A blockchain-based medical record security optimization query system

Abstract

The application relates to the technical field of data security, in particular to a medical record security optimization query system based on a block chain, which comprises a permission verification module, a data integrity verification module, an access path optimization module, a log auditing module and a data traceability tracking module.In the application, a dynamic permission mapping is generated through an access request and an identity information association key structure, real-time matching of permissions and instruction parameters is realized, over-reach access under static authorization is avoided, a credibility evaluation model is constructed in combination with data structure characteristics, data integrity identification capability is improved, path scheduling logic is generated based on node access frequency, hop distance and time period, query efficiency and response accuracy are improved, abnormal behavior identification and audit data generation are realized in combination with operation behavior and overlapping period comparison, further traceability features in the intersection of data flow paths and time sequences are extracted, and security guarantee and trust support capability in the whole access process are enhanced.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a blockchain-based medical record security optimization query system. Background Technology

[0002] Data security technology involves protecting the integrity, confidentiality, and controllability of information during storage, transmission, and access. This technology includes encryption mechanisms, access control, authentication, data traceability, information hiding, and anti-tampering technologies. It is widely used in data-sensitive scenarios such as healthcare and industrial control, especially in high-risk environments where technical means are used to ensure the trustworthiness and attack resistance of data throughout its lifecycle. Building trust mechanisms and auditing capabilities in data circulation has become an important research direction in this field. Traditional medical record security optimization query systems refer to the basic query platform used for the secure storage and authorized access of personal medical records in the process of medical information management. The system uses a centralized database, username / password-based identity verification methods, permission level division mechanisms, a log recording system, and rule-based access control policies to manage and schedule user access to record content. It also relies on the database's own backup and mirroring mechanisms for data fault tolerance and recovery. However, in practical applications, this approach suffers from problems such as attack risks and insufficient operational trust due to its centralized structure.

[0003] Existing technologies, based on centralized databases combined with fixed permission divisions and rule-based control strategies, are prone to problems such as ambiguous permission identification and delayed response of control rules under conditions of concurrent requests from multiple roles or high-frequency access. When relying on static identity recognition and log recording for behavior auditing, it is difficult to effectively capture fine-grained abnormal operations, especially when the behavior patterns are similar but the operation intentions are significantly different, which can easily lead to missing or misjudged anomalies. In addition, the system's data recovery and fault tolerance capabilities depend on the database backup mechanism. Once unauthorized access or attacks on intermediate nodes occur, data integrity is difficult to trace, leading to a break in the audit accountability chain. In scenarios with frequent interaction of medical records and high-frequency updates of sensitive information, this seriously affects the trustworthiness and controllability of the information system. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a blockchain-based medical record security optimization query system.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: A blockchain-based medical record security optimization query system includes:

[0006] The permission verification module obtains the user's access request and identity information, parses the key association structure, extracts the user's identity hash value and key mapping label, identifies the corresponding permission level index and compares the access request instruction parameters, marks the request corresponding permission label and matches the authorization level, and generates a dynamic permission mapping table.

[0007] The data integrity verification module extracts the signature field of the storage node and the current data based on the dynamic permission mapping table, identifies the structural feature code, compares the consistency between the tag and the corresponding node in the linked list, and generates a data credibility assessment model.

[0008] The access path optimization module identifies high-frequency access nodes and low-frequency archive nodes based on the data credibility assessment model, counts access time periods and request source distribution frequencies, extracts hop distances between nodes, analyzes the changes in node connection directions and hop intervals, and generates a path priority scheduling table for query requests.

[0009] The log auditing module calls the path priority scheduling table of the query request, collects the time interval and operation type of access behavior, filters the overlapping areas of access anomaly frequency and operation time period, compares the offset degree of the original operation record with the current behavior feature mark, and generates the archive security audit data table.

[0010] As a further embodiment of the present invention, the dynamic permission mapping table includes permission level identifiers, key segmentation structure, and timestamp sequence distribution; the data credibility assessment model includes signature consistency score, verification value deviation range, and original signature distribution map; the path priority scheduling table for query requests includes a list of high-frequency nodes, archive node distribution weight, and access frequency difference matrix; and the archive security audit data table includes abnormal behavior markers, operation type statistics, and audit result classification.

[0011] As a further aspect of the present invention, the permission verification module includes:

[0012] The identity resolution submodule obtains the user's access request and identity information, extracts the key segment identifier value in the key segment structure, locates the identity field index position corresponding to the segment, filters the key segment combination field with associated tags, compares the identity parameters in the access request with the key combination information in the mapping table, parses the key association relationship, and generates the key level mapping quantity.

[0013] The timestamp correction submodule extracts the timestamp of the access request based on the key level mapping, extracts the field index corresponding to the timestamp in the key level, identifies the offset difference between the access request timestamp and the key time field, filters out time period labels that exceed the error threshold and performs data replacement correction, corrects the time deviation, and generates a time synchronization factor.

[0014] The permission mapping generation submodule, based on the time synchronization factor, combines the key level and timestamp sequence, reads the permission tag index value corresponding to the synchronization factor, extracts the access control field content corresponding to the permission level, locates the key access behavior identifier item in the timestamp sequence, merges the permission index results corresponding to the key level and behavior tag, assigns permission level tags, and generates a dynamic permission mapping table.

[0015] As a further aspect of the present invention, the data integrity verification module includes:

[0016] The signature extraction submodule extracts the encrypted signature field of the file storage node based on the dynamic permission mapping table, locates the signature identifier segment in the storage node and extracts the corresponding value, reads the field position index in the signature structure and marks the field source, counts the frequency of signature field occurrence and divides the signature structure hierarchy, identifies signature distribution characteristics, and generates a signature sequence set.

[0017] The consistency verification submodule calls the signature sequence set to verify the consistency of the current archive data, extracts the signature field corresponding to the data segment to be verified, reads the comparison sequence between the original data block and the signature structure, calculates the offset fusion difference value, compares the signature sequence in the original record, and generates the verification value deviation.

[0018] The credibility assessment submodule analyzes the signature consistency score based on the verification value deviation, extracts the original signature node index table and the corresponding score value range, filters the key field positions and score mutation nodes, and generates a data credibility assessment model through the original signature distribution.

[0019] As a further aspect of the present invention, the access path optimization module includes:

[0020] The node distribution analysis submodule extracts the distribution characteristics of high-frequency access nodes and low-frequency archive nodes based on the data credibility assessment model, marks the access tags of nodes and extracts the corresponding access counts, extracts the physical location information of nodes, identifies the storage density distribution and access hotspot areas among nodes, and generates a node distribution difference quantity.

[0021] The frequency difference calculation submodule calls the node distribution difference quantity to analyze the difference in access frequency between high-frequency nodes and low-frequency nodes, extracts the node access frequency interval value and generates frequency group mapping, marks the behavior trigger node, identifies the jump segment and continuous access sequence characteristics of the frequency interval, and generates a frequency distribution matrix.

[0022] The path priority generation submodule, based on the frequency distribution matrix and combining the differences in node weight and access frequency, extracts the node weight field and frequency factor, calculates the access intensity fluctuation fusion index, filters out node channels with abnormal access intensity distribution and marks the path priority sequence, assigns path priority labels, and generates a path priority scheduling table for query requests.

[0023] As a further aspect of the present invention, the log auditing module includes:

[0024] The behavior pattern extraction submodule calls the path priority scheduling table of the query request, collects the time interval and operation type of user access behavior, identifies behavior pattern features, and generates a behavior pattern distribution map.

[0025] The abnormal behavior filtering submodule filters behavior patterns that exceed the normal range based on the behavior pattern distribution map, extracts operation offset values ​​from behavior sequences and counts repeated jumps, marks operation overload segments and abnormal path switching locations, identifies behavior sequences that offset beyond the threshold and matches abnormal trigger nodes, marks abnormal behavior nodes, and generates an abnormal behavior tagging table.

[0026] The audit data generation submodule calculates the distribution of operation types based on the abnormal behavior marker table, extracts node behavior records and operation code index values, constructs an operation frequency distribution map, analyzes the mapping relationship with node operation types, analyzes the operation concentration areas and high-frequency abnormal nodes in the behavior pattern, and generates an archive security audit data table based on the behavior pattern characteristics.

[0027] As a further aspect of the present invention, the system also includes a data tracing module:

[0028] Based on the archive security audit data table, the data tracing module collects the operation trajectory and data flow path of abnormal behavior nodes, extracts the data transfer time series and forwarding node identification information, analyzes the intersection distribution of trajectory nodes and data flow paths in the node index table, and generates data flow tracing results.

[0029] The data flow traceability results include an operation trajectory distribution map, path consistency markers, and a list of file query traceability nodes.

[0030] As a further aspect of the present invention, the data tracing module includes:

[0031] Based on the archive security audit data table, the trajectory extraction submodule extracts the operation trajectory of abnormal behavior nodes, identifies the time sequence and execution command number of each operation node, extracts the jump relationship and operation trigger field between nodes, filters continuous operation chains and generates node association mapping, identifies trajectory continuity features, and generates an operation trajectory distribution map.

[0032] The path consistency analysis submodule calls the operation trajectory distribution map to analyze the consistency between the trajectory and the data flow path, extracts the node index in the operation trajectory and compares it with the data flow channel, filters the path segments with consistent fields and marks the nodes with matching hop counts, marks the consistent path nodes, and generates a path consistency mark table.

[0033] The traceability node generation submodule tracks the distribution characteristics of consistent path nodes based on the path consistency tagging table, extracts the access time series and data transfer records of the tagged nodes, identifies the transfer direction identifier, extracts the interval between the terminal trigger node and the first execution node, and generates a list of traceability nodes for file query.

[0034] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0035] In this invention, a dynamic permission mapping mechanism generated by associating access requests with identity information and key structures effectively achieves real-time matching of permissions and instruction parameters, avoiding unauthorized access issues caused by static authorization. The credibility assessment model generated based on data structure features enhances the integrity identification capability of data during use. The path priority scheduling logic constructed by combining node access frequency, hop distance, and time period information significantly improves query efficiency and response accuracy. Through the identification of operation behavior combinations and overlapping time periods, rapid comparison of abnormal behaviors and generation of audit data are achieved. Furthermore, traceability features are extracted from the intersection distribution of data flow paths and time series, improving the auditability and accountability of file access, and enhancing the overall access security and trust level throughout the data lifecycle. Attached Figure Description

[0036] Figure 1 This is a system flowchart of the present invention;

[0037] Figure 2 This is a flowchart of the permission verification module in this invention;

[0038] Figure 3 This is a flowchart of the data integrity verification module in this invention;

[0039] Figure 4 This is a flowchart of the access path optimization module in this invention;

[0040] Figure 5 This is a flowchart of the log auditing module in this invention;

[0041] Figure 6 This is a flowchart of the data traceability module in this invention. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0043] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0044] Please see Figure 1 A blockchain-based medical record security optimization query system includes:

[0045] The permission verification module obtains the user's access request and identity information, parses the key association structure, extracts the user's identity hash value and key mapping label, identifies the corresponding permission level index and compares the access request instruction parameters, extracts the timestamp mapping value, marks the request corresponding permission label and matches the authorization level, and generates a dynamic permission mapping table.

[0046] The data integrity verification module is based on a dynamic permission mapping table. It extracts the signature field of the storage node and the current data, identifies the structural feature code and obtains the verification label, collects the original signature sequence to build a signature chain, compares the consistency between the label and the corresponding node in the chain, and generates a data credibility assessment model.

[0047] The access path optimization module identifies high-frequency access nodes and low-frequency archive nodes based on the data credibility assessment model, counts the access time period and request source distribution frequency, extracts the hop distance between nodes, analyzes the changes in node connection direction and hop interval, and generates a path priority scheduling table for query requests.

[0048] The log auditing module calls the path priority scheduling table of the query request, collects the time interval and operation type of access behavior, filters the overlapping areas of access anomaly frequency and operation time period, extracts operation command combinations and behavior repetition patterns, compares the offset degree of the original operation record with the current behavior feature marker, and generates the archive security audit data table.

[0049] The data tracing module is based on the archive security audit data table. It collects the operation trajectory and data flow path of abnormal behavior nodes, extracts the data transfer time series and forwarding node identification information, analyzes the intersection distribution of trajectory nodes and data flow paths in the node index table, and generates data flow tracing results.

[0050] The dynamic permission mapping table includes permission level identifiers, key segmentation structure, and timestamp sequence distribution. The data credibility assessment model includes signature consistency score, check value deviation range, and original signature distribution map. The query request path priority scheduling table includes a list of high-frequency nodes, archive node distribution weight, and access frequency difference matrix. The archive security audit data table includes abnormal behavior markers, operation type statistics, and audit result classification. The data flow tracing results include operation trajectory distribution map, path consistency markers, and archive query tracing node list.

[0051] Please see Figure 2 The permission verification module includes:

[0052] The identity resolution submodule obtains the user's access request and identity information, extracts the key segment identifier value in the key segment structure, locates the identity field index position corresponding to the segment, filters the key segment combination field with associated tags, compares the identity parameters in the access request with the key combination information in the mapping table, parses the key association relationship, and generates the key level mapping quantity.

[0053] To obtain user access requests and identity information, in a certain electronic medical record system, when a user attempts to access a specific patient's medical record, the system first obtains the user's access request, which includes the user's identity information such as username and role, as well as the requested medical record ID. A pre-defined key segment structure is extracted, containing key segments such as user role and access time. Each key segment identifier corresponds to the specific content of the key segment. For example, if the role is "Doctor" and the access time is "14:30", the system locates the corresponding identity field index position. Based on the key segment identifier value, the system searches for the corresponding field index position in the identity information. For example, the "Doctor" role corresponds to the "Title" field in the user's identity information, and "14:30" corresponds to... The "Access Time" field filters key segment combinations associated with the access marker. For example, if the "Doctor" role is pre-associated with "specific time period" access permissions, then the filter will select combinations containing these two key segments. The identity parameters in the access request are compared with the key combination information in the mapping table. For example, the "Title = Doctor" in the user's identity information is compared with the entry "Doctor role is allowed to access medical records" in the mapping table. The key association relationship is parsed, the comparison results are analyzed, and it is determined whether the user has access permissions. The key segments, identity field indexes, key combination information, and access permission association relationships are integrated into a key-level mapping quantity. This mapping quantity can be represented as a multidimensional array or tree structure for subsequent timestamp correction and permission mapping.

[0054] The timestamp correction submodule extracts the timestamp of the access request based on the key level mapping, extracts the field index corresponding to the timestamp in the key level, identifies the offset difference between the access request timestamp and the key time field, filters out time period labels that exceed the error threshold and performs data replacement correction, corrects the time deviation, and generates a time synchronization factor.

[0055] Find the field index corresponding to the timestamp from the key-level mapping, such as the "access time" field. Identify the offset difference between the access request timestamp and the key time field. Compare the access request timestamp with the key time field and calculate the offset difference. If the key time field has a precision of minutes, while the access request timestamp has a precision of seconds, conversion and comparison are required. Filter time period tags that exceed the error threshold and perform data replacement correction. If the system's preset error threshold is 5 seconds, filter out all time period tags with offset differences exceeding 5 seconds and perform data replacement correction, for example, correcting "15:00:10" to "15:00:00" to ensure consistent timestamp precision and correct time deviations. Correct all timestamps to maintain consistency with the precision of the key time field and generate a time synchronization factor for subsequent permission mapping. This factor can be represented as a time offset or a time correction function.

[0056] The permission mapping generation submodule is based on the time synchronization factor, combined with the key level and timestamp sequence, reads the permission tag index value corresponding to the synchronization factor, extracts the access control field content corresponding to the permission level, locates the key access behavior identifier item in the timestamp sequence, merges the permission index results corresponding to the key level and behavior tag, assigns permission level tags, and generates a dynamic permission mapping table.

[0057] Based on the time synchronization factor, combined with the key level and timestamp sequence, the permission tag index value corresponding to the synchronization factor is read, and the access control field content corresponding to the permission level is extracted. For example, according to the time synchronization factor, the corresponding permission tag index value is found in the key level. This index value corresponds to a permission level or access control list. The key access behavior identifier item in the timestamp sequence is located. For example, for an electronic medical record system, the key access behavior is "viewing medical records" or "modifying medical records". The identifier item related to the behavior is located in the timestamp sequence. For example, if a user views a medical record at "15:00:00", this behavior is recorded. The permission index results corresponding to the key level and the behavior tag are merged. The permission index results in the key level and the permission index results corresponding to the behavior tag are merged to generate a comprehensive permission index result. A permission level tag is assigned. According to the comprehensive permission index result, a permission level tag is assigned to the access request. For example, the permission level is "read-only". A dynamic permission mapping table is generated, which integrates user identity information, access time, access behavior, and permission level tag into a dynamic permission mapping table. This table can be used for subsequent access control and auditing.

[0058] Please see Figure 3 The data integrity verification module includes:

[0059] The signature extraction submodule is based on the dynamic permission mapping table. It extracts the encrypted signature field of the file storage node, locates the signature identifier segment in the storage node and extracts the corresponding value, reads the field position index in the signature structure and marks the field source, counts the frequency of signature fields and divides the signature structure hierarchy, identifies the signature distribution characteristics, and generates a signature sequence set.

[0060] Based on a dynamic permission mapping table, the signature field of a medical record is extracted as "SHA256(medical record content + timestamp + permission tag)". The signature identifier segment in the storage node is located and the corresponding value is extracted. The field position index in the signature structure is read and the field source is marked. The position index of each field in the signature structure is read. For example, the medical record content is located in bytes 1-100, the timestamp is located in bytes 101-110, and the permission tag is located in bytes 111-120. The frequency of occurrence of signature fields is counted and the signature structure is divided into different levels according to the frequency. For example, the frequency of medical record content and timestamp is relatively high, while the frequency of permission tag is relatively low. The signature distribution characteristics are identified. For example, the signature length, signature algorithm, etc. are identified and a signature sequence set is generated for subsequent consistency verification. For example, the signature length is 256 bits, the signature algorithm is SHA256, and all signature fields contain medical record content, timestamp, and permission tag.

[0061] The consistency verification submodule calls the signature sequence set to verify the consistency of the current archive data, extracts the signature field corresponding to the data segment to be verified, reads the comparison sequence between the original data block and the signature structure, and uses the following formula:

[0062] ;

[0063] Calculate the offset fusion difference value, compare it with the signature sequence in the original record, and generate the check value deviation.

[0064] in, Indicates the offset fusion difference value. This represents the offset difference value extracted between the i-th original data block and the signature structure. This represents the alignment deviation between the i-th signature sequence and the reference signature structure. This represents the length of the i-th segment of the original data block. This represents the total number of segments in the offset sequence. This represents the mean offset estimate after merging all segment differences;

[0065] The signature sequence set is invoked to perform consistency verification on a specific medical record. The signature field corresponding to the data segment to be verified is extracted. For example, the signature field of the current medical record content is extracted as "SHA256(medical record content + timestamp + permission tag)". The comparison sequence between the original data block and the signature structure is read. This sequence defines how to compare the original data block and the signature structure. For example, the comparison sequence is "first compare the medical record content, then compare the timestamp, and finally compare the permission tag". The formula is then invoked. Calculate the offset fusion difference value and compare the calculated offset fusion difference value with the signature sequence in the original record;

[0066] The advantage of this formula is that by fusing the offset difference between the original data block and the signature structure, the deviation between the signature sequence and the reference signature structure, and the length of the original data block, it can more comprehensively assess the consistency of the data. This represents the offset fusion difference value, in bytes. This represents the offset difference between the i-th original data block and the signature structure, expressed in bytes. It reflects the positional deviation between the original data and the signature structure; for example, the distance between the position of a field in the data block and the expected position of that field in the signature structure. This represents the alignment deviation between the i-th signature sequence and the reference signature structure, expressed in bits. It reflects the differences between the signature sequence and the expected reference signature structure, such as deviations in the signature algorithm, key, etc. This represents the length of the i-th original data block, in bytes, and is used to weight the offset differences. Longer data blocks with the same offset indicate a more serious problem. This represents the total number of segments in the offset sequence. This represents the average offset estimate after fusing all segment differences, in bytes. It provides an overall offset reference. Through summation, square root, and other operations, a comprehensive offset fusion difference value D is finally obtained. The smaller the value, the higher the data consistency; the larger the value, the lower the data consistency. Assume the following data: n=3, =2 bytes =1 bit, =100 bytes =3 bytes =0 bits, =150 bytes =1 byte =1 bit, =200 bytes, first calculate So that the value of D can be calculated later. The calculation is slightly complex because it involves... Unit conversion (bit to byte, assuming 1 byte = 8 bits) simplifies calculations by ignoring unit conversion and directly using the given bit value as an approximation of the byte value:

[0067] ;

[0068] Next, calculate :

[0069] ;

[0070] The results show that the offset fusion difference value is approximately 0.66 bytes. Assuming the preset difference threshold is 1 byte, if this value is lower than the threshold, the data consistency is considered to be relatively high. This means that the offset and deviation between the signature sequence in the data block and the original data block are relatively small. The data consistency verification result is compared with the preset threshold to obtain the conclusion of whether the data is consistent and to generate the verification value deviation.

[0071] The credibility assessment submodule analyzes the signature consistency score based on the verification value deviation, extracts the original signature node index table and the corresponding score value range, filters the key field positions and score mutation nodes, and generates a data credibility assessment model through the original signature distribution.

[0072] Based on the checksum deviation, the signature consistency score is analyzed. The original signature node index table is extracted, and the corresponding score value range is extracted. For example, the score value range is [0, 100]. Key field positions and score mutation nodes are filtered. For example, the medical record content field and timestamp field are key fields. Score mutation nodes refer to nodes where the score value changes significantly. Through the original signature distribution, for example, by analyzing historical signature data, it is found that factors such as signature length, signature algorithm, and key affect data credibility. The higher the signature consistency score, the higher the data credibility; conversely, the lower the data credibility. For example, if the checksum deviation of a medical record is 0.66 bytes, the credibility score of the record can be calculated as 85 points. Based on the score, the data credibility is evaluated. The checksum deviation reflects the signature... The degree of difference between the sequence and the reference signature structure is analyzed, for example, the check value deviation is 0.66. The signature consistency score is analyzed, for example, assuming there is a linear relationship between the deviation and the score, the smaller the deviation, the higher the score. The original signature node index table is extracted and the corresponding score value range is extracted, for example, the historical score value range is extracted as [70, 100]. The positions of key fields and score mutation nodes are filtered. Key fields include medical record content, timestamps, etc. Score mutation nodes refer to nodes where the score value changes significantly. Through the original signature distribution, for example, the distribution range, average value, variance, etc. of the signature value are statistically analyzed. Assuming the average value of the historical score is 80 and the variance is 5, a data credibility assessment model is generated. This model comprehensively considers factors such as check value deviation, historical scores, and signature distribution to assess the credibility of the data. By comprehensively considering multiple factors, the data credibility assessment model can more accurately assess the credibility of the data.

[0073] Please see Figure 4 The access path optimization module includes:

[0074] The node distribution analysis submodule extracts the distribution characteristics of high-frequency access nodes and low-frequency archive nodes based on the data credibility assessment model, marks the access tags of nodes and extracts the corresponding access counts, extracts the physical location information of nodes, identifies the storage density distribution and access hotspot areas among nodes, and generates a node distribution difference quantity.

[0075] Based on the data credibility assessment model, for example, medical record retrieval nodes are high-frequency access nodes, while backup storage nodes are low-frequency archiving nodes. Access tags are marked on nodes and corresponding access counts are extracted. For example, a retrieval node is marked as "read" with an access count of 1000 times. Node physical location information is extracted, such as the server's IP address and geographical location. Storage density distribution and access hotspots between nodes are identified. For example, some areas have higher storage density while others have higher access frequency. A node distribution difference is generated for subsequent access path optimization. For example, it can be represented as the distance between high-frequency access nodes and low-frequency archiving nodes. The distribution characteristics of high-frequency access nodes and low-frequency archiving nodes are extracted.

[0076] The frequency difference calculation submodule calls the node distribution difference quantity, analyzes the difference in access frequency between high-frequency nodes and low-frequency nodes, extracts the node access frequency interval value and generates frequency group mapping, marks the behavior trigger node, identifies the jump segment and continuous access sequence characteristics of the frequency interval, and generates a frequency distribution matrix.

[0077] The system utilizes node distribution differences. For example, nodes with access frequencies in the range [0, 100] are mapped to "low-frequency nodes," those in the range [101, 1000] to "medium-frequency nodes," and those in the range [1001, 10000] to "high-frequency nodes." It also marks behavior-triggered nodes, such as medical record viewing and modification nodes, and identifies transitional segments and continuous access sequences within frequency ranges. For instance, some nodes may change from low-frequency to high-frequency nodes, or some nodes may be accessed multiple times consecutively. The node distribution differences reflect the differences in physical location and access frequency between high-frequency and low-frequency nodes. The quantity is (high-frequency node access frequency - low-frequency node access frequency) / distance. Analyze the difference in access frequency between high-frequency and low-frequency nodes, extract the node access frequency interval values ​​and generate frequency group mappings. For example, the access frequency is divided into three intervals: low (0-100 times / day), medium (101-1000 times / day), and high (more than 1001 times / day). Mark the behavior trigger nodes, such as user login, data query and other operations. Identify the jump segments and continuous access sequence features between frequency intervals. For example, a node suddenly jumps from low frequency to high frequency, or a node is continuously and frequently accessed. Generate a frequency distribution matrix, which records the access frequency relationship between nodes.

[0078] The path priority generation submodule, based on the frequency distribution matrix and combining node weights with access frequency differences, extracts the node weight field and frequency factor using the following formula:

[0079] ;

[0080] Calculate the access intensity fluctuation fusion index, filter out nodes and channels with abnormal access intensity distribution and mark the path priority sequence, assign path priority labels, and generate a path priority scheduling table for query requests.

[0081] in, This indicates a fusion index representing fluctuations in access intensity. This represents the magnitude of the change in the access frequency of the j-th node within adjacent scheduling periods. This represents the frequency of visits to the j-th node on the path. This represents the ordinal index of the j-th node in the path. This represents the number of nodes in the current path;

[0082] Based on the frequency distribution matrix, and combining the differences in node weights and access frequencies, the formula is applied. The system calculates access intensity fluctuation fusion indicators. In electronic medical record systems, some patients' medical records need to be accessed urgently, which requires optimization of the access path. This is a unitless index representing the fluctuation in access intensity along a path. A higher index indicates greater fluctuation in access intensity. This represents the variation in the access frequency of the j-th node within adjacent scheduling periods, expressed in times per minute. It reflects the changes in the node's access frequency; for example, if the node was accessed 10 times in the previous minute and 20 times in the current minute, then... =10 times / minute This represents the access frequency of the j-th node on the path, measured in times per minute. It is used to normalize the frequency variation to prevent minor changes in high-frequency nodes from being excessively amplified. This represents the ordinal index of the j-th node in the path. It has no unit and is used to sort the nodes on the path. Nodes closer to the starting point have a greater influence. This represents the number of nodes in the current path. For example, if a path contains 3 nodes, then m=3.

[0083] The advantage of this formula is that by comprehensively considering the fluctuation range of access frequency, node access frequency, and the node's sequential index in the path, it can fully assess the fluctuation of path access intensity, thus providing a more reasonable basis for path priority scheduling. Assuming a path contains 3 nodes, the parameter values ​​are as follows: =5, =10, =1, =10, =20, =2, =2, =5, =3, substitute the parameter into the formula:

[0084] ;

[0085] The results indicate that the access intensity fluctuation fusion index is approximately 11.45. Assuming a preset fluctuation threshold of 10, a value higher than this threshold indicates that the access intensity fluctuation of this path is relatively large. The higher the value of the access intensity fluctuation fusion index, the greater the access intensity fluctuation of this path, indicating the presence of sudden or abnormal access behavior. Therefore, this path needs to be prioritized and assigned a higher priority in order to handle potential risks in a timely manner and generate a path priority scheduling table for query requests.

[0086] Please see Figure 5 The log auditing module includes:

[0087] The behavior pattern extraction submodule calls the path priority scheduling table of the query request, collects the time interval and operation type of user access behavior, identifies behavior pattern features, and generates a behavior pattern distribution map.

[0088] The system invokes the path priority scheduling table for query requests. For example, if a user views a medical record at 10:00 and modifies it at 10:05, the time interval is 5 minutes, and the operation type is "view" and "modify". It identifies behavioral pattern characteristics, such as frequent viewing of medical records and occasional modification. The system analyzes the time interval and operation type of user access behavior to identify behavioral pattern characteristics. For example, a normal doctor's behavior pattern is to first view the medical record, then make a diagnosis, and then issue a prescription. It analyzes the mapping relationship with node operation types. User access behavior on the path includes operations such as login, query, modification, and upload. Each operation corresponds to an operation type; for example, login corresponds to "login", and query corresponds to "query". Node behavior records include access time, user identity, operation type, and operation result information, generating a behavioral pattern distribution map.

[0089] The abnormal behavior filtering submodule filters behavior patterns that exceed the normal range based on the behavior pattern distribution map, extracts operation offset values ​​from behavior sequences and counts repeated jumps, marks operation overload segments and abnormal path switching locations, identifies behavior sequences that offset beyond the threshold and matches abnormal trigger nodes, marks abnormal behavior nodes, and generates an abnormal behavior tagging table.

[0090] Based on behavioral pattern distribution maps, such as frequent modification of medical records or unauthorized access, the system extracts operation offset values ​​from behavioral sequences and counts repeated hops. For example, if a user skips multiple nodes consecutively or performs multiple operations on the same node, it marks operation overload segments and abnormal path switching locations. For example, if the operation frequency of certain nodes is too high, or if a user frequently switches access paths, it identifies behavioral sequences that deviate above the threshold and matches abnormal trigger nodes. For example, if a user accesses a large number of medical records in a short period of time, the behavioral sequence is considered to have deviated above the threshold, and the abnormal trigger node is the medical record viewing node. Abnormal behavior nodes are marked, and an abnormal behavior marking table is generated. The system identifies behavioral sequences that deviate above the threshold, and the sequences indicate abnormal user behavior. For example, if a user frequently accesses multiple medical records in a short period of time, it marks operation overload segments and abnormal path switching locations. It marks operation overload segments, such as if the access frequency of a certain node is much higher than the average level, and marks abnormal behavior nodes. For example, users who frequently access medical records are marked as "suspicious users."

[0091] The audit data generation submodule calculates the distribution of operation types based on the abnormal behavior marking table, extracts node behavior records and operation code index values, constructs an operation frequency distribution map, analyzes the mapping relationship with node operation types, analyzes the operation concentration area and high-frequency abnormal nodes in the behavior pattern, and generates an archive security audit data table based on the behavior pattern characteristics.

[0092] Based on the abnormal behavior marker table, such as the number of times operations like viewing medical records, modifying medical records, and uploading reports are performed, node behavior records and operation code index values ​​are extracted. For example, the operation code index value can represent the operation type; for instance, "01" indicates viewing medical records, and "02" indicates modifying medical records. An operation frequency distribution map is constructed to show the frequency distribution of different operation types. The mapping relationship between nodes and operation types is analyzed to identify concentrated operation areas and high-frequency abnormal nodes in the behavior patterns. For example, some areas have a relatively concentrated operation type, or some nodes frequently exhibit abnormal behavior. Combined with behavior pattern characteristics, such as the normal behavior pattern of a doctor who first views medical records, then makes a diagnosis, and then issues a prescription, abnormal behaviors are analyzed based on these behavior pattern characteristics. The operation behaviors in the system are statistically analyzed, and a file security audit data table is generated. This data table is used to record detailed information about all operation behaviors.

[0093] Please see Figure 6 The data traceability module includes:

[0094] The trajectory extraction submodule extracts the operation trajectory of abnormal behavior nodes based on the archive security audit data table, identifies the time sequence and execution command number of each operation node, extracts the jump relationship and operation trigger field between nodes, filters continuous operation chains and generates node association mapping, identifies trajectory continuity characteristics, and generates operation trajectory distribution map.

[0095] Based on the archive security audit data table, for example, if a user views a medical record at 10:00 (node ​​number 1), modifies a medical record at 10:05 (node ​​number 2), and uploads a report at 10:10 (node ​​number 3), the module extracts the jump relationships between nodes and the operation trigger fields. For example, when jumping from the "view medical record" node to the "modify medical record" node, the user clicks the "modify" button, triggering the modification operation. The module filters continuous operation chains and generates node association mappings, such as "view medical record → modify medical record → upload report." It also identifies trajectory continuity features and generates an operation trajectory distribution map. For example, if a user continuously accesses multiple medical record nodes within a short period, the operation nodes are numbered according to time sequence, such as 1, 2, 3, ..., and the jump relationships between nodes and the operation trigger fields are extracted. For example, when jumping from node 1 to node 2, the triggered operation is "view medical record." This module analyzes a series of user operations within the archive system.

[0096] The path consistency analysis submodule calls the operation trajectory distribution map to analyze the consistency between the trajectory and the data flow path, extracts the node index in the operation trajectory and compares it with the data flow channel, filters the path segments with consistent fields and marks the nodes with matching hop counts, marks consistent path nodes, and generates a path consistency mark table.

[0097] The system calls the operation trajectory distribution map to analyze whether the operation trajectory is consistent with the data flow path. For example, if a user views, modifies, and uploads medical records according to the correct process, the node indexes in the operation trajectory are extracted and compared with the data flow channel. For example, if the operation trajectory is node 1→node 2→node 3 and the data flow channel is node A→node B→node C, the system filters path segments with consistent fields and marks nodes with matching hop counts. For example, if node 1 in the operation trajectory corresponds to node A in the data flow channel, then the path segment is considered consistent. If the hop counts of node 1 and node A are consistent, the consistent path nodes are marked, and a path consistency mark table is generated. The system analyzes the consistency between the trajectory and the data flow path. If the user accesses data according to a predefined process, then the trajectory is considered consistent with the data flow path. The system filters path segments with consistent fields and marks nodes with matching hop counts. For example, nodes that conform to the predefined process are marked as "normal nodes".

[0098] The traceability node generation submodule tracks the distribution characteristics of consistent path nodes based on the path consistency tagging table, extracts the access time series and data transfer records of the tagged nodes, identifies the transfer direction identifier, extracts the interval between the terminal trigger node and the first execution node, and generates a list of traceability nodes for file query.

[0099] Based on the path consistency marker table, for example, if a normal user's access path conforms to a predefined process, the access time series and data transfer records of the marked nodes are extracted. For example, if a user accesses node A at 10:00 and transfers data from node A to node B at 10:05, the transfer direction identifier is identified. For example, if data is transferred from node A to node B, the transfer direction is A→B. The interval between the terminal trigger node and the first execution node is extracted. For example, if a user triggers abnormal behavior at node C, then node C is the terminal trigger node and node A is the first execution node. This includes nodes A, B, and C, as well as the access relationships and data transfer relationships between nodes. Nodes conforming to the predefined process are tracked, the access time series and data transfer records of the marked nodes are extracted, the transfer direction identifier is identified, the direction of data flow is determined, the interval between the terminal trigger node and the first execution node is extracted, and a list of traceable nodes for archive query is generated.

[0100] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A blockchain-based medical record security optimization query system, characterized in that, The system includes: The permission verification module obtains the user's access request and identity information, parses the key association structure, extracts the user's identity hash value and key mapping label, identifies the corresponding permission level index and compares the access request instruction parameters, marks the request corresponding permission label and matches the authorization level, and generates a dynamic permission mapping table. The data integrity verification module extracts the signature field of the storage node and the current data based on the dynamic permission mapping table, identifies the structural feature code, compares the consistency between the tag and the corresponding node in the linked list, and generates a data credibility assessment model. The access path optimization module identifies high-frequency access nodes and low-frequency archive nodes based on the data credibility assessment model, counts access time periods and request source distribution frequencies, extracts hop distances between nodes, analyzes the changes in node connection directions and hop intervals, and generates a path priority scheduling table for query requests. The access path optimization module includes: The node distribution analysis submodule extracts the distribution characteristics of high-frequency access nodes and low-frequency archive nodes based on the data credibility assessment model, marks the access tags of nodes and extracts the corresponding access counts, extracts the physical location information of nodes, identifies the storage density distribution and access hotspot areas among nodes, and generates a node distribution difference quantity. The frequency difference calculation submodule calls the node distribution difference quantity to analyze the difference in access frequency between high-frequency nodes and low-frequency nodes, extracts the node access frequency interval value and generates frequency group mapping, marks the behavior trigger node, identifies the jump segment and continuous access sequence characteristics of the frequency interval, and generates a frequency distribution matrix. The path priority generation submodule, based on the frequency distribution matrix and combined with the difference between node weight and access frequency, extracts the node weight field and frequency factor, calculates the access intensity fluctuation fusion index, filters out node channels with abnormal access intensity distribution and marks the path priority sequence, assigns path priority labels, and generates a path priority scheduling table for query requests. The log auditing module calls the path priority scheduling table of the query request, collects the time interval and operation type of access behavior, filters the overlapping areas of access anomaly frequency and operation time period, compares the offset degree of the original operation record with the current behavior feature mark, and generates the archive security audit data table. The log auditing module includes: The behavior pattern extraction submodule calls the path priority scheduling table of the query request, collects the time interval and operation type of user access behavior, identifies behavior pattern features, and generates a behavior pattern distribution map. The abnormal behavior filtering submodule filters behavior patterns that exceed the normal range based on the behavior pattern distribution map, extracts operation offset values ​​from behavior sequences and counts repeated jumps, marks operation overload segments and abnormal path switching locations, identifies behavior sequences that offset beyond the threshold and matches abnormal trigger nodes, marks abnormal behavior nodes, and generates an abnormal behavior tagging table. The audit data generation submodule calculates the distribution of operation types based on the abnormal behavior marker table, extracts node behavior records and operation code index values, constructs an operation frequency distribution map, analyzes the mapping relationship with node operation types, analyzes the operation concentration areas and high-frequency abnormal nodes in the behavior pattern, and generates an archive security audit data table based on the behavior pattern characteristics.

2. The blockchain-based medical record security optimization query system according to claim 1, characterized in that, The dynamic permission mapping table includes permission level identifiers, key segmentation structure, and timestamp sequence distribution. The data credibility assessment model includes signature consistency score, verification value deviation range, and original signature distribution map. The path priority scheduling table for query requests includes a list of high-frequency nodes, archive node distribution weights, and access frequency difference matrix. The archive security audit data table includes abnormal behavior markers, operation type statistics, and audit result classification.

3. The blockchain-based medical record security optimization query system according to claim 1, characterized in that, The permission verification module includes: The identity resolution submodule obtains the user's access request and identity information, extracts the key segment identifier value in the key segment structure, locates the identity field index position corresponding to the segment, filters the key segment combination field with associated tags, compares the identity parameters in the access request with the key combination information in the mapping table, parses the key association relationship, and generates the key level mapping quantity. The timestamp correction submodule extracts the timestamp of the access request based on the key level mapping, extracts the field index corresponding to the timestamp in the key level, identifies the offset difference between the access request timestamp and the key time field, filters out time period labels that exceed the error threshold and performs data replacement correction, corrects the time deviation, and generates a time synchronization factor. The permission mapping generation submodule, based on the time synchronization factor, combines the key level and timestamp sequence, reads the permission tag index value corresponding to the synchronization factor, extracts the access control field content corresponding to the permission level, locates the key access behavior identifier item in the timestamp sequence, merges the permission index results corresponding to the key level and behavior tag, assigns permission level tags, and generates a dynamic permission mapping table.

4. The blockchain-based medical record security optimization query system according to claim 3, characterized in that, The data integrity verification module includes: The signature extraction submodule extracts the encrypted signature field of the file storage node based on the dynamic permission mapping table, locates the signature identifier segment in the storage node and extracts the corresponding value, reads the field position index in the signature structure and marks the field source, counts the frequency of signature field occurrence and divides the signature structure hierarchy, identifies signature distribution characteristics, and generates a signature sequence set. The consistency verification submodule calls the signature sequence set to verify the consistency of the current archive data, extracts the signature field corresponding to the data segment to be verified, reads the comparison sequence between the original data block and the signature structure, calculates the offset fusion difference value, compares the signature sequence in the original record, and generates the verification value deviation. The credibility assessment submodule analyzes the signature consistency score based on the verification value deviation, extracts the original signature node index table and the corresponding score value range, filters the key field positions and score mutation nodes, and generates a data credibility assessment model through the original signature distribution.

5. The blockchain-based medical record security optimization query system according to claim 1, characterized in that, The system also includes a data traceability module: Based on the archive security audit data table, the data tracing module collects the operation trajectory and data flow path of abnormal behavior nodes, extracts the data transfer time series and forwarding node identification information, analyzes the intersection distribution of trajectory nodes and data flow paths in the node index table, and generates data flow tracing results. The data flow traceability results include an operation trajectory distribution map, path consistency markers, and a list of file query traceability nodes.

6. The blockchain-based medical record security optimization query system according to claim 5, characterized in that, The data tracing module includes: Based on the archive security audit data table, the trajectory extraction submodule extracts the operation trajectory of abnormal behavior nodes, identifies the time sequence and execution command number of each operation node, extracts the jump relationship and operation trigger field between nodes, filters continuous operation chains and generates node association mapping, identifies trajectory continuity features, and generates an operation trajectory distribution map. The path consistency analysis submodule calls the operation trajectory distribution map to analyze the consistency between the trajectory and the data flow path, extracts the node index in the operation trajectory and compares it with the data flow channel, filters the path segments with consistent fields and marks the nodes with matching hop counts, marks the consistent path nodes, and generates a path consistency mark table. The traceability node generation submodule tracks the distribution characteristics of consistent path nodes based on the path consistency tagging table, extracts the access time series and data transfer records of the tagged nodes, identifies the transfer direction identifier, extracts the interval between the terminal trigger node and the first execution node, and generates a list of traceability nodes for file query.

Images