An ophthalmic patient privacy protection traceability method and system

Abstract

The application discloses an ophthalmic patient privacy protection traceability method and system, relates to the technical field of medical information security, and comprises the following steps: dividing byte data flow into data blocks, performing Gray code conversion, constituting a binary bit plane, calculating the boundary flip number of the binary bit plane, obtaining a weighted complexity index, classifying the sensitivity of the data blocks, extracting a central region corresponding to the spatial position of the decrypted data block, obtaining a cropped image, performing standardization processing, generating a final output image, constructing a database, and performing traceability. The application combines byte-level data block division and Gray code bit plane complexity analysis, and introduces a sensitivity classification method based on the weighted complexity index, thereby improving the matching degree of the privacy protection strategy and the actual sensitive characteristics of the data, and improving the accuracy of data security processing and the overall processing efficiency of the system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of medical information security, and particularly relates to an ophthalmic patient privacy protection tracing method and system. BACKGROUND

[0002] With the rapid development of medical informatization and digital medicine, a hospital information system (HIS) and a picture archiving and communication system (PACS) have become one of the core infrastructures of a modern hospital. In particular, in an ophthalmic diagnosis and treatment scene, a large amount of high-resolution fundus image data (such as optical coherence tomography OCT, fundus photography, and eye ultrasound images) and structured or unstructured electronic medical record text data are continuously collected, stored, and shared for the purpose of assisting diagnosis, surgical decision-making, scientific research analysis, and remote medical services.

[0003] The existing ophthalmic medical data privacy protection technology still has many deficiencies in actual application. The existing scheme usually uniformly applies a security policy at the granularity of a file or a record, and fails to fully consider the significant differences in structural complexity, information entropy, and privacy sensitivity between image data and text data in ophthalmic diagnosis and treatment data, which easily leads to over-encryption or insufficient protection, affecting system efficiency and user experience. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides an ophthalmic patient privacy protection tracing method and system to solve the problem that the existing scheme usually uniformly applies a security policy at the granularity of a file or a record, and fails to fully consider the significant differences in structural complexity, information entropy, and privacy sensitivity between image data and text data in ophthalmic diagnosis and treatment data, which easily leads to over-encryption or insufficient protection, affecting system efficiency and user experience.

[0006] To solve the above technical problems, the present application provides the following technical solutions.

[0007] In a first aspect, the present application provides an ophthalmic patient privacy protection tracing method, which comprises,

[0008] Collecting multi-source data and performing preprocessing to generate a byte data stream, dividing the byte data stream into data blocks, and performing Gray code conversion to constitute a binary bit plane, calculating the boundary flip number of the binary bit plane to obtain a weighted complexity index, and classifying the data blocks according to sensitivity;

[0009] The data block is encrypted based on the sensitivity grading, the client request is authenticated, an access token is generated, the ciphertext is decrypted according to the sensitivity level, and the data block is recovered;

[0010] The user unique identifier extracted from the access token is a string, a user identity phase mask is generated, a generalized pupil function is defined, and two-dimensional discrete convolution is performed, a center region corresponding to the spatial position of the decrypted data block is extracted, a cropped image is obtained, and a final output image is generated, a database is constructed, and traceability is performed.

[0011] As a preferred scheme of the ophthalmic patient privacy protection traceability method, wherein: the byte data stream is divided into data blocks, and a gray code transformation is performed to form a binary bit plane, the boundary flip number of the binary bit plane is calculated to obtain a weighted complexity index, the data blocks are graded according to sensitivity, including:

[0012] The byte data stream is divided into data blocks to form a standardized data block matrix, and a gray code transformation is applied to each element in the data block matrix to obtain a gray code matrix;

[0013] Each element in the gray code matrix is decomposed to form a binary bit plane, and in the binary bit plane, the total sum of the number of value changes between all adjacent pixel pairs is calculated, defined as the boundary flip number, and the boundary flip numbers of all binary bit planes are normalized and summed to obtain a weighted complexity index;

[0014] A segmentation threshold is set, the weighted complexity index is compared with the segmentation threshold, a binary grading determination is performed, and the sensitivity level of the data block is obtained.

[0015] As a preferred scheme of the ophthalmic patient privacy protection traceability method, wherein: the data block is encrypted based on the sensitivity grading, including:

[0016] According to the sensitivity level, the data block is encrypted respectively to obtain ciphertext;

[0017] The weighted complexity index, the sensitivity level and the ciphertext are converted into a byte sequence;

[0018] A TLV unit is constructed for each serialized data field, the TLV units are spliced into a header byte sequence, the hash value of the header byte sequence is calculated as a header authentication code;

[0019] The header byte sequence, the header authentication code and the ciphertext are spliced in order to form a ciphertext package.

[0020] As a preferred solution of the ophthalmic patient privacy protection traceability method of the application, wherein: the client request is authenticated, an access token is generated, the ciphertext is decrypted according to the sensitivity level, and the data block is recovered, including:

[0021] The user initiates a login request, issues an access token, and transmits the ciphertext package and the access token as parameters to the trusted security processing unit through an encrypted interface. The trusted security processing unit parses the ciphertext package, separates the header byte sequence from the encrypted data body according to the length prefix structure, and extracts the weighted complexity index and the sensitivity level.

[0022] The header byte sequence is deserialized, the weighted complexity index and the sensitivity level are extracted, the encrypted data body is decrypted based on the sensitivity level, and the data block is obtained.

[0023] As a preferred solution of the ophthalmic patient privacy protection traceability method of the application, wherein: the user unique identifier extracted from the access token is a string, a user identity phase mask is generated, a generalized pupil function is defined, and two-dimensional discrete convolution is performed, a center region corresponding to the spatial position of the decrypted data block is extracted, a cropped image is obtained, and a final output image is generated, including:

[0024] The user unique identifier extracted from the access token is a string, and is deterministically spliced with an image generation timestamp to construct a spliced string.

[0025] The SHA-3-256 hash function is applied to the spliced string to generate a hash value, the hash value is regarded as a binary sequence, the binary sequence is sequentially filled into a temporary matrix, the temporary matrix is upsampled to a target size N×N using bilinear interpolation, where N is the target size of the phase matrix, a floating-point matrix is obtained, and a linear transformation is performed on the floating-point matrix to generate a user identity phase mask.

[0026] The difference between the recovered weighted complexity index and the segmentation threshold is calculated, defined as the sensitivity offset, the maximum wavefront aberration of the sensitivity offset at the edge of the pupil is calculated, and the generalized pupil function is defined.

[0027] The two-dimensional discrete Fourier transform is performed on the generalized pupil function, and the modulus square is taken to obtain a point spread function. The decrypted data block is zero-padded using the zero-padding center alignment method, and the padded data block and the point spread function are two-dimensionally convolved to obtain a convolution matrix.

[0028] The center region corresponding to the spatial position of the decrypted data block is extracted from the convolution matrix to obtain a cropped image, the cropped image is subjected to linear contrast stretching, the pixel values are normalized, and a final output image is generated.

[0029] As a preferred scheme of the ophthalmic patient privacy protection traceability method, the database is constructed and traced, including:

[0030] The intensity difference between adjacent pixels in each row of the final output image is calculated, and binaryzation processing is performed to generate a binary matrix, the binary matrix is unfolded in row priority order to obtain a binary sequence, and the binary sequence is converted into a hexadecimal string as a perceptual hash value of the image;

[0031] The perceptual hash value, image generation timestamp, current verified identity, and weighted complexity index are encapsulated to obtain a traceability record, which is atomically inserted into a database table named trace_log through an INSERT operation of the database management system to construct the database;

[0032] When the final output image needs to be traced, an exact query operation is performed in the database, if there is a record, the traceability is successful, and if there is no record, "no matching generation record found" is output.

[0033] As a preferred scheme of the ophthalmic patient privacy protection traceability method, the database is constructed and traced, including:

[0034] The multi-source data is collected from the HIS and PACS through an API interface, and denoising and standardization processing are performed to obtain a byte data stream.

[0035] In a second aspect, the present application provides an ophthalmic patient privacy protection traceability system, comprising,

[0036] The acquisition and processing module is used for collecting fundus image and text data from the HIS and PACS system, and performing denoising, standardization processing and conversion into a byte data stream;

[0037] The segmentation module is used for segmenting the byte data stream into data blocks, performing Golay code conversion on each data block, calculating the boundary flip number of each data block, and evaluating the complexity of the data block according to the weighted complexity index, and classifying the data block into high-sensitivity data or low-sensitivity data based on the sensitivity level of the data block divided by the weighted complexity index and the Otsu method;

[0038] The encryption and decryption module is used for encrypting the data block according to the sensitivity level of the data, performing identity authentication on the client request, generating an access token, decrypting the ciphertext according to the sensitivity level, and restoring the data block;

[0039] The traceability query module is used for generating a perceptual hash value of the image, calculating the intensity difference and generating a hash value through binaryzation processing, inserting the traceability record into the database, and performing accurate query when needed.

[0040] In a third aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and wherein the computer program, when executed by the processor, implements any step of the method for tracing ophthalmic patient privacy protection according to the first aspect of the present application.

[0041] In a fourth aspect, the present application provides a computer readable storage medium having stored thereon a computer program, wherein the computer program, when executed by a processor, implements any step of the method for tracing ophthalmic patient privacy protection according to the first aspect of the present application.

[0042] The present application has the beneficial effects that: the present application combines byte-level data block division and Golay code bit plane complexity analysis, and introduces a sensitivity grading method based on a weighted complexity index, thereby achieving fine differentiation of the privacy sensitivity of ophthalmic image data and text data without relying on data semantic analysis, improving the matching degree of privacy protection strategies and actual sensitive characteristics of data, avoiding the problems of over-encryption or insufficient protection caused by uniform encryption strategies, and improving the accuracy of data security processing and the overall processing efficiency of the system. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0044] Figure 1 Flowchart of the method for tracing ophthalmic patient privacy protection in embodiment 1.

[0045] Figure 2 Schematic diagram of the method for tracing ophthalmic patient privacy protection in embodiment 1.

[0046] Figure 3 Schematic diagram of the module of the system for tracing ophthalmic patient privacy protection in embodiment 2.

[0047] Figure 4 Schematic diagram of the system for tracing ophthalmic patient privacy protection in embodiment 2. DETAILED DESCRIPTION

[0048] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings of the specification.

[0049] In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that the present application can be practiced without the specific details set forth in this description, that the present application can be practiced with other systems, and that the present application can be practiced using different techniques. Therefore, the present application is not limited to the embodiments described herein but rather the scope of the present application is to be given the broadest interpretation of the appended claims and all equivalents thereof.

[0050] Second, the "one embodiment" or "an embodiment" referred to herein means a specific feature, structure, characteristic, or combination of features, structures, or characteristics that can be included in at least one implementation of the present application. The various appearances of "in one embodiment" or "in an embodiment" in the specification do not all refer to the same embodiment, however, although such phrasing can appear rerepeatedly in this specification. Inferences from this specification are not to be taken as essential or limiting members of the various embodiments illustrated.

[0051] Embodiment 1, refer to Figure 1 and Figure 2 The first embodiment of the present application provides an ophthalmic patient privacy protection traceability method, comprising the following steps:

[0052] S1, collect multi-source data and pre-process to generate byte data stream, divide the byte data stream into data blocks, and perform Golay code conversion to form binary bit planes, calculate the boundary flip number of the binary bit planes to obtain a weighted complexity index, and classify the data blocks according to sensitivity;

[0053] Specifically, multi-source data is collected from HIS (Hospital Information System) and PACS (Picture Archiving and Communication System) through an API interface, and denoising and standardization processing is performed to obtain a byte data stream;

[0054] The multi-source data includes fundus images (OCT, fundus photography, and eye ultrasound images) and text (diagnosis reports, medical orders, medical records, and surgical records in electronic medical records);

[0055] The denoising and standardization processing includes scaling to a unified reference size by bilinear interpolation, using a Non-Local Means (NLM) filtering algorithm to denoise the fundus image, converting the denoised fundus image to an 8-bit grayscale image, scanning the pixel matrix of the grayscale image in row-major order, taking the 8-bit grayscale value (0-255) of each pixel as a byte, and sequentially storing it in a byte array to generate a continuous byte sequence representing the image, converting all text data to UTF-8 encoding, removing XML / HTML tags, JSON field names, and other structured markers used only for data exchange, retaining only the actual text content, removing all control characters (except line feeds and tabs) with ASCII code values less than 32, replacing multiple consecutive spaces and tabs with a single space character, concatenating multiple text fields related to the same medical event (such as diagnosis + medical advice + medical history) in chronological order, separated by periods, to form a standardized text string, and converting the text string to a corresponding byte sequence using UTF-8 encoding rules;

[0056] Concatenating the alternately arriving byte sequences in chronological order to form a continuous, standardized byte data stream;

[0057] Through step-by-step segmentation and processing by byte units, the traditional method of excessive encryption for files or records is avoided, thereby improving the accuracy and efficiency of processing, flexible encryption strategies are adopted for different types of information in medical data (such as images and text), improving the quality of privacy protection, and through standardized processing of the data stream, subsequent processing steps (such as complexity analysis and sensitivity classification) can be performed in a consistent format, not only reducing errors caused by inconsistent data formats, but also enabling mixed processing of different types of data.

[0058] Further, the byte data stream is divided into data blocks and subjected to Gray code transformation to form a binary bit plane, the number of boundary flips of the binary bit plane is calculated to obtain a weighted complexity index, and the data blocks are subjected to sensitivity classification, including:

[0059] The byte data stream is sequentially read and segmented by byte units, the byte data stream is segmented into data blocks with a size of 8x8 bytes, for data blocks with less than 64 bytes at the end, 0-valued bytes are used for padding to form a standardized data block matrix, to eliminate the interference of multiple bit jumps (Hamming cliffs) in adjacent values in natural binary coding on complexity calculation, a Gray code transformation is applied to each element in the data block matrix, the Gray code is a cyclic code with the characteristic that the binary representation of adjacent values differs by only one bit, and a Gray code matrix is obtained, the formula is:

[0060] ,

[0061] wherein is the transformed Gray code value, represents the element value in the mth row and nth column of the Gray code matrix, is the element value in the mth row and nth column of the data block matrix, is the bitwise XOR (exclusive OR) operation, which compares each bit of the binary representations of two operands and produces a result of 1 if the bits are different and 0 if the bits are the same, is the logical right shift operator, which shifts the binary representation of its operand right by one bit;

[0062] The 8-bit binary representation of each element in the Gray code matrix is decomposed to form a binary bit plane, and the kth bit (k = 0, 1,..., 7, where k = 0 represents the least significant bit (LSB) and k = 7 represents the most significant bit (MSB)) of all elements is extracted in turn to form the kth binary bit plane. A binary bit plane is a binary matrix whose element values are 0 or 1.

[0063] In the binary bit plane, the total number of times of value changes between all adjacent pixel pairs (including row and column adjacent pairs) is calculated and defined as the boundary flip number, and the formula is:

[0064] ,

[0065] wherein is the boundary flip number of the kth-order bit plane, is the element value in the mth row and nth column (i.e., the right adjacent) of the kth-order bit plane, is the relational operator, which represents not equal to, and is used to compare whether two element values are different, and m and n are the index variables of rows and columns, is the indicator function, which outputs a value of 1 if the condition in the parentheses is true, and outputs a value of 0 if the condition is false;

[0066] The normalized sum of the boundary flip numbers of all binary bit planes is obtained to obtain the weighted complexity index, and the formula is:

[0067] ,

[0068] wherein is the weighted complexity index of the normalized data block, is the maximum value of the binary bit plane boundary flip number, is the weight coefficient of the kth-order bit plane. The monotone increasing weight coefficient method is used to set j = 1, 2,..., 7, and j is the order of the plane;

[0069] ​Different bit planes carry different information entropy weights, higher bit planes (near MSB) carry the main structural information of the image, and their complexity better reflects the overall sensitive characteristics of the data. To comprehensively evaluate the complexity of the entire data block, a weighted complexity index is defined.

[0070] Based on the weighted complexity index, the threshold is set by the Otsu method. A series of weighted complexity indexes obtained in the current processing window (for example, all data blocks generated in one diagnosis and treatment session) are used to construct a histogram distribution of the weighted complexity index. The weighted complexity indexes of image data blocks and text data blocks will form two separable distribution peaks. The Otsu method is used to find the best segmentation point by maximizing the inter-class variance to determine the threshold. The weighted complexity index is compared with the segmentation threshold, and a binary classification decision is made to obtain the sensitivity level of the data block.

[0071] If the weighted complexity index is greater than the segmentation threshold, it is determined that the data block is derived from high-frequency texture-rich, complex-structured high-sensitivity data, and the typical representative is the original ophthalmic medical image without compression or lossless compression. Such data needs to be strictly visually desensitized in subsequent processing.

[0072] If the weighted complexity index is less than or equal to the segmentation threshold, it is determined that the data block is derived from low-sensitivity data with regular structure and low information entropy, and the typical representative is medical record text and examination parameters. Such data mainly needs to embed traceable identity watermark in subsequent processing, and the visual clarity can be retained.

[0073] Gray code conversion can eliminate the influence of adjacent data bit jumps and reduce the interference of the "Hamming cliff" phenomenon on complexity calculation, thereby effectively improving the accuracy of data complexity analysis. By performing Gray code conversion on each element in the data block, unnecessary fluctuations caused by binary representation are reduced, making the calculation result more stable, especially when processing high-frequency texture-rich image data, it is more accurate. The data block sensitivity grading mechanism based on the weighted complexity index can accurately judge the sensitivity of the data block. High-complexity data (such as uncompressed medical images) will be judged as high-sensitivity data and stricter privacy protection measures will be taken. Low-complexity data (such as structured medical record text) will adopt a more relaxed protection strategy. In this way, the waste of resources caused by overprotecting low-sensitivity data is effectively avoided, while the safety of high-sensitivity data is ensured. This grading mechanism can dynamically adjust the data protection strategy based on the complexity of the data, so that the system can adaptively adjust the encryption strategy and processing method when processing different types of medical data, thereby improving the flexibility and security of the system.

[0074] S2, encrypt the data block based on the sensitivity classification, authenticate the client request, generate an access token, decrypt the ciphertext according to the sensitivity level, and restore the data block;

[0075] Specifically, the data block is encrypted based on the sensitivity classification, including:

[0076] According to the sensitivity level, the data block is encrypted to obtain ciphertext;

[0077] The data block is encrypted, including:

[0078] The pre-defined access control policy is that, for high-sensitive data, policy 1 is defined as: "(position = chief physician) OR (position = deputy chief physician) AND (department = ophthalmology)", and for low-sensitive data, policy 2 is defined as: "(position = physician) OR (position = technician) OR (position = nurse) AND (department = ophthalmology)";

[0079] When the data block is high-sensitive data, a ciphertext policy attribute-based encryption (CP-ABE) algorithm is used to directly encrypt the data block (taking the data block and the access policy 1 as input, the encryption process is based on the standard process of the CP-ABE algorithm (such as an access tree scheme based on a bilinear pair), to generate a ciphertext bound to the policy 1);

[0080] When the data block is low-sensitive data, a cryptographically secure random number generator is called to generate a random sequence with a length of 256 bits as a symmetric encryption key, and an AES-256 symmetric encryption algorithm is used in GCM mode (an authenticated encryption (AE) mode of operation that can provide data confidentiality) to encrypt the data block with the symmetric encryption key to obtain symmetric ciphertext. The GCM mode provides confidentiality and integrity authentication, and a CP-ABE encryption function is used to encrypt the symmetric encryption key as plaintext and the access policy 2 as policy to generate a key encapsulation ciphertext. The symmetric ciphertext and the key encapsulation ciphertext are sequentially spliced to combine into the final data block ciphertext;

[0081] The weighted complexity index, the sensitivity level, and the ciphertext are converted into a byte sequence;

[0082] The conversion into a byte sequence includes:

[0083] The weighted complexity indicator is converted into 8 bytes according to the IEEE 754 double-precision standard, the sensitivity level is mapped into a single byte, for example, 0x01 represents high-sensitive data and 0x02 represents low-sensitive data, the current Unix timestamp (a 64-bit integer) and the starting byte offset (a 64-bit integer) in the byte data stream are each converted into 8 bytes (big-endian order);

[0084] A TLV unit is constructed for each serialized data field, Type (T): 1 byte, identifying the field type (for example, 0xA1 represents the weighted complexity indicator and 0xA2 represents the sensitivity level), Length (L): 2 bytes, identifying the byte length of the subsequent Value field, Value (V): the byte content of the serialized field;

[0085] The TLV units are spliced in a predefined order (for example: weighted complexity indicator, sensitivity level, timestamp, starting byte offset) to form a complete header byte sequence, a 256-bit (32-byte) hash value of the entire header byte sequence is calculated using the SHA-256 hash function as the header authentication code;

[0086] The header byte sequence, the header authentication code and the ciphertext are spliced in order to form a ciphertext package, the formula is:

[0087] ,

[0088] wherein is the ciphertext package of the i-th data block, is the header byte sequence of the i-th data block, is the authentication code of the header byte sequence , is the ciphertext of the i-th data block, is a byte splicing operator, which directly connects the byte sequence on the left side and the byte sequence on the right side into a longer, new byte sequence in the order from left to right.

[0089] Different encryption schemes are adopted for different sensitivity data, enabling the system to protect data privacy while avoiding over-protection of low-sensitive data, thereby improving system performance and reducing unnecessary computational overhead. By predefining access control policies, the system can flexibly determine access data permissions based on user roles and department permissions, improving the accuracy and flexibility of data access control and ensuring that sensitive data can only be accessed by authorized users. By embedding authentication codes in the ciphertext, the system can ensure that the data has not been tampered with during transmission, ensuring data integrity and reliability. Even if the data is intercepted or tampered with, the authentication code can detect inconsistencies in time, ensuring the security of information transmission. The use of TLV format for data encapsulation enables flexible encapsulation and transmission of multiple types of data, facilitating the construction of a more flexible and scalable privacy protection system.

[0090] Further, the client request is authenticated, an access token is generated, and the ciphertext is decrypted according to the sensitivity level to recover the data block, including:

[0091] The user initiates a login request to the system through a client (such as a doctor workstation software) and provides a digital certificate or biometric credential. After the system authentication server verifies the validity of the credential, it issues a time-limited access token (e.g., a JWT token complying with the OAuth 2.0 standard) that encodes the user's identity and attributes (such as role and department). All subsequent data access requests must carry this token. The host application program calls the encryption interface provided by the hardware security module vendor, which complies with the PKCS#11 or Microsoft CNG standard, and passes the ciphertext package and access token as parameters into the trusted security processing unit. This interface call is implemented on the physical layer through the PCIe bus, and the operating system kernel driver ensures the isolation of data transmission, thereby forming the secure channel. The unit verifies the access token to confirm the legality of this data access. The trusted security processing unit parses the ciphertext package and separates the header byte sequence and encrypted data body according to the length prefix structure;

[0092] The trusted security processing unit (hardware security module) internally verifies the access token cryptographically, including: verifying the digital signature of the token to ensure that it was issued by a legitimate system authentication server and has not been tampered with; checking the token's expiration field to ensure that it is not expired; parsing the token payload to extract the user's identity and attribute set encoded therein;

[0093] The header byte sequence is deserialized to extract the weighted complexity indicator (8-byte sequence is parsed as a floating-point number in IEEE 754 double-precision format) and the sensitivity level (1-byte is parsed as an enumeration value, such as 0x01 representing high-sensitive data and 0x02 representing low-sensitive data);

[0094] Decrypt the encrypted data body based on the sensitivity level to obtain a data block;

[0095] The decrypting the encrypted data body based on the sensitivity level comprises:

[0096] When the sensitivity level is high-sensitive data, the encrypted data body is a complete CP-ABE ciphertext, a CP-ABE decryption algorithm is called, and a private key component corresponding to the user attribute extracted from the access token is used to decrypt the ciphertext to obtain the data block;

[0097] When the sensitivity level is low-sensitive data, the encrypted data body is composed of two parts spliced in sequence: the first part is a symmetric ciphertext encrypted in the CBC mode using the AES-256 algorithm, and the second part is a key encapsulation ciphertext obtained by encapsulating the symmetric key used for the AES-256 encryption using the CP-ABE algorithm, a CP-ABE decryption algorithm is first called to decrypt the second part using the user attribute private key component to obtain the symmetric key, and an AES-256 decryption algorithm is called using the symmetric key to decrypt the first part to obtain the data block;

[0098] All intermediate data generated in the decryption process and the final obtained data block exist only in the protected memory of the trusted secure processing unit, and the data block and the weighted complexity index are directly transmitted to the subsequent calculation imaging modulation module integrated in the same secure unit for processing, and cannot be output in any plaintext form outside the secure unit.

[0099] Identity verification is performed by using digital certificates or biometric features, avoiding the security risks of traditional password verification, ensuring the security and accuracy of identity verification, and the access token contains the role and permission information of the user, which can dynamically control the access permission of the user to the data, ensuring that the access of sensitive data is limited to specific users, and by dynamically selecting the decryption method according to the sensitivity level of the data, the decryption efficiency of low-sensitive data is improved while ensuring the security of high-sensitive data, avoiding unnecessary waste of computing resources, and the combination of the two decryption algorithms enables the system to cope with decryption requirements of different types of data, thereby improving the adaptability and flexibility of the system, by ensuring that all intermediate data and final data in the decryption process are stored only in the protected memory, avoiding exposure of data during decryption, further enhancing the security of the data, and all operations in the decryption process are performed in a protected environment, effectively preventing data leakage caused by improper operation or malicious attacks, and enhancing the reliability of the system.

[0100] S3, the user unique identity identifier extracted from the access token is a string, a user identity phase mask is generated, a generalized pupil function is defined, and two-dimensional discrete convolution is performed, a central region corresponding to the spatial position of the decrypted data block is extracted, a cropped image is obtained, and a standardization process is performed to generate a final output image, a database is constructed, and traceability is performed;

[0101] Specifically, the user unique identity identifier extracted from the access token is a string, a user identity phase mask is generated, a generalized pupil function is defined, and two-dimensional discrete convolution is performed, a central region corresponding to the spatial position of the decrypted data block is extracted, a cropped image is obtained, and a standardization process is performed to generate a final output image, including:

[0102] The user unique identity identifier extracted from the access token is a string, and is deterministically spliced with the image generation timestamp to construct a spliced string, the formula is:

[0103] ,

[0104] Where S is the spliced string, U is the user identity identifier string, t is the image generation timestamp, is a function of converting a decimal integer to a decimal number string, is a literal string constant to be connected, which is the character "vertical bar" itself. In mathematical expressions or pseudocode, it is enclosed in quotes to indicate that it is a specific string value, not a variable or operator;

[0105] Apply the SHA-3-256 hash function to the spliced string to generate a fixed-length hash value of 256 bits (32 bytes), and the hash function ensures that different users or different times of the same user will get statistically independent and unpredictable bit sequences. A 256-bit hash value is regarded as a one-dimensional binary sequence of length 256;

[0106] Fill the 256-bit sequence into a temporary matrix of 16x16 in order (because 16x16=256), upsample the temporary matrix to the target size NxN using bilinear interpolation, where N is the target size of the phase matrix, which is set using the preset parameter method, to obtain a floating-point matrix whose value is in the interval [0,1]. Linear transformation of the floating-point matrix generates a user identity phase mask, the formula is:

[0107] ,

[0108] Where is the user identity phase mask, and represents the phase delay introduced by the user identity at the virtual pupil plane coordinates (u,v), is a temporary floating-point value at coordinates (u, v), u and v are row index and column index in the phase matrix;

[0109] The difference between the recovered weighted complexity index and the segmentation threshold is calculated, which is defined as the sensitivity offset. According to geometric optics, the wavefront error (optical path difference) caused by defocus is proportional to the square of the defocus distance. The maximum wavefront aberration caused by the sensitivity offset at the pupil edge is calculated, and the formula is:

[0110] ,

[0111] wherein is the maximum wavefront aberration caused by defocus, and represents how many wavelengths the optical path difference corresponds to, is the sensitivity offset, is the radius of the virtual pupil, which is equal to half of N, is the reference wavelength (such as 550*10 -9 ), and f is the focal length of the virtual imaging system (0.05), which is set by an empirical rule;

[0112] On the virtual pupil plane, the generalized pupil function is defined, and the formula is:

[0113] ,

[0114] wherein is the value of the generalized pupil function at coordinates (u, v), is the imaginary unit, is the pupil aperture function value at coordinates (u, v), 1 represents light transmission, and 0 represents light blocking, is the natural exponential function;

[0115] According to the Fourier optics principle, the two-dimensional discrete Fourier transform (DFT) is performed on the generalized pupil function, and the square of the modulus is taken to obtain the point spread function;

[0116] The zero-padding center alignment method is used to zero-pad the decrypted data block, and the padded data block is two-dimensionally discrete convolved with the point spread function to simulate the optical imaging process, thereby obtaining the convolution matrix. The formula is:

[0117] ,

[0118] wherein is the convolution matrix, is the padded data block, is the convolution operation, and PSF is the point spread function;

[0119] The center region cropping method is used to extract the center region corresponding to the spatial position of the decrypted data block from the convolution matrix, and the cropped image is obtained, and the formula is:

[0120] ,

[0121] Wherein is the pixel value of the image at position (i,j) after cropping, i and j are the row index and column index inside the cropped image, and are the size of the point spread function, corresponding to the height and width respectively;

[0122] The linear contrast stretching is performed on the cropped image, the pixel value is normalized to the standard display range (such as 0 to 255), and the final output image is generated.

[0123] By introducing the user identity-based phase mask, it can be ensured that only the identity of the legal user affects the processing of the data, and the identity forgery and unauthorized data access are avoided. The generation mechanism of the user identity phase mask makes the processing of the same data by different users different, enhances the personalized privacy protection, and makes the same data have different encryption modes in different situations. By simulating the optical imaging process, the system can fuse the spatial information of the data block with the identity mark, realize a more accurate and reliable image reconstruction process, and enhance the consistency of the image in different display environments. The convolution operation can restore the image according to the specific application scene, and process the sensitive data of different user identities, improve the accuracy and security in the image restoration process, and ensure that the size and color of the image meet the standard in the final output, avoid the inconsistency in the image output, and ensure the clarity and ornamental of the image. Through accurate cropping and contrast stretching of the image, the finally generated image is clearer and brighter in visual effect, which meets the demand of professional medical image processing.

[0124] Further, a database is constructed and traced, including:

[0125] The intensity difference between adjacent pixels in each row of the final output image is calculated, and binaryzation processing is performed to generate a binary matrix, and the formula is:

[0126] ,

[0127] Wherein is the value of the i-th row and j-th column in the binary matrix, is the intensity difference of the i-th row and j-th column in the difference matrix;

[0128] The binary matrix is unfolded in row-major order to obtain a binary sequence, and the binary sequence is converted into a hexadecimal string as the perceptual hash value of the image;

[0129] The binary sequence is divided into groups of 4 bits each, and each group is converted into a hexadecimal character (0-9, a-f). If the sequence length is not an integer multiple of 4, zeros are added at the end until the total number of bits is an integer multiple of 4, and then the grouping conversion is performed;

[0130] The perceptual hash value, image generation timestamp, current verified identity, and weighted complexity indicator are encapsulated to obtain a trace record, which is inserted atomically into a database table named trace_log through the INSERT operation of the database management system (DBMS), and a database is constructed;

[0131] When the final output image needs to be traced, an exact query operation is performed in the database. If such a record exists, the trace is successful, and the data contained in the trace record is output in the format {current verified identity, image generation timestamp, sensitivity indicator}. If such a record does not exist, "no matching generation record found" is output.

[0132] The application of perceptual hashing ensures that each image can be accurately identified and traced back to the original data source through the hash value, avoiding data tampering and identity forgery problems, enhancing the transparency and reliability of the data. Through the generation of perceptual hash values and database tracing, the system can ensure that the image has not been tampered with or replaced during the entire processing process, providing strong anti-tampering functions. Through database storage and accurate queries, the system can quickly find the generation record of each image, enhancing the management efficiency and security of the data. The database management system of this trace record not only meets the protection requirements of medical data, but also provides court evidence for data leakage or tampering incidents, enhancing the legal protection of the entire system.

[0133] Embodiment 2, refer to Figure 3 and Figure 4 The embodiment also provides an ophthalmic patient privacy protection tracing system, comprising:

[0134] The acquisition and processing module is used to acquire fundus images and text data from the HIS and PACS systems, and to perform denoising, standardization processing, and conversion into a byte data stream;

[0135] The segmentation module is used to segment the byte data stream into data blocks, and to perform Gray code conversion on each data block, calculate the boundary flip number of each data block, and evaluate the complexity of the data block based on the weighted complexity indicator. Based on the weighted complexity indicator and the Otsu method, the sensitivity level of the data block is divided, and the data block is classified as high-sensitivity data or low-sensitivity data;

[0136] The encryption and decryption module is configured to encrypt the data block according to the sensitivity level of the data, authenticate the client request, generate an access token, decrypt the ciphertext according to the sensitivity level, and restore the data block.

[0137] The traceability query module is configured to generate a perceptual hash value of the image, generate a hash value by calculating an intensity difference value and performing binary processing, insert a traceability record into a database, and perform accurate query when needed.

[0138] The embodiment also provides a computer device suitable for the ophthalmic patient privacy protection traceability method, which comprises a memory and a processor.

[0139] The computer device can be a terminal, and the computer device comprises a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is configured to perform wired or wireless communication with an external terminal. The wireless communication can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device. In addition, the input device can also be an external keyboard, touchpad or mouse, etc.

[0140] The embodiment also provides a storage medium on which a computer program is stored, the program being executed by a processor to implement the traceability method for protecting privacy of an ophthalmic patient according to the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk or an optical disk.

[0141] To sum up, the present application combines byte-level data block division with Gray code bit plane complexity analysis, and introduces a sensitivity grading method based on a weighted complexity index, thereby achieving fine distinction of the privacy sensitivity of ophthalmic image data and text data without relying on data semantic analysis, improving the matching degree of the privacy protection strategy and the actual sensitive characteristics of the data, avoiding the problems of over-encryption or insufficient protection caused by a unified encryption strategy, and improving the accuracy of data security processing and the overall processing efficiency of the system.

[0142] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A traceability method for protecting the privacy of ophthalmology patients, characterized in that: include, Collect multi-source data and preprocess it to generate a byte data stream. Divide the byte data stream into data blocks and perform Gray code transformation to form a binary bit plane. Calculate the boundary flip number of the binary bit plane to obtain a weighted complexity index. Then, classify the data blocks according to their sensitivity. Data blocks are encrypted based on sensitivity levels, client requests are authenticated, access tokens are generated, and ciphertext is decrypted according to sensitivity levels to recover data blocks. The user's unique identifier extracted from the access token is a string. A user identity phase mask is generated, a generalized pupil function is defined, and a two-dimensional discrete convolution is performed. The central region corresponding to the spatial location of the decrypted data block is extracted to obtain the cropped image. The image is then standardized to generate the final output image. A database is constructed, and the source is traced. The user's unique identifier extracted from the access token is a string. A user identity phase mask is generated, a generalized pupil function is defined, and a two-dimensional discrete convolution is performed to extract the central region corresponding to the spatial location of the decrypted data block, resulting in a cropped image. This image is then standardized to generate the final output image, including: The user's unique identifier extracted from the access token is a string, which is then deterministically concatenated with the image generation timestamp to construct the concatenated string; The SHA-3-256 hash function is applied to the concatenated string to generate a hash value. The hash value is treated as a binary sequence and the binary sequence is filled into a temporary matrix in sequence. Bilinear interpolation is used to upsample the temporary matrix to the target size N×N, where N is the target size of the phase matrix, to obtain a floating-point matrix. The floating-point matrix is ​​then linearly transformed to generate a user identity phase mask. The difference between the weighted complexity index of the recovery and the segmentation threshold is calculated and defined as the sensitivity offset. The maximum wavefront aberration of the sensitivity offset at the edge of the pupil is calculated and the generalized pupil function is defined. A two-dimensional discrete Fourier transform is performed on the generalized pupil function, and the square of the modulus is taken to obtain the point spread function. The zero-filling center alignment method is used to zero-fill the decrypted data block. The filled data block is then subjected to a two-dimensional discrete convolution with the point spread function to obtain the convolution matrix. The central region corresponding to the spatial location of the decrypted data block is extracted from the convolution matrix to obtain the cropped image. The cropped image is then subjected to linear contrast stretching, and the pixel values ​​are normalized to generate the final output image.

2. The traceability method for protecting ophthalmic patient privacy as described in claim 1, characterized in that: The process involves dividing the byte data stream into data blocks, performing Gray code transformation to form a binary bit plane, calculating the boundary flip number of the binary bit plane to obtain a weighted complexity index, and classifying the data blocks by sensitivity, including: The byte data stream is divided into data blocks to form a normalized data block matrix. A Gray code transformation is applied to each element of the data block matrix to obtain the Gray code matrix. Each element in the Gray code matrix is ​​decomposed to form a binary bit plane. In the binary bit plane, the sum of the number of times the value changes between all adjacent pixel pairs is calculated, which is defined as the boundary flip number. The boundary flip numbers of all binary bit planes are normalized and summed to obtain the weighted complexity index. Set a segmentation threshold, compare the weighted complexity index with the segmentation threshold, perform a binary classification judgment, and obtain the sensitivity level of the data block.

3. The traceability method for protecting ophthalmic patient privacy as described in claim 2, characterized in that: The encryption of data blocks based on sensitivity grading includes: Based on the sensitivity level, the data blocks are encrypted to obtain ciphertext; Convert the weighted complexity index, sensitivity level, and ciphertext into a byte sequence; Construct a TLV unit for each serialized data field, concatenate the TLV units into a header byte sequence, and calculate the hash value of the header byte sequence as the header authentication code; The header byte sequence, header authentication code, and ciphertext are concatenated in sequence to form a ciphertext packet.

4. The traceability method for protecting ophthalmic patient privacy as described in claim 3, characterized in that: The process of authenticating client requests, generating access tokens, decrypting ciphertext according to sensitivity levels, and recovering data blocks includes: The user initiates a login request, issues an access token, and passes the ciphertext packet and access token as parameters to the trusted security processing unit through an encrypted interface. The trusted security processing unit parses the ciphertext packet and separates the header byte sequence and the encrypted data body according to the length prefix structure. The header byte sequence is deserialized, and the weighted complexity index and sensitivity level are extracted. Based on the sensitivity level, the encrypted data body is decrypted to obtain the data block.

5. The traceability method for protecting ophthalmic patient privacy as described in claim 4, characterized in that: The process of building the database and tracing its origins includes: The intensity difference between adjacent pixels in each row of the final output image is calculated and binarized to generate a binary matrix. The binary matrix is ​​then expanded in row-major order to obtain a binary sequence. The binary sequence is then converted into a hexadecimal string as the perceptual hash value of the image. The perceptual hash value, image generation timestamp, currently verified identity identifier, and weighted complexity index are encapsulated to obtain traceability records. Through the INSERT operation of the database management system, the records are atomically inserted into a database table named trace_log to build the database. When it is necessary to trace the source of the final output image, an exact query operation is performed in the database. If a record exists, the tracing is successful; otherwise, "No matching generated record found" is output.

6. The traceability method for protecting ophthalmic patient privacy as described in claim 1, characterized in that: The process of collecting and preprocessing multi-source data to generate a byte data stream includes: Data from multiple sources is collected from HIS and PACS via API interfaces, and then denoised and standardized to obtain a byte data stream.

7. A traceability system for protecting the privacy of ophthalmic patients, based on the traceability method for protecting the privacy of ophthalmic patients as described in any one of claims 1 to 6, characterized in that: include, The acquisition and processing module is used to acquire fundus images and text data from HIS and PACS systems, and to perform noise reduction, standardization and conversion into byte data streams; The segmentation module is used to segment the byte data stream into data blocks, perform Gray code transformation on each data block, calculate the boundary flip number of each data block, evaluate the complexity of the data block according to the weighted complexity index, and classify the data blocks into high-sensitivity data or low-sensitivity data based on the sensitivity level of the data block segmentation according to the weighted complexity index and Otsu's method. The encryption / decryption module is used to encrypt data blocks according to their sensitivity level, authenticate client requests, generate access tokens, decrypt ciphertext according to its sensitivity level, and recover the data blocks. The source tracing and query module is used to generate perceptual hash values ​​for images. It generates hash values ​​by calculating intensity differences and performing binarization, inserts source tracing records into the database, and performs precise queries when needed.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the traceability method for protecting the privacy of ophthalmic patients as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the traceability method for protecting the privacy of ophthalmic patients as described in any one of claims 1 to 6.

Images