Biological medicine data management method and device and electronic equipment thereof

Abstract

The invention provides a biological medicine data management method and device and electronic equipment, and relates to the technical field of data management, and the method comprises the steps: obtaining initial biological medicine data; preprocessing the initial biological medicine data to obtain preprocessed biological medicine data in a unified format; based on the data type and the data size of the preprocessed biological medicine data, performing block processing on the preprocessed biological medicine data according to a preset data size, and generating data blocks and checksum thereof; encrypting the data block through an improved homomorphic encryption model to generate a ciphertext data block and a checksum thereof; and packaging the ciphertext data block and the checksum thereof, uploading the packaged ciphertext data block to a side chain storage node for storage, and storing meta-information of the ciphertext data block to a main chain storage node. According to the invention, the whole encryption of the data in the transmission, storage and calculation process is ensured, and the risk of data leakage is effectively prevented.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data management, in particular to a biomedical data management method, device and electronic equipment. BACKGROUND

[0002] With the vigorous development of the biomedical field, a large amount of highly sensitive and valuable data has been generated, covering key information such as genomic sequences, proteomics data, and clinical trial results. These data are not only valuable resources for in-depth exploration of medical research, but also important milestones for promoting the progress of personalized medicine. However, in the process of fully tapping the potential of these data, problems such as data security and privacy protection, efficient storage and sharing, and data integrity and traceability have become increasingly prominent, becoming a major challenge to the further development of the biomedical field.

[0003] Traditional centralized databases have inherent defects in data security and privacy protection, such as single point of failure risk and security vulnerabilities, making it difficult to effectively resist external attacks and data leaks, and unable to meet the strict requirements of biomedical data for high security and privacy. In addition, although existing homomorphic encryption algorithms can achieve encrypted computation of data to a certain extent, they are inefficient in processing complex and large-scale data sets in the biomedical field, severely restricting their widespread application in practical applications.

[0004] Although blockchain technology provides a new approach to data security and privacy protection with its decentralized and tamper-proof characteristics, it also faces storage and computing capacity bottlenecks when dealing with massive amounts of biomedical data. At the same time, the existing privacy protection mechanism of blockchain is not perfect, and it is difficult to meet the demand for high privacy protection of biomedical data.

[0005] More seriously, due to differences in laws and regulations and privacy protection policies of various countries, biomedical data faces many obstacles in the process of sharing across institutions and regions, seriously hindering the deepening of scientific research cooperation and clinical application. This not only limits the full use of data resources, but also hinders the pace of innovation in the biomedical field.

[0006] In addition, the current data storage and transmission mechanism lacks effective mechanisms to ensure data integrity and traceability. In the process of data transmission and storage, once data corruption or tampering occurs, it will be difficult to trace and recover, causing immeasurable losses to scientific research and clinical application.

[0007] Therefore, a biomedical data management method, device and electronic equipment are proposed. SUMMARY

[0008] The present specification provides a biological medicine data management method, device and electronic equipment, which ensures the whole encryption of data in the transmission, storage and calculation process, and effectively prevents the risk of data leakage.

[0009] The present specification provides a biological medicine data management method, device and electronic equipment, which ensures the whole encryption of data in the transmission, storage and calculation process, and effectively prevents the risk of data leakage.

[0010] Obtaining initial biological medicine data;

[0011] Pretreating the initial biological medicine data to obtain pretreated biological medicine data in a unified format;

[0012] Based on the data type and data size of the pretreated biological medicine data, the pretreated biological medicine data is processed according to the preset data size of the data type to generate data blocks and their checksums;

[0013] The data blocks are encrypted by an improved homomorphic encryption model to generate ciphertext data blocks and their checksums;

[0014] The ciphertext data blocks and their checksums are packed, the packed ciphertext data blocks are uploaded to a side chain storage node for storage, and the meta information of the ciphertext data blocks is stored in a main chain storage node.

[0015] Optionally, the initial biological medicine data is obtained by:

[0016] The initial biological medicine data is collected through a standardized data interface protocol and a data generation device; wherein the initial biological medicine data includes genomic sequence, proteomics data and medical image data.

[0017] Optionally, the data blocks are encrypted by an improved homomorphic encryption model to generate ciphertext data blocks and their checksums, comprising:

[0018] Setting a polynomial modulus initial value, selecting a key chain length according to data processing requirements, generating a decreasing modulus chain, and determining the last modulus based on the key chain length;

[0019] After each homomorphic multiplication operation, the ciphertext is relinearized by a fixed relinearization parameter matrix to reduce the redundant terms in the ciphertext.

[0020] Optionally, the data blocks are encrypted by an improved homomorphic encryption model to generate ciphertext data blocks and their checksums, further comprising:

[0021] Setting a plaintext space size, and adjusting the plaintext space size based on the data type of the data blocks;

[0022] Before each homomorphic addition operation, it is detected whether the current plaintext space size meets the operation requirements;

[0023] Before each homomorphic multiplication operation, the plaintext space size is enlarged ten times, and until the homomorphic multiplication operation is completed, the enlarged ten times plaintext space is reduced back to the initial plaintext space size.

[0024] Optionally, the method further comprises:

[0025] obtaining data request access permission verification sent by a data requester;

[0026] When the data request access permission verification is passed, the smart contract is authorized, and the hash value of the data package and the access credential are returned to the data requester;

[0027] The data requester downloads the packaged ciphertext data block corresponding to the hash value of the data package through the IPFS network based on the access credential.

[0028] Optionally, the method further comprises:

[0029] The data requester loads the packaged ciphertext data block through the improved homomorphic encryption model, and performs homomorphic operation on the loaded packaged ciphertext data block to obtain ciphertext.

[0030] Obtaining ciphertext sent by the data requester;

[0031] Decrypting the ciphertext through a private key to obtain plaintext, and returning the plaintext to the data requester through a secure channel.

[0032] Optionally, the method further comprises:

[0033] Real-time acquisition of data access conditions of the side chain storage node and the main chain storage node;

[0034] Judging whether the data access condition is abnormal based on the malicious behavior feature library;

[0035] When the malicious behavior feature library judges that the data access condition is abnormal, the access permission of the related account is immediately limited, and the communication between the suspicious node and the side chain storage node is cut off until the exception is removed, and the side chain storage node is restored through backup data and the hash value.

[0036] The present specification provides a biological medicine data management device, comprising:

[0037] An acquisition module is configured to acquire initial biological medicine data;

[0038] A preprocessing module is configured to preprocess the initial biological medicine data to obtain preprocessed biological medicine data in a unified format;

[0039] a block module, configured to perform block processing on the preprocessed biomedical data according to a preset data size of a data type of the preprocessed biomedical data based on a data type and a data size of the preprocessed biomedical data, to generate data blocks and checksums thereof;

[0040] an encryption module, configured to perform encryption on the data blocks by using an improved homomorphic encryption model to generate ciphertext data blocks and checksums thereof;

[0041] a packaging module, configured to package the ciphertext data blocks and the checksums thereof, upload the packaged ciphertext data blocks to a side chain storage node for storage, and store meta-information of the ciphertext data blocks to a main chain storage node.

[0042] Optionally, the acquisition module comprises:

[0043] The initial biomedical data is collected by connecting to a data generation device through a standardized data interface protocol, and the initial biomedical data comprises genomic sequences, proteomics data, and medical image data.

[0044] Optionally, the encryption module comprises:

[0045] An initial value of a polynomial modulus is set, a key chain length is selected according to a data processing requirement, a decreasing modulus chain is generated, and a last modulus is determined based on the key chain length.

[0046] After each homomorphic multiplication operation, relinearization processing is performed on the ciphertext by using a fixed relinearization parameter matrix, so as to reduce redundant terms in the ciphertext.

[0047] Optionally, the encryption module further comprises:

[0048] A plaintext space size is set, and the plaintext space size is adjusted based on a data type of the data blocks.

[0049] Before each homomorphic addition operation, it is detected whether a current plaintext space size meets an operation requirement.

[0050] Before each homomorphic multiplication operation, the plaintext space size is enlarged by ten times until the homomorphic multiplication operation is completed, and the plaintext space size enlarged by ten times is reduced back to an initial plaintext space size.

[0051] Optionally, the method further comprises:

[0052] A data request access permission verification sent by a data requester is acquired.

[0053] When the data request access permission verification is passed, an intelligent contract is authorized, and a hash value of a data package and an access credential are returned to the data requester.

[0054] The data requester downloads the packaged ciphertext data block corresponding to the hash value of the data packet based on the access credential through the IPFS network.

[0055] Optionally, the method further comprises:

[0056] The data requester loads the packaged ciphertext data block through the improved homomorphic encryption model, and performs homomorphic operation on the loaded packaged ciphertext data block to obtain ciphertext.

[0057] The ciphertext sent by the data requester is obtained.

[0058] The ciphertext is decrypted through a private key to obtain plaintext, and the plaintext is returned to the data requester through a secure channel.

[0059] Optionally, the method further comprises:

[0060] The data access situation of the side chain storage node and the main chain storage node is obtained in real time.

[0061] It is judged whether the data access situation is abnormal based on the malicious behavior feature library.

[0062] When the malicious behavior feature library judges that the data access situation is abnormal, the access permission of the related account is immediately restricted, and the communication between the suspicious node and the side chain storage node is cut off until the exception is resolved, and the side chain storage node is restored through backup data and the hash value.

[0063] The specification also provides an electronic device, wherein the electronic device comprises:

[0064] a processor; and

[0065] a memory storing computer-executable instructions that, when executed, cause the processor to perform any of the above methods.

[0066] The specification also provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs that, when executed by a processor, implement any of the above methods.

[0067] In the present application, in terms of data security, by combining the advanced CKKS homomorphic encryption algorithm with the hierarchical blockchain architecture, the encryption of data in the whole process of transmission, storage and calculation is ensured, and the risk of data leakage is effectively prevented. Using the homomorphic encryption algorithm, data can be directly calculated in the encrypted state, which avoids the security risk in the decryption process, and through the introduction of the smart contract, efficient sharing of data is realized. The design of the hierarchical blockchain architecture stores large-capacity ciphertext data in the side chain, and stores metadata and permission policies in the main chain, effectively reducing the burden of the main chain and improving the scalability and data processing efficiency of the system. Through means such as polynomial modulus adjustment, key chain configuration and dynamic plaintext space adjustment, this method realizes fine control of data precision and calculation depth, and meets the diversified data processing needs. BRIEF DESCRIPTION OF DRAWINGS

[0068] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0069] Figure 1 A principle diagram of a biological medicine data management method provided by the embodiments of the present application is shown in the figure.

[0070] Figure 2 A structure diagram of a biological medicine data management device provided by the embodiments of the present application is shown in the figure.

[0071] Figure 3 A structure diagram of an electronic device provided by the embodiments of the present application is shown in the figure.

[0072] Figure 4 A principle diagram of a computer readable medium provided by the embodiments of the present application is shown in the figure. DETAILED DESCRIPTION

[0073] The following description is used to disclose the present application so that those skilled in the art can implement the present application. The preferred embodiments in the following description are only as examples, and other obvious modifications can be made by those skilled in the art. The basic principles of the present application defined in the following description can be applied to other embodiments, modifications, improvements, equivalents and other technical solutions without departing from the spirit and scope of the present application.

[0074] The following description is used to disclose the present application so that those skilled in the art can implement the present application. The preferred embodiments in the following description are only as examples, and other obvious modifications can be made by those skilled in the art. The basic principles of the present application defined in the following description can be applied to other embodiments, modifications, improvements, equivalents and other technical solutions without departing from the spirit and scope of the present application. Figures 1-4Exemplary embodiments of the present application are described more fully hereinafter with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the inventive concept to those skilled in the art. Like reference numerals refer to like elements throughout the specification. Repetitive descriptions of like elements will be omitted for sake of brevity.

[0075] In the case of a certain specific embodiment, the features, structures, characteristics or other details described in the description are not excluded from being combined in one or more other embodiments in a suitable manner.

[0076] In the description of the specific embodiments, the features, structures, characteristics or other details described in the description are to enable those skilled in the art to fully understand the embodiments. However, it is not excluded that one or more of the specific features, structures, characteristics or other details can not be practiced by those skilled in the art without the specific features, structures, characteristics or other details.

[0077] The flowcharts shown in the drawings are only exemplary illustrations, and do not necessarily include all contents and operations / steps, nor are they necessarily executed in the order described. For example, some operations / steps can be further decomposed, and some operations / steps can be combined or partially combined, so the actual execution order can be changed according to the actual situation.

[0078] The block diagrams shown in the drawings are only functional entities, and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0079] The term "and / or" or "and / or" includes all combinations of any one or more of the associated listed items.

[0080] Figure 1 A schematic diagram of the principle of a biological and pharmaceutical data management method provided for the embodiments of the present specification. The method can include:

[0081] S110: obtaining initial biological and pharmaceutical data;

[0082] Optionally, the S110 includes:

[0083] Through a standardized data interface protocol, the initial biological and pharmaceutical data is collected from a data generation device; wherein the initial biological and pharmaceutical data includes genomic sequence, proteomics data, medical image data.

[0084] In the detailed description of the present specification, by adopting standardized interface protocols such as HL7 and FHIR, effective docking with data generation devices such as gene sequencers and mass spectrometers can be achieved, and various biomedical information including genomic sequences, proteomics data and medical image data can be collected.

[0085] S120: preprocessing the initial biomedical data to obtain preprocessed biomedical data in a unified format;

[0086] In the detailed description of the present specification, preprocessing the initial biomedical data includes using mean filling and other methods for missing value processing, using standard deviation method for outlier detection, and performing format unification processing on the data to ensure that data in different formats can be converted into a unified internal format such as JSON, thereby facilitating subsequent data analysis and application.

[0087] S130: based on the data type and data size of the preprocessed biomedical data, the preprocessed biomedical data is processed according to the preset data size of the data type to generate data blocks and their checksums;

[0088] In the detailed description of the present specification, specifically, the preprocessed biomedical data is divided into multiple parts of 1MB per block based on the data type and size, and SHA-256 checksums are generated for each data block. This step aims to ensure accurate data integrity verification in the subsequent process.

[0089] S140: encrypting the data blocks through an improved homomorphic encryption model to generate ciphertext data blocks and their checksums;

[0090] Optionally, the S140 comprises:

[0091] Setting the initial value of the polynomial modulus, selecting the key chain length according to the data processing requirements, generating a decreasing modulus chain, and determining the last modulus based on the key chain length;

[0092] After each homomorphic multiplication operation, the ciphertext is relinearized by a fixed relinearization parameter matrix to reduce the redundant terms in the ciphertext.

[0093] In the detailed description of the present specification, specifically, the initial value of the polynomial modulus is set to q = 2 60 , and the modulus is used to initialize the system. This setting ensures that the initial ciphertext has sufficient noise tolerance, providing necessary support for early data encryption operations and simple operations.

[0094] To support multiple homomorphic operations, a key chain with length L = 8 is generated. After each homomorphic operation, the noise in the ciphertext is reduced by a modulus reduction operation. The polynomial moduli in the modulus chain decrease step by step, and are set as follows:

[0095] q_0 = 2 is used after the initial operation 60 , q_1 = 2 after the first operation 55 , q_2 = 2 after the second operation 50 , q_3 = 2 after the third operation 45 , and so on, until q_7 = 2 is used after the seventh operation 20 . Such a design ensures that the ciphertext can maintain sufficient noise tolerance throughout the operation process to support continuous homomorphic operations.

[0096] The length of the key chain is selected according to different types of computing tasks. For the alignment operation of genomic data, a longer key chain L = 10 is selected for this complex computing requirement to support up to 10 consecutive homomorphic multiplication operations, which is particularly important for tasks involving complex matrix operations and statistical analysis. For simple statistical analysis tasks, such as mean calculation, a shorter key chain L = 5 is used, which is sufficient for up to 5 addition operations and one multiplication operation, thereby improving operation efficiency while ensuring security.

[0097] After each homomorphic multiplication is performed, relinearization processing is immediately performed on the ciphertext. This step aims to eliminate redundant terms in the ciphertext and prevent them from accumulating as the computation depth increases. To ensure the efficiency and effectiveness of the relinearization processing, a fixed relinearization parameter matrix is used. This not only helps to control the increase in storage space of the processed ciphertext as the computation depth increases, but also effectively suppresses the rise in noise level, providing a stable foundation for subsequent ciphertext operations.

[0098] Optionally, the S140 further includes:

[0099] Setting the plaintext space size, adjusting the plaintext space size based on the data type of the data block;

[0100] Before each homomorphic addition operation, detecting whether the current plaintext space size meets the operation requirement;

[0101] Before each homomorphic multiplication operation, the plaintext space size is enlarged by ten times until the homomorphic multiplication operation is completed, and the enlarged plaintext space size is reduced back to the initial plaintext space size.

[0102] In the detailed description of the present specification, when processing genomic data, the initial plaintext space size is adapted to different data types and operation requirements. By default, the plaintext space size is set to Δ = 240 This setting can accurately represent the decimal in most genomic data (such as DNA sequence data), while ensuring that the precision is not lost during the operation. However, adaptive adjustment is made for different types of data. When the data type is gene sequence (such as sequence composed of ATCG), considering the particularity of these data, the plaintext space size is adjusted to Δ = 2 20 When the data type is protein structure data (containing three-dimensional coordinates), the plaintext space size is adjusted to Δ = 2 60 , to ensure the decimal precision of the spatial coordinates

[0103] Before performing the homomorphic addition operation, it is detected whether the current plaintext space size meets the operation requirements. If the current noise level is low (such as less than 60%), the plaintext space size is kept unchanged, such as keeping Δ = 2 20 ; if the current noise level is high (such as higher than 60%), the plaintext space is automatically adjusted to Δ = 2 45 to increase the tolerance to noise, thereby ensuring the accuracy and stability of the operation.

[0104] Before performing the homomorphic multiplication operation, the plaintext space size is adjusted from the current value to Δ = 2 50 , because the multiplication operation will significantly increase the noise. Specifically, when performing multiplication calculation of protein three-dimensional structure, Δ is expanded from 2 40 to 2 50 , to ensure the precision during the operation. After the operation is completed, the plaintext space is reduced back to Δ = 2 40 to reduce the influence of noise.

[0105] According to the data block size, the configuration of the plaintext space is determined. Specifically, if the data block size is 1 MB, the plaintext space is set to Δ = 2 40 to ensure that each data element can be accurately represented. If the data block size is 0.5 MB, the plaintext space is set to Δ = 2 35 to reduce the storage space after encryption and improve the transmission efficiency.

[0106] During each homomorphic operation, the noise level of the ciphertext and the actual representation range of the plaintext are monitored in real time. When the noise level exceeds 70%, the automatic adjustment process is triggered, and the plaintext space size is doubled (such as from Δ = 2 40 to Δ = 2 41 ). If the noise level is less than 30%, the plaintext space size is gradually reduced (such as from Δ = 2 40 to Δ = 2 39 ) to optimize the calculation efficiency.

[0107] S150: package the ciphertext data block and its checksum, upload the packaged ciphertext data block to the sidechain storage node for storage, and store the metadata of the ciphertext data block to the main chain storage node.

[0108] In the detailed description of the present specification, the ciphertext data block is uploaded to the sidechain storage node for distributed storage using the IPFS technology, and a unique content address (hash value) is generated for each data packet. The main chain is responsible for storing the metadata of the sidechain ciphertext data, including the content address (hash value), data identifier, and permission policy. Through the data synchronization and state update mechanism based on the cross-chain communication protocol, the main chain and the sidechain can maintain data consistency and ledger synchronization. In addition, the Merkle tree structure is used to verify the sidechain data to ensure the integrity and traceability of the data.

[0109] Optionally, it further comprises:

[0110] obtaining the data request access permission verification sent by the data requester;

[0111] when the data request access permission verification is passed, authorizing through the smart contract, and returning the hash value of the data packet and the access credential to the data requester;

[0112] the data requester downloads the packaged ciphertext data block corresponding to the hash value of the data packet based on the access credential through the IPFS network.

[0113] In the detailed description of the present specification, the data requester sets the data access permission through the client application using the RBAC (Role-Based Access Control) and ABAC (Attribute-Based Access Control) models, and deploys these permission policies in the form of a smart contract on the main chain. When the data requester submits an access request, the system will perform multi-factor identity authentication, including password authentication, biometric authentication, etc. The smart contract then automatically evaluates the access permission of the requester according to the pre-set permission policy, and once the verification is passed, it will return the content address (hash value) of the data packet and the access credential. The data requester can download the ciphertext data packet from the sidechain through the IPFS network based on these credentials. The entire transmission process uses TLS1.3 protocol encryption to ensure the security of the data during transmission.

[0114] Optionally, it further comprises:

[0115] the data requester loads the packaged ciphertext data block through the improved homomorphic encryption model, and performs homomorphic operation on the loaded packaged ciphertext data block to obtain ciphertext;

[0116] obtaining the ciphertext sent by the data requester;

[0117] The ciphertext is decrypted by the private key to obtain plaintext, and the plaintext is returned to the data requester through a secure channel.

[0118] In the detailed description of the present specification, the data requester builds a homomorphic computing environment locally or in the cloud, loads the CKKS homomorphic encryption library and necessary parameters, and then imports the downloaded ciphertext data. In the computing environment, the data requester selects appropriate algorithms (such as gene sequence alignment or protein analysis) to perform homomorphic operations, and the operation results are generated in the form of ciphertext. Then, the data requester submits the ciphertext results to the data owner or the designated decryption party. The decryption party decrypts the ciphertext results using the private key in a trusted execution environment (such as TEE), restores them to plaintext results, and returns the plaintext results to the data requester through a secure channel.

[0119] A pair of 4096-bit length public and private keys is generated for each data provider, where the public key is used for encryption and the private key is used for decryption to ensure encryption strength. The private key is securely stored in a hardware security module (HSM) that provides physical-level tamper protection to ensure the security of the key. In addition, the system also supports a multi-layer key chain mechanism, which can flexibly manage multiple encryption or different computing stage keys to ensure data security at each stage.

[0120] Optionally, it also includes:

[0121] Real-time acquisition of data access conditions of the sidechain storage node and the mainchain storage node;

[0122] Judging whether the data access condition is abnormal based on the malicious behavior feature library;

[0123] When the malicious behavior feature library determines that the data access condition is abnormal, the access rights of the related account are immediately restricted, and the communication between the suspicious node and the sidechain storage node is cut off until the abnormality is resolved, and the sidechain storage node is restored by backup data and the hash value.

[0124] In the detailed description of the present specification, the data requester builds a homomorphic computing environment locally or in the cloud, loads the CKKS homomorphic encryption library and necessary parameters, and then imports the downloaded ciphertext data. In the computing environment, the data requester selects appropriate algorithms (such as gene sequence alignment or protein analysis) to perform homomorphic operations, and the operation results are generated in the form of ciphertext. Then, the data requester submits the ciphertext results to the data owner or the designated decryption party. The decryption party decrypts the ciphertext results using the private key in a trusted execution environment (such as TEE), restores them to plaintext results, and returns the plaintext results to the data requester through a secure channel.

[0125] In the present application, in terms of data security, by combining the advanced CKKS homomorphic encryption algorithm with the layered blockchain architecture, the encryption of data in the whole process of transmission, storage and calculation is ensured, and the risk of data leakage is effectively prevented. Using the homomorphic encryption algorithm, data can be directly calculated in an encrypted state, which avoids the security risks in the decryption process, and through the introduction of smart contracts, efficient sharing of data is realized. The design of the layered blockchain architecture stores large-capacity ciphertext data in the side chain, while the metadata and permission policies are stored in the main chain, effectively reducing the burden of the main chain and improving the scalability and data processing efficiency of the system. Through means such as polynomial modulus adjustment, key chain configuration, and dynamic plaintext space adjustment, this method realizes fine control of data precision and calculation depth, meeting diverse data processing needs.

[0126] Figure 2 A principle schematic diagram of a biological and pharmaceutical data management device provided by an embodiment of the present application, which can include:

[0127] The acquisition module 10 is configured to acquire initial biological and pharmaceutical data.

[0128] The preprocessing module 20 is configured to preprocess the initial biological and pharmaceutical data to obtain preprocessed biological and pharmaceutical data in a unified format.

[0129] The block division module 30 is configured to divide the preprocessed biological and pharmaceutical data into blocks according to a preset data size of the data type of the preprocessed biological and pharmaceutical data, to generate data blocks and their checksums.

[0130] The encryption module 40 is configured to encrypt the data blocks by using an improved homomorphic encryption model to generate ciphertext data blocks and their checksums.

[0131] The packing module 50 is configured to pack the ciphertext data blocks and their checksums, upload the packed ciphertext data blocks to a side chain storage node for storage, and store the metadata of the ciphertext data blocks to a main chain storage node.

[0132] Optionally, the acquisition module 10 includes:

[0133] The initial biological and pharmaceutical data includes genomic sequences, proteomics data, and medical image data.

[0134] Optionally, the encryption module 40 includes:

[0135] An initial value of a polynomial modulus is set, a key chain length is selected according to data processing requirements, a decreasing modulus chain is generated, and the last modulus is determined based on the key chain length.

[0136] After each homomorphic multiplication operation, the ciphertext is relinearized by a fixed relinearization parameter matrix, thereby reducing the redundant terms in the ciphertext.

[0137] Optionally, the encryption module 40 further comprises:

[0138] Setting the size of the plaintext space, adjusting the size of the plaintext space based on the data type of the data block;

[0139] Before each homomorphic addition operation, detect whether the current plaintext space size meets the operation requirement;

[0140] Before each homomorphic multiplication operation, enlarge the plaintext space size by ten times until the homomorphic multiplication operation is completed, and reduce the enlarged plaintext space size by ten times to the initial plaintext space size.

[0141] Optionally, it further comprises:

[0142] Obtain the data request access permission verification sent by the data requester;

[0143] When the data request access permission verification is passed, authorize through the smart contract, and return the hash value of the data package and the access credential to the data requester;

[0144] The data requester downloads the packaged ciphertext data block corresponding to the hash value of the data package through the IPFS network based on the access credential.

[0145] Optionally, it further comprises:

[0146] The data requester loads the packaged ciphertext data block through the improved homomorphic encryption model, and performs homomorphic operation on the loaded packaged ciphertext data block to obtain ciphertext;

[0147] Obtain the ciphertext sent by the data requester;

[0148] Decrypt the ciphertext through the private key to obtain the plaintext, and return the plaintext to the data requester through the secure channel.

[0149] Optionally, it further comprises:

[0150] Real-time acquisition of data access of the side chain storage node and the main chain storage node;

[0151] Determine whether the data access is abnormal based on the malicious behavior feature library;

[0152] When the malicious behavior feature library judges that the data access situation is abnormal, the access permission of the related account is immediately limited, and the communication between the suspicious node and the side chain storage node is cut off until the exception is removed, and the side chain storage node is restored by backing up data and the hash value.

[0153] The functions of the device of the embodiments of the application have been described in the method embodiments described above, and therefore, details not described in the description of the present embodiments can be referred to the relevant description in the foregoing embodiments, which will not be repeated here.

[0154] Based on the same inventive concept, the embodiments of the present specification also provide an electronic device.

[0155] The electronic device embodiments of the present application are described below, which can be regarded as a specific physical implementation of the above-mentioned method and device embodiments of the present application. For the details described in the electronic device embodiments of the present application, it should be regarded as a supplement to the above-mentioned method or device embodiments; for the details not disclosed in the electronic device embodiments of the present application, it can be realized by referring to the above-mentioned method or device embodiments.

[0156] Figure 3 A structural schematic diagram of an electronic device provided by the embodiments of the present specification is shown. The electronic device 300 according to the embodiments of the present application is described below with reference to Figure 3 Figure 3 The electronic device 300 shown is only an example, and should not bring any limitation to the functions and use range of the embodiments of the present application.

[0157] As Figure 3 shown, the electronic device 300 is in the form of a general computing device. The components of the electronic device 300 can include, but are not limited to, at least one processing unit 310, at least one storage unit 320, a bus 330 connecting different system components including the storage unit 320 and the processing unit 310, a display unit 340, etc.

[0158] The storage unit stores program codes, which can be executed by the processing unit 310, so that the processing unit 310 performs the steps according to various exemplary embodiments of the present application described in the processing method part of the present specification. For example, the processing unit 310 can perform the steps as Figure 1 shown.

[0159] The storage unit 320 can include a readable medium in the form of a volatile storage unit, such as a random access memory (RAM) 3201 and / or a cache memory unit 3202, and can further include a read-only memory (ROM) 3203.

[0160] ​The storage unit 320 can also include a program / utility 3204 having a set (at least one) of program modules 3205, including an operating system, one or more application programs, other program modules, and program data, each of which

[0161] The bus 330 can represent one or more of several types of bus structures, including a storage unit bus or bus controller, a peripheral bus, a graphics acceleration port, a processing unit bus, or a local bus using any of a variety of bus architectures.

[0162] The electronic device 300 can also communicate with one or more external devices 400, such as a keyboard or a pointing device, a Bluetooth device, etc.; other devices that enable a user to interact with the electronic device 300; and / or one or more devices that enable the electronic device 300 to communicate with one or more other computing devices. Such communication can occur via an input / output (I / O) interface 350. Still yet, the electronic device 300 can communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network, such as the Internet, via a network adapter 360. The network adapter 360 can communicate with the other components of the electronic device 300 via the bus 330. It should be appreciated that the Figure 3 Other hardware and / or software modules that can be used in conjunction with the electronic device 300, such as microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc. are not shown in FIG. 3, but can be incorporated into the electronic device 300.

[0163] From the above description of embodiments of the present application, it is readily apparent to those skilled in the art that the exemplary embodiments described herein can be realized by software as well as by hardware. The technical solutions according to the embodiments of the present application can be embodied in the form of a software product. The software product can be stored in a computer readable storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.) or a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to perform the above-described methods according to the present application. When the computer program is executed by a data processing device, the computer readable medium enables the data processing device to implement the above-described methods of the present application, i.e., the method shown in FIG. 4. Figure 1

[0164] Figure 4 A schematic diagram of a computer readable medium according to an embodiment of the present application.

[0165] Implementation​Figure 1 A computer program product of the method can be stored on one or more computer readable media. The computer readable media can be a readable signal medium or a readable storage medium. The readable storage medium can, for example, be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0166] The computer readable storage medium can include a data signal transported over a carrier wave and can be baseband or propagated along with carriers. The propagated carrier can take any suitable form, including but not limited to electro-magnetic, optical, or any suitable combination thereof. A computer readable medium containing a computer readable program code can be any medium that can store program codes of instructions for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0167] The program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, etc., and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the audience computing device, partly on the audience computing device, as a stand-alone software package, partly on the audience computing device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the audience computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider.

[0168] In light of the above, the present application can be implemented in hardware, or implemented in software modules running on one or more processors, or implemented in a combination of the two. Those skilled in the art should understand that some or all of the functions of some or all of the components according to the embodiments of the present application can be implemented in practice using a general-purpose data processing device such as a microprocessor or a digital signal processor (DSP). The present application can also be implemented as a device or apparatus program (for example, a computer program and a computer program product) for performing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer readable medium or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0169] The above-described specific embodiments further illustrate the purposes, technical solutions and beneficial effects of the present application. It should be understood that the present application is not inherently related to any specific computer, virtual device or electronic device, and various general-purpose devices can implement the present application. The above-described specific embodiments are merely examples of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0170] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be mutually referred to. Each of the embodiments mainly describes the differences from other embodiments.

[0171] The above-described specific embodiments are merely examples of the present application and are not intended to limit the present application. Those skilled in the art can make various changes and modifications to the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A biomedical data management method, characterized in that, include: Acquire initial biomedical data; The initial biomedical data is preprocessed to obtain preprocessed biomedical data in a unified format; Based on the data type and data size of the preprocessed biomedical data, the preprocessed biomedical data is divided into blocks according to the preset data size of the data type, and data blocks and their checksums are generated. The data block is encrypted using an improved homomorphic encryption model to generate a ciphertext data block and its checksum; The encrypted data block and its checksum are packaged together, the packaged encrypted data block is uploaded to the sidechain storage node for storage, and the metadata of the encrypted data block is stored in the main chain storage node.

2. The biomedical data management method as described in claim 1, characterized in that, The acquisition of initial biomedical data includes: Initial biomedical data is collected by interfacing with data generation equipment through a standardized data interface protocol; wherein, the initial biomedical data includes genome sequences, proteomics data, and medical imaging data.

3. The biomedical data management method as described in claim 2, wherein encrypting the data block using an improved homomorphic encryption model to generate a ciphertext data block and its checksum includes: Set an initial value for the polynomial modulus, select the key chain length according to the data processing requirements, generate a decreasing modulus chain, and determine the last modulus based on the key chain length; After each homomorphic multiplication operation, the ciphertext is re-linearized using a fixed relinearization parameter matrix to reduce redundant terms in the ciphertext.

4. The biomedical data management method as described in claim 3, characterized in that, The step of encrypting the data block using an improved homomorphic encryption model to generate a ciphertext data block and its checksum further includes: Set the plaintext space size, and adjust the plaintext space size based on the data type of the data block; Before each homomorphic addition operation, check whether the current plaintext space size meets the operation requirements; Before each homomorphic multiplication operation, the plaintext space size is increased by ten times until the homomorphic multiplication operation is completed, and then the increased plaintext space size is reduced back to the initial plaintext space size.

5. The biomedical data management method as described in claim 4, characterized in that, Also includes: Obtain access permission verification for the data request sent by the data requester; When the data request access permission verification is successful, authorization is granted through a smart contract, and the hash value of the data packet and access credentials are returned to the data requester. The data requester downloads the packaged ciphertext data block corresponding to the hash value of the data packet through the IPFS network based on the access credentials.

6. The biomedical data management method as described in claim 5, characterized in that, Also includes: The data requester loads the packaged ciphertext data block using an improved homomorphic encryption model and performs homomorphic operations on the loaded packaged ciphertext data block to obtain ciphertext. Obtain the ciphertext sent by the data requester; The ciphertext is decrypted using the private key to obtain the plaintext, which is then returned to the data requester via a secure channel.

7. The biomedical data management method as described in claim 6, characterized in that, Also includes: Real-time acquisition of data access status of the sidechain storage node and the main chain storage node; Based on the malicious behavior feature database, determine whether there are any abnormalities in the data access situation; When the malicious behavior signature database determines that there is an anomaly in the data access situation, it immediately restricts the access permissions of the relevant accounts and cuts off the communication between the suspicious node and the sidechain storage node until the anomaly is resolved. Then, it restores the operation of the sidechain storage node by backing up the data and the hash value.

8. A biomedical data management device, characterized in that, include: The acquisition module is used to acquire initial biomedical data; The preprocessing module is used to preprocess the initial biomedical data to obtain preprocessed biomedical data in a unified format. The block segmentation module is used to segment the preprocessed biomedical data into blocks according to the preset data size of the data type, based on the data type and data size of the preprocessed biomedical data, and generate data blocks and their checksums. An encryption module is used to encrypt the data block using an improved homomorphic encryption model to generate a ciphertext data block and its checksum; The packaging module is used to package the encrypted data block and its checksum, upload the packaged encrypted data block to the sidechain storage node for storage, and store the metadata of the encrypted data block to the main chain storage node.

9. An electronic device, wherein, The electronic device includes: Processor; and, A memory storing computer-executable instructions, which, when executed, cause the processor to perform the method according to any one of claims 1-7.

10. A computer-readable storage medium, wherein, The computer-readable storage medium stores one or more programs that, when executed by a processor, implement the method of any one of claims 1-7.

Images