Medical data security sharing method, equipment and medium

Abstract

The invention discloses a medical data security sharing method and device and a medium, and relates to the technical field of data security sharing, and the method comprises the steps: collecting the related information of medical data nodes, generating a node grouping scheme, determining a list of network nodes at all levels, electing a second-level network aggregation node and a first-level network main aggregation node, the task publisher carries out federal learning task distribution; the method comprises the following steps: training a local model in a local data set by medical data nodes, performing intra-group aggregation on local model parameters uploaded by other medical data nodes in a group by each group of aggregation nodes after training is completed, and performing inter-group aggregation by a main aggregation node to complete global model aggregation; after node information is updated, the global aggregated in the current round is used as a starting point of training in the next round, and redistribution is carried out until the model converges; and deploying the final model to each medical data node service scene to realize medical data value sharing. Therefore, decentralization can be realized, the credibility of the whole process is guaranteed through multiple verifications, and cross-mechanism data security sharing is realized.

Description

Technical Field

[0001] This invention relates to the field of data security sharing technology, and in particular to a method, device and medium for secure sharing of medical data. Background Technology

[0002] With the development of smart healthcare, the demand for cross-regional and cross-institutional medical data sharing is becoming increasingly urgent. Traditional models suffer from both "data silos" and privacy risks. While federated learning can achieve "data usable but not visible," traditional architectures rely on a central server to coordinate model aggregation. This not only presents single points of failure and performance bottlenecks but also easily becomes a trust bottleneck. Malicious attackers can tamper with server data or intercept transmission parameters, leading to global model bias. In traditional blockchain-federated learning solutions, communication overhead increases exponentially with the number of nodes, making it unsuitable for large-scale medical node collaboration. Simply putting the federated learning process on the blockchain introduces high latency and lacks verification and auditing mechanisms for the reliability of the local training process. The data from geographically dispersed nodes exhibits non-independent and identically distributed characteristics, with significant differences in computing power, leading to difficulties in model convergence and low hardware processing speeds. Summary of the Invention

[0003] The purpose of this invention is to provide a method, device, and medium for secure sharing of medical data, which can be decentralized, eliminate single points of failure and performance bottlenecks, reduce node communication overhead, adapt to heterogeneous data and differences in computing power, improve hardware processing efficiency, and realize secure sharing of medical data across institutions.

[0004] To address the aforementioned technical problems, this invention provides a method for secure sharing of medical data, comprising:

[0005] Collect relevant information about medical data nodes and generate a node grouping scheme; the node grouping scheme includes the mapping relationship between the medical data nodes and the secondary network; the medical data nodes are the data providers for federated learning;

[0006] The node list of each secondary network is determined according to the node grouping scheme, and the aggregation node of the secondary network and the main aggregation node of the primary network are elected. The task publisher distributes the federated learning task. The task publisher provides a unified federated learning unit and a shared model. The primary network is composed of the aggregation nodes of each secondary network.

[0007] Medical data nodes train local models on local datasets. After training, the local model parameters are uploaded to the blockchain network. When the number of uploaded medical data nodes reaches a threshold, the aggregation node of the secondary network sends an aggregation task to the smart contract unit.

[0008] After the aggregation task is triggered, each group of aggregation nodes performs intra-group aggregation of the model. After the intra-group aggregation is completed, the main aggregation node of the first-level network performs inter-group aggregation to complete the global model aggregation and generate the global model for this round of aggregation.

[0009] Update node information based on node behavior during this training round, use the global model aggregated in this round as the starting point for the next training round, redistribute the model, and repeat the node election, model training, and model aggregation operations until the global model converges and the target global model is obtained.

[0010] The target global model is deployed to the business scenarios where each of the medical data nodes is located, so that each of the medical data nodes can share the value of medical data through the target global model.

[0011] Firstly, in the medical data secure sharing method provided by the present invention, before collecting relevant information of medical data nodes, the method further includes:

[0012] The system receives the public key and identity information of the medical data node and sends them to the Certificate Authority, so that the Certificate Authority can verify the identity information of the medical data node through a preset offline or trusted channel.

[0013] After successful verification, the private key of the certificate authorization center is used to generate a digital certificate for the medical data node, and the digital certificate is used as the credential of the zero-trust security system.

[0014] Start the zero-trust agent on the medical data node, and control the zero-trust agent to submit a registration request to the zero-trust controller using the digital certificate to confirm that the medical data node is online.

[0015] On the other hand, in the above-mentioned medical data secure sharing method provided by the present invention, collecting relevant information of medical data nodes and generating a node grouping scheme includes:

[0016] The collected medical data nodes contain information about the node's longitude, latitude, and computing power;

[0017] The FCM clustering algorithm is run, using node longitude, latitude, and computing power as clustering algorithm parameters. The number of groups is determined, the maximum number of iterations and error threshold are given, and initial values ​​are set. The node longitude and latitude are normalized, and a matrix is ​​constructed from the feature values ​​of node longitude, latitude, and computing power. A membership matrix is ​​randomly generated. New cluster centers are calculated, and the updated membership matrix is ​​calculated. The calculation operations of cluster centers and membership matrices are repeated until the preset maximum number of iterations is reached or the calculation error is less than the set threshold, and the grouping results are obtained to generate a node grouping scheme.

[0018] The node grouping scheme is written into the blockchain network so that each medical data node can access the blockchain to obtain its own group information.

[0019] On the other hand, in the above-mentioned medical data secure sharing method provided by the present invention, determining the node list of each of the secondary networks according to the node grouping scheme, and electing the aggregation node of the secondary network and the main aggregation node of the primary network, includes:

[0020] Read the grouping information corresponding to the node grouping scheme on the blockchain network to determine the node list of each secondary network;

[0021] Query the reputation score and online status data of each medical data node, and filter out medical data nodes with excessive reputation scores or that are unavailable;

[0022] From the remaining filtered medical data nodes, a set number of nodes with the highest reputation score and lowest load are selected to form the first candidate pool;

[0023] Each group selects a set number of nodes with the highest reputation score and lowest load from the remaining filtered medical data nodes to form a candidate pool.

[0024] A round-robin algorithm is executed on the candidate pool to elect the aggregation node for each group in this round; each group of aggregation nodes in this round becomes a member of the first-level network and forms a master node candidate pool; all nodes vote on the nodes in the master node candidate pool to elect the master aggregation node for this round, and the election results of each level of the network are written into the corresponding level of the blockchain.

[0025] On the other hand, in the above-mentioned medical data secure sharing method provided by the present invention, the medical data node trains a local model on a local dataset, including:

[0026] The access control policy generated by the zero-trust controller for this round of training is signed with the private key of the zero-trust controller and then sent to the zero-trust agent of the target medical data node.

[0027] The zero-trust proxy of the target medical data node is used to verify the signature of the access control policy. After the verification is successful, the local trusted execution environment module is invoked to create a hardware-level security enclave.

[0028] The zero-trust agent loads the encrypted local training set into the secure enclave and decrypts the data using a key securely issued by the zero-trust controller; plaintext data is isolated entirely within the secure enclave.

[0029] The training process is initiated within the secure enclave, while the zero-trust proxy is controlled to intercept operations that violate the access control policy and record relevant security events.

[0030] After training is completed, the initial hash value of the model update is calculated inside the secure enclave, and the initial hash value is signed using the node's private key to generate a node signature; after verification by the zero-trust proxy, the signed model is allowed to be output from the secure enclave; the signed model includes the model parameter update result and the node signature.

[0031] On the other hand, in the above-mentioned medical data secure sharing method provided by the present invention, each group of aggregation nodes performs intra-group aggregation of the model, and after the intra-group aggregation is completed, the main aggregation node of the first-level network performs inter-group aggregation, including:

[0032] Each aggregation node downloads the local model parameters uploaded by other medical data nodes within the group to its local machine and executes the aggregation task within the group.

[0033] Once all aggregation nodes have completed their intra-group aggregation tasks, the primary aggregation node of the first-level network aggregates all the aggregation model parameters uploaded by all groups into new global model parameters and updates the shared model.

[0034] On the other hand, the above-mentioned medical data secure sharing method provided by the present invention also includes:

[0035] The primary aggregation node of the first-level network packages the data requests of this round into blocks, encapsulates them into announcement messages, and announces them to the aggregation nodes of other groups;

[0036] After receiving the notification message, the aggregation nodes of each group conduct PBFT consensus within the group and send the first confirmation message to the main aggregation node, thus entering the inter-group consensus phase.

[0037] After receiving the first confirmation from more than half of the aggregation nodes, the primary aggregation node sends the second confirmation.

[0038] After receiving the second confirmation message, other aggregation nodes send the third confirmation message to the main aggregation node. At this point, the consensus process within and between groups is complete.

[0039] Each aggregation node in a group sends execution information to notify the nodes in the group to write the block locally; after the main aggregation node receives the messages from all aggregation nodes, the consensus communication is completed.

[0040] On the other hand, in the above-mentioned medical data secure sharing method provided by the present invention, the global model aggregated in this round is used as the starting point for the next round of training and redistributed, and the operations of node election, model training and model aggregation are performed cyclically until the global model converges to obtain the target global model, including:

[0041] The global model aggregated in this round is distributed to each of the secondary networks as the starting point for the next round of training;

[0042] The hash values ​​of key events during the training process are written into the blockchain to form an audit trail chain;

[0043] Malicious nodes are isolated, and the process is redirected to the main aggregation node election phase to start a new round of training;

[0044] The model is redistributed, and node election, model training, and model aggregation are performed repeatedly until the global model converges, resulting in the target global model.

[0045] To address the aforementioned technical problems, the present invention also provides an electronic device, comprising:

[0046] Memory, used to store computer programs;

[0047] A processor is used to implement the steps of the above-described method for secure sharing of medical data when executing the computer program.

[0048] To address the aforementioned technical problems, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the aforementioned medical data secure sharing method.

[0049] The medical data secure sharing method provided by this invention first collects relevant information of medical data nodes and generates a node grouping scheme. The node grouping scheme includes the mapping relationship between medical data nodes and secondary networks. Medical data nodes are the data providers for federated learning. Then, based on the node grouping scheme, the node list of each secondary network is determined, and the aggregation nodes of the secondary networks and the main aggregation nodes of the primary network are elected. The task publisher distributes the federated learning tasks. The task publisher provides a unified federated learning unit and a shared model, and notifies all medical data nodes to start the training task. The primary network consists of the aggregation nodes of each secondary network. Afterwards, the medical data nodes train a local model on their local dataset, and after training, upload the local model parameters to the blockchain network. In a network, when the number of uploaded medical data nodes reaches a threshold, the aggregation node of the secondary network sends an aggregation task to the smart contract unit. After the aggregation task is triggered, each group of aggregation nodes performs intra-group aggregation of the model. After intra-group aggregation is completed, the main aggregation node of the primary network performs inter-group aggregation to complete the global model aggregation and generate the global model for this round of aggregation. The node information is updated according to the node behavior during this round of training, and the global model aggregated in this round is used as the starting point for the next round of training and redistributed. The operations of node election, model training and model aggregation are repeated until the global model converges and the target global model is obtained. The target global model is deployed to the business scenarios where each medical data node is located so that each medical data node can share the value of medical data through the global model. This hierarchical model aggregation decentralization eliminates single points of failure and performance bottlenecks of the central server, while enabling secure cross-institutional data sharing without sharing original medical data, balancing privacy protection and data value mining. Furthermore, it effectively reduces the communication overhead that increases with the number of nodes, avoids the performance limitations of blockchain on federated learning applications, and can adapt to the heterogeneous data and computing power differences of geographically dispersed nodes, improving hardware processing efficiency and facilitating the efficient realization of multi-center collaborative modeling.

[0050] In addition, the present invention also provides corresponding electronic devices and computer-readable storage media for the method of secure sharing of medical data, which have the same or corresponding technical features as the above-mentioned method of secure sharing of medical data and have the same effect. Attached Figure Description

[0051] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 A flowchart of a medical data secure sharing method provided in an embodiment of the present invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0054] It should be noted that, in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0055] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0056] The specific application environment architecture or specific hardware architecture on which the implementation of the medical data secure sharing method depends is described here.

[0057] The embodiments of the present invention provide a method for secure sharing of medical data, and the method is described in detail below in conjunction with the execution flow of the method for secure sharing of medical data. Figure 1 A flowchart of a medical data secure sharing method provided in an embodiment of the present invention is shown below. Figure 1 As shown, the method includes:

[0058] S101. Collect relevant information about medical data nodes and generate a node grouping scheme; the node grouping scheme includes the mapping relationship between medical data nodes and secondary networks; medical data nodes are the data providers for federated learning.

[0059] It should be noted that the aforementioned medical data nodes are servers belonging to medical institutions that possess local data and serve as data providers for federated learning. Federated learning is a distributed machine learning technique that allows participating parties to jointly train models without sharing the original data. The relevant information for medical data nodes can include the latitude, longitude, and computing power of different types of nodes, such as hospitals, community health service centers, and medical testing institutions. The information for medical data nodes can also include data features processed with privacy protection measures, which may include electronic medical record diagnostic features, medical image annotation features, and statistical features of laboratory indicators, ensuring that patient privacy is not compromised.

[0060] The aforementioned secondary network consists of multiple sub-networks composed of data nodes according to a dynamic grouping strategy (node ​​grouping scheme), used for intra-group model aggregation and consensus. That is, this invention performs intra-group model aggregation within the secondary network. This invention can combine the geographic attributes, computing power, and data volume of medical data nodes with data distribution characteristics processed for differential privacy protection to perform comprehensive clustering analysis, generating a node grouping scheme. This dynamically constructs the secondary network, thereby optimizing the independent and identically distributed (IID) nature of data within the group and achieving system load balancing.

[0061] The mapping relationship between medical data nodes and secondary networks is the corresponding rule for determining which secondary network each medical data node belongs to. For example, community health service center nodes in the same region are assigned to the same secondary network, or hospital nodes of the same specialty are grouped together to reduce the cost of cross-group data interaction and improve the homogeneity of data within the group.

[0062] S102. Determine the node list of each secondary network according to the node grouping scheme, elect the aggregation node of the secondary network and the main aggregation node of the primary network, and distribute the federated learning task by the task publisher; the task publisher provides a unified federated learning unit and a shared model; the primary network is composed of the aggregation nodes of each secondary network.

[0063] It should be noted that each medical data node in the network becomes a task publisher when there is a need for model training. As a data requester, the task publisher needs to provide a unified federated learning unit and a shared model. The remaining nodes, or all nodes, act as data providers, performing local data processing and model testing using the federated learning unit and the shared model. The data providers then publish the results of data processing and model testing to the consortium blockchain network. Therefore, this invention involves the distribution of federated learning tasks by the task publisher.

[0064] The aforementioned primary network consists of aggregation nodes from various secondary networks, used for global model aggregation and consensus. It can run a lightweight consensus mechanism based on Byzantine Fault Tolerance (BFT). BFT includes Practical Byzantine Fault Tolerance (PBFT), Delegated Byzantine Fault Tolerance (DBFT), and Federated Byzantine Agreement (FBA), etc. Here, a consensus mechanism with minimal data overhead can be selected for consensus, with Practical Byzantine Fault Tolerance (PBFT) being the preferred choice.

[0065] This invention employs a multi-level dynamic network architecture: replacing the federated learning center server with a hierarchical consortium blockchain structure consisting of a first-level network (global consensus) and a second-level network (local consensus). Data nodes are dynamically and adaptively grouped into multiple second-level networks. Within each second-level network, data nodes intelligently elect a convergence node to form a first-level network with convergence nodes from other second-level networks. Convergence nodes perform intra-group aggregation within their respective second-level networks, and within the first-level network, a master convergence node is selected through intelligent election for global aggregation, eliminating centralized dependencies. A consortium blockchain is a blockchain open only to a specific group, combining decentralization and controllability. The hierarchical consortium blockchain structure of this invention can store key metadata such as the global model, aggregation results, consensus proofs, and security event hashes, providing an immutable foundation of trust.

[0066] In implementation, each secondary network can adopt Reduced-Practical Byzantine Fault Tolerance (R-PBFT) consensus based on reputation delegation. Specifically, trusted nodes are selected through node election to form a consensus committee, reducing the size of the consensus node and improving efficiency. Since the primary network consists entirely of aggregation nodes, PBFT consensus can be used without further node selection, significantly reducing blockchain communication overhead, increasing system throughput, and solving the throughput bottleneck problem of distributed federated learning.

[0067] S103. Medical data nodes train local models on local datasets. After training, the local model parameters are uploaded to the blockchain network. When the number of uploaded medical data nodes reaches a threshold, the aggregation node of the secondary network sends an aggregation task to the smart contract unit.

[0068] It should be noted that medical data nodes upload model parameters instead of raw medical data, thus avoiding the risk of sensitive medical data leakage and complying with medical data privacy protection requirements. Using a threshold number of uploading nodes as the trigger condition for the smart contract replaces the manual intervention to initiate aggregation tasks, ensuring the objectivity and timeliness of aggregation timing. Aggregation tasks initiated by secondary network aggregation nodes not only adapt to the hierarchical architecture design after node grouping but also limit the aggregation task to the group scope, avoiding efficiency losses caused by global synchronization waiting, and laying the foundation for the orderly advancement of subsequent intra-group and global aggregation.

[0069] S104. After the aggregation task is triggered, each group aggregation node performs intra-group aggregation of the model. After the intra-group aggregation is completed, the primary aggregation node of the first-level network performs inter-group aggregation to complete the global model aggregation and generate the global model for this round of aggregation.

[0070] In implementation, this invention first aggregates models within each group using aggregation nodes. This allows for the initial integration of model parameters from numerous dispersed medical data nodes within the group, significantly reducing the data processing load during subsequent inter-group aggregation by the main aggregation node. This avoids the excessive computational pressure and inefficiency caused by direct global aggregation. The hierarchical logic of intra-group aggregation corresponding to a secondary network and inter-group aggregation corresponding to a primary network is highly compatible with the secondary / primary network architecture formed by node group election, ensuring hierarchical consistency throughout the federated learning process. Hierarchical aggregation first integrates local features of medical data nodes within the same group, and then integrates global features of data from different groups through inter-group aggregation. This ensures that the final global model not only fits the characteristics of local medical data but also considers the overall data distribution, improving the model's adaptability to medical scenarios.

[0071] S105. Update node information based on node behavior during this training round, take the global model aggregated in this round as the starting point for the next training round, and redistribute it. Repeat the node election, model training and model aggregation operations until the global model converges and the target global model is obtained.

[0072] It should be noted that this invention can update node information based on node behavior during the current training round, using the global model aggregated in this round as the starting point for the next round of training. Then, the data is redistributed, and steps S102 to S105 are executed iteratively. For example, after electing the secondary network aggregation node and consensus committee members, and the primary network master aggregation node, the master aggregation node distributes the federated learning task. After training, each data node performs model aggregation according to the aggregation process until the master aggregation node completes the global model aggregation. Subsequently, node information continues to be updated, using the global model aggregated in this round as the starting point for the next round of training, until the global model converges, obtaining the final target global model.

[0073] S106. Deploy the target global model to the business scenarios where each medical data node is located, so that each medical data node can share the value of medical data through the target global model.

[0074] In implementation, the target global model serves as an aggregation carrier of privacy data features from multiple medical data nodes (such as different hospitals and community health centers), rather than a tool for transferring raw data. When each medical data node calls the deployed target global model, there is no need to transmit sensitive raw data such as medical records and images; they only need to input local data to obtain results that integrate multi-center experience. Essentially, it conveys the underlying patterns and value of the data through the model, rather than sharing the data itself. This value sharing through the target global model satisfies the capability needs of primary hospitals (such as improving accuracy by using cross-hospital trained models) while avoiding the risk of data leakage, aligning with the actual demands of multi-center medical collaboration.

[0075] In the medical data secure sharing method provided in this embodiment of the invention, firstly, relevant information of medical data nodes is collected to generate a node grouping scheme; the node grouping scheme includes the mapping relationship between medical data nodes and secondary networks; the medical data nodes are the data providers for federated learning; then, based on the node grouping scheme, the node list of each secondary network is determined, and the aggregation node of the secondary network and the main aggregation node of the primary network are elected, and the task publisher distributes the federated learning task; the task publisher provides a unified federated learning unit and a shared model, and notifies all medical data nodes to start the training task; the primary network consists of the aggregation nodes of each secondary network; then, the medical data nodes train a local model on their local dataset, and after training, upload the local model parameters to the block. In this blockchain network, when the number of uploaded medical data nodes reaches a threshold, the aggregation node of the secondary network issues an aggregation task to the smart contract unit. After the aggregation task is triggered, each group of aggregation nodes performs intra-group aggregation of the model. After intra-group aggregation is completed, the main aggregation node of the primary network performs inter-group aggregation, completing the global model aggregation and generating the global model for this round of aggregation. Based on the node behavior during this round of training, the node information is updated, and the global model aggregated in this round is used as the starting point for the next round of training. The model is then redistributed, and the operations of node election, model training, and model aggregation are repeated until the global model converges, resulting in the target global model. The target global model is then deployed to the business scenarios where each medical data node is located, enabling each medical data node to share the value of medical data through the global model. This consortium blockchain structure, which constructs a "primary network (global) - secondary network (local)" structure, replaces the traditional central server, solving the pain points of traditional solutions from multiple dimensions and generating significant benefits. On the one hand, the hierarchical model aggregation decentralization eliminates the single point of failure and performance bottleneck of the central server, while achieving secure cross-institutional data sharing without sharing the original medical data, balancing privacy protection and data value mining. On the other hand, it effectively reduces the communication overhead that increases with the number of nodes, avoids the performance limitations of blockchain on federated learning applications, and can also adapt to the heterogeneous data and computing power differences of geographically dispersed nodes, improve hardware processing efficiency, and help achieve efficient multi-center collaborative modeling.

[0076] In practical applications, this invention can be applied to the field of cross-institutional collaborative modeling of medical data combining federated learning and blockchain. It involves medical data security sharing technology and can be widely applied to scenarios such as cross-hospital clinical research collaboration, multi-center disease prediction model construction, and regional medical data value mining. Through the method provided by this invention, different hospital nodes can complete collaborative model training without sharing original medical records. In the scenario of regional medical data value mining, it can both ensure the secure participation of primary healthcare institutions and enable medical data value sharing through a global model, effectively solving the dual challenges of medical data silos and privacy protection.

[0077] Furthermore, in a specific implementation, in the above-mentioned medical data secure sharing method provided in the embodiments of the present invention, before performing step S101 to collect relevant information of the medical data node, it may further include: receiving the public key and identity information of the medical data node and sending them to a Certificate Authority (CA), so that the CA can verify the identity information of the medical data node through a preset offline or trusted channel; after verification, calling the private key of the CA to generate a digital certificate for the medical data node, and using the digital certificate as a credential of the zero-trust security system; starting the zero-trust agent on the medical data node, and controlling the zero-trust agent to use the digital certificate to submit a registration request to the ZeroTrust Controller (ZTC) to confirm that the medical data node is online.

[0078] It's important to note that the Zero Trust Agent (ZTA) is a lightweight software agent pre-installed on each data node. It enforces security measures to ensure secure data and model transmission, preventing unauthorized access or tampering. Under Zero Trust supervision, the model training process on the local privacy data of medical data nodes is dynamically monitored, allowing for real-time interception of abnormal operations (such as tampering with training data or malicious parameter adjustments), mitigating the risk of model contamination at its source. The model here is designed for medical tasks and utilizes relevant medical data. After training, the updated model data is hashed and signed. The hash value uniquely maps to the model content, ensuring integrity, while the signature uses the node's digital identity to confirm its origin. Together, they form an immutable digital credential. After verification by the Zero Trust Agent, the results are exported. The agent verifies the signature's legitimacy and hash consistency. Only model updates that pass this double verification can proceed to the next stage, effectively solving the problem of ensuring the reliability of local model updates in traditional federated learning. This provides a reliable data foundation for consensus and aggregation in subsequent secondary networks.

[0079] The Certificate Authority (CA) is used to issue and manage digital certificates for all medical data nodes, forming the cornerstone of zero-trust security. The Zero-Trust Controller, existing as a smart contract, manages the identity lifecycle of all medical data nodes, generates and distributes dynamic access policies, receives security event alerts, and makes dynamic response decisions. The Zero-Trust Agent can be used locally to execute policies issued by the Zero-Trust Controller, enforce security measures, and collect local security logs, uploading them to the Zero-Trust Controller and the blockchain.

[0080] In implementation, the above process constitutes the system initialization and security access control phase, aiming to ensure that only trusted nodes join the network. First, the medical data node submits its public key and identity information to the Certificate Authority (CA) to apply for a digital certificate. Next, the CA verifies the authenticity and legitimacy of the medical data node's identity through offline channels or trusted channels. After successful verification, the CA issues a digital certificate to the medical data node using its private key. Finally, the zero-trust agent on the medical data node starts up and registers with the zero-trust controller using the newly issued digital certificate, declaring itself online.

[0081] This invention, through the synergy of a zero-trust controller and a zero-trust agent, extends the security boundary from the network layer to the local computing environment of each medical data node, implementing mandatory access control based on continuous verification and the principle of least privilege. This extends the zero-trust principle from the network communication domain into the computing environment, enabling continuous verification and mandatory access control of the identity of medical data nodes, local training behavior, and data flow, thus comprehensively strengthening system security.

[0082] Furthermore, in a specific implementation, in the above-mentioned medical data secure sharing method provided in the embodiments of the present invention, step S101 collects relevant information of medical data nodes and generates a node grouping scheme, which may specifically include: collecting information on the longitude a, latitude o, and computing power p of the medical data nodes; running the FCM clustering algorithm, using the node longitude a, latitude o, and computing power p as clustering algorithm parameters, determining the number of groups K, giving the maximum number of iterations M and the error threshold μ and setting an initial value L, normalizing the node longitude a and latitude o, constructing an N*3 matrix X from the feature values ​​composed of the node longitude a, latitude o, and computing power p, and randomly generating a membership matrix U; calculating the new cluster center C, and then calculating the updated membership matrix U(L+1); repeatedly executing the calculation operations of the cluster center and membership matrix until the preset maximum number of iterations is reached or the calculation error is less than the set threshold, obtaining the grouping result to generate a node grouping scheme; and writing the node grouping scheme into the blockchain network so that each medical data node can access the blockchain to obtain its own group information.

[0083] In implementation, this invention utilizes a grouping service to run the FCM clustering algorithm. The grouping service (also known as dynamic grouping service) exists in the form of a smart contract, used to periodically combine the geographical information, computing power, and data characteristics of medical data nodes to perform clustering analysis, dynamically adjusting the grouping of the secondary network to ensure that the grouping adapts to the actual operational needs of the system. This invention can select three features strongly correlated with the physical location and computing resources of medical data nodes—longitude 'a', latitude 'o', and computing power 'p'—as clustering parameters. This allows the grouping results to consider both the geographical distribution of nodes and the matching degree of computing power, avoiding imbalances in subsequent training efficiency due to uneven node resources. By eliminating the dimensional differences between latitude / longitude and computing power through normalization processing, and iteratively optimizing the cluster centers and membership matrices until the termination condition is met, this not only conforms to the core principles of FCM fuzzy clustering but also controls the algorithm's convergence through preset iteration counts and error thresholds, avoiding excessive iteration or insufficient accuracy in the grouping results. By writing the grouping scheme into the blockchain and leveraging the blockchain's immutability and traceability, it is ensured that all medical data nodes can obtain unified and reliable grouping information, laying a consistent node grouping foundation for subsequent processes such as hierarchical election and model aggregation.

[0084] Furthermore, in specific implementation, in the above-mentioned medical data secure sharing method provided in the embodiments of the present invention, step S102 determines the node list of each secondary network according to the node grouping scheme, and elects the aggregation node of the secondary network and the main aggregation node of the primary network. Specifically, it may include: reading the grouping information corresponding to the node grouping scheme on the blockchain network to determine the node list of each secondary network; querying the reputation score and online status data of each medical data node, and filtering out medical data nodes with excessive reputation scores or unusable; selecting a set number of nodes with the highest reputation score and lowest load from the remaining filtered medical data nodes in each group to form a candidate pool; executing a round-robin algorithm on the candidate pool to elect the aggregation node of each group in this round; the aggregation nodes of each group in this round become members of the primary network and form a main node candidate pool; all nodes vote on the nodes in the main node candidate pool to elect the main aggregation node in this round, and writing the election results of each level of network into the corresponding level of blockchain.

[0085] In implementation, the above process is the intelligent election phase, aiming to elect reliable leader nodes (i.e., main aggregation nodes) in each secondary and primary network. The overall process can be divided into five steps: candidate pool generation, reputation filtering, elite pool selection, election execution, and result announcement. First, candidate pool generation: the system determines the node list for each secondary network based on grouping information on the blockchain. Next, reputation filtering is performed, querying the latest reputation score and online status of each node to filter out nodes with low reputation or that are unavailable. Then, elite pool selection is conducted, with each group selecting the top K nodes with the highest reputation score and lowest load from the remaining nodes to form an elite candidate pool. The election execution phase proceeds according to network levels: in the secondary network, the aggregation node for each group in this round is elected from the elite candidate pool using a round-robin algorithm. In the primary network, the aggregation nodes in each group automatically become members of the primary network, and then, through the same candidate pool generation, reputation filtering, and elite pool selection process as the secondary network, a main aggregation node candidate pool is formed, and then the main aggregation node for this round is elected using a round-robin algorithm. Finally, the results are announced; the election results are written to their respective blockchains as the authoritative basis for this round of training.

[0086] To ensure the reliability and efficiency of the network leader node, this invention establishes a multi-dimensional reputation score model for medical data nodes. This model can intelligently elect aggregation nodes and consensus committee members based on the real-time reputation score and load status of medical data nodes, prioritizing high-reputation, low-load medical data nodes as leader nodes, while eliminating single-point dependencies.

[0087] Furthermore, in a specific implementation, in the above-described medical data secure sharing method provided in this embodiment of the invention, step S103, in which the medical data node trains a local model on its local dataset, may specifically include: controlling the zero-trust controller to generate the access control policy for this round of training, signing it with the zero-trust controller's private key, and then sending it to the zero-trust proxy of the target medical data node; using the zero-trust proxy of the target medical data node to verify the signature of the access control policy, and after successful verification, invoking the local trusted execution environment (Trusted Execution Environment). The Environment (TEE) module creates a hardware-level secure enclave; it controls the zero-trust agent to load the encrypted local training set into the secure enclave and decrypts the data using a key securely issued by the zero-trust controller; plaintext data is completely isolated within the secure enclave; the training process is started within the secure enclave, while the zero-trust agent is controlled to intercept operations that violate access control policies and record relevant security events; after training is completed, the initial hash value for model updates is calculated within the secure enclave, and the node signature is generated by signing the initial hash value using the node's private key; after verification by the zero-trust agent, the signed model is allowed to be output from the secure enclave; the signed model includes the model parameter update result and the node signature.

[0088] In implementation, local training under zero-trust supervision aims to complete local model updates in a secure and controlled environment, preventing data leakage and malicious behavior. The process proceeds in six steps: First, policy distribution: the zero-trust controller generates a dynamic access control policy for this round of training, signs it, and distributes it to the zero-trust agent on the target node. Next, enclave creation: after verifying the validity of the policy signature, the zero-trust agent calls the local trusted execution environment to create a hardware-level secure enclave. Then, secure loading: the zero-trust agent loads the encrypted local data into the enclave, decrypts it using the key securely distributed by the zero-trust controller, and keeps the plaintext data isolated within the enclave throughout the process to prevent external access. The fourth step is execution and monitoring: the training process is executed within the enclave, and the zero-trust agent monitors system calls in real time outside the enclave, strictly intercepting behaviors that violate the policy and recording security events. Finally, signature output: after training is completed, the hash value H of the local model update W_local is calculated within the enclave, and it is signed with the node's private key to generate Sig_node(H) (node ​​signature). Only after the zero-trust proxy verifies the validity of the output target is the local model update and the corresponding signature (W_local, Sig_node(H)) allowed to leave the enclave.

[0089] Furthermore, in specific implementation, in the above-mentioned medical data secure sharing method provided in the embodiments of the present invention, step S104 involves each group of aggregation nodes performing intra-group aggregation of the model. After the intra-group aggregation is completed, the primary aggregation node of the first-level network performs inter-group aggregation. Specifically, this may include: each group of aggregation nodes downloading the local model parameters uploaded by other medical data nodes in the group to its local machine and executing the intra-group aggregation task; after all aggregation nodes have completed the intra-group aggregation task, the primary aggregation node of the first-level network aggregates the aggregated model parameters uploaded by all groups into new global model parameters and updates the shared model.

[0090] In implementation, this invention allows each group of aggregation nodes to first perform local aggregation of model parameters within their group. This initial integration of local parameters scattered across numerous medical data nodes significantly reduces the computational burden on the main aggregation node, which directly processes all node parameters. It also avoids aggregation delays caused by excessive data volume, making it suitable for scenarios with a large number of medical data nodes and a large volume of parameters. The division of labor—aggregation nodes handling intra-group aggregation tasks while the main aggregation node focuses on inter-group global aggregation—is highly compatible with the hierarchical architecture of a "second-level network - first-level network," fully utilizing the computing resources of nodes at different levels and avoiding overload on a single node. Intra-group aggregation first merges local medical data features (such as regional medical data characteristics) from nodes within the same group, and then integrates features from different groups through global aggregation to form a unified shared model. This preserves the personalized characteristics of local medical data while ensuring the adaptability of the global model to the overall medical scenario, enhancing the practical value of federated learning models in the medical field.

[0091] Furthermore, in specific implementation, the above-mentioned medical data secure sharing method provided in the embodiments of the present invention may further include: the primary aggregation node of the first-level network packages the data request of this round into a block, encapsulates it into an announcement message, and announces it to the aggregation nodes of other groups; after receiving the announcement message, the aggregation nodes of each group perform PBFT consensus within the group and send a first confirmation message to the primary aggregation node, entering the inter-group consensus phase; after receiving the first confirmation message from more than half of the aggregation nodes, the primary aggregation node sends a second confirmation message; after receiving the second confirmation message, the other aggregation nodes send a third confirmation message to the primary aggregation node again, at which point the consensus process within and between groups is completed; the aggregation nodes of each group send execution information to notify the nodes within the group to write the block locally; after the primary aggregation node receives the messages from all aggregation nodes, the consensus communication is completed.

[0092] In implementation, this invention adopts a two-tiered model of intra-group consensus followed by inter-group consensus, perfectly matching the node hierarchy of a "second-level network - first-level network". First, each group's aggregation node organizes the medical data nodes within the group to complete PBFT consensus, ensuring consistent acceptance of the data requests within the group. Then, inter-group consensus is achieved through interaction between the main aggregation node and the aggregation nodes of each group, avoiding the process chaos and efficiency losses caused by direct consensus across levels. The PBFT consensus mechanism itself has fault tolerance, capable of resisting attacks from a certain number of malicious nodes. The triggering condition of more than half of the confirmation information and the design of three-way confirmation information interaction further strengthen the rigor of the consensus process, ensuring that the consensus result at each step is recognized by a majority of nodes, effectively preventing the risk of data tampering, and meeting the stringent requirements for security and trustworthiness of medical data. After consensus is completed, each group's aggregation node notifies the nodes within the group to write blocks, and the main aggregation node waits for feedback from all aggregation nodes to ensure that the consensus result of this round can be synchronized to all medical data nodes, providing a unified and reliable data foundation for the next round of federated learning training.

[0093] Furthermore, in specific implementation, in the above-mentioned medical data secure sharing method provided in the embodiments of the present invention, step S105 takes the global model aggregated in this round as the starting point of the next round of training and redistributes it, and performs node election, model training and model aggregation operations in a loop until the global model converges and the target global model is obtained. Specifically, it may include: distributing the global model aggregated in this round to each secondary network as the starting point of the next round of training; writing the hash values ​​of key events in the training process into the blockchain to form an audit trail chain; isolating malicious nodes and jumping to the main aggregation node election stage to start a new round of training; redistributing and performing node election, model training and model aggregation operations in a loop until the global model converges and the target global model is obtained.

[0094] In implementation, this invention uses the global model aggregated in the current round as the starting point for the next round of training, achieving layer-by-layer optimization and cumulative iteration of model parameters. This allows the global model to continuously absorb local features from various medical data nodes across multiple training rounds, constantly improving its adaptability to medical scenarios and avoiding resource waste and efficiency losses associated with starting training from scratch in each round. By writing the hash values ​​of key training events into the blockchain and leveraging its immutability to form a complete audit trail, the invention enables full-process traceability of core processes such as model distribution, parameter uploading, and aggregation execution. This not only meets the compliance requirements for auditable data and model operations in medical data but also provides a reliable basis for tracing potential problems later. Isolating malicious nodes and redirecting them to the main aggregation node election stage to start a new round of training effectively eliminates malicious nodes that affect training security and model accuracy, ensuring the purity of the federated learning network. Simultaneously, by re-electing the main aggregation node and cyclically executing the training process, the invention ensures that model training is not interrupted due to individual node anomalies, maintaining the stability and robustness of the entire medical federated learning system.

[0095] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0096] Embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above embodiments of the medical data secure sharing method.

[0097] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program configured to execute the steps in any of the above embodiments of the medical data secure sharing method.

[0098] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0099] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the medical data secure sharing method.

[0100] Embodiments of the present invention also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above embodiments of the medical data secure sharing method.

[0101] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0102] The present invention has provided a detailed description of a method, device, and medium for secure sharing of medical data. Specific examples have been used to illustrate the principles and implementation methods of the invention. The descriptions of these embodiments are only intended to aid in understanding the method and core ideas of the invention. It should be noted that those skilled in the art can make various improvements and modifications to the invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the invention.

Claims

1. A method for securely sharing medical data, characterized in that, include: Collect relevant information about medical data nodes and generate a node grouping scheme; the node grouping scheme includes the mapping relationship between medical data nodes and secondary networks; The medical data node is the data provider for federated learning; The node list of each secondary network is determined according to the node grouping scheme, and the aggregation node of the secondary network and the main aggregation node of the primary network are elected. The task publisher distributes the federated learning task. The task publisher provides a unified federated learning unit and a shared model. The primary network is composed of the aggregation nodes of each secondary network. Medical data nodes train local models on local datasets. After training, the local model parameters are uploaded to the blockchain network. When the number of uploaded medical data nodes reaches a threshold, the aggregation node of the secondary network sends an aggregation task to the smart contract unit. After the aggregation task is triggered, each group of aggregation nodes performs intra-group aggregation of the model. After the intra-group aggregation is completed, the main aggregation node of the first-level network performs inter-group aggregation to complete the global model aggregation and generate the global model for this round of aggregation. Update node information based on node behavior during this training round, use the global model aggregated in this round as the starting point for the next training round, redistribute the model, and repeat the node election, model training, and model aggregation operations until the global model converges and the target global model is obtained. The target global model is deployed to the business scenarios where each of the medical data nodes is located, so that each of the medical data nodes can share the value of medical data through the target global model.

2. The method for securely sharing medical data according to claim 1, characterized in that, Before collecting relevant information about medical data nodes, the process also includes: The system receives the public key and identity information of the medical data node and sends them to the Certificate Authority, so that the Certificate Authority can verify the identity information of the medical data node through a preset offline or trusted channel. After successful verification, the private key of the certificate authorization center is used to generate a digital certificate for the medical data node, and the digital certificate is used as the credential of the zero-trust security system. Start the zero-trust agent on the medical data node, and control the zero-trust agent to submit a registration request to the zero-trust controller using the digital certificate to confirm that the medical data node is online.

3. The method for securely sharing medical data according to claim 1, characterized in that, Collect relevant information about medical data nodes and generate a node grouping scheme, including: The collected medical data nodes contain information about the node's longitude, latitude, and computing power; The FCM clustering algorithm is run, using node longitude, latitude, and computing power as clustering algorithm parameters. The number of groups is determined, the maximum number of iterations and error threshold are given, and initial values ​​are set. The node longitude and latitude are normalized, and a matrix is ​​constructed from the feature values ​​of node longitude, latitude, and computing power. A membership matrix is ​​randomly generated. New cluster centers are calculated, and the updated membership matrix is ​​calculated. The calculation operations of cluster centers and membership matrices are repeated until the preset maximum number of iterations is reached or the calculation error is less than the set threshold, and the grouping results are obtained to generate a node grouping scheme. The node grouping scheme is written into the blockchain network so that each medical data node can access the blockchain to obtain its own group information.

4. The method for securely sharing medical data according to claim 3, characterized in that, Based on the node grouping scheme, the node list of each secondary network is determined, and the aggregation node of the secondary network and the main aggregation node of the primary network are elected, including: Read the grouping information corresponding to the node grouping scheme on the blockchain network to determine the node list of each secondary network; Query the reputation score and online status data of each medical data node, and filter out medical data nodes with excessive reputation scores or that are unavailable; Each group selects a set number of nodes with the highest reputation score and lowest load from the remaining filtered medical data nodes to form a candidate pool. A round-robin algorithm is executed on the candidate pool to elect the aggregation node for each group in this round; each group of aggregation nodes in this round becomes a member of the first-level network and forms a master node candidate pool; all nodes vote on the nodes in the master node candidate pool to elect the master aggregation node for this round, and the election results of each level of the network are written into the corresponding level of the blockchain.

5. The method for secure sharing of medical data according to claim 1, characterized in that, The local model is trained on the local dataset by the medical data nodes, including: The access control policy generated by the zero-trust controller for this round of training is signed with the private key of the zero-trust controller and then sent to the zero-trust agent of the target medical data node. The zero-trust proxy of the medical data node is used to verify the signature of the access control policy. After the verification is successful, the local trusted execution environment module is invoked to create a hardware-level security enclave. The zero-trust agent loads the encrypted local training set into the secure enclave and decrypts the data using a key securely issued by the zero-trust controller; plaintext data is isolated entirely within the secure enclave. The training process is initiated within the secure enclave, while the zero-trust proxy is controlled to intercept operations that violate the access control policy and record relevant security events. After training is completed, the initial hash value of the model update is calculated inside the secure enclave, and the initial hash value is signed using the node's private key to generate a node signature; after verification by the zero-trust proxy, the signed model is allowed to be output from the secure enclave; the signed model includes the model parameter update result and the node signature.

6. The method for securely sharing medical data according to claim 1, characterized in that, Each group of aggregation nodes performs intra-group aggregation of the model. After intra-group aggregation is completed, the main aggregation node of the first-level network performs inter-group aggregation, including: Each aggregation node downloads the local model parameters uploaded by other medical data nodes within the group to its local machine and executes the aggregation task within the group. Once all aggregation nodes have completed their intra-group aggregation tasks, the primary aggregation node of the first-level network aggregates all the aggregation model parameters uploaded by all groups into new global model parameters and updates the shared model.

7. The method for secure sharing of medical data according to claim 1, characterized in that, Also includes: The primary aggregation node of the first-level network packages the data requests of this round into blocks, encapsulates them into announcement messages, and announces them to the aggregation nodes of other groups; After receiving the notification message, the aggregation nodes of each group conduct PBFT consensus within the group and send the first confirmation message to the main aggregation node, thus entering the inter-group consensus phase. After receiving the first confirmation from more than half of the aggregation nodes, the primary aggregation node sends the second confirmation. After receiving the second confirmation message, other aggregation nodes send the third confirmation message to the main aggregation node. At this point, the consensus process within and between groups is complete. Each aggregation node in a group sends execution information to notify the nodes in the group to write the block locally; after the main aggregation node receives the messages from all aggregation nodes, the consensus communication is completed.

8. The method for securely sharing medical data according to claim 1, characterized in that, The global model aggregated in this round is used as the starting point for the next round of training. The model is then redistributed, and the processes of node election, model training, and model aggregation are repeated until the global model converges, resulting in the target global model, which includes: The global model aggregated in this round is distributed to each of the secondary networks as the starting point for the next round of training; The hash values ​​of key events during the training process are written into the blockchain to form an audit trail chain; Malicious nodes are isolated, and the process is redirected to the main aggregation node election phase to start a new round of training; The model is redistributed, and node election, model training, and model aggregation are performed repeatedly until the global model converges, resulting in the target global model.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the medical data secure sharing method as described in any one of claims 1 to 8 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the medical data secure sharing method as described in any one of claims 1 to 8.

Images