Dicom data desensitization and separation transmission integration method and system

Abstract

The invention is applicable to the field of medical data processing, and provides a dicom data desensitization and separation transmission integration method, which comprises the following steps of: S1, defining a data field which needs to be desensitized according to a DICOM (Digital Imaging and Communications in Medicine) standard; s2, performing DICOM (Digital Imaging and Communications in Medicine) data desensitization on the corresponding data field to obtain a latest desensitization field; s3, separately transmitting the plurality of desensitization fields as a plurality of sub-data blocks; s4, a receiving end receives all the sub-data blocks and then checks, combines and recovers the sub-data blocks; according to the method, sensitive fields are defined by adopting a field definition method for multi-dimensional semantic association recognition, and according to dynamic difficulty scores self-adaptive to desensitization intensity, an encryption algorithm processing mode is automatically selected to encrypt the sensitive fields. Therefore, the method can realize efficient, safe and complete transmission of the DICOM data. Through the technical means of data desensitization, separated transmission and integrity recovery, the problems of privacy protection, transmission efficiency, data integrity and data security in DICOM data transmission are solved.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of medical data processing, and provides a method for integrating dicom data desensitization and separate transmission. BACKGROUND

[0002] DICOM (Digital Imaging and Communications in Medicine) is an international standard widely used in the medical field, aiming to realize the storage, transmission and processing of medical image data. The DICOM standard defines the format, storage rules and network transmission protocol of images and other medical information, enabling seamless exchange of medical image data between different devices and systems. With the rapid development of medical imaging, DICOM is not only widely used in imaging devices in hospitals and clinics, but also has become one of the core technologies of remote medical treatment and cloud storage.

[0003] In the existing DICOM data transmission process, the transmission method based on TCP / IP protocol is usually adopted, and data is exchanged through medical devices, servers or workstations. In order to ensure the integrity of data and the stability of transmission, traditional DICOM data transmission will take encryption and check mechanism to a certain extent, to ensure that data is not tampered with and can reliably reach the destination.

[0004] However, the privacy protection and transmission efficiency problems in traditional DICOM data transmission have not been fully solved. In terms of patient privacy protection, DICOM data often does not undergo effective desensitization, which may pose a risk of leakage of patients' personal privacy information; in the data transmission process, the data is not optimized, which may lead to low transmission efficiency, and the data is easy to be intercepted or reconstructed in transmission, further increasing the possibility of data leakage. SUMMARY

[0005] In view of the above defects, the purpose of the present application is to provide a method for integrating dicom data desensitization and separate transmission, which aims to solve the problems raised in the background art, comprising the following steps:

[0006] S1, according to the DICOM standard, defining the data field that needs to be desensitized;

[0007] S2, desensitizing the corresponding data field to obtain the latest desensitized field;

[0008] S3, separating and transmitting multiple desensitized fields as multiple sub-data blocks;

[0009] S4, the receiving end receives all sub-data blocks and performs verification, combination and recovery;

[0010] The method defines the sensitive field by using a multi-dimensional semantic correlation recognition field definition method, and automatically selects an encryption algorithm processing mode to encrypt the sensitive field according to a dynamic difficulty score adaptive to a desensitization strength.

[0011] Further, the multi-dimensional semantic correlation recognition includes semantic recognition and multi-dimensional correlation.

[0012] Further, the semantic recognition uses a natural language processing technology, and utilizes a semantic analysis model to recognize semantics of each data field in the transmission data text, so as to determine the sensitive field.

[0013] Further, the multi-dimensional correlation marks a node corresponding to the sensitive field as a sensitive node during semantic recognition, and then marks nodes associated with the related sensitive information according to the correlation, constructs an association graph of the sensitive node in the whole data, and marks fields corresponding to the related nodes as sensitive fields.

[0014] Further, the automatic switching processing method according to the dynamic difficulty score adaptive to the desensitization strength uses a sensitive coefficient in a sensitive field definition library, combines an encryption difficulty coefficient, a data information data redundancy coefficient, and generates a dynamic difficulty score for the sensitive field, and the formula is:

[0015] S = α * A + β * N + γ * M + Y

[0016] Wherein, α is the encryption difficulty coefficient; A is the difficulty basic score; β is the data information data redundancy; N is the data redundancy basic score; γ is the block synchronous transmission difficulty coefficient; M is the block synchronous transmission basic score; Y is the additional score.

[0017] Further, for the same data in the hospital transmission or the cross-regional medical joint transmission, the calculation formula is defined as:

[0018] S = α * A + β * N + γ * M + δ * Z + Y

[0019] δ represents a transmission coefficient of different types in different regions, and Z represents a basic score of different types in different regions.

[0020] Further, under the multi-standard measurement score S, it is guaranteed that:

[0021] α max *A + β max *N + γ max *M + δ max *Z + Y = S ≤ 100.

[0022] Further, the encryption algorithm processing mode is selected according to the dynamic difficulty score, and the mode is divided into weak desensitization, strong desensitization and block confusion.

[0023] Weak desensitization only uses sensitive field pseudo-anonymization;

[0024] Strong desensitization performs AES-256 encryption of all data / images / information;

[0025] Block confusion adds a noise matrix to the data after partitioning by node to obtain confused data, and obtains disordered desensitized data through specific sorting encoding.

[0026] Further, the weak desensitization method only encrypts the part with sensitive information by splitting the model, and the splitting model is a pre-set lightweight U-Net splitting model. The splitting model creates a private tag area in the DICOM file header, and the private tag area writes the decryption parameters;

[0027] The decryption parameters include: desensitization method, encrypted hash check code corresponding to the receiving end decoding database, and encrypted key seed.

[0028] Further, for the data splitting after strong desensitization and weak desensitization, the desensitized DICOM data is split into multiple data blocks according to the nodes between multiple desensitization fields, and the multiple data blocks are sequentially transmitted in multiple threads;

[0029] For the splitting of data after block confusion, the "disordered" data according to the specific sorting encoding is split into multiple data blocks, and the multiple data blocks are sequentially transmitted in multiple threads. After receiving, the data is restored to the "disordered" data according to the specific sorting encoding, and then the decryption process is performed.

[0030] Through the above steps, the DICOM data between the medical image center and the remote diagnosis center can be efficiently, securely and completely transmitted. Through the technical means of data desensitization, separate transmission and integrity recovery, the problems of privacy protection, transmission efficiency and data integrity, data security in DICOM data transmission are solved, which has wide application prospect, especially in the fields of remote medical treatment, medical image cloud storage, medical big data sharing, etc. It can effectively protect the privacy information of patients, improve the transmission efficiency and reliability of DICOM data, ensure the integrity and accuracy of data, and provide strong support for digital management and application of medical images. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present application will be described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present application, not all. It should be understood that the specific embodiments described herein are only used to explain the present application, and not to limit the present application.

[0032] DICOM (Digital Imaging and Communications in Medicine) standard is an international standard for medical digital imaging and communication. Its format is composed of file header and data set, the file header contains specific identification and information, and the data set is composed of a series of data elements, each data element has a unique label identification, including data type, length and value information. The role of DICOM standard is to realize the data exchange and sharing between medical imaging equipment (such as CT, MRI, ultrasound, etc.) and information system (such as PACS, RIS, HIS, etc.), to ensure the interoperability of data between different manufacturers' equipment, to facilitate medical personnel to store, transmit, display, process and analyze the image data of patients, so as to improve the efficiency and quality of medical diagnosis, and promote the wide application of medical imaging technology in clinical and scientific research.

[0033] The purpose of the present application is to provide a DICOM data desensitization and separate transmission integration method and system, according to the DICOM standard, the data fields that need to be desensitized are defined, such as patient name, ID number, medical record number, case data, medical imaging data, etc. The corresponding data fields are desensitized to obtain the latest desensitized fields. A plurality of desensitized fields are respectively taken as a plurality of sub data blocks for separate transmission. The receiving end receives all the sub data blocks and performs verification, combination and recovery.

[0034] The specific steps are as follows:

[0035] S1, according to the DICOM standard, the data fields that need to be desensitized are defined;

[0036] S2, the corresponding data fields are desensitized to obtain the latest desensitized fields;

[0037] S3, a plurality of desensitized fields are respectively taken as a plurality of sub data blocks for separate transmission;

[0038] S4, the receiving end receives all the sub data blocks and performs verification, combination and recovery.

[0039] Specifically, in step S1, the field definition method of multi-dimensional semantic association recognition is used to define sensitive fields. "Multi-dimensional semantic association recognition" includes two processes of "semantic recognition" and "multi-dimensional association", which together realize the effect of multi-dimensional semantic association recognition of sensitive fields.

[0040] For semantic recognition, on the one hand, natural language processing technology is used to recognize the semantics of each data field in the transmission data text by using a semantic analysis model. Sensitive fields such as patient name, ID number, key past medical history, medication history, allergens, psychological diagnosis state, etc. Semantic analysis can analyze the unique semantic features of the disease description in the transmission text, identify the description fragments that directly or indirectly point to the patient's personal privacy, and thus accurately locate the sensitive fields to prevent them from being ignored by traditional desensitization methods.

[0041] For multi-dimensional association process, each field in the DICOM data is intercepted in the semantic recognition process to form a node, and the node corresponding to the sensitive field is marked as a sensitive node during semantic recognition. Then, according to the medical association system constructed by the system administrator and the functional association, role association and nodes associated with related sensitive information of the data in the actual medical process, the association graph of the sensitive nodes in the overall data is constructed. By analyzing the association strength and path between nodes, it is determined which field combination may leak sensitive information, and the fields corresponding to the related nodes are marked as sensitive fields.

[0042] For example, a special treatment record in a patient's past medical history is associated with the sensitive information of the current imaging examination site. In the association graph, the node that was originally marked as non-sensitive (a special treatment record in a past medical history) is associated with the path of the sensitive node (sensitive information of the current imaging examination site), and these related fields are included in the desensitization range.

[0043] Therefore, in the step of defining the data fields that need to be desensitized, the method can use natural language processing and association graph to redefine the DICOM data desensitization fields from multiple dimensions after the initial definition, effectively making up for the lack of precision in defining DICOM data desensitization fields in current technology.

[0044] Specifically, in step S2, the present scheme uses the AES (Advanced Encryption Standard) encryption algorithm to process the sensitive fields, ensuring that the data cannot be directly identified during transmission. Specifically, based on the use of the AES (Advanced Encryption Standard) encryption algorithm, an adaptive difficulty score automatic switching processing method for desensitization strength is used to encrypt the sensitive fields. The encryption key is stored in a secure key management system, and only authorized receivers can decrypt and obtain the original information.

[0045] AES encryption algorithm is a kind of symmetric encryption algorithm, which adopts block encryption mode, supports 128-bit, 192-bit and 256-bit key length, and encrypts data through multiple rounds of complex substitution, permutation and other operations, has high security, strong attack resistance and fast encryption and decryption speed, etc.

[0046] The desensitization strength adaptive difficulty score automatic switching processing method uses the sensitive coefficient in the sensitive field definition library, combines the encryption difficulty coefficient, the data information data redundancy coefficient, etc., to generate a dynamic difficulty score for the sensitive field, and automatically switches the processing mode according to the difficulty score.

[0047] The sensitive field definition library contains multiple dimension information of the type, data format, importance in medical diagnosis, etc. of the field. The dynamic difficulty score is calculated in real time according to the preset sensitivity calculation formula based on the extracted feature information before encryption processing, and the formula is:

[0048] S = a * A + b * N + g * M + Y + … * …

[0049] Wherein a is the encryption difficulty coefficient; A is the difficulty base score; b is the data information data redundancy; N is the data redundancy base score; g is the block synchronous transmission difficulty coefficient; M is the block synchronous transmission base score; Y is the additional score.

[0050] The S value will be dynamically adjusted with changes in data usage scenarios, data size, data redundancy, number of multi-threaded synchronous transmission of sensitive data field nodes, etc. For example, the same data is transmitted within the hospital and transmitted in a cross-regional medical consortium, and a new calculation formula is defined:

[0051] S = a * A + b * N + g * M + d * Z + Y

[0052] At this time, d represents the transmission coefficient of different types across regions, and Z represents the base score of different types across regions.

[0053] Under the multi-standard measurement score S, it is guaranteed that:

[0054] a max * A + b max * N + g max * M + d max * Z + Y = S ≤ 100

[0055] According to the dynamic difficulty score, the encryption algorithm processing mode is selected, which includes weak desensitization, strong desensitization and block confusion. Specifically:

[0056] When the dynamic difficulty score S≥80, weak desensitization is adopted, and only the sensitive field is pseudo-anonymized; under the premise of preserving the integrity of the overall data, reversible information confusion processing is performed on the identified sensitive field, so that the unauthorized party cannot identify the specific data characteristics, and the receiving end can restore the original data through a secure key. In this way, due to the reasons such as data type, data redundancy, difficulty of synchronous transmission, etc., if the difficulty score is too large, in order to solve the problem of too long system processing time caused by large desensitization difficulty, the system can choose to use only weak desensitization to encrypt and transmit the data.

[0057] In some embodiments, if the data type is a large amount of medical image training data or medical imaging information, the system uses a segmentation model (a pre-set lightweight U-Net segmentation model, which is trained with a large number of labeled medical images to automatically output a binary mask of the lesion area - such as white areas indicating pathological feature positions and black areas for normal tissue), only the part with sensitive information is encrypted, and the final encrypted overall data is stored in the DICOM file header for transmission.

[0058] In this way, the DICOM file header creates a private tag area, which writes decryption parameters: one is to identify the desensitization method, such as "lesion pseudo-anonymization", "image data pseudo-anonymization", "key information pseudo-anonymization"; the second is to record the encrypted hash check code corresponding to the receiving end decoding database, which cooperates with the "identification desensitization method" in the decryption parameter to select and further verify the decryption method; the third is the encrypted key seed, which is hosted by the hospital key management system. The total capacity of the tag data in the above private tag area is controlled within 128 bytes to avoid increasing the transmission load.

[0059] When the dynamic difficulty score 50≤S<80, strong desensitization is adopted, that is, all data / images / information are AES-256 encrypted, that is, all contents such as image pixel data, patient metadata, and diagnosis text are covered by AES-256, which ensures high-level security protection while maintaining acceptable system processing efficiency.

[0060] When the dynamic difficulty score S<50, block confusion is adopted, that is: the data is divided into blocks according to the nodes, and then a noise matrix is added to obtain confused data, and the confused data is encoded through a specific sorting to obtain disordered desensitized data. The "disordered" data and the specific sorting encoding are synchronously received at the receiving end, and then the specific sorting encoding is reversed at the receiving end, and the noise matrix is removed to restore the desensitized data.

[0061] In the above process of selecting the encryption algorithm processing mode according to the dynamic difficulty score, an additional score Y can be set by the system administrator according to the data type and data sensitivity, and the additional score Y can more flexibly regulate the dynamic difficulty score S value. In the encryption of high-sensitive data, the high-sensitive data can be more targeted for encryption transmission.

[0062] Specifically, in step S3, the multiple desensitization fields are respectively separated and transmitted as multiple sub-data blocks. Transmission supports multiple network channels, for example, wired networks and wireless networks, and the optimal transmission channel is automatically selected according to the current network condition to ensure the flexibility and reliability of data transmission.

[0063] For the segmentation of strongly desensitized and weakly desensitized data, the desensitized DICOM data is segmented into multiple sub-data blocks according to the nodes between the multiple desensitization fields, and each sub-data block contains image information and metadata between nodes. For example, when a large medical image DICOM file is segmented into multiple 1MB sub-data blocks, each sub-data block contains a part of the encrypted pixel data of the image and related metadata. The sub-data block is transmitted in single thread, and multiple sub-data blocks are sequentially transmitted in multiple threads.

[0064] For the segmentation of the data segmented by block confusion, the "disordered" data encoded according to a specific order is segmented into multiple sub-data blocks, and the multiple sub-data blocks are sequentially transmitted in multiple threads. After receiving, the "disordered" data encoded according to a specific order is restored, and the subsequent decryption process is performed.

[0065] In addition, the data supports the transmission of sub-data blocks through multiple channels, reduces the bottleneck of single-channel transmission, and supports multiple protocol transmission. During transmission, according to the network condition and data priority, the system can prioritize and schedule the transmission of sub-data blocks to improve transmission efficiency. For example, sub-data blocks containing critical diagnostic information (such as data in the center region of an image) are given higher priority for transmission; at the same time, network bandwidth, delay and other parameters are monitored in real time, and the transmission rate and data block sending order are dynamically adjusted.

[0066] Specifically, in step S4, the receiving end receives the sub-data blocks, performs verification, combination and recovery. After receiving all the sub-data blocks, the receiving end uses the CRC verification algorithm to verify each sub-data block, and confirms that there is no error; if a sub-data block fails the verification, the receiving end will request retransmission of the sub-data block. The CRC verification formula is:

[0067] CRC = CRC32 (sub-data block content)

[0068] CRC32 is a cyclic redundancy check algorithm used to detect errors in data transmission. For data combination, the sub-data blocks are recombined into a complete DICOM file according to their sequence numbers and position information, and then the data is decrypted and restored.

[0069] After the receiving end completes the recombination of the sub-data blocks, it starts the differential decryption and restoration process according to the de-sensitization mode identifier recorded in the DICOM header. The three de-sensitization modes correspond to independent technical paths to ensure the accuracy of data restoration. Specifically:

[0070] For weak de-sensitization data restoration, the receiving end parses the DICOM header private tag area, decrypts the seed parameters through the key management system (KMS), reconstructs the pseudo-random matrix, and decrypts the parts marked as sensitive information (such as "lesion pseudo-anonymization", "image data pseudo-anonymization", "key information pseudo-anonymization", etc.). Perform bitwise XOR inverse operation on the image regions of the above sensitive information, and the self-reflection of the XOR operation can guarantee the accurate restoration of the de-sensitized data, as follows:

[0071] Original pixel = Confused pixel XOR noise matrix

[0072] Where the receiving end runs the same U-Net model to reconstruct the lesion mask and compares the 8-bit hash check code stored in the header.

[0073] Where the text type sensitive field (such as patient ID) uses the same key for reverse obfuscation calculation.

[0074] For strong de-sensitization data restoration, extract the key index from the DICOM header private tag area, request the session key from the key management system (KMS), and perform AES-256-CBC reverse decryption. The AES-256-CBC reverse decryption method is a mature existing technology, which includes round key addition, reverse column obfuscation, reverse row shift, reverse byte substitution, and removal of PKCS#7 padding data steps, which are not described here.

[0075] For block obfuscation data restoration, the data is sequentially reconstructed and restored through the out-of-order correction mechanism. In this process, the "out-of-order" data is reconstructed according to a specific ordering code; specifically, the specific ordering code contains ECC encrypted chaotic sorting parameters, which are decrypted by a private key to obtain the original block three-dimensional coordinate matrix divided in the "block obfuscation" step. The ECC encrypted chaotic sorting parameters contained in the specific ordering code are reversely restored to the original block three-dimensional coordinate matrix, i.e. the physical order of the data in the original block three-dimensional coordinate matrix is restored according to the coding value, and the reconstruction and restoration are completed.

[0076] For noise stripping, the base layer is operated in the following way to obtain pure data:

[0077]

[0078] Through the above steps, the DICOM data between the medical image center and the remote diagnosis center can be transmitted efficiently, safely and completely. Through the technical means of data desensitization, separate transmission and integrity recovery, the problems of privacy protection, transmission efficiency and data integrity, data security in DICOM data transmission are solved, which has a wide application prospect, especially in the fields of remote medical treatment, medical image cloud storage, medical big data sharing, etc. The privacy information of patients can be effectively protected, the transmission efficiency and reliability of DICOM data are improved, the integrity and accuracy of data are ensured, and strong support is provided for the digital management and application of medical images.

[0079] Of course, the present application can have other various embodiments, and those skilled in the art can make various corresponding changes and modifications according to the present application without departing from the spirit and essence of the present application. However, these corresponding changes and modifications should belong to the protection scope of the claims attached to the present application.

Claims

1. A method of dicom data de- sensitization and segregated transmission integration, comprising: The method comprises the steps of: S1, defining the data field needing desensitization according to the DICOM standard; S2, performing DICOM data desensitization on the corresponding data field to obtain the latest desensitized field; S3, separating and transmitting the multiple desensitized fields as multiple sub-data blocks respectively; S4, verifying, combining and recovering after receiving all the sub-data blocks at the receiving end; The method adopts a field definition method of multi-dimensional semantic association recognition to define the sensitive field, and automatically selects an encryption algorithm processing mode to encrypt the sensitive field according to a dynamic difficulty score adaptive to the desensitization strength.

2. The method of dicom data de- sensitization and segregated transmission integration of claim 1, wherein, The multi-dimensional semantic association recognition includes semantic recognition and multi-dimensional association.

3. The method of dicom data de- sensitization and segregated transmission integration of claim 2, wherein, The semantic recognition uses natural language processing technology to recognize the semantics of each data field in the transmission data text by using a semantic analysis model, so as to determine the sensitive field.

4. The method of dicom data de- sensitization and segregated transmission integration of claim 2, wherein, The multi-dimensional association marks the node corresponding to the sensitive field as a sensitive node during semantic recognition, and then marks the nodes associated with the related sensitive information according to the association, constructs an association graph of the sensitive node in the whole data, and marks the fields corresponding to the related nodes as sensitive fields.

5. The method of dicom data de- sensitization and segregated transmission integration of claim 1, wherein, The dynamic difficulty score adaptive to the desensitization strength automatically switches the processing method by using the sensitive coefficient in the sensitive field definition library, combining the encryption difficulty coefficient, the data information data redundancy coefficient, to generate a dynamic difficulty score for the sensitive field, the formula is: S = alpha * A + beta * N + gamma * M + Y Where alpha is the encryption difficulty coefficient; A is the difficulty base score; beta is the data information data redundancy; N is the data redundancy base score; gamma is the block synchronization transmission difficulty coefficient; M is the block synchronization transmission base score; Y is the additional score.

6. The method of dicom data de- sensitization and segregated transmission integration of claim 5, wherein, For the same data in hospital transmission or cross-regional medical union transmission, the calculation formula is defined as: S = alpha * A + beta * N + gamma * M + delta * Z + Y Delta represents the transmission coefficient of different types across regions, and Z represents the base score of different types across regions.

7. The method of dicom data de- sensitization and segregated transmission integration of claim 6, wherein, Under the multi-standard measurement score S, it is guaranteed that: alpha max *A+beta max *N+gamma max *M+delta max *Z+Y = S < 100.

8. The method for dicom data de-sensitization and segregated transmission integration of any one of claims 1, 5, 6, wherein, According to the dynamic difficulty score, the encryption algorithm processing mode is selected, which is divided into weak desensitization, strong desensitization and block confusion; Weak desensitization only uses sensitive field pseudo-anonymization; Strong desensitization performs AES-256 encryption on all data / images / information; Block confusion obtains confusion data by adding a noise matrix to the data after block division, and obtains disordered desensitization data by encoding the confusion data through specific sorting.

9. The method of dicom data de- sensitization and segregated transmission integration of claim 8, wherein, The weak desensitization mode only encrypts the part with sensitive information by using a segmentation model, and the segmentation model is a pre-set lightweight U-Net segmentation model. The decryption parameter includes: desensitization method, encrypted hash check code corresponding to the receiving end decoding database, and encrypted key seed.

10. The method of dicom data de- sensitization and segregated transmission integration of claim 8, wherein, In step S3, For the data segmentation of strong and weak de-identification, the de-identified DICOM data is segmented into multiple sub-data blocks according to the nodes between multiple de-identification fields, and the multiple sub-data blocks are sequentially transmitted in multiple threads; for the segmentation of data segmented by block confusion, the "out-of-order" data encoded according to a specific ordering is segmented into multiple sub-data blocks, and the multiple sub-data blocks are sequentially transmitted in multiple threads, and after being received at the receiving end, the "out-of-order" data encoded according to the specific ordering is restored, and then a subsequent decryption process is performed.