameter adjustment experiences in the experience replay pool;

[0083] S2-3-6: Use the elastic weight mechanism of the CLA algorithm to adjust the loss function of the optimized data analysis model with the experience replay pool, and obtain the final data analysis model with the adjusted loss function;

[0084] S2-4: Collect some historical access traffic data and use deep learning algorithms to build an abnormal traffic identification model based on the historical access traffic data;

[0085] The abnormal traffic identification model is built based on the Improved Sparrow Search Algorithm (ISSA)-LSTM algorithm, and includes a network parameter optimization module based on the ISSA algorithm and an abnormal traffic identification module based on the Long Short-Term Memory (LSTM) algorithm, which are connected in sequence.

[0086] The network parameter optimization module is used to optimize the initial parameters of the LSTM network during the training process, avoiding the defects of the LSTM network being sensitive to initial values and easily falling into local optimal values and being unable to escape, thereby improving the efficiency of model training and the accuracy of model prediction;

[0087] Collect some historical access traffic data and use deep learning algorithms to build an abnormal traffic identification model based on the data. The steps include:

[0088] S2-4-1: With minimizing the model error as the optimization goal, use the ISSA algorithm to build a network parameter optimization module;

[0089] S2-4-2: Use the LSTM algorithm to build an initial abnormal traffic identification module, and use the network parameter optimization module to optimize the initial parameters of the LSTM network in the initial abnormal traffic identification module to obtain an optimized abnormal traffic identification module, including the following steps:

[0090] S2-4-2-1: Use the LSTM algorithm to build an initial abnormal traffic identification module, and encode the initial parameters of the LSTM network in the initial abnormal traffic identification module as the positions of the ISSA individuals in the network parameter optimization module;

[0091] S2-4-2-2: Set the algorithm parameters and maximum number of iterations of the ISSA algorithm, and set the fitness function according to the optimization goal of the network parameter optimization module;

[0092] The formula is:

[0093] Fit(x) = minMSE(x)

[0094] Where Fit(x) is the fitness function; MSE is the mean square error function; x is the ISSA individual variable;

[0095] S2-4-2-3: Initialize using the Circle chaotic map sequence to obtain an initial ISSA population consisting of several initial ISSA individuals;

[0096] The formula is:

[0097]

[0098] Where, X' c is the initial ISSA individual of Circle chaotic mapping; X c * is the randomly generated initial ISSA individual; c is the ISSA individual indicator;

[0099] S2-4-2-4: Use the fitness function to obtain the initial fitness values of all initial ISSA populations, and sort the initial ISSA individuals according to the initial fitness values to obtain the initial discoverers, initial joiners, and initial predators;

[0100] S2-4-2-5: Update the initial ISSA population to obtain an updated ISSA population; the updated ISSA population includes updated discoverers, updated joiners, and updated predators;

[0101] The update formula of the discoverer is:

[0102]

[0103] Where, are the cth discoverer ISSA individuals of the t+1th and tth iterations respectively; iter maxis the maximum iteration threshold; ξ is a random number between 0 and 1; Q is a normally distributed random number; L is a 1×D matrix whose elements are all 1; R2 is the warning value; ST is the safety threshold;

[0104] The update formula for the joiner is:

[0105]

[0106] Where, are the cth joiner ISSA individuals in the t+1th and tth iterations respectively; The best position for those who reveal their identities; is the current worst position; iter max is the maximum iteration threshold; ξ is a random number between 0 and 1; L is a 1×D matrix whose elements are all 1 or -1; c is the sparrow indicator; h is the total number of ISSA individuals;

[0107] The update formula of the predator is:

[0108]

[0109] Where, are the c-th predator ISSA individuals in the t+1th and tth iterations respectively; δ is the step-size control parameter, and δ=a"·γ", where a" is the convergence factor and γ" is a non-zero positive real number for step-size control; is the current best position; f c 、f g 、f w are the current, best and worst fitness of the ISSA individual respectively; γ is the minimum constant to prevent the denominator from being 0;

[0110]

[0111] Where a" is the convergence factor; tanh(.) is the hyperbolic tangent function; t is the iteration indicator; t max is the maximum number of iterations; a max 、a min are the maximum and minimum values of the convergence factor respectively; λ is the decreasing rate parameter, k" is the decreasing period parameter, λ = -2π, k" = π;

[0112] S2-4-2-6: Use the fitness function to obtain the updated fitness value of the updated ISSA individual in the updated ISSA population, and obtain the optimal individual according to the updated fitness value;

[0113] S2-4-2-7: If the current number of iterations is greater than the maximum iteration test or the fitness value of the optimal individual is less than the fitness threshold, the position of the optimal individual is decoded to obtain the optimal initial parameters of the LSTM network;

[0114] S2-4-2-8: Optimize the initial abnormal traffic identification module based on the optimal initial parameters of the LSTM network to obtain an optimized abnormal traffic identification module;

[0115] S2-4-3: Input some historical access traffic data and optimize the abnormal traffic identification module to obtain the final abnormal traffic identification module;

[0116] S2-4-4: Integrate the network parameter optimization module and the final abnormal traffic identification module to obtain the abnormal traffic identification model;

[0117] S2-5: Send the first model metadata and the second model metadata to all edge computing gateways connected to the cloud data center;

[0118] S2-6: On the edge computing gateway side, reconstruct the model based on the first model metadata and the second model metadata to obtain a reconstructed data analysis model and a reconstructed OPC UA information model;

[0119] S3: The edge computing gateway uses the OPC UA communication protocol based on the OPC UA information model to collect real-time CRRT device data from CRRT devices within the communication range. It then uses the data analysis model to analyze the real-time CRRT device data and obtain the corresponding real-time data analysis results. This includes the following steps:

[0120] S3-1: Edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects real-time CRRT device data from CRRT devices within the communication range;

[0121] S3-2: Preprocessing the real-time CRRT device data to obtain preprocessed real-time CRRT device data, and inputting the preprocessed real-time CRRT device data into the data analysis model;

[0122] S3-3: using the graph structure feature extraction module of the data analysis model to extract the real-time CRRT device data features of the pre-processed real-time CRRT device data, and using the data analysis module to perform data analysis based on the real-time CRRT device data features to obtain corresponding real-time data analysis results;

[0123] S3-4: If the real-time data analysis result shows that there is data anomaly, the corresponding pre-processed real-time CRRT device data is deleted and data collection is performed again. Otherwise, proceed to the next step;

[0124] S3-5: Extract the real-time model parameters of the data analysis model and generate real-time model parameter adjustment experience based on the real-time model parameters and real-time CRRT equipment data characteristics;

[0125] S3-6: Randomly extract a number of historical model parameter adjustment experiences and mix them with the real-time model parameter adjustment experiences to obtain a number of mixed model parameter adjustment experiences;

[0126] S3-7: Based on the experience of adjusting parameters of the hybrid model, the data analysis model is updated to obtain an updated data analysis model, and the next data analysis is waited for;

[0127] Since the experiences in the experience replay pool are randomly sampled, this helps break the correlation between consecutive experiences, thereby reducing the variance in model training. By reusing experiences, the model can learn more from limited experiences, which is especially useful when new data or samples are scarce. Experience replay helps stabilize the learning process and reduce fluctuations during training. The size of the experience replay pool is regularly checked. If it exceeds the preset capacity, some experiences are removed according to preset strategies (such as priority sampling and the longest unvisited area).

[0128] S4: The edge computing gateway encrypts and signs the real-time CRRT device data based on the private key and signature information of the CRRT device, and uploads the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center, including the following steps:

[0129] S4-1: The edge computing gateway encrypts the real-time CRRT device data according to the private key of the CRRT device to obtain the encrypted real-time CRRT device data;

[0130] S4-2: Sign the encrypted real-time CRRT device data according to the signature information of the CRRT device to obtain corresponding real-time signature data;

[0131] S4-3: Upload the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center;

[0132] S5: The cloud data center calls the trusted organization to authenticate the real-time signature data. After the authentication is passed, the cloud data center obtains the public key of the edge computing gateway controlled by the trusted organization and decrypts the encrypted real-time CRRT device data based on the public key to obtain the decrypted real-time CRRT device data. The steps include:

[0133] S5-1: The cloud data center receives the real-time signature data sent by the edge computing gateway and sends the real-time signature data to the trusted organization;

[0134] S5-2: On the trusted institution side, the identity authentication tool is called to authenticate the real-time signature data. If the identity authentication is successful, the public key of the corresponding edge computing gateway is extracted from the controlled database and the next step is entered. Otherwise, the corresponding encrypted real-time CRRT device data and real-time data analysis results are blocked;

[0135] S5-3: After identity authentication is passed, the corresponding encrypted real-time CRRT device data and real-time data analysis results sent by the edge computing gateway are received, and the public key of the edge computing gateway sent by the trusted organization is received;

[0136] S5-4: Decrypting the encrypted real-time CRRT device data according to the public key to obtain the decrypted real-time CRRT device data;

[0137] S6: The cloud data center writes the decrypted real-time CRRT device data to the corresponding OPC UA instance, collects the real-time access traffic data during the data writing process, and uses the abnormal traffic identification model to identify abnormal traffic in the real-time access traffic data to obtain the real-time abnormal traffic identification results, including the following steps:

[0138] S6-1: The cloud data center writes the decrypted real-time CRRT device data to the corresponding OPC UA instance in the OPC UA server;

[0139] S6-2: Collecting real-time access traffic data during the data writing process and inputting the real-time access traffic data into the abnormal traffic identification model;

[0140] S6-3: using the abnormal traffic identification module of the abnormal traffic identification model to extract real-time access traffic data features of the real-time access traffic data, and performing abnormal traffic identification based on the real-time access traffic data features to obtain a real-time abnormal traffic identification result;

[0141] S6-4: If the real-time abnormal traffic identification result is that abnormal traffic exists, a corresponding real-time alarm signal is generated, the real-time alarm signal is visualized, and the corresponding decrypted real-time CRRT device data and real-time data analysis results are deleted. Otherwise, wait for the next abnormal traffic identification.

[0142] Example 2:

[0143] like Figure 2 As shown, this embodiment provides a secure collection system for CRRT equipment data, which is used to implement a secure collection method. The system includes a cloud data center, a trusted organization, and several edge computing gateways. The cloud data center and the trusted organization are respectively connected to the several edge computing gateways, and the cloud data center is connected to the trusted organization;

[0144] The trusted authority is responsible for generating a public-private key pair and signature information for each edge computing gateway, returning the signature information to the corresponding edge computing gateway, storing the public key in the public-private key pair in a locally controlled manner, and returning the private key in the public-private key pair to the corresponding edge computing gateway using QKD technology;

[0145] The cloud data center is used to initialize the model, obtain the abnormal traffic identification model, the OPC UA information model of the CRRT equipment, the corresponding OPC UA instance and the data analysis model, and deploy the data analysis model and the OPC UA information model to all edge computing gateways connected to the cloud data center; call the trusted organization to authenticate the real-time signature data. After the authentication is passed, obtain the public key of the edge computing gateway controlled by the trusted organization, and decrypt the encrypted real-time CRRT equipment data based on the public key to obtain the decrypted real-time CRRT equipment data; write the decrypted real-time CRRT equipment data to the corresponding OPC UA instance, collect the real-time access traffic data during the data writing process, and use the abnormal traffic identification model to perform abnormal traffic identification on the real-time access traffic data to obtain the real-time abnormal traffic identification result;

[0146] The edge computing gateway is used to collect real-time CRRT device data of CRRT devices within the communication range based on the OPC UA information model and the OPC UA communication protocol, and use the data analysis model to analyze the real-time CRRT device data to obtain corresponding real-time data analysis results; according to the private key and signature information of the CRRT device, the real-time CRRT device data is encrypted and signed, and the real-time data analysis results, the encrypted real-time CRRT device data and the corresponding real-time signature data are uploaded to the cloud data center.

[0147] The present invention discloses a method and system for securely collecting CRRT equipment data. The method adopts QKD technology for key distribution, which is almost impossible to be intercepted or cracked, thereby ensuring the credibility of the key. Combined with asymmetric encryption algorithm and digital identity authentication technology, the data security and the protection level of the cloud data center are improved, and data leakage and tampering are effectively prevented. Combined with the edge-cloud collaboration mechanism, data processing and analysis are decentralized to the edge computing gateway, which reduces the data storage and processing pressure of the cloud data center, avoids network congestion or hardware crash, and improves the reliability of data collection. By constructing a unified OPC UA information model, standardized conversion between different CRRT equipment data sources is achieved, the data processing process is simplified, and processing efficiency is improved. The data analysis model processes CRRT equipment data in real time and efficiently, improves the response speed and data processing capability, and an abnormal traffic identification model is set in the cloud data center to identify abnormal traffic, further improving data security.

[0148] The present invention is not limited to the above optional embodiments. Anyone can derive various other forms of products based on the teachings of the present invention. The above specific embodiments should not be construed as limiting the scope of protection of the present invention. The scope of protection of the present invention shall be based on the scope defined in the claims, and the description can be used to interpret the claims.

Claims

1. A method for securely collecting CRRT equipment data, characterized by: The steps include: The trusted institution generates a public-private key pair and signature information for each edge computing gateway, returns the signature information to the corresponding edge computing gateway, stores the public key in the public-private key pair in a locally controlled manner, and uses QKD technology to return the private key in the public-private key pair to the corresponding edge computing gateway; The cloud data center initializes the model to obtain the abnormal traffic identification model, the OPC UA information model of the CRRT equipment, the corresponding OPC UA instance, and the data analysis model. The data analysis model and OPC UA information model are then deployed to all edge computing gateways connected to the cloud data center. The edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects real-time CRRT device data from CRRT devices within the communication range and uses the data analysis model to analyze the real-time CRRT device data to obtain corresponding real-time data analysis results. The edge computing gateway encrypts and signs the real-time CRRT device data based on the private key and signature information of the CRRT device, and uploads the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center; The cloud data center calls the trusted organization to authenticate the real-time signature data. After the authentication is passed, the cloud data center obtains the public key of the edge computing gateway controlled by the trusted organization and decrypts the encrypted real-time CRRT device data based on the public key to obtain the decrypted real-time CRRT device data. The cloud data center writes the decrypted real-time CRRT equipment data into the corresponding OPC UA instance, collects the real-time access traffic data during the data writing process, and uses the abnormal traffic identification model to identify abnormal traffic in the real-time access traffic data to obtain real-time abnormal traffic identification results.

2. The method for securely collecting CRRT equipment data according to claim 1, characterized in that: The trusted institution generates a public-private key pair and signature information for each edge computing gateway, returns the signature information to the corresponding edge computing gateway, stores the public key in the public-private key pair locally under controlled storage, and uses QKD technology to return the private key in the public-private key pair to the corresponding edge computing gateway, including the following steps: The trusted institution collects the gateway identity information of all edge computing gateways communicating with the cloud data center, and uses an asymmetric key generation algorithm to generate a public-private key pair for each edge computing gateway based on the gateway identity information; Based on the gateway identity information and the private key in the public-private key pair, use the digital identity registration algorithm to generate the corresponding edge computing gateway signature information; Confirm the public communication line and quantum communication line between the trusted institution and each edge computing gateway, and return the signature information to the corresponding edge computing gateway through the public communication line; The public key in the public-private key pair is stored in a local controlled database, and the private key in the public-private key pair is returned to the edge computing gateway through a quantum communication line using QKD technology.

3. The method for securely collecting CRRT equipment data according to claim 2, characterized in that: The public key in the public-private key pair is stored in a local controlled database, and the private key in the public-private key pair is returned to the edge computing gateway via a quantum communication line using QKD technology. This includes the following steps: The trusted institution stores the public key in the public-private key pair in a local controlled database and sets up identity authentication tools for the controlled database; Using QKD technology, the private key in the public-private key pair is converted into a private key quantum state, the private key quantum state is sent to the corresponding edge computing gateway through a quantum communication line, and the private key quantum state is measured to obtain a first measurement result; Through a public communication line, the first measurement result is compared with the second measurement result obtained by measuring the private key quantum state on the edge computing gateway side for public basis vector comparison and error rate estimation, and a private key is generated on the edge computing gateway side.

4. The method for securely collecting CRRT equipment data according to claim 3, wherein: The cloud data center initializes the model to obtain the abnormal traffic identification model, the OPC UA information model of the CRRT equipment, the corresponding OPC UA instance, and the data analysis model. The data analysis model and OPC UA information model are then deployed to all edge computing gateways connected to the cloud data center. This includes the following steps: The cloud data center uses OPC UA information technology to build the corresponding OPC UA information model based on the physical information of the CRRT equipment. Based on the OPC UA information model, a corresponding OPC UA instance is created in the cloud data center, some historical CRRT equipment data is collected, and the first model metadata of the OPC UA information model is extracted; Based on some historical CRRT equipment data, a deep learning algorithm is used to build a data analysis model, generate some historical model parameter adjustment experience, and extract the second model metadata of the data analysis model; Collect some historical access traffic data and use deep learning algorithms to build an abnormal traffic identification model based on the historical access traffic data; Sending the first model metadata and the second model metadata to all edge computing gateways in communication with the cloud data center; On the edge computing gateway side, the model is reconstructed according to the first model metadata and the second model metadata to obtain a reconstructed data analysis model and a reconstructed OPC UA information model.

5. The method for securely collecting CRRT equipment data according to claim 4, characterized in that: The data analysis model is constructed based on the GCN-MLP-CLA algorithm, and the data analysis model includes a graph structure feature extraction module constructed based on the GCN algorithm, a data analysis module constructed based on the MLP algorithm, and an experience replay pool constructed based on the CLA algorithm, which are connected in sequence; The abnormal traffic identification model is constructed based on the ISSA-LSTM algorithm, and the abnormal traffic identification model includes a network parameter optimization module constructed based on the ISSA algorithm and an abnormal traffic identification module constructed based on the LSTM algorithm, which are connected in sequence.

6. The method for securely collecting CRRT equipment data according to claim 5, characterized in that: The edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects real-time CRRT device data from CRRT devices within the communication range and uses the data analysis model to analyze the real-time CRRT device data to obtain the corresponding real-time data analysis results. The steps include: The edge computing gateway, based on the OPC UA information model and using the OPC UA communication protocol, collects real-time CRRT device data from CRRT devices within the communication range; Preprocessing the real-time CRRT device data to obtain preprocessed real-time CRRT device data, and inputting the preprocessed real-time CRRT device data into a data analysis model; Using a data analysis model, extracting real-time CRRT device data features of pre-processed real-time CRRT device data, and performing data analysis based on the real-time CRRT device data features to obtain corresponding real-time data analysis results; If the real-time data analysis result shows that there is data anomaly, the corresponding pre-processed real-time CRRT device data is deleted and data collection is performed again. Otherwise, proceed to the next step; Extract the real-time model parameters of the data analysis model and generate real-time model parameter adjustment experience based on the real-time model parameters and real-time CRRT equipment data characteristics; Randomly extract a number of historical model parameter adjustment experiences and mix them with the real-time model parameter adjustment experiences to obtain a number of mixed model parameter adjustment experiences; According to the experience of adjusting the parameters of several hybrid models, the data analysis model is updated to obtain an updated data analysis model, and wait for the next data analysis.

7. The method for securely collecting CRRT equipment data according to claim 3, characterized in that: The edge computing gateway encrypts and signs the real-time CRRT device data based on the private key and signature information of the CRRT device, and uploads the real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data to the cloud data center, including the following steps: The edge computing gateway encrypts the real-time CRRT device data according to the private key of the CRRT device to obtain the encrypted real-time CRRT device data; According to the signature information of the CRRT device, the encrypted real-time CRRT device data is signed to obtain the corresponding real-time signature data; The real-time data analysis results, the encrypted real-time CRRT device data, and the corresponding real-time signature data are uploaded to the cloud data center.

8. The method for securely collecting CRRT equipment data according to claim 3, characterized in that: The cloud data center calls the trusted organization to authenticate the real-time signature data. After the authentication is passed, the cloud data center obtains the public key of the edge computing gateway controlled by the trusted organization and decrypts the encrypted real-time CRRT device data based on the public key to obtain the decrypted real-time CRRT device data. The steps include: The cloud data center receives the real-time signature data sent by the edge computing gateway and sends the real-time signature data to the trusted organization; On the trusted institution side, the identity authentication tool is called to authenticate the real-time signature data. If the identity authentication is successful, the public key of the corresponding edge computing gateway is extracted from the controlled database and the next step is entered. Otherwise, the corresponding encrypted real-time CRRT device data and real-time data analysis results are blocked. After identity authentication is passed, the corresponding encrypted real-time CRRT device data and real-time data analysis results sent by the edge computing gateway are received, and the public key of the edge computing gateway sent by the trusted organization is received; The encrypted real-time CRRT device data is decrypted according to the public key to obtain the decrypted real-time CRRT device data.

9. The method for securely collecting CRRT equipment data according to claim 5, characterized in that: The cloud data center writes the decrypted real-time CRRT device data to the corresponding OPC UA instance, collects the real-time access traffic data during the data writing process, and uses the abnormal traffic identification model to identify abnormal traffic in the real-time access traffic data, obtaining the real-time abnormal traffic identification results, including the following steps: The cloud data center writes the decrypted real-time CRRT device data to the corresponding OPC UA instance in the OPC UA server; Collect real-time access traffic data during the data writing process and input the real-time access traffic data into the abnormal traffic identification model; Using an abnormal traffic identification model, extracting real-time access traffic data features of the real-time access traffic data, and performing abnormal traffic identification based on the real-time access traffic data features to obtain a real-time abnormal traffic identification result; If the real-time abnormal traffic identification result is that abnormal traffic exists, a corresponding real-time alarm signal is generated, the real-time alarm signal is visualized, and the corresponding decrypted real-time CRRT device data and real-time data analysis results are deleted. Otherwise, wait for the next abnormal traffic identification.

10. A secure data collection system for CRRT equipment, used to implement the secure data collection method according to any one of claims 1 to 9, characterized in that: The system includes a cloud data center, a trusted organization and several edge computing gateways. The cloud data center and the trusted organization are respectively connected to the several edge computing gateways in communication, and the cloud data center is connected to the trusted organization in communication.

Images