Blockchain-based neural detection data encryption storage and permission control method and system

Abstract

The application discloses a blockchain-based neural detection data encryption storage and permission control method and system, relates to the technical field of data encryption and permission control, and solves the technical problem that it is difficult to find hidden abnormal operations across multiple nodes and over time through correlation analysis of operation paths; a data index is constructed through a Merkle tree structure, zero-knowledge proof accompanying the data index is set, a general permission operation set and a subject-object relationship of data access are set, an operation permission logic is established as a directed graph, operation permission complexity is calculated, operation data finally operated by a user is matched with an operation path, and according to user access behavior, an abnormal mode is extracted through a GNN graph neural network, user permission is immediately frozen for abnormal operation, and an evidence chain is recorded on a blockchain; and the operation path and user behavior mode are analyzed through the GNN graph neural network, and hidden abnormal operations across multiple nodes and over time can be recognized.

Description

Technical Field

[0001] This invention belongs to the field of data encryption and access control, specifically a blockchain-based method and system for encrypted storage and access control of neural network detection data. Background Technology

[0002] Neurological data, as crucial information reflecting the functional state of the human nervous system, plays an irreplaceable role in various fields such as medical diagnosis, disease research, and neuroscience exploration. For example, in the diagnosis of epilepsy, the neural electrical signal data obtained by electroencephalography (EEG) can accurately capture the abnormal brain electrical characteristics during epileptic seizures, providing important evidence for doctors to formulate personalized treatment plans. In the research of neurodegenerative diseases such as Alzheimer's disease, neural activity data obtained through functional magnetic resonance imaging (fMRI) helps to understand the mechanisms of disease development and provides clues for the development of effective therapeutic drugs and interventions.

[0003] However, neurological testing data is highly sensitive and privacy-sensitive. This data not only contains patients' personal physiological characteristics but may also involve their health status, medical history, and other private information. Data breaches can have serious negative impacts on patients. Therefore, ensuring the security of neurological testing data during storage and use has become a critical issue that urgently needs to be addressed.

[0004] Traditional neural network detection data encryption storage and access control schemes rely on rule engines, such as threshold alarms, but cannot identify complex behavioral patterns, such as potential attacks like "multiple attempts to access data from different departments in a short period of time." They also lack the correlation analysis of operation paths by graph neural networks (GNNs), making it difficult to detect hidden abnormal operations across multiple nodes and time periods. Summary of the Invention

[0005] This invention aims to solve at least one of the technical problems existing in the prior art; to this end, this invention proposes a blockchain-based method and system for encrypted storage and access control of neural detection data, which is used to solve the technical problem of lacking correlation analysis of operation paths and making it difficult to detect hidden abnormal operations across multiple nodes and across time.

[0006] To address the aforementioned problems, the first aspect of this invention provides a blockchain-based method and system for encrypted storage and access control of neural network detection data, comprising the following steps:

[0007] The business logic of neural detection data is divided into several levels, and the data of each level is segmented according to a preset time window and access frequency to form several data fragments;

[0008] Based on the data categories in the data shards, the neural detection data is divided by sensitivity, and sensitivity labels are added to the data. The importance level of the data is analyzed for each level of data shards.

[0009] Data fragments at different levels are encrypted to generate key pairs. A decentralized storage network is built using the IPFS+Filecoin protocol. The keys are then encrypted again and stored along with the ciphertext of the data fragments at edge nodes.

[0010] The storage location data of the data shards is anchored to the blockchain using SHA-256 hash, and the hash value of the data shards, user operation access logs and timestamps are uploaded to the blockchain. A Merkle tree structure is used to build a data index, and a ZKP zero-knowledge proof is set to accompany the access to the data index.

[0011] Set up a general set of permission operations and the subject-object relationship for data access. By establishing the operation permission logic as a directed graph, calculate the operation permission complexity. Match the operation path based on the final operation data of the user operation. Based on the user access behavior, extract abnormal patterns through a GNN graph neural network. Immediately freeze user permissions for abnormal operations and record the evidence chain on the blockchain.

[0012] Optionally, in one example of the above aspects, the business logic of neural detection data is divided into several levels, and the data of each level is segmented according to a preset time window and access frequency to form several data fragments, including the following steps:

[0013] Based on the business logic of neural detection data, which categorizes data into public data, internal data, confidential data, and core data, the data is divided into L levels, where L = {public, internal, confidential, core}.

[0014] The data at each level is divided into several data slices according to a preset time window Tw. The data slice D(i,j,k) is defined, where i is the data type, j is the time slice, and k is the level.

[0015] Based on the average access frequency of data in the data shards, the data shard access frequency threshold is set, and the data shards are classified into high-frequency access shards, second-highest frequency access shards, medium-frequency access shards, and low-frequency access shards.

[0016] Optionally, in one example of the above aspects, the neural detection data is categorized by sensitivity based on the data category within the data shards, and sensitivity labels are added to the data. For each level of data shards, the importance level of the data is analyzed, including the following steps:

[0017] Based on the data categories in the data fragments, public-level data is classified as non-sensitive data, and personal information data in internal-level data is classified as ordinary sensitive data; personal information data, raw detection data, and detection result data in confidential-level data and core-level data are classified as high-level sensitive data, and data in confidential-level data and core-level data other than high-level sensitive data are classified as ordinary sensitive data.

[0018] Add sensitivity labels to data at each level;

[0019] Based on the patient ID, relevant departments, test items, and test result keywords in the data segments;

[0020] For data with the same patient ID, the patient ID similarity is assigned a value of 1; otherwise, it is assigned a value of 0. The mean cosine similarity between the departments involved, test items, and test result keywords of the test data is used as the similarity of the departments involved, test items, and test result keywords, respectively. The weighted average of each similarity is then used to obtain the data similarity analysis value.

[0021] Data with similarity analysis values ​​greater than a threshold are set as high similarity data. Associated edges are added between high similarity data, the number of associated edges is obtained, and the data is sorted according to the number of associated edges. Data ranked in the [0%, 30%] range is set as high importance data, data ranked in the (30%, 60%] range is set as medium importance data, and data ranked in the (60%, 100%] range is set as ordinary data.

[0022] Optionally, in one example of the above aspects, the data shards at different levels are encrypted to generate key pairs. A decentralized storage network is built using the IPFS+Filecoin protocol. The keys are then encrypted again and stored along with the ciphertext of the data shards at edge nodes, including the following steps:

[0023] For public-level data fragments, plaintext or HMAC-SHA1 checksums are transmitted directly, and the key is not stored.

[0024] For data shards at the internal level, the data is encrypted using the AES-192 algorithm to generate a symmetric key Ksym. Ksym is then encrypted using the department's public key PKdept to generate Ckey = RSA(PKdept, Ksym). The data data in the data shard is encrypted using the AES algorithm to generate Cdata = AES(Ksym, data), and Cdata is stored on the local edge node.

[0025] For confidential data fragments, generate an independent key Ksymi for each data fragment, encrypt Ksymi with the ECC-256 public key PKdata to generate Ckeyi = ECC(PKdata, Ksymi), encrypt the data datai in the data fragment with the AES algorithm to generate Cdatai = AES(Ksymi, datai), and store Cdatai to the local edge node.

[0026] For core-level data shards, an independent key Ksym is generated for each data shard, and a one-time key Kqkd is generated through the QKD system. The one-time key Kqkd and Ksym are combined to generate the final key Kfinal = XOR(Kqkd, SHA-3(Ksym)). The data datac in the data shard is encrypted using the AES algorithm to generate Cdatac = AES(Ksymc, datac), and Cdatac is stored to the local edge node.

[0027] A decentralized storage network is built using the IPFS+Filecoin protocol. For data shards at the internal level, the key Ckey is stored in the edge node with the most associated edges with the data in the local edge node.

[0028] For data sharding at the confidential and core levels, the keys Ckeyi and Ckeyc are divided into several subkeys and stored at the edge nodes.

[0029] Optionally, in one example of the above aspects, the keys Ckeyi and Ckeyc are split into several subkeys and stored in the edge node, including the following steps:

[0030] Using the Shamir secret sharing scheme, if the keys Ckeyi and Ckeyc are split into n pieces, k pieces are needed to recover them:

[0031]

[0032] Where xi is the i-th subkey, f(xi) is the random polynomial of the i-th subkey, and p is a large prime number satisfying p>d and p>n;

[0033] Filter edge nodes that have associated edges with the data in the local edge nodes, and sort the filtered edge nodes by the degree of association according to the number of associated edges from most to least;

[0034] The subkeys are sorted according to their relevance and stored sequentially on different edge nodes.

[0035] Optionally, in one example of the above aspects, the storage location data of the data shard is anchored to the blockchain via a SHA-256 hash, including the following steps:

[0036] Calculate the hash value of the data shard in each level, generate a hash value H(i,j,k) = SHA-256(D(i,j,k)), and store the hash value in the blockchain;

[0037] By using a dynamic pseudonymization and reversible encryption mechanism to create a pseudonym mapping table, a unique pseudonym PID = HMAC(RealID, Ktenant) is generated for each data shard. Here, RealID is the real ID of the patient / research subject of the data, and Ktenant is the tenant's private key.

[0038] Based on the unique pseudonym of the data in the data shard and the storage address of the data on the edge node, generate a pseudonym-data storage address mapping table M = {PID → RealID → Storage Address}, store the pseudonym-data storage address mapping table on the blockchain, and record the hash of the mapping table: HM = SHA-256(M).

[0039] Optionally, in one example of the above aspects, the hash values ​​of data shards, user operation access logs, and timestamps are uploaded to the blockchain, a data index is constructed using a Merkle tree structure, and a ZKP zero-knowledge proof is set to accompany access to the data index, including the following steps:

[0040] Access data for data in data shards is obtained: user operation access logs and timestamps, along with the data shard hash value H(i,j,k), uploaded to the blockchain, and the storage location of the access data is recorded;

[0041] A Merkle tree structure is used to construct the data index: Index = {H(i,j,k) → (access data storage location, access frequency), with the data shard hash value as the leaf node to construct a binary Merkle tree;

[0042] Leaf nodes are grouped in pairs. If the number of nodes is odd, the last node is copied once before grouping. Otherwise, they are grouped directly.

[0043] Concatenate the hash values ​​of the nodes in the group and then hash them again;

[0044] Generate Merkle paths for the hierarchical data, repeating the above process until a unique root node hash value is generated.

[0045] The root hash serves as a digital fingerprint for the entire hierarchical data, used for verifying access to hierarchical data.

[0046] Set up the ZKP zero-knowledge proof attached to the access data index, including: setting the input as: user private key, data fragment hash value and access permission policy, with the constraint: verifying whether the user public key meets the access permission requirements;

[0047] User run proof generation algorithm: π←Prove(user private key, data fragment hash value, Policy, CRS), where CRS is a public reference string;

[0048] To perform verification, the blockchain node runs the verification algorithm:

[0049] {0,1}←Verify(π, user public key, data shard hash, Policy, CRS)

[0050] If the return value is 1, it means the user has the right to access.

[0051] Optionally, in one example of the above aspects, a general set of permission operations and the subject-object relationship for data access are set. By establishing the operation permission logic as a directed graph, the calculation of operation permissions becomes complex. Based on the final operation data of the user operation, the operation path is matched, including the following steps:

[0052] Set up a set of general permission operations, and set up atomic operations, including: create, read, update, delete, as well as data export and sharing;

[0053] Constructing the subject-object relationship for data access:

[0054] Perform subject modeling for data access, constructing the accessing user's ID and department attribute as the subject;

[0055] Perform object modeling for data access, taking data at each level as the object, and set access permissions for public level data, internal level data, confidential level data and core level data based on the data's sensitivity labels, as well as access permissions for high-level sensitive data and ordinary sensitive data in the sensitivity labels;

[0056] The operation permission logic is established as a directed graph. Directed graph modeling is performed for data at each level. Nodes are set as data of each data segment and the main body of data access. The edges of the directed graph are permission operations and condition judgments.

[0057] The complexity of the operation is calculated as MV(G) = E - N + 2, where E is the number of edges traversed to complete the operation and N is the number of nodes traversed to complete the operation.

[0058] Based on the final operation data of the user's operation, and according to the operation permission logic which is a directed graph, extract all operation paths from the user's corresponding subject node to the final object node;

[0059] Calculate the operation permission complexity of all proposed operation paths, and select the operation path with the smallest operation permission complexity as the final matched operation path.

[0060] Optionally, in one example of the above aspects, based on user access behavior, anomaly patterns are extracted using a GNN graph neural network, user permissions are immediately frozen for abnormal operations, and the chain of evidence is recorded on the blockchain, including the following steps:

[0061] Based on the user's access behavior to be detected, the access behavior is synchronized to the directed graph of operation permission logic. Each object node in the directed graph is marked in the access behavior, and the user's subject node is also marked.

[0062] Obtain historical data of abnormal and normal operations from historical access data, synchronize the historical access data to the corresponding operation permission logic in the directed graph, mark the corresponding labeled directed graph as abnormal or normal operation, and input the labeled data and the access permissions corresponding to the object nodes into the GNN graph neural network for training.

[0063] The trained GNN graph neural network is used to identify user access behavior to be detected, and to determine whether it is abnormal or normal operation.

[0064] For any abnormal operation, immediately freeze the user's permissions, calculate the SHA-256 hash value of the abnormal operation log, and record the evidence chain on the blockchain.

[0065] According to another aspect of this disclosure, a blockchain-based encrypted storage and access control system for neural detection data is provided. This system uses the blockchain-based encrypted storage and access control method described above to achieve encrypted storage and access control of neural detection data.

[0066] Compared with the prior art, the beneficial effects of the present invention are:

[0067] This invention constructs a Merkle tree using the hash values ​​of multiple data shards as leaf nodes, and generates a root hash through layer-by-layer hash calculation. Any modification to a data shard will cause a change in the root hash, creating a "one-size-fits-all" verification mechanism. Users only need to provide the path hash from the data shard to the root hash to verify data integrity, without needing to download all the data. When adding or deleting data shards, only the hash of the affected path needs to be recalculated, without reconstructing the entire tree, adapting to scenarios with high-frequency updates in neural network detection data.

[0068] This invention accelerates data integrity checks through the synergy of Merkle trees and ZKP. Merkle trees support multi-path parallel verification, shortening the time required for large-scale data integrity checks. Regardless of data volume, ZKP enables efficient proof generation and verification, adapting to high-concurrency access scenarios. Data shard integrity is verified using SHA-256 + Merkle trees, while access permissions are verified using ZKP, forming a double insurance of "data + permissions." The blockchain's consensus mechanism ensures that a single malicious node cannot forge a large number of identities to tamper with data, and combined with ZKP, it prevents permission forgery.

[0069] This invention, through a universal set of permission operations and a defined subject-object relationship, clarifies the scope of each user's data operations, preventing unauthorized access caused by ambiguous permissions. Simultaneously, by utilizing a graph neural network (GNN) to analyze operation paths and user behavior patterns, it can automatically identify abnormal operations. By learning the graph structure of normal behavior, the GNN can efficiently detect operations deviating from the baseline, reducing manual monitoring costs. The combination of a directed graph model of operation permission logic and blockchain records forms a fully traceable path from "operation initiation → permission verification → data access." Attached Figure Description

[0070] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0071] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0072] Figure 2 This is a schematic diagram of the data fragmentation setting method of the present invention. Detailed Implementation

[0073] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0074] Please see Figures 1-2 The first aspect of this invention provides a blockchain-based method and system for encrypted storage and access control of neural network detection data, comprising the following steps:

[0075] The business logic of neural detection data is divided into several levels, and the data of each level is segmented according to a preset time window and access frequency to form several data fragments;

[0076] Based on the data categories in the data shards, the neural detection data is divided by sensitivity, and sensitivity labels are added to the data. The importance level of the data is analyzed for each level of data shards.

[0077] Data fragments at different levels are encrypted to generate key pairs. A decentralized storage network is built using the IPFS+Filecoin protocol. The keys are then encrypted again and stored along with the ciphertext of the data fragments at edge nodes.

[0078] The storage location data of the data shards is anchored to the blockchain using SHA-256 hash, and the hash value of the data shards, user operation access logs and timestamps are uploaded to the blockchain. A Merkle tree structure is used to build a data index, and a ZKP zero-knowledge proof is set to accompany the access to the data index.

[0079] Set up a general set of permission operations and the subject-object relationship for data access. By establishing the operation permission logic as a directed graph, calculate the operation permission complexity. Match the operation path based on the final operation data of the user operation. Based on the user access behavior, extract abnormal patterns through a GNN graph neural network. Immediately freeze user permissions for abnormal operations and record the evidence chain on the blockchain.

[0080] Specifically, in this embodiment, the data at each level is segmented according to a preset time window and access frequency, and data preprocessing is performed: non-numerical data is converted into hash values, and numerical data is normalized to [0,1]. The data is divided into fixed-size blocks Bj={b(j-1)k+1,…,bjk} according to the time window, where k is the block size.

[0081] The neural network detection data is divided into independent layers, with data shards set for each layer to prevent cross-layer data leakage. Data is also segmented using time windows to limit the amount of data that can be obtained in a single attack, reducing the risk of leakage. Sensitivity levels are labeled according to data categories to implement differentiated encryption strategies.

[0082] Layered key encryption facilitates the generation of independent key pairs for each data shard, with different keys capable of being configured with different management or encryption modes. Key shards are stored across multiple edge nodes, ensuring that even if a single node is compromised, the attacker cannot recover the complete key, consistent with Shamir's secret sharing theory.

[0083] By recording data access logs on the blockchain, patients can authorize or revoke data access permissions through smart contracts, thus fulfilling the GDPR's "right to be forgotten" requirement.

[0084] All operations are recorded on the blockchain for verification, allowing auditing agencies to track data flow and prevent internal personnel from abusing their privileges. Highly sensitive data is automatically replaced with hash values ​​before storage, and only authorized users can query this data using their private keys. Decryption policies are generated based on user roles to achieve fine-grained access control.

[0085] Each data shard generates a unique hash value using SHA-256, such as a fixed-length 256-bit string. Even if the original data is tampered with by 1 bit, the hash value will be completely different, forming a "digital fingerprint" for anti-counterfeiting. Blockchain-anchored notarization involves writing the hash value into the blockchain, utilizing the blockchain's distributed consensus mechanism to ensure the hash value is immutable, achieving a "physical binding" between the data shard and the blockchain. Through the cryptographic hash function SHA-256, there are currently no known quantum computing attack methods, ensuring long-term security.

[0086] A Merkle tree is constructed using the hash values ​​of multiple data shards as leaf nodes, and a root hash is generated through layer-by-layer hash calculation. Any modification to a data shard will cause a change in the root hash, creating a "one-size-fits-all" verification mechanism. Users only need to provide the path hash from the data shard to the root hash to verify data integrity, without needing to download all the data. When adding or deleting data shards, only the hash of the affected path needs to be recalculated, without reconstructing the entire tree, adapting to scenarios with high-frequency updates in neural network detection data.

[0087] ZKP (Zero-Knowledge Proof) proves that a user has the necessary permissions without revealing them. Users can use ZKP to prove they meet the access requirements without disclosing specific identity information or permission details. The mathematical completeness of ZKP ensures the proof cannot be forged, and the verification process does not rely on a trusted third party, meeting the principle of "minimum necessary disclosure" for medical data. When user permissions change, such as a doctor's reassignment, only the ZKP parameters need to be updated; there is no need to regenerate data fragments or keys, reducing the complexity of permission management.

[0088] By recording the entire lifecycle of data—including uploads, accesses, modifications, and deletions—user actions and timestamps are written to the blockchain, creating an immutable audit log. Smart contracts automatically check whether operations comply with preset rules; if violations are found, alerts are triggered and evidence of the violation is recorded.

[0089] Hash values ​​replace the original data on the blockchain; only the hash values ​​of data shards are stored instead of the original data, significantly reducing the storage load on the blockchain. Original data shards are stored on edge nodes, with the blockchain acting only as a "trust anchor," supporting petabyte-scale data storage needs.

[0090] Merkle trees and ZKP work together to accelerate data integrity checks. Merkle trees support multi-path parallel verification, shortening the time for large-scale data integrity checks. Regardless of the data volume, ZKP enables efficient proof generation and verification, adapting to high-concurrency access scenarios. Data shard integrity is verified using SHA-256 + Merkle trees, while access permissions are verified using ZKP, forming a double insurance of "data + permissions". The blockchain's consensus mechanism ensures that a single malicious node cannot forge a large number of identities to tamper with data, and combined with ZKP, it prevents permission forgery.

[0091] By defining a universal set of permission operations and subject-object relationships, the system clearly defines the scope of each user's data operations, preventing unauthorized access caused by ambiguous permissions. Simultaneously, by utilizing a graph neural network (GNN) to analyze operation paths and user behavior patterns, it can automatically identify abnormal operations. By learning the graph structure of normal behavior, the GNN can efficiently detect operations deviating from the baseline, reducing the cost of manual monitoring. The combination of a directed graph model of operation permission logic and blockchain records forms a fully traceable path from "operation initiation → permission verification → data access."

[0092] The system can quickly pinpoint the operation time, data range, and associated permissions, aiding in auditing and accountability. Upon detecting abnormal behavior, the system can immediately freeze user permissions, preventing potential risks. Compared to traditional post-event auditing, this real-time response mechanism significantly reduces the risk of data leakage, making it particularly suitable for highly sensitive scenarios such as finance and healthcare. The distributed ledger nature of blockchain ensures that all operation records are encrypted, stored, and immutable. GNN handles real-time analysis of behavioral patterns, while the blockchain permanently stores evidence; the combination of the two achieves a closed loop of "dynamic monitoring + static evidence preservation."

[0093] In one embodiment of the present invention, the business logic of neural detection data is divided into several levels, and the data of each level is segmented according to a preset time window and access frequency to form several data fragments, including the following steps:

[0094] Based on the business logic of neural detection data, which categorizes data into public data, internal data, confidential data, and core data, the data is divided into L levels, where L = {public, internal, confidential, core}.

[0095] The data at each level is divided into several data slices according to a preset time window Tw. The data slice D(i,j,k) is defined, where i is the data type, j is the time slice, and k is the level.

[0096] Based on the average access frequency of data in the data shards, the data shard access frequency threshold is set, and the data shards are classified into high-frequency access shards, second-highest frequency access shards, medium-frequency access shards, and low-frequency access shards.

[0097] In one embodiment of the present invention, the neural detection data is classified by sensitivity according to the data category in the data slices, and sensitivity labels are added to the data. The importance level of each data slice is analyzed, including the following steps:

[0098] Based on the data categories in the data fragments, public-level data is classified as non-sensitive data, and personal information data in internal-level data is classified as ordinary sensitive data; personal information data, raw detection data, and detection result data in confidential-level data and core-level data are classified as high-level sensitive data, and data in confidential-level data and core-level data other than high-level sensitive data are classified as ordinary sensitive data.

[0099] Add sensitivity labels to data at each level;

[0100] Based on the patient ID, relevant departments, test items, and test result keywords in the data segments;

[0101] For data with the same patient ID, the patient ID similarity is assigned a value of 1; otherwise, it is assigned a value of 0. The mean cosine similarity between the departments involved, test items, and test result keywords of the test data is used as the similarity of the departments involved, test items, and test result keywords, respectively. The weighted average of each similarity is then used to obtain the data similarity analysis value.

[0102] Data with similarity analysis values ​​greater than a threshold are set as high similarity data. Associated edges are added between high similarity data, the number of associated edges is obtained, and the data is sorted according to the number of associated edges. Data ranked in the [0%, 30%] range is set as high importance data, data ranked in the (30%, 60%] range is set as medium importance data, and data ranked in the (60%, 100%] range is set as ordinary data.

[0103] In one embodiment of the present invention, data from data shards at different levels is encrypted to generate key pairs. A decentralized storage network is constructed using the IPFS+Filecoin protocol. The keys are then encrypted again and stored along with the ciphertext of the data shards at edge nodes. This process includes the following steps:

[0104] For public-level data fragments, plaintext or HMAC-SHA1 checksums are transmitted directly, and the key is not stored.

[0105] For data shards at the internal level, the data is encrypted using the AES-192 algorithm to generate a symmetric key Ksym. Ksym is then encrypted using the department's public key PKdept to generate Ckey = RSA(PKdept, Ksym). The data data in the data shard is encrypted using the AES algorithm to generate Cdata = AES(Ksym, data), and Cdata is stored on the local edge node.

[0106] For confidential data fragments, generate an independent key Ksymi for each data fragment, encrypt Ksymi with the ECC-256 public key PKdata to generate Ckeyi = ECC(PKdata, Ksymi), encrypt the data datai in the data fragment with the AES algorithm to generate Cdatai = AES(Ksymi, datai), and store Cdatai to the local edge node.

[0107] For core-level data shards, an independent key Ksym is generated for each data shard, and a one-time key Kqkd is generated through the QKD system. The one-time key Kqkd and Ksym are combined to generate the final key Kfinal = XOR(Kqkd, SHA-3(Ksym)). The data datac in the data shard is encrypted using the AES algorithm to generate Cdatac = AES(Ksymc, datac), and Cdatac is stored to the local edge node.

[0108] A decentralized storage network is built using the IPFS+Filecoin protocol. For data shards at the internal level, the key Ckey is stored in the edge node with the most associated edges with the data in the local edge node. In this embodiment, if there are multiple edge nodes with the most associated edges, any one of them is selected for storage.

[0109] For data sharding at the confidential and core levels, the keys Ckeyi and Ckeyc are divided into several subkeys and stored at the edge nodes.

[0110] In one embodiment of the present invention, the keys Ckeyi and Ckeyc are divided into several sub-keys and stored in the edge node, including the following steps:

[0111] Using the Shamir secret sharing scheme, if the keys Ckeyi and Ckeyc are split into n pieces, k pieces are needed to recover them:

[0112]

[0113] Where xi is the i-th subkey, f(xi) is the random polynomial of the i-th subkey, and p is a large prime number satisfying p>d and p>n;

[0114] Filter edge nodes that have associated edges with the data in the local edge nodes, and sort the filtered edge nodes by the degree of association according to the number of associated edges from most to least;

[0115] The subkeys are sorted according to their relevance and stored sequentially on different edge nodes.

[0116] In one embodiment of the present invention, the storage location data of the data fragment is anchored to the blockchain via SHA-256 hash, including the following steps:

[0117] Calculate the hash value of the data shard in each level, generate a hash value H(i,j,k) = SHA-256(D(i,j,k)), and store the hash value in the blockchain;

[0118] By using a dynamic pseudonymization and reversible encryption mechanism to create a pseudonym mapping table, a unique pseudonym PID = HMAC(RealID, Ktenant) is generated for each data shard. Here, RealID is the real ID of the patient / research subject of the data, and Ktenant is the tenant's private key.

[0119] Based on the unique pseudonym of the data in the data shard and the storage address of the data on the edge node, generate a pseudonym-data storage address mapping table M = {PID → RealID → Storage Address}, store the pseudonym-data storage address mapping table on the blockchain, and record the hash of the mapping table: HM = SHA-256(M).

[0120] In one embodiment of the present invention, the hash value of the data shard, user operation access logs, and timestamps are uploaded to the blockchain, a data index is constructed using a Merkle tree structure, and a ZKP zero-knowledge proof is set to accompany the access to the data index, including the following steps:

[0121] Access data for data in data shards is obtained: user operation access logs and timestamps, along with the data shard hash value H(i,j,k), uploaded to the blockchain, and the storage location of the access data is recorded;

[0122] A Merkle tree structure is used to construct the data index: Index = {H(i,j,k) → (access data storage location, access frequency), with the data shard hash value as the leaf node to construct a binary Merkle tree;

[0123] Leaf nodes are grouped in pairs. If the number of nodes is odd, the last node is copied once before grouping. Otherwise, they are grouped directly.

[0124] Concatenate the hash values ​​of the nodes in the group and then hash them again;

[0125] Generate Merkle paths for the hierarchical data, repeating the above process until a unique root node hash value is generated.

[0126] The root hash serves as a digital fingerprint for the entire hierarchical data, used for verifying access to hierarchical data.

[0127] Set up the ZKP zero-knowledge proof attached to the access data index, including: setting the input as: user private key, data fragment hash value and access permission policy, with the constraint: verifying whether the user public key meets the access permission requirements;

[0128] User run proof generation algorithm: π←Prove(user private key, data fragment hash value, Policy, CRS), where CRS is a public reference string generated through trusted settings;

[0129] To perform verification, the blockchain node runs the verification algorithm:

[0130] {0,1}←Verify(π, user public key, data shard hash, Policy, CRS)

[0131] If the return value is 1, it means the user has the right to access.

[0132] In one embodiment of the present invention, a general permission operation set and a subject-object relationship for data access are set. By establishing the operation permission logic as a directed graph, the calculation of operation permissions is complex. Based on the final operation data of the user operation, the operation path is matched, including the following steps:

[0133] Set up a set of general permission operations, and set up atomic operations, including: create, read, update, delete, as well as data export and sharing;

[0134] Constructing the subject-object relationship for data access:

[0135] Perform subject modeling for data access, constructing the accessing user's ID and department attribute as the subject;

[0136] Perform object modeling for data access, taking data at each level as the object, and set access permissions for public level data, internal level data, confidential level data and core level data based on the data's sensitivity labels, as well as access permissions for high-level sensitive data and ordinary sensitive data in the sensitivity labels;

[0137] The operation permission logic is established as a directed graph. Directed graph modeling is performed for data at each level. Nodes are set as data of each data segment and the main body of data access. The edges of the directed graph are permission operations and condition judgments.

[0138] The complexity of the operation is calculated as MV(G) = E - N + 2, where E is the number of edges traversed to complete the operation and N is the number of nodes traversed to complete the operation.

[0139] Specifically, in this embodiment, an example is provided: the path to access highly sensitive data is LOGIN→ROLE_CHECK→DATA_SENSITIVITY_JUDGE→AUTH_2FA_005→DATA_READ_002, MV(G)=5-1+2.

[0140] For basic operations, atomic operations are set, including: create, read, update, delete, as well as data export and sharing. Each operation corresponds to a unique permission identifier; for example, after a user role is assigned the DATA_READ_002 permission, it can read the specified dataset but cannot modify it.

[0141] Based on the final operation data of the user's operation, and according to the operation permission logic which is a directed graph, extract all operation paths from the user's corresponding subject node to the final object node;

[0142] Calculate the operation permission complexity of all proposed operation paths, and select the operation path with the smallest operation permission complexity as the final matched operation path.

[0143] In one embodiment of the present invention, based on user access behavior, abnormal patterns are extracted using a GNN graph neural network, user permissions are immediately frozen for abnormal operations, and the evidence chain is recorded on the blockchain, including the following steps:

[0144] Based on the user's access behavior to be detected, the access behavior is synchronized to the directed graph of operation permission logic. Each object node in the directed graph is marked in the access behavior, and the user's subject node is also marked.

[0145] Obtain historical data of abnormal and normal operations from historical access data, synchronize the historical access data to the corresponding operation permission logic in the directed graph, mark the corresponding labeled directed graph as abnormal or normal operation, and input the labeled data and the access permissions corresponding to the object nodes into the GNN graph neural network for training.

[0146] The trained GNN graph neural network is used to identify user access behavior to be detected, and to determine whether it is abnormal or normal operation.

[0147] For any abnormal operation, immediately freeze the user's permissions, calculate the SHA-256 hash value of the abnormal operation log, and record the evidence chain on the blockchain.

[0148] In another embodiment of the present invention, a blockchain-based encrypted storage and access control system for neural detection data is provided. This system uses the blockchain-based encrypted storage and access control method described above to achieve encrypted storage and access control of neural detection data.

[0149] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A blockchain-based method for encrypted storage and access control of neural network detection data, characterized in that, Includes the following steps: The business logic of neural detection data is divided into several levels, and the data of each level is segmented according to a preset time window and access frequency to form several data fragments; Based on the data categories in the data shards, the neural detection data is divided by sensitivity, and sensitivity labels are added to the data. The importance level of the data is analyzed for each level of data shards. Data fragments at different levels are encrypted to generate key pairs. A decentralized storage network is built using the IPFS+Filecoin protocol. The keys are then encrypted again and stored along with the ciphertext of the data fragments at edge nodes. The storage location data of the data shards is anchored to the blockchain using SHA-256 hash, and the hash value of the data shards, user operation access logs and timestamps are uploaded to the blockchain. A Merkle tree structure is used to build a data index, and a ZKP zero-knowledge proof is set to accompany the access to the data index. Set up a general set of permission operations and the subject-object relationship for data access. By establishing the operation permission logic as a directed graph, calculate the operation permission complexity. Match the operation path based on the final operation data of the user operation. Extract abnormal patterns through GNN graph neural network based on the user access behavior. Immediately freeze user permissions for abnormal operations and record the evidence chain on the blockchain. This involves setting a general set of permission operations and establishing the subject-object relationship for data access. By creating a directed graph for the operation permission logic, the calculation of operation permissions becomes complex. Based on the final operation data of the user's operation, the operation path is matched, including the following steps: Set up a set of general permission operations, and set up atomic operations, including: create, read, update, delete, as well as data export and sharing; Constructing the subject-object relationship for data access: Perform subject modeling for data access, constructing the accessing user's ID and department attribute as the subject; Perform object modeling for data access, taking data at each level as the object, and set access permissions for public level data, internal level data, confidential level data and core level data based on the data's sensitivity labels, as well as access permissions for high-level sensitive data and ordinary sensitive data in the sensitivity labels; The operation permission logic is established as a directed graph. Directed graph modeling is performed for data at each level. Nodes are set as data of each data segment and the main body of data access. The edges of the directed graph are permission operations and condition judgments. Calculate the complexity of operation permissions. Where E is the number of edges traversed to complete the operation, and N is the number of nodes traversed to complete the operation; Based on the final operation data of the user's operation, and according to the operation permission logic which is a directed graph, extract all operation paths from the user's corresponding subject node to the final object node; Calculate the operation permission complexity of all proposed operation paths, and select the operation path with the smallest operation permission complexity as the final matched operation path.

2. The blockchain-based method for encrypted storage and access control of neural network detection data according to claim 1, characterized in that, The business logic of neural network detection data is divided into several levels. The data at each level is then segmented according to a preset time window and access frequency to form several data fragments, including the following steps: Based on the business logic of neural detection data, which categorizes data into public data, internal data, confidential data, and core data, the data is divided into L levels, where L = {public, internal, confidential, core}. The data at each level is divided into several data slices according to a preset time window Tw. The data slice D(i,j,k) is defined, where i is the data type, j is the time slice, and k is the level. Based on the average access frequency of data in the data shards, the data shard access frequency threshold is set, and the data shards are classified into high-frequency access shards, second-highest frequency access shards, medium-frequency access shards, and low-frequency access shards.

3. The blockchain-based method for encrypted storage and access control of neural network detection data according to claim 1, characterized in that, Based on the data categories in the data shards, the neural network detection data is categorized by sensitivity, and sensitivity labels are added to the data. For each level of data sharding, the importance level of the data is analyzed, including the following steps: Based on the data categories in the data fragments, public-level data is classified as non-sensitive data, and personal information data in internal-level data is classified as ordinary sensitive data; personal information data, raw detection data, and detection result data in confidential-level data and core-level data are classified as high-level sensitive data, and data in confidential-level data and core-level data other than high-level sensitive data are classified as ordinary sensitive data. Add sensitivity labels to data at each level; Based on the patient ID, relevant departments, test items, and test result keywords in the data segments; For data with the same patient ID, the patient ID similarity is assigned a value of 1; otherwise, it is assigned a value of 0. The mean cosine similarity between the departments involved, test items, and test result keywords of the test data is used as the similarity of the departments involved, test items, and test result keywords, respectively. The weighted average of each similarity is then used to obtain the data similarity analysis value. Data with similarity analysis values ​​greater than a threshold are set as high similarity data. Associated edges are added between high similarity data, the number of associated edges is obtained, and the data is sorted according to the number of associated edges. Data ranked in the [0%, 30%] range is set as high importance data, data ranked in the (30%, 60%] range is set as medium importance data, and data ranked in the (60%, 100%] range is set as ordinary data.

4. The blockchain-based method for encrypted storage and access control of neural network detection data according to claim 1, characterized in that, Encrypting data shards at different levels to generate key pairs, building a decentralized storage network using the IPFS+Filecoin protocol, and then encrypting the keys again and storing them along with the ciphertext of the data shards on edge nodes includes the following steps: For public-level data fragmentation, plaintext or... Checksum, no key is stored; For data shards at the internal level, the data is encrypted using the AES-192 algorithm to generate a symmetric key Ksym. Ksym is then encrypted using the department's public key PKdept to generate Ckey=RSA(PKdept,Ksym). The data data in the data shard is encrypted using the AES algorithm to generate Cdata=AES(Ksym,data), and Cdata is stored on the local edge node. For data fragments at the confidential level, an independent key Ksymi is generated for each data fragment. The public key PKdata is used to encrypt Ksymi, generating Ckeyi=ECC(PKdata,Ksymi). The data datai in the data fragment is encrypted using the AES algorithm, generating Cdatai=AES(Ksymi,datai). Cdatai is then stored on the local edge node. For core-level data sharding, an independent key Ksym is generated for each data shard, and a one-time key Kqkd is generated through the QKD system. The final key Kfinal is then generated by combining the one-time key Kqkd and Ksym: Kfinal = XOR(Kqkd, (Ksym)) encrypts the data datac in the data fragment using the AES algorithm, generates Cdatac=AES(Ksymc,datac), and stores Cdatac to the local edge node; A decentralized storage network is built using the IPFS+Filecoin protocol. For data shards at the internal level, the key Ckey is stored in the edge node with the most associated edges with the data in the local edge node. For data sharding at the confidential and core levels, the keys Ckeyi and Ckeyc are divided into several subkeys and stored at the edge nodes.

5. The blockchain-based method for encrypted storage and access control of neural network detection data according to claim 4, characterized in that, The keys Ckeyi and Ckeyc are split into several subkeys and stored in the edge nodes, including the following steps: Using the Shamir secret sharing scheme, if the keys Ckeyi and Ckeyc are split into n pieces, k pieces are needed to recover them: Where xi is the i-th subkey, f(xi) is the random polynomial of the i-th subkey, and p is a large prime number satisfying p>d and p>n; Filter edge nodes that have associated edges with the data in the local edge nodes, and sort the filtered edge nodes by the degree of association according to the number of associated edges from most to least; The subkeys are sorted according to their relevance and stored sequentially on different edge nodes.

6. The blockchain-based method for encrypted storage and access control of neural network detection data according to claim 1, characterized in that, Data fragment storage location data through Hash anchoring to the blockchain includes the following steps: Calculate the hash value of the data shards in each level, generating a hash value H(i,j,k) = (D(i,j,k)) stores the hash value in the blockchain; By using a dynamic pseudonymization and reversible encryption mechanism to create a pseudonym mapping table, a unique pseudonym PID=HMAC(RealID,Ktenant) is generated for each data shard. Here, RealID is the real ID of the patient / research subject of the data, and Ktenant is the tenant's private key. Based on the unique pseudonyms of the data in the data fragments and the storage addresses of the data at the edge nodes, generate a pseudonym-data storage address mapping table. The pseudonym-data storage address mapping table is stored on the blockchain, and the hash of the mapping table is recorded: .

7. The blockchain-based method for encrypted storage and access control of neural network detection data according to claim 1, characterized in that, The hash values ​​of data shards, user operation access logs, and timestamps are uploaded to the blockchain. A data index is built using a Merkle tree structure, and a ZKP zero-knowledge proof is set to accompany the access to the data index, including the following steps: Access data for data in data shards is obtained: user operation access logs and timestamps, along with the data shard hash value H(i,j,k), uploaded to the blockchain, and the storage location of the access data is recorded; A Merkle tree structure is used to construct the data index: Index={H(i,j,k)} (Access data storage location, access frequency), construct a binary Merkle tree using the data shard hash value as the leaf node; Leaf nodes are grouped in pairs. If the number of nodes is odd, the last node is copied once before grouping. Otherwise, they are grouped directly. Concatenate the hash values ​​of the nodes in the group and then hash them again; Generate Merkle paths for the hierarchical data, and repeat the above process until a unique root node hash value is generated; The root hash serves as a digital fingerprint for the entire hierarchical data, used for verifying access to hierarchical data. Set up the ZKP zero-knowledge proof attached to the access data index, including: setting the input as: user private key, data fragment hash value and access permission policy, with the constraint: verifying whether the user public key meets the access permission requirements; User run proof generation algorithm: Prove(user private key, data shard hash, Policy, CRS), where CRS is a public reference string; To perform verification, the blockchain node runs the verification algorithm: {0,1} Verify(π, user public key, data shard hash, policy, CRS) If the return value is 1, it means the user has the right to access.

8. The blockchain-based method for encrypted storage and access control of neural network detection data according to claim 1, characterized in that, Based on user access behavior, abnormal patterns are extracted using a GNN (Graph Neural Network). Abnormal operations are immediately frozen, and the evidence chain is recorded on the blockchain. This process includes the following steps: Based on the user's access behavior to be detected, the access behavior is synchronized to the directed graph of operation permission logic. Each object node in the directed graph is marked in the access behavior, and the user's subject node is also marked. Obtain historical data of abnormal and normal operations from historical access data, synchronize the historical access data to the corresponding operation permission logic in the directed graph, mark the corresponding labeled directed graph as abnormal or normal operation, and input the labeled data and the access permissions corresponding to the object nodes into the GNN graph neural network for training. The trained GNN graph neural network is used to identify user access behavior to be detected, and to determine whether it is abnormal or normal operation. For any abnormal operation, immediately freeze the user's permissions and calculate the abnormal operation log. The hash value is used to record the chain of evidence on the blockchain.

9. A blockchain-based encrypted storage and access control system for neural network detection data, characterized in that, The system employs the blockchain-based method for encrypted storage and access control of neural detection data as described in any one of claims 1-8 to achieve encrypted storage and access control of neural detection data.

Images