Dynamic key-driven medical terminal security adaptive remote control method

Abstract

The invention discloses a dynamic key-driven medical terminal security adaptive remote control method, and relates to the technical field of remote control, and the method comprises the steps: generating a dynamic session key for the communication; further calculating a security entropy used for representing the security intensity of the communication; calculating the length of the remote control instruction according to the medical service requirement and the security entropy, and calculating the expected comprehensive delay time when the remote control instruction arrives at the medical terminal and begins to be executed; the medical terminal executes a specified medical task according to the received remote control instruction; and according to the safety risk score, the medical terminal controls itself to enter different working modes. Sensitive operation can be quickly frozen when a power supply is abnormal or a network is deteriorated without manual guarding, and the sensitive operation can be immediately recovered after a fault is eliminated, so that the safety credibility, the operation continuity and the hospital operation and maintenance efficiency of the self-service terminal are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of remote control technology, and in particular to a dynamic key-driven secure adaptive remote control method for a medical terminal. Background Art

[0002] Amid the rapid development of healthcare informatization, medical terminals, as a crucial component of hospital smart service systems, have been widely deployed in outpatient halls, pharmacy windows, inpatient departments, and other locations. They provide patients with self-service services such as registration, payment, receipt printing, report collection, medication withdrawal, and electronic health card activation. Their primary advantages are alleviating pressure on manual counters, shortening patient wait times, and improving service efficiency. However, with the continued expansion of terminal functionality, the demand for remote management and control capabilities is also increasing. Especially with the deployment of numerous self-service terminals in large hospitals, how to dynamically issue commands remotely, control device status, execute prescription tasks, and manage network security have become critical technical challenges in healthcare operations and maintenance systems.

[0003] In the existing technology, the control and management of medical terminals mainly rely on manual intervention through scheduled scripts, batch commands or remote desktop protocols (such as VNC and RDP). Some terminals support docking with hospital core systems such as HIS and EMR, accept business data through standard interfaces and perform automatic printing, code scanning or medication dispensing. However, these remote control methods often suffer from several key design issues. First, existing solutions rely on fixed keys or timestamp-based authentication for the security and robustness of communication links. These solutions lack the ability to account for unclonable parameters such as physical noise, hardware status, and temperature drift in the terminal. This results in insufficient randomness in session keys and makes them susceptible to side-channel or man-in-the-middle attacks. Second, control commands are often statically encapsulated, failing to dynamically optimize packetization and transmission based on real-time network conditions (such as jitter, packet loss, and bandwidth). This can easily lead to command delays or loss during link fluctuations, impacting the stability of service execution. Third, existing systems generally switch control modes based on fixed thresholds or static states, lacking quantitative models for assessing terminal operating status and failing to accurately reflect the risk level of devices under power-critical conditions, hardware degradation, or network degradation. Fourth, task classification strategies are crude, typically enabling or restricting functions based solely on whether the device is connected to the internet or printing, failing to implement refined service-level management and control based on the risk level of medical services, the degree of data irreversibility, and compliance requirements, thus creating potential gaps in security policies. Summary of the Invention

[0004] To address the above technical issues, a fully dynamic key-driven secure adaptive remote control method for medical terminals is provided. This method proposes generating dynamic keys based on the terminal hardware identity, environmental noise, and clock drift. It combines real-time bandwidth integration with a packet loss compensation algorithm to accurately estimate instruction latency. Furthermore, network jitter, power consumption margin, and hardware anomalies are incorporated into an exponentially weighted risk score through adaptive weighting, enabling the terminal to automatically switch between full-function, degraded, and offline security modes. While ensuring the security of high-risk services such as prescription dispensing and medical insurance transactions, basic functions such as registration inquiries and report reprinting remain available. This method can quickly freeze sensitive operations in the event of power anomalies or network deterioration without human oversight, and can be restored instantly after the fault is eliminated. This significantly improves the security reliability, operational continuity, and hospital operation and maintenance efficiency of self-service terminals.

[0005] In order to achieve the above objects, the technical solution adopted by the present invention is:

[0006] A dynamic key-driven secure adaptive remote control method for a medical terminal, the method comprising:

[0007] Step 1: The medical terminal obtains the unique identification code preset in its own hardware, receives the control center identification code and the random prime number dynamically generated by the remote control center from the remote control center, and generates a dynamic session key for this communication. The medical terminal then further calculates the security entropy based on the dynamic session key to represent the security strength of this communication.

[0008] Step 2: Calculate the length of this remote control command based on medical service requirements and security entropy. The basic command length is the length of the fixed template for medical services. Combined with the security entropy, the complete command length is obtained. The theoretical delay of command transmission is calculated in an integral manner. Taking into account the packet loss rate of the current network link, the delay caused by network packet loss and retransmission, the link network jitter caused by the number of network path hops, and the clock synchronization error between the medical terminal and the network timing source, the expected comprehensive delay time for the remote control command to reach the medical terminal and begin execution is calculated.

[0009] Step 3: The medical terminal performs the designated medical task according to the received remote control instruction;

[0010] Step 4: The medical terminal collects its own real-time power supply and compares it with the rated power consumption. It also counts the number of internal hardware anomalies and compares it with the anomaly tolerance threshold to construct an immediate risk indicator. Simultaneously, the medical terminal collects the current network jitter standard deviation of the network link and the network round-trip delay between the terminal and the remote control center in real time, compares them with their respective thresholds, and constructs an adaptive adjustment factor based on the current network status in combination with the packet loss rate. This adaptive adjustment factor is used to fuse the immediate risk indicator with the historical risk indicator using an exponentially weighted moving average algorithm to obtain a security risk score. Based on the security risk score, the medical terminal controls itself to enter different operating modes.

[0011] Furthermore, in step 3, when the security risk score exceeds the first preset security threshold, the medical terminal automatically enters the offline security mode and only performs basic services; when the security risk score is between the first and second preset security thresholds, the medical terminal automatically enters the degraded operation mode and only performs basic services and low-risk services; when the security risk score is lower than the second preset security threshold, the medical terminal enters the full-function online mode and can perform basic services, low-risk services and high-risk services.

[0012] Furthermore, the dynamic session key K sess for:

[0013]

[0014] Among them, ID T It is the unique identification code of the medical terminal; ID C is the control center identification code of the remote control center; λ is a random prime number dynamically generated by the remote control center; P is a 2048-bit system public prime number; τ sync is the NTP / IEEE1588 clock drift; τ max is the maximum allowed clock drift; η clk is the RTC temperature drift coefficient, η clk =(T amb -25) / 1000; T amb is the ambient temperature.

[0015] Furthermore, security entropy E sess for:

[0016] E sess =-log2[(K sess modP) / P+10 -15 ].

[0017] Furthermore, the expected comprehensive delay time t exec for:

[0018]

[0019] Where B(u) represents the link bandwidth corresponding to the uth bit during the transmission of the remote control command; p loss is the packet loss rate; R reTx is the average delay caused by each retransmission; Θ hop is the link hop scheduling weight, ranging from 1 to 10, in ms / hop; jit is the standard deviation of link network jitter; δ NTP is the clock synchronization error between the medical terminal and the network timing source; D is the complete instruction length.

[0020] Furthermore, the complete instruction length D is:

[0021] D=L0+βE sess ;

[0022] Where β is the security entropy expansion coefficient, which represents the additional length required for the encryption header, random padding, and MAC authentication per 1 bit of entropy. It is determined by the encryption algorithm family and takes a value of 1.125 or 1.25. When the encryption algorithm family is AES-GCM, β takes a value of 1.125; when the encryption algorithm family is ChaCha20-Poly1305, it takes a value of 1.25. L0 is the length of the fixed template for medical services.

[0023] Furthermore, the basic services include at least: registration information inquiry and reprinting, local display of medical queue information, system usage guidance, health education and user feedback entry; the low-risk services include at least: basic payment voucher reprinting, historical report inquiry and printing and registration information confirmation or reprinting receipts; the high-risk services include at least: prescription drug dispensing, prescription printing, medical insurance registration, payment settlement, hospitalization deposit recharge and deposit receipt printing, medical treatment item authorization and electronic health card writing and activation.

[0024] Furthermore, the adaptive adjustment factor α t for:

[0025]

[0026] Among them, σ max is the jitter tolerance threshold; RTT max is the network round-trip delay threshold; RTT is the network round-trip delay.

[0027] Furthermore, the security risk score R safe (t+1) is:

[0028]

[0029] Among them, Π nom is the real-time power supply;pow is the rated power consumption; R safe (t) is the historical risk indicator; E err is the number of abnormal events; E crit is the abnormal tolerance threshold.

[0030] A remote control system for a medical terminal.

[0031] Compared with the existing technology, the beneficial effects of the present invention are as follows: the medical terminal remote control method and system proposed in the present invention, starting from dynamic key negotiation, couples the terminal hardware identity, physical noise, clock drift and ambient temperature into the same security entropy framework, and realizes device-level unclonable authentication under unattended conditions; on this basis, by directly mapping the security entropy to the instruction length, encryption header and message authentication segment, it not only ensures the confidentiality integrity of high-risk services, but also avoids retransmission storms caused by excessive message size in network-restricted scenarios. A fine-grained delay model coupled with bandwidth integration, packet loss compensation and jitter timing is constructed within the method, which can provide accurate time limit budgets for time-sensitive operations such as prescription printing and drug distribution when the link status fluctuates. The adaptive adjustment factor combines the packet loss rate, jitter amplitude and round-trip delay to drive the exponential weighted update of the risk score, so that the terminal can quickly increase its alert when the network deteriorates and smoothly fall back when the link is stable, avoiding frequent oscillations. The risk score also integrates the power consumption margin and hardware anomaly density, and is compressed into a unified interval through hyperbolic tangent mapping. In conjunction with the hierarchical business list, it forms three working modes: offline security, degraded operation, and full-function online, thus achieving end-side autonomy. The overall architecture eliminates the reliance on manual supervision. When the power suddenly drops, the printer jams, or the network packet loss surges, the terminal can freeze high-risk operations within one cycle and retain basic query capabilities, which not only protects the patient's medication safety and medical insurance transaction compliance, but also maintains the basic information service without interruption; when the fault is eliminated, the system can automatically restore full functionality, reducing operation and maintenance intervention. Compared with traditional solutions that rely on a single heartbeat or a fixed threshold, the present invention significantly improves the accuracy of security perception, recovery speed, and resource utilization efficiency, and provides a feasible, scalable, and regulatory-friendly overall solution for the large-scale deployment of self-service terminals in hospitals. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a schematic diagram of the method flow of the dynamic key-driven secure adaptive remote control method for medical terminals proposed by the present invention;

[0033] Figure 2 Schematic diagram of the experimental effect of dynamic session key generation time under different encryption algorithm families;

[0034] Figure 3 Schematic diagram of the experimental effect of expected comprehensive delay time under different network conditions. DETAILED DESCRIPTION

[0035] The following description is intended to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are merely examples, and those skilled in the art may conceive of other obvious variations.

[0036] Reference Figure 1 As shown, a dynamic key-driven secure adaptive remote control method for a medical terminal includes:

[0037] Step 1: The medical terminal obtains the unique identification code preset in its own hardware, receives the control center identification code and the random prime number dynamically generated by the remote control center from the remote control center, and generates a dynamic session key for this communication. The medical terminal then further calculates the security entropy based on the dynamic session key to represent the security strength of this communication.

[0038] In the medical terminal remote control method of the present invention, the first step is to first use the terminal's internal trusted computing module to retrieve the unique serial number written into the hardware. The serial number is written in the manufacturing stage and cannot be tampered with, and is used for subsequent identity binding with the cloud control node; when the terminal is powered on or receives a remote wake-up signal, the control node will send its own node identification and an instantly randomly generated prime number seed through an encrypted channel. The terminal will perform a mixed mapping of the two end identifications in the local secure execution environment to make the correlation between the identifications far away from the linear space, and then perform an exponential irreversible transformation in combination with the prime number seed to obtain an initial key fragment that is only effective in this session; at the same time, the terminal sensor network performs millisecond-level sampling of physical random sources such as multi-point micro-vibration, fan noise, power supply ripple, etc. in the cabinet, and splices these sampled values ​​to the end of the initial key fragment after processing them with a debiasing algorithm to improve the unpredictability of the key; the terminal then calls a high-precision real-time clock to measure the instantaneous drift between the clock and the cloud timing server, and the drift The amount is injected into the key generation process as time-related entropy to ensure the uniqueness of the key in the temporal dimension; the entire calculation process is completed entirely within the secure execution area, the intermediate data is immediately erased after the key is generated, and the hash summary of the key-derived information is recorded through the security register for subsequent security entropy audits; after key generation is completed, the terminal derives multi-level symmetric encryption subkeys, message authentication subkeys, and handshake digest keys based on the key, which are used for subsequent instruction confidentiality, integrity, and identity confirmation respectively; then, the terminal outputs a measurement value based on the key randomness quality assessment model, which is used to dynamically adjust the encryption algorithm parameters used in the communication layer, such as deciding whether to enable longer random padding or higher-bit integrity check, so as to balance performance and security in complex medical scenarios; finally, the terminal sends a handshake confirmation message back to the control node with a timestamp and device health status summary. After comparison on the cloud, the session activation is completed, and the dynamic secure channel between the terminal and the control node is established.

[0039] Step 2: Calculate the length of this remote control command based on medical service requirements and security entropy. The basic command length is the length of the fixed template for medical services. Combined with the security entropy, the complete command length is obtained. The theoretical delay of command transmission is calculated in an integral manner. Taking into account the packet loss rate of the current network link, the delay caused by network packet loss and retransmission, the link network jitter caused by the number of network path hops, and the clock synchronization error between the medical terminal and the network timing source, the expected comprehensive delay time for the remote control command to reach the medical terminal and begin execution is calculated.

[0040] After completing the key and security entropy initialization, the remote control center generates an instruction template based on the current user's business request type in the hospital information system. The template only contains the minimum fields of operational semantics, such as printing prescriptions, reprinting invoices, enabling medicine cabinet slots, or executing medical insurance deductions. After receiving the instruction template, the medical terminal will evaluate the confidentiality level requirements of this communication in real time based on the security entropy obtained in the previous step, insert the random padding, integrity check tail and anti-replay sequence of the corresponding length into the template reserved area, and simultaneously embed the status description of the local sub-module, such as the remaining printer consumables, scanner mode, remaining dosage of the medicine box, and encryption chip firmware. The terminal then starts the bandwidth detection program, performs multiple rapid speed tests on the uplink, and obtains an instantaneous available bandwidth curve, which is sent to the instruction encapsulator to estimate the sending window. Inside the encapsulator, the template length, the encryption header length, and the measured bandwidth curve are combined into a dynamic segmented schedule. The schedule will assign a target sending time for each data packet to avoid instantaneous congestion that causes medical instructions to be delayed, while ensuring that the entire instruction is transmitted within the specified business time limit. During the scheduling stage, the terminal monitors more than one hundred packets in parallel through the kernel network stack. The packet loss rate and round-trip delay jitter of the message. When the packet loss rate rises or the jitter fluctuation exceeds the threshold, the scheduler immediately reduces the data segment size and starts the compensation retransmission counter. At the same time, the network degradation information is attached to the subsequent data segment, allowing the control center to dynamically adjust the retransmission strategy and priority. At the same time, the terminal clock synchronization daemon will continuously compare the local clock with the timing server, make a sliding average of the new and old time offsets, and write the latest time drift value back to the schedule, so that the encrypted timestamp field remains strictly monotonically increasing, ensuring that the encryption layer will not be rejected due to timing errors. When all data segments are encrypted and signed according to the schedule, the terminal begins to send them formally. At the end of each sending cycle, it reads the actual number of outbound bytes returned by the driver layer and compares it with the expected sending volume. It then fine-tunes the rate and window for the next cycle based on the retransmission count, and repeats this cycle until all instruction data is safely delivered. This ensures that when the network conditions are good, the bandwidth is fully utilized to shorten the queuing delay, and when the network fluctuates, the pressure is quickly reduced to avoid continuous retransmission storms, so that medical business instructions can reach the terminal in real time and safely, without causing prescription execution delays, medical insurance settlement failures, or bill generation errors due to network congestion or link jitter, thereby maximizing the continuity, reliability, and compliance of the hospital's self-service chain. If the value of the expected comprehensive delay time is less than the hospital's business timeout threshold for scenarios such as prescription printing or medical insurance payment, it means that the medical terminal can respond to the instruction in a timely manner and the instruction can continue to be executed. If the delay exceeds the threshold, it means that the link congestion, jitter, or packet loss has a significant impact, and the medical terminal may encounter obstruction or failure during the operation execution phase. This will trigger the automatic switching logic of security monitoring or service degradation during the actual task execution in step 3.

[0041] Step 3: The medical terminal performs the designated medical task according to the received remote control instruction;

[0042] After completing the authenticity verification, confidentiality decryption and timestamp legitimacy confirmation of the remote control instruction, the medical terminal immediately enters the execution scheduling stage. The core control engine first resolves whether the operation is high-risk, low-risk or basic task based on the business identifier inside the instruction, and then calls the microkernel message bus inside the terminal to split the instruction into a series of hardware driver-level atomic actions. These atomic actions will be asynchronously queued into the real-time priority queue and mapped to the corresponding functional modules. For example, when the business is prescription drug delivery, the control engine needs to drive the prescription database query submodule, the drug grid positioning submodule, the motor control submodule and the weight verification submodule in sequence to ensure that the medicine box is in full compliance with the doctor's order in terms of physical trajectory and dosage; when the business is treatment When printing a prescription, the instruction first triggers the cloud-based prescription review result comparison, and after passing the verification, the typeset prescription template is sent to the thermal printer. At the same time, after printing is completed, the photoelectric sensor verifies the paper length and the integrity of the QR code to confirm the output quality; when the business is medical insurance registration or payment settlement, the terminal will call the encrypted security chip to establish a controlled session with the local medical insurance platform, and then write the payment result to the local secure storage and send it back to the center to ensure the closed loop of capital flow and medical insurance reimbursement link; when the business is hospitalization deposit recharge and deposit receipt printing, the terminal will complete the virtual account deduction of tens of thousands of amounts through the encrypted channel, and then drive the high-resolution laser printer to output the financial invoice, and the barcode scanner will read back the receipt code for self-verification; when the business is medical treatment projects During authorization, after receiving the doctor's ID and authorization code, the terminal calls the hospital's imaging or inspection scheduling system to assign an inspection number and displays it on the screen immediately; when the business is writing and activating an electronic health card, the radio frequency module will conduct short-range communication with the second-generation ID card or social security card, write the binding information into the electronic health card and return to the activated state; when executing low-risk businesses such as historical report query and printing, basic payment voucher reprinting and registration information reprinting, the terminal mainly reads the local cache or read-only database, and no account writes are generated after printing is completed; when providing basic services such as displaying medical queue information, system usage guidance, health education or user feedback entry, the terminal only needs to call the UI rendering engine and local media player, and communicate with the core data The library can remain in read mode. Regardless of the task level, the control engine will collect feedback data from multiple sensors such as temperature, optics, weight, and current in real time throughout the execution process, and continuously write it into a circular buffer. The quality monitoring thread will calculate the execution deviation and feedback delay in a sliding window manner. If an anomaly is found, an alarm will be immediately sent to the remote control center and the local log system. After all hardware operations are completed, the terminal will generate an execution result package containing the task type, start and end time, key indicators, user interaction logs, and encrypted verification summary. It will be sent back to the control center through the previously established secure channel. At the same time, only the irreversible hash summary will be retained locally to meet the requirements of medical compliance regulations on the principle of minimizing data storage.This closed-loop design ensures that high-risk tasks such as prescription drug dispensing, prescription printing, medical insurance transactions, deposit receipts, high-value consumables authorization, and electronic health card activation are fully protected in an unattended environment, ensuring pharmaceutical, security, and financial security. It also ensures that low-risk or basic tasks such as historical report reprinting, queue inquiries, and health education can still be performed normally even when the system network is unstable or degraded. This ensures highly reliable, traceable, and compliant operation of remote control of medical terminals throughout the entire process.

[0043] Step 4: The medical terminal collects its own real-time power supply and compares it with the rated power consumption. It also counts the number of internal hardware anomalies and compares it with the anomaly tolerance threshold to construct an immediate risk indicator. Simultaneously, the medical terminal collects the current network jitter standard deviation of the network link and the network round-trip delay between the terminal and the remote control center in real time, compares them with their respective thresholds, and constructs an adaptive adjustment factor based on the current network status in combination with the packet loss rate. This adaptive adjustment factor is used to fuse the immediate risk indicator with the historical risk indicator using an exponentially weighted moving average algorithm to obtain a security risk score. Based on the security risk score, the medical terminal controls itself to enter different operating modes.

[0044] While the terminal is performing medical tasks, the system daemon thread schedules the safety monitoring process at a fixed beat of once per second. First, it reads the ratio of the UPS output power to the rated power consumption after correction of the cabinet's internal temperature from the power measurement module, and writes it into the instantaneous power consumption buffer through the hardware abstraction layer; in parallel, the abnormality collection thread counts the number of hardware fault log entries such as printer paper shortage, medicine cabinet blockage, card reader overtemperature, motor overcurrent, etc. in the past minute, and records them synchronously in the abnormality counting buffer; the network detection thread performs four high-precision round-trip delay measurements on the keep-alive channel maintained by the control center, analyzes the latest round-trip delay and delay jitter, and reads the message loss rate from the kernel protocol stack sliding window. These data are unified The structure is written into the network status buffer; then, the risk control core scheduler extracts the latest observation values ​​from the three buffers, and performs natural logarithmic compression on the five indicators of power consumption ratio, anomaly count, delay, jitter, and packet loss, bringing the amplitude difference to the same order of magnitude, and then calculates the Euclidean distance to obtain the immediate risk amplitude; within the same cycle, the scheduler generates adaptive weights based on the three observation values ​​of the network status. The higher the weight, the worse the network quality, and the system should perceive the risk change faster. Then, the immediate risk amplitude and the historical risk value persisted in the previous cycle are exponentially weighted moving averaged according to the adaptive weight to obtain a new comprehensive risk score; this score is compressed to between zero and one by hyperbolic tangent mapping, and the mapping is completed The security risk score is written into the shared memory and triggers the mode determination routine. If the score is higher than the high threshold, the terminal immediately sends a broadcast signal to stop the action of the drug motor and the receipt printer motor, closes the encrypted session related to the medical insurance settlement and switches to the read-only database mode. The screen simultaneously displays the "offline security mode" prompt. The user can still query the registration information or reprint the historical report; if the score is in the middle range, the terminal disables the prescription printing and drug dispensing tasks, but retains low-risk operations such as reprinting the payment voucher and printing the report, and continuously pushes the status summary to the control center every ten seconds in the background; if the score is lower than the low threshold, all terminal functions are unlocked and the status light is updated to the green operating state; no matter which mode is entered, the risk control core The center will write the current score, various observation values ​​and mode switching results into the local circular log, and synchronize them incrementally to the cloud operation and maintenance platform through the established encrypted channel. The operation and maintenance platform will issue strategies or perform manual intervention based on the summary information of multiple terminals. In this way, the calculation and mode switching of each cycle are completed in milliseconds, ensuring that when power consumption suddenly increases, hardware failures surge or network quality deteriorates sharply, the terminal can automatically enter the safe mode within one cycle, thereby avoiding medical risks and economic disputes caused by mis-issuance of drugs, prescription printing failure or interruption of medical insurance transactions. At the same time, it can quickly resume full functional operation after the risk is eliminated, ensuring that the hospital self-service maintains a dynamic balance between security, compliance and availability.

[0045] Furthermore, in step 3, when the security risk score exceeds the first preset security threshold, the medical terminal automatically enters the offline security mode and only performs basic services; when the security risk score is between the first and second preset security thresholds, the medical terminal automatically enters the degraded operation mode and only performs basic services and low-risk services; when the security risk score is lower than the second preset security threshold, the medical terminal enters the full-function online mode and can perform basic services, low-risk services and high-risk services.

[0046] refer to Figure 2 , further, the dynamic session key K sess for:

[0047]

[0048] Among them, ID T It is the unique identification code of the medical terminal; ID C is the control center identification code of the remote control center; λ is a random prime number dynamically generated by the remote control center; P is a 2048-bit system public prime number; τ sync is the NTP / IEEE1588 clock drift; τ max is the maximum allowed clock drift; η clk is the RTC temperature drift coefficient, η clk =(T amb -25) / 1000; T amb is the ambient temperature.

[0049] First multiplier The hardware serial number ID that cannot be changed on the terminal side is selected T Unique ID of the cloud control node C Perform bitwise XOR operation, which can break up the linear correlation between the two end identifiers in a constant time, avoiding direct inference in radio frequency detection or bypass analysis; then use the prime number λ randomly generated by the remote control center to perform modular exponentiation operation, which not only amplifies the discreteness of the identifier space, but also its exponential operation path changes with λ, making the key distribution of the same terminal in different sessions spread exponentially, further increasing the difficulty of exhaustive search; the modulus P uses a 2048-bit secure prime number, which is in line with the TLS level security strength commonly used in current hospital information systems. It is compatible with dedicated acceleration instruction sets and is also easy to connect with existing CA systems. The second multiplier in the formula Introduced the temporal consistency constraint: τ sync Measured by NTP or IEEE1588, it is the drift value between the control node and the terminal local clock; τ maxIt is the maximum allowable drift set by the hospital operation and maintenance side based on the real-time requirements of the application. When the drift value is closer to the threshold, the output of the exponential function approaches zero, causing the overall amplitude of the key to drop sharply and eventually be judged invalid. This design can automatically block the session in the scenario of hardware clock aging or malicious delay injection, thereby preventing instructions used for prescription verification or medical insurance payment from being maliciously replayed.

[0050] The third multiplier (1+η clk ) reflects the temperature dependence of the device at the physical level that cannot be replicated; η clk =(T amb -25) / 1000 to calculate the real-time ambient temperature T inside the terminal cabinet. amb Converted into a tiny linear increment, when the temperature deviates from the manufacturing calibration point by 25°C, it will cause a frequency drift of about 10-40ppm to the RTC crystal oscillator. This drift is reflected in the key space as a unique noise fingerprint of the device in the form of a product, so that even if the attacker copies the terminal firmware and hardware serial number, it is difficult to reproduce the same key in different thermal environments; at the same time, the introduction of the temperature term meets the long-term security requirements under dynamic conditions such as day and night temperature differences, air conditioning shutdown, and cabinet heat dissipation in medical scenarios. By multiplying the three results, the present invention establishes an inseparable association between logical identity, time series, and physical environment: any single-dimensional anomaly will compress the key amplitude to the failure range recognized by the system, ensuring that only terminals with authentic hardware, accurate timing, and cabinet temperature within a reasonable range can establish an encrypted session with the control center. Furthermore, when the terminal generates K sess Immediately afterwards, three independent keys, namely the data encryption subkey, the integrity check subkey and the handshake signature key, are derived through a hardware random number diffusion algorithm. Intermediate variables and original sample values ​​are zeroed in a trusted execution environment to ensure that even if the terminal is subsequently attacked by a power outage, historical session information cannot be restored. The control center performs a secondary verification on the handshake summary sent back by the terminal. Only when the key derivation path is completely consistent with the recorded temperature, clock drift and hardware serial number will it be written into the session table. At this point, the data channel for high-risk remote operations such as prescription printing, medicine cabinet control, and medical insurance deductions can be enabled. This design not only meets the requirements of medical data for compliance encryption, but also uses the physical noise of the hospital's on-site environment to enhance the randomness and non-replicability of the session key, laying a solid foundation of dual trust in cryptography and hardware for the remote control process of the present invention.

[0051] Figure 2This is a comparison chart of dynamic session key generation time under different encryption algorithm families. The figure shows the time performance of three different encryption algorithms in the dynamic session key generation process in the form of a bar chart. The horizontal axis represents different encryption algorithm family types, and the vertical axis represents the key generation time in milliseconds. Specifically, when the AES encryption algorithm is used and the security entropy expansion coefficient is 1.125, the dynamic session key generation time is 12.5 milliseconds; when the ChaCha20 encryption algorithm is used and the security entropy expansion coefficient is 1.25, the dynamic session key generation time is 15.8 milliseconds; and when the traditional RSA algorithm is used, the dynamic session key generation time reaches 28.3 milliseconds. Figure 2 It is clear that the dynamic key generation method used in this invention has significant performance advantages across different encryption algorithm families. The AES encryption algorithm performs best, with the shortest generation time; the ChaCha20 encryption algorithm comes in second; and the traditional RSA algorithm takes the longest, approximately 2.26 times longer than the AES algorithm.

[0052] Furthermore, security entropy E sess for:

[0053] E sess =-log2[(K sess modP) / P+10 -15 ].

[0054] The expression is first expressed by (K sess modP) / P maps the key value to the interval (0,1) to achieve normalized comparison with the modulus P, so that keys of different lengths or from different sources can be measured on a unified scale; then a very small constant 10 is added to the normalized result. -15 It is used as a numerical stabilizer to avoid the logarithm value of zero in extreme cases where the key exactly divides the modulus, while ensuring that the compensation term is small enough not to significantly dilute the entropy carried by the key itself. Taking the negative logarithm with base 2 can directly correspond the sparsity of the probability domain to the number of bits, expressing the size of the key space that the attacker needs to try on average; the higher the entropy value, the greater the unpredictability caused by the terminal's physical noise, clock drift, and identity mixing, and the computational complexity required for cryptanalysis increases exponentially. The terminal will obtain E in real time. sessThis security level signal is written into the communication stack and task scheduler. If the entropy value falls below the threshold set by the hospital, the scheduler automatically increases the random padding length, increases the number of integrity check bits, and shortens the instruction validity period to compensate for the potential risks associated with insufficient key entropy. If the entropy value is in the high range, the system allows the use of higher-throughput encryption algorithm parameters to ensure timely response to latency-sensitive services such as medical insurance transactions and prescription printing. Throughout the session, the entropy value is periodically recalculated to detect the impact of temperature fluctuations, network latency fluctuations, or hardware aging on randomness. If a rapid drop in entropy is detected, the terminal triggers the key rollover process and requests a new random prime number seed from the control center to prevent prolonged use of the same key, which could lead to statistical deviations that could be exploited by attackers.

[0055] For further reference, Figure 3 , expected comprehensive delay time t exec for:

[0056]

[0057] Where B(u) represents the link bandwidth corresponding to the uth bit during the transmission of the remote control command; p loss is the packet loss rate; R reTx is the average delay caused by each retransmission; Θ hop is the link hop scheduling weight, ranging from 1 to 10, in ms / hop; jit is the standard deviation of link network jitter; δ NTP is the clock synchronization error between the medical terminal and the network timing source; D is the complete instruction length.

[0058] The first integral describes the cumulative time taken to send each bit in a variable link bandwidth scenario: the length of the securely encapsulated instruction is D, and the function B(u) dynamically measured by the system represents the instantaneous available bandwidth at the u-th moment. The bandwidth varies with the load of the in-hospital WLAN or 5G network. The integral maps the continuous fluctuations into a precise time budget. The second integral Revealing the exponential cumulative effect of packet loss on latency: packet loss rate p obtained by sliding window statistics loss Once it increases, the average retransmission cost R reTx The terminal scheduler proactively reduces the data segment size and triggers congestion avoidance early, thus ensuring that the prescription instruction will not be caught in a retransmission storm; the third At the same time, the combined effects of queuing delay and timing error caused by cross-segment forwarding are considered: the connection from the campus to the cloud often passes through several levels of routers or SD-WAN nodes, and the average queuing time per hop is Θ hop quantization; and the jitter standard deviation σ of high-speed networks when microbursts occur jit It will increase rapidly if there is a drift δ between the terminal local clock and the timing source NTP, jitter and timing error work together through the root sum of squares to avoid ignoring potential delays when they are too large individually or cancel each other out; the entire formula is linearly superimposed in three parts, each of which can be obtained by real-time measurement of the terminal or statistics of the protocol stack, without relying on external empirical coefficients, so an approximate upper bound of the delay prediction value can be given before the instruction is encapsulated. Based on this, the control center assigns queue priorities to services of different risk levels: for example, if the predicted value of a prescription drug delivery instruction approaches the response red line of the medical insurance system, the center will force the terminal to adopt a configuration with shorter segments, more severe transmission thresholds, and higher encryption efficiency; if the predicted value is low and the network is stable, the terminal is allowed to batch process patient payments or result printing in the same session to improve throughput. The delay model is also embedded in the security risk assessment link: when p is observed in real time loss , σ jit or δ NTP The abnormal surge causes the calculated t exec If the service SLA is consistently exceeded, the system will simultaneously increase the security risk score, triggering mode downgrade or offline protection in step 4 to prevent the forced push of high-risk instructions even when the network is unstable. Through this refined latency model, the present invention ensures real-time service while enabling bandwidth adaptation, retransmission compensation, and timing calibration to work together, making remote control links for medical terminals predictable, schedulable, and auditable in complex hybrid wireless and wired network environments.

[0059] Figure 3 This is an analysis chart of the expected comprehensive delay time under different network conditions. The chart is in the form of a line graph, showing the impact of packet loss rate on the expected comprehensive delay time under different network environments. The horizontal axis represents the packet loss rate, with a value range from 0 to 1.2; the vertical axis represents the expected comprehensive delay time, in milliseconds, with a value range from 0 to 200 milliseconds. The figure contains three characteristic curves: the first solid line represents the delay change under normal network conditions. Under this condition, the network jitter is small and the delay growth is relatively slow; the second long dashed line represents the delay change under high packet loss rate network conditions. Due to the frequent retransmission mechanism, the delay growth is significantly accelerated; the third short dashed line represents the delay change under high jitter network conditions. The unstable network causes large delay fluctuations and rapid growth. From Figure 3The analysis results show that as the packet loss rate increases, the expected comprehensive delay time under the three network conditions all shows an upward trend, but there are significant differences in the degree of increase. Under normal network conditions, when the packet loss rate increases from 0 to 1.2, the delay time increases from about 45 milliseconds to about 80 milliseconds; while under high packet loss rate and high jitter network conditions, the delay time within the same packet loss rate variation range increases from about 50 milliseconds to about 180 milliseconds and about 170 milliseconds, respectively. This result shows that the expected comprehensive delay time calculation method of the present invention can accurately reflect the impact of different network states on system performance, and provides a reliable theoretical basis for the adaptive control of medical terminals.

[0060] Furthermore, the complete instruction length D is:

[0061] D=L0+βE sess ;

[0062] Where β is the security entropy expansion coefficient, which represents the additional length required for the encryption header, random padding, and MAC authentication per 1 bit of entropy. It is determined by the encryption algorithm family and takes a value of 1.125 or 1.25. When the encryption algorithm family is AES-GCM, β takes a value of 1.125; when the encryption algorithm family is ChaCha20-Poly1305, it takes a value of 1.25. L0 is the length of the fixed template for medical services.

[0063] L0 corresponds to the minimum business semantic template. For example, the prescription printing task contains fixed fields occupied by the patient ID, prescription number, and pharmacist signature, while the medicine cabinet control task contains fixed fields such as the compartment number, dosage value, and check digit. These fields are strictly defined by the hospital information system, and their length does not change with the security level or the network status. Therefore, L0 can be determined at compile time and stored in the terminal instruction description table. The second term βE in the formula is sess Used to describe the stretching effect of key security entropy on the encryption bearer space: when the session entropy E sess When it is higher, random padding, initialization vectors, message authentication codes, and additional data all require longer bit widths to avoid statistical deviations or interception analysis. Therefore, the system introduces a linear expansion coefficient β to map the entropy value to an increment in the actual message length. The expansion coefficient depends on the internal block structure and integrity verification strategy of the selected encryption algorithm family. If the terminal and the control center negotiate to use AES-GCM, then because the GCM tag is fixed to 128 bits and the random padding requirement is relatively moderate, β is set to 1.125; if ChaCha20-Poly1305 is negotiated, because the stream cipher version requires a longer random counter and a larger 128-bit tag to resist replay attacks, β is increased to 1.25. When generating an instruction, the terminal first queries the encryption parameter table to obtain the corresponding β, and then reads the latest security entropy value E sess, calculate the actual additional length required, then reserve padding space in the buffer and fill it with true random bytes, and then write the Poly1305 tag or GCM authentication field at the end of the message, so as to obtain the final instruction that meets the cryptographic requirements and strictly corresponds to the current entropy value. The control center also uses the same β value to verify the random padding and tag length when unpacking. If the length does not match the session entropy, the message is immediately discarded and a security event is marked to prevent attackers from forging low-entropy data to bypass verification. By linearly combining the service template length with the entropy-driven security additional length, the present invention realizes the instant coupling of service semantics and security level. The control center can accurately calculate the link occupancy and transmission window based on the complete length D in the instruction queue scheduler. The terminal can also automatically compress the message to increase the sending speed or reduce the risk of retransmission by adjusting the entropy value or switching the algorithm family when the network is limited, thereby ensuring the correctness of the prescription execution while maintaining good throughput and real-time response.

[0064] Furthermore, the basic services include at least: registration information inquiry and reprinting, local display of medical queue information, system usage guidance, health education and user feedback entry; the low-risk services include at least: basic payment voucher reprinting, historical report inquiry and printing and registration information confirmation or reprinting receipts; the high-risk services include at least: prescription drug dispensing, prescription printing, medical insurance registration, payment settlement, hospitalization deposit recharge and deposit receipt printing, medical treatment item authorization and electronic health card writing and activation.

[0065] In the remote control method for medical terminals proposed in the present invention, in order to achieve secure adaptive management of the terminal operation mode, all service tasks that can be issued by the remote control center or triggered by the user are divided into three levels: basic business, low-risk business and high-risk business according to their sensitivity to medical safety, data consistency, transaction irreversibility and compliance audit requirements. Basic business refers to service content that does not involve the modification of core diagnosis and treatment data, does not generate account or prescription changes, and has read operation or user feedback attributes, including registration information query and reprinting, local display of consultation queue information, system usage guidance prompts, health education content playback, and user satisfaction evaluation or feedback entry. These functions can still operate when the terminal is in network degradation, service restriction or offline security mode. The purpose is to ensure that patients can still obtain the most basic medical guidance and information services during hospital peak hours, network fluctuations or equipment operation degradation. Low-risk services are services that reprint or confirm historical medical treatment data or receipts without directly changing medical insurance reimbursement, drug issuance, or fund settlement. These services include reprinting basic payment receipts, querying and printing historical examination and test reports, and confirming, reprinting, or repeating registration information. Although such services involve the retrieval and output of data within the system, they do not trigger new account statuses or generate write operations on prescription data. Therefore, they can be opened when the terminal is in degraded operation mode, provided that the network is available but the system detects that the risk score is in the middle range. High-risk services involve irreversible core operations such as patient prescription execution, changes in cash flow, activation of medical insurance transaction links, or changes in electronic health identities. These include the dispensing of prescription drugs, printing of prescription documents, medical insurance registration and settlement processes, recharging hospitalization deposits and printing of fiscal receipts, authorization and activation of specific imaging or test items, and writing patient identity binding information into the electronic health card and completing activation operations. Errors in this type of service will directly impact patient medication safety, the accuracy of medical insurance settlements, or the continuity of the diagnosis and treatment process. Therefore, execution is only permitted in full-function online mode, where the terminal is in normal condition, the security score is below the threshold, and the communication link is stable. Through the aforementioned hierarchical definitions, the control center can dynamically select which service content to enable based on the risk score when assessing the current risk status of the terminal. This maximizes terminal availability while ensuring compliance with diagnosis and treatment data and secure operations. This supports hospitals in ensuring patient service continuity and technical control of data asset integrity in unattended, self-service scenarios.

[0066] Furthermore, the adaptive adjustment factor α t for:

[0067]

[0068] Among them, σ max is the jitter tolerance threshold; RTT max is the network round-trip delay threshold; RTT is the network round-trip delay.

[0069] The numerator of the formula aggregates three link degradation indicators: actual packet loss rate p loss , the ratio of the network jitter standard deviation to its tolerance threshold σ jit / σ max , and the ratio of the latest round-trip delay to the allowed upper limit RTT / RTT max The three indicators are directly added in dimensionless form to avoid weight bias due to differences in measurement units; the denominator adds one to the same sum, so that the overall value is strictly limited to between zero and one. The worse the network quality, the larger the numerator, α t The trend towards 1 means that the system almost completely adopts the current observed risk and ignores the historical value in the subsequent exponentially weighted moving average update, achieving a rapid response to sudden jitter or packet loss; when the network is stable, the above ratio tends to be smaller, α t Close to zero, historical risk is maintained, avoiding frequent triggering of mode switching due to occasional small fluctuations. In specific implementation, the terminal extracts the number of confirmed losses of the past 100 data packets from the protocol stack sliding window every second to calculate p loss , and calculate the jitter standard deviation σ through the delay difference sequence defined in RFC3393 jit , threshold σ max The hospital determines the upper limit of acceptable jitter for real-time services; RTT is obtained by averaging the four timestamps measured on the continuous keep-alive channel. max It is given by the hospital network service level agreement. This design ensures that when there is a sudden surge in packet loss, latency, or jitter on the link, the adaptive factor increases rapidly, so that the risk score almost immediately affects the hardware execution logic, and the terminal can be promptly downgraded to an operating mode that only executes low-risk or basic services, avoiding the erroneous execution of high-risk instructions such as prescription drug delivery and medical insurance deductions in an unreliable network; on the contrary, when the network returns to normal and the indicators are far below the threshold, the adaptive factor decreases, and the risk score update center of gravity returns to history. The terminal will not frequently enter offline mode due to short and harmless fluctuations, thereby ensuring the continuity of the patient's medical process and the service life of the terminal hardware. Due to α t The calculation of σ depends on real-time observations and completely eliminates manual experience weights. The system can directly reuse the formula in different hospital network environments. It only needs to adjust the threshold σ max with RTT max It only needs to match the local link characteristics without modifying the software logic, meeting the dual requirements of medical scenarios for deployment convenience and security robustness.

[0070] Furthermore, the security risk score R safe (t+1) is:

[0071]

[0072] Among them, Π nom is the real-time power supply; pow is the rated power consumption; R safe (t) is the historical risk indicator; E err is the number of abnormal events; E crit is the abnormal tolerance threshold.

[0073] The historical risk index R safe (t) Save the environment and hardware state memory accumulated in the previous cycle, and adaptively adjust the factor α t The link packet loss, jitter and round-trip delay are calculated in real time. When the network deteriorates, the value is close to one, which allows the model to be updated quickly. When the network is stable, it tends to zero, and the new risk contribution is weakened to avoid score jitter. Measures the deviation between the UPS output power and the rated power consumption. If the real-time power approaches the load limit, the positive value increases after taking the logarithm, thereby increasing the overall risk. When the power is sufficient, the numerator is smaller than the denominator, the logarithm is negative, and after squaring, it still contributes a positive value but the amplitude decreases, reflecting redundancy. The ratio of the hardware failure count in the past minute to the tolerance threshold is mapped to a logarithmic increment. The more failures, the greater the ratio, and the logarithmic growth is marginally decreasing. After squaring, it is synthesized with the power term to form the Euclidean norm, which not only avoids the dominance of a single indicator, but also ensures that the two types of physical risks are manifested at the same time. After that, the whole is mapped to the (0,1) interval through tanh. The output is continuous, differentiable, and converges to extreme inputs, which facilitates rapid threshold judgment in the software: when the score is greater than the high threshold, the terminal immediately enters the offline security mode that only retains basic services such as registration query and queue display; when the score falls between the two thresholds, the terminal is locked from performing operations such as prescription printing, and only low-risk services are open; when the score is lower than the low threshold, the terminal resumes full online functionality, allowing high-risk instructions such as drug issuance and medical insurance settlement to be issued normally. The entire update process is repeated once per second. The power consumption and fault values ​​are directly collected by the onboard sensor, α t The network thread asynchronously refreshes the score, and the two are integrated atomically in shared memory. This ensures that even in power outages or frequent hardware failures, the score jumps within a single cycle to trigger protection. After brief network jitter or occasional minor glitches, the adaptive weighting ensures a smooth return to the score, avoiding frequent system mode switching. This dynamic scoring mechanism enables terminals in unmanned public healthcare environments to achieve real-time assessment and automated self-regulation of their security posture with minimal human intervention, effectively supporting the multiple goals of prescription safety, healthcare insurance compliance, and patient experience.

[0074] A remote control system for a medical terminal, the system comprising: a medical terminal and a remote control center; the medical terminal obtains a unique identification code preset in the terminal's own hardware, and receives a control center identification code and a random prime number dynamically generated by the remote control center from the remote control center, to generate a dynamic session key for this communication; the medical terminal then further calculates a security entropy based on the dynamic session key to characterize the security strength of this communication; the length of this remote control instruction is calculated based on medical business requirements and security entropy, wherein the basic instruction length is the length of a fixed template for the medical business, and the complete instruction length is obtained by combining the security entropy, and the theoretical delay of instruction transmission is calculated in an integral manner, while taking into account the packet loss rate of the current network link, the delay caused by network packet loss and retransmission, the link network jitter caused by the number of network path hops, and the clock synchronization between the medical terminal and the network timing source. The error is calculated to calculate the expected comprehensive delay time for the remote control command to reach the medical terminal and start execution; the medical terminal executes the designated medical task according to the received remote control command; the medical terminal collects its own real-time power supply power and compares it with the rated power consumption, and at the same time counts the number of internal hardware abnormal events and compares them with the abnormal tolerance threshold to construct an immediate risk index; at the same time, the medical terminal collects the current network jitter standard deviation of the network link and the network round-trip delay between the terminal and the remote control center in real time, and compares them with their corresponding thresholds respectively, and combines the packet loss rate to construct an adaptive adjustment factor based on the current network status; the adaptive adjustment factor is used to fuse the immediate risk index and the historical risk index with the exponentially weighted moving average algorithm to obtain a security risk score. According to the security risk score, the medical terminal controls itself to enter different working modes.

[0075] At 9 o'clock sharp, the medical terminal numbered T-01 in the outpatient hall completes the power-on self-test and starts the remote handshake process. The trusted execution environment first reads the hardware serial ID burned into the TPM. T =0xABCD1234eF567890, the control center node returns its own identification ID C = 0x1234567890ABCDEF and a 16-bit random prime number λ = 65537. The system's public prime number is 2048 bits in the official deployment, but this example reduces it to P = 2147483647 for ease of calculation. The terminal XORs the two identifiers to obtain 0xB9F95A5E7F1BD67F = 13367087013507369471, then calculates the power modulo to obtain

[0076]

[0077] Then read the instantaneous drift τ recorded by the timing daemon sync =4.00ms, maximum drift allowable value τ max=50.00ms. The cabinet temperature sensor displays the ambient temperature T amb =28.4℃, so the temperature drift coefficient η clk =(28.4-25.0) / 1000=0.0034. Substitute the value into

[0078]

[0079] To calculate session entropy, first find

[0080]

[0081] Add the stability constant to get 0.827559836000001, and then find the binary negative logarithm

[0082] E sess =-log2(0.827559836000001)≈0.278330bit.

[0083] The control center inserts a fixed operation template for the prescription drug delivery service for this patient, with a length of L0 = 512 bits. The two parties in the conversation agree to use AES-GCM, so the security expansion factor is β = 1.125. The complete instruction length is calculated as

[0084] D=L0+βE sess =512+1.125×0.278330=512.313616bit.

[0085] Then the link performance detection is started. The terminal uses three rounds of ICMP echo and BBR rate detection to measure the available bandwidth to be approximately constant over time.

[0086] B(u)=5.00×10 6 bit / s(0≤u≤D);

[0087] So the first integral

[0088]

[0089] Two out of 100 packets in the sliding window are lost, and the packet loss rate is p loss =0.02. The average retransmission time R measured by the network layer reTx =50ms. So the packet loss compensation delay

[0090]

[0091] The link reaches the cloud-side SD-WAN through four hops, and the routing hop weight Θ hop =5ms / hop=0.005s / hop. The delay jitter standard deviation σ is calculated in real time. jit=3.042ms, the difference between the terminal clock and the timing server δ NTP = 0.976ms. Take the square root of the sum of the two and get So the third

[0092] 0.005×3.196ms=0.01598ms;

[0093] The expected combined delay is obtained by adding the three items

[0094] t exec =0.102463+1.020408+0.015980≈1.138851ms.

[0095] This value is far lower than the hospital SLA upper limit of 100ms for the prescription drug delivery link, so the scheduler immediately marks the instruction as high priority for transmission.

[0096] In the same cycle, the network thread aggregates the link degradation factor. The threshold σ specified in the campus IT planning document is used. max =5ms, RTT max =200ms. The current average round-trip delay is RTT = 30.6ms.

[0097]

[0098] The power monitoring board uploads the UPS output power π pow =82.4W, nameplate power consumption Π nom =100.0W.

[0099] Instantaneous power risk term

[0100]

[0101] The hardware abnormality log has accumulated 4 in the last 60 seconds, and the tolerance threshold is E crit = 10. Abnormal risk items

[0102]

[0103] Euclidean synthesis

[0104]

[0105] Historical risk value records of the previous period Substitute all the data into

[0106]

[0107] The hospital set an offline protection threshold of 0.70 and a degradation threshold of 0.40, ensuring the terminal remained fully online and allowing the control center to proceed with the prescription dispensing process. The entire dispensing process took 6.8 seconds to complete. The quality monitoring thread recorded metrics such as a weight deviation of 0.18g and 100% QR code integrity in the traceability log, and then signed and pushed the results to the cloud.

[0108] At 11:23, the network peak arrived. The terminal detected that the packet loss rate jumped to 0.17, the jitter soared to 12.5ms, and the RTT soared to 176ms. Repeated calculations showed

[0109]

[0110] In the same minute, the printer jammed twice and the barcode scanner overheated once, causing the abnormality count to rise to 7. The UPS output power increased to 94W due to the full speed of the cooling fan. The risk Euclidean term becomes

[0111]

[0112] Update rating

[0113]

[0114] If the score exceeds the 0.40 demotion threshold but falls below the 0.70 high threshold, the terminal immediately enters degraded mode. Prescription dispensing, new medical insurance deductions, and deposit receipt printing are all frozen. Users can still print medical reports and reprint payment invoices. A yellow message bar appears at the top of the screen, indicating that network instability has restricted services. In this mode, command template length is limited to 256 bits, the retransmission window is reduced, and the system continuously monitors network and hardware status.

[0115] At 12:02, the network was restored, packet loss dropped to 0.01, jitter dropped to 4.3ms, and RTT dropped to 42ms. At the same time, the operation and maintenance personnel cleared the printer paper jam and replaced the heat dissipation filter, and the abnormal count returned to 1. Recalculation

[0116]

[0117] If the score falls below 0.40 again, the system automatically unlocks the downgrade lock, and the electronic screen at the counter turns green, indicating that all functions are available. The full process example, from key entropy generation to instruction encapsulation, latency budgeting, network weight calculation, risk score iteration, and operational mode change, demonstrates the dynamic self-adaptation and automatic self-healing capabilities of the present invention under abnormal conditions of real hospital networks, power supplies, and hardware. This fully verifies that this method can ensure patient drug safety, bill compliance, and treatment continuity without relying on human intervention.

[0118] The above shows and describes the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions merely illustrate the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the appended claims and their equivalents.

Claims

1. A dynamic key-driven secure adaptive remote control method for medical terminals, characterized in that: The method comprises: Step 1: The medical terminal obtains the unique identification code preset in its own hardware, receives the control center identification code and the random prime number dynamically generated by the remote control center from the remote control center, and generates a dynamic session key for this communication. The medical terminal then calculates the security entropy based on the dynamic session key to represent the security strength of this communication. Step 2: Calculate the length of this remote control command based on medical service requirements and security entropy. The basic command length is the length of the fixed template for medical services. Combined with the security entropy, the complete command length is obtained. The theoretical delay of command transmission is calculated in an integral manner. Taking into account the packet loss rate of the current network link, the delay caused by network packet loss and retransmission, the link network jitter caused by the number of network path hops, and the clock synchronization error between the medical terminal and the network timing source, the expected comprehensive delay time for the remote control command to reach the medical terminal and begin execution is calculated. Step 3: The medical terminal performs the designated medical task according to the received remote control instruction; Step 4: The medical terminal collects its own real-time power supply and compares it with the rated power consumption. It also counts the number of internal hardware anomalies and compares it with the anomaly tolerance threshold to construct an immediate risk indicator. Simultaneously, the medical terminal collects the current network jitter standard deviation of the network link and the network round-trip delay between the terminal and the remote control center in real time, compares them with their respective thresholds, and constructs an adaptive adjustment factor based on the current network status in combination with the packet loss rate. This adaptive adjustment factor is used to fuse the immediate risk indicator with the historical risk indicator using an exponentially weighted moving average algorithm to obtain a security risk score. Based on the security risk score, the medical terminal controls itself to enter different operating modes.

2. The dynamic key-driven secure adaptive remote control method for medical terminals according to claim 1, characterized in that: In step 3, when the security risk score exceeds the first preset security threshold, the medical terminal automatically enters the offline security mode and only performs basic services; when the security risk score is between the first and second preset security thresholds, the medical terminal automatically enters the degraded operation mode and only performs basic services and low-risk services; when the security risk score is lower than the second preset security threshold, the medical terminal enters the full-function online mode and performs basic services, low-risk services or high-risk services.

3. The dynamic key-driven secure adaptive remote control method for medical terminals according to claim 2, characterized in that: Dynamic session key K sess for: Among them, ID T It is the unique identification code of the medical terminal; ID C is the control center identification code of the remote control center; λ is a random prime number dynamically generated by the remote control center; P is a 2048-bit system public prime number; τ sync is the NTP / IEEE1588 clock drift; τ max is the maximum allowed clock drift; η clk is the RTC temperature drift coefficient, η clk =(T amb -25) / 1000; T amb is the ambient temperature.

4. The dynamic key-driven secure adaptive remote control method for medical terminals according to claim 3, characterized in that: Security Entropy E sess for: E sess =-log2[(K sess modP) / P+10 -15 ]。 5. The dynamic key-driven secure adaptive remote control method for medical terminals according to claim 4, characterized in that: Expected comprehensive delay time t exec for: Where B(u) represents the link bandwidth corresponding to the uth bit during the transmission of the remote control command; p loss is the packet loss rate; R reTx is the average delay caused by each retransmission; Θ hop is the link hop scheduling weight, ranging from 1 to 10, in ms / hop; jit is the standard deviation of link network jitter; δ NTP is the clock synchronization error between the medical terminal and the network timing source; D is the complete instruction length.

6. The dynamic key-driven secure adaptive remote control method for medical terminals according to claim 5, characterized in that: The complete instruction length D is: D=L0+βE sess ; Where β is the security entropy expansion coefficient, which represents the additional length required for the encryption header, random padding, and MAC authentication per 1 bit of entropy. It is determined by the encryption algorithm family and takes a value of 1.125 or 1.

25. When the encryption algorithm family is AES-GCM, β takes a value of 1.125; when the encryption algorithm family is ChaCha20-Poly1305, it takes a value of 1.

25. L0 is the length of the fixed template for medical services.

7. The dynamic key-driven secure adaptive remote control method for medical terminals according to claim 6, characterized in that: The basic services include at least: registration information inquiry and reprinting, local display of medical queue information, system usage guidance, health education and user feedback entry; the low-risk services include at least: basic payment voucher reprinting, historical report inquiry and printing and registration information confirmation or reprinting receipts; the high-risk services include at least: prescription drug dispensing, prescription printing, medical insurance registration, payment settlement, hospitalization deposit recharge and deposit receipt printing, medical treatment item authorization and electronic health card writing and activation.

8. The dynamic key-driven secure adaptive remote control method for medical terminals according to claim 7, characterized in that: Adaptive adjustment factor α t for: Among them, σ max is the jitter tolerance threshold; RTT max is the network round-trip delay threshold; RTT is the network round-trip delay.

9. The dynamic key-driven secure adaptive remote control method for medical terminals according to claim 8, characterized in that: Security Risk Score R safe (t+1) is: Among them, Π nom is the real-time power supply; pow is the rated power consumption; R safe (t) is the historical risk indicator; E err is the number of abnormal events; E crit is the abnormal tolerance threshold.

10. A remote control system for a medical terminal, used to implement the method according to any one of claims 1 to 9.

Images