Medical image encryption and secure storage method and system based on block chain

Abstract

The invention discloses a medical image encryption and secure storage method and system based on a block chain, and the method comprises the steps: obtaining the original data of a medical image, segmenting the original data of the medical image into a plurality of segments through a fragmentation technology, carrying out the encryption of each segment through a symmetric encryption algorithm, generating an encrypted segment set, and storing the encrypted segment set in a database; determining an integrity check value of the encrypted fragment set; according to the encrypted fragment set, adopting a distributed storage protocol to distribute each fragment to a plurality of storage nodes, recording a storage position and an integrity check value of each fragment to a block chain account book, and generating a storage index containing a storage path and check information; and establishing an access control strategy through the block chain smart contract, and if the obtained requester identity identifier and the authority level conform to the access control strategy, generating a dynamic authorization token including an access range and time limitation. According to the method, the privacy of the patient is protected, and meanwhile, the safety and availability of medical data are improved.

Description

Technical Field

[0001] The present invention relates to the field of image processing technology, and in particular discloses a medical image encryption and secure storage method and system based on blockchain. Background Art

[0002] Medical data management is a key area in the modern medical system, directly related to patient privacy protection, data security and cross-institutional collaboration efficiency. With the advancement of digital transformation, medical images, as core data for diagnosis and treatment, have become the top priority for the development of medical informatization. Blockchain technology has been widely explored for medical data management due to its decentralization, tamper-proof and high transparency. However, existing solutions still have significant limitations in practical applications. Traditional centralized storage systems are susceptible to single point failures and data leakage risks, and lack effective privacy protection mechanisms; existing blockchain solutions are difficult to meet the dual needs of efficiency and compliance in medical scenarios due to high on-chain storage costs and complex access control. In addition, the lack of standardization and traceability of cross-institutional data sharing further limits the efficiency of collaboration.

[0003] These limitations reflect the core challenges in this field: how to achieve efficient distributed storage and fine-grained access control while ensuring the security of medical image data, as well as ensuring compliance and traceability of cross-institutional sharing. Specifically, data encryption and integrity assurance need to strike a balance between high security and computing efficiency; distributed storage architecture needs to solve the load optimization problem caused by the separation of on-chain and off-chain data; and access control mechanisms need to balance flexibility and compliance in dynamic authorization and permission management. These unresolved technical factors lead to unique technical challenges in privacy protection, efficient sharing, and operational traceability of medical image data.

[0004] Therefore, how to design a blockchain-based medical image encryption and secure storage method to achieve data tamper-proofing, privacy protection, and efficient cross-institutional sharing by combining efficient encryption, distributed storage architecture, and smart contract dynamic authorization mechanism has become a key issue in this study. Summary of the invention

[0005] The present invention provides a blockchain-based medical image encryption and secure storage method and system, aiming to solve at least one defect of the above-mentioned prior art in terms of privacy protection, efficient sharing and operation traceability of medical image data.

[0006] One aspect of the present invention relates to a medical image encryption and secure storage method based on blockchain, comprising the following steps: Obtaining original medical image data, dividing the original medical image data into multiple fragments using a fragmentation technology, encrypting each fragment using a symmetric encryption algorithm, generating an encrypted fragment set, and determining an integrity check value of the encrypted fragment set; According to the encrypted fragment set, each fragment is distributed to multiple storage nodes using a distributed storage protocol, the storage location and integrity check value of each fragment is recorded in the blockchain ledger, and a storage index containing the storage path and check information is generated; Establish access control policies through blockchain smart contracts. If the identity and permission level of the requester obtained meet the access control policy, a dynamic authorization token containing the access scope and time limit is generated; Extract the storage index from the blockchain ledger according to the dynamic authorization token, retrieve the encrypted fragment set from the corresponding storage node through the distributed storage protocol, and verify the consistency of the integrity check value and the storage node data; The verified encrypted fragment set is decrypted using a symmetric decryption algorithm, the original medical image data is restored through fragmentation and reconstruction technology, and the decryption operation records and data access logs are written into the blockchain ledger.

[0007] Further, the steps of obtaining the original medical image data, dividing the original medical image data into multiple fragments by using the fragmentation technology, encrypting each fragment by using the symmetric encryption algorithm, generating an encrypted fragment set, and determining the integrity check value of the encrypted fragment set include: Obtaining original medical image data, and using a fragmentation technique to segment the original medical image data into multiple fragments to obtain a fragment set; According to the fragment set, each fragment is encrypted by a symmetric encryption algorithm to generate an encrypted fragment set; For the encrypted fragment set, calculate the integrity check value to obtain a check value set; If the encrypted segment set needs to be verified, the data integrity is determined by comparing the check value set with a preset threshold.

[0008] Furthermore, according to the encrypted fragment set, each fragment is distributed to multiple storage nodes using a distributed storage protocol, and the storage location and integrity check value of each fragment are recorded in the blockchain account book. The steps of generating a storage index including the storage path and check information include: A distributed storage protocol is used to process the encrypted fragment set, the storage address of each fragment is calculated through a hash function, the storage node identifier and the fragment mapping are recorded, and the distributed storage allocation result is obtained; According to the distributed storage allocation result, the integrity check value is calculated for each encrypted fragment using the SHA-256 algorithm, the corresponding storage path is obtained, and metadata including the fragment identifier, check value and path is generated to obtain a metadata set; If the metadata set is generated, the metadata set is written into the blockchain account book through the smart contract, and the on-chain record protocol is adopted to obtain the transaction hash and block height to obtain the on-chain record certificate; According to the transaction hash of the on-chain record certificate, the index generation algorithm is used to integrate the storage path and verification information, generate a storage index containing the fragment identifier and verification value, and store it in the distributed database to obtain a queryable storage index.

[0009] Furthermore, an access control policy is established through a blockchain smart contract. If the obtained requester identity and permission level meet the access control policy, the steps of generating a dynamic authorization token including the access scope and time limit include: Obtain the identity and permission level from the access request submitted by the requester, perform preliminary decoding through the blockchain node, and obtain the decoded identity data; If the decoded identity data matches the access control policy preset in the smart contract, the permission level comparison is used to determine whether the policy requirements are met; According to the permission matching result, the corresponding access scope and time limit parameters are obtained from the smart contract to generate a temporary access key containing the scope and time constraints; The temporary access key is encrypted through the blockchain distributed ledger to obtain a dynamic authorization token; Extract the access scope and time limit from the dynamic authorization token, use the hash algorithm to verify the integrity of the token, and determine whether the token is valid; If the token verification is successful, access rights are assigned through the smart contract interface to obtain the resource path for authorized access; According to the resource path of authorized access, the access log is recorded in the blockchain ledger to generate an unalterable record of the access operation.

[0010] Further, the steps of extracting a storage index from the blockchain ledger according to the dynamic authorization token, retrieving an encrypted fragment set from a corresponding storage node through a distributed storage protocol, and verifying the consistency of the integrity check value with the storage node data include: According to the dynamic authorization token, the storage index is obtained from the blockchain ledger, a query request is generated using a hash mapping algorithm, and the query request is sent to the blockchain node through the node communication protocol to obtain the storage index; If the storage index is successfully obtained, a retrieval request is sent to the corresponding storage node through the distributed storage protocol, and a multi-threaded concurrent mechanism is used to obtain the encrypted segment set from the storage node to obtain the encrypted segment set; According to the encrypted segment set, the encrypted segment is decrypted by using a data decryption algorithm, and a decrypted data segment is generated by using a preset decryption key to obtain decrypted data; The integrity check algorithm is used to calculate the hash value of the decrypted data and compare it with the pre-stored hash value of the storage node. If the hash value is consistent, the data consistency is determined.

[0011] Furthermore, the steps of decrypting the verified encrypted fragment set using a symmetric decryption algorithm, restoring the original medical image data through fragmentation and reconstruction technology, and writing the decryption operation record and data access log into the blockchain account book include: Obtaining an encrypted segment set, and decrypting the encrypted segment set using a symmetric decryption algorithm to obtain a decrypted data segment set; According to the decrypted data fragment set, the fragmentation and reassembly technology is used to reassemble according to predetermined rules to obtain the original medical image; If the original medical image passes the data integrity verification, an operation record is generated based on the timestamp and key information of the decryption operation and written into the blockchain account book to obtain an unalterable record identifier; When data access occurs, the visitor's identity information and access time are obtained, an access log is generated and written into the blockchain ledger, and the hash value of the access record is obtained.

[0012] Another aspect of the present invention relates to a blockchain-based medical image encryption and secure storage system, which is used to implement the above-mentioned blockchain-based medical image encryption and secure storage method. The blockchain-based medical image encryption and secure storage system includes: An acquisition module is used to acquire the original data of the medical image, divide the original data of the medical image into multiple fragments by using the fragmentation technology, encrypt each fragment by using the symmetric encryption algorithm, generate an encrypted fragment set, and determine the integrity check value of the encrypted fragment set; The first generation module is used to distribute each fragment to multiple storage nodes according to the encrypted fragment set using a distributed storage protocol, record the storage location and integrity check value of each fragment to the blockchain account book, and generate a storage index including the storage path and check information; The second generation module is used to establish an access control policy through a blockchain smart contract. If the obtained requester identity and permission level meet the access control policy, a dynamic authorization token including the access scope and time limit is generated; A verification module is used to extract a storage index from the blockchain ledger according to a dynamic authorization token, retrieve a set of encrypted fragments from a corresponding storage node through a distributed storage protocol, and verify the consistency of the integrity check value with the storage node data; The decryption module is used to decrypt the verified encrypted fragment set using a symmetric decryption algorithm, restore the original medical image data through fragmentation and reconstruction technology, and write the decryption operation record and data access log into the blockchain account book.

[0013] Furthermore, the acquisition module includes: A first acquisition unit is used to acquire original medical image data, and to divide the original medical image data into multiple segments using a segmentation technique to obtain a segment set; A first generating unit is used to encrypt each fragment by a symmetric encryption algorithm according to the fragment set to generate an encrypted fragment set; A second obtaining unit is used to calculate the integrity check value for the encrypted segment set to obtain a check value set; The first comparison unit is used to determine the data integrity by comparing the check value set with a preset threshold value if the encrypted segment set needs to be verified.

[0014] Furthermore, the first generation module includes: A third acquisition unit is used to process the encrypted fragment set using a distributed storage protocol, calculate the storage address of each fragment through a hash function, record the storage node identifier and the fragment mapping, and obtain a distributed storage allocation result; A fourth acquisition unit is used to calculate the integrity check value for each encrypted segment using the SHA-256 algorithm according to the distributed storage allocation result, obtain the corresponding storage path, generate metadata including the segment identifier, the check value and the path, and obtain a metadata set; The fifth acquisition unit is used to write the metadata set into the blockchain account book through the smart contract if the metadata set is generated, adopt the on-chain record protocol, obtain the transaction hash and block height, and obtain the on-chain record certificate; The sixth acquisition unit is used to integrate the storage path and verification information according to the transaction hash of the on-chain record certificate using an index generation algorithm, generate a storage index including a fragment identifier and a verification value, store it in a distributed database, and obtain a searchable storage index.

[0015] Furthermore, the second generation module includes: The seventh acquisition unit is used to obtain the identity identification and permission level from the access request submitted by the requester, and perform preliminary decoding through the blockchain node to obtain the decoded identity data; A first judgment unit is used to judge whether the policy requirements are met by comparing the permission levels if the decoded identity data matches the access control policy preset in the smart contract; A second generation unit is used to obtain corresponding access scope and time limit parameters from the smart contract according to the permission matching result, and generate a temporary access key containing scope and time constraints; an eighth acquisition unit, configured to encrypt the temporary access key through a blockchain distributed ledger to obtain a dynamic authorization token; A second judgment unit is used to extract the access scope and time limit from the dynamic authorization token, use a hash algorithm to verify the integrity of the token, and judge whether the token is valid; The ninth acquisition unit is used to allocate access rights through the interface of the smart contract if the token verification is successful, and obtain the resource path for authorized access; The third generation unit is used to record the access log to the blockchain account book according to the resource path authorized for access, and generate an unalterable record of the access operation.

[0016] The beneficial effects achieved by the present invention are: The present invention provides a blockchain-based medical image encryption and secure storage method and system, which processes medical image data through sharding encryption technology, and uses a distributed storage protocol to disperse and store encrypted fragments in multiple nodes, while recording storage indexes and integrity verification information in a blockchain account book; uses smart contracts to establish access control strategies, generates dynamic tokens for authorized users, and realizes secure retrieval and decryption and reorganization of medical data; key operations in the entire process are recorded in the blockchain, ensuring the traceability of data access; effectively solves the problems of secure storage of medical image data, refined access control, and operation auditing, while protecting patient privacy, improving the security and availability of medical data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flow chart of an embodiment of a method for medical image encryption and secure storage based on blockchain of the present invention. DETAILED DESCRIPTION

[0018] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0019] like Figure 1 As shown, the first embodiment of the present invention proposes a medical image encryption and secure storage method based on blockchain, comprising the following steps: Step S100, obtaining the original data of the medical image, dividing the original data of the medical image into multiple fragments by using the fragmentation technology, encrypting each fragment by using the symmetric encryption algorithm, generating an encrypted fragment set, and determining the integrity check value of the encrypted fragment set.

[0020] Medical image raw data refers to the initial data directly obtained from medical imaging equipment (such as CT, MRI, etc.) that has not been reconstructed or has only undergone preliminary processing.

[0021] Sharding is a technology that divides large-scale data sets or system resources into multiple independent fragments (shards) to improve performance, scalability, and fault tolerance through distributed storage or processing. The core goal of sharding technology is to solve the single-point bottleneck problem through horizontal expansion (rather than vertical hardware upgrades).

[0022] Symmetric Encryption Algorithm is an encryption technology whose core feature is that the same key is used for encryption and decryption.

[0023] Encrypted Fragment Collection ‌ refers to a ciphertext collection formed by dividing the original data into multiple independent fragments through an encryption algorithm and encrypting them separately.

[0024] The integrity check value of an encrypted fragment set refers to a verification mark used to verify whether the encrypted data fragment has been tampered with or damaged, which is usually generated and verified through cryptographic technology.

[0025] Step S200: According to the encrypted fragment set, each fragment is distributed to multiple storage nodes using a distributed storage protocol, the storage location and integrity check value of each fragment are recorded in the blockchain account book, and a storage index containing the storage path and verification information is generated.

[0026] The distributed storage protocol is a set of specifications and rules for achieving decentralized storage, collaborative management, and unified access of data among multiple independent nodes. Its core goal is to integrate decentralized storage resources through the network to form a logically unified storage service while ensuring data reliability, scalability, and efficient access.

[0027] A storage node is the basic component of a distributed storage system, referring to a physical or logical entity that independently assumes the responsibility of data storage and management.

[0028] The blockchain ledger is a decentralized, tamper-proof distributed database that records transactions or status changes in a chain structure and relies on cryptography and consensus mechanisms to ensure data consistency across the entire network.

[0029] The storage index is a metadata organization structure used to quickly locate the physical location of data in the storage system. It optimizes data retrieval efficiency by establishing a mapping relationship between logical identifiers (such as file names, key values) and physical storage addresses (such as disk blocks, node IDs).

[0030] Step S300: Establish an access control policy through a blockchain smart contract. If the obtained requester identity and permission level meet the access control policy, a dynamic authorization token including the access scope and time limit is generated.

[0031] Blockchain smart contracts are automated protocols that run on blockchain. They convert contract terms into automatically executable program logic through programming codes, and autonomously trigger and complete transactions or operations when preset conditions are met, without relying on human or centralized agency intervention.

[0032] Access control policy is a set of rules used to manage resource access rights in information security systems. It prevents unauthorized access and data leakage by clarifying the operating permissions of subjects (users, processes) on objects (data, services). The core goal of access control policy is to ensure the principle of least privilege and permission isolation, and balance security and business flexibility.

[0033] A dynamic authorization token is a temporary, dynamically generated digital credential used to verify user identity and grant specific operation permissions. Its core feature is that it dynamically adjusts the scope of permissions based on real-time context (such as time, device status, and risk level) to ensure the security and flexibility of access control.

[0034] Step S400: extract the storage index from the blockchain ledger according to the dynamic authorization token, retrieve the encrypted fragment set from the corresponding storage node through the distributed storage protocol, and verify the consistency of the integrity check value and the storage node data.

[0035] The ‌Encrypted Segment Set‌ is a ciphertext set formed by dividing the original data into multiple logical or physical segments and encrypting each segment independently through an encryption algorithm. The core goal of the encrypted segment set is to improve data security through the ‌shard encryption mechanism‌ and prevent the risk of overall data leakage or tampering.

[0036] Step S500: Decrypt the verified encrypted fragment set using a symmetric decryption algorithm, restore the original medical image data through fragmentation and reconstruction technology, and write the decryption operation record and data access log into the blockchain account book.

[0037] Symmetric decryption algorithm is the reverse process in the symmetric encryption system, which refers to the algorithm that uses the same key as the encryption stage to restore the ciphertext to plaintext. The core feature of the symmetric decryption algorithm is the consistency of encryption and decryption keys, and relies on the security of the key to ensure data confidentiality.

[0038] Shard reconstruction technology is the process of recombining sharded data (plaintext or ciphertext fragments) into a complete data entity in the original logical or physical order. The core goal of shard reconstruction technology is to ensure the integrity and availability of data through a structured restoration mechanism.

[0039] Decryption operation records are the process of restoring ciphertext to plaintext through a symmetric key algorithm and the same key used for encryption. The core features of decryption operation records are key consistency and algorithm reversibility.

[0040] Data access logs are structured records of access behaviors of data entities (such as files, database records, API resources, etc.). The core function of data access logs is to track access subjects, operation types, time, and results to support security audits, anomaly detection, and compliance verification.

[0041] Furthermore, the blockchain-based medical image encryption and secure storage method provided in this embodiment includes step S100: Step S110, obtaining original medical image data, and using fragmentation technology to segment the original medical image data into multiple fragments to obtain a fragment set.

[0042] In the field of medical image data processing, obtaining raw medical image data and performing segmentation, encryption, and integrity verification is a rigorous technical process aimed at ensuring data security and integrity.

[0043] The following analysis and examples are provided around each technical topic of the process, and the implementation methods and beneficial effects are explained in combination with business scenarios.

[0044] For example, obtaining raw medical image data usually refers to extracting image data in DICOM (Digital Imaging and Communications in Medicine) format from medical devices such as CT (Computed Tomography) machines or MRI (Nuclear Magnetic Resonance Imaging) devices. Raw medical image data contains patient information and image details, and the data volume is large and sensitive. For example, a chest CT scan may generate hundreds of MB (Megabyte) of DICOM files, including multi-layer slice images.

[0045] When acquiring, it is necessary to ensure that the transmission process of the original medical image data from the device to the processing system is protected, such as transmission through a dedicated network to avoid data leakage. This method ensures the reliability and integrity of the original data and lays the foundation for subsequent processing.

[0046] In a possible implementation, the fragmentation technology is to divide the original medical image data into multiple fragments for efficient processing and storage. For example, a 500MB CT image data file is divided into 10 50MB fragments to generate a fragment set.

[0047] Segmentation can be based on fixed size or content characteristics, such as grouping by image slices.

[0048] After sharding, each fragment can be processed independently, reducing the amount of data processed at a time and improving system efficiency. In addition, sharding facilitates distributed storage or transmission, reducing the risk of single point failure.

[0049] It should be noted that the sharding needs to record the metadata of each fragment, such as the fragment number and original position, for subsequent reassembly.

[0050] Step S120: According to the fragment set, each fragment is encrypted by a symmetric encryption algorithm to generate an encrypted fragment set.

[0051] Specifically, the segment set is encrypted using a symmetric encryption algorithm to generate an encrypted segment set.

[0052] Symmetric encryption such as AES-256 is an efficient encryption method that uses a single key to encrypt and decrypt data. For example, for the above 10 50MB fragments, the same AES-256 key is used to encrypt each of them, generating 10 encrypted fragments. The encryption process ensures that even if the fragment is intercepted, the content cannot be directly read.

[0053] Preferably, key management needs to be distributed through a secure channel, such as using a hardware security module to store keys to prevent key leakage. The technical effect of encryption is significant, not only protecting patient privacy, but also meeting medical data compliance requirements, such as HIPAA (Health Insurance Portability and Accountability Act / 19).

[0054] Step S130: Calculate the integrity check value for the encrypted segment set to obtain a check value set.

[0055] In one embodiment, an integrity check value is calculated for a set of encrypted segments to obtain a set of check values.

[0056] Integrity verification usually uses a hash algorithm such as SHA-256 to generate a fixed-length check value for each encrypted fragment. For example, 10 encrypted fragments are calculated to obtain 10 SHA-256 check values, which form a check value set. These check values ​​are used as data fingerprints to detect whether the data has been tampered with.

[0057] It is understandable that the check value calculation is simple and efficient, suitable for large-scale data verification, and the anti-collision property of SHA-256 ensures the reliability of the check value. For example, in the data verification stage, the data integrity is determined by comparing the check value set with the preset threshold.

[0058] Step S140: If the encrypted segment set needs to be verified, the data integrity is determined by comparing the check value set with a preset threshold.

[0059] The preset threshold is usually a checksum value originally calculated and stored in a secure database.

[0060] During verification, the checksum of each encrypted fragment is recalculated and compared with the stored checksum. For example, the 10 fragments after transmission are verified one by one. If all the checksums are consistent, the data is complete; if a checksum does not match, it may mean that the fragment has been tampered with or damaged, and needs to be retransmitted or an alarm is issued. This mechanism ensures the consistency of data during transmission or storage, and is particularly suitable for telemedicine scenarios, such as sharing image data between hospitals.

[0061] In one embodiment, the above process can be extended to cloud storage scenarios. The encrypted fragments after sharding are stored in multiple cloud nodes in a dispersed manner, and the check value set is used to periodically verify data integrity. This approach improves data availability and fault tolerance while ensuring security through encryption and verification. For example, a hospital stores encrypted fragments on nodes of three different cloud service providers. Even if one node fails, other nodes can still provide complete data. Regular verification can detect data anomalies in a timely manner and improve system reliability.

[0062] Through the above technical solutions, the security, integrity and efficiency of medical image data are significantly improved.

[0063] Sharding reduces processing complexity, encryption protects privacy, and verification ensures data consistency, together building a reliable medical data processing system that meets strict compliance requirements and supports efficient medical services.

[0064] Preferably, in the blockchain-based medical image encryption and secure storage method provided in this embodiment, step S200 includes: Step S210: Use a distributed storage protocol to process the encrypted fragment set, calculate the storage address of each fragment through a hash function, record the storage node identifier and the fragment mapping, and obtain a distributed storage allocation result.

[0065] The core of the distributed storage protocol for processing encrypted fragment collections is to store data in a decentralized manner to improve security and scalability. For example, in medical image data management, encrypted image fragments need to be distributed to multiple storage nodes.

[0066] In one possible implementation, the system generates a storage address for each fragment through a consistent hashing algorithm. Assume that the CT image data of a hospital is divided into 100 encrypted fragments, and the hash function calculates a unique address based on the fragment identifier, and distributes the fragment to 10 storage nodes, with each node storing 10 fragments.

[0067] When recording the mapping between node identifiers and fragments, the system generates a mapping table containing fragment IDs and node IP addresses, such as "Fragment 001-Node A:192.168.1.1", to ensure quick positioning during subsequent retrieval.

[0068] Step S220: According to the distributed storage allocation result, the integrity check value is calculated for each encrypted fragment using the SHA-256 algorithm, the corresponding storage path is obtained, metadata including the fragment identifier, check value and path is generated, and a metadata set is obtained.

[0069] Specifically, the SHA-256 algorithm is used to calculate the integrity check value for each encrypted segment to verify that the data has not been tampered with. In one embodiment, the check value of segment 001 is generated by SHA-256 to generate a 32-byte hash value, such as "a1b2c3", and is associated with the storage path " / nodeA / 001" to form metadata.

[0070] The metadata set contains the IDs, checksums, and paths of all fragments, such as "fragment 001-a1b2c3- / nodeA / 001". This structured metadata makes it easy for the management system to query and verify data integrity.

[0071] Step S230: If the metadata set is generated, the metadata set is written into the blockchain account book through the smart contract, and the on-chain record protocol is adopted to obtain the transaction hash and block height to obtain the on-chain record certificate.

[0072] Preferably, the metadata set is written to the blockchain ledger via a smart contract to ensure immutability and traceability.

[0073] For example, the hospital uses the Ethereum blockchain, and the smart contract puts the metadata set on the chain as transaction data, generates a transaction hash such as "0x1234" and a block height such as "1500000", and forms a record certificate on the chain. This method ensures the security of metadata through the distributed consensus mechanism of the blockchain.

[0074] It is understood that the transaction hash of the on-chain record certificate is used to generate a queryable storage index.

[0075] Step S240: Based on the transaction hash of the on-chain record voucher, an index generation algorithm is used to integrate the storage path and verification information, generate a storage index containing a fragment identifier and a verification value, and store it in a distributed database to obtain a searchable storage index.

[0076] In one embodiment, the system integrates the storage path and verification information of the fragments through an index generation algorithm to generate index records, such as "Fragment 001- / nodeA / 001-a1b2c3". These indexes are stored in a distributed database, such as MongoDB, which is deployed on multiple nodes to support high-concurrency queries.

[0077] Hospital administrators can quickly retrieve the corresponding path and checksum value through the fragment ID to verify data integrity.

[0078] It should be noted that the above solution forms a complete data management chain from distributed storage to blockchain records to index generation.

[0079] Each link supports each other to ensure the safe storage and efficient retrieval of medical imaging data. For example, distributed storage reduces the risk of single point failure, blockchain records ensure metadata credibility, and index database improves query efficiency. This multi-level design is particularly important in medical data management and can effectively cope with large-scale data storage and strict security requirements.

[0080] Furthermore, the blockchain-based medical image encryption and secure storage method provided in this embodiment includes step S300: Step S310: Obtain the identity identifier and permission level from the access request submitted by the requester, perform preliminary decoding through the blockchain node, and obtain the decoded identity data.

[0081] In the business field of distributed storage and blockchain authorized access, technical topics such as access request processing, identity authentication, permission allocation and logging can be analyzed through specific scenario examples.

[0082] Assume that an enterprise uses blockchain and distributed storage systems to manage sensitive data and needs to ensure that only authorized users can access specific data fragments. For example, when a requester submits an access request, the system extracts an identity such as a user ID and a permission level such as "senior user" from the request.

[0083] The blockchain node uses the preset public key to initially decode the request and obtain identity data such as user ID "U123" and permission level "Level3".

[0084] Step S320: If the decoded identity data matches the access control policy preset in the smart contract, the permission level is compared to determine whether the policy requirements are met.

[0085] Specifically, the decoding process relies on asymmetric encryption, and the public key is pre-stored by the smart contract to ensure that the identity data is trustworthy.

[0086] The decoded data is matched with the access control policy in the smart contract. For example, if the policy stipulates that "Level 3 users can access financial data", the user is confirmed to meet the conditions through comparison.

[0087] Step S330: According to the permission matching result, the corresponding access scope and time limit parameters are obtained from the smart contract, and a temporary access key containing the scope and time constraints is generated.

[0088] In one possible implementation, after the permissions are matched, the smart contract returns the access scope such as "financial data fragments F1-F10" and the time limit such as "valid within 24 hours".

[0089] The system generates a temporary access key that contains scope and time parameters, for example, the key format is "U123_F1-F10_24h".

[0090] Step S340: Encrypt the temporary access key through the blockchain distributed ledger to obtain a dynamic authorization token.

[0091] Preferably, the key is encrypted through the blockchain ledger to generate a dynamic authorization token such as "Token_U123_abc123". The encryption adopts a symmetric encryption algorithm, and the key is managed by a smart contract to ensure security.

[0092] Step S350: extract the access scope and time limit from the dynamic authorization token, use a hash algorithm to verify the integrity of the token, and determine whether the token is valid.

[0093] For example, after the token is generated, the system extracts the access scope and time limit, calculates the hash value of the token using the SHA-256 algorithm, and verifies its integrity.

[0094] Assuming the hash value is "Hash_abc123", it is consistent with the expected value stored by the smart contract, confirming that the token is valid.

[0095] It should be noted that integrity verification prevents the token from being tampered with and ensures that the authorization process is trustworthy.

[0096] Step S360: If the token verification is successful, access rights are allocated through the smart contract interface to obtain the resource path for authorized access.

[0097] It is understandable that after the token verification is passed, the smart contract interface assigns access rights and returns a resource path such as " / data / finance / F1-F10". The path points to the distributed storage node, and users can directly access the corresponding data fragments.

[0098] Step S370: Record the access log to the blockchain account book according to the resource path authorized for access, and generate an unalterable record of the access operation.

[0099] Preferably, the access log is recorded in the blockchain account book to generate an unalterable record, for example, the log content is "U123 accessed F1-F10, time 2025-04-18 10:00". The record contains the transaction hash and block height to ensure traceability.

[0100] In one embodiment, the log records use an on-chain recording protocol, and the transaction hash such as "Tx_789" is associated with the block height such as "Block_10086" to facilitate auditing. For example, auditors can query access details through transaction hashes to confirm operational compliance. This method ensures access security and traceability through multi-link verification and recording.

[0101] Specifically, each link in the above process supports each other: identity decoding ensures user authenticity, permission matching limits access scope, dynamic token and integrity verification prevent unauthorized tampering, and log records provide audit basis.

[0102] This design ensures the efficiency and security of data access in the scenario where distributed storage is combined with blockchain.

[0103] Furthermore, the blockchain-based medical image encryption and secure storage method provided in this embodiment includes step S400: Step S410: According to the dynamic authorization token, obtain the storage index from the blockchain account book, use the hash mapping algorithm to generate a query request, send the query request to the blockchain node through the node communication protocol, and obtain the storage index.

[0104] In the field of medical data management, steps such as obtaining a collection of encrypted fragments and decrypting them, reorganizing the fragments, verifying data integrity, uploading operation records to the chain, and recording access logs constitute an efficient medical image data processing and protection process.

[0105] The following will analyze the specific implementation methods of each technical topic through the introduction of principles and specific examples, combined with multi-faceted considerations.

[0106] For example, when obtaining a set of encrypted fragments, a request may be initiated through a node communication protocol in a distributed storage system.

[0107] Assuming that a hospital stores a batch of encrypted CT image slices, the system first generates a query request based on the patient ID to locate the storage node.

[0108] Step S420: If the storage index is successfully obtained, a search request is sent to the corresponding storage node through the distributed storage protocol, and the encrypted segment set is obtained from the storage node using a multi-threaded concurrent mechanism to obtain the encrypted segment set.

[0109] The encrypted fragment set returned by the node contains 10 fragments, each fragment is 2MB in size and has an independent encryption identifier. This method ensures the security of data fragment storage and improves efficiency through multi-node concurrent acquisition.

[0110] Step S430: Decrypt the encrypted segments using a data decryption algorithm according to the encrypted segment set, generate decrypted data segments using a preset decryption key, and obtain decrypted data.

[0111] In a possible implementation, the encrypted segment set is processed using a symmetric decryption algorithm.

[0112] Preferably, the AES-256 algorithm is used in combination with a preset 256-bit key to decrypt each slice.

[0113] For example, the hospital sets a unified key for a patient's CT image slices, and after decryption, 10 decrypted data fragments are obtained, and each slice still maintains a size of 2MB.

[0114] The decryption process is completed in a local secure environment to avoid key leakage and ensure that the data can be reassembled and used later.

[0115] For example, in the field of blockchain access control, dynamic authorization tokens, as the core of permission allocation, need to obtain storage indexes from the blockchain ledger.

[0116] The storage index is the location identifier of data in the distributed ledger, which records the storage location of encrypted data.

[0117] In one embodiment, after receiving the dynamic authorization token, the system initiates a query to the blockchain ledger through the unique identifier in the token. For example, in an internal file management system of an enterprise, user Zhang holds a valid token, and the system extracts the index value "INDEX_20250418_001" from the ledger, pointing to storage node A.

[0118] Understandably, index acquisition relies on the decentralized nature of blockchain to ensure that data location is transparent and cannot be tampered with.

[0119] Step S440: Calculate the hash value of the decrypted data through the integrity check algorithm and compare it with the pre-stored hash value of the storage node. If the hash value is consistent with the hash value, the data consistency is determined.

[0120] Specifically, a hash mapping algorithm is used to generate a query request, and the hash mapping converts the token identifier into a fixed-length query parameter. For example, the token identifier "TOKEN_123" generates a query hash value through the SHA-256 algorithm and maps it to the index record in the ledger. The query request is sent to the blockchain node through the node communication protocol.

[0121] Preferably, the communication protocol can be implemented based on gRPC (Google Remote Procedure Call) to ensure low latency and high throughput.

[0122] After receiving the request, the node returns the storage index. This method ensures query efficiency through the hash algorithm and communication stability through the protocol.

[0123] Furthermore, the blockchain-based medical image encryption and secure storage method provided in this embodiment includes step S500: Step S510: Obtain an encrypted segment set, and use a symmetric decryption algorithm to decrypt the encrypted segment set to obtain a decrypted data segment set.

[0124] In one possible implementation, after obtaining the storage index, the system sends a retrieval request to the storage node through a distributed storage protocol. For example, the system sends an IPFS (InterPlanetary File System) protocol request to node A to locate the encrypted fragment collection.

[0125] It should be noted that the multi-threaded concurrent mechanism can improve retrieval efficiency. Assuming that node A stores 10 encrypted fragments, the system allocates 4 threads to download in parallel, and each thread processes 2-3 fragments, which significantly shortens the response time.

[0126] The encrypted fragment set is in the form of "FRAG_001" to "FRAG_010", and each fragment is about 1MB in size. For example, after obtaining the encrypted fragment set, the system uses a data decryption algorithm to decrypt it.

[0127] Assuming that the segments are encrypted using AES-256, the system decrypts each segment using the preset decryption key "KEY_20250418" to generate decrypted data. The decryption process must ensure segment integrity to prevent data loss.

[0128] In one embodiment, the decrypted data is part of the content of the enterprise file, such as "Contract Clause 001". The efficiency of decryption depends on the reliability of key management, and regular rotation of keys can improve security.

[0129] It is understandable that integrity checking is a key step in ensuring data consistency.

[0130] The system calculates the hash value of the decrypted data through the SHA-256 algorithm, such as "DATA_HASH_789", and compares it with the hash value "DATA_HASH_789" pre-stored in node A. If the two are consistent, it is confirmed that the data has not been tampered with. For example, the file data accessed by Zhang is verified to be consistent with the original uploaded data, ensuring the authenticity of the accessed content. This verification mechanism provides data integrity protection through the irreversibility of the hash algorithm.

[0131] In one embodiment, the above process forms a strict logical chain, from token to data consistency verification, which is closely linked.

[0132] Index acquisition ensures accurate data positioning, hash mapping and communication protocols ensure efficient queries, distributed storage and multi-threading improve retrieval speed, and decryption and verification ensure data security and integrity.

[0133] These steps together support the efficiency and reliability of blockchain access control, and are suitable for scenarios such as enterprise file management.

[0134] Step S520: Based on the decrypted data fragment set, the fragment reassembly technology is used to recombine according to predetermined rules to obtain the original medical image.

[0135] Specifically, the fragment reconstruction technology combines the decrypted data fragments into the original medical image according to predetermined rules.

[0136] It can be understood that the reorganization rules are based on the metadata index of the shard header, which records the position and order of each shard.

[0137] Assuming that the CT image consists of 10 slices, the system reads the metadata and stitches them together in sequence to generate a complete 512MB image file.

[0138] Step S530: If the original medical image passes the data integrity verification, an operation record is generated based on the timestamp and key information of the decryption operation, and written into the blockchain account book to obtain an unalterable record identifier.

[0139] During the reconstruction process, the system verifies the integrity of the slices to ensure that there is no loss or misalignment, thereby restoring high-quality medical images for doctors to diagnose.

[0140] It should be noted that data integrity verification is implemented through a hash algorithm. In one embodiment, the system calculates the SHA-256 hash value of the reconstructed CT image and compares it with the hash value pre-stored in the storage node. If the two are consistent, it is confirmed that the image has not been tampered with. For example, in a certain verification, the calculated hash value is "a1b2c3...", which completely matches the pre-stored value, and the verification passes. This method ensures the reliability of medical images.

[0141] In one embodiment, after the decryption operation is completed, the system generates an operation record based on the timestamp and key information and writes it into the blockchain ledger.

[0142] For example, a decryption operation occurs at 10:00 on April 18, 2025. The system records the operation time, key ID and operator ID, generates a record and uploads it to the chain to obtain a unique record identifier such as "tx123..."

[0143] The immutability of blockchain ensures traceability of operations and enhances transparency of data management.

[0144] Step S540: When data access occurs, obtain the visitor's identity information and access time, generate an access log and write it into the blockchain account book, and obtain the hash value of the access record.

[0145] For example, the generation and uploading of data access logs further improves security.

[0146] Specifically, when a doctor accesses a CT image, the system records the visitor ID and access time, such as 10:05 on April 18, 2025, and generates a log on the chain to obtain a hash value "log456..." This mechanism facilitates auditing, prevents unauthorized access, and provides compliance assurance for subsequent data use.

[0147] Preferably, the above technical topics form a complete solution through multi-faceted collaboration. For example, encryption and decryption ensure data security, sharding reorganization and integrity verification ensure data availability, and blockchain records provide traceability. Assuming that a hospital processes thousands of CT images, the system saves 50% of time by concurrently acquiring shards, the accuracy of decryption and reorganization reaches 100%, and the risk of tampering is reduced by 90% for on-chain records. These steps support each other and jointly build an efficient and secure medical data management system.

[0148] The present invention relates to a medical image encryption and secure storage system based on blockchain, which is used to implement the above-mentioned medical image encryption and secure storage method based on blockchain. The medical image encryption and secure storage system based on blockchain includes an acquisition module, a first generation module, a second generation module, a verification module and a decryption module, wherein the acquisition module is used to acquire original medical image data, divide the original medical image data into multiple fragments by using a sharding technology, encrypt each fragment by using a symmetric encryption algorithm, generate an encrypted fragment set, and determine the integrity check value of the encrypted fragment set; the first generation module is used to distribute each fragment to multiple storage nodes by using a distributed storage protocol according to the encrypted fragment set, record the storage location and integrity check value of each fragment, and the storage location and integrity check value of each fragment. The value is verified to the blockchain ledger to generate a storage index containing the storage path and verification information; the second generation module is used to establish an access control policy through the blockchain smart contract. If the obtained requester identity and authority level meet the access control policy, a dynamic authorization token containing the access scope and time limit is generated; the verification module is used to extract the storage index from the blockchain ledger according to the dynamic authorization token, retrieve the encrypted fragment set from the corresponding storage node through the distributed storage protocol, and verify the consistency of the integrity check value and the storage node data; the decryption module is used to decrypt the verified encrypted fragment set using a symmetric decryption algorithm, restore the original medical image data through fragmentation and reconstruction technology, and write the decryption operation record and data access log to the blockchain ledger.

[0149] Furthermore, the blockchain-based medical image encryption and secure storage system provided in this embodiment, the acquisition module includes a first acquisition unit, a first generation unit, a second acquisition unit and a first comparison unit, wherein the first acquisition unit is used to acquire the original data of the medical image, and divide the original data of the medical image into multiple fragments by using the fragmentation technology to obtain a fragment set; the first generation unit is used to encrypt each fragment according to the fragment set by using a symmetric encryption algorithm to generate an encrypted fragment set; the second acquisition unit is used to calculate the integrity check value for the encrypted fragment set to obtain a check value set; the first comparison unit is used to determine the data integrity by comparing the check value set with a preset threshold if the encrypted fragment set needs to be verified.

[0150] Preferably, in the blockchain-based medical image encryption and secure storage system provided in this embodiment, the first generation module includes a third acquisition unit, a fourth acquisition unit, a fifth acquisition unit and a sixth acquisition unit, wherein the third acquisition unit is used to process the encrypted fragment set using a distributed storage protocol, calculate the storage address of each fragment through a hash function, record the storage node identifier and the fragment mapping, and obtain a distributed storage allocation result; the fourth acquisition unit is used to calculate the integrity check value for each encrypted fragment using the SHA-256 algorithm according to the distributed storage allocation result, obtain the corresponding storage path, generate metadata including the fragment identifier, the check value and the path, and obtain a metadata set; the fifth acquisition unit is used to write the metadata set into the blockchain ledger through a smart contract if the metadata set is generated, adopt the on-chain record protocol, obtain the transaction hash and the block height, and obtain the on-chain record certificate; the sixth acquisition unit is used to integrate the storage path and the verification information according to the transaction hash of the on-chain record certificate using an index generation algorithm, generate a storage index including the fragment identifier and the check value, store it in a distributed database, and obtain a queryable storage index.

[0151] Furthermore, in the blockchain-based medical image encryption and secure storage system provided in this embodiment, the second generation module includes a seventh acquisition unit, a first judgment unit, a second generation unit, an eighth acquisition unit, a second judgment unit, a ninth acquisition unit and a third generation unit, wherein the seventh acquisition unit is used to obtain the identity identification and the permission level from the access request submitted by the requester, and perform preliminary decoding through the blockchain node to obtain the decoded identity data; the first judgment unit is used to determine whether the policy requirements are met by comparing the permission level if the decoded identity data matches the access control policy preset in the smart contract; the second generation unit is used to determine whether the policy requirements are met by comparing the permission level from the smart contract according to the permission matching result. The corresponding access scope and time limit parameters are obtained from the contract, and a temporary access key containing the scope and time constraints is generated; the eighth acquisition unit is used to encrypt the temporary access key through the blockchain distributed ledger to obtain a dynamic authorization token; the second judgment unit is used to extract the access scope and time limit from the dynamic authorization token, and use a hash algorithm to verify the integrity of the token to determine whether the token is valid; the ninth acquisition unit is used to assign access rights through the interface of the smart contract if the token verification passes, and obtain the resource path for authorized access; the third generation unit is used to record the access log to the blockchain ledger according to the resource path for authorized access, and generate an unalterable record of the access operation.

[0152] Compared with the prior art, the blockchain-based medical image encryption and secure storage method and system provided in this embodiment processes medical image data through sharding encryption technology, and uses a distributed storage protocol to disperse and store encrypted fragments in multiple nodes, while recording storage indexes and integrity verification information in the blockchain account book; uses smart contracts to establish access control policies, generates dynamic tokens for authorized users, and realizes secure retrieval and decryption and reorganization of medical data; key operations in the entire process are recorded in the blockchain, ensuring the traceability of data access; effectively solves the problems of secure storage of medical image data, refined access control, and operation auditing, while protecting patient privacy, improving the security and availability of medical data.

[0153] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic inventive concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A medical image encryption and secure storage method based on blockchain, characterized in that: The following steps are involved: Obtaining original medical image data, dividing the original medical image data into multiple fragments using a fragmentation technology, encrypting each fragment using a symmetric encryption algorithm to generate an encrypted fragment set, and determining an integrity check value of the encrypted fragment set; According to the encrypted fragment set, each fragment is distributed to multiple storage nodes using a distributed storage protocol, the storage location of each fragment and the integrity check value are recorded in the blockchain account book, and a storage index including the storage path and the check information is generated; Establish access control policies through blockchain smart contracts. If the identity and permission level of the requester obtained meet the access control policies, a dynamic authorization token containing access scope and time limit is generated. Extracting a storage index from the blockchain ledger according to the dynamic authorization token, retrieving a set of encrypted fragments from a corresponding storage node through a distributed storage protocol, and verifying the consistency of the integrity check value with the storage node data; The verified encrypted fragment set is decrypted using a symmetric decryption algorithm, the original medical image data is restored through fragmentation and reconstruction technology, and the decryption operation records and data access logs are written into the blockchain ledger.

2. The blockchain-based medical image encryption and secure storage method according to claim 1, characterized in that: The steps of obtaining the original medical image data, dividing the original medical image data into multiple fragments by using a fragmentation technology, encrypting each fragment by using a symmetric encryption algorithm, generating an encrypted fragment set, and determining the integrity check value of the encrypted fragment set include: Acquire original medical image data, and use a fragmentation technique to segment the original medical image data into multiple fragments to obtain a fragment set; According to the fragment set, each fragment is encrypted by a symmetric encryption algorithm to generate an encrypted fragment set; Calculate the integrity check value for the encrypted segment set to obtain a check value set; If the encrypted segment set needs to be verified, the data integrity is determined by comparing the check value set with a preset threshold.

3. The blockchain-based medical image encryption and secure storage method according to claim 1, characterized in that: According to the encrypted fragment set, each fragment is distributed to multiple storage nodes using a distributed storage protocol, the storage location of each fragment and the integrity check value are recorded in the blockchain account book, and the steps of generating a storage index including the storage path and the check information include: A distributed storage protocol is used to process the encrypted fragment set, the storage address of each fragment is calculated through a hash function, the storage node identifier and the fragment mapping are recorded, and the distributed storage allocation result is obtained; According to the distributed storage allocation result, the integrity check value is calculated for each encrypted segment using the SHA-256 algorithm, the corresponding storage path is obtained, metadata including the segment identifier, the check value and the path is generated, and a metadata set is obtained; If the metadata set is generated, the metadata set is written into the blockchain account book through the smart contract, and the on-chain record protocol is adopted to obtain the transaction hash and block height to obtain the on-chain record certificate; According to the transaction hash of the on-chain record voucher, an index generation algorithm is used to integrate the storage path and verification information, generate a storage index including a fragment identifier and a verification value, and store it in a distributed database to obtain a queryable storage index.

4. The blockchain-based medical image encryption and secure storage method according to claim 1, characterized in that: The access control policy is established through the blockchain smart contract. If the obtained requester identity and permission level meet the access control policy, the step of generating a dynamic authorization token including the access scope and time limit includes: Obtain the identity and permission level from the access request submitted by the requester, perform preliminary decoding through the blockchain node, and obtain the decoded identity data; If the decoded identity data matches the access control policy preset in the smart contract, the permission level comparison is used to determine whether the policy requirements are met; According to the permission matching result, the corresponding access scope and time limit parameters are obtained from the smart contract to generate a temporary access key containing the scope and time constraints; The temporary access key is encrypted through the blockchain distributed ledger to obtain a dynamic authorization token; Extract the access scope and time limit from the dynamic authorization token, use the hash algorithm to verify the integrity of the token, and determine whether the token is valid; If the token verification is successful, access rights are assigned through the smart contract interface to obtain the resource path for authorized access; According to the resource path of authorized access, the access log is recorded in the blockchain ledger to generate an unalterable record of the access operation.

5. The blockchain-based medical image encryption and secure storage method according to claim 1, characterized in that: The steps of extracting a storage index from the blockchain ledger according to the dynamic authorization token, retrieving an encrypted fragment set from a corresponding storage node through a distributed storage protocol, and verifying the consistency of the integrity check value with the storage node data include: According to the dynamic authorization token, a storage index is obtained from the blockchain ledger, a query request is generated using a hash mapping algorithm, and the query request is sent to the blockchain node through a node communication protocol to obtain the storage index; If the storage index is successfully obtained, a search request is sent to the corresponding storage node through a distributed storage protocol, and a multi-threaded concurrent mechanism is used to obtain the encrypted segment set from the storage node to obtain the encrypted segment set; According to the encrypted segment set, the encrypted segment is decrypted by using a data decryption algorithm, and a decrypted data segment is generated by using a preset decryption key to obtain decrypted data; The hash value of the decrypted data is calculated by an integrity check algorithm and compared with the pre-stored hash value of the storage node. If the hash value is consistent with the hash value, the data consistency is determined.

6. The blockchain-based medical image encryption and secure storage method according to claim 1, characterized in that: The steps of decrypting the verified encrypted fragment set using a symmetric decryption algorithm, restoring the original medical image data through fragmentation and reconstruction technology, and writing the decryption operation record and data access log into the blockchain account book include: Obtaining an encrypted segment set, and decrypting the encrypted segment set using a symmetric decryption algorithm to obtain a decrypted data segment set; According to the decrypted data fragment set, recombining according to a predetermined rule through fragmentation and reassembly technology to obtain the original medical image; If the original medical image passes the data integrity verification, an operation record is generated according to the timestamp and key information of the decryption operation, and written into the blockchain account book to obtain an unalterable record identifier; When data access occurs, the visitor's identity information and access time are obtained, an access log is generated and written into the blockchain account book, and a hash value of the access record is obtained.

7. A blockchain-based medical image encryption and secure storage system, used to implement the blockchain-based medical image encryption and secure storage method as described in any one of claims 1 to 6, characterized in that: The blockchain-based medical image encryption and secure storage system includes: An acquisition module is used to acquire original medical image data, divide the original medical image data into multiple fragments using a fragmentation technology, encrypt each fragment using a symmetric encryption algorithm, generate an encrypted fragment set, and determine an integrity check value of the encrypted fragment set; A first generation module is used to distribute each fragment to multiple storage nodes according to the encrypted fragment set using a distributed storage protocol, record the storage location of each fragment and the integrity check value to the blockchain account book, and generate a storage index including a storage path and check information; The second generation module is used to establish an access control policy through a blockchain smart contract. If the obtained requester identity and permission level meet the access control policy, a dynamic authorization token including the access scope and time limit is generated; A verification module, configured to extract a storage index from the blockchain ledger according to the dynamic authorization token, retrieve a set of encrypted fragments from a corresponding storage node through a distributed storage protocol, and verify the consistency of the integrity check value with the storage node data; The decryption module is used to decrypt the verified encrypted fragment set using a symmetric decryption algorithm, restore the original medical image data through fragmentation and reconstruction technology, and write the decryption operation record and data access log into the blockchain account book.

8. The blockchain-based medical image encryption and secure storage system according to claim 7, characterized in that: The acquisition module comprises: A first acquisition unit is used to acquire original medical image data, and to segment the original medical image data into multiple segments using a segmentation technique to obtain a segment set; A first generating unit, configured to encrypt each fragment according to the fragment set by using a symmetric encryption algorithm to generate an encrypted fragment set; A second obtaining unit, configured to calculate an integrity check value for the set of encrypted segments to obtain a check value set; The first comparison unit is configured to determine data integrity by comparing the check value set with a preset threshold value if the encrypted segment set needs to be verified.

9. The blockchain-based medical image encryption and secure storage system according to claim 7, characterized in that: The first generation module comprises: A third acquisition unit is used to process the encrypted fragment set using a distributed storage protocol, calculate the storage address of each fragment through a hash function, record the storage node identifier and the fragment mapping, and obtain a distributed storage allocation result; A fourth acquisition unit is used to calculate the integrity check value for each encrypted segment using the SHA-256 algorithm according to the distributed storage allocation result, obtain the corresponding storage path, generate metadata including the segment identifier, the check value and the path, and obtain a metadata set; A fifth acquisition unit is used to write the metadata set into the blockchain account book through a smart contract if the metadata set is generated, adopt an on-chain record protocol, obtain a transaction hash and a block height, and obtain an on-chain record certificate; The sixth acquisition unit is used to integrate the storage path and verification information according to the transaction hash of the on-chain record certificate using an index generation algorithm, generate a storage index including a fragment identifier and a verification value, store it in a distributed database, and obtain a searchable storage index.

10. The blockchain-based medical image encryption and secure storage system according to claim 7, characterized in that: The second generation module comprises: The seventh acquisition unit is used to obtain the identity identification and permission level from the access request submitted by the requester, and perform preliminary decoding through the blockchain node to obtain the decoded identity data; A first judgment unit is used to judge whether the policy requirements are met by comparing the permission levels if the decoded identity data matches the access control policy preset in the smart contract; A second generation unit is used to obtain corresponding access scope and time limit parameters from the smart contract according to the permission matching result, and generate a temporary access key containing scope and time constraints; an eighth acquisition unit, configured to encrypt the temporary access key through a blockchain distributed ledger to obtain a dynamic authorization token; A second judgment unit is used to extract the access scope and time limit from the dynamic authorization token, use a hash algorithm to verify the integrity of the token, and judge whether the token is valid; The ninth acquisition unit is used to allocate access rights through the interface of the smart contract if the token verification is successful, and obtain the resource path for authorized access; The third generation unit is used to record the access log to the blockchain account book according to the resource path authorized for access, and generate an unalterable record of the access operation.

Images