P4-based medical information intelligent hierarchical control system and method

Abstract

The invention discloses a P4-based medical information intelligent hierarchical control system and method, and the method comprises the steps: S1, analyzing a transmitted HL7 message, and extracting key information, including an MAC address, an IP address and HL7 user information, from the HL7 message by an analysis module in a data plane; s2, executing an access control function, and matching by using a white list and a black list in the access control form; s3, allocating the bandwidth based on the emergency degree, matching the emergency level form, and obtaining the priority of the corresponding bandwidth allocation; s4, executing a dynamic encryption strategy, and distinguishing the users with different permission levels through specified fields in the MAC address, the IP address and the HL7 information; and S5, performing HL7 data encapsulation to ensure that the message structure is complete, and recalculating the checksum of the message by a data plane to ensure that the message conforms to a protocol specification. Intelligent identification, dynamic priority control and privacy protection can be carried out on the HL7 message, and the requirements of medical scenes for high efficiency, safety and interconnection and intercommunication are met.

Description

Technical Field

[0001] The present invention belongs to the technical field of intelligent classification of medical information, and in particular, relates to a medical information intelligent classification control system and method based on P4. Background Art

[0002] The HL7 (Health Level Seven) protocol is an international standard for medical information exchange, which is widely used in medical scenarios to transmit sensitive content such as patient data and diagnostic information. With the development of intelligent medical equipment and the promotion of the HL7 FHIR (Fast Healthcare Interoperability Resources) standard, the HL7 protocol plays an increasingly important role in the interconnection and interoperability of medical information, providing technical support for improving medical efficiency and patient care quality.

[0003] In medical scenarios, traditional switches cannot recognize HL7 messages, nor can they implement communication priority control, identity classification processing, and dynamic encryption protection, which hinders the further development of medical informatization. Specifically, the following problems are involved:

[0004] (1) Privacy and security issues in medical data transmission:

[0005] HL7 messages often contain sensitive patient information, such as name, ID number, diagnosis results, etc. Traditional network devices cannot effectively encrypt and protect these sensitive data, which can easily lead to data leakage. How to encrypt and protect the privacy of HL7 data during transmission while meeting the real-time and high-efficiency requirements of medical scenarios is a key issue.

[0006] (2) Priority control of department flow:

[0007] Different medical departments have different requirements for communication bandwidth and priority. For example, ICU and operating rooms have higher requirements for real-time and reliability, while general departments have relatively low traffic requirements. Traditional switches cannot recognize department information in HL7 messages and cannot dynamically adjust communication priority and bandwidth allocation. When the network is congested, it may cause delays or interruptions in critical medical traffic.

[0008] (3) Identity classification and transmission control issues:

[0009] In a medical environment, the identities of both the sender and the receiver (such as doctors, nurses, and equipment) have hierarchical permissions, and different identities have different access rights and operation requirements for HL7 messages. For example, high-authority users need to fully access HL7 messages in order to carry out timely medical treatment; when medical data is used for scientific research and analysis, it is not necessary to know specific user names and medical record numbers; access to unauthorized IP addresses or low-authority users should be denied. Traditional switches cannot identify the identity information of both the sender and the receiver, and cannot dynamically adjust data transmission strategies based on identity levels.

[0010] (4) Cross-device compatibility issues:

[0011] Although HL7 is an international standard, there may be differences in the protocol implementation between devices from different manufacturers, resulting in a large amount of integration and debugging work for the interconnection of medical information. How to solve this compatibility problem through intelligent network devices and improve the interoperability between devices is a difficult problem that needs to be solved in the integration process.

[0012] To address these issues, there is an urgent need for an innovative solution that can intelligently identify HL7 messages, dynamically control priorities, and protect privacy, in order to meet the needs of medical scenarios for efficiency, security, and interoperability. Summary of the invention

[0013] The purpose of the present invention is to provide a medical information intelligent hierarchical control system and method based on P4. The SDN switch based on P4 has powerful data plane programmability. Through flexible parsing, matching and action mechanisms, it can efficiently complete the intelligent identification, dynamic classification, priority control and privacy protection of HL7 messages. Combined with the specific needs of medical scenarios, the P4 switch can achieve accurate processing of HL7 messages in a high-performance and low-latency manner, while enhancing the security and scalability of the system. It solves the limitations of traditional switches in medical scenarios, and can also provide strong technical support for the future development of medical informatization through the collaborative design of data and control planes.

[0014] In order to solve the above problems, the present invention discloses a medical information intelligent hierarchical control method based on P4, which can intelligently identify HL7 messages, dynamically control priorities and protect privacy, and meet the requirements of medical scenarios for efficiency, security and interconnection; including:

[0015] S1. Parse the transmitted HL7 message;

[0016] S2, perform access control functions;

[0017] S3, allocate bandwidth based on urgency;

[0018] S4, execute dynamic encryption strategy;

[0019] S5, HL7 data encapsulation;

[0020] S6. Intelligent management of control plane.

[0021] Preferably, the parsing of the transmitted HL7 message includes:

[0022] The parsing module in the data plane extracts key information from the message, including MAC address, IP address, and fields such as department information, patient information, and examination items in HL7. Department information, patient information, and examination items in HL7 are collectively referred to as HL7 user information.

[0023] Preferably, the performing of the access control function includes:

[0024] Based on the MAC address, IP address, and HL7 user information of the sender and receiver, the whitelist and blacklist in the access control form are used for matching. If the packet is on the whitelist, it is allowed to proceed to the next step; if it is on the blacklist, the packet is directly discarded; if the identity information cannot be confirmed, it is marked as "pending verification" and sent to the control plane for further authentication.

[0025] The allocating bandwidth based on urgency includes:

[0026] According to the parsed identity information, the emergency level form is matched to obtain the department priority; the data plane allocates the traffic to the corresponding forwarding queue according to the priority; the control plane dynamically adjusts the emergency level form through the real-time traffic monitoring module to ensure the real-time nature of traffic distribution.

[0027] The execution of the dynamic encryption strategy includes:

[0028] Based on the MAC address, IP address, and HL7 user information of both the sender and the receiver, different identity permissions are obtained. Sensitive fields in the HL7 message are identified in the data plane, and the following operations are performed according to different permissions: For high-authority identities, the original HL7 data is directly transmitted without processing; for medium-authority identities, sensitive fields are encrypted; for low-authority or unauthorized identities: the message is discarded or all sensitive fields are shielded. The processing results of sensitive fields are directly passed to the next encapsulation module.

[0029] The HL7 data package includes:

[0030] Ensure that the message structure is complete, recalculate the message checksum on the data plane, ensure that the message complies with the HL7 protocol specifications, and send the reorganized message to the target device or system.

[0031] It also includes intelligent management of the control plane, which includes protocol adaptation, monitoring statistics and form management;

[0032] The protocol adaptation parsing adaptation rules support the parsing module to process different versions of HL7 messages, and at the same time guide the encapsulation module to complete field mapping, message completion and priority marking to ensure the collaborative work of parsing and encapsulation.

[0033] Monitoring statistics: Analyze traffic and access behavior through the monitoring statistics module to optimize bandwidth allocation strategies and sensitive field processing rules;

[0034] Form management includes:

[0035] Dynamic management of access control forms, updating blacklists based on abnormal access behaviors, limiting malicious traffic, dynamically adding legitimate identities to whitelists, and reducing subsequent matching delays;

[0036] The emergency level form is dynamically updated, and the priority of departments is dynamically adjusted by monitoring the traffic status;

[0037] Encryption policy form management, update different permission identities, and define sensitive information fields.

[0038] The present invention also discloses a medical information intelligent hierarchical control system based on P4, comprising: a control plane and a data plane, wherein the control plane comprises a protocol adaptation module, a monitoring statistics module and a form management module, and the data plane comprises a parsing module, a hierarchical processing module and an encapsulation module in sequence;

[0039] The protocol adaptation module provides parsing rules for the parsing module, which is used for parsing and adapting different versions of HL7 protocols and supporting different field mapping and conversion;

[0040] The protocol adaptation module provides encapsulation rules for the encapsulation module to ensure the protocol integrity of the sent information;

[0041] The form management module provides the classification processing module with an intelligent classification processing basis and controls the data plane behavior through the rule table;

[0042] The monitoring and statistics module is used to track the information of the statistical analysis module, and perform data analysis and processing on it to obtain the optimization strategy, and update the optimization strategy to the form management module. The hierarchical processing module includes an identity recognition unit, a bandwidth guarantee unit, and a sensitive field processing unit. The form management module includes an access control form, an emergency level form, and an encryption policy form.

[0043] The access control form is maintained and managed by the control plane; the access control form conveys the control policy to the data plane through a distribution mechanism, and the identity recognition unit performs corresponding processing actions according to the received access control form content.

[0044] The emergency level form is maintained and managed by the control plane; the emergency level form conveys the control strategy to the data plane through a distribution mechanism, and the bandwidth guarantee unit performs corresponding processing actions according to the content of the received emergency level form.

[0045] The encryption policy form is maintained and managed by the control plane; the encryption policy form conveys the control policy to the data plane through a distribution mechanism, and the sensitive field processing unit performs corresponding processing actions based on the received encryption policy form content.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] Improve data processing efficiency: Through the P4 custom parser, the present invention can efficiently process complex HL7 messages, increase the speed of data transmission and processing, and gain valuable time for medical treatment.

[0048] Ensure data security and privacy: The present invention can perform real-time encryption and privacy protection on sensitive information, effectively preventing leakage of patient information, and meeting the data security requirements of the medical industry.

[0049] Optimize network resource allocation: Dynamic classification and priority control functions give priority to key medical traffic, improve the utilization efficiency of network resources, and ensure the continuity and stability of medical services.

[0050] Enhance system compatibility and scalability: The flexibility of the P4 language enables the switch to adapt to different HL7 versions and vendor equipment, providing good technical support for medical information construction.

[0051] Improve the quality of medical services: Through real-time and performance assurance, the present invention helps to improve the collaborative efficiency between medical devices and systems, and further improve the quality of medical services.

[0052] Simplified network management: The data plane and control plane of the P4 switch work together to make network management more flexible and efficient, reducing the complexity and cost of network maintenance.

[0053] Promoting the development of medical informatization: The application of P4 language provides new solutions for medical informatization, which helps to promote technological innovation and business development in the medical industry.

[0054] In short, the application of this invention in medical scenarios not only improves data processing efficiency and network resource utilization, but also ensures data security and privacy, providing strong technical support for the construction of medical informatization. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a block diagram of the intelligent hierarchical control system of the present invention;

[0056] Figure 2 It is a data flow diagram of the present invention. DETAILED DESCRIPTION

[0057] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods.

[0058] In the description of the present invention, it should be noted that the terms "upper", "lower", "inner", "outer", "front end", "rear end", "two ends", "one end", "the other end" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance.

[0059] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "provided with", "connected", etc. should be understood in a broad sense. For example, "connected" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0060] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0061] like Figure 1 and Figure 2 As shown, the present invention discloses a medical information intelligent hierarchical priority control method based on a P4 programmable switch, comprising the following steps:

[0062] (1) Parse the transmitted HL7 message in the P4 programmable switch and identify the department information, equipment information, and sensitive fields in the HL7 segment.

[0063] (2) Based on the identified information, access control is performed.

[0064] (3) Dynamically allocate communication bandwidth and priority based on emergency level.

[0065] (4) Implement differentiated encryption strategies for HL7 sensitive messages based on permission levels.

[0066] (5) HL7 data is encapsulated and sent.

[0067] (6) The control plane is responsible for protocol adaptation, monitoring statistics and form management.

[0068] Through the above mechanism, the security, real-time and priority guarantee of HL7 information transmission can be achieved in the medical environment. This method can improve the security and network performance of medical information transmission, and is particularly suitable for scenarios such as ICU and operating room with high bandwidth and latency requirements.

[0069] The following is a detailed description of the above steps:

[0070] Step 1: Parse the data packet and extract key information.

[0071] The parsing module in the data plane extracts key information from the received data packets. In addition to the source / destination MAC address, IP address, port number and other information, according to the HL7 protocol rules, it parses key information such as department information (MSH segment), equipment ID, user identity (PID segment), and sensitive fields (such as patient name, ID number, diagnosis information, etc.).

[0072] The control plane protocol adaptation module is used to parse adaptation rules of different versions of HL7 protocols and support different field mapping and conversion.

[0073] The P4 language supports custom parsers that can deeply parse the HL7 data structure in the TCP payload, including message segments (such as MSH, PID, OBX, etc.) as well as fields and subfields. Messages of the HL7 protocol are characterized by delimiters (such as |, ^, &, etc.). By defining parsing rules in the P4 program, key fields such as department information, patient information, and diagnosis results can be quickly extracted. With the high-speed parsing capabilities of P4 programmable devices, sensitive content in HL7 messages can be identified in real time and used as the basis for subsequent operations (such as priority control or encryption processing).

[0074] Step 2: Identification, determine the source and destination of the data packet.

[0075] Based on the MAC address, IP address, HL7 user information of both parties, the whitelist and blacklist in the access control table are used for matching. If it belongs to the whitelist, it is allowed to proceed to the next step. If it belongs to the blacklist, the data packet is directly discarded. If the identity information cannot be confirmed, it is marked as "pending verification" and sent to the control plane for further authentication.

[0076] Access Control Form:

[0077] Including whitelist and blacklist:

[0078] (1) Whitelist: includes legal IP addresses, MAC addresses, and custom fields in HL7.

[0079] (2) Blacklist: includes MAC addresses or IP addresses of malicious access or custom fields in HL7.

[0080] Table 1 Access Control Form

[0081]

[0082] -- indicates any value, which does not affect the policy. The corresponding action policy is obtained only when all fields are satisfied. The combination of fields and values ​​in HL7 information is customized through programmable switches, and conventional switches do not have this function.

[0083] Step 3: Identity-based bandwidth guarantee.

[0084] Dynamically allocate bandwidth or adjust priority based on the parsed identity information and department priority. The data plane allocates traffic to the corresponding forwarding queue (such as high priority queue or low priority queue) based on the emergency level form. The control plane dynamically adjusts the emergency level form rules through the real-time traffic monitoring module to ensure the real-time nature of traffic distribution.

[0085] Emergency level form:

[0086] The control plane maintains and issues corresponding rules through the interface, which are read by the data plane for dynamic traffic scheduling.

[0087] (1) Highest level (such as ICU, operating room): allocate the maximum bandwidth and forwarding priority.

[0088] (2) General level (such as general departments): regular bandwidth is allocated and forwarded according to normal priority.

[0089] (3) Lowest level (such as non-critical traffic): bandwidth is limited and the priority is the lowest.

[0090] Table 2 Emergency Level Table

[0091]

[0092]

[0093] The number 0 indicates the highest priority. When network congestion occurs, the data plane can execute a scheduling algorithm to guarantee bandwidth for high-priority services based on the priority.

[0094] Step 4: Protect privacy and secure sensitive fields

[0095] Identify sensitive fields in HL7 messages (such as name, ID number, diagnosis results) in the data plane.

[0096] The following operations are performed according to the identity classification rules. For high-authority identities, the original HL7 data is directly transmitted without processing. For medium-authority identities, encryption or obfuscation processing (such as AES encryption or partial mask processing) is performed on sensitive fields. Low-authority or unauthorized identities: discard the message or mask all sensitive fields. The sensitive field processing results are directly passed to the next step of the encapsulation module.

[0097] Encryption policy form:

[0098] (1) High-authority identities: such as doctors and nurses on duty.

[0099] (2) Medium-authority identity: such as scientific research data sampling, doctors and nurses from non-related departments, etc. High-authority users outside the hospital intranet are downgraded to medium-authority identities when accessing.

[0100] (3) Low-privilege or unauthorized identity.

[0101] Table 3 Encryption policy form

[0102]

[0103] The permission level to which the fields of MAC address, IP address or HL7 information belong, as well as the identification of encrypted fields, can be customized by the programmable switching device.

[0104] The data plane programmable device uses the P4 language to dynamically process specific fields of HL7 messages, such as encrypting, obfuscating, or adding noise to sensitive fields (such as patient name and ID number). The dynamic encryption logic of sensitive fields can be completed by calling external encryption modules (such as AES or RSA), while obfuscation or noise can be completed directly in the data plane without additional processing delays. Through these mechanisms, P4 switches can protect data privacy and prevent sensitive information leakage while ensuring data real-time performance.

[0105] Step 5: Packaging and sending

[0106] The HL7 message after encapsulation on the data plane can ensure the integrity of the message structure (including delimiters, segments, fields, etc.). The data plane recalculates the message checksum (such as length or integrity check) to ensure that the message complies with the protocol specification. The reorganized message is sent to the target device or system.

[0107] Step 6: Intelligent management of control plane

[0108] Provides dynamic rule updates, abnormal traffic detection and global security management, including protocol adaptation module, form management module, statistics and audit module.

[0109] (1) Protocol Adaptation Module

[0110] The control plane protocol adaptation module generates parsing rules and encapsulation rules to ensure that the system can flexibly adapt to different versions of the HL7 protocol, achieve correct parsing and complete encapsulation of data, and ensure efficient interaction and accurate transmission of HL7 information.

[0111] (2) Form Management Module

[0112] Dynamic management of access control lists: The control plane updates the blacklist based on abnormal access behaviors (such as high-frequency requests or illegal IP addresses) to limit malicious traffic. Legitimate identities are dynamically added to the whitelist to reduce subsequent matching delays.

[0113] Dynamic update of emergency level forms: Monitor traffic status through the control plane and dynamically adjust the priority of departments (such as further increasing the priority of ICU during peak traffic).

[0114] Encryption policy form management: timely update based on statistics and configuration information.

[0115] (3) Monitoring and statistics module:

[0116] The control plane uses the monitoring statistics module to analyze traffic and access behavior, optimize bandwidth allocation strategies and sensitive field processing rules, and record abnormal access for analysis.

[0117] Specific examples:

[0118] Step 1: Identify and parse the HL7 message

[0119] (1) Listening to TCP ports and parsing TCP messages

[0120] Implement TCP listening on the specified port and receive the transmitted data packets. In addition to parsing the MAC address and IP address, extract the payload part and enter the HL7 protocol processing flow.

[0121] (2) Identify HL7 information

[0122] Typically, an HL7 message begins with the MSH (Message Header) field, and the HL7 message is identified by detecting whether the data stream contains HL7 standard separators (such as | and ^).

[0123] (3) Parsing HL7 message structure

[0124] According to the HL7 version (such as v2.x), parse the hierarchical structure of the message, including segments, fields, and subfields, and extract the data that needs to be processed.

[0125] Step 2: Implement access control

[0126] If the identified MAC address, IP address, and HL7 user information are matched and meet the whitelist, the corresponding data plane processing rule is to allow it to proceed to the next step; if it belongs to the blacklist, the data packet is directly discarded.

[0127] If a device or user attempts to send an unauthorized HL7 message over the network, such as from an unknown IP address or unauthorized device, it is marked as "pending verification" and sent to the control plane for further authentication. Before obtaining access authorization, the data plane directly discards the traffic and records the log to send to the control plane for subsequent analysis.

[0128] The whitelist and blacklist are set by the user through the control plane and dynamically configured through the analysis results of the monitoring statistics module.

[0129] Step 3: Identity-based bandwidth guarantee

[0130] For example, the imaging equipment in the operating room needs to transmit real-time surgical imaging data to assist doctors in performing precise operations. At this time, the department information parsed in the HL7 message header (MSH segment) is "operating room".

[0131] (1) In the emergency level table, "Operating Room" is matched as medium priority traffic.

[0132] (2) The data plane allocates the traffic to the medium priority queue and limits the bandwidth usage of general department traffic to ensure the transmission of operating room imaging data.

[0133] (3) If the flow rate in the operating room increases further, the control plane dynamically adjusts the flow rules to postpone the processing of some low-priority flows.

[0134] Ultimately, real-time imaging data in the operating room is guaranteed without lag or delay, supporting the smooth progress of the surgery.

[0135] Step 4: Sensitive fields processing

[0136] The following three types of processing are performed on sensitive fields in HL7 messages (such as patient name, address, ID number, etc.) (one or more combinations can be used):

[0137] (1) Encryption:

[0138] Encrypt sensitive fields using symmetric encryption (such as AES) or asymmetric encryption (such as RSA). Ensure key security and support decryption process for subsequent processing.

[0139] (2) Noise Addition

[0140] Inject random noise into numeric or date fields (e.g., increase or decrease the patient's date of birth by a random number of days). Ensure that the data after adding noise is still within the allowed range.

[0141] (3) Data Masking

[0142] Replace some characters of sensitive fields (e.g., obscure "Zhang San" as "Zhang *" or "Z **"). For structured data (such as ID numbers), retain its format but mask some content (e.g., "123456****90").

[0143] Step 5: Reassemble the HL7 message

[0144] (1) Reconstruct the HL7 message

[0145] Re-insert the processed sensitive fields into the original HL7 message to ensure the integrity of the message structure.

[0146] (2) Verify the integrity of the HL7 message

[0147] According to the HL7 standard, recalculate the check value (such as message length or checksum) to ensure that the message complies with the protocol specifications.

[0148] The above are only embodiments of the present invention. Specific structures and characteristics and other common knowledge well known in the art are not described in detail here. For those skilled in the art, it is obvious that the present invention is not limited to the details of the above exemplary embodiments, and can be implemented in other specific forms without departing from the spirit or basic characteristics of the present invention. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-limiting. The scope of the present invention is defined by the appended claims rather than the above description. Therefore, all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be included in the present invention. Any reference signs in the claims should not be construed as limiting the claimed invention.

Claims

1. A medical information intelligent hierarchical control method based on P4, characterized in that: include: S1. Parse the transmitted HL7 message; S2, perform access control functions; S3, allocate bandwidth based on urgency; S4, executing dynamic encryption strategy; S5, HL7 data encapsulation.

2. The intelligent hierarchical control method of medical information based on P4 according to claim 1 is characterized in that: The HL7 message of the parsed transmission includes: The parsing module in the data plane extracts key information from the message containing HL7 information, including MAC address, IP address, and HL7 user information. The user information includes department information, patient information and examination items. The patient information is defined as a sensitive field, and the sensitive fields include name, consultation number, and examination results.

3. The intelligent hierarchical control method of medical information based on P4 according to claim 1 is characterized in that: The access control function is performed, including: Based on the parsed MAC addresses, IP addresses, and HL7 user information of the sender and receiver, the whitelist and blacklist in the access control form are used for matching. If the packet belongs to the whitelist, it is "passed" and allowed to proceed to the next step; if it belongs to the blacklist, it is "rejected" and the data packet is directly discarded; if the packet is not in the list, it is marked as "pending verification" and sent to the control plane for further authentication.

4. The medical information intelligent hierarchical control method based on P4 according to claim 1 is characterized in that: The allocating bandwidth based on urgency includes: According to the parsed HL7 user information, the emergency level form is matched to obtain the priority of the corresponding bandwidth allocation; the data plane allocates the traffic to the corresponding forwarding queue according to the priority value; the control plane dynamically adjusts the emergency level form rules through the real-time traffic monitoring and statistics module to ensure the real-time nature of traffic allocation.

5. The intelligent hierarchical control method of medical information based on P4 according to claim 1 is characterized in that: The execution of the dynamic encryption strategy includes: Users with different permission levels are distinguished by MAC addresses, IP addresses, and designated fields in HL7 information. The permission levels include highest permission, medium permission, and lowest permission. The following operations are performed on sensitive fields in HL7 messages according to the encryption policy form. For high-privilege identities, the original HL7 data is directly transmitted without processing. For medium-privilege identities, encryption is performed on sensitive fields. For low-privilege or unauthorized identities, the message is discarded or all sensitive fields are shielded, and the sensitive field processing results are directly passed to the next encapsulation module.

6. The P4-based intelligent hierarchical control method for medical information according to claim 1, characterized in that: The HL7 data package includes: Ensure that the message structure is complete, recalculate the message checksum on the data plane, ensure that the message complies with the protocol specification, and send the reorganized message to the target device or system.

7. The P4-based intelligent hierarchical control method for medical information according to claim 1, characterized in that: It also includes S6, intelligent management of control plane; The control plane intelligent management includes protocol adaptation, monitoring statistics and form management; Protocol adaptation implements different versions of HL7 protocol parsing and encapsulation rules through the protocol adaptation module, supports different field mapping and conversion, ensures the consistency of parsing and encapsulation, including sending parsing rules to the data plane parsing module to guide how to parse data packets; Configure the protocol type to be identified; Set the parsing priority of the protocol field and update the protocol parsing template; Send encapsulation rules to the data plane encapsulation module, define the protocol header modification method, configure the checksum calculation rules, and specify the encapsulation protocol type; Monitoring statistics: Analyze traffic and access behavior through the monitoring statistics module to optimize bandwidth allocation strategies and sensitive field processing rules; Form management includes: Dynamic management of access control forms, updating blacklists based on abnormal access behaviors, limiting malicious traffic, dynamically adding legitimate identities to whitelists, and reducing subsequent matching delays; The emergency level form is dynamically updated, and the priority of department business is dynamically adjusted by monitoring traffic status; Encryption policy form management, update different permission identities, and define sensitive information fields.

8. A P4-based intelligent hierarchical control system for medical information, characterized in that: include: The control plane and the data plane, the control plane includes a protocol adaptation module, a monitoring statistics module and a form management module, and the data plane includes a parsing module, a hierarchical processing module and an encapsulation module in sequence; The protocol adaptation module provides parsing rules for the parsing module, which is used for parsing and adapting different versions of HL7 protocols and supporting different field mapping and conversion; The protocol adaptation module provides encapsulation rules for the encapsulation module to ensure the protocol integrity of the sent information; The form management module provides the classification processing module with an intelligent classification processing basis and controls the data plane behavior through the rule table; The monitoring and statistics module is used to track the information of the statistical analysis module, and perform data analysis and processing on it to obtain an optimization strategy, and update the optimization strategy to the form management module; The control plane sends configurations, updates rules, and sets policies to the data plane through interfaces; The data plane uploads statistical information to the control plane through the interface to perform exception reporting and status feedback.

9. The P4-based intelligent hierarchical control system for medical information according to claim 8, characterized in that: The hierarchical processing module includes an identity recognition unit, a bandwidth guarantee unit, and a sensitive field processing unit. The form management module includes an access control form, an emergency level form, and an encryption policy form. The access control form is maintained and managed by the control plane; the access control form conveys the control policy to the data plane through the distribution mechanism, and the identity recognition unit performs corresponding processing actions according to the content of the received access control form; The emergency level form is maintained and managed by the control plane; the emergency level form conveys the control strategy to the data plane through the distribution mechanism, and the bandwidth guarantee unit performs corresponding processing actions according to the content of the received emergency level form; The encryption policy form is maintained and managed by the control plane; the encryption policy form conveys the control policy to the data plane through a distribution mechanism, and the sensitive field processing unit performs corresponding processing actions based on the received encryption policy form content.

Images