A maternal and child health care data security sharing and exchanging method and system

Abstract

The application discloses a maternal and child health care data security sharing exchange method and system, relates to the technical field of data security sharing, and comprises the following steps: a patient initiates authorization through zero-knowledge proof DID identity, defines a three-dimensional strategy, generates a strategy fingerprint and a dynamic access token DAT; a data use direction privacy gateway submits an access request, channel 1 performs on-chain verification, sends the DAT to a smart contract, and outputs an on-chain verification result; channel 2 performs environment verification and outputs True / False; when the double-channel combined verification result is passed, a metadata key is decrypted by using attribute-based encryption, the storage position of data is acquired, a physically isolated safe area is created, the metadata key is input into an enclave, the data body key is decrypted in the enclave memory, and the data is decrypted by using the key; scientific research code runs in a TEE, and only a compliant calculation result is output. From key decryption to data calculation, all operations are completed in a safe environment, and plaintext data is not exposed.

Description

Technical Field

[0001] This invention relates to the field of data security sharing technology, specifically to a method and system for secure sharing and exchange of maternal and child health care data. Background Technology

[0002] Chinese invention application CN107241360A discloses a data security sharing and exchange method and a data security sharing and exchange platform system, including blockchain infrastructure, a blockchain repository, an access agent subsystem, and a request agent subsystem. The method includes: the access agent subsystem receiving description information of first target data and publishing it to the blockchain repository; the request agent subsystem selecting description information of second target data from the description information, generating a data permission request, and publishing it to the blockchain repository; the access agent subsystem obtaining the data permission request and approving it, publishing the approval information to the blockchain repository; the request agent subsystem obtaining the approval information and determining whether the approval was successful; if so, publishing a data access request for the second target data to the blockchain repository; and the access agent subsystem obtaining the data access request for the second target data from the blockchain repository and providing the second target data to the data requester corresponding to the request agent subsystem.

[0003] In the above invention applications, the second target data is provided to the data demander corresponding to the request agent subsystem, that is, the data is directly shared with the data demander. However, the model of directly sharing maternal and child health care data can no longer meet the current data security and regulatory requirements due to problems such as privacy leakage, lax access control, lack of compliance, weak security protection and low efficiency of cross-institutional collaboration.

[0004] Therefore, the present invention provides a method and system for secure sharing and exchange of maternal and child health care data. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] To address the shortcomings of existing technologies, this invention provides a method and system for secure sharing and exchange of maternal and child health care data. This invention uses attribute-based encryption to decrypt metadata keys, obtains the data storage location, creates a physically isolated secure zone, inputs the metadata key into the enclave, decrypts the data ontology key in the enclave's memory, and uses this key to decrypt the data. Research code runs within a TEE (Technical Environment Execution Environment), outputting only compliant calculation results. From key decryption to data computation, everything is completed in a secure environment with zero exposure of plaintext data. By forcibly outputting compliant results such as statistical characteristics through the TEE, it directly meets medical data regulatory requirements. Hardware isolation and memory encryption technologies effectively resist internal and external attacks. Lightweight operation and parallel processing ensure high efficiency, and dynamic policy adaptation enhances flexibility, thereby solving the technical problems described in the background art.

[0007] (II) Technical Solution

[0008] To achieve the above objectives, the present invention provides a method for secure sharing and exchange of maternal and child health care data, comprising the following steps:

[0009] Patients initiate authorization using their DID identity with zero-knowledge proof, define a three-dimensional policy, and the attribute-based cryptographic engine compiles the policy into executable logic, generating a policy fingerprint and a dynamic access token (DAT).

[0010] When the data user submits an access request to the privacy gateway, the privacy gateway initiates dual-channel verification. Channel 1 performs on-chain verification, sends DAT to the smart contract, and outputs the on-chain verification result.

[0011] Channel 2 performs environmental verification, the privacy gateway collaborates with the spatiotemporal verification engine to perform environmental verification, the policy compiler parses the Boolean expression in the patient's DAT, the input data user request parameters are used to perform real-time logical operations, and the output is True / False;

[0012] Once the dual-channel combined verification result passes, the attribute-based encryption decrypts the metadata key, obtains the data storage location, creates a physically isolated secure area, inputs the metadata key into the enclave, decrypts the data ontology key in the enclave's memory, and uses this key to decrypt the data. The research code runs within the TEE and only outputs compliant calculation results.

[0013] Furthermore, patients log in to the decentralized digital identity (DID) system, which uses zero-knowledge proof technology to verify the validity of their identity. After logging in, patients define three-dimensional policy elements on the privacy protection interface, including shareable data categories, usage scenarios, and spatiotemporal constraints, and output a structured policy statement.

[0014] Zero-knowledge proofs are cryptographic protocols that allow one party (the prover) to prove a statement to another party (the verifier) ​​that it is true, without revealing any additional information beyond the statement's truth. Their core goal is to achieve a balance between privacy and verifiability. Zero-knowledge proofs must satisfy three fundamental properties: integrity, reliability, and zero-knowledge. Integrity means that if the statement is true, an honest prover can convince the verifier to accept the proof. Reliability means that if the statement is false, the prover cannot deceive the verifier. Zero-knowledge means that the verifier only knows whether the statement is true or false and cannot obtain any additional information, such as secret content or data details.

[0015] Data Category: Select the shareable data types, including prenatal checkup records, genetic data, and newborn screening results. Use Case: Select preset scenario labels, including clinical diagnosis and treatment, scientific research analysis, insurance underwriting, and government statistics. Spatiotemporal Constraints: Set the start and end dates of the effective time window and the geofence, such as limiting the geofence to medical institutions within the city.

[0016] Furthermore, the policy compiler transforms the structured policy declaration into an executable Boolean logic expression: (data type = gene) AND (scenario = scientific research) AND (validity period ≥ current time). The attribute-based encryption engine performs a two-channel operation to generate a random metadata key, encrypts the key using the compiled policy logic, and calculates the policy's unique digital fingerprint.

[0017] Furthermore, a core data structure for the token is constructed, including an encrypted policy binding key, a policy digital fingerprint, and a patient anonymization DID identifier. The token is encrypted and signed using a consortium blockchain root certificate, and blockchain smart contract call parameters are embedded to output an encrypted and signed dynamic access token (DAT).

[0018] The root certificate of a consortium blockchain is the highest level of trust anchor in the consortium blockchain ecosystem. It is issued by a certificate authority (Consortium CA) jointly authorized by the consortium members and is used to verify the identity and legitimacy of on-chain nodes, users and smart contracts. Its core function is to establish a controllable trust system in a distributed environment, which is in stark contrast to the anonymity of public blockchains.

[0019] Embedding blockchain smart contract call parameters means melting the contract call instructions into the DAT instead of attaching external parameters. The contract_call structure, which contains the contract address and opcode, is written when the DAT is constructed. The smart contract automatically triggers operations such as registration / revocation by parsing the contract_call of the DAT.

[0020] Furthermore, the data user submits an access request to the privacy gateway. The request includes the data type, usage scenario, current spatiotemporal information, and the DAT token held. The spatiotemporal information includes GPS coordinates and timestamps.

[0021] Furthermore, after receiving the DAT from the data user, the smart contract performs digital signature verification, which involves extracting the original data content from the DAT, decrypting and verifying it using the public key of the consortium root certificate pre-installed in the contract, and comparing the "decrypted data hash value" with the "recalculated data hash value". If the verification result matches completely, it proves that the DAT has not been tampered with; if the verification result does not match, access is immediately denied.

[0022] A smart contract is a digital protocol that executes automatically on a blockchain. Essentially, it's a computer program stored on the blockchain. It defines the rights, obligations, and execution logic of the participating parties using code. When preset conditions are met, the contract automatically triggers and executes the relevant operations without the need for a third-party intermediary.

[0023] Furthermore, after the digital signature verification is successful, the smart contract extracts the policy fingerprint of the DAT token, queries the blockchain registry to obtain the current state, and outputs the on-chain verification result: ACTIVE allows continued verification, REVOKED immediately rejects (the token has expired), and UNREGISTERED immediately rejects (an invalid token).

[0024] When a DAT is created, the system writes the policy digital fingerprint into the consortium blockchain's dedicated registry. The registry uses key-value pairs for storage, namely policy fingerprint-state identifier, with the initial state marked as ACTIVE.

[0025] Furthermore, Channel 2 performs environmental verification. The privacy gateway, in collaboration with the spatiotemporal verification engine, performs environmental verification, including whether the current time is within the validity window and whether the requester's GPS coordinates are within the geofence.

[0026] The strategy compiler parses the Boolean expression (data type = gene) AND (scenario = scientific research) AND (validity period ≥ current time) in the patient's DAT, performs real-time logical operations on the input data and user request parameters, and outputs True / False.

[0027] Furthermore, if channel 1 outputs "allow" for continued verification and channel 2 outputs "True", then the dual-channel combined verification result is passed. The metadata key is then encrypted and decrypted using the attribute base, and the decrypted metadata key is used to obtain the data storage location.

[0028] A secure data sharing and exchange system for maternal and child health care includes:

[0029] The access token generation module allows patients to initiate authorization using their zero-knowledge proof DID identity, define a three-dimensional policy, and have the attribute-based encryption engine compile the policy into executable logic to generate a policy fingerprint and a dynamic access token DAT.

[0030] In the on-chain verification module, the data user submits an access request to the privacy gateway. The privacy gateway initiates dual-channel verification. Channel 1 performs on-chain verification, sends DAT to the smart contract, and outputs the on-chain verification result.

[0031] The environment verification module performs environment verification through channel 2, and the privacy gateway collaborates with the spatiotemporal verification engine to perform environment verification. The policy compiler parses the Boolean expression in the patient's DAT, performs real-time logical operations on the input data and user request parameters, and outputs True / False.

[0032] The data output module, when the dual-channel combined verification result passes, uses attribute-based encryption to decrypt the metadata key, obtains the data storage location, creates a physically isolated secure area, inputs the metadata key into the enclave, decrypts the data ontology key in the enclave memory, and uses this key to decrypt the data. The research code runs within the TEE and only outputs compliant calculation results.

[0033] (III) Beneficial Effects

[0034] This invention provides a method and system for secure sharing and exchange of maternal and child health care data, which has the following beneficial effects:

[0035] 1. Generate a policy fingerprint and a dynamic access token (DAT). Output the DAT as the "digital gene" of the entire process. Its policy fingerprint determines the technical path of all subsequent steps, replacing the traditional independent permission verification step. Subsequent steps (such as privacy gateway verification, smart contract status check, and environment verification) are all automatically triggered based on the same policy fingerprint, avoiding duplicate verification, significantly reducing the communication and computing overhead of the verification step, and improving the overall efficiency of the system.

[0036] 2. The privacy gateway initiates dual-channel verification. Channel 1 performs on-chain verification, sending DAT to the smart contract and outputting the on-chain verification result. Channel 1's on-chain verification leverages the immutability, distributed trust, and automated execution of smart contracts of the blockchain to significantly improve the security, real-time performance, and traceability of data access verification. Its core advantages lie in its tamper-proof verification and real-time status checks to prevent token abuse, its millisecond-level response and automated execution to reduce human intervention, meeting medical data regulatory requirements, and providing a clear and traceable audit trail.

[0037] 3. The privacy gateway collaborates with the spatiotemporal verification engine to perform environment verification. The policy compiler parses the Boolean expressions in the patient's DAT, performs real-time logical operations on the input data user's request parameters, and outputs True / False. Channel 2's environment verification significantly improves the security, flexibility, and compliance of data access verification by dynamically verifying spatiotemporal constraints and policy logic. Its core advantage lies in the fact that even if the token is valid, non-compliant environments will still result in rejection. It supports complex Boolean logic, adapts to policy changes in real time, and has built-in spatiotemporal constraint verification to meet medical data regulatory requirements. It complements Channel 1, building a multi-dimensional security system.

[0038] 4. Attribute-based encryption is used to decrypt metadata keys, obtain the data storage location, create a physically isolated secure zone, input the metadata key into the enclave, decrypt the data ontology key in the enclave's memory, and then use this key to decrypt the data. Research code runs within a TEE, outputting only compliant calculation results. From key decryption to data computation, everything is completed in a secure environment, with zero exposure of plaintext data. The TEE forces the output of compliant results such as statistical characteristics, directly meeting medical data regulatory requirements. Hardware isolation and memory encryption technologies effectively resist internal and external attacks. Lightweight operation and parallel processing ensure high efficiency, while dynamic policy adaptation enhances flexibility. Attached Figure Description

[0039] Figure 1 This is a flowchart illustrating a method for secure sharing and exchange of maternal and child health care data according to the present invention.

[0040] Figure 2 This is a schematic diagram of the structure of a secure data sharing and exchange system for maternal and child health care according to the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] Please see Figure 1 This invention provides a method for secure sharing and exchange of maternal and child health care data, comprising the following steps:

[0043] Step 1: The patient initiates authorization using their zero-knowledge proof DID identity, defines a three-dimensional policy, and the attribute-based encryption engine compiles the policy into executable logic, generating a policy fingerprint and a dynamic access token DAT.

[0044] Step one includes the following:

[0045] Step 101: The patient logs into the system using a decentralized digital identity (DID) and verifies the validity of their identity using zero-knowledge proof technology, such as proving that they belong to a maternal and child health care institution without disclosing their specific identity.

[0046] Zero-knowledge proofs are cryptographic protocols that allow one party (the prover) to prove a statement to another party (the verifier) ​​that it is true, without revealing any additional information beyond the statement's truth. Their core goal is to achieve a balance between privacy and verifiability. Zero-knowledge proofs must satisfy three fundamental properties: integrity, reliability, and zero-knowledge. Integrity means that if the statement is true, an honest prover can convince the verifier to accept the proof. Reliability means that if the statement is false, the prover cannot deceive the verifier. Zero-knowledge means that the verifier only knows whether the statement is true or false and cannot obtain any additional information, such as secret content or data details.

[0047] Step 102: After logging in, the patient defines three-dimensional policy elements on the privacy protection interface, including shareable data categories, usage scenarios, and spatiotemporal constraints, and outputs a structured policy statement.

[0048] Data Category: Select the shareable data types, including prenatal checkup records, genetic data, and newborn screening results. Use Case: Select preset scenario labels, including clinical diagnosis and treatment, scientific research analysis, insurance underwriting, and government statistics. Spatiotemporal Constraints: Set the start and end dates of the effective time window and the geofence, such as limiting the geofence to medical institutions within the city.

[0049] Step 103: The policy compiler converts the structured policy declaration into an executable Boolean logic expression: (data type = gene) AND (scenario = scientific research) AND (validity period ≥ current time). The attribute-based encryption engine performs a two-channel operation to generate a random metadata key, encrypts the key using the compiled policy logic, and calculates the unique digital fingerprint of the policy.

[0050] Step 104: Construct the core data structure of the token, including the encrypted policy binding key, policy digital fingerprint and patient anonymization DID identifier, use the consortium blockchain root certificate to encrypt and sign the token, embed the blockchain smart contract call parameters, and output the encrypted signed dynamic access token DAT.

[0051] The root certificate of a consortium blockchain is the highest level of trust anchor in the consortium blockchain ecosystem. It is issued by a certificate authority (Consortium CA) jointly authorized by the consortium members and is used to verify the identity and legitimacy of on-chain nodes, users and smart contracts. Its core function is to establish a controllable trust system in a distributed environment, which is in stark contrast to the anonymity of public blockchains.

[0052] Embedding blockchain smart contract call parameters means melting the contract call instructions into the DAT instead of attaching external parameters. The contract_call structure, which contains the contract address and opcode, is written when the DAT is constructed. The smart contract automatically triggers operations such as registration / revocation by parsing the contract_call of the DAT.

[0053] When using it, combine the content of steps 101 to 104.

[0054] Patients initiate authorization using their DID identity with zero-knowledge proof, defining a three-dimensional policy. The attribute-based cryptographic engine compiles the policy into executable logic, generating a policy fingerprint and a dynamic access token (DAT). The output DAT serves as the "digital gene" of the entire process, with its policy fingerprint determining the technical path for all subsequent stages, replacing the traditional independent authorization verification stage. Subsequent stages (such as privacy gateway verification, smart contract state checks, and environment verification) are all automatically triggered based on the same policy fingerprint, avoiding duplicate verification, significantly reducing communication and computational overhead in the verification process, and improving overall system efficiency.

[0055] Step 2: The data user submits an access request to the privacy gateway. The privacy gateway initiates dual-channel verification. Channel 1 performs on-chain verification, sends DAT to the smart contract, and outputs the on-chain verification result.

[0056] Step two includes the following:

[0057] Step 201: The data user submits an access request to the privacy gateway. The request includes the data type, usage scenario, current spatiotemporal information, and the DAT token held. The spatiotemporal information includes GPS coordinates and timestamps. The privacy gateway initiates dual-channel verification. Channel 1 performs on-chain verification and sends DAT to the smart contract.

[0058] Step 202: After receiving the DAT from the data user, the smart contract performs digital signature verification, which involves extracting the original data content from the DAT, decrypting and verifying it using the public key of the consortium root certificate pre-installed in the contract, and comparing the "decrypted data hash value" with the "recalculated data hash value". If the verification result matches completely, it proves that the DAT has not been tampered with; if the verification result does not match, access is immediately denied.

[0059] A smart contract is a digital protocol that executes automatically on a blockchain. Essentially, it's a computer program stored on the blockchain. It defines the rights, obligations, and execution logic of the participating parties using code. When preset conditions are met, the contract automatically triggers and executes the relevant operations without the need for a third-party intermediary.

[0060] Step 203: After the digital signature verification is successful, the smart contract extracts the policy fingerprint of the DAT token, queries the blockchain registry to obtain the current status, and outputs the on-chain verification result: ACTIVE allows continued verification, REVOKED immediately rejects (token has expired), and UNREGISTERED immediately rejects (illegal token).

[0061] When a DAT is created, the system writes the policy digital fingerprint into the consortium blockchain's dedicated registry. The registry uses key-value pairs for storage, namely policy fingerprint-state identifier, with the initial state marked as ACTIVE.

[0062] When using this method, refer to steps 201 to 203:

[0063] Data users submit access requests to the privacy gateway, which then initiates dual-channel verification. Channel 1 performs on-chain verification, sending DAT to the smart contract and outputting the on-chain verification result. Channel 1's on-chain verification leverages the immutability, distributed trust, and automated execution of smart contracts of the blockchain to significantly improve the security, real-time performance, and traceability of data access verification. Its core advantages lie in its tamper-proof verification and real-time status checks to prevent token abuse, its millisecond-level response and automated execution to reduce human intervention, its compliance with medical data regulatory requirements, and its clear and traceable audit trail.

[0064] Step 3: Channel 2 performs environment verification. The privacy gateway collaborates with the spatiotemporal verification engine to perform environment verification. The policy compiler parses the Boolean expression in the patient's DAT, performs real-time logical operations on the input data and user request parameters, and outputs True / False.

[0065] Step three includes the following:

[0066] Step 301: Channel 2 performs environment verification. The privacy gateway, in collaboration with the spatiotemporal verification engine, performs environment verification, including whether the current time is within the validity window and whether the requester's GPS coordinates are within the geofence.

[0067] Step 302: The strategy compiler parses the Boolean expression (data type = gene) AND (scenario = scientific research) AND (validity period ≥ current time) in the patient's DAT, performs real-time logical operations on the input data and user request parameters, and outputs True / False.

[0068] When using this method, refer to steps 301 and 302:

[0069] Channel 2 performs environment verification. The privacy gateway collaborates with the spatiotemporal verification engine to perform environment verification. The policy compiler parses the Boolean expressions in the patient's Data Access Authorization File (DAT), performs real-time logical operations on the input data user's request parameters, and outputs True / False. Channel 2's environment verification significantly improves the security, flexibility, and compliance of data access verification by dynamically validating spatiotemporal constraints and policy logic. Its core advantage lies in the fact that even if the token is valid, non-compliant environments will still result in rejection. It supports complex Boolean logic, adapts to policy changes in real time, and has built-in spatiotemporal constraint verification to meet medical data regulatory requirements. It complements Channel 1, constructing a multi-dimensional security system.

[0070] Step 4: When the dual-channel combined verification result passes, use attribute-based encryption to decrypt the metadata key, obtain the data storage location, create a physically isolated secure area, input the metadata key into the enclave, decrypt the data ontology key in the enclave memory, and use the key to decrypt the data. The research code runs within the TEE and only outputs compliant calculation results.

[0071] Step four includes the following:

[0072] Step 401: When Channel 1 outputs "Allow verification to continue" and Channel 2 outputs "True", the dual-channel combined verification result is passed. Use Attribute Base Encryption (ABE) to decrypt the metadata key and use the decrypted metadata key to obtain the data storage location.

[0073] Step 402: Create a physically isolated secure zone using Intel SGX or AMD SEV technology. Encrypted data is input into the enclave through a secure channel and decrypted only in the enclave's memory, meaning plaintext never touches the disk. Input the metadata key into the enclave, decrypt the data ontology key in the enclave's memory, and use this key to decrypt the data. The research code runs within the TEE and only outputs compliant calculation results, such as statistical features.

[0074] Scientific code is the core logic driving data analysis within a TEE (Technical Engineering Environment). It refers to computer programs specifically designed for scientific research, used to extract knowledge from raw data. In the context of medical gene analysis, it is the "transformation engine" that converts encrypted gene data into statistical features.

[0075] When using this method, refer to steps 401 and 402:

[0076] Once the dual-channel combined verification passes, the metadata key is decrypted using attribute-based encryption to obtain the data's storage location. A physically isolated secure zone is created, the metadata key is input into the enclave, the data ontology key is decrypted in the enclave's memory, and the data is then decrypted using this key. The research code runs within the TEE, outputting only compliant calculation results. From key decryption to data computation, everything is completed in a secure environment with zero exposure of plaintext data. The TEE forces the output of compliant results such as statistical features, directly meeting medical data regulatory requirements. Hardware isolation and memory encryption technologies effectively resist internal and external attacks. Lightweight operation and parallel processing ensure high efficiency, while dynamic policy adaptation enhances flexibility.

[0077] Please see Figure 2 This invention provides a secure data sharing and exchange system for maternal and child health care, comprising:

[0078] The access token generation module allows patients to initiate authorization using their zero-knowledge proof DID identity, define a three-dimensional policy, and have the attribute-based cryptographic engine compile the policy into executable logic, generating a policy fingerprint and a dynamic access token DAT.

[0079] In the on-chain verification module, the data user submits an access request to the privacy gateway. The privacy gateway initiates dual-channel verification. Channel 1 performs on-chain verification, sends DAT to the smart contract, and outputs the on-chain verification result.

[0080] The environment verification module performs environment verification through channel 2, and the privacy gateway collaborates with the spatiotemporal verification engine to perform environment verification. The policy compiler parses the Boolean expression in the patient's DAT, performs real-time logical operations on the input data and user request parameters, and outputs True / False.

[0081] The data output module, when the dual-channel combined verification result passes, uses attribute-based encryption to decrypt the metadata key, obtains the data storage location, creates a physically isolated secure area, inputs the metadata key into the enclave, decrypts the data ontology key in the enclave memory, and uses this key to decrypt the data. The research code runs within the TEE and only outputs compliant calculation results.

[0082] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0083] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0084] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A method for secure sharing and exchange of maternal and child health care data, characterized in that: Includes the following steps: Patients initiate authorization using their DID identity with zero-knowledge proof, define a three-dimensional policy, and the policy compiler compiles the policy into executable logic, generating a policy fingerprint and a patient dynamic access token (DAT). Define the three-dimensional strategy elements, including the type of shareable data, use cases, and spatiotemporal constraints, and output a structured strategy declaration; Shareable data types include prenatal checkup records, genetic data, and newborn screening results. Use cases are preset scenario labels, which include clinical diagnosis and treatment, scientific research analysis, insurance underwriting, and government statistics. Spatiotemporal constraints are the setting of effective time window start and end dates and geofences. The policy compiler transforms the structured policy declaration into an executable Boolean logic expression: (data type = gene) AND (scenario = scientific research) AND (validity period ≥ current time). The attribute-based encryption engine performs a two-channel operation to generate a random metadata key, encrypts the key using the compiled policy logic, and calculates the policy's unique digital fingerprint. The data user submits an access request to the privacy gateway. The privacy gateway initiates dual-channel verification. Channel 1 performs on-chain verification, sends the patient's dynamic access token (DAT) to the smart contract, and outputs the on-chain verification result. Channel 2 performs environment verification. The privacy gateway collaborates with the spatiotemporal verification engine to perform environment verification. The policy compiler parses the Boolean expression in the patient's dynamic access token (DAT), performs real-time logical operations on the input data and user request parameters, and outputs True / False. Once the dual-channel combined verification result passes, the attribute-based encryption engine is used to decrypt the metadata key, obtain the data storage location, create a physically isolated secure area, input the metadata key into the enclave, decrypt the data ontology key in the enclave memory, and decrypt the data using the data ontology key. The research code runs within the TEE and only outputs compliant calculation results.

2. The method for secure sharing and exchange of maternal and child health care data according to claim 1, characterized in that: The core data structure of the token is constructed, including an encrypted policy binding key, a policy digital fingerprint, and a patient anonymization DID identifier. The token is encrypted and signed using a consortium root certificate, and blockchain smart contract call parameters are embedded to output an encrypted signed patient dynamic access token (DAT).

3. The method for secure sharing and exchange of maternal and child health care data according to claim 1, characterized in that: The data is submitted to the privacy gateway. The request includes the data type, usage scenario, current spatiotemporal information, and the patient dynamic access token (DAT) held. The spatiotemporal information includes GPS coordinates and timestamps.

4. The method for secure sharing and exchange of maternal and child health care data according to claim 1, characterized in that: After receiving the patient dynamic access token (DAT) from the data user, the smart contract performs digital signature verification. This involves extracting the original data content from the DAT, decrypting it using the pre-installed public key of the consortium root certificate, and comparing the "decrypted data hash value" with the "recalculated data hash value." If the verification results match perfectly, it proves that the DAT has not been tampered with; otherwise, access is immediately denied.

5. The method for secure sharing and exchange of maternal and child health care data according to claim 1, characterized in that: After the digital signature verification is successful, the smart contract extracts the policy fingerprint of the patient's dynamic access token (DAT), queries the blockchain registry to obtain the current status, and outputs the on-chain verification result: ACTIVE allows continued verification, REVOKED immediately rejects the request as the token has expired, and UNREGISTERED immediately rejects the request as an invalid token.

6. The method for secure sharing and exchange of maternal and child health care data according to claim 1, characterized in that: Channel 2 performs environment verification. The privacy gateway collaborates with the spatiotemporal verification engine to perform environment verification, including whether the current time is within the validity window and whether the requester's GPS coordinates are within the geofence. The policy compiler parses the Boolean expression (data type = gene) AND (scenario = scientific research) AND (validity period ≥ current time) in the patient dynamic access token DAT, performs real-time logical operations on the input data and user request parameters, and outputs True / False.

7. The method for secure sharing and exchange of maternal and child health care data according to claim 1, characterized in that: If channel 1 outputs "allow" for continued verification and channel 2 outputs "True", then the dual-channel combined verification result is successful. The attribute-based encryption engine is used to decrypt the metadata key, and the decrypted metadata key is used to obtain the data storage location.

8. A secure data sharing and exchange system for maternal and child health care, used to implement the method described in any one of claims 1 to 7, characterized in that: include: The access token generation module allows patients to initiate authorization using their zero-knowledge proof DID identity, define a three-dimensional policy, and have the policy compiler compile the policy into executable logic, generating a policy fingerprint and a dynamic access token (DAT) for the patient. In the on-chain verification module, the data user submits an access request to the privacy gateway. The privacy gateway initiates dual-channel verification. Channel 1 performs on-chain verification, sends the patient's dynamic access token (DAT) to the smart contract, and outputs the on-chain verification result. The environment verification module performs environment verification through channel 2, and the privacy gateway collaborates with the spatiotemporal verification engine to perform environment verification. The policy compiler parses the Boolean expression in the patient's dynamic access token (DAT), performs real-time logical operations on the input data and user request parameters, and outputs True / False. The data output module, when the dual-channel combined verification result passes, uses the attribute-based encryption engine to decrypt the metadata key, obtains the data storage location, creates a physically isolated secure area, inputs the metadata key into the enclave, decrypts the data ontology key in the enclave memory, and decrypts the data using the data ontology key. The research code runs within the TEE and only outputs compliant calculation results.

Images