Sick and wounded information privacy protection method and system

Abstract

The invention provides a sick and wounded information privacy protection method and system. The method comprises the following steps: receiving and verifying a query request of an authorized user, identifying non-sensitive identification information, and generating a security access token; based on the secure access token, applying a differential privacy algorithm to add a proper amount of noise for each field to protect individual privacy, and adopting a secure multi-party computing technology to perform joint query and statistical analysis to generate an encrypted aggregation result; based on the encryption aggregation result, performing encryption processing on sensitive fields in a user query result by applying a zero-knowledge proof algorithm, and intelligently adjusting a visible information range and generating personalized display content by adopting a fine-grained access control method and dynamically evaluating a user operation context and a minimum permission principle; and on the basis of the personalized display content, completing query of an automatic update audit log, and generating a detailed privacy protection report. According to the technical scheme provided by the invention, a multi-level security framework is provided, and the information privacy protection comprehensiveness of the sick and wounded is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of medical information privacy protection, and in particular, to a method and system for protecting the privacy of patient information. Background Art

[0002] With the rapid development of medical informatization, patient information management systems have been widely used in hospitals, clinics, and other medical institutions. These systems not only need to efficiently process and store a large amount of patient data, but also need to ensure the security and privacy of the data. In particular, when sensitive information (such as medical records, diagnosis results, etc.) is involved, strict security measures must be taken to prevent information leakage. Therefore, the application scenario puts forward technical requirements for the privacy protection of patient information, including secure access control, precise privacy protection, and joint query and analysis.

[0003] At present, common methods for protecting the privacy of patient information mainly include limiting user access through predefined permission settings to ensure that only authorized personnel can view specific information; performing basic encryption on sensitive fields to prevent unauthorized access; and recording user access behavior for subsequent audits and compliance checks. These existing solutions meet some privacy protection needs to a certain extent, but they are insufficient in terms of comprehensiveness and flexibility.

[0004] Although existing solutions provide basic privacy protection in some aspects, they still have the following significant defects. Existing methods are usually limited to static access control and simple encryption, and fail to fully consider the sensitivity and statistical needs of different fields, resulting in insufficient privacy protection and insufficient comprehensiveness of privacy protection for the injured and sick: Existing solutions cannot intelligently adjust the scope of visible information according to the user operation context and the principle of least privilege, and are difficult to adapt to complex and changing application scenarios; in multi-party collaboration scenarios, existing solutions cannot ensure the security of joint queries and statistical analysis, and are prone to information leakage risks. Summary of the invention

[0005] The embodiments of the present application provide a method and system for protecting the privacy of the patient's information, so as to solve the problem that the privacy protection of the patient's information is not comprehensive enough in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a method for protecting the privacy of information of injured and sick persons, comprising:

[0007] Receive verification and authorization user query requests to identify specific non-sensitive identification information of the injured or sick and generate a security access token;

[0008] Based on the secure access token, a differential privacy algorithm is used to accurately calculate the required amount of noise according to the sensitivity and statistical requirements, and an appropriate amount of noise is added to each field to protect individual privacy. Secure multi-party computing technology is used to distribute information summaries to multiple parties, and joint queries and statistical analysis are performed through encryption protocols to generate encrypted aggregation results.

[0009] Based on the encrypted aggregation results, a zero-knowledge proof algorithm is used to predefine security parameters to construct proof statements, encrypt sensitive fields in user query results, and adopt a fine-grained access control method to dynamically evaluate user operation context and the principle of least privilege to intelligently adjust the visible information range and generate personalized display content;

[0010] Based on the personalized display content, the query is completed to automatically update the audit log, record the key parameters of the access behavior, and generate a detailed privacy protection report.

[0011] Optionally, based on the secure access token, a differential privacy algorithm is used to accurately calculate the required amount of noise according to the sensitivity and statistical requirements, and an appropriate amount of noise is added to each field to protect individual privacy. Secure multi-party computing technology is used to distribute information summaries to multiple parties, and joint queries and statistical analysis are performed through encryption protocols to generate encrypted aggregation results, including:

[0012] Based on the security access token, perform field sensitivity assessment on the patient data matching the query condition and generate a de-identified summary;

[0013] Based on the de-identified summary, a differential privacy algorithm is used to accurately calculate the required amount of noise according to the sensitivity and statistical requirements, and an appropriate amount of noise is added to each field to protect individual privacy, thereby generating a noise-processed summary;

[0014] Based on the noise processing summary, secure multi-party computing technology is used to distribute the information summary to multiple participants, and joint query and statistical analysis are performed through encryption protocols to generate distributed encryption middleware;

[0015] Based on the distributed encryption middleware, a secure channel of secure multi-party computing technology is used to ensure that no single party obtains complete information and intermediate results alone, thereby generating an encrypted aggregation result.

[0016] Optionally, based on the de-identified summary, a differential privacy algorithm is used to accurately calculate the required noise amount according to the sensitivity and statistical requirements, add an appropriate amount of noise to each field to protect individual privacy, and generate a noise processing summary, including:

[0017] Based on the de-identified summary, conduct a preliminary assessment of sensitivity and statistical requirements, accurately calculate the required amount of noise according to data utility requirements, and generate a sensitivity assessment report;

[0018] Based on the sensitivity assessment report, a differential privacy algorithm is used to add corresponding random noise to each field according to the pre-calculated required noise amount according to the sensitivity and statistical requirements of each field, and the noise distribution is adjusted to adapt to the requirements of different fields to generate a noise distribution adjustment result;

[0019] Based on the noise distribution adjustment result, a data consistency check is performed to ensure that the data after the noise distribution adjustment still complies with the logic and business rules, and a consistency check summary is generated;

[0020] Based on the consistency check summary, the content is further screened in detail to ensure that all fields have been properly noised, and a noise processing summary is generated.

[0021] Optionally, the noise processing summary is based on the use of secure multi-party computing technology to distribute the information summary to multiple parties, and joint query and statistical analysis are performed through an encryption protocol to generate distributed encryption middleware, including:

[0022] Based on the noise processing summary, the encryption requirements of each field and the roles of the participants are evaluated, and a suitable encryption algorithm is selected to generate an encryption key for each field, and an encryption configuration scheme is generated;

[0023] Based on the encryption configuration scheme, encryption processing is performed through homomorphic encryption, and the information summary is distributed to multiple participants to generate a distributed encrypted data set;

[0024] Based on the distributed encrypted data set, secure multi-party computing technology is used to establish a secure channel through an encryption protocol, allowing each participant to perform joint query and statistical analysis to generate encrypted computing middleware;

[0025] Based on the encryption calculation middleware, a series of verification steps are performed, the encryption calculation results of each participant are summarized, and the distributed encryption middleware is generated.

[0026] Optionally, based on the encrypted aggregation result, a zero-knowledge proof algorithm is used, security parameters are predefined to construct a proof statement, sensitive fields in the user query result are encrypted, a fine-grained access control method is adopted, and the visible information range is intelligently adjusted by dynamically evaluating the user operation context and the principle of least privilege to generate personalized display content, including:

[0027] Based on the encrypted aggregation results, sensitive fields are identified and classified, a zero-knowledge proof environment is initialized, a mathematical statement template and security parameters are prepared, and a privacy protection configuration is generated;

[0028] Based on the privacy protection configuration, each sensitive field in the user query result is encrypted using a zero-knowledge proof algorithm, and a secure encryption process is performed by constructing a specific mathematical statement and a corresponding zero-knowledge proof to generate an enhanced encrypted field;

[0029] Based on the enhanced encrypted field, a fine-grained access control method is adopted to dynamically evaluate the user operation context and the principle of least privilege, intelligently adjust the visible information range, and generate a personalized display configuration;

[0030] Based on the personalized display configuration, the encrypted sensitive fields are integrated with the non-sensitive fields to optimize the user experience and generate personalized display content.

[0031] Optionally, based on the privacy protection configuration, using a zero-knowledge proof algorithm, encrypting each sensitive field in the user query result, constructing a specific mathematical statement and a corresponding zero-knowledge proof, performing secure encryption processing, and generating an enhanced encrypted field, including:

[0032] Based on the privacy protection configuration, determine the fields that require additional privacy protection measures and generate a list of sensitive fields;

[0033] Based on the sensitive field list, each sensitive field in the user query result is encrypted using a zero-knowledge proof algorithm, and a zero-knowledge proof encrypted record is generated to ensure that the verification field is correctly encrypted without leaking actual information by constructing a specific mathematical statement and a corresponding zero-knowledge proof;

[0034] Based on the zero-knowledge proof encrypted record, perform data integrity check to ensure that all sensitive fields are properly encrypted as required, and generate an encryption verification report;

[0035] Based on the encryption verification report, enhanced encryption operations are performed on all verified sensitive fields to further strengthen the security of each sensitive field and generate enhanced encrypted fields.

[0036] Optionally, based on the personalized display content, the audit log is queried and automatically updated, key parameters of the access behavior are recorded, and a detailed privacy protection report is generated, including:

[0037] Based on the personalized display content, detailed information about user access is collected and sorted to generate access behavior log entries;

[0038] Based on the access behavior log entries, the system audit log is automatically updated, each query operation log entry is integrated into the system audit log, and an update audit log is generated;

[0039] Based on the update audit log, perform a privacy compliance check to evaluate whether the access complies with relevant laws, regulations and internal security policies, and generate a compliance assessment report;

[0040] Based on the compliance assessment report, all access behavior privacy protection measures and effects are summarized to generate a detailed privacy protection report.

[0041] In a second aspect, an embodiment of the present application provides a system for protecting the privacy of patient information, including:

[0042] A receiving module, used to receive and verify the query request of the authorized user, to identify the non-sensitive identification information of the specific injured or sick person, and to generate a security access token;

[0043] A computing module is used to use a differential privacy algorithm based on the security access token to accurately calculate the required amount of noise according to the sensitivity and statistical requirements, add an appropriate amount of noise to each field to protect individual privacy, use secure multi-party computing technology to distribute information summaries to multiple parties, perform joint query and statistical analysis through encryption protocols, and generate encrypted aggregation results;

[0044] A processing module is used to encrypt sensitive fields in user query results based on the encrypted aggregation results, apply a zero-knowledge proof algorithm, predefine security parameters to construct proof statements, adopt a fine-grained access control method, dynamically evaluate user operation context and the principle of least privilege, intelligently adjust the visible information range, and generate personalized display content;

[0045] The recording module is used to complete the query and automatically update the audit log based on the personalized display content, record the key parameters of the access behavior, and generate a detailed privacy protection report.

[0046] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a method for protecting the privacy of information of injured and sick persons as described in the first aspect.

[0047] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program, which, when executed by a computer, implements a method for protecting the privacy of information of injured and sick persons as described in the first aspect.

[0048] In an embodiment of the present application, a query request of an authorized user is received to identify non-sensitive identification information of a specific injured or sick person and generate a secure access token; based on the secure access token, a differential privacy algorithm is used to accurately calculate the required amount of noise according to the sensitivity and statistical requirements, and an appropriate amount of noise is added to each field to protect individual privacy. A secure multi-party computing technology is used to distribute the information summary to multiple parties, and a joint query and statistical analysis are performed through an encryption protocol to generate an encrypted aggregation result; based on the encrypted aggregation result, a zero-knowledge proof algorithm is used to predefine security parameters to construct a proof statement, and sensitive fields in the user query results are encrypted. A fine-grained access control method is used to intelligently adjust the visible information range by dynamically evaluating the user operation context and the principle of least privilege, and generate personalized display content; based on the personalized display content, the query is completed to automatically update the audit log, record the key parameters of this access behavior, and generate a detailed privacy protection report. From receiving and verifying the query request of authorized users to generating detailed privacy protection reports, each step adopts advanced encryption technology and access control mechanism to ensure the high security of the entire process; differential privacy algorithm is used to add appropriate amount of noise to sensitive fields to effectively prevent the leakage of individual information in statistical analysis; secure multi-party computing technology is used to distribute information summaries to multiple participants to ensure the security of joint queries and statistical analysis, and no party obtains complete information alone; through fine-grained access control and dynamic evaluation of user operation context, the visible information range is intelligently adjusted to ensure the application of the principle of least privilege and optimize user experience.

[0049] Furthermore, by performing field sensitivity assessment on the data of the injured and sick that match the query conditions, the required amount of noise is accurately calculated to ensure privacy protection without affecting the effectiveness of data analysis; generating de-identified summaries reduces the risk of directly identifying personal identities and further enhances privacy protection; through secure multi-party computing technology and encryption protocols, joint queries and statistical analysis are performed to generate distributed encryption middleware, ensuring the security of data during transmission and processing; ensuring that no single party obtains complete information and intermediate results alone, greatly reducing the risk of information leakage.

[0050] Furthermore, by identifying and classifying sensitive fields and preparing mathematical statement templates and security parameters, the reliability and effectiveness of subsequent encryption processing are ensured; each sensitive field is encrypted using a zero-knowledge proof algorithm, a specific mathematical statement and the corresponding zero-knowledge proof are constructed, and an enhanced encrypted field is generated to ensure that even if leakage occurs during transmission or storage, it will not lead to the exposure of sensitive information; a fine-grained access control method is adopted to dynamically evaluate the user operation context and the principle of least privilege, and intelligently adjust the visible information range to ensure that users can only see necessary information, thereby improving the security of the system and user experience; the encrypted sensitive fields are integrated with non-sensitive fields to generate personalized display content to ensure that users can obtain accurate and secure information display while maintaining a good user experience.

[0051] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0053] Figure 1 A flowchart of a method for protecting the privacy of patient information provided in an embodiment of the present application;

[0054] Figure 2 A schematic diagram of the structure of a system for protecting the privacy of patient information provided by an embodiment of the present application;

[0055] Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0057] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0058] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0059] Figure 1 A flowchart of a method for protecting the privacy of patient information is provided for an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0060] 101. Receive a query request from a verification authorized user to identify non-sensitive identification information of a specific patient and generate a security access token;

[0061] In this step, verifying the authorized user query request means that after the system receives the query request initiated by the user, it confirms whether the user has the right to access the non-sensitive identification information of the specific injured or sick person through identity authentication and permission check.

[0062] Non-sensitive identification information includes but is not limited to the medical record number and name abbreviations of the injured and sick. This information is not sufficient to identify the individual individually, but can be used to associate and retrieve more detailed medical records.

[0063] A security access token is a temporary credential that contains user identity information and access rights. It is used to verify the user's identity and provide continuous authentication during subsequent data access.

[0064] In an embodiment of the present application, first, a query request from a user is received and an identity authentication process is initiated; second, the user's identity and authority are verified to ensure that the user has the right to access the non-sensitive identification information of a specific patient; third, once the verification is passed, the system generates a security access token, which contains the user's identity information and access rights; finally, the security access token is returned to the user for subsequent operations.

[0065] Suppose a hospital's information system receives a query request from a doctor to view the non-sensitive information of a specific patient. For example, the system first verifies the doctor's identity and authority to ensure that he is qualified to access the patient's information. Next, the system generates a security access token containing the doctor's identity information and access rights. Again, the token is sent back to the doctor for subsequent operations. Finally, the doctor uses this token to initiate further data access requests.

[0066] 102. Based on the secure access token, using a differential privacy algorithm, accurately calculating the required amount of noise according to the sensitivity and statistical requirements, adding an appropriate amount of noise to each field to protect individual privacy, using secure multi-party computing technology to distribute information summaries to multiple parties, and performing joint query and statistical analysis through an encryption protocol to generate encrypted aggregation results;

[0067] In this step, the differential privacy algorithm is a technology used to protect individual privacy in data analysis. It adds an appropriate amount of random noise to the data so that individual records are difficult to identify, but the overall statistical results remain valid.

[0068] Sensitivity refers to the degree to which a field or data item affects personal privacy. Different fields may have different sensitivities, for example, diagnosis information in a medical record is usually more sensitive than the date of admission.

[0069] Statistical requirements refer to the requirements for data integrity and accuracy during the data analysis process. Even after adding noise, the data must still maintain certain statistical characteristics to ensure the validity of the analysis results.

[0070] Information summary is a simplified representation of original data, which retains key features but removes unnecessary details. This simplified form is easy to transmit and process between different parties while reducing the risk of direct exposure of original data.

[0071] Secure multi-party computing technology allows multiple parties to complete computing tasks together without leaking their respective data. Each party only holds part of the data and works together through encryption protocols to ensure that no one party obtains the complete data set alone.

[0072] An encryption protocol is a set of rules and technologies used to ensure the security of communications and data exchange and prevent unauthorized access and tampering. Common encryption protocols include SSL / TLS, PGP, etc.

[0073] The encrypted aggregation result refers to the data processed by the differential privacy algorithm and added with noise, and then generated after joint query and statistical analysis through secure multi-party computing technology and encryption protocol. This result retains the statistical characteristics of the data while ensuring the security of individual privacy.

[0074] In the embodiment of the present application, first, a secure access token is used to verify the user's identity and authority; second, a differential privacy algorithm is used to calculate the required amount of noise based on the sensitivity of the field and statistical requirements; third, an appropriate amount of noise is added to each field to ensure that individual privacy is protected; finally, through secure multi-party computing technology and encryption protocols, the information summary is distributed to multiple participants, and joint queries and statistical analysis are performed to generate encrypted aggregation results.

[0075] For example, continuing with the above example, suppose a doctor uses a secure access token to initiate a query request for the patient data; first, the system calculates the amount of noise required for each field based on the field sensitivity and statistical requirements; second, it adds an appropriate amount of noise to these fields to ensure privacy protection; third, through secure multi-party computing technology, it distributes the de-identified information summary to multiple parties; finally, it conducts joint query and statistical analysis to generate encrypted aggregation results.

[0076] 103. Based on the encrypted aggregation results, a zero-knowledge proof algorithm is used, security parameters are predefined to construct proof statements, sensitive fields in user query results are encrypted, a fine-grained access control method is adopted, and the visible information range is intelligently adjusted by dynamically evaluating the user operation context and the principle of least privilege to generate personalized display content;

[0077] In this step, the zero-knowledge proof algorithm allows one party (the prover) to prove to another party (the verifier) ​​that a statement is true without revealing any additional information. The key to this algorithm is that it can verify whether certain attributes or conditions are established without leaking actual data. It is widely used in privacy protection, blockchain and other fields.

[0078] The purpose of pre-defining security parameters is to ensure the validity and security of zero-knowledge proofs, including selecting appropriate mathematical models and parameter settings. These parameters determine the construction method of the proof statement and its reliability, ensuring that sensitive information will not be leaked during the verification process while ensuring the authenticity of the proof.

[0079] A proof statement is a specific mathematical expression constructed to verify whether a condition is met without leaking other information. It is generated based on predefined security parameters to ensure that only necessary information is transmitted during the verification process while protecting the privacy of the original data.

[0080] The fine-grained access control method dynamically adjusts the scope of information that the user can access based on the user's specific operations and permissions, ensuring the application of the principle of least privilege. This method combines real-time operation context to flexibly adjust the scope of visible information and minimize the risk of privacy leakage.

[0081] Dynamically evaluating user operation context means dynamically adjusting access rights and visible information range based on the user's real-time operating environment and background information. The system will monitor factors such as user behavior patterns, access time, device type, and intelligently judge the security and rationality of current operations.

[0082] The principle of least privilege ensures that users can only access the minimum information required to perform their tasks, reducing potential privacy risks. This principle emphasizes that when designing and implementing access control systems, user permissions should be limited as much as possible to avoid security risks caused by excessive authorization.

[0083] Personalized content display means intelligently adjusting and generating content suitable for users to view based on their identity, permissions, and operation context. This not only ensures privacy protection but also optimizes the user experience, ensuring that users can obtain information that matches their permissions while not being exposed to data that they should not see.

[0084] In the embodiment of the present application, first, the zero-knowledge proof environment is initialized based on the encrypted aggregation result; second, specific mathematical statements and security parameters are constructed to ensure the reliability and validity of the proof statement; third, the sensitive fields in the user query results are encrypted to generate enhanced encrypted fields; finally, a fine-grained access control method is adopted to intelligently adjust the visible information range according to the user operation context and permissions to generate personalized display content.

[0085] For example, continuing with the above example, assume that the sensitive fields in the doctor's query results have been encrypted; first, initialize the zero-knowledge proof environment based on the encrypted aggregation results, prepare the mathematical statement template and security parameters; second, construct specific mathematical statements and corresponding zero-knowledge proofs; third, dynamically evaluate and intelligently adjust the visible information range based on the doctor's operation context and permissions; finally, integrate the encrypted sensitive fields with non-sensitive fields to generate personalized display content for the doctor to view.

[0086] 104. Based on the personalized display content, complete the query to automatically update the audit log, record the key parameters of the access behavior, and generate a detailed privacy protection report.

[0087] In this step, the audit log records the key parameters of all access behaviors for subsequent review and compliance checks. It records in detail the time, user identity, operation content and other information of each access, providing an important basis for the transparency and traceability of the system.

[0088] Key parameters include user identity, access time, query content, etc. This information is crucial to ensuring system security. It helps administrators understand who performed what operations and when, thereby discovering potential security issues or abnormal behaviors.

[0089] The privacy protection report records in detail the privacy protection measures and results throughout the query process, ensuring the transparency and traceability of the system. It covers all steps from user request to final display.

[0090] Automatically updating audit logs means that the system automatically records the key parameters of each access behavior to ensure that all operations are accurately recorded for subsequent review. This method reduces the possibility of human intervention, improves the integrity and accuracy of log records, and enhances the security of the system.

[0091] A detailed privacy protection report refers to a document covering all privacy protection measures and results throughout the inquiry process, ensuring the transparency and traceability of the system, and provided to relevant regulatory authorities or internal audit teams.

[0092] In the embodiment of the present application, first, based on the personalized display content, the system automatically updates the audit log; secondly, it records the key parameters of the access behavior, such as user identity, access time, query content, etc.; thirdly, it ensures that all key parameters are accurately recorded for subsequent review; finally, it generates a detailed privacy protection report covering the privacy protection measures and results throughout the query process.

[0093] For example, continuing with the above example, assume that personalized display content has been generated; first, the system automatically updates the audit log to record the doctor's visit behavior; second, record the key parameters of this visit, including the doctor's identity, visit time and query content; third, ensure that all key parameters are recorded accurately; finally, generate a detailed privacy protection report covering all privacy protection measures and results in the entire query process for subsequent review and compliance checks.

[0094] In order to address more complex needs for protecting the privacy of patient information, in some embodiments, the process of generating encrypted aggregation results based on a secure access token using a differential privacy algorithm and secure multi-party computing technology in step 102 includes: based on the secure access token, performing a field sensitivity assessment on the patient data matching the query conditions to generate a de-identified summary; based on the de-identified summary, using a differential privacy algorithm to accurately calculate the required amount of noise based on the sensitivity and statistical requirements, adding an appropriate amount of noise to each field to protect individual privacy, and generating a noise processing summary; based on the noise processing summary, using secure multi-party computing technology to distribute the information summary to multiple parties, performing joint query and statistical analysis through an encryption protocol, and generating a distributed encryption middleware; based on the distributed encryption middleware, using a secure channel of secure multi-party computing technology to ensure that no single party obtains complete information and intermediate results alone, and generating an encrypted aggregation result.

[0095] In this embodiment, field sensitivity assessment is to analyze the patient data matching the query conditions to determine the sensitivity of each field. It ensures the targeted nature of subsequent processing measures by quantifying the impact of the field on personal privacy.

[0096] De-identified summaries are created by processing raw data to remove information that can directly identify individuals, while retaining key features for subsequent analysis. This approach reduces the risk of directly exposing sensitive information while maintaining the effectiveness of data analysis.

[0097] The noise-processed summary refers to adding an appropriate amount of noise based on the sensitivity of the field on the basis of the de-identified summary to ensure privacy protection without affecting the effectiveness of statistical analysis. The required amount of noise is calculated through the differential privacy algorithm, and an appropriate amount of noise is added to each field.

[0098] Distributed encryption middleware distributes information summaries to multiple parties through secure multi-party computing technology and encryption protocols to ensure the security of joint queries and statistical analysis. Each participant only holds part of the data and works together through encryption protocols to ensure that no one party obtains the complete data set alone.

[0099] In an embodiment of the present application, first, the user identity is verified based on the security access token and the data of the injured and sick that matches the query conditions are retrieved; secondly, the field sensitivity of these data is evaluated and a de-identified summary is generated to ensure that the sensitive information in the data is effectively protected; thirdly, the differential privacy algorithm is used to accurately calculate the required amount of noise according to the sensitivity of different fields, and an appropriate amount of noise is added to each field to generate a noise processing summary; finally, the information summary is distributed to multiple participants through secure multi-party computing technology and encryption protocols to ensure the security of joint queries and statistical analysis, generate distributed encryption middleware, and ensure through a secure channel that no party can obtain complete information or intermediate results alone, and finally generate an encrypted aggregation result.

[0100] Here is a specific example:

[0101] For example, suppose that researchers from a public health agency need to access a hospital information system to conduct a study on the transmission patterns of a specific disease. First, the system verifies the identity of the researcher based on a secure access token and retrieves data on sick and injured patients that match the research criteria. Second, the system performs field sensitivity assessments on these data and generates de-identified summaries to ensure that direct identifying information such as names and medical record numbers are removed, leaving only key features for analysis. Third, the system uses a differential privacy algorithm to accurately calculate the amount of noise required based on the sensitivity of different fields (such as diagnostic information and treatment plans), adds an appropriate amount of noise to each field, and generates a noise-processed summary. Finally, secure multi-party computing technology and encryption protocols are used to distribute information summaries to multiple parties to ensure the security of joint queries and statistical analysis, generate distributed encryption middleware, and use secure channels to ensure that no party can obtain complete information or intermediate results alone. Finally, encrypted aggregated results are generated for researchers to view.

[0102] In order to address the risk of sensitive information leakage in data privacy protection, in some embodiments, the noise processing based on the de-identified summary using a differential privacy algorithm in step 102 includes: based on the de-identified summary, a preliminary assessment of the sensitivity and statistical requirements is performed, and the required amount of noise is accurately calculated according to the data utility requirements to generate a sensitivity assessment report; based on the sensitivity assessment report, a differential privacy algorithm is used to add corresponding random noise to each field according to the pre-calculated required amount of noise for the sensitivity and statistical requirements of each field, and a noise distribution adjustment result is generated by adjusting the noise distribution to adapt to the requirements of different fields; based on the noise distribution adjustment result, a data consistency check is performed to ensure that the data still complies with the logic and business rules after the noise distribution adjustment, and a consistency verification summary is generated; based on the consistency verification summary, the content is further screened in detail to ensure that noise has been appropriately added to all fields, and a noise processing summary is generated.

[0103] In this embodiment, the preliminary assessment of sensitivity and statistical requirements refers to analyzing each field in the de-identified summary to determine its sensitivity and the need for statistical analysis. This process helps determine the privacy protection measures required for each field.

[0104] Data utility requirements refer to ensuring that data still has sufficient statistical utility to support subsequent analysis and research while protecting privacy. It emphasizes finding a balance between privacy protection and data analysis so that data with added noise can still provide valuable information.

[0105] The sensitivity assessment report records in detail the sensitivity of each field, statistical requirements, and the required amount of noise calculated based on the data utility requirements. The report provides an important basis for the subsequent application of differential privacy algorithms to ensure that each field is properly protected.

[0106] The noise distribution adjustment result refers to adding corresponding random noise to each field based on the pre-calculated required noise amount, and adjusting the noise distribution to adapt to the requirements of different fields. This process ensures that the noise addition to each field meets the privacy protection requirements and does not affect the effectiveness of data analysis.

[0107] The consistency check summary refers to the consistency check of the logic and business rules of the data after the noise distribution is adjusted to ensure that the data is still reasonable and usable. This check ensures that even if noise is added, the data still conforms to the expected logical relationships and business rules, avoiding unreasonable data introduced by noise.

[0108] In an embodiment of the present application, first, the system performs a preliminary assessment of the sensitivity and statistical requirements based on the de-identified summary, accurately calculates the required amount of noise according to the data utility requirements, and generates a sensitivity assessment report; secondly, based on the sensitivity assessment report, a differential privacy algorithm is used to add corresponding random noise to each field according to the sensitivity and statistical requirements of each field based on the pre-calculated required amount of noise, and a noise distribution adjustment result is generated by adjusting the noise distribution to adapt to the requirements of different fields; thirdly, based on the noise distribution adjustment result, a data consistency check is performed to ensure that the data still complies with the logic and business rules after the noise distribution adjustment, and a consistency verification summary is generated; finally, based on the consistency verification summary, the content is further screened in detail to ensure that noise has been appropriately added to all fields, and a noise processing summary is generated.

[0109] Here is a specific example:

[0110] For example, suppose that researchers at a medical institution need to access the hospital information system to conduct a study on the effectiveness of treatment for a specific disease. First, the system conducts a preliminary assessment of the sensitivity and statistical requirements based on the de-identified summary, accurately calculates the required amount of noise based on the data utility requirements, and generates a sensitivity assessment report. Second, based on the sensitivity assessment report, a differential privacy algorithm is used to add corresponding random noise to each field (such as diagnostic information, treatment plan) based on the sensitivity and statistical requirements of the field, according to the pre-calculated required amount of noise. The noise distribution is adjusted to adapt to the requirements of different fields, and the noise distribution adjustment result is generated. Third, based on the noise distribution adjustment result, a data consistency check is performed to ensure that the data still complies with the logic and business rules after the noise distribution adjustment, and a consistency verification summary is generated. Finally, based on the consistency verification summary, the content is further screened in detail to ensure that all fields have appropriate noise added, and a noise processing summary is generated for researchers to review.

[0111] In order to address more complex needs for privacy protection of information of the wounded and sick, in some embodiments, the process of generating a distributed encryption middleware based on the noise processing summary using secure multi-party computing technology in step 102 includes: based on the noise processing summary, evaluating the encryption requirements of each field and the roles of the participants, selecting a suitable encryption algorithm to generate an encryption key for each field, and generating an encryption configuration scheme; based on the encryption configuration scheme, encrypting the information using homomorphic encryption, distributing the information summary to multiple participants, and generating a distributed encrypted data set; based on the distributed encrypted data set, using secure multi-party computing technology, establishing a secure channel through an encryption protocol, allowing each participant to perform joint queries and statistical analysis, and generating an encrypted computing middleware; based on the encrypted computing middleware, executing a series of verification steps, summarizing the encryption calculation results of each participant, and generating a distributed encryption middleware.

[0112] In this embodiment, field encryption requirement assessment refers to analyzing each field in the noise processing summary to determine its encryption requirements in joint query and statistical analysis. This step ensures that the sensitive data of each field is properly protected without affecting the effectiveness of data analysis.

[0113] Participant role assessment is a detailed analysis of the roles and permissions of each participant to determine the specific responsibilities of each participant in joint queries and statistical analysis. This assessment helps to select appropriate encryption strategies to ensure that each participant can only access data within the scope of their authority, thereby enhancing overall security.

[0114] The encryption configuration plan is based on the results of the field encryption requirements assessment and the participant role assessment, selects the appropriate encryption algorithm to generate encryption keys for each field, and formulates detailed encryption rules

[0115] Homomorphic encryption is a technology that allows calculations to be performed directly on encrypted data without decryption. It enables multiple parties to jointly complete computing tasks without leaking the original data, ensuring the privacy and integrity of the data.

[0116] A distributed encrypted dataset is a data set that is distributed to multiple participants after homomorphic encryption. Each participant only holds part of the encrypted data and cannot obtain the complete dataset alone. This method ensures data security while supporting multi-party collaborative computing tasks.

[0117] In the present application embodiment:

[0118] Brief explanation of the solution process: First, the system evaluates the encryption requirements and roles of each field based on the noise processing summary, selects a suitable encryption algorithm to generate an encryption key for each field, and generates an encryption configuration plan; secondly, based on the encryption configuration plan, encryption processing is performed through homomorphic encryption, and the information summary is distributed to multiple participants to generate a distributed encrypted data set; thirdly, based on the distributed encrypted data set, secure multi-party computing technology is used to establish a secure channel through an encryption protocol, allowing each participant to perform joint queries and statistical analysis, and generate encryption computing middleware; finally, based on the encryption computing middleware, a series of verification steps are performed to summarize the encryption calculation results of each participant and generate a distributed encryption middleware.

[0119] Here is a specific example:

[0120] For example, suppose a medical research institution needs to cooperate with multiple hospitals to conduct a large-scale study on the treatment effects of a specific disease; first, the system evaluates the encryption requirements and roles of the participants (hospitals) for each field (such as diagnostic information, treatment plan) based on the noise processing summary, selects a suitable encryption algorithm to generate an encryption key for each field, and generates an encryption configuration plan; secondly, based on the encryption configuration plan, encryption processing is performed through homomorphic encryption, and the information summary is distributed to multiple hospitals to generate a distributed encrypted data set; thirdly, based on the distributed encrypted data set, secure multi-party computing technology is used to establish a secure channel through an encryption protocol, allowing each hospital to perform joint queries and statistical analysis, and generate encrypted computing middleware; finally, based on the encrypted computing middleware, a series of verification steps are performed to summarize the encrypted computing results of each hospital, and a distributed encrypted middleware is generated for researchers to view.

[0121] Optionally, based on the encrypted aggregation result, a zero-knowledge proof algorithm is used, security parameters are predefined to construct a proof statement, sensitive fields in the user query result are encrypted, a fine-grained access control method is adopted, and the visible information range is intelligently adjusted by dynamically evaluating the user operation context and the principle of least privilege to generate personalized display content, including:

[0122] Based on the encrypted aggregation results, sensitive fields are identified and classified, a zero-knowledge proof environment is initialized, a mathematical statement template and security parameters are prepared, and a privacy protection configuration is generated;

[0123] Based on the privacy protection configuration, each sensitive field in the user query result is encrypted using a zero-knowledge proof algorithm, and a secure encryption process is performed by constructing a specific mathematical statement and a corresponding zero-knowledge proof to generate an enhanced encrypted field;

[0124] Based on the enhanced encrypted field, a fine-grained access control method is adopted to dynamically evaluate the user operation context and the principle of least privilege, intelligently adjust the visible information range, and generate a personalized display configuration;

[0125] Based on the personalized display configuration, the encrypted sensitive fields are integrated with the non-sensitive fields to optimize the user experience and generate personalized display content.

[0126] In this embodiment, sensitive field identification and classification refers to analyzing and classifying fields involving sensitive information to clarify which fields require special privacy protection measures. This step ensures that each sensitive field is properly handled without affecting the normal display of non-sensitive fields.

[0127] Zero-knowledge proof environment initialization refers to preparing the necessary mathematical statement templates and security parameters to support subsequent zero-knowledge proof operations. It includes selecting a suitable mathematical model, defining the proof statement structure, and configuring relevant security parameters to ensure that no additional information is leaked during the verification process.

[0128] Privacy protection configuration is to formulate a detailed privacy protection strategy based on the results of sensitive field identification and classification and zero-knowledge proof environment initialization. It not only stipulates how to encrypt sensitive fields, but also includes key management, distribution and storage methods to ensure the security and reliability of the entire process.

[0129] Enhanced encrypted fields refer to data generated by encrypting each sensitive field in the user query results by constructing specific mathematical statements and corresponding zero-knowledge proofs.

[0130] The fine-grained access control method dynamically adjusts the scope of information that users can access based on their specific operations and permissions, ensuring the application of the principle of least privilege.

[0131] Personalized display configuration refers to intelligently adjusting and generating content suitable for users to view based on their identity, permissions, and operation context. It not only ensures privacy protection but also optimizes the user experience, ensuring that users can obtain information that matches their permissions while not being exposed to data that they should not see.

[0132] In the embodiment of the present application, first, the system identifies and classifies the sensitive fields involved based on the encrypted aggregation results, initializes the zero-knowledge proof environment, prepares mathematical statement templates and security parameters, and generates a privacy protection configuration; secondly, based on the privacy protection configuration, the system uses the zero-knowledge proof algorithm to encrypt each sensitive field in the user query results, and performs secure encryption processing by constructing specific mathematical statements and corresponding zero-knowledge proofs to generate enhanced encrypted fields; thirdly, based on the enhanced encrypted fields, a fine-grained access control method is adopted to dynamically evaluate the user operation context and the principle of least privilege, intelligently adjust the visible information range, and generate a personalized display configuration; finally, based on the personalized display configuration, the encrypted sensitive fields are integrated with non-sensitive fields to optimize the user experience and generate personalized display content.

[0133] Here is a specific example:

[0134] For example, suppose that researchers from a large medical data research institution need to access the hospital information system to obtain detailed treatment records of specific patients. First, the system identifies and classifies sensitive fields (such as diagnostic information and treatment plans) based on the encrypted aggregation results, initializes the zero-knowledge proof environment, prepares mathematical statement templates and security parameters, and generates a privacy protection configuration. Second, based on the privacy protection configuration, the system uses the zero-knowledge proof algorithm to encrypt each sensitive field in the user's query results, constructs specific mathematical statements and corresponding zero-knowledge proofs, performs secure encryption, and generates enhanced encrypted fields. Third, based on the enhanced encrypted fields, a fine-grained access control method is used to dynamically evaluate the researcher's operating context and the principle of least privilege, intelligently adjust the visible information range, and generate a personalized display configuration. Finally, based on the personalized display configuration, the encrypted sensitive fields are integrated with non-sensitive fields to optimize the user experience and generate personalized display content for researchers to view.

[0135] Optionally, based on the privacy protection configuration, using a zero-knowledge proof algorithm, encrypting each sensitive field in the user query result, constructing a specific mathematical statement and a corresponding zero-knowledge proof, performing secure encryption processing, and generating an enhanced encrypted field, including:

[0136] Based on the privacy protection configuration, determine the fields that require additional privacy protection measures and generate a list of sensitive fields;

[0137] Based on the sensitive field list, each sensitive field in the user query result is encrypted using a zero-knowledge proof algorithm, and a zero-knowledge proof encrypted record is generated to ensure that the verification field is correctly encrypted without leaking actual information by constructing a specific mathematical statement and a corresponding zero-knowledge proof;

[0138] Based on the zero-knowledge proof encrypted record, perform data integrity check to ensure that all sensitive fields are properly encrypted as required, and generate an encryption verification report;

[0139] Based on the encryption verification report, enhanced encryption operations are performed on all verified sensitive fields to further strengthen the security of each sensitive field and generate enhanced encrypted fields.

[0140] In this embodiment, the sensitive field list refers to a set of fields that require additional privacy protection measures determined according to the privacy protection configuration. It clearly lists which fields contain sensitive information, such as personal identity, diagnosis results, etc., to ensure that these fields are specially protected in subsequent processing.

[0141] The zero-knowledge proof encrypted record is a verification document generated by constructing a specific mathematical statement and the corresponding zero-knowledge proof when encrypting each sensitive field in the user query result. It ensures that it can be verified whether the field has been correctly encrypted without leaking the actual information.

[0142] Data integrity check refers to a series of verification operations performed on all sensitive fields after the encryption process is completed to ensure that they are properly encrypted as required. This step ensures the integrity and consistency of the data and prevents any omissions or erroneous encryption operations from affecting subsequent use.

[0143] The encryption verification report is the result document of the data integrity check, which records in detail the encryption status and verification results of each sensitive field. It not only confirms that all sensitive fields are correctly encrypted, but also provides the necessary audit information to ensure the transparency and compliance of the system.

[0144] Enhanced encryption operation means that based on the encryption verification report, further security encryption measures are performed on all verified sensitive fields. This step is designed to strengthen the security of each sensitive field to ensure that sensitive information will not be leaked even under the most stringent scrutiny.

[0145] Enhanced encryption fields refer to the final data set after enhanced encryption operations. It not only retains the key features of the original data, but also significantly improves security and privacy protection. This type of field is suitable for further analysis and use, while ensuring the integrity and logical consistency of the data.

[0146] In the present application embodiment:

[0147] First, based on the privacy protection configuration, the fields that require additional privacy protection measures are determined, and a list of sensitive fields is generated; secondly, based on the list of sensitive fields, each sensitive field in the user query results is encrypted using a zero-knowledge proof algorithm, and by constructing specific mathematical statements and corresponding zero-knowledge proofs, it is ensured that the verification field has been correctly encrypted without leaking actual information, and a zero-knowledge proof encrypted record is generated; thirdly, based on the zero-knowledge proof encrypted record, a data integrity check is performed to ensure that all sensitive fields are properly encrypted in accordance with regulations, and an encryption verification report is generated; finally, based on the encryption verification report, enhanced encryption operations are performed on all verified sensitive fields to further strengthen the security of each sensitive field and generate enhanced encrypted fields.

[0148] Here is a specific example:

[0149] For example, suppose an insurance company needs to access the patient information system of a partner hospital to evaluate the claims of specific customers; first, the system determines the fields that require additional privacy protection measures (such as medical expenses, treatment details) based on the privacy protection configuration, and generates a list of sensitive fields; second, based on the list of sensitive fields, the system uses a zero-knowledge proof algorithm to encrypt each sensitive field in the user query results, and by constructing specific mathematical statements and corresponding zero-knowledge proofs, ensure that the verification field is correctly encrypted without leaking actual information, and generate a zero-knowledge proof encrypted record; third, based on the zero-knowledge proof encrypted record, perform a data integrity check to ensure that all sensitive fields are properly encrypted in accordance with regulations, and generate an encryption verification report; finally, based on the encryption verification report, perform enhanced encryption operations on all verified sensitive fields to further strengthen the security of each sensitive field, and generate enhanced encrypted fields for review by insurance company auditors.

[0150] In order to address more complex privacy protection needs for the information of the wounded and sick, in some embodiments, the process of completing the query based on the personalized display content to automatically update the audit log and generate a detailed privacy protection report described in step 104 includes: based on the personalized display content, collecting and organizing user access details to generate access behavior log entries; based on the access behavior log entries, automatically updating the system audit log, integrating each query operation log entry into the system audit log, and generating an update audit log; based on the update audit log, performing a privacy compliance check to evaluate whether the visit complies with relevant laws, regulations and internal security policies, and generating a compliance assessment report; based on the compliance assessment report, summarizing all access behavior privacy protection measures and effects to generate a detailed privacy protection report.

[0151] Access behavior log entries are records generated after collecting and collating user access details. They contain key parameters such as the time of each access, user identity, and operation content, which are used for subsequent review and compliance checks.

[0152] The system audit log records the key parameters of all access behaviors for subsequent review and compliance checks. It records in detail the time, user identity, operation content and other information of each access, providing an important basis for the transparency and traceability of the system.

[0153] Privacy compliance checking refers to evaluating updated audit logs to ensure that the access complies with relevant laws, regulations and internal security policies. It analyzes access behavior log entries to confirm whether there are potential privacy leakage risks or non-compliant operations.

[0154] The compliance assessment report is the result document of the privacy compliance check, which records in detail the assessment results of whether the access complies with relevant laws and regulations and internal security policies. It not only confirms the legality of the access behavior, but also provides necessary audit information to ensure the transparency and compliance of the system.

[0155] The summary of privacy protection measures and effects refers to summarizing the privacy protection measures and their effects in all access behaviors and generating a detailed privacy protection report.

[0156] In an embodiment of the present application, first, the system collects and organizes detailed information on user access based on personalized display content, and generates access behavior log entries; secondly, based on the access behavior log entries, the system audit log is automatically updated, and each query operation log entry is integrated into the system audit log to generate an update audit log; thirdly, based on the update audit log, a privacy compliance check is performed to evaluate whether the access complies with relevant laws, regulations and internal security policies, and a compliance assessment report is generated; finally, based on the compliance assessment report, all access behavior privacy protection measures and effects are summarized to generate a detailed privacy protection report.

[0157] Here is a specific example:

[0158] For example, suppose a government health department needs to regularly access hospital information systems to monitor the spread of specific infectious diseases; first, the system collects and organizes detailed information on visits by health department officials (such as visit time and query content) based on personalized display content, and generates access behavior log entries; second, based on the access behavior log entries, the system audit log is automatically updated, and each query operation log entry is integrated into the system audit log to generate an update audit log; third, based on the update audit log, a privacy compliance check is performed to evaluate whether the visit complies with relevant laws and regulations and internal security policies, and a compliance assessment report is generated; finally, based on the compliance assessment report, all access behavior privacy protection measures and effects are summarized, and a detailed privacy protection report is generated for internal review and external supervision.

[0159] This application takes into account that in order to solve the problem of insufficient privacy protection in the prior art, especially in the processing of information on the wounded and sick, the traditional method cannot accurately balance the relationship between privacy protection and data utility, resulting in an increased risk of sensitive information leakage or distortion of data analysis results. Therefore, the embodiment of the invention proposes this optional solution, which aims to ensure that the sensitivity and statistical requirements of each field are properly handled by introducing a differential privacy algorithm and a complex noise adjustment mechanism, thereby maintaining the validity of the data while protecting privacy. The solution includes:

[0160] Based on the sensitivity assessment report, a differential privacy algorithm is used to calculate the required noise amount in advance according to the sensitivity and statistical requirements of each field, and corresponding random noise is added to each field. By adjusting the noise distribution to adapt to the requirements of different fields, a noise distribution adjustment result is generated, including:

[0161] Based on the sensitivity assessment report, the privacy risk level of the field is quantitatively assessed to identify highly sensitive information, and appropriate metrics are selected according to the field type and data distribution characteristics to generate the required amount of noise;

[0162] The required amount of noise is calculated using the following formula:

[0163]

[0164] Among them, ∈ i is the noise amount required for the i-th field; α is the predefined global sensitivity factor; β is the sensitivity weight adjustment coefficient; γ and η are statistical demand influencing factors; S i is the sensitivity of field i; T i is the statistical demand of field i; δ is the exponential decay coefficient;

[0165] Based on the required noise amount, a nonlinear transformation is performed to adapt to the specific requirements of different fields, an additional adjustment factor is introduced, the flexibility of noise distribution is enhanced, and an iterative method is used to ensure that the pre-processing results can be inherited and optimized to generate an intermediate noise adjustment coefficient;

[0166] The intermediate noise adjustment factor is calculated using the following formula:

[0167]

[0168] Among them, C i is the intermediate noise adjustment coefficient of the i-th field; μ is the noise intensity factor; λ, ω and φ are nonlinear parameters used to adjust the noise distribution; ν is the influence coefficient of the noise adjustment coefficient in the previous step; C i-1 is the intermediate noise adjustment coefficient of the previous field; ∈ i is the amount of noise required for the i-th field; ρ and θ are additional nonlinear adjustment coefficients; κ is the influence coefficient of the tangent term; ψ is the frequency adjustment factor of the tangent term; ξ and ζ are exponential decay adjustment factors; η' is the noise intensity influence factor;

[0169] Based on the intermediate noise adjustment coefficient, the cosine square term and the arctangent term are introduced to maintain the overall statistical characteristics, the noise intensity is adjusted using the exponential decay function, and the iterative optimization method is adopted to gradually accumulate and optimize the noise distribution to generate a noise distribution adjustment result.

[0170] This method aims to quantitatively evaluate the privacy risk level of the field, identify highly sensitive information, and select appropriate metrics based on the field type and data distribution characteristics to generate the required amount of noise; then enhance the flexibility of the noise distribution through nonlinear transformation, use iterative methods to optimize the pre-processing results, and finally generate the noise distribution adjustment result.

[0171] In the required amount of noise, the global sensitivity term α·log(1+β·S i ): Measures the overall sensitivity of the field. By multiplying the global sensitivity factor α and the sensitivity weight adjustment coefficient β, the noise volume can reflect the global sensitivity of the field. The statistical demand influence term γ·sin(π·T i ): Capture the statistical demand changes of the field, and ensure that the data remains statistically valid even if noise is added through the sine function of the statistical demand impact factor γ and the field statistical demand Ti; exponential decay term Adjust the amount of noise as the statistical demand changes, and avoid excessive impact on the data through the combination of the exponential decay coefficient δ and the statistical demand impact factor η;

[0172] Among them, α and β are determined through experiments, usually based on historical data analysis, and can refer to the sensitivity evaluation results of similar data sets; γ and η are determined through experiments, considering the impact of statistical requirements, and can be adjusted by simulating the data utility under different statistical requirements; S i and T i Obtained from the sensitivity assessment report, the specific value can be evaluated based on the actual content of the field, such as medical record number, diagnosis information, etc.;

[0173] In the intermediate noise adjustment coefficient, the noise intensity term μ·∈ i :Measure the noise intensity required for the current field, through the noise intensity factor μ and the previously calculated noise amount ∈ i The product of ensures that the noise amount can effectively protect privacy; nonlinear adjustment term Capture the nonlinear changes of noise distribution and enhance the flexibility of noise distribution through the combination of nonlinear parameter λ, frequency adjustment factor ω and phase adjustment factor φ; the previous step affects the Inherit and optimize the pre-processing results. Through the combination of the influence coefficient ν, the additional adjustment coefficient ρ and the logarithmic adjustment factor θ of the previous step, the noise adjustment of the current step can inherit and optimize the pre-processing results; the tangent term κ·tan(ψ·∈ i ): Maintain the smoothness of the noise distribution, and ensure that the noise distribution is smoother through the combination of the tangent term influence coefficient κ and the frequency adjustment factor ψ; exponential decay adjustment term The noise intensity is gradually accumulated and optimized, and the overall statistical characteristics are maintained through the combination of the exponential decay adjustment factor ξ, the noise intensity influence factor ζ and the noise intensity influence factor η';

[0174] Among them, μ, λ, ω, φ, ν, ρ, θ, κ, ψ, ξ, ζ and η' are all determined through experiments and are usually adjusted based on simulation experiments and actual application effects to ensure the rationality and flexibility of noise distribution; ∈ i and C i-1 :Obtained from the required noise amount calculation, the specific value can be dynamically updated during each iteration to ensure that each step of noise adjustment can inherit and optimize the pre-processing results;

[0175] Assume that a medical research institution needs to regularly access the hospital information system to analyze the treatment effect of a specific disease, involving multiple sensitive fields (such as patient age, treatment plan, etc.); Assume that α=0.7, β=0.5, γ=0.6, δ=0.4, η=0.9; the field sensitivity S i =0.85 (such as patient age), statistical requirement T i =0.75 (such as treatment effect analysis);

[0176]

[0177] Assume μ=0.8,λ=0.5,ω=0.7,σ=0.4,ν=0.4,ρ=0.6,θ=0.7,κ=0.3,ψ=1.1,ξ=0.2,ζ=0.3,η'=1.0; the intermediate noise adjustment coefficient C of the previous field i-1 = 0.5, the noise amount required for the current field ∈ i =0.58;

[0178]

[0179] Assuming that the threshold is set to 0.6, since the calculated result is less than the set threshold, it indicates that the noise adjustment of the current field is sufficient and there is no need to further increase the noise amount. The lower intermediate noise adjustment coefficient reflects that under the current parameter setting, the noise amount can effectively protect privacy while maximizing the statistical utility and analytical value of the data. Through the above steps, it is ensured that medical research institutions can safely access hospital information systems involving multiple sensitive fields when analyzing the treatment effects of specific diseases.

[0180] This application takes into account that in order to solve the problem of insufficient privacy protection in the prior art, especially in the processing of information on the wounded and sick, the traditional method cannot accurately balance the relationship between privacy protection and data utility, resulting in an increased risk of sensitive information leakage or distortion of data analysis results. Therefore, the embodiment of the invention proposes this optional solution, which aims to ensure that each sensitive field is verified to be correctly encrypted without leaking actual information by introducing a zero-knowledge proof algorithm and a complex encryption recording mechanism, thereby maintaining the validity of the data while protecting privacy. The solution includes:

[0181] Based on the sensitive field list, each sensitive field in the user query result is encrypted using a zero-knowledge proof algorithm. By constructing a specific mathematical statement and a corresponding zero-knowledge proof, it is ensured that the verification field has been correctly encrypted without leaking actual information, and a zero-knowledge proof encrypted record is generated, including:

[0182] Based on the sensitive field list, analyze the field historical access patterns and usage frequencies in detail, identify high-risk fields, assess potential privacy leakage risks, consider dependencies between fields, and build a correlation map between sensitive fields to generate specific mathematical statements;

[0183] The specific mathematical statement is calculated using the following formula:

[0184]

[0185] Among them, Z i is the specific mathematical statement of the i-th sensitive field; A is the statement strength factor; B is the field proof requirement adjustment coefficient; G and D are the logical constraint impact factors; Ci is the sensitivity of the i-th sensitive field; P i is the proof requirement of field i; L i is the logical constraint of field i; E is the influence coefficient of the cosine square term; W is the frequency adjustment factor of the cosine term;

[0186] Based on the specific mathematical statement, nonlinear transformation is performed to enhance the security and adaptability of the statement, and a recursive neural network method is used for step-by-step cumulative optimization. Time series prediction technology is introduced to ensure the consistency of encrypted records on the entire data set to generate zero-knowledge proof encrypted record intermediate results;

[0187] The intermediate result of the zero-knowledge proof encryption record is calculated using the following formula:

[0188]

[0189] Among them, V i is the intermediate result of the zero-knowledge proof encryption record of the i-th sensitive field; M is the assertion strength factor; N is the influence coefficient of the encrypted record in the previous step; V i-1 Encrypt and record the intermediate result of the zero-knowledge proof of the previous field; Z i is the specific mathematical declaration of the i-th sensitive field; R and T are additional nonlinear adjustment coefficients; K is the influence index of the logarithmic absolute value term; H is the influence coefficient of the error function; Q is the frequency adjustment factor of the error function; Z' is the influence factor of the square term; L is the influence coefficient of the inverse tangent term; F is the frequency adjustment factor of the inverse tangent term; erf(x) is the error function, which is used to measure the cumulative distribution function in the probability distribution to ensure that the verification field has been correctly encrypted without leaking actual information;

[0190] Based on the intermediate result of the zero-knowledge proof encrypted record, an adaptive filter is introduced to adjust the noise distribution in the encrypted record, the intermediate result is re-encrypted through homomorphic encryption technology, and the differential privacy framework is applied to verify the validity of the encrypted record to generate a zero-knowledge proof encrypted record.

[0191] This method aims to identify high-risk fields by analyzing the historical access patterns and usage frequencies of fields in detail, and consider the dependencies between fields to build a correlation map between sensitive fields to generate specific mathematical statements. It then enhances the security and adaptability of the statements through nonlinear transformations, uses recursive neural network methods for gradual cumulative optimization, introduces time series prediction technology to ensure the consistency of encrypted records across the entire data set, and ultimately generates zero-knowledge proof encrypted records.

[0192] In a specific mathematical statement, the strength term is declared Measure the strength of the field statement, through the combination of the statement strength factor A and the field proof requirement adjustment coefficient B, to ensure that the statement can reflect the sensitivity of the field; the logical constraint influence term G·sinh(D·L i ): Capture the logical constraint changes of the field, through the logical constraint influencing factor G and logical constraint L i The hyperbolic sine function ensures that the data remains logically consistent even if declarations are added; the cosine square term E·cos 2 (W.C i ): Adjust the change of the statement with the sensitivity level, through the combination of the cosine square term influence coefficient E and the frequency adjustment factor W, to avoid excessive impact on the reliability of the statement;

[0193] Among them, A and B are determined through experiments, usually based on historical data analysis, and can refer to the sensitivity assessment results of similar data sets; G and D are determined through experiments, considering the influence of logical constraints, and can be adjusted by simulating the data utility under different logical constraints; C i and P i The specific value can be obtained from the list of sensitive fields, and the specific value can be evaluated based on the actual content of the field, such as medical record number, diagnosis information, etc. i Obtained from the dependencies between fields, specific values ​​can be evaluated based on the logical constraints between fields.

[0194] In the zero-knowledge proof encryption record intermediate result, declare the strength item Measure the specific mathematical statement strength of the current field, by the statement strength factor M and the previously calculated mathematical statement Z i combination to ensure that the statement can effectively protect privacy; the previous step encrypts the records of the affected items Inherit and optimize the pre-processing results. Through the combination of the influence coefficient N, additional adjustment coefficient R, influence index K of the logarithmic absolute value term and logarithmic adjustment factor T of the previous step, the encrypted record of the current step can inherit and optimize the pre-processing results; error function term Maintain the smoothness of the encrypted record, and ensure that the encrypted record is smoother through the combination of the influence coefficient H of the error function, the frequency adjustment factor Q and the influence factor Z' of the square term; the inverse tangent term L·tan -1 (F.V i-1 ): Gradually accumulate and optimize the encrypted records, and maintain the consistency of the encrypted records on the entire data set through the combination of the influence coefficient L of the inverse tangent term and the frequency adjustment factor F;

[0195] Among them, M, N, R, T, K, H, Q, Z', L and F are all determined through experiments and are usually adjusted based on simulation experiments and actual application effects to ensure the rationality and flexibility of encrypted records; Z i and V i-1Obtained from the previous step, the specific value can be dynamically updated during each iteration, ensuring that the encrypted record of each step can inherit and optimize the pre-processing results.

[0196] Assume that a large public medical institution needs to regularly access the hospital information system to monitor the spread of a specific infectious disease, involving multiple sensitive fields (such as patient geographic location, contact history, etc.); Assume A = 0.8, B = 0.6, G = 0.7, D ​​= 0.5, E = 0.4, W = 0.3; field sensitivity C i =0.9 (such as patient geographic location), field proof requirement P i =0.8 (such as propagation path analysis), field logic constraint L i =0.7 (such as the relationship between geographic location and other fields);

[0197]

[0198] Assume that M = 0.9, N = 0.8, R = 0.7, T = 0.6, K = 0.5, H = 0.4, Q = 0.3, Z' = 0.2, L = 0.1, F = 0.1; the zero-knowledge proof of the previous field encrypts the intermediate record result V i-1 =0.6, the specific mathematical statement of the current field Z i =0.65;

[0199]

[0200] Assuming that the threshold is set to 0.8, since the calculated result 0.72 is less than the set threshold, it shows that the zero-knowledge proof encrypted record of the current field is secure enough and does not need to be further enhanced. This is because the lower intermediate result of the encrypted record reflects that under the current parameter settings, the encryption process can effectively protect privacy while maximizing the statistical utility and analytical value of the data. Through the above steps, it is ensured that large public medical institutions can securely access hospital information systems involving multiple sensitive fields (such as patient geographic location, contact history, etc.) when monitoring the spread of infectious diseases, improve the security of data transmission and storage, and enhance the accuracy and response speed of the entire health monitoring system.

[0201] Figure 2 A schematic diagram of the structure of a system for protecting the privacy of patient information is provided for the present application embodiment. Figure 2 As shown, the device comprises:

[0202] A receiving module 21 is used to receive a query request for verifying an authorized user, identify non-sensitive identification information of a specific patient, and generate a security access token;

[0203] The computing module 22 is used to use a differential privacy algorithm based on the security access token to accurately calculate the required noise amount according to the sensitivity and statistical requirements, add an appropriate amount of noise to each field to protect individual privacy, use secure multi-party computing technology to distribute information summaries to multiple parties, perform joint query and statistical analysis through encryption protocols, and generate encrypted aggregation results;

[0204] The processing module 23 is used to use a zero-knowledge proof algorithm based on the encrypted aggregation result, predefine security parameters to construct a proof statement, encrypt sensitive fields in the user query result, adopt a fine-grained access control method, dynamically evaluate the user operation context and the principle of least privilege, intelligently adjust the visible information range, and generate personalized display content;

[0205] The recording module 24 is used to query and automatically update the audit log based on the personalized display content, record the key parameters of the access behavior, and generate a detailed privacy protection report.

[0206] Figure 2 The system for protecting the privacy of patient information can be implemented Figure 1 The implementation principle and technical effect of the method for protecting the privacy of patient information described in the embodiment are not described in detail. The specific way in which each module and unit performs operations in the system for protecting the privacy of patient information in the above embodiment has been described in detail in the embodiment of the method, and will not be described in detail here.

[0207] In one possible design, Figure 2 The patient information privacy protection system of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0208] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0209] The processing component 32 is used to: receive and verify the query request of the authorized user, identify the non-sensitive identification information of the specific injured and sick, and generate a secure access token; based on the secure access token, use the differential privacy algorithm to accurately calculate the required noise amount according to the sensitivity and statistical requirements, add an appropriate amount of noise to each field to protect individual privacy, use secure multi-party computing technology to distribute the information summary to multiple parties, perform joint query and statistical analysis through encryption protocols, and generate encrypted aggregation results; based on the encrypted aggregation results, use the zero-knowledge proof algorithm, predefine security parameters to construct proof statements, encrypt sensitive fields in the user query results, use fine-grained access control methods, dynamically evaluate the user operation context and the principle of least privilege, intelligently adjust the visible information range, and generate personalized display content; based on the personalized display content, complete the query and automatically update the audit log, record the key parameters of this access behavior, and generate a detailed privacy protection report.

[0210] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0211] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0212] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0213] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0214] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0215] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0216] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 A method for protecting the privacy of patient information in the illustrated embodiment.

[0217] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0218] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0219] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0220] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for protecting the privacy of patient information, characterized in that: include: Receive verification and authorization user query requests to identify specific non-sensitive identification information of the injured or sick and generate a security access token; Based on the secure access token, a differential privacy algorithm is used to accurately calculate the required amount of noise according to the sensitivity and statistical requirements, and an appropriate amount of noise is added to each field to protect individual privacy. Secure multi-party computing technology is used to distribute information summaries to multiple parties, and joint queries and statistical analysis are performed through encryption protocols to generate encrypted aggregation results. Based on the encrypted aggregation results, a zero-knowledge proof algorithm is used to predefine security parameters to construct proof statements, encrypt sensitive fields in user query results, and adopt a fine-grained access control method to dynamically evaluate user operation context and the principle of least privilege to intelligently adjust the visible information range and generate personalized display content; Based on the personalized display content, the query is completed to automatically update the audit log, record the key parameters of the access behavior, and generate a detailed privacy protection report.

2. The method according to claim 1, characterized in that Based on the secure access token, the differential privacy algorithm is used to accurately calculate the required noise amount according to the sensitivity and statistical requirements, and an appropriate amount of noise is added to each field to protect individual privacy. The secure multi-party computing technology is used to distribute the information summary to multiple participants, and the encryption protocol is used to perform joint query and statistical analysis to generate encrypted aggregation results, including: Based on the security access token, perform field sensitivity assessment on the patient data matching the query condition and generate a de-identified summary; Based on the de-identified summary, a differential privacy algorithm is used to accurately calculate the required amount of noise according to the sensitivity and statistical requirements, and an appropriate amount of noise is added to each field to protect individual privacy, thereby generating a noise-processed summary; Based on the noise processing summary, secure multi-party computing technology is used to distribute the information summary to multiple participants, and joint query and statistical analysis are performed through encryption protocols to generate distributed encryption middleware; Based on the distributed encryption middleware, a secure channel of secure multi-party computing technology is used to ensure that no single party obtains complete information and intermediate results alone, thereby generating an encrypted aggregation result.

3. The method according to claim 2, characterized in that Based on the de-identified summary, a differential privacy algorithm is used to accurately calculate the required amount of noise according to the sensitivity and statistical requirements, add an appropriate amount of noise to each field to protect individual privacy, and generate a noise processing summary, including: Based on the de-identified summary, conduct a preliminary assessment of sensitivity and statistical requirements, accurately calculate the required amount of noise according to data utility requirements, and generate a sensitivity assessment report; Based on the sensitivity assessment report, a differential privacy algorithm is used to add corresponding random noise to each field according to the pre-calculated required noise amount according to the sensitivity and statistical requirements of each field, and the noise distribution is adjusted to adapt to the requirements of different fields to generate a noise distribution adjustment result; Based on the noise distribution adjustment result, a data consistency check is performed to ensure that the data after the noise distribution adjustment still complies with the logic and business rules, and a consistency check summary is generated; Based on the consistency check summary, the content is further screened in detail to ensure that all fields have been properly noised, and a noise processing summary is generated.

4. The method according to claim 2, characterized in that: Based on the noise processing summary, the secure multi-party computing technology is used to distribute the information summary to multiple participants, and joint query and statistical analysis are performed through the encryption protocol to generate distributed encryption middleware, including: Based on the noise processing summary, the encryption requirements of each field and the roles of the participants are evaluated, and a suitable encryption algorithm is selected to generate an encryption key for each field, and an encryption configuration scheme is generated; Based on the encryption configuration scheme, encryption processing is performed through homomorphic encryption, and the information summary is distributed to multiple participants to generate a distributed encrypted data set; Based on the distributed encrypted data set, secure multi-party computing technology is used to establish a secure channel through an encryption protocol, allowing each participant to perform joint query and statistical analysis to generate encrypted computing middleware; Based on the encryption calculation middleware, a series of verification steps are performed, the encryption calculation results of each participant are summarized, and the distributed encryption middleware is generated.

5. The method according to claim 1, characterized in that Based on the encrypted aggregation result, the zero-knowledge proof algorithm is used, security parameters are predefined to construct proof statements, sensitive fields in user query results are encrypted, and a fine-grained access control method is adopted to dynamically evaluate the user operation context and the principle of least privilege, intelligently adjust the visible information range, and generate personalized display content, including: Based on the encrypted aggregation results, sensitive fields are identified and classified, a zero-knowledge proof environment is initialized, a mathematical statement template and security parameters are prepared, and a privacy protection configuration is generated; Based on the privacy protection configuration, each sensitive field in the user query result is encrypted using a zero-knowledge proof algorithm, and a secure encryption process is performed by constructing a specific mathematical statement and a corresponding zero-knowledge proof to generate an enhanced encrypted field; Based on the enhanced encrypted field, a fine-grained access control method is adopted to dynamically evaluate the user operation context and the principle of least privilege, intelligently adjust the visible information range, and generate a personalized display configuration; Based on the personalized display configuration, the encrypted sensitive fields are integrated with the non-sensitive fields to optimize the user experience and generate personalized display content.

6. The method according to claim 5, characterized in that Based on the privacy protection configuration, the zero-knowledge proof algorithm is used to encrypt each sensitive field in the user query result, and a specific mathematical statement and a corresponding zero-knowledge proof are constructed to perform secure encryption processing to generate an enhanced encrypted field, including: Based on the privacy protection configuration, determine the fields that require additional privacy protection measures and generate a list of sensitive fields; Based on the sensitive field list, each sensitive field in the user query result is encrypted using a zero-knowledge proof algorithm, and a zero-knowledge proof encrypted record is generated to ensure that the verification field is correctly encrypted without leaking actual information by constructing a specific mathematical statement and a corresponding zero-knowledge proof; Based on the zero-knowledge proof encrypted record, perform data integrity check to ensure that all sensitive fields are properly encrypted as required, and generate an encryption verification report; Based on the encryption verification report, enhanced encryption operations are performed on all verified sensitive fields to further strengthen the security of each sensitive field and generate enhanced encrypted fields.

7. The method according to claim 1, characterized in that Based on the personalized display content, the query automatically updates the audit log, records the key parameters of the access behavior, and generates a detailed privacy protection report, including: Based on the personalized display content, detailed information about user access is collected and sorted to generate access behavior log entries; Based on the access behavior log entries, the system audit log is automatically updated, each query operation log entry is integrated into the system audit log, and an update audit log is generated; Based on the update audit log, perform a privacy compliance check to evaluate whether the access complies with relevant laws, regulations and internal security policies, and generate a compliance assessment report; Based on the compliance assessment report, all access behavior privacy protection measures and effects are summarized to generate a detailed privacy protection report.

8. A system for protecting the privacy of patient information, characterized in that: include: A receiving module, used to receive and verify the query request of the authorized user, to identify the non-sensitive identification information of the specific injured or sick person, and to generate a security access token; A computing module is used to use a differential privacy algorithm based on the security access token to accurately calculate the required amount of noise according to the sensitivity and statistical requirements, add an appropriate amount of noise to each field to protect individual privacy, use secure multi-party computing technology to distribute information summaries to multiple parties, perform joint query and statistical analysis through encryption protocols, and generate encrypted aggregation results; A processing module is used to encrypt sensitive fields in user query results based on the encrypted aggregation results, apply a zero-knowledge proof algorithm, predefine security parameters to construct proof statements, adopt a fine-grained access control method, dynamically evaluate user operation context and the principle of least privilege, intelligently adjust the visible information range, and generate personalized display content; The recording module is used to complete the query and automatically update the audit log based on the personalized display content, record the key parameters of the access behavior, and generate a detailed privacy protection report.

9. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a method for protecting the privacy of information of injured and sick persons as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, a method for protecting the privacy of information of injured and sick persons as claimed in any one of claims 1 to 7 is implemented.

Images