Medical management system and data access method thereof

Abstract

The application provides a medical management system and a data access method thereof, and relates to the technical field of medical treatment. The method comprises the following steps: generating a business access request in an access layer, and sending the business access request to a service layer; calling a target business module corresponding to a target business according to the business access request in the service layer, and forwarding the business access request to a business application layer; constructing a data access request in the business application layer, and sending the data access request to a data layer; obtaining target business data corresponding to the target business based on the data access request in the data layer, and performing encryption processing on the target business data, and returning the encrypted target business data to the access layer through a double one-way isolation exchange technology; performing decryption processing on the encrypted target business data in the access layer, and displaying the decrypted target business data on an access platform, so that the problem that safe, controllable and real-time data access cannot be realized between different access environments in the related art is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of medical treatment, in particular to a medical management system and a data access method thereof. BACKGROUND

[0002] With the continuous improvement of medical informatization level, the medical management system gradually presents the trend of multi-layer architecture, distributed deployment and cross-institutional collaboration, and can support data interaction between different medical institutions and different access environments. However, the existing data access mode still has many deficiencies in the cross-environment access scene.

[0003] Specifically, due to the consideration of business data security and compliance, the medical management system usually needs to strictly control the access path and access permission, which to some extent increases the complexity of data access, making it difficult for users to obtain the required business data in a timely manner in a non-local access environment.

[0004] Based on this, it is difficult to achieve safe, controllable and real-time data access between different access environments, which is a problem to be solved. SUMMARY

[0005] Embodiments of the present application provide a medical management system and a data access method, device, computer equipment, storage medium and computer program product, which can solve the problem of difficult safe, controllable and real-time data access between different access environments in related technologies. The technical solution is as follows:

[0006] According to an aspect of the present application, a data access method of a medical management system, the system comprising an access layer, a service layer, a business application layer and a data layer; wherein the data layer is deployed in a first network environment, and the access layer is deployed in a second network environment which is isolated from the first network environment; the method comprising: providing an access platform for a user in the access layer, and generating a business access request based on a business access operation of the user on the access platform, and sending the business access request to the service layer; the business access request being used to indicate a target business requested to be accessed by the user; calling a target business module corresponding to the target business according to the business access request in the service layer, and forwarding the business access request to the business application layer according to the target business module; constructing a data access request corresponding to the target business module according to the target business indicated by the business access request in the business application layer, and sending the data access request to the data layer; the data access request being used to request the data layer to acquire target business data corresponding to the target business module; acquiring the target business data corresponding to the target business based on the data access request in the data layer, and performing encryption processing on the target business data, and returning the encrypted target business data to the access layer through a double one-way isolated exchange technology; wherein the double one-way isolated exchange technology is used to realize one-way secure transmission of business data between the first network environment and the second network environment; performing decryption processing on the encrypted target business data in the access layer, and displaying the decrypted target business data on the access platform, so that the user views the target business data on the access platform.

[0007] According to an aspect of the present application, a data access device of a medical management system, the system comprising an access layer, a service layer, a business application layer and a data layer; wherein the data layer is deployed in a first network environment, and the access layer is deployed in a second network environment which is isolated from the first network environment; the device comprising: a business access module configured to provide an access platform for a user in the access layer, and generate a business access request based on a business access operation of the user on the access platform, and send the business access request to the service layer; the business access request being used to indicate a target business requested to be accessed by the user; a business calling module configured to call a target business module corresponding to the target business according to the business access request in the service layer, and forward the business access request to the business application layer according to the target business module; a data access module configured to construct a data access request corresponding to the target business module according to the target business indicated by the business access request in the business application layer, and send the data access request to the data layer; the data access request being used to request the data layer to obtain target business data corresponding to the target business module; a data obtaining module configured to obtain the target business data corresponding to the target business based on the data access in the data layer, and perform encryption processing on the target business data, and return the encrypted target business data to the access layer through a double one-way isolated exchange technology; wherein the double one-way isolated exchange technology is used to realize one-way secure transmission of business data between the first network environment and the second network environment; and a data display module configured to perform decryption processing on the encrypted target business data in the access layer, and display the decrypted target business data on the access platform, so that the user views the target business data on the access platform.

[0008] According to an aspect of the present application, a medical management system comprises an access layer, a service layer, a business application layer and a data layer; the access layer is configured to provide an access platform for a user, generate a business access request based on a business access operation of the user on the access platform, send the business access request to the service layer, receive target business data after encryption sent by the data layer, decrypt the target business data after encryption, and display the target business data after decryption on the access platform, so that the user views the target business data on the access platform; the business access request is used to indicate a target business requested to be accessed by the user; the service layer is configured to call a corresponding target business module according to the business access request, and forward the business access request to the business application layer according to the target business module; the business application layer is configured to construct a data access request corresponding to the target business module according to the target business indicated by the business access request, and send the data access request to the data layer; the data access request is used to request the data layer to obtain target business data corresponding to the target business module; the data layer is configured to receive the data access request, obtain target business data corresponding to the target business based on the data access request, and encrypt the target business data, and return the target business data after encryption to the access layer through a double one-way isolation exchange technology; wherein the data layer is deployed in a first network environment, and the access layer is deployed in a second network environment isolated from the first network environment; the double one-way isolation exchange technology is used to realize one-way secure transmission of business data between the first network environment and the second network environment.

[0009] According to an aspect of the present application, a computer device comprises at least one processor and at least one memory, wherein the memory stores a computer program, and the computer program is executed by the processor to implement the data access method of the medical management system.

[0010] According to an aspect of the present application, a storage medium stores a computer program, and the computer program is executed by one or more processors to implement the data access method of the medical management system.

[0011] According to an aspect of the present application, a computer program product comprises a computer program, and the computer program is executed by one or more processors to implement the data access method of the medical management system.

[0012] The technical scheme provided by the present application has the beneficial effects that:

[0013] In the above technical solution, the secure access and display of target business data across different network environments in the medical management system is realized, a complete business access link is constructed between the access layer, the service layer, the business application layer and the data layer, and it is ensured that the business access request initiated by the user in the external network environment can be securely transmitted to the data layer of the internal network environment for processing after authentication, routing and data generation, and the encrypted target business data is unidirectionally returned to the access layer for decryption and display, thereby effectively solving the problem of difficult secure, controllable and real-time data access between different access environments in the related art. BRIEF DESCRIPTION OF DRAWINGS

[0014] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments of the present application will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0015] Figure 1 is a structural block diagram of a medical management system according to the present application;

[0016] Figure 2 is a system block diagram of a medical management system according to an exemplary embodiment;

[0017] Figure 3 is a flowchart of a data access method of a medical management system according to an exemplary embodiment;

[0018] Figure 4 is Figure 3 corresponding to step 310 in an embodiment of the flowchart;

[0019] Figure 5 is Figure 3 corresponding to step 350 in an embodiment of the flowchart;

[0020] Figure 6 is Figure 5 corresponding to step 351 in an embodiment of the flowchart;

[0021] Figure 7 is Figure 6 is a specific implementation schematic diagram of the double one-way isolation exchange technology involved in the corresponding embodiment;

[0022] Figure 8 is Figure 3 corresponding to the data access method of the medical management system in an embodiment of the flowchart;

[0023] Figures 9 to 10is a specific implementation schematic diagram of a data access method of a medical management system in an application scenario;

[0024] Figure 11 is a structural block diagram of a data access device of a medical management system according to an exemplary embodiment. DETAILED DESCRIPTION

[0025] Embodiments of the present application are described in detail below with reference to examples shown in the accompanying drawings, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as a limitation on the present application.

[0026] Those skilled in the art can understand that, unless specifically stated, the singular forms "a", "an" and "the" used herein also include the plural forms. It should be further understood that the use of the phrase "comprising" in the specification of the present disclosure means that the features, integers, steps, operations, elements and / or components exist, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we say an element is "connected" or "coupled" to another element, it can be directly connected or coupled to the other element, or there can be intermediate elements. In addition, "connected" or "coupled" used herein can include wireless connection or wireless coupling. The phrase "and / or" used herein includes all or any single unit and all combinations of the associated listed items.

[0027] As mentioned earlier, the existing data access method still has many deficiencies under a cross-network environment.

[0028] On the one hand, in order to protect the security of sensitive business data, the inventors thought that different functional modules of the medical management system could be deployed in mutually isolated network environments. However, this isolation improves data security to some extent, but also increases the complexity of cross-network access, and users often cannot directly and conveniently access the required business data from the external environment.

[0029] On the other hand, the inventors found that the existing medical management system lacks a unified mechanism for secure access control, and the access portals and authentication processes between different business modules are independent of each other, resulting in the need for multiple logins and repeated authentication for users, increasing the operational burden, and also potentially creating security risks due to inconsistent authentication standards.

[0030] In addition, in a high-concurrency access scenario, due to the lack of cross-level resource dynamic scheduling capability, when the resource consumption of a certain system layer is too high, it may cause access delay, request blocking and other problems, affecting the overall running efficiency and stability.

[0031] From the above, in the related art, there is still a defect that it is difficult to realize secure, controllable and real-time data access between different access environments.

[0032] Therefore, the data access method of the medical management system provided in the present application can effectively improve the security of data access of the medical management system. Accordingly, the data access method of the medical management system is suitable for a data access device of the medical management system, and the data access device of the medical management system can be deployed on an electronic device. The electronic device can be a computer device configured with a von Neumann architecture, for example, the computer device includes a desktop computer, a notebook computer, a server, etc.

[0033] In order to make the purpose, technical scheme and advantages of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the drawings.

[0034] Please refer to Figure 1 , Figure 1 is a structural diagram of a medical management system. As shown in Figure 1 , the medical management system 100 includes an access layer 110, a service layer 130, a business application layer 150 and a data layer 170. Among them, the data layer 170 is deployed in a first network environment, and the access layer 110 is deployed in a second network environment which is isolated from the first network environment.

[0035] The access layer 110 is used to provide an access platform for users, and based on the business access operation of the users on the access platform, a business access request is generated and sent to the service layer. The business access request is used to indicate the target business requested by the user to access. The encrypted target business data sent by the data layer is received, and the decrypted target business data is processed and displayed on the access platform, so that the user can view the target business data on the access platform. Among them, the access layer 110 can provide the access platform for the user through various ways such as mobile application (APP) installed on the user terminal, WeChat public number, Alipay life number, etc.

[0036] The service layer 130 is used to call the corresponding target business module according to the business access request, and forward the business access request to the business application layer according to the target business module.

[0037] The business application layer 150 is used to construct a data access request corresponding to the target business module according to the target business indicated by the business access request, and send the data access request to the data layer. The data access request is used to request the data layer to obtain the target business data corresponding to the target business module.

[0038] Data layer 170 is used to receive data access requests, obtain target business data corresponding to the target business based on the data access requests, encrypt the target business data, and return the encrypted target business data to the access layer through dual one-way isolation exchange technology.

[0039] The data layer is deployed in the first network environment, and the access layer is deployed in the second network environment, which is isolated from the first network environment. The dual unidirectional isolation switching technology is used to realize unidirectional secure transmission of business data between the first network environment and the second network environment.

[0040] In one possible implementation, the medical management system may further include a base layer, which is used to obtain resource usage information of the access layer, service layer, business application layer, and data layer; based on the resource usage information, allocate or adjust resources for data transmission between the access layer, service layer, business application layer, and data layer; if the resource usage of the access layer, service layer, business application layer, or data layer is detected to exceed a set threshold, then resources are reallocated to the access layer, service layer, business application layer, and / or data layer.

[0041] In one possible implementation Figure 2 A system block diagram of a medical management system is shown, such as Figure 2 As shown, the system consists of an access layer, a service layer, a business application layer, a data layer, and a foundation layer, arranged from top to bottom according to functional logic. The layers interact with each other through information security mechanisms and data standards and specifications.

[0042] Access Layer: This layer provides a unified access point for end users (such as doctors, patients, and third-party medical service providers). It can be accessed through various methods, including mobile applications (APPs), WeChat official accounts, and Alipay service accounts. The access layer is responsible for carrying the business access module, providing an access platform for users, generating business access requests based on user actions on the platform, and sending these requests to the service layer.

[0043] Service Layer: This layer receives and processes business access requests from the access layer, providing functions such as unified account, unified authentication, unified login, and unified services. The service layer hosts business invocation modules, which can invoke the corresponding target business module based on the business access request and forward the request to the business application layer, thus implementing access control and business logic scheduling.

[0044] The business application layer includes various functional application modules for medical services, such as appointment booking, online consultation, imaging examination, report retrieval, health records, and medical insurance settlement. This layer also houses the data access module, which generates data access requests based on business access requests and sends these requests to the data layer to retrieve the corresponding business data.

[0045] Data layer: responsible for the storage, management and processing of business data, including data collection, data control, data storage, data analysis, data mining and other functions. The data layer carries a data acquisition module, which can find the corresponding target business data based on data access requests, and encrypt the target business data, and then transmit the encrypted data to the access layer through the double one-way isolation exchange technology, realizing the one-way secure transmission of business data between different access environments.

[0046] In one possible implementation, the data layer includes a data collection module, which can be used to collect real-time video signals output by an ultrasound device and ensure low latency, high reliability and high security of video signals during transmission.

[0047] Specifically, the data collection module collects real-time pictures of the ultrasound machine through the HDMI interface, uses the built-in collection chip to perform signal equalization and jitter suppression, and sends the video frames into the hard-coded unit through the DMA direct memory access mode; the Slice hard-coded mode is used to divide a single-frame video into multiple independent Slices, and only the missing part is retransmitted when the network condition is poor, thereby shortening the recovery time and reducing error propagation.

[0048] The collected video stream is transmitted through the pass-through video transmission protocol, which is based on memory semantic optimization and zero-copy transmission technology, combines RDMA to write data directly into the network buffer, reduces CPU occupation and reduces delay; integrates TLS encryption handshake and supports SM1, SM2, SM3, SM4, SM6 algorithms during transmission, realizes video stream encryption and integrity check.

[0049] Data display module: can be deployed in the access layer, used for decrypting the received encrypted business data, and displaying on the access platform, so that users can view the target business data on the access platform.

[0050] Foundation layer: provides cloud computing resources, network resources, storage resources and management functions for each layer, and monitors and dynamically schedules resource usage to ensure stable operation of the system under high concurrency or load changes.

[0051] In one possible implementation, the foundation layer can be deployed in the cloud or hybrid cloud environment, based on the decoupled architecture design of the application layer and the physical layer, through the application interface abstraction layer, the plug-in type scheduling strategy engine, the scheduling strategy configuration layer and the resource real-time perception layer, the on-demand allocation and dynamic scheduling of various heterogeneous computing resources (including CPU, GPU, DPU, FPGA, high-speed storage nodes, etc.) in the system are realized.

[0052] The application interface abstraction layer is used to shield the differences between underlying hardware architectures, and provides a unified resource request and interaction interface for the access layer, the service layer, the business application layer, and the data layer, so that the business modules of each layer do not need to care about the specific deployment details of the underlying computing power, and only need to describe the computing power requirements (such as real-time requirements, concurrent access volume, bandwidth requirements, algorithm types, etc.) in a business-friendly manner.

[0053] The plug-in scheduling strategy engine can match the optimal heterogeneous computing resource combination according to the real-time, throughput, and algorithm type requirements of the business module, and support dynamic replacement of scheduling strategies in different business scenarios. For example, in the real-time analysis scene of ultrasonic video, DPU and GPU nodes with video codec hardware acceleration can be preferentially allocated; in the batch data analysis scene, NVME-oF nodes with high storage throughput can be preferentially allocated.

[0054] The scheduling strategy configuration layer can provide management and configuration capabilities for the plug-in scheduling strategy, allowing system administrators to configure the computing power allocation rules and priorities in different stages according to the target business scenario, such as limiting the maximum resource occupation ratio of a single task, optimizing the utilization of specific resources (such as GPUs), or reserving a redundant computing power pool for critical businesses.

[0055] The resource real-time perception layer can collect the health status, bandwidth utilization, hardware topology structure, and running load of the distributed computing nodes in real time, and feed back the perception results to the scheduling strategy engine to realize dynamic optimization of resource allocation. For example, when detecting that a node has a high load or hardware failure, the task can be automatically migrated to other healthy nodes, thereby ensuring the continuity and stability of the business.

[0056] In one possible implementation, the basic layer can also access a third-party security platform to provide key, token, and certificate management capabilities of cryptographic algorithms such as SM1, SM4, SM2, SM3, and SM6, for ensuring the security of cross-layer data transmission and access control.

[0057] Referring to Figure 3 , the embodiment of the present application provides a data access method of a medical management system. Figure 1 The medical management system is shown in the figure.

[0058] In the following method embodiment, in order to facilitate description, the execution subject of each step of the method is taken as an example for description, but this does not constitute a specific limitation.

[0059] As Figure 3 shown, the method can include the following steps:

[0060] At step 310, the access layer provides an access platform for the user, and generates a service access request based on the service access operation of the user on the access platform, and sends the service access request to the service layer.

[0061] The service access request is used to indicate a target service requested by the user to access.

[0062] Firstly, the data access method of the embodiment is applicable to a medical management system, which includes an access layer, a service layer, a service application layer and a data layer; wherein the data layer is deployed in a first network environment, and the access layer is deployed in a second network environment which is isolated from the first network environment.

[0063] Specifically, the access layer can provide a unified access portal, i.e. an access platform, for the user through an access server, a portal system or a client application deployed in the second network environment. The access platform can be a Web-based portal page, or a client application installed on a user terminal (such as a smart phone, a tablet computer, a personal computer, etc.), which is used to receive the service operation instructions of the user.

[0064] In the embodiment, the first network environment can be an internal secure network environment in which the data layer of the medical management system is deployed, which is usually an information private network in a medical institution, a hospital local area network, or a health industry intranet accessed through a dedicated line. The first network environment is physically isolated from the Internet, and is used to store and process sensitive data such as patient privacy information, diagnosis and treatment data, electronic medical records, etc.

[0065] It can be understood that the first network environment is an internal network carrying core business systems and sensitive data of the hospital, and can have the following characteristics: isolated from the Internet, limited data exchange with external networks through a secure access point or isolation device; internal devices are interconnected through a high-speed local area network (LAN) to ensure low latency and high reliability of data transmission; the network topology can adopt a multi-layer structure (core layer, aggregation layer, access layer), and deploy multi-level protection strategies.

[0066] The second network environment can be an external network environment in which the access layer of the medical management system is deployed, which is usually a public network environment accessible through the Internet, such as an Internet access platform open to the public by the hospital, a patient service website, a mobile application platform, etc. The network environment is used to provide a service access portal for terminal users (such as doctors, patients, third-party medical service institutions, etc.) to initiate a service access request and view the returned data.

[0067] It can be understood that, in contrast to the first network environment, the second network environment mainly carries the externally open medical service access layer.

[0068] Further, the first network environment and the second network environment can realize one-way secure transmission of data through a double one-way isolation exchange technology, to prevent the first network environment from being directly accessed or invaded from the outside.

[0069] When the user performs a service access operation through the access platform, the access layer can collect operation parameters related to the service access operation, such as target hospital identifier, service data type, user identity authentication information, and the like, and construct a service access request based on the above operation parameters. The service access request can contain service object information pointed by the user operation, and can also include context information required for subsequent access control and data scheduling.

[0070] In one possible implementation, the service access request includes a target hospital identifier and a service data type, the target hospital identifier is used to indicate the data layer of the target hospital that needs to be accessed, and the service data type is used to indicate the specific service data category that needs to be accessed; the user identity authentication information can be used to obtain target member information at the subsequent service layer or service application layer, so as to ensure the legality and accuracy of data access.

[0071] After generating the service access request, the access layer sends the request to the service layer. To ensure secure transmission across network environments, the access layer and the service layer can interact through an encrypted communication channel (such as TLS / SSL), and can attach an access token or a session key during transmission to verify the source and integrity of the service access request.

[0072] In one possible implementation, as shown in FIG. 3B, step 310 can further include the following steps: Figure 4

[0073] Step 311: Establishing a public communication domain and a secure communication domain in the communication network element through the 5G dual-domain private network.

[0074] The secure communication domain is in communication with the first network environment where the data layer is located, and the public communication domain is in communication with the second network environment where the access layer is located.

[0075] Specifically, the communication network element can be a core network device supporting 5G private network functions, such as a user plane function node or a multi-access edge computing node of a 5G core network.

[0076] In this embodiment, the communication network element can divide two logically isolated domains on the same hardware platform or virtualization platform:

[0077] Secure communication domain: in communication with the first network environment where the data layer is located, used to carry a secure access channel involving sensitive service data.

[0078] ​Public communication domain: in communication with the second network environment where the access layer is located, used to carry non-sensitive data traffic such as external Internet resource access.

[0079] Therefore, through the network slicing or multi-access technology of the 5G dual-domain private network, two types of communication domains can be established on the physical link at the same time, realizing the domain management and isolated transmission of different service traffic, so as to ensure the security of medical data access and the efficiency of service processing.

[0080] In one possible implementation, the hospital internal equipment is mainly deployed in the first network environment, which is usually the internal information private network of the hospital or the industry intranet accessed through a dedicated line, and is physically isolated from the public Internet, and has a high security protection level. The hospital internal equipment includes but is not limited to: server type equipment (for example, medical management system data server), network and security equipment and terminal type equipment (terminals for in-hospital use only, such as doctor workstations, nurse station terminals, medical technology department query terminals, etc.).

[0081] Step 313, in the communication network element, based on the user identity authentication rule, the user terminal corresponding to the access layer is authenticated in the public communication domain and the secure communication domain.

[0082] Among them, the user terminal corresponding to the access layer can be a user-side device deployed with an access platform client and used to initiate a service access request and receive a service processing result. The user terminal can establish a communication relationship with the access layer by accessing the 5G network (private network or public network).

[0083] In this embodiment, the dual-domain identity authentication means that the communication network element respectively verifies the access rights of the user terminal corresponding to the access layer in the public communication domain and the secure communication domain. The authentication process can include the following operations:

[0084] In the public communication domain, the network access identity of the user terminal is authenticated, for example, 5G access authentication based on a SIM card / USIM card.

[0085] In the secure communication domain, the service access identity of the user terminal is authenticated again, for example, access right verification based on user identity authentication information, digital certificate, token (Token), etc.

[0086] In one possible implementation, the dual-domain identity authentication includes access authentication and service authorization in the public communication domain and the secure communication domain, to ensure the identity consistency and legal rights of the terminal accessing the two domains; the process can adopt a two-way authentication mechanism based on user identity authentication information to prevent unauthorized terminals from accessing sensitive service systems in the first network environment.

[0087] Through the dual-domain identity authentication, it can be ensured that the user terminal not only has network access permission, but also has service authorization to access sensitive business data, thereby realizing multi-layer protection of medical data access.

[0088] Step 315, if the business access request is directed to the target business data in the first network environment, the business access request is forwarded to the data layer through the secure communication domain in the case of passing the identity authentication.

[0089] Specifically, after identifying the access target of the business access request, if the target is the data layer deployed in the first network environment, the communication network element selects the secure communication domain as the transmission path, and routes the request to the internal network address where the target data layer is located through the secure communication domain.

[0090] At this time, the communication network element can transmit the business access request to the corresponding first network environment data layer address according to the target hospital identifier and the business data type carried in the business access request, realizing secure access from the external network environment to the internal network business system.

[0091] To ensure transmission security, end-to-end encryption and access control policies can be enabled in the secure communication domain, so as to avoid interception or tampering of business requests during transmission.

[0092] Step 317, if the business access request is directed to external Internet resources, the business access request is forwarded to the external server through the public communication domain.

[0093] In this embodiment, the external Internet resource can be a third-party hospital platform, a public health information platform or an external cloud service interface, etc.

[0094] After the communication network element judges that the target address of the business access request belongs to the Internet range, the request is forwarded to the corresponding external server through the public communication domain, so as to interact with the external system. Since the public communication domain is physically isolated from the first network environment, the external request cannot directly access the internal data layer, effectively preventing the exposure risk of the internal network.

[0095] Therefore, this way can realize flexible access to the internal network business system and Internet resources in the same terminal session, and the access paths and permission systems of the two are completely isolated, thereby ensuring the security of the first network environment and the convenience of Internet access.

[0096] Through the above process, through the 5G dual-domain private network, intelligent distribution of data access is realized in the communication network element, so that the user in the external network environment can safely, quickly and conveniently access the health and health industry private network through the terminal where the access layer is located without changing the SIM card or phone number, thereby directly accessing the application and data service in the first network environment in the second network environment.

[0097] It is further explained that the access layer can deploy a user information verification module for checking the legitimacy of the identity of the user before accessing the platform, so as to prevent unauthorized terminals or users from accessing the medical management system.

[0098] In one possible implementation, after the access layer receives a user-initiated access platform login request, the user information is verified; specifically, the access layer receives the login credential information input by the user on the access platform, and the login credential information can include user identity authentication information (such as a username, a password), a dynamic verification code, and biometric information (such as a fingerprint, facial recognition data). The access layer can send the user identity authentication information to the authentication service component for checking. The authentication service component can be deployed locally in the access layer, or can call the interface of the service layer or an external identity authentication center for implementation; then, in the case where the identity authentication is passed, the access layer can generate an access token (Token) and a session key for the user, and bind the access token with the user type (such as a doctor, a patient, an administrator, a user of a third-party medical service institution, etc.), which is used for subsequent permission checking and call control of the business access request; of course, if the identity authentication is not passed, the user login request is rejected, and the access platform returns corresponding prompt information, prompting the user to check the login credentials or reapply for access permission.

[0099] In another possible implementation, the access layer can also verify the user information while combining the user terminal device information (such as a device unique identification code, an IP address, geographic location information, etc.) to make a security policy judgment, so as to identify potential unauthorized access or abnormal login behavior, thereby further improving the security of the system.

[0100] Step 330, the service layer calls a target business module corresponding to the target business according to the business access request, and forwards the business access request to the business application layer according to the target business module.

[0101] Specifically, the service layer can be deployed in an independent application server or a cloud computing environment, serving as a business processing hub between the access layer and the business application layer. After receiving the business access request sent by the access layer, the service layer first parses the business access request to extract the key parameters contained therein, such as: target hospital identification, business data type, user identity authentication information, etc.

[0102] In one possible implementation, the service layer can maintain a plurality of different target business modules, each of which corresponds to one or more business processing logics. For example, an electronic medical record query module, a test report acquisition module, an image data review module, a reservation registration module, etc. After the business access request is parsed, the service layer can determine the target business module to be called according to the business data type, the target hospital identification, and the module mapping rule inside the system.

[0103] In addition, the target business module can also determine the calling strategy in combination with the user type. For example, for a doctor user, the target business module can include an electronic medical record query module, a test report acquisition module, an image data review module, a prescription issuing module, etc. For a patient user, the target business module can include a reservation registration module, a test result viewing module, a fee list query module, an online payment module, etc.

[0104] It is further explained that the target business module can be dynamically loaded and displayed on the user interface of the access platform, so that the user can directly access the business function matching the role and permission in the access platform interface.

[0105] Then, the displayed target business module not only can be viewed by the user, but also can further respond to the operation instruction (such as clicking, querying, modifying, downloading, etc.) of the user, and pass these operations as an updated business access request to the service layer again, which is further processed by the service layer or forwarded to the business application layer.

[0106] In this way, the service layer not only realizes the calling and forwarding function of the target business module, but also dynamically adjusts the business function displayed by the access platform according to the user type and operation context, thereby improving the interactivity and personalized service capability of the system.

[0107] Then, after calling the target business module, the service layer can convert the business access request into a data request format matching the target business module based on the business application layer interface address, communication protocol and data format associated with the target business module, and forward it to the corresponding business processing unit in the business application layer. After receiving the request, the business application layer can process the request according to the predetermined business logic.

[0108] For example, when the target business module is an electronic medical record viewing module, the service layer can encapsulate the business access request according to the standard parameter format of the electronic medical record interface, and forward it to the service process responsible for medical record data query in the business application layer; when the target business module is a test report query module, the business access request is forwarded to the functional unit responsible for test report retrieval in the business application layer.

[0109] It should be noted that the target business module is closely related to the user type of the user. Even if multiple users request to access the same target business (such as an "online consultation" service), due to different identity attributes, the target business module called by the system may also be different, thereby affecting the subsequent business processing flow and data display form.

[0110] In a possible implementation, the method further includes: determining a user type of the user according to the service access request; and invoking a corresponding target service module according to the target service indicated by the service access request based on the user type.

[0111] The user type can be a classification identification based on a role or permission assumed by the user in the medical management system, and is used to distinguish the operation permission, data access range, and interaction content difference of different users in a service process.

[0112] In a possible implementation, the user type includes a doctor, a patient, a nurse, an expert remote consultation personnel, and the like, which are not specifically limited herein.

[0113] For example, if the user is a patient, the system can invoke an online consultation module dedicated to patients to provide functions including consultation initiation, graphic and text inquiry, historical record viewing, and the like; if the user is a doctor, the system can invoke an online inquiry module on the doctor side to support functions including patient queue viewing, consultation request responding, medical record filling, and the like.

[0114] For the identification of the user type, the user access request can include a user identifier (such as a user ID, an account name, and the like), and the system can query the registration information or authorization information of the user based on the information to determine the user type corresponding to the user; for example, if the user information includes a "role=doctor" field, the user can be identified as a doctor.

[0115] In addition, when the user accesses the system through a specific access platform, channel, or path, the user type can be inferred based on the access platform, channel, or path; for example, access from a hospital HIS system intranet is considered as a medical staff such as a doctor or a nurse by default, and external access from a mobile app is considered as a patient or a family member by default, which are not specifically limited herein.

[0116] Through the above process, the identification of the user type can be used to guide the system to make a differentiated decision when invoking the target service module, so as to achieve precise access control and personalized interaction.

[0117] In step 350, a data access request corresponding to the target service module is constructed according to the target service indicated by the service access request in the service application layer, and the data access request is sent to the data layer.

[0118] The data access request is used to request the data layer to obtain target service data corresponding to the target service module.

[0119] It should be understood that after the target business module call of the business access request is completed, the system generates a corresponding data access request based on the selected target business module, which is used to request the target business data related to the target business module from the data layer. The data access request can include business data types, target member information, etc. The data access request can support the data layer to complete the accurate extraction, semantic association and structured processing of the target business data, and return the processed target business data to the access layer for final display.

[0120] Specifically, the business application layer is deployed in the business logic processing environment of the medical management system, and is usually composed of multiple application services oriented to different business fields, such as electronic medical record service, image diagnosis service, laboratory report service, drug management service, etc.

[0121] After receiving the service layer forwarded business access request, the business application layer can parse the business data range and access conditions required to be accessed based on the target hospital identifier, business data type, user identity authentication information and other parameters contained in the business access request.

[0122] In one possible implementation, the business access request includes a target hospital identifier and a business data type; as shown in Figure 5 Step 350 includes:

[0123] Step 351, if the target hospital indicated by the target hospital identifier is not the hospital corresponding to the current access platform, the target member information is parsed based on the business access request.

[0124] It can be understood that if the target hospital indicated by the target hospital identifier is not the hospital corresponding to the current access platform, the business access request needs to be processed across hospitals, that is, the target member information is parsed based on the business access request.

[0125] In one possible implementation, as shown in Figure 6 Step 351 can further include the following steps:

[0126] Step 3511, based on the business access request, an access credential is obtained, and in the case of hospital interconnection, the access credential is sent to the target access platform corresponding to the target hospital indicated by the target hospital identifier.

[0127] The access credential is used to establish a secure access session between different hospital platforms, and the access credential can be an authorization code, which is not limited here.

[0128] Specifically, after receiving the cross-hospital access business access request, the business application layer first parses the target hospital identifier based on the business access request, and confirms that the target hospital indicated by the identifier is not the hospital corresponding to the current access platform. At this time, a secure channel for cross-hospital access needs to be built.

[0129] To this end, the business application layer can extract the basic parameters (such as user identity authentication information) for cross-hospital access authorization from the business access request and generate an access credential.

[0130] The above-mentioned access credential can be in the form of a single-time valid random string and be encapsulated through an encryption algorithm (such as AES or RSA) combined with a digital signature technology to ensure the confidentiality and tamper resistance of the access credential during transmission.

[0131] Subsequently, under the condition of hospital interconnection (for example, based on the national health industry private network or regional medical data exchange platform), the business application layer sends the generated access credential to the target hospital identifier corresponding target access platform, for initiating a cross-hospital session initialization request.

[0132] Step 3513, by interacting with one or more application programming interfaces of the target access platform, the target user information of the user in the target access platform is obtained based on the access credential, and the target member information of the user in the target access platform is determined according to the target user information.

[0133] In one possible implementation, the TOKEN token can be obtained based on the access credential through a first application programming interface at the target access platform; the target user information of the user can be obtained based on the TOKEN token through a second application programming interface at the target access platform; and the target member information can be obtained based on the target user information through a third application programming interface at the target access platform.

[0134] Specifically, after receiving the access credential, the target access platform can verify the access credential through a first application programming interface (API1).

[0135] In one possible implementation, the verification process can include: checking whether the digital signature of the access credential matches the public key of the target hospital; checking whether the validity period of the access credential is within a set time window (for example, valid within 60 seconds or 5 minutes); verifying whether the source of the access credential is in the trusted access platform whitelist.

[0136] Then, after verification, the target access platform generates a TOKEN token with timeliness and uniqueness for this cross-hospital access. The TOKEN token is usually a unpredictable random value, and can bind the identity information of the access user, the authorized range, the accessible business data type and the like. The generation of the TOKEN token can rely on a customized hospital internal token mechanism, and be stored in the session management module of the target hospital.

[0137] After the TOKEN token is generated, the business application layer initiates a target user information acquisition request to the target access platform based on the token through a second application programming interface (API2).

[0138] After receiving the target user information acquisition request, the target access platform parses the user identifier bound to the TOKEN token, and queries the registration information, permission level, role type (such as doctor, nurse, patient, and third-party service personnel) of the user in the user management system of the target hospital.

[0139] The return of the target user information can be in the form of an encrypted data packet, and can be accompanied by a data signature to prevent man-in-the-middle attacks or data tampering.

[0140] Specifically, the target member information includes the user's clinic card number in the target hospital, in addition to which the target member information can also include the user's medical record number, outpatient or inpatient registration information, and the like, which are not limited here.

[0141] It should be noted that the target user information can refer to basic identity information and account information related to the user in the target hospital, which can be used to confirm the user's identity in the target hospital business system and obtain more specific member information, such as the user's name, ID number, mobile phone number, and the like; the target member information can refer to the business identity information corresponding to the user in the target hospital internal business system, which is a key identifier directly used to query medical business data, and can be used as a search condition in a data access request to locate the business data related to the user in the target hospital database, such as a work number (doctor or nurse), clinic card number, medical record number, hospitalization number, and electronic medical record unique identifier.

[0142] Step 353, generating a data access request based on the business data type indicated by the business access request and the target member information.

[0143] Then, after the target member information is obtained by the business application layer, the data access request for accessing the target hospital data layer can be further generated in combination with the business data type indicated in the business access request.

[0144] Specifically, the business data type can be used to indicate the data category to be accessed, such as outpatient clinic records, inpatient medical records, test results, imaging data, and prescription information; and the target member information can uniquely identify the subject of the user in the target hospital, such as a work number (doctor or nurse), a clinic card number, and a patient unique code.

[0145] When generating the data access request, the business application layer can also bind the business data type with the target member information, and add necessary access control parameters, such as access timestamp, user identity authentication information, session token, etc., so as to perform access permission check and data scheduling in the data layer.

[0146] At step 355, the data layer access address of the target hospital is determined based on the target hospital identifier, and the data access request is sent to the data layer of the target hospital based on the data layer access address.

[0147] Specifically, based on the target hospital identifier contained in the business access request, the corresponding target hospital data layer access address, such as the security access gateway address, dedicated line IP address, or virtual private network (VPN) portal address of the data layer, can be found in the address mapping table or directory service of hospital interconnection.

[0148] After the access address is determined, the business application layer can send the data access request to the target hospital data layer through a secure transmission channel. The secure transmission channel can use a 5G dual-domain private network, a VPN dedicated line, or a TLS / SSL encryption link supporting a national encryption algorithm to ensure that the data access request is not eavesdropped, tampered with, or replayed during transmission.

[0149] At step 370, the target business data corresponding to the target business is obtained based on the data access request in the data layer, and the target business data is encrypted and returned to the access layer through a dual one-way isolation exchange technology.

[0150] The dual one-way isolation exchange technology is used to realize one-way secure transmission of business data between the first network environment and the second network environment.

[0151] In one possible implementation, step 370 can further include the following steps: based on the target member information of the data access request, searching for the target database corresponding to the target member information in the data layer of the target hospital; based on the business data type indicated by the data access request, searching for the target business data in the target database.

[0152] Specifically, after the data layer receives the data access request, the target database corresponding to the target member information is first searched in the data layer of the target hospital based on the target member information contained in the data access request.

[0153] For example, when the target member information is the patient's medical card number in the target hospital, the data layer can locate the corresponding patient file database or its logical partition in the patient information index table.

[0154] Next, the data layer can further retrieve the corresponding data record in the target database based on the business data type indicated in the data access request. For example, when the business data type is "test result", the system can find the record that meets the access condition in the test data table of the patient; when the business data type is "image data", the image storage system (PACS) can be located and the corresponding image file and its structured report can be extracted.

[0155] After obtaining the target business data, the data layer will encrypt it to prevent unauthorized access or tampering during cross-network transmission. The encryption method can support the SM algorithm (SM1, SM4 symmetric encryption, SM2 asymmetric encryption, SM3, SM6 hash algorithm), and the encryption key and token used can be generated by the system's basic layer or accessed through the basic layer by accessing a third-party security platform.

[0156] After encryption, the data layer sends the encrypted target business data to the access layer through a double one-way isolation exchange technology.

[0157] In one possible implementation, the double one-way isolation exchange technology includes a front-end machine, a back-end machine, and a one-way optical gate; the front-end machine is deployed in the first network environment where the data layer is located, used to receive the encrypted target business data, and transmit the target business data to the one-way optical gate; the one-way optical gate is arranged between the first network environment and the second network environment where the access layer is located, and the one-way optical gate only allows the target business data to be transmitted from the front-end machine to the back-end machine in a predetermined direction; the back-end machine is deployed in the second network environment where the access layer is located, used to receive the target business data transmitted by the one-way optical gate, and transmit the target business data to the access layer.

[0158] Figure 7 A specific implementation diagram of a double one-way isolation exchange technology is shown, as shown in Figure 8 The double one-way isolation exchange technology includes a front-end machine and a back-end machine deployed in different network environments, and a one-way optical gate device between them; the isolation exchange system on the mobile private network side is deployed as a front-end machine, connected to the first network environment (such as the internal secure network where the data layer of the hospital is located); the isolation exchange system on the office private network side is deployed as a back-end machine, connected to the second network environment (such as the external office network where the access layer is located, the Internet access environment); two optical gate devices (labeled as "optical gate (in)" in the figure) realize one-way transmission channels in different directions, ensuring that data can only flow in a predetermined direction, preventing reverse access or data backflow.

[0159] Then, the data layer can deliver the encrypted target business data to the front-end machine on the mobile private network side, and transmit it unidirectionally to the back-end machine on the office private network side through the optical shutter. The back-end machine then transfers the target business data to the access layer, and finally displays it to the user on the access platform.

[0160] The aforementioned dual unidirectional isolation switching technology ensures that internal network data can only go out and not come in. Even when transmitting sensitive medical data across private networks, it can effectively prevent direct intrusion of external networks into the primary network environment, thus achieving secure interconnection of the medical management system between different private networks.

[0161] In one possible implementation, the above method may further include: performing semantic-level data parsing on the target business data to obtain a subset of the target business data associated with user context information, and returning the subset of the target business data to the access layer.

[0162] Specifically, the user context information may include, but is not limited to, the user's user type (such as doctor, patient, administrator, etc.), access time, terminal type, and business data type. Based on the above user context information, the data layer can perform semantic-level data parsing processing on the target business data through technologies such as structured extraction, semantic understanding, and feature matching, and filter out the subset of data most relevant to the current user's access purpose, which is then returned to the access layer as the target business data subset.

[0163] For example, when a user requests access to a patient's imaging data, if the user is the attending physician and the purpose of the access is "postoperative follow-up", the system can only extract the imaging reports and surgical records within 7 days after the patient's surgery; while if the user is the patient and the purpose of the access is "health consultation", the system can prioritize presenting basic imaging results and explanatory documents.

[0164] In this way, the system can deliver personalized data at the data layer, improve data response efficiency, reduce redundant transmission content, and enhance the accuracy and security of terminal display.

[0165] Step 390: Decrypt the encrypted target business data at the access layer and display the decrypted target business data on the access platform so that users can view the target business data on the access platform.

[0166] Specifically, after receiving target business data that has been encrypted by the data layer and transmitted through dual unidirectional isolation switching technology, the access layer can call the local decryption module or access the decryption service provided by the basic layer to decrypt the target business data.

[0167] In a possible implementation, the decryption process can be performed based on a cryptographic algorithm matched with the encryption process, such as the national SM1, SM4 symmetric encryption algorithm, SM2 asymmetric encryption algorithm, SM3, SM6 hash algorithm, and the like. The keys and tokens required for decryption can be generated and managed by the underlying layer, or can be provided by the underlying layer by accessing a third-party security platform through a secure interface.

[0168] After decryption, the access layer displays the obtained plaintext target service data through the access platform. The access platform can present the data in different ways such as a list, a chart, an electronic medical record view, an examination report view, and the like according to the type of the service data, to ensure that the user can intuitively and accurately view the data content.

[0169] In a possible implementation, the access layer can also perform permission control and audit recording on the displayed data, for example, according to the user identity authentication information and the access token to verify whether the user has the permission to view specific data, and record the time, source IP, operation type, and the like of each data access, to meet the medical data security and compliance requirements.

[0170] Through the above process, the secure access and display of the target service data across different network environments in the medical management system are realized, and a complete service access link is constructed between the access layer, the service layer, the service application layer, and the data layer, to ensure that the service access request initiated by the user in the external network environment can be securely transmitted to the data layer in the internal network environment for processing after authentication, routing, and data generation, and the encrypted target service data is unidirectionally returned to the access layer for decryption and display.

[0171] The above process realizes the physical isolation and unidirectional secure transmission between the first network environment and the second network environment through the double unidirectional isolation exchange technology and the encryption and decryption mechanism, to prevent internal data leakage or illegal access; meanwhile, through the decryption and display of the data by the access layer, the user can efficiently and conveniently obtain the required service information on the premise of ensuring data security and compliance, thereby improving the availability and access security of the medical data.

[0172] Please refer to Figure 8 In an example embodiment, the above medical management system further includes an underlying layer. Accordingly, the above method can further include the following steps:

[0173] Step 410: Obtain resource usage information of the access layer, the service layer, the service application layer, and the data layer through the underlying layer.

[0174] In the embodiment, the base layer serves as the bottom support platform of the medical management system, and can monitor the running load and resource occupation of each system level. The resource usage information can include, but is not limited to, CPU occupation rate, memory usage, network bandwidth occupation, storage space usage, and encryption / decryption processing resource consumption. The resource usage information can be periodically reported to the base layer through the monitoring agent module deployed at each layer, or can be collected in real time through a centralized resource management interface.

[0175] At step 430, based on the resource usage information, the base layer allocates or adjusts resources for data layer to data transmission between access layer, service layer, business application layer and data layer.

[0176] Specifically, the base layer can optimize the allocation of computing resources, storage resources and network resources of the data layer in combination with the number of current access requests, data transmission volume, business processing type and other factors. For example, when the access volume suddenly increases, the base layer can temporarily increase the computing nodes or bandwidth quota for the data layer to ensure the stability and low delay of the business access link; when the access volume decreases, the excess resources can be released to improve the overall resource utilization.

[0177] At step 450, if it is detected that the resource usage of the access layer, the service layer, the business application layer or the data layer exceeds the set threshold, the resource allocation of the access layer, the service layer, the business application layer and / or the data layer is re-performed through the base layer.

[0178] Specifically, the base layer can pre-configure multiple threshold strategies, such as an 80% warning value for CPU occupation rate, a peak limit for network bandwidth, etc. When it is detected that the resource usage of a certain layer exceeds the set threshold, the base layer can trigger resource reallocation process to dynamically schedule the resources of idle or low-load nodes to the high-load layer; if necessary, it can also trigger load balancing mechanism to migrate part of the business requests to other available nodes, thereby avoiding the performance degradation of the system caused by single-point overload.

[0179] In one possible implementation, in addition to collecting the resource usage information of the access layer, the service layer, the business application layer and the data layer and performing dynamic resource allocation, the base layer can also provide unified security support for the system.

[0180] Specifically, the base layer can generate or manage security credentials such as keys and access tokens involved in data encryption. The keys and access tokens can support the SM series cryptographic algorithms of the national cryptography, including but not limited to SM1, SM4 symmetric encryption algorithm, SM2 asymmetric encryption algorithm, SM3 hash algorithm, and SM6 and other new generation cryptographic algorithms.

[0181] Further, in actual deployment, the base layer can either locally deploy the key management module, directly generate and distribute the keys and tokens, or interface with a third-party security platform through a secure interface, and the third-party security platform generates and manages the keys and tokens.

[0182] In the above manner, the confidentiality, integrity and traceability of the business access request, data access request and target business data can be ensured during transmission and processing in a cross-network environment.

[0183] Under the action of the above embodiments, by uniformly collecting resource usage information of each system level in the base layer and dynamically allocating and adjusting resources based on real-time monitoring results, on-demand allocation and load balancing of data transmission resources between the access layer, service layer, business application layer and data layer are realized. When the resource usage of any layer exceeds the set threshold, resource reallocation can be triggered in time to avoid single-point overload and ensure the stability and response speed of the system in high-concurrency and complex business scenarios, thereby improving the overall operation efficiency and reliability of the medical management system.

[0184] Figures 9 to 10 is a specific implementation schematic diagram of a data access method of a medical management system in an application scenario, which is applicable to Figure 1 the medical management system shown.

[0185] Now the application scenario will be described in conjunction with Figure 9 and Figure 10 A user accesses the access platform of the medical management system through a mobile terminal (such as a secure mobile phone, a secure tablet computer, etc.) deployed with a secure access application. The user terminal first establishes a secure connection with the access layer through a 5G dedicated network, and the connection is realized through a 5G dual-domain private network provided by the operator.

[0186] Specifically, the user terminal connects to a second user plane function network element (UPF) by accessing a 5G dedicated base station. The second UPF can be deployed in a public network access area and is used to carry business access requests from the Internet or public 5G networks; the first UPF is deployed in a private network access area (5G dual-domain private network) and is used to carry business access requests from medical private network users. The system can intelligently select the first UPF or the second UPF for data access based on business policies and user identity authentication information, realize dynamic switching and shunting of access paths, and thus stably and securely access target business data in different network environments.

[0187] It should be noted that the first UPF can be one of the access points for accessing the first network environment, and the service traffic carried by the first UPF is finally introduced to the core resources such as the data layer in the first network environment; the second UPF can be one of the access points for accessing the second network environment, and the service traffic carried by the second UPF is introduced to the core resources such as the access layer in the second network environment.

[0188] When the user initiates a service access operation (such as calling patient image data or viewing test reports) on the access platform, the access layer generates a service access request based on the operation and sends it to the service layer. The service layer calls the target service module (such as the PACS image system access module or the LIS test system access module) matching the user type according to the service access request, and forwards the service access request to the service application layer.

[0189] The service application layer generates a data access request according to the service access request, and determines the target hospital data layer that needs to be accessed based on the target hospital identifier and the service data type. When the user needs to access non-hospital data, the system can obtain the target member information (such as the user's medical card number in the target hospital) across the hospital through authorization code, TOKEN token and other mechanisms, and encapsulate the target member information and the service data type into the data access request.

[0190] Then, the data access request can be securely transmitted to the data layer of the target hospital through the double one-way isolation exchange technology (including front-end machine, one-way optical gate, and rear-end machine) of the secure isolation area. After receiving the data access request, the data layer searches for the target service data (such as ultrasound video stream or test report data) from the corresponding target database, and encrypts it using the encryption mechanism provided by the basic layer (supporting SM1, SM4, SM2, SM3, and SM6 cryptographic algorithms).

[0191] In scenarios involving large-scale ultrasound images, the data acquisition module deployed in the data layer can capture real-time images of ultrasound equipment through HDMI, use Slice hard coding for low-latency video encoding, and efficiently transmit them to the data center through the common video transmission protocol. Then, the cloud processing module can work with the basic layer to perform real-time processing and AI analysis on the data using distributed computing nodes and DPU hardware acceleration.

[0192] Further, the encrypted target service data is transmitted to the network environment where the access layer is located through the one-way optical gate. After decryption in the access layer, the target service data is displayed to the user on the access platform, thereby realizing the user's safe and fast access to internal service data of medical institutions in an external network environment.

[0193] In the application scenario, by introducing an access path dynamic selection mechanism based on service policy and user identity authentication information in the access layer, intelligent switching and service distribution between the first UPF and the second UPF are realized, so that the system can maintain the stability and security of service access under different network environments; in cooperation with the target member information acquisition mechanism for cross-institution access, the data access consistency and service processing continuity of users among multiple medical institutions are ensured; in combination with the double one-way isolation exchange technology and the basic layer encryption mechanism, the confidentiality and integrity of service data in the cross-network transmission process are ensured; when high-bandwidth services such as large-scale ultrasound images are involved, low-latency video acquisition and efficient transmission are realized by using Slice hard coding and the pass-through video transmission protocol, and further combining the cloud distributed computing node and the AI processing capability of the DPU hardware acceleration, real-time processing and intelligent analysis of large data volume medical images are realized, thereby improving the overall access efficiency, data security and cross-institution business collaboration capability of the system.

[0194] It should be understood that, although each step in the flowchart of the accompanying drawings is displayed in sequence according to the direction of the arrow, these steps are not necessarily executed in sequence according to the direction of the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and they can be executed in other sequences. Moreover, at least part of the steps in the flowchart of the accompanying drawings can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or sub-steps or stages of other steps.

[0195] The following is an apparatus embodiment of the present application, which can be used to execute the data access method of the medical management system involved in the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the method embodiment of the data access method of the medical management system involved in the present application.

[0196] Please refer to Figure 11 In the embodiment of the present application, a data access apparatus 900 of a medical management system is provided, which can be deployed in a medical management system, the system including an access layer, a service layer, a business application layer and a data layer. The data layer is deployed in a first network environment, and the access layer is deployed in a second network environment isolated from the first network environment.

[0197] The apparatus 900 includes but is not limited to a service access module 910, a service calling module 930, a data access module 950, a data acquisition module 970 and a data display module 990.

[0198] The service access module 910 is configured to provide an access platform for a user at the access layer, and generate a service access request based on a service access operation of the user on the access platform, and send the service access request to the service layer; the service access request is used to indicate a target service requested to be accessed by the user.

[0199] The service calling module 930 is configured to call a target service module corresponding to the target service according to the service access request at the service layer, and forward the service access request to the service application layer according to the target service module.

[0200] The data access module 950 is configured to construct a data access request corresponding to the target service module according to the target service indicated by the service access request at the service application layer, and send the data access request to the data layer; the data access request is used to request the data layer to obtain target service data corresponding to the target service module.

[0201] The data access module 950 is configured to construct a data access request corresponding to the target service module according to the target service indicated by the service access request at the service application layer, and send the data access request to the data layer; the data access request is used to request the data layer to obtain target service data corresponding to the target service module.

[0202] The data display module 990 is configured to decrypt the encrypted target service data at the access layer, and display the decrypted target service data on the access platform, so that the user can view the target service data on the access platform.

[0203] It should be noted that the data access device of the medical management system provided in the above embodiment is only used as an example for the division of the above functional modules during data access of the medical management system. In actual applications, the above functions can be distributed to different functional modules according to needs, that is, the internal structure of the data access device of the medical management system is divided into different functional modules to complete all or part of the functions described above.

[0204] In addition, the data access device of the medical management system and the data access method of the medical management system provided in the above embodiment belong to the same concept, and the specific operation of each module has been described in detail in the method embodiment, which will not be repeated here.

[0205] Compared with the related art, the scheme realizes secure access and display of target business data across different network environments in a medical management system, builds a complete business access link among an access layer, a service layer, a business application layer and a data layer, and ensures that a business access request initiated by a user in an external network environment can be securely transmitted to the data layer of an internal network environment for processing after authentication, routing and data generation, and the encrypted target business data is unidirectionally returned to the access layer for decryption and display.

[0206] The above process realizes physical isolation and unidirectional secure transmission between the first network environment and the second network environment through the double unidirectional isolation exchange technology and the encryption and decryption mechanism, prevents internal data leakage or illegal access; at the same time, the decryption and display of data by the access layer enable the user to efficiently and conveniently obtain the required business information under the premise of ensuring data security and compliance, thereby improving the availability and access security of medical data.

[0207] The above only describes some embodiments of the present application, and it should be noted that, for those skilled in the art, without departing from the principles of the present application, some improvements and refinements can be made, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A data access method for a medical management system, characterized in that, The system includes an access layer, a service layer, a business application layer, a data layer, and a foundation layer; wherein the data layer is deployed in a first network environment, and the access layer is deployed in a second network environment isolated from the first network environment; the method includes: The access layer provides an access platform for users and generates a business access request based on the user's business access operation on the access platform, and sends the business access request to the service layer; the business access request is used to indicate the target business that the user requests to access. The service layer invokes the target business module corresponding to the target business according to the business access request, and forwards the business access request to the business application layer according to the target business module; In the business application layer, based on the target business indicated by the business access request, a data access request corresponding to the target business module is constructed, and the data access request is sent to the data layer; the data access request is used to request the data layer to obtain the target business data corresponding to the target business module; The data layer obtains target service data corresponding to the target service based on the data access request, encrypts the target service data, and returns the encrypted target service data to the access layer through dual unidirectional isolation switching technology; wherein, the dual unidirectional isolation switching technology is used to realize unidirectional secure transmission of service data between the first network environment and the second network environment; The encrypted target business data is decrypted at the access layer, and the decrypted target business data is displayed on the access platform, allowing the user to view the target business data on the access platform. The base layer obtains resource usage information of the access layer, service layer, business application layer, and data layer, and based on the resource usage information, allocates or adjusts data transmission allocation resources between the access layer, service layer, business application layer, and data layer. If the resource usage of the access layer, service layer, business application layer, or data layer exceeds a set threshold, the base layer reallocates resources to the access layer, service layer, business application layer, and / or data layer.

2. The method as described in claim 1, characterized in that, The step of invoking the target service module corresponding to the target service in the service layer according to the service access request includes: Determine the user type based on the service access request; Based on the user type, and according to the target service indicated by the service access request, the corresponding target service module is invoked.

3. The method as described in claim 1, characterized in that, The business access request includes the target hospital identifier and the business data type; The step of constructing a data access request corresponding to the target service module at the service application layer based on the target service indicated by the service access request, and sending the data access request to the data layer, includes: If the target hospital indicated by the target hospital identifier is not the hospital corresponding to the current access platform, then the target member information is obtained based on the parsing of the business access request; A data access request is generated based on the business data type indicated by the business access request and the target member information; The data layer access address of the target hospital is determined based on the target hospital identifier, and the data access request is sent to the data layer of the target hospital based on the data layer access address.

4. The method as described in claim 3, characterized in that, The process of obtaining the target member information based on the parsing of the business access request includes: Based on the business access request, an access credential is obtained, and in the case of hospital interconnection, the access credential is sent to the target access platform corresponding to the target hospital indicated by the target hospital identifier; By interacting with one or more application programming interfaces of the target access platform, based on the access credentials, the target user information of the user on the target access platform is obtained, and the target member information of the user on the target access platform is determined according to the target user information.

5. The method as described in claim 3, characterized in that, The step of obtaining target service data corresponding to the target service based on the data access request at the data layer includes: Based on the target member information in the data access request, search for the target database corresponding to the target member information in the data layer of the target hospital; Based on the business data type indicated by the data access request, the target business data is retrieved from the target database.

6. The method as described in claim 1, characterized in that, After the data layer obtains the target service data corresponding to the target service based on the data access request, the method further includes: The target business data is subjected to semantic-level data parsing processing to obtain a subset of target business data associated with the user context information, and the subset of target business data is returned to the access layer.

7. The method as described in claim 1, characterized in that, The dual unidirectional isolation switching technology includes a front-end unit, a back-end unit, and a unidirectional optical shutter; The step of returning the encrypted target service data to the access layer via dual one-way isolation exchange technology includes: The front-end machine is deployed in the first network environment where the data layer is located to receive encrypted target service data and transmit the target service data to the unidirectional optical shutter. The one-way optical shutter is set between the first network environment and the second network environment where the access layer is located. The one-way optical shutter only allows the target service data to be transmitted from the front-end machine to the back-end machine in a predetermined direction. The back-end unit is deployed in the second network environment where the access layer is located, and is used to receive the target service data transmitted via the unidirectional optical gate, and transmit the target service data to the access layer.

8. The method as described in claim 1, characterized in that, Sending the service access request to the service layer includes: A public communication domain and a secure communication domain are established in the communication network element through a 5G dual-domain private network. The secure communication domain is connected to the first network environment where the data layer is located, and the public communication domain is connected to the second network environment where the access layer is located. Based on user identity authentication rules, dual-domain identity authentication is performed on the user terminal corresponding to the access layer in the communication network element under the public communication domain and the secure communication domain. If the identity authentication is successful, and the service access request points to target service data in the first network environment, the service access request is forwarded to the data layer through the secure communication domain. If the service access request points to an external Internet resource, the service access request is forwarded to the external server through the public communication domain.

9. A medical management system, characterized in that, The system includes an access layer, a service layer, a business application layer, a data layer, and a foundation layer. The access layer is used to provide an access platform for users, and based on the user's business access operations on the access platform, generate a business access request and send the business access request to the service layer. The system receives encrypted target service data sent by the data layer, decrypts the encrypted target service data, and displays the decrypted target service data on the access platform, allowing the user to view the target service data on the access platform; the service access request is used to instruct the user to access the target service. The service layer is used to invoke the corresponding target business module according to the business access request, and forward the business access request to the business application layer according to the target business module. The business application layer is used to construct a data access request corresponding to the target business module according to the target business indicated by the business access request, and send the data access request to the data layer; The data access request is used to request the data layer to obtain target business data corresponding to the target business module; The data layer is used to receive the data access request, obtain the target service data corresponding to the target service based on the data access request, encrypt the target service data, and return the encrypted target service data to the access layer through dual one-way isolation exchange technology. The base layer is used to acquire resource usage information of the access layer, the service layer, the business application layer, and the data layer, and based on the resource usage information, allocate or adjust data transmission allocation resources between the access layer, the service layer, the business application layer, and the data layer. If the resource usage of the access layer, the service layer, the business application layer, or the data layer exceeds a set threshold, the base layer will reallocate resources to the access layer, the service layer, the business application layer, and / or the data layer. The data layer is deployed in a first network environment, and the access layer is deployed in a second network environment that is isolated from the first network environment. The dual unidirectional isolation switching technology is used to realize unidirectional secure transmission of business data between the first network environment and the second network environment.

Images