Secure intelligent transfer system for patient health data

Abstract

The application provides a data security intelligent transmission system for patient health, which comprises backbone equipment and mobile equipment, one mobile equipment is connected with one backbone equipment, and the mobile equipment is divided into acquisition equipment and monitoring equipment. The system realizes technical effects in the following ways: (1) ensuring safe transmission of patient health data, (2) effectively protecting patient privacy, and (3) significantly improving the service performance of a medical system. The system has wide application prospects in the field of intelligent medical treatment.

Description

Technical Field

[0001] This invention relates to a transmission system, and more particularly to a secure intelligent transmission system for patient health data. Background Technology

[0002] Current methods for transmitting patient health data have security and reliability vulnerabilities and shortcomings. Current methods transmit health data in plaintext. Since health data includes individual and disease information, such as identity information, disease names, and various vital signs like heart rate and blood oxygen levels, this can lead to privacy breaches and security risks such as identity theft and exposure of individual diseases.

[0003] This system aims to overcome the aforementioned security and reliability vulnerabilities and deficiencies, achieve secure transmission of patient health data, and protect patient identity information. Summary of the Invention

[0004] Purpose of the invention: The technical problem to be solved by the present invention is to provide a secure and intelligent transmission system for patient health data, addressing the shortcomings of the existing technology.

[0005] Technical solution: This invention discloses a secure intelligent transmission system for patient health data. The system includes a backbone device and a mobile device, with one mobile device connected to one backbone device. The mobile device is divided into a data acquisition device and a monitoring device.

[0006] The mobile device sends a key request message to the connected backbone device to obtain a key set; the backbone device that receives the key request message constructs the key set, creates a mobile device entry, and sends a key response message, which contains the message ID of the key response message encrypted with the mobile device's public key and the key set;

[0007] The mobile device that receives the key response message selects the message ID entry in the message ID table that is equal to the encrypted message ID of the key response message, uses the key in the message ID entry to decrypt the set of encrypted keys in the key response message, and sets its own key set as the decrypted key set.

[0008] The acquisition device sends the acquired data to the connected backbone device via an upload message; the backbone device that receives the upload message selects the message ID table entry whose encrypted message ID is equal to the encrypted message ID in the upload message, performs the decryption operation using the key of the message ID table entry, and creates a data table entry to save the decrypted data;

[0009] The monitoring equipment acquires the target data by transmitting messages; the backbone equipment that receives the transmission message performs a decryption operation to obtain the identifier and public key that identify the target data, selects a data table entry whose identifier is equal to the decrypted identifier, selects a mobile device table entry whose public key is equal to the decrypted public key, randomly selects an element from the key set of the mobile device table entry, and sends a monitoring message. This monitoring message contains the message ID value of the monitoring message encrypted using the element, the identifier of the selected data table entry, and the data; the monitoring equipment that receives the monitoring message performs a decryption operation to obtain the target data.

[0010] The method further includes:

[0011] The mobile device sending the key request message encrypts the message ID value of the key request message and its own public key using the public key of the connected backbone device. The key request message sent contains the encrypted message ID and the encrypted public key.

[0012] The backbone device that receives the key request message generates a random number r1 and constructs a key set containing r1 unique keys. None of these keys are included in the key set of any mobile device entry in the backbone device's table. The backbone device selects a message ID entry whose encrypted message ID is equal to the encrypted message ID in the key request message. It then uses the key in this message ID entry to decrypt the encrypted public key in the key request message, obtaining the public key of the mobile device that sent the key request message. In the mobile device entry created by the backbone device, the public key is equal to the decrypted public key, the key set is equal to the constructed key set, and the lifetime is set to the maximum value.

[0013] For each message ID, the backbone device that receives the key request message performs the following operations: for each element in the constructed key set, encrypt the message ID using the element to obtain the encrypted message ID, create a message ID table entry, where the message ID of the message ID table entry is equal to the message ID, the encrypted message ID is equal to the encrypted message ID, and the key is equal to the element.

[0014] The method further includes:

[0015] If the backbone device detects that the lifetime decay of a mobile device entry is 0, it creates a new key set, randomly selects an element from the key set of the mobile device entry, and sends a refresh message. The refresh message contains the message ID value of the refresh message encrypted with the element and the encrypted key set. The key set of the mobile device entry is then set as the newly created key set.

[0016] The mobile device that receives the refresh message selects the message ID entry in the message ID table that is equal to the encrypted message ID of the refresh message, uses the key of the message ID entry to decrypt the set of encrypted keys in the refresh message, and sets its own key set as the decrypted key set.

[0017] The acquisition device that sends the upload message randomly selects an element from its own key set, and the uploaded message sent contains the message ID value of the upload message encrypted using that element and the encrypted acquisition data;

[0018] The monitoring device that sends the transmission message randomly selects an element from its own key set. The transmission message it sends contains the message ID value of the transmission message encrypted using that element, an identifier that identifies the target data, and its own public key.

[0019] The method further includes:

[0020] For each message ID, the mobile device that receives the key response message performs the following operations: for each element of its own key set, encrypts the message ID using that element to obtain the encrypted message ID, creates a message ID entry, where the message ID of the message ID entry is equal to the message ID, the encrypted message ID is equal to the encrypted message ID, and the key is equal to the element.

[0021] The method further includes:

[0022] The backbone device that sends the refresh message generates a random number r2 and constructs a key set containing r2 newly created keys. Each of these r2 keys is different, and none of the keys are included in the key set of any mobile device entry of the backbone device.

[0023] For each message ID value, the backbone device sending the refresh message performs the following operations: encrypts the message ID value using each element in the newly created key set, creates a message ID entry, where the message ID of the message ID entry is equal to the message ID, the encrypted message ID is equal to the encrypted message ID, and the key is equal to the element.

[0024] The method further includes:

[0025] For each message ID, the mobile device that receives the refresh message performs the following operations: encrypts the message ID value using each element in its own key set, creates a message ID entry, where the message ID of the message ID entry is equal to the message ID, the encrypted message ID is equal to the encrypted message ID, and the key is equal to the element;

[0026] The backbone device that receives the transmission message selects the message ID entry that is equal to the encrypted message ID of the transmission message, and uses the key of the message ID entry to decrypt the encrypted identifier and encrypted public key in the transmission message to obtain the decrypted identifier and public key.

[0027] Upon receiving a monitoring message, the monitoring device selects the message ID entry in the table whose encrypted message ID is equal to the encrypted message ID of the monitoring message, and uses the key of the message ID entry to decrypt the encrypted data in the monitoring message to obtain the decrypted data.

[0028] The method further includes:

[0029] Each piece of data is uniquely identified by an identifier; the public and private keys of each backbone device or mobile device are stored and issued by a third-party certified data center computer; the system uses messages to transmit patient health data, and each message is uniquely identified by a message ID; when a backbone device registers with the third-party certified data center computer, it obtains the message ID of all messages in the system, its own public and private keys, asymmetric encryption algorithms, and symmetric encryption algorithms;

[0030] When a mobile device registers with a third-party certified data center computer, it obtains the message ID of all messages, its own public and private keys, asymmetric encryption algorithms, symmetric encryption algorithms, and the public key of the backbone device it is connected to.

[0031] The method further includes:

[0032] A backbone device or mobile device stores a message ID table, and each message ID table entry contains a message ID, an encrypted message ID, and a key;

[0033] For each message ID, the backbone device or mobile device uses its own public key and asymmetric encryption algorithm to encrypt the message ID to obtain the encrypted message ID, and creates a message ID table entry. The message ID of the message ID table entry is equal to the message ID, the encrypted message ID is equal to the encrypted message ID, and the key is equal to the private key of the backbone device or mobile device.

[0034] A backbone device maintains a mobile device table, and each mobile device table entry contains a public key, a key set, and a lifecycle.

[0035] The method further includes:

[0036] A mobile device stores a set of keys;

[0037] A key request message contains an encrypted message ID and an encrypted public key;

[0038] A key response message contains an encrypted message ID and a set of encryption keys;

[0039] A refresh message contains an encrypted message ID and a set of encryption keys;

[0040] A backbone device stores a data table, and each data table entry contains an identifier, data, and lifecycle.

[0041] The method further includes:

[0042] An upload message contains an encrypted message ID, an encrypted identifier, and encrypted data;

[0043] A transmitted message contains an encrypted message ID, an encrypted identifier, and an encrypted public key;

[0044] A monitoring message contains an encrypted message ID, an encrypted identifier, and encrypted data.

[0045] Beneficial Effects: This invention provides a secure and intelligent transmission system for patient health data. The system achieves the following technical effects: (1) ensuring the secure transmission of patient health data; (2) effectively protecting patient privacy; and (3) significantly improving the service performance of the medical system. This system has broad application prospects in the field of smart healthcare. Attached Figure Description

[0046] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0047] Figure 1 This is a flowchart of the patient health data secure intelligent transmission system of the present invention.

[0048] Figure 2 This is a schematic diagram of the process for obtaining the key set according to the present invention.

[0049] Figure 3 This is a schematic diagram of the key refresh process described in this invention.

[0050] Figure 4 This is a schematic diagram of the health data secure upload process described in this invention.

[0051] Figure 5 This is a schematic diagram of the health data security monitoring process described in this invention. Detailed Implementation

[0052] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0053] Figure 1 This is a flowchart of the patient health data secure intelligent transmission system of the present invention. Figure 2 This is a schematic diagram of the key set acquisition process described in this invention. The system includes backbone equipment and mobile devices, with each mobile device connected to a backbone device. The backbone device can be an access node, base station, or router. Each type of data is uniquely identified by an identifier. Mobile devices are divided into acquisition devices and monitoring devices. Acquisition devices are mounted on the patient and can be wearable devices or sensor nodes, used to collect the patient's health data, such as blood pressure and blood oxygen. Monitoring devices are used to monitor the patient's health data, such as mobile phones.

[0054] The public and private keys of each backbone device or mobile device are stored and issued by a third-party certified data center computer; the system uses messages to transmit patient health data, and each message is uniquely identified by a message ID;

[0055] When backbone equipment registers with a third-party certified data center computer, it obtains the message ID of all messages in the system, its own public and private keys, and the asymmetric encryption algorithm AEM0 and the symmetric encryption algorithm SEM0. The asymmetric encryption algorithm can be RSA, and the symmetric encryption algorithm can be Advanced Encryption Standard (SEM0). AES );

[0056] When a mobile device registers with a third-party authentication data center computer, it obtains the message ID of all messages, its own public and private keys, the asymmetric encryption algorithm AEM0, the symmetric encryption algorithm SEM0, and the public key of the backbone device it is connected to.

[0057] A backbone device or mobile device stores a message ID table, and each message ID table entry contains a message ID, an encrypted message ID, and a key;

[0058] For each message ID MID0, the backbone device or mobile device uses its own public key and algorithm AEM0 to encrypt message ID MID0 to obtain encrypted message ID EMID0, and creates a message ID table entry. The message ID of this message ID table entry is MID0, the encrypted message ID is EMID0, and the key is equal to the private key of the backbone device or mobile device.

[0059] A backbone device maintains a mobile device table. Each mobile device table entry contains a public key, a key set, and a lifecycle. The mobile device table is initially empty.

[0060] A mobile device stores a set of keys;

[0061] A key request message contains an encrypted message ID and an encrypted public key;

[0062] A key response message contains an encrypted message ID and a set of encryption keys;

[0063] Mobile device NM1 connects to backbone device BD1, and mobile device NM1 performs the following registration operation to obtain a key set:

[0064] S101: Begin;

[0065] S102: Mobile device NM1 uses the public key of backbone device BD1 and algorithm AEM0 to encrypt message ID value 1 and its own public key PK1 to obtain encrypted message ID value EM1 and encrypted public key EUK1, and sends a key request message. The encrypted message ID of the key request message is EM1 and the encrypted public key is EUK1.

[0066] S103: When the backbone device BD1 receives the key request message, it determines whether there is a message ID entry that is equal to the encrypted message ID of the key request message. If so, it executes S104; otherwise, it executes S113.

[0067] S104: Backbone device BD1 selects a message ID entry, the encrypted message ID of which is equal to the encrypted message ID of the key request message. It uses the key of the message ID entry and algorithm AEM0 to decrypt the encrypted public key in the key request message, generates a random number r1, generates r1 keys that meet condition 1 to form a key set NS0, creates a mobile device entry, the public key of which is equal to the decrypted public key, the key set is equal to the set NS0, and the lifespan is set to the maximum value, for example, 10 minutes; backbone device BD1 sets a set variable v1, the value of which is equal to NS0, uses the decrypted public key and algorithm AEM0 to encrypt message ID value 2 and set NS0 to obtain encrypted message ID value ET2 and encrypted key set EKS2, and sends a key response message, the encrypted message ID of which is ET2 and the encrypted key set is EKS2;

[0068] Condition 1: r1 keys are all different, and none of the keys are included in the key set of any mobile device entry in backbone device BD1;

[0069] S105: Backbone equipment BD1 checks whether the set variable v1 is empty. If it is, execute S108; otherwise, execute S106.

[0070] S106: For each message ID value Y0, the backbone device BD1 uses the first element of the set variable v1 and the algorithm SEM0 to encrypt the message ID value Y0 to obtain the encrypted message ID value EY0, and creates a message ID table entry. The message ID value of this message ID table entry is Y0, the encrypted message ID value is EY0, and the key is the first element of the set variable v1.

[0071] S107: Backbone equipment BD1 removes the first element from set variable v1, and executes S105;

[0072] S108: After receiving the key response message, the mobile device determines whether it has a message ID entry whose encrypted message ID is equal to the encrypted message ID of the key response message. If it exists, proceed to S109; otherwise, proceed to S113.

[0073] S109: The mobile device that receives the key response message selects a message ID entry, the encrypted message ID of which is equal to the encrypted message ID of the key response message. The mobile device uses the key of the message ID entry and the algorithm AEM0 to decrypt the encrypted key set in the key response message and sets its own key set as the decrypted key set. The mobile device sets a variable a1, the value of which is equal to the decrypted key set.

[0074] S110: The mobile device that receives the key response message checks whether variable a1 is empty. If it is, execute S113; otherwise, execute S111.

[0075] S111: For each message ID value X0, the mobile device that receives the key response message uses the first element of variable a1 and algorithm SEM0 to encrypt the message ID value X0 to obtain the encrypted message ID value EX0, and creates a message ID table entry. The message ID value of this message ID table entry is X0, the encrypted message ID value is EX0, and the key is the first element of variable a1.

[0076] S112: The mobile device that received the key response message deletes the first element from variable a1 and executes S110;

[0077] S113: End.

[0078] The mobile device obtains the key set from the connected backbone device through the above process. The above process has the following innovations: (1) The message does not contain mobile device information, thus achieving privacy protection; (2) The key set achieves secure transmission, thereby enabling the mobile device to securely obtain the key set; (3) The mobile device can use any key in the key set to encrypt data, thus achieving secure transmission of health data; (4) The backbone device can use any key in the key set to encrypt data, thus enabling the mobile device to securely obtain data from the backbone device; (5) Message transmission does not require specifying the target mobile device, thereby achieving privacy protection.

[0079] Figure 3 This is a schematic diagram of the key refresh process described in this invention. A refresh message includes an encrypted message ID and an encrypted key set;

[0080] Mobile device NM1 is connected to backbone device BD1, and the key set of mobile device NM1 is KS1; if backbone device BD1 detects that the lifetime decay of mobile device entry NE1 is 0, it performs the following operation:

[0081] S201: Beginning;

[0082] S202: Backbone device BD1 creates a random number r2 and r2 keys that meet condition 2, which constitute a key set KS3; backbone device BD1 randomly selects an element from the key set of mobile device entry NE1, and uses this element, along with algorithm SEM0 to encrypt the message ID value 3 and key set KS3 to obtain the encrypted message ID value ET3 and encryption key set EKS3; backbone device BD1 sets two set variables v2 and v3, where the value of set variable v2 is equal to the key set of mobile device entry NE1, and the value of set variable v3 is equal to the key set KS3; the key set of mobile device entry NE1 is updated to key set KS3, and the lifetime is set to the maximum value; a refresh message is sent, with the encrypted message ID being ET3 and the encryption key set being EKS3;

[0083] Condition 2: The r2 keys are all different, and none of the keys are included in the key set of any mobile device entry in the backbone device BD1;

[0084] S203: Backbone equipment BD1 checks whether the set variable v2 is an empty set. If it is, then execute S205; otherwise, execute S204.

[0085] S204: Backbone device BD1 selects all message ID entries whose key field values ​​are equal to the first element of set variable v2, deletes the selected message ID entries, deletes the first element from set variable v2, and executes S203.

[0086] S205: Backbone equipment BD1 checks whether variable v3 is empty. If it is, execute S208; otherwise, execute S206.

[0087] S206: For each message ID value Z0, the backbone device BD1 uses the first element of variable v3 and algorithm SEM0 to encrypt the message ID value Z0 to obtain the encrypted message ID value EZ0, and creates a message ID table entry. The message ID value of this message ID table entry is Z0, the encrypted message ID value is EZ0, and the key is the first element of variable v3.

[0088] S207: Backbone equipment BD1 removes the first element from set variable v3, and executes S205;

[0089] S208: The mobile device that receives the refresh message determines whether it has a message ID entry whose encrypted message ID is equal to the encrypted message ID of the refresh message. If it exists, proceed to S209; otherwise, proceed to S215.

[0090] S209: The mobile device that receives the refresh message selects a message ID entry, the encrypted message ID of which is equal to the encrypted message ID of the refresh message. The mobile device uses the key of the message ID entry and algorithm SEM0 to decrypt the encrypted key set in the refresh message. The mobile device sets two set variables a2 and a3, the value of set variable a2 is equal to the key set KS1, and the value of set variable a3 is equal to the decrypted key set. The mobile device sets its own key set to the decrypted key set.

[0091] S210: The mobile device that receives the refresh message checks whether the set variable a2 is an empty set. If it is, then execute S212; otherwise, execute S211.

[0092] S211: The mobile device that receives the refresh message selects the message ID entry whose key field value is equal to the first element of the set variable a2, deletes the selected message ID entry, deletes the first element from the set variable a2, and executes S210.

[0093] S212: The mobile device that receives the refresh message checks whether the set variable a3 is empty. If it is, then execute S215; otherwise, execute S213.

[0094] S213: For each message ID value W0, the mobile device that receives the refresh message uses the first element of the set variable a3 and the algorithm SEM0 to encrypt the message ID value W0 to obtain the encrypted message ID value EW0, and creates a message ID table entry. The message ID value of this message ID table entry is W0, the encrypted message ID value is EW0, and the key is the first element of the variable a3.

[0095] S214: The mobile device that receives the refresh message removes the first element from the set variable a3 and executes S212;

[0096] S215: End.

[0097] The backbone equipment updates the key set regularly through the above process. The innovations of the above process include: (1) The backbone equipment sends the key set to the mobile device in encrypted form, realizing the secure update of the key set; (2) Due to the regular update of the key, the key is prevented from being stolen or misused, ensuring the security of healthy data transmission; (3) Message transmission does not require specifying the target mobile device, thus realizing privacy protection.

[0098] Figure 4 This is a schematic diagram of the health data secure upload process described in this invention. One backbone device stores one data table, and each data table entry contains an identifier, data, and a lifecycle.

[0099] An upload message contains an encrypted message ID, an encrypted identifier, and encrypted data; data DA1 is uniquely identified by the identifier NA1, and the acquisition device NM1 is connected to the backbone device BD1; if the acquisition device NM1 generates data DA1, the following operations are performed:

[0100] S301: Start;

[0101] S302: Acquisition device NM1 randomly selects an element e4 from its own key set, and uses element e4 and algorithm SEM0 to encrypt message ID value 4, identifier NA1 and data DA1 to obtain encrypted message ID value ET4, encrypted identifier ENA4 and encrypted data EDA4 respectively; acquisition device NM1 sends an upload message, the encrypted message ID value of which is ET4, the encrypted identifier is ENA4 and the encrypted data is EDA4;

[0102] S303: The backbone device BD1 that receives the upload message determines whether there is a message ID table entry. If the encrypted message ID of the message ID table entry is equal to the encrypted message ID of the upload message, then execute S304; otherwise, execute S306.

[0103] S304: Backbone device BD1 selects a message ID entry, the encrypted message ID of which is equal to the encrypted message ID of the uploaded message, and uses the key and algorithm SEM0 of the message ID entry to decrypt the encrypted identifier and encrypted data in the uploaded message;

[0104] S305: Backbone equipment BD1 determines whether there is a data table entry whose identifier is equal to the decrypted identifier. If so, the data field value of the data table entry is set to the decrypted data, and the lifetime is set to the maximum value. Otherwise, backbone equipment BD1 creates a data table entry whose identifier and data are equal to the decrypted identifier and decrypted data, respectively, and the lifetime is set to the maximum value.

[0105] S306: End.

[0106] The acquisition device encrypts the acquired data and then publishes it to the backbone device through the above process. Its innovations include: (1) the data is transmitted in an encrypted form, which realizes the security of data transmission; (2) the backbone device automatically identifies the key through the message ID table, and the message does not contain the information of the acquisition device, thus realizing privacy protection.

[0107] Figure 5 This is a schematic diagram of the health data security monitoring process described in this invention.

[0108] A transmitted message contains an encrypted message ID, an encrypted identifier, and an encrypted public key;

[0109] A monitoring message contains an encrypted message ID, an encrypted identifier, and encrypted data;

[0110] Data DA1 is uniquely identified by identifier NA1. Monitoring device NM2 is connected to backbone device BD1. Monitoring device NM2 acquires data DA1 through the following process:

[0111] S401: Start;

[0112] S402: Monitoring device NM2 randomly selects an element e5 from its own key set, uses element e5 and algorithm SEM0 to encrypt message ID value 5, identifier NA1 and its own public key to obtain encrypted message ID value ET5, encrypted identifier ENA5 and encrypted public key EPK5 respectively, and sends the transmission message. The encrypted message ID value of the transmission message is ET5, the encrypted identifier is ENA5 and the encrypted public key is EPK5.

[0113] S403: The backbone device BD1 that receives the transmission message determines whether there is a message ID entry whose encrypted message ID is equal to the encrypted message ID of the transmission message. If yes, execute S404; otherwise, execute S409.

[0114] S404: Backbone equipment BD1 selects a message ID entry, the encrypted message ID of which is equal to the encrypted message ID of the transmitted message, and uses the key and algorithm SEM0 of the message ID entry to decrypt the encrypted identifier and encrypted public key in the transmitted message.

[0115] S405: Backbone equipment BD1 determines whether there is a data table entry whose identifier is equal to the decrypted identifier. If yes, execute S406; otherwise, execute S409.

[0116] S406: Backbone device BD1 selects a data table entry whose identifier is equal to the decrypted identifier, selects a mobile device table entry whose public key is equal to the decrypted public key, randomly selects an element from the key set of the mobile device table entry, and uses this element, algorithm SEM0 to encrypt the message ID value 6, as well as the identifier and data of the data table entry, to obtain the encrypted message ID value ET6, the encrypted identifier ENA6, and the encrypted data EDA6 respectively; backbone device BD1 sends a monitoring message, the encrypted message ID of which is ET6, the encrypted identifier is ENA6, and the encrypted data is EDA6;

[0117] S407: The monitoring device that receives the monitoring message determines whether it has a message ID table entry. The encrypted message ID of the message ID table entry is equal to the encrypted message ID of the monitoring message. If it exists, proceed to S408; otherwise, proceed to S409.

[0118] S408: The monitoring device that receives the monitoring message selects a message ID entry. The encrypted message ID of the message ID entry is equal to the encrypted message ID of the monitoring message. The device uses the key and algorithm SEM0 of the message ID entry to decrypt the encrypted identifier and encrypted data in the monitoring message and saves the decrypted identifier and data.

[0119] S409: End.

[0120] The monitoring equipment obtains data from the backbone equipment through the above process. The above process has the following innovations: (1) The monitoring equipment and the backbone equipment can use different keys for encryption, which realizes secure data transmission; (2) The message does not contain information about the monitoring equipment and the backbone equipment, which realizes privacy protection; (3) The message does not contain target equipment information, and automatically identifies whether it is the target equipment of the message through the message ID, which improves the security of data transmission and reduces the data transmission delay.

[0121] Example 1

[0122] Based on the simulation parameters in Table 1, this embodiment simulates a secure intelligent transmission system for patient health data according to the present invention. Performance analysis is as follows: as the data volume increases, the data communication success rate increases; as the data volume decreases, the data communication success rate decreases; the average data communication success rate is 98.1%.

[0123] Table 1

[0124] Parameter Description Parameter Value MAC Protocol IEEE 802.11 Transmission Radius 100 meters Number of Simulations 10 Simulation Time 60 minutes

[0125] This invention provides a concept for a secure and intelligent transmission system for patient health data. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A secure intelligent transfer system of patient health data, characterized in that, The system comprises backbone devices and mobile devices, one mobile device is connected with one backbone device, and the mobile devices are divided into collection devices and monitoring devices; The mobile device sends a key request message to the connected backbone device to obtain a key set; the backbone device receiving the key request message constructs the key set, creates a mobile device table item, and sends a key response message, which contains the message ID of the encrypted key response message and the key set encrypted by the public key of the mobile device; The mobile device receiving the key response message selects a message ID table item with the encrypted message ID equal to the encrypted message ID of the key response message, decrypts the encrypted key set in the key response message by using the key of the message ID table item, and sets its own key set as the decrypted key set; The collection device sends the collected data to the connected backbone device through an upload message; the backbone device receiving the upload message selects a message ID table item with the encrypted message ID equal to the encrypted message ID in the upload message, performs a decryption operation by using the key of the message ID table item, and creates a data table item to save the decrypted data; The monitoring device obtains the monitored target data through a transmission message; The backbone device receiving the transmission message performs a decryption operation to obtain an identifier identifying the target data and a public key, selects a data table item with the decrypted identifier equal to the identifier, selects a mobile device table item with the decrypted public key equal to the public key, randomly selects an element from the key set of the mobile device table item, and sends a monitoring message, which contains the message ID value of the monitoring message encrypted by the element, the identifier of the selected data table item, and the data; the monitoring device receiving the monitoring message performs a decryption operation to obtain the target data.

2. A secure intelligent transfer system of patient health data according to claim 1, wherein, Further comprising: The mobile device sending the key request message encrypts the message ID value of the key request message and its own public key by using the public key of the connected backbone device, and the sent key request message contains the encrypted message ID and the encrypted public key; The backbone device receiving the key request message generates a random number r1, and the constructed key set contains r1 keys created, the r1 keys are all different, and any one of the keys is not contained in the key set of any mobile device table item of the backbone device; the backbone device selects a message ID table item with the encrypted message ID equal to the encrypted message ID in the key request message, decrypts the encrypted public key in the key request message by using the key of the message ID table item, obtains the public key of the mobile device sending the key request message, and creates a mobile device table item, in which the public key is equal to the decrypted public key, the key set is equal to the constructed key set, and the life cycle is set to the maximum value; For each message ID, the backbone device receiving the key request message performs the following operations: for each element in the constructed key set, the element is encrypted to obtain an encrypted message ID, a message ID table item is created, the message ID of the message ID table item is equal to the message ID, the encrypted message ID is equal to the encrypted message ID, and the key is equal to the element.

3. A secure intelligent transfer system of patient health data as claimed in claim 1 wherein, Further comprising: If the backbone device detects that the life time of the mobile device entry decays to 0, it creates a new key set, randomly selects an element from the key set of the mobile device entry, sends a refresh message containing the message ID value of the refresh message encrypted by the element and the encrypted key set, and sets the key set of the mobile device entry as the newly created key set; The mobile device receiving the refresh message selects a message ID entry whose encrypted message ID is equal to the encrypted message ID of the refresh message, decrypts the encrypted key set in the refresh message by the key of the message ID entry, and sets its own key set as the decrypted key set; The collection device sending the upload message randomly selects an element from its own key set, and the sent upload message contains the message ID value of the upload message encrypted by the element and the encrypted collection data; The monitoring device sending the transmission message randomly selects an element from its own key set, and the sent transmission message contains the message ID value of the transmission message encrypted by the element, the identifier identifying the target data, and the public key of the monitoring device.

4. A secure intelligent transfer system of patient health data according to any one of claims 1 to 3, characterized in that, Further comprising: For each message ID, the mobile device receiving the key response message performs the following operations: for each element of its own key set, encrypts the message ID by the element to obtain an encrypted message ID, and creates a message ID entry whose message ID is equal to the message ID, encrypted message ID is equal to the encrypted message ID, and key is equal to the element.

5. A secure intelligent transfer system of patient health data according to any one of claims 1 to 3, characterized in that, Further comprising: The backbone device sending the refresh message generates a random number r2, and the constructed key set contains newly created r2 keys, which are all different and none of which is contained in the key set of any mobile device entry of the backbone device; For each message ID value, the backbone device sending the refresh message performs the following operations: encrypts the message ID value by each element in the newly created key set, and creates a message ID entry whose message ID is equal to the message ID, encrypted message ID is equal to the encrypted message ID, and key is equal to the element.

6. A secure intelligent transfer system of patient health data according to any one of claims 1 to 3, characterized in that, Further comprising: For each message ID, the mobile device receiving the refresh message performs the following operations: encrypts the message ID value by each element in its own key set, and creates a message ID entry whose message ID is equal to the message ID, encrypted message ID is equal to the encrypted message ID, and key is equal to the element; The backbone device receiving the transmission message selects a message ID entry whose encrypted message ID is equal to the encrypted message ID of the transmission message, decrypts the encrypted identifier and encrypted public key in the transmission message by the key of the message ID entry, and obtains the decrypted identifier and public key; The monitoring device receiving the monitoring message selects a message ID entry whose encrypted message ID is equal to the encrypted message ID of the monitoring message, decrypts the encrypted data in the monitoring message by the key of the message ID entry, and obtains the decrypted data.

7. A secure intelligent transfer system of patient health data according to any one of claims 1 to 3, characterized in that, Further comprising: A data is uniquely identified by an identifier; the public key and the private key of each backbone device or mobile device are stored and issued by a third-party authentication data center computer; The system transmits patient health data by messages, a message is uniquely identified by a message ID; when a backbone device registers with the third-party authentication data center computer, it obtains the message IDs of all messages of the system, its own public key and private key, asymmetric encryption algorithm and symmetric encryption algorithm; When a mobile device registers with the third-party authentication data center computer, it obtains the message IDs of all messages, its own public key and private key, asymmetric encryption algorithm, symmetric encryption algorithm and the public key of the connected backbone device.

8. A secure intelligent transfer system of patient health data according to any one of claims 1 to 3, characterized in that, Further comprising: A backbone device or a mobile device stores a message ID table, a message ID table entry contains a message ID, an encrypted message ID and a key; For each message ID, the backbone device or the mobile device encrypts the message ID by using its own public key and asymmetric encryption algorithm to obtain an encrypted message ID, and creates a message ID table entry, the message ID of the message ID table entry is equal to the message ID, the encrypted message ID is equal to the encrypted message ID, and the key is equal to the private key of the backbone device or the mobile device; A backbone device stores a mobile device table, a mobile device table entry contains a public key, a key set and a life cycle.

9. A secure intelligent transfer system of patient health data according to any one of claims 1 to 3, characterized in that, Further comprising: A mobile device stores a key set; A key request message contains an encrypted message ID and an encrypted public key; A key response message contains an encrypted message ID and an encrypted key set; A refresh message contains an encrypted message ID and an encrypted key set; A backbone device stores a data table, a data table entry contains an identifier, data and a life cycle.

10. The secure intelligent transmission system of patient health data according to any one of claims 1 to 3, characterized in that, An upload message contains an encrypted message ID, an encrypted identifier and encrypted data; A transmission message contains an encrypted message ID, an encrypted identifier and an encrypted public key; A monitoring message contains an encrypted message ID, an encrypted identifier and encrypted data.

Images