Medical data storage sharing method and system

Abstract

The invention discloses a medical data storage sharing method and system, and relates to the technical field of data sharing, and the method comprises the steps: collecting medical data, carrying out the preprocessing of the medical data, recognizing sensitive information based on the preprocessed data through the rule matching, combining a BERT model with a named entity recognition technology of a graph attention network, and carrying out the sensitivity grading; and encrypting the medical data by adopting a CP-ABE algorithm based on a sensitivity grading result, storing the encrypted medical data, and generating a trusted anchor point through block chain evidence storage. According to the method, BERT, GAT and CRF technologies are combined, accurate processing and hierarchical encryption of medical data are achieved, it is ensured that the data meet privacy protection requirements in the sharing process by generating metadata tags, differential privacy and block chain evidence storage are supported, data safety, traceability and compliance auditing are guaranteed, and finally, high efficiency, safety and compliance of medical data storage and sharing are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data sharing, and particularly relates to a medical data storage sharing method and system. BACKGROUND

[0002] In recent years, with the large-scale growth of electronic medical records, inspection and image data, the demand for interconnection and interoperation of heterogeneous source terminals such as clinical information systems (HIS), medical image archiving and communication systems (PACS) and laboratory information systems (LIS) is increasingly urgent, prompting industry standards such as FHIR and DICOM to gradually land in engineering scenarios to achieve semantic interoperability. At the same time, medical pre-training language models (such as medical BERT), graph attention networks (GAT) and rule-based multi-modal matching technologies are widely introduced to improve the named entity recognition and semantic parsing capabilities of unstructured medical record texts. To meet the needs of controllable access and trusted audit in data sharing, attribute-based encryption (CP-ABE), distributed file systems (such as IPFS) and blockchain storage solutions have become research and practice hotspots, while differential privacy and its Renyi divergence (RDP) accounting framework provide a theoretical tool for statistical analysis and traceable audit while ensuring individual privacy. Building a medical semantic equivalence class knowledge base based on UMLS / SNOMED CT and combining it with NLP query analysis is becoming a key path to achieving privacy-preserving statistical output and semantic preservation.

[0003] Although the prior art has made progress in its respective field, there are still several deficiencies in the real medical data sharing scenario. First, if Chinese clinical unstructured text sensitive information identification only relies on dictionary matching or a single deep model, it is easy to miss and misreport, and it is difficult to support fine-grained sensitivity classification. Second, although blockchain technology can provide an unalterable audit chain, on-chain storage is limited and there is insufficient support for continuous tracking and automatic rejection mechanism for differential privacy budget, making it difficult to balance privacy protection and data availability. Therefore, existing medical data storage and sharing technologies generally have low sensitivity information identification accuracy, extensive access control and lack of privacy budget management. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides a medical data storage sharing method and system, which solves the problems of low sensitivity information identification accuracy, extensive access control and lack of privacy budget management.

[0006] To solve the above technical problems, the present application provides the following technical solutions: In a first aspect, the present application provides a medical data storage sharing method, comprising, Medical data is collected and preprocessed. Based on the preprocessed data, sensitive information is identified and its sensitivity is graded using named entity recognition technology that combines rule matching with BERT model and graph attention network. The medical data includes electronic medical record texts, test reports, and medical image files; Based on the sensitivity classification results, the CP-ABE algorithm is used to encrypt the medical data, the encrypted medical data is stored, and a trusted anchor is generated through blockchain notarization. When a user initiates a shared access request, the system verifies the attributes and generates a decryption private key. The user uses the private key to decrypt the ciphertext and performs hash comparison through blockchain notarization. The system also records privacy budget consumption on the blockchain through differential privacy mechanism for secure aggregation analysis and traceable auditing.

[0007] As a preferred embodiment of the medical data storage and sharing method of the present invention, the following steps are described: Sensitive information is identified and sensitivity is graded based on named entity recognition technology using rule matching combined with BERT model and graph attention network on preprocessed data. Specifically, for unstructured medical record text in standardized medical datasets, a Chinese word segmentation tool is used to process the unstructured medical record text to obtain word sequences. And combine each character in the segmented word into a character sequence. A multi-pattern matching algorithm based on the Aho-Corasick automaton is employed on the character sequence, combined with a pre-built medical sensitivity dictionary. Each character is matched against the medical sensitivity dictionary to identify all matched entity regions. Based on these entity regions, the character sequence is then processed. Each character in the code generates a BMES label, and the BMES label of each character is converted into a heat vector form as the prior feature vector of the character. Finally, the set of character prior feature vectors is obtained. and in character sequence Special markers are added before and after to obtain the input sequence X. The input sequence X is then fed into the BERT model for encoding to obtain the context representation matrix H for each character. The prior feature vector corresponding to each character is mapped to the same dimension as the context vector through a linear transformation, and then concatenated to obtain the enhanced character feature vector set. Each character is treated as a node in a graph. If a character belongs to a matching word, an edge is created to construct a heterogeneous graph. The initial vector of each node is the corresponding enhanced character feature vector. A graph attention network is used to propagate information between the nodes in the graph. After GAT information propagation is completed, the updated character node representations form an enhanced representation sequence. The emission score is calculated on the tag for each character. We use CRF to model the transition relationships between labels and calculate the normalized probability of the label sequence. The Viterbi algorithm is used to solve for the optimal label sequence. Through the optimal label sequence The sensitive information in the text is mapped from the character level to the entity level, and the data is classified according to the type of sensitive information in the label sequence.

[0008] As a preferred embodiment of the medical data storage and sharing method of the present invention, the step of encrypting medical data using the CP-ABE algorithm based on sensitivity classification results refers to the following steps: before encryption, a trusted authorized institution is responsible for initializing and generating public parameters PK and master private key SK. Based on the medical data classification results, corresponding access control policies are set for data with different sensitivity levels, and each piece of medical data is encrypted. An attribute-based encryption algorithm is used to embed the access control policy into the ciphertext. During the encryption process, the data sensitivity information and access policy are directly bound together, and the encrypted ciphertext is CT.

[0009] As a preferred embodiment of the medical data storage and sharing method of the present invention, the step of storing the encrypted medical data and generating a trusted anchor through blockchain notarization refers to uploading the encrypted ciphertext to a distributed file system. During the upload process, the file is divided and distributed for storage. A hash value is calculated for each stored data block to obtain the hash value H(CT) of the encrypted ciphertext. Based on the hash value H(CT) of the encrypted ciphertext, a unique content identifier CID is generated, and a blockchain notarization information package is constructed and recorded using blockchain technology.

[0010] As a preferred embodiment of the medical data storage and sharing method of the present invention, the following steps are described: when a user initiates a sharing access request, the attribute verification and generation of a decryption private key are performed. The user uses the private key to decrypt the ciphertext and performs hash comparison through blockchain notarization. This means that when an external institution or user initiates a medical data sharing request, the requesting party submits identity attribute information for certificate authenticity verification and attribute conformity check. When the attribute verification passes, a dynamic decryption key DK is generated, and access is authorized to the requesting party, along with the corresponding decryption key. The authorization information is stored in the log. The requesting party calculates the hash value of the downloaded ciphertext data and compares it with the original hash value stored on the blockchain. When the two match, it indicates that the data has not been tampered with and the data integrity is verified. When the two do not match, it is considered that the data may have been tampered with, data use is prohibited, and an alarm is issued to the requesting party, requiring further verification of the data integrity and trustworthiness. When the attribute verification fails, the request is rejected and a detailed log is recorded explaining the reason for rejection.

[0011] As a preferred embodiment of the medical data storage and sharing method described in this invention, the step of recording privacy budget consumption on the blockchain through a differential privacy mechanism for secure aggregation analysis and traceable auditing refers to constructing a standardized medical terminology system based on UMLS, identifying query types in medical statistics, and obtaining a semantic equivalence class set by dividing each query type into corresponding semantic equivalence classes. For the semantic equivalence class set, medical experts review each set and integrate them according to query type, storing them in a knowledge base as a structured data resource. Upon receiving query requests, natural language processing (NLP) is used to parse the query statements and identify the query type. Based on the constructed medical semantic equivalence class knowledge base, a candidate set U is selected from the corresponding semantic equivalence classes for the target field of the query. Let f(D) represent the actual query result z on dataset D. Relevant audit information for the query is recorded, and a utility function is used. ,in, Here, z represents the candidate output, and z represents the actual query result. The global sensitivity of the utility function is calculated. ; Based on global sensitivity The exponential mechanism is used to select one result from the candidate set U for output, and the selection probability of the exponential mechanism is calculated. The final perturbation output result is obtained by sampling a result from the candidate set U. And assign importance weights to data of different query types and different sensitivity levels. and Combined with a basic privacy budget Calculate the actual privacy budget consumption for this query. This will consume the actual privacy budget. As input for RDP cost calculation, the exponent calculation mechanism is used in order of... RDP cost And calculate the total privacy loss. Total privacy loss Convert to standard -DP form obtains equivalent privacy budget loss Set a global privacy budget consumption threshold. When the equivalent privacy budget loss Greater than or equal to the global privacy budget threshold If the cumulative privacy loss exceeds the allowable range, subsequent query requests will be immediately rejected, and the reason for rejection will be recorded in the audit log. Otherwise, if the current privacy consumption is still within an acceptable range, new queries will continue to be allowed to execute.

[0012] As a preferred embodiment of the medical data storage and sharing method of the present invention, the step of collecting and preprocessing medical data refers to uniformly collecting raw data through a hospital information integration platform, calculating the collection completeness rate C during the collection process, and setting a threshold. When the data collection completeness rate C is greater than or equal to the threshold If the data collection is successful, the data collection results are deemed acceptable. For the collected structured or semi-structured data, the FHIR standard is uniformly used for format mapping, and a globally unique identifier (UUID) is assigned to each resource object. For unstructured medical record text, sentence and word segmentation is performed, and semantic parsing is used to identify key fields. The extracted key fields are then structured according to the FHIR standard, and the structured coverage rate (P) is calculated and a threshold is set. When the structured coverage P is greater than or equal to the threshold If the text conversion is successful, the collected medical image data is uniformly converted to DICOM format. The mean square error is used to determine whether the conversion result meets the lossless requirement, and a standardized medical dataset is output.

[0013] Secondly, the present invention provides a medical data storage and sharing system, comprising, The data acquisition module is used to collect data from HIS and other sources, map it to FHIR resources, generate UUIDs, and verify them. The sensitive identification module is used to perform word segmentation, dictionary matching, BERT and GAT encoding, and CRF decoding and classification of unstructured text; The key management module is used by trusted authorized institutions to initialize CP-ABE, generate PK and SK, and issue decryption keys according to attributes; The blockchain evidence storage module is used to upload encrypted data to IPFS, calculate its hash, generate a CID, and write it to the blockchain for evidence storage. The privacy audit module is used to parse statistical queries and output based on semantic equivalence classes and index mechanisms, and adopts RDP accounting tracking budget.

[0014] Thirdly, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, wherein the computer program, when executed by the processor, implements any step of a medical data storage and sharing method as described in the first aspect of the present invention.

[0015] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of a medical data storage and sharing method as described in the first aspect of the present invention.

[0016] The beneficial effects of this invention are as follows: This invention achieves unified collection and lossless conversion through standardized mapping based on FHIR / DICOM and integrity verification based on hash / UUID; it adopts a hybrid NER framework combining BERT encoding, GAT enhancement, and CRF decoding to achieve high-precision sensitive identification and classification; it implements CP-ABE layered encryption based on the classification results; it combines IPFS offline storage and blockchain anchor verification to ensure data availability and immutability; and it uses a semantic equivalence class knowledge base as support, employs an index mechanism in conjunction with RDP accounting for differential privacy protection and privacy budget tracking, thereby achieving synergistic optimization among data availability, access controllability, and audit traceability. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Fig. 1 This is a flowchart of a medical data storage and sharing method in Example 1.

[0019] Fig. 2 This is a structural diagram of a medical data storage and sharing system in Example 1.

[0020] Fig. 3 This is a flowchart of the differential privacy budget audit process in Example 1. Detailed Implementation

[0021] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0022] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0023] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0024] Example 1, referring to Figs. 1-3This is the first embodiment of the present invention, which provides a method for sharing medical data storage, including the following steps: S1. Collect medical data and preprocess it. Based on the preprocessed data, use rule matching combined with BERT model and graph attention network named entity recognition technology to identify sensitive information and classify its sensitivity. Specifically, collecting and preprocessing medical data involves using a hospital information integration platform to uniformly collect raw data from electronic medical record texts, laboratory reports, and medical image files from the Hospital Information System (HIS), Picture Archiving and Communication System (PACS), Laboratory Information System (LIS), and patient mobile applications. During the collection process, to ensure data integrity, the collection completeness rate C is calculated by multiplying the ratio of successfully collected data entries to the total number of data entries in the source systems by 100%. A threshold is then set through statistical analysis. When the data collection completeness rate C is greater than or equal to the threshold If the data collection is successful, the data collection results are deemed acceptable. For the collected structured or semi-structured data (such as patient basic information, test results, and diagnostic conclusions), the FHIR standard is uniformly used for format mapping (patient basic information is mapped to Patient resources, test results to Observation resources, and diagnostic reports to DiagnosticReport resources). During the mapping process, to ensure cross-system consistency, each resource object is assigned a globally unique identifier (UUID). The UUID generation rule calculation formula is as follows:

[0025] Where h(·) is the hash function, S is the source system identifier, T is the timestamp of data generation, and R is the random number; Unstructured medical record texts (such as admission records and progress notes) are segmented into sentences and words, and semantic parsing is performed using a pre-trained medical model to identify key fields such as "chief complaint," "diagnosis," and "medication." The extracted key fields are then structured according to the FHIR standard (diagnostic information is mapped to Condition resources, medication information to Medication Statement resources, and observational descriptions to Observation resources). To evaluate the accuracy of the structured transformation, the structured coverage rate P is calculated using a field coverage formula, and a threshold is set using fuzzy logic. When the structured coverage P is greater than or equal to the threshold If the text conversion is successful, the collected medical image data is uniformly converted to DICOM format. To ensure the lossless nature of the image data during the conversion process, mean square error (MSE) is used to determine whether the conversion result meets the lossless requirements. The output result is a standardized medical dataset composed of FHIR resources and DICOM files (unified resource identifier (UUID), complete structured fields and image information, and integrity and lossless verification results).

[0026] By uniformly collecting multi-source medical data and performing integrity rate verification, data integrity is ensured. The FHIR standard and globally unique identifiers are used to achieve structured mapping and cross-system consistency. Semantic parsing is combined to improve the structured coverage of unstructured text, and thresholding is used to ensure conversion quality. Images are uniformly converted to DICOM and their non-destructive nature is verified by MSE to ensure credible diagnosis.

[0027] Furthermore, based on the preprocessed data, name entity recognition technology combining rule matching with BERT model and graph attention network is used to identify sensitive information and perform sensitivity classification. Specifically, for unstructured medical record text in standardized medical datasets, Chinese word segmentation tools (such as Jieba or LTP) are used to perform sentence segmentation and word segmentation to obtain word sequences. ,in, It is the i-th word after word segmentation, and each character in the segmented word is combined into a character sequence. ,in, This refers to the characters in the i-th word after word segmentation. A multi-pattern matching algorithm based on the Aho-Corasick automaton is used on the character sequence, combined with a pre-built medical sensitivity dictionary (including names, addresses, hospitals, occupations, etc.). Each character is matched against this dictionary to identify all matched entity intervals (the range of locations where sensitive information fields appear in the original text). The start and end positions and types of the entities (sensitive information fields) are recorded. Based on these entity intervals, the character sequence is... Each character in the text generates a BMES tag, and the tag set is... ,in, It is the first character of the entity. It is the middle character of the entity. It is the last character of the entity. It is a single-character entity that can stand alone as a word. These are characters that do not belong to any entity. The BMES label of each character is converted into a heat vector, which serves as the character's prior feature vector. The expression is:

[0028] in, It is a character The value of s in the BMES label dimension It is a character The dimension corresponding to the BMES label; Finally, we obtain the set of character prior feature vectors. ,in, It is a character in the i-th word after word segmentation. It is a character The corresponding prior feature vector, and in the character sequence Special markers [CLS] (for representing the aggregate representation of the entire sentence) and [SEP] (for indicating the end of the sentence) are added before and after the character to obtain the input sequence X. The input sequence X is then fed into the BERT model for encoding to obtain the context representation matrix for each character.

[0029] Where H is the output character context representation matrix, It is the vector representation corresponding to the [CLS] label. It is the vector representation corresponding to the [SEP] tag. It is the context vector of the characters in the i-th word after word segmentation; The prior feature vector corresponding to each character is mapped to the same dimension as the context vector through a linear transformation, and then concatenated to obtain the enhanced character feature vector set. ,in, It is a character The system enhances the character feature vectors and treats each character as a node in a graph. If a character belongs to a matching word (a sensitive word or keyword obtained through dictionary matching), an edge is established to construct a heterogeneous graph (containing character nodes and matching word nodes, as well as edges between character nodes and matching word nodes). The initial vector of each node (character) is the corresponding enhanced character feature vector. Graph Attention Network (GAT) is used to propagate information between nodes in the graph.

[0030] in, This is the updated enhanced character feature vector, where N(i) is the node (character). The set of neighboring nodes, Let be the enhanced character feature vector of neighbor node k, and W be a trainable weight matrix. It is a node (character). Attention weights between the node and its neighbor k It is a non-linear activation function; Attention weight The calculation formula is:

[0031] Where 'a' is the attention parameter vector, || is the vector concatenation operation, and LeakyReLU is the activation function. It is the first word after word segmentation. Enhanced character feature vectors of characters in each word. It is a transpose operation, where W is a trainable weight matrix; After GAT information propagation is complete, the updated character node representations will form an enhanced representation sequence. ,in, This is the updated enhanced character feature vector, with the emission score calculated on the label for each character:

[0032] in, It is a character In the label The emission score is given by W, which is a trainable weight matrix representing the correlation between the label and the character augmentation representation, and b is a bias term. It is a transpose operation; We use CRF to model the transition relationships between labels and calculate the normalized probability of the label sequence:

[0033] in, It is the normalized probability of the label sequence. It is the set of all possible label sequences. It is a tag arrive The transition score represents the cost of transitioning from one tag to another, where n is the number of characters; Normalized probability based on label sequence The Viterbi algorithm is used to find the optimal label sequence:

[0034] in, It is the optimal label sequence; Through the optimal label sequence Sensitive information in the text is mapped from the character level to the entity level, thus outputting precise sensitive information. Based on the type of sensitive information in the tag sequence, the data is classified. If the text contains original identity information ("name", "ID number", "phone number") tags, it is marked as Level 1 (high sensitivity). If the text only contains clinical information ("disease", "drug", "examination item") and does not contain identity information tags, it is marked as Level 2 (medium sensitivity). If the text only contains statistical summary information or de-identified information ("a patient, male, 50 years old") and does not contain any sensitive identity information or clinical information, it is marked as Level 3 (low sensitivity). Based on the classification results, corresponding metadata tags are generated for each data record.

[0035] For unstructured medical record texts, fine-grained modeling of the original free text is achieved through word segmentation and character sequence construction, ensuring the accuracy of subsequent processing. Aho-Corasick automata combined with a sensitive dictionary is used for multi-pattern matching and BMES label generation, achieving precise interval-based identification of sensitive entities, improving recall and label consistency. BMES prior features are fused with BERT contextual semantic vectors, taking into account both dictionary knowledge and contextual understanding, significantly enhancing the model's discriminative power and robustness. By constructing a heterogeneous graph of characters and matching words and using a graph attention network to propagate information, cross-contextual entity association modeling is achieved, strengthening the detection capability of sparse sensitive information. Combining CRF and Viterbi decoding ensures the global optimality of label prediction and the continuity of results, avoiding the fragmentation of sensitive information. Finally, the recognition results are graded and metadata labels are generated, achieving automated sensitivity management of medical data.

[0036] S2. Based on the sensitivity classification results, the CP-ABE algorithm is used to encrypt the medical data, the encrypted medical data is stored, and a trusted anchor is generated through blockchain notarization. Specifically, encrypting medical data using the CP-ABE algorithm based on sensitivity grading results means that before encryption, a trusted authorized institution is responsible for initialization, including generating public parameters (generated and published by the authorized institution to all participants, and the parameters are public during the encryption and decryption process) and a master private key (generated by the authorized institution and stored in a secure hardware device or key management system, and not disclosed to any user):

[0037] Where PK is the public parameter, SK is the master private key, and g is the generator. is the pairing function in the group, and x is the master private key; Based on the medical data classification results, corresponding access control policies are set for data with different sensitivity levels. For Level 1 data (high sensitivity), access is only permitted to specific roles (such as cardiologists) during the project's validity period. For Level 2 data (medium sensitivity), access is only permitted to approved researchers. For Level 3 data (low sensitivity), access is permitted to the patient or administrator. When encrypting each piece of medical data, the attribute-based encryption algorithm (CP-ABE) is used to embed the access control policy into the ciphertext. During encryption, the data's sensitivity information and access policy are directly bound. The encrypted ciphertext expression is:

[0038] In this context, CT is the encrypted ciphertext, M is the original medical data, A is the access policy, and PK is the public parameter.

[0039] By generating public parameters and master private keys through trusted institutions, a secure and reliable encryption foundation is built. Differentiated access policies are set through medical data classification, and roles, approvals, and timeliness are directly mapped to attribute conditions. The CP-ABE algorithm is used to embed the access policy into the ciphertext, realizing the encryption protection of the data's self-carrying policy. Users can only decrypt the data when the attribute conditions are met, effectively avoiding excessive exposure and abuse.

[0040] Furthermore, the encrypted medical data is stored, and a trusted anchor is generated through blockchain notarization. To ensure high availability and reliability of the data, the encrypted ciphertext (medical data) is uploaded to a distributed file system. During the upload process, the IPFS system segments the file and stores it in a distributed manner to ensure decentralized data storage. A hash value (SHA-256) is calculated for each stored data block.

[0041] Where H(CT) is the hash value of the encrypted ciphertext; Based on the calculated hash value, the IPFS system generates a unique Content Identifier (CID) as the address for data access. To further enhance data security and traceability, a blockchain-based evidence storage package is constructed (ciphertext hash value, IPFSCID, data type, sensitivity classification label, timestamp, and identity identifier of the data provider). To ensure the immutability and transparency of the evidence storage information, the constructed blockchain-based evidence storage package is recorded using blockchain technology.

[0042] By storing encrypted medical data in blocks on IPFS, decentralization and redundant backups are achieved, ensuring high availability and disaster recovery capabilities. Combining SHA-256 hashes and CID generation enables content addressing and integrity verification, preventing tampering and duplicate storage. Furthermore, the encrypted hash, CID, data type, sensitivity classification, timestamp, and provider identity are packaged and uploaded to the blockchain, leveraging the immutability and transparency of the blockchain to achieve data notarization and traceability.

[0043] S3. When a user initiates a shared access request, the attributes are verified and a decryption private key is generated. The user uses the private key to decrypt the ciphertext and performs hash comparison through blockchain notarization. The privacy budget consumption is recorded on the blockchain through differential privacy mechanism for secure aggregation analysis and traceable auditing.

[0044] Specifically, when a user initiates a sharing access request, attributes are verified and a decryption private key is generated. The user uses the private key to decrypt the ciphertext and performs hash comparison through blockchain notarization. When an external institution or user initiates a medical data sharing request, the requesting party submits identity attribute information (role information (e.g., doctor, researcher, administrator, etc.), department (e.g., cardiology, oncology, etc.), project approval status (e.g., whether the project has been approved, project validity period, etc.)). Upon receiving the request, certificate authenticity verification and attribute compliance checks are performed. The attribute compliance check determines whether the attribute information provided by the requesting party meets the requirements based on the access policy of the target data. When the attribute verification passes, a dynamic decryption key is generated using the master private key and the requesting party's identity attribute information.

[0045] Where DK is the decryption key and I is the set of attributes of the requester (such as role, department, project approval status, etc.). The system authorizes access to the requesting party and provides the corresponding decryption key. The authorization information is stored in the log, recording the data access operation. To ensure that the data is not tampered with during transmission and storage, the requesting party uses a secure hash algorithm (such as SHA-256) to calculate the hash value of the downloaded ciphertext data. The calculated hash value is compared with the original hash value stored on the blockchain. When the two match, it means that the data has not been tampered with and the data integrity is verified. When the two do not match, it is considered that the data may have been tampered with, data use is prohibited, and an alert is issued to the requesting party, requiring further inspection of the data integrity and trustworthiness. When the attribute verification fails, the request is rejected and a detailed log is recorded explaining the reason for rejection.

[0046] By collecting and verifying identity attributes, the system ensures the authenticity and trustworthiness of the accessing entity. Through attribute compliance checks and dynamic decryption key generation, it achieves refined authorization and timeliness control based on sensitivity and role. By logging and archiving the reasons for denial, it ensures the traceability and compliance of operations. By hash verification of downloaded data and comparison with blockchain evidence, it ensures the integrity and immutability of the transmission and storage process, and promptly alerts and isolates abnormalities.

[0047] Furthermore, by using a differential privacy mechanism to record privacy budget consumption on the blockchain for secure aggregation analysis and traceable auditing, and by constructing a standardized medical terminology system based on UMLS (Unified Medical Language System), the system identifies query types in medical statistics ("age distribution query", "disease type query", "drug frequency query"), and obtains a semantic equivalence class set for each query type. ,in, Is with the first The set of semantic equivalence classes corresponding to each query type It is the first in the semantic equivalence class For each candidate output item, a semantic equivalence class set is reviewed by medical experts to ensure clinical rationality and interpretability. All expert-verified semantic equivalence classes are integrated according to query type and stored in a knowledge base as structured data resources. When receiving query requests, Natural Language Processing (NLP) techniques are used to parse the query statements, identifying the query type (e.g., COUNT, AVG, SUM), target fields (e.g., age, diagnosis, medication), and data sensitivity levels (e.g., Level 1, Level 2, Level 3). Based on the constructed medical semantic equivalence class knowledge base, a candidate set U is selected from the corresponding semantic equivalence classes for the target fields of the query. Let f(D) represent the actual query result z on dataset D. Relevant audit information is recorded, including the requester's identity, access time, purpose of use, and data identifier, for subsequent audit log generation to ensure data access traceability and compliance. To ensure semantic similarity between the output results and the actual results, a utility function is used. ,in, These are candidate outputs, used to measure the difference between the true result z and the candidate output. The similarity between them, z is the actual query result. To apply differential privacy, the global sensitivity of the utility function is calculated:

[0048] in, It is global sensitivity. Given two datasets that differ by only one record, calculate the change in the utility function. Based on global sensitivity The exponential mechanism is used to select one result from the candidate set U for output. The formula for calculating the selection probability of the exponential mechanism is:

[0049] in, It is the probability of choice. It's the privacy budget for queries. It is a utility function. It is a normalization factor that ensures the sum of the probabilities of all candidate results is 1. It is one of the possible output results in the candidate set U; Based on the probability of selection The final perturbation output result is obtained by sampling a result from the candidate set U. Cross-validation was used to assign importance weights to data of different query types and sensitivity levels. and The actual privacy budget consumption for this query is calculated by multiplying the base privacy budget by the base privacy budget. This will consume the actual privacy budget. As input for RDP cost calculation, within the RDP framework, the privacy loss for each query is represented by the Rényi divergence. The exponential mechanism for calculating the exponent is at order [number missing]. The RDP cost is as follows:

[0050] in, This is the privacy cost of the l-th query under the Rényi divergence. It is the order of the Rényi divergence; Since RDP costs are additive, the total privacy loss of all executed queries can be tracked by summing them up:

[0051] in, is the total privacy loss of all executed queries under the Rényi divergence, where L is the total number of completed queries; Total privacy loss Convert to standard -DP format:

[0052] in, It is given The corresponding equivalent privacy budget loss, It is the allowed failure probability; Set the global privacy budget loss threshold through Bayesian optimization. When the equivalent privacy budget loss Greater than or equal to the global privacy budget loss threshold If the cumulative privacy loss exceeds the allowable range, subsequent query requests will be immediately rejected, and the reason for rejection will be recorded in the audit log. This ensures that the same dataset will not increase the risk of privacy leakage due to excessive queries, thereby maximizing the protection of individual privacy while ensuring data availability. Otherwise, if the current privacy loss is still within an acceptable range, new query execution will continue to be allowed.

[0053] By using the UMLS standardized medical terminology system, a unified expression of multi-source heterogeneous medical concepts is achieved, reducing semantic ambiguity and improving the accuracy of queries and statistics. By classifying query types and establishing a set of semantic equivalence classes, each candidate is reviewed by medical experts and stored in a knowledge base to ensure the clinical rationality and interpretability of the candidate options, thereby improving the credibility and practicality of statistical results. By parsing query statements through NLP, aggregation methods, target fields, and sensitivity levels are automatically identified, enabling refined access strategy matching and privacy-level protection. The semantic similarity between the actual results and candidate results is measured through a utility function, and an exponential mechanism is used to sample the output in combination with global sensitivity, balancing differential privacy constraints and the effectiveness of statistical results, ensuring that useful information is retained even when noise is introduced. The actual privacy budget is adjusted through weight allocation, and the accumulated privacy loss is accurately tracked under the RDP framework, achieving risk control and budget optimization for multiple queries. Finally, a global threshold is set, and when the privacy loss exceeds the limit, subsequent queries are automatically rejected and audit logs are recorded to ensure access traceability and compliance.

[0054] This embodiment also provides a medical data storage and sharing system, including: The data acquisition module is used to collect data from HIS and other sources, map it to FHIR resources, generate UUIDs, and verify them. The sensitive identification module is used to perform word segmentation, dictionary matching, BERT and GAT encoding, and CRF decoding and classification of unstructured text; The key management module is used by trusted authorized institutions to initialize CP-ABE, generate PK and SK, and issue decryption keys according to attributes; The blockchain evidence storage module is used to upload encrypted data to IPFS, calculate its hash, generate a CID, and write it to the blockchain for evidence storage. The privacy audit module is used to parse statistical queries and output based on semantic equivalence classes and index mechanisms, and adopts RDP accounting tracking budget.

[0055] This embodiment also provides a computer device applicable to a medical data storage and sharing method, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement a medical data storage and sharing method as proposed in the above embodiment.

[0056] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0057] This embodiment also provides a storage medium on which a computer program is stored. When executed by a processor, the program implements a medical data storage and sharing method as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

Claims

1. A method for sharing medical data, characterized in that: include, Medical data is collected and preprocessed. Based on the preprocessed data, sensitive information is identified and its sensitivity is graded using named entity recognition technology that combines rule matching with BERT model and graph attention network. The medical data includes electronic medical record texts, test reports, and medical image files; Based on the sensitivity classification results, the CP-ABE algorithm is used to encrypt the medical data, the encrypted medical data is stored, and a trusted anchor is generated through blockchain notarization. When a user initiates a shared access request, the system verifies the attributes and generates a decryption private key. The user uses the private key to decrypt the ciphertext and performs hash comparison through blockchain notarization. The system also records privacy budget consumption on the blockchain through differential privacy mechanism for secure aggregation analysis and traceable auditing.

2. The medical data storage and sharing method as described in claim 1, characterized in that: The method involves using named entity recognition technology based on preprocessed data, combining rule matching with BERT model and graph attention network to identify sensitive information and perform sensitivity classification. Specifically, for unstructured medical record text in standardized medical datasets, a Chinese word segmentation tool is used to process the unstructured medical record text to obtain word sequences. And combine each character in the segmented word into a character sequence. A multi-pattern matching algorithm based on the Aho-Corasick automaton is employed on the character sequence, combined with a pre-built medical sensitivity dictionary. Each character is matched against the medical sensitivity dictionary to identify all matched entity regions. Based on these entity regions, the character sequence is then processed. Each character in the code generates a BMES label, and the BMES label of each character is converted into a heat vector form as the prior feature vector of the character. Finally, the set of character prior feature vectors is obtained. and in character sequence Special markers are added before and after to obtain the input sequence X. The input sequence X is then fed into the BERT model for encoding to obtain the context representation matrix H for each character. The prior feature vector corresponding to each character is mapped to the same dimension as the context vector through a linear transformation, and then concatenated to obtain the enhanced character feature vector set. Each character is treated as a node in a graph. If a character belongs to a matching word, an edge is created to construct a heterogeneous graph. The initial vector of each node is the corresponding enhanced character feature vector. A graph attention network is used to propagate information between the nodes in the graph. After GAT information propagation is completed, the updated character node representations form an enhanced representation sequence. The emission score is calculated on the tag for each character. We use CRF to model the transition relationships between labels and calculate the normalized probability of the label sequence. The Viterbi algorithm is used to solve for the optimal label sequence. Through the optimal label sequence The sensitive information in the text is mapped from the character level to the entity level, and the data is classified according to the type of sensitive information in the label sequence.

3. A medical data storage and sharing method as described in claim 2, characterized in that: The encryption of medical data based on the sensitivity classification results using the CP-ABE algorithm involves the following steps: Before encryption, a trusted authorized institution is responsible for initializing and generating public parameters PK and a master private key SK. Based on the medical data classification results, corresponding access control policies are set for data with different sensitivity levels, and each piece of medical data is encrypted. An attribute-based encryption algorithm is used to embed the access control policy into the ciphertext. During the encryption process, the data's sensitivity information and access policy are directly bound together. The encrypted ciphertext is CT.

4. A medical data storage and sharing method as described in claim 3, characterized in that: The process of storing encrypted medical data and generating a trusted anchor through blockchain notarization involves uploading the encrypted ciphertext to a distributed file system. During the upload process, the file is segmented and distributed for storage. A hash value is calculated for each stored data block to obtain the hash value H(CT) of the encrypted ciphertext. Based on the hash value H(CT) of the encrypted ciphertext, a unique content identifier (CID) is generated, and a blockchain notarization information package is constructed and recorded using blockchain technology.

5. A medical data storage and sharing method as described in claim 4, characterized in that: The process of verifying attributes and generating a decryption private key when a user initiates a sharing access request, and the user using the private key to decrypt the ciphertext and perform hash comparison through blockchain storage, refers to the process where, when an external institution or user initiates a medical data sharing request, the requesting party submits identity attribute information for certificate authenticity verification and attribute compliance checks. When the attribute verification passes, a dynamic decryption key (DK) is generated, and access is authorized to the requesting party, along with the corresponding decryption key. The authorization information is stored in the log. The requesting party calculates the hash value of the downloaded ciphertext data and compares it with the original hash value stored on the blockchain. If they match, it indicates that the data has not been tampered with and the data integrity has been verified. If they do not match, it is considered that the data may have been tampered with, data use is prohibited, and an alert is issued to the requesting party, requiring further checks on the data integrity and trustworthiness. If the attribute verification fails, the request is rejected and a detailed log is recorded explaining the reason for rejection.

6. A medical data storage and sharing method as described in claim 5, characterized in that: The method of recording privacy budget consumption on the blockchain through differential privacy mechanism for secure aggregation analysis and traceable auditing refers to constructing a standardized medical terminology system based on UMLS, identifying query types in medical statistics, and obtaining a set of semantic equivalence classes for each query type. For the semantic equivalence class set, medical experts review each set and integrate them according to the query type, storing them in a knowledge base as a structured data resource. Upon receiving query requests, natural language processing (NLP) is used to parse the query statements and identify the query type. Based on the constructed medical semantic equivalence class knowledge base, a candidate set U is selected from the corresponding semantic equivalence classes for the target field of the query. Let f(D) represent the actual query result z on dataset D. Relevant audit information for the query is recorded, and a utility function is used. ,in, Here, z represents the candidate output, and z represents the actual query result. The global sensitivity of the utility function is calculated. ; Based on global sensitivity The exponential mechanism is used to select one result from the candidate set U for output, and the selection probability of the exponential mechanism is calculated. The final perturbation output result is obtained by sampling a result from the candidate set U. And assign importance weights to data of different query types and different sensitivity levels. and Combined with a basic privacy budget Calculate the actual privacy budget consumption for this query. This will consume the actual privacy budget. As input for RDP cost calculation, the exponent calculation mechanism is used in order of... RDP cost And calculate the total privacy loss. Total privacy loss Convert to standard -DP form obtains equivalent privacy budget loss Set a global privacy budget consumption threshold. When the equivalent privacy budget loss Greater than or equal to the global privacy budget threshold If the cumulative privacy loss exceeds the allowable range, subsequent query requests will be immediately rejected, and the reason for rejection will be recorded in the audit log. Otherwise, if the current privacy consumption is still within an acceptable range, new queries will continue to be allowed to execute.

7. A medical data storage and sharing method as described in claim 6, characterized in that: The aforementioned collection and preprocessing of medical data refers to the unified collection of raw data through a hospital information integration platform, calculating the data collection completeness rate C during the collection process, and setting a threshold. When the completeness rate C is greater than or equal to the threshold If the data collection is successful, the data collection results are deemed acceptable. For the collected structured or semi-structured data, the FHIR standard is uniformly used for format mapping, and a globally unique identifier (UUID) is assigned to each resource object. For unstructured medical record text, sentence and word segmentation is performed, and semantic parsing is used to identify key fields. The extracted key fields are then structured according to the FHIR standard, and the structured coverage rate (P) is calculated and a threshold is set. When the structured coverage rate P is greater than or equal to the threshold If the text conversion is successful, the collected medical image data is uniformly converted to DICOM format. The mean square error is used to determine whether the conversion result meets the lossless requirement, and a standardized medical dataset is output.

8. A medical data storage and sharing system, based on the medical data storage and sharing method according to any one of claims 1 to 7, characterized in that: include, The data acquisition module is used to collect data from HIS and other sources, map it to FHIR resources, generate UUIDs, and verify them. The sensitive identification module is used to perform word segmentation, dictionary matching, BERT and GAT encoding, and CRF decoding and classification of unstructured text; The key management module is used by trusted authorized institutions to initialize CP-ABE, generate PK and SK, and issue decryption keys according to attributes; The blockchain evidence storage module is used to upload encrypted data to IPFS, calculate its hash, generate a CID, and write it to the blockchain for evidence storage. The privacy audit module is used to parse statistical queries and output based on semantic equivalence classes and index mechanisms, and adopts RDP accounting tracking budget.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the medical data storage and sharing method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the medical data storage and sharing method according to any one of claims 1 to 7.

Images