Reversible intelligent mapping method for desensitized medical ultrasound data

Abstract

The application provides a reversible intelligent mapping method for desensitized medical ultrasonic data, and relates to the technical field of ultrasonic data processing, and comprises the following steps: analyzing original ultrasonic DICOM data; generating a random salt value, encrypting the check serial number and the random salt value by using an encryption method to generate a main mapping identifier, splicing the main mapping identifier with a sequence identifier and an instance identifier by using a derivation algorithm, and generating a sequence layer derivation mapping identifier and an instance layer derivation mapping identifier by layer-by-layer derivation to obtain a hierarchical mapping identifier system; performing desensitization processing on patient sensitive information of the DICOM data; establishing a hierarchical and separated mapping relationship storage system; and storing the desensitized data by using a multi-level directory structure to complete reversible intelligent mapping storage of the desensitized data. The application can realize multi-granularity reversible tracing of the desensitized data, and improve fault tolerance and system security of the mapping relationship.

Description

Technical Field

[0001] This invention relates to the field of ultrasound data processing technology, and in particular to a reversible intelligent mapping method for desensitized medical ultrasound data. Background Technology

[0002] With the rapid development of artificial intelligence technology in medical imaging, the demand for medical ultrasound data in scientific research and clinical applications is increasing. However, medical data contains a large amount of sensitive patient information, and directly using the raw data poses a serious risk of privacy leakage, necessitating the desensitization of medical ultrasound data. Existing desensitization technologies mainly employ encryption to process sensitive information and establish a mapping relationship between desensitized data and original data through mapping tables.

[0003] Chinese patent application CN112768036A discloses a method for de-identifying information in DICOM files. This method obtains the file to be de-identified and the hierarchical relationship of its tags, acquires a preset de-identification template, and de-identifies the information in the file according to the template, resulting in a de-identified file which is then stored according to the hierarchical relationship. This patent flexibly de-identifies information corresponding to different tags by setting the de-identification method and de-identification value in the template, maintaining the original hierarchical relationship of the de-identified information in the de-identified file. However, this patent does not establish a reversible mapping mechanism between the de-identified data and the original data, thus failing to achieve the function of tracing back from the de-identified data to the original data. Summary of the Invention

[0004] In view of this, the present invention provides a reversible intelligent mapping method for anonymized medical ultrasound data. By establishing a hierarchical mapping identifier system and a layered mapping storage mechanism, the method enables multi-granularity reversible traceability of anonymized data while ensuring patient privacy and security, and improves the fault tolerance and system security of the mapping relationship.

[0005] The technical solution of this invention is implemented as follows:

[0006] This invention provides a reversible intelligent mapping method for anonymized medical ultrasound data, comprising:

[0007] S1. Parse the raw ultrasound DICOM data and extract the examination sequence number of the examination layer, the sequence identifier of the sequence layer, the instance identifier of the instance layer, the examination date, the patient number, and the patient's sensitive information.

[0008] S2. Generate a random salt value. Use an encryption method to encrypt the inspection sequence number and the random salt value to generate the main mapping identifier. Use a derivation algorithm to concatenate the main mapping identifier with the sequence identifier and the instance identifier respectively, and derive the sequence layer derived mapping identifier and the instance layer derived mapping identifier layer by layer to obtain a hierarchical mapping identifier system.

[0009] S3. Desensitize the patient-sensitive information in the DICOM data, and embed the master mapping identifier and random salt value into the desensitized DICOM data to obtain desensitized data with embedded mapping identifier;

[0010] S4. Establish a hierarchical and separate mapping relationship storage system. Establish a path mapping between the prefix of the main mapping identifier and the data storage path of the desensitized data. After encrypting the original examination serial number and the original patient number, establish an encrypted mapping with the main mapping identifier as the primary key and use an independent storage method.

[0011] S5. A multi-level directory structure is used to store the de-identified data. The directory hierarchy is established according to the inspection date and the prefix of the main mapping identifier to complete the reversible intelligent mapping storage of the de-identified data.

[0012] Preferably, step S2 involves generating a random salt value and using an encryption method to encrypt the check sequence number and the random salt value to generate the main mapping identifier, specifically including:

[0013] Random salt values ​​were generated during the initial desensitization of a certain examination record. And store it in the mapping table; when incrementally desensitizing or repeatedly processing the same inspection record, search the mapping table to see if the inspection record already exists. If it exists, reuse the existing random salt value; if it does not exist, generate a new random salt value and create a new mapping record.

[0014] Encryption is performed using the AES-256 symmetric encryption algorithm, with CBC working mode selected, PKCS7 padding method used, and initialization vector IV randomly generated.

[0015] The encrypted input is the concatenation of the check sequence number and the random salt value. ,in To check the serial number, This represents a string concatenation operation;

[0016] Use the master encryption key The encrypted input is encrypted using AES-256-CBC to obtain the inspection layer master mapping identifier:

[0017] ;

[0018] in This indicates that the encryption operation is performed using AES-256-CBC mode.

[0019] Preferably, in step S2, a derivation algorithm is used to concatenate the main mapping identifier with the sequence identifier and the instance identifier respectively, and to derive the sequence-level derived mapping identifier and the instance-level derived mapping identifier layer by layer, specifically including:

[0020] For each sequence in the inspection, the inspection layer master mapping identifier will be checked. Concatenate the sequence identifier with the sequence number of the given sequence, and use the SHA-256 hash algorithm to calculate the derived sequence layer mapping identifier:

[0021] ;

[0022] The superscript (k) indicates the k-th sequence in the check. Let k be the sequence identifier. This refers to the SHA-256 hash algorithm;

[0023] For each instance in the sequence, derive the sequence-level mapping identifier. Concatenate the instance identifier with the instance identifier and use the SHA-256 hash algorithm to calculate the derived instance layer mapping identifier:

[0024] ;

[0025] The superscript (j) indicates the j-th instance in the sequence. is the instance identifier for instance j.

[0026] Preferably, step S3 involves desensitizing sensitive patient information in the DICOM data, specifically including two stages: metadata desensitization and image desensitization.

[0027] Metadata desensitization stage: Parse the DICOM file, identify sensitive fields containing patient personal information, and uniformly replace the values ​​of sensitive fields with preset desensitization identifier strings;

[0028] Image desensitization stage: Read the pixel data in the DICOM file, identify sensitive areas in the image that contain patient-related information, and set the pixel values ​​of the identified sensitive areas to zero.

[0029] Preferably, step S3, which embeds the master mapping identifier and random salt value into the desensitized DICOM data, specifically includes:

[0030] Create a private tag group in the de-identified DICOM file;

[0031] The generated check layer master mapping identifier Write the first private tag;

[0032] random salt value Write the second private tag;

[0033] The first and second private tags are saved together with the de-identified DICOM file.

[0034] Preferably, in step S4, a hierarchical and separate mapping relationship storage system is established, and a path mapping is established between the prefix of the main mapping identifier and the data storage path of the desensitized data. Specifically, three methods are used for embedded storage: the first method is file embedding, where the main mapping identifier is stored in the private tag of the desensitized DICOM file, and the mapping clue can be obtained by reading the file; the second method is path embedding, where the prefix of the main mapping identifier is directly used as part of the directory name when organizing the data storage path of the desensitized data, and the prefix of the main mapping identifier is extracted from the storage path itself; the third method is a lightweight index table, which establishes a lightweight data table that only contains the prefix of the main mapping identifier and the storage path, and this table does not store any original identifier information.

[0035] Preferably, in step S4, after encrypting the original examination sequence number and the original patient number, an encrypted mapping is established using the master mapping identifier as the primary key and stored independently. Specifically, this includes:

[0036] Use the mapping table's private key For the original inspection serial number and original patient number AES-256-CBC encryption is performed, and the encrypted ciphertext is stored in the database.

[0037] Mapping table private key With the master encryption key Separate management;

[0038] For each mapping record, a SHA-256 hash value is calculated by combining the key fields. The hash value is then signed using a private key of an asymmetric encryption algorithm. The signature value is stored in the record. When reading a mapping record, the public key is used to verify the signature to ensure that the mapping relationship has not been tampered with.

[0039] Preferably, step S5 uses a multi-level directory structure to store the de-identified data, establishing a directory hierarchy based on the inspection date and the prefix of the main mapping identifier. Specifically, this includes: starting from the inspection date... Extract year, month, and date information sequentially, and create multi-level subdirectories under the storage root directory according to year, month, and date; use the inspection layer master mapping identifier. The prefix is ​​used as the directory name, and a subdirectory dedicated to this check is created under the date directory; forming a multi-level storage path organized by time and identifier prefix.

[0040] Preferably, it also includes a reversible traceability step:

[0041] Initiate a traceability request based on the provided master mapping identifier, storage path, or de-identified file;

[0042] If a known mapping identifier is provided, then the mapping identifier is used directly for trace query;

[0043] If a storage path for the de-identified data is provided, the mapping identifier prefix contained in the directory name is parsed and extracted from the path;

[0044] If an anonymized DICOM file or image file is submitted, the embedded mapping identifier is read from the file's private tag or metadata area;

[0045] Using the obtained mapping identifier as the query key, a lookup is performed in the mapping master table. After retrieving the corresponding mapping record, the mapping table's dedicated decryption key is used. The encrypted original identifier is decrypted to restore the original examination sequence number and original patient number, and the tracing results are returned.

[0046] Preferably, the traceability query supports three levels of granularity:

[0047] Check the hierarchical trace to examine the layer master mapping identifier. To perform a lookup in the mapping master table using the lookup key, a dedicated decryption key for the mapping table is used. The decryption formula for the encrypted original identifier ciphertext is:

[0048] ;

[0049] in This represents the encrypted check sequence number ciphertext stored in the database. This indicates an AES-256-CBC decryption operation, and the traceback result returns complete information about the inspection.

[0050] Sequence-level tracing, obtaining the main mapping identifier of the inspection layer through inspection layer tracing. Based on the sequence identifier of the target sequence Use a derived algorithm to compute the sequence level mapping identifier for this sequence:

[0051] ;

[0052] Locate all instance files of the target sequence according to the storage path rules;

[0053] Instance hierarchy tracing, based on the instance identifier of the target instance. The instance-level mapping identifier for this instance is computed using a two-level derivation algorithm:

[0054] ;

[0055] The instance file is located precisely by searching the file system.

[0056] The present invention has the following advantages over the prior art:

[0057] (1) This invention uses a hierarchical mapping identifier generation method based on derivation mechanism to generate sequence layer and instance layer mapping identifiers by starting from the main mapping identifier of the inspection layer and generating them layer by layer. This forms a complete three-layer mapping identifier system, which allows the mapping table to only store the main mapping relationship of the inspection layer and then calculate the lower layer identifiers in real time through the derivation algorithm. This satisfies the need for multi-granularity traceability and avoids the explosive growth of the mapping table size, perfectly adapting to the hierarchical structure characteristics of DICOM.

[0058] (2) By embedding a lightweight mapping identifier in the desensitized data and writing the mapping identifier into the private tag of the DICOM file or the storage path of the desensitized data, the present invention achieves redundant storage of the mapping relationship. Even if the complete mapping table is damaged or unavailable, the mapping clue can still be obtained through the desensitized data file itself, the storage path or the lightweight index table, providing basic fault tolerance and recovery capabilities.

[0059] (3) The present invention uses a layered and separated mapping storage system to store lightweight path mapping and complete encrypted mapping separately. Lightweight path mapping and desensitized data are stored together for easy access. Complete encrypted mapping and desensitized data are physically isolated and encrypted with independent keys. This ensures that even if one layer of mapping relationship is compromised, another layer can still provide protection, reducing the security risk of centralized leakage of mapping table leading to the failure of protection for all desensitized data.

[0060] (4) The present invention ensures that the same inspection record generates the same mapping identifier during incremental processing or repeated desensitization by reusing random salt values, thereby guaranteeing the idempotency and stability of the mapping relationship and avoiding redundancy in the mapping relationship caused by repeated processing. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 This is a flowchart of the method of the present invention;

[0063] Figure 2 This is a diagram showing the DICOM three-layer data structure and the derivation relationship of the hierarchical mapping identifiers in this invention;

[0064] Figure 3 This is a diagram of the hierarchical separation mapping storage architecture of the present invention;

[0065] Figure 4 This is a schematic diagram of the multi-level directory storage structure for de-identified data according to the present invention;

[0066] Figure 5 This is a flowchart of the multi-granularity reversible traceability process of the present invention. Detailed Implementation

[0067] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0068] like Figure 1 As shown, this invention provides a reversible intelligent mapping method for anonymized medical ultrasound data, comprising: S1, parsing the original ultrasound DICOM data to extract the examination sequence number of the examination layer, the sequence identifier of the sequence layer, the instance identifier of the instance layer, the examination date, the patient number, and sensitive patient information; S2, generating a random salt value, encrypting the examination sequence number and the random salt value using an encryption method to generate a main mapping identifier, and using a derivation algorithm to concatenate the main mapping identifier with the sequence identifier and the instance identifier respectively, and derive the sequence-level derived mapping identifier and the instance-level derived mapping identifier layer by layer to obtain a hierarchically associated mapping identifier system; S3 3. Desensitize sensitive patient information in DICOM data and embed the master mapping identifier and random salt value into the desensitized DICOM data to obtain desensitized data with embedded mapping identifier; S4. Establish a hierarchical and separate mapping relationship storage system, establish a path mapping between the prefix of the master mapping identifier and the data storage path of the desensitized data, encrypt the original examination sequence number and the original patient number, establish an encrypted mapping with the master mapping identifier as the primary key, and use an independent storage method; S5. Use a multi-level directory structure to store the desensitized data, establish a directory hierarchy according to the examination date and the prefix of the master mapping identifier, and complete the reversible intelligent mapping storage of the desensitized data.

[0069] In one embodiment of the present invention, step S1 includes:

[0070] Ultrasound examination data follows a three-layer structure of the DICOM standard, consisting of the examination layer, sequence layer, and instance layer from top to bottom, each with a corresponding globally unique identifier. The pydicom library in Python is used to parse the DICOM file to be processed, extracting the necessary layer identifiers and metadata information from the standard label fields of the DICOM file.

[0071] For the inspection layer data, extract the inspection sequence number. This check sequence number corresponds to the StudyInstanceUID field in the DICOM standard, which is a globally unique identifier used to uniquely identify a single check; retrieve the check date. The corresponding StudyDate field records the date the examination was performed; extract the patient ID. The corresponding PatientID field is a unique identifier assigned to a patient by the hospital;

[0072] For sequence layer data, extract the sequence identifier. The corresponding SeriesInstanceUID field is used to uniquely identify a sequence in the check; the sequence number is also extracted. The corresponding SeriesNumber field records the sequence number of the sequence during the inspection. SeriesInstanceUID is used instead of SeriesNumber as input to subsequent derived algorithms because SeriesInstanceUID is a globally unique identifier mandated by the DICOM standard, while SeriesNumber may have duplicate boundary cases within the same inspection record.

[0073] For instance-level data, extract the instance identifier. The corresponding SOPInstanceUID field is used to uniquely identify a specific image or frame in the sequence; the instance number is also extracted. The corresponding InstanceNumber field records the sequential number of the instance in the sequence;

[0074] Further statistics were compiled on the total number of sequences included in this inspection. and total number of instances The system iterates through the DICOM file collection and reads its hierarchical identifiers to perform counting and statistics. It then extracts a list of sensitive patient information fields requiring de-identification, including personally identifiable information such as PatientName, PatientAge, and PatientBirthDate.

[0075] like Figure 2 As shown, in one embodiment of the present invention, step S2 includes:

[0076] To address the three-layer DICOM structure characteristics of ultrasound data, a multi-granularity mapping identifier generation method based on a derivation mechanism is designed to maintain logical associations between mapping identifiers at different levels.

[0077] First, the master mapping identifier for the inspection layer is generated. Encryption is performed using the AES-256 symmetric encryption algorithm, with CBC working mode selected and PKCS7 padding used. A random 128-bit initialization vector IV is generated to ensure encryption security.

[0078] Introducing random salt values ​​during encryption The random salt value is generated and stored in the mapping table when a certain inspection record is first desensitized. When incrementally desensitizing or repeatedly processing the same inspection record, the mapping table is first queried to check whether a mapping record already exists for the inspection record. If it exists, the existing random salt value is reused to ensure that the same mapping identifier is generated when the same inspection record is processed multiple times, thus ensuring the idempotency and stability of the mapping relationship. If it does not exist, a new random salt value is generated and a new mapping record is created.

[0079] The encrypted input is the concatenation of the check sequence number and the random salt value. ,in To check the serial number, This represents a string concatenation operation. It uses the master encryption key. The encrypted input is encrypted using AES-256-CBC to obtain a 256-bit check layer master mapping identifier:

[0080] ;

[0081] in This indicates that encryption is performed using AES-256-CBC mode. This primary mapping identifier is the foundation of the entire mapping system; all lower-level mapping identifiers are derived from it. It also specifies the patient number. Using the same encryption method, but with independent random salt values. and independent initialization vectors Generate patient-level mapping identifiers:

[0082] ;

[0083] Next, derived mapping identifiers for the sequence layer are generated. Unlike traditional methods that encrypt each sequence identifier independently, this invention employs a derivation generation mechanism based on the main mapping identifier of the inspection layer. For each sequence in the inspection, the main mapping identifier of the inspection layer is... Concatenate the sequence identifier with the sequence number of the given sequence, and use the SHA-256 hash algorithm to calculate the derived sequence layer mapping identifier:

[0084] ;

[0085] The superscript (k) indicates the k-th sequence in the check. This is the sequence identifier for the sequence. This represents the SHA-256 hash algorithm. The advantage of this derivation mechanism is that by checking the master mapping identifier of the layer, the mapping identifier of all sequences under this check can be calculated in combination with the sequence identifier, without needing to store the mapping relationship for each sequence separately in the mapping table, thus reducing the storage overhead of the mapping table;

[0086] Further, generate derivation mapping identifiers for the instance layer. For each instance in the sequence, generate a sequence-level derivation mapping identifier. Concatenate the instance identifier with the instance identifier and use the SHA-256 hash algorithm to calculate the derived instance layer mapping identifier:

[0087] ;

[0088] The superscript (j) indicates the j-th instance in the sequence. This is the instance identifier for this instance. Through this two-level derivation mechanism, starting from the main mapping identifier at the inspection layer, the sequence identifier is obtained through the first derivation of the sequence identifier, and then the instance identifier is obtained through the second derivation of the instance identifier, thus forming a complete three-level mapping identifier system;

[0089] The core idea of ​​this derivation mechanism is to utilize the unidirectional and deterministic characteristics of hash algorithms, which not only ensures the irreversibility of the derived mapping identifiers, but also ensures that the same input always produces the same output. This allows the mapping table to store only the main mapping relationship of the inspection layer, while the mapping identifiers of the sequence layer and the instance layer can be calculated in real time through the derivation algorithm, thus achieving a balance between storage space and traceability granularity.

[0090] In one embodiment of the present invention, step S3 includes:

[0091] The desensitization process includes two stages: metadata desensitization and image desensitization.

[0092] In the metadata desensitization stage, the DICOM file to be processed is parsed using Python's pydicom library to identify sensitive fields containing patient personal information, including standard DICOM label fields such as PatientName, PatientAge, and PatientBirthDate. The values ​​of these sensitive fields are replaced with preset desensitization identifier strings. These desensitization identifier strings can be set to fixed strings such as "ANONYMIZED" or specific format anonymization identifiers "XXXX" to ensure that patient personal information is unidentifiable.

[0093] In the image desensitization stage, Python's OpenCV library is used to read pixel data from the DICOM file, identify sensitive areas containing patient-related information, and set the pixel values ​​of these sensitive areas to zero to achieve visual desensitization. Ultrasound images often display patient names, numbers, or other text information in corners or specific locations. The coordinate ranges of these sensitive areas are identified through image processing algorithms or manual annotation, and the grayscale or RGB values ​​of the corresponding pixels are set to 0 to achieve a black masking effect. The desensitized DICOM file can be converted to JPG image or AVI video format according to application requirements for easy subsequent storage and use.

[0094] Embed lightweight mapping identifiers into the anonymized data. Leveraging the DICOM standard's ability to customize private tags, create a private tag group in the anonymized DICOM file. Then, use the generated inspection layer master mapping identifier. Write the first private label; add a random salt value. Write the second private tag. The first and second private tags are saved along with the de-identified DICOM file. The embedded mapping identifier does not contain any sensitive patient information; it is merely an encrypted hash value, thus not increasing the risk of privacy leakage. For example, the generated examination layer master mapping identifier... Write a private label (0x0013, 0x1001) to map the patient level identifier. Write the private tag (0x0013, 0x1002) to the random salt value used for encryption. Write private tags (0x0013, 0x1003);

[0095] For anonymized data converted to JPG or AVI format, the mapping identifier is written to the file's metadata area. JPG format uses the UserComment field of the EXIF ​​tag to store the main mapping identifier, and the EXIF ​​metadata can be read and written using Python's PIL or exifread libraries. AVI format uses a custom metadata field in the file header, which is written during encoding using video processing libraries such as OpenCV or FFmpeg. Through this embedded design, the anonymized data file itself becomes the carrier of the mapping relationship, achieving a close association between data and mapping.

[0096] like Figure 3 As shown, in one embodiment of the present invention, step S4 includes:

[0097] Establish a hierarchical and separate mapping relationship storage system, dividing the mapping relationship into two layers: lightweight path mapping and full encrypted mapping, and storing them separately;

[0098] The first layer is a lightweight path mapping, using embedded storage. The lightweight path mapping does not store the original identifier information; it only contains the correspondence between the mapping identifier and the storage path. Specifically, it will check the main mapping identifier of the layer. The first 64 characters The key for the path mapping specifies the storage path of the de-identified data. This mapping is used as the value for the path mapping. This mapping relationship is embedded in storage in three ways. The first is file embedding, where the main mapping identifier is stored in a private tag within the de-identified DICOM file; reading the file retrieves the mapping clue. The second is path embedding, where the prefix of the main mapping identifier is directly used as part of the directory name when organizing the de-identified data storage path, allowing the main mapping identifier prefix to be extracted from the storage path itself. The third is a lightweight index table, which creates a lightweight data table containing only the main mapping identifier prefix and the storage path. This table does not store any original identifier information, so even if leaked, it will not expose privacy. The advantage of lightweight path mapping is that when the complete mapping table is unavailable, the storage location of the de-identified data can still be located through file embedding, path embedding, or the lightweight index table, providing a basis for restoring the mapping relationship.

[0099] The second layer is a complete encrypted mapping, stored independently and securely. This complete encrypted mapping stores the full correspondence between the original identifier and the mapped identifier, and is the core of achieving reversible traceability. The data structure for the mapping relationship is designed such that each mapping record contains the following field: Original inspection sequence number. Original patient number Inspection date Check the layer master mapping identifier Patient mapping identifier Random salt value Total number of sequences Total number of instances De-identified data storage path Encryption key reference identifier Mapping record creation time ;

[0100] To protect the security of the mapping relationship itself, the original identifier field is stored in encrypted form. This is done using a dedicated key for the mapping table. For the original inspection serial number and original patient number AES-256-CBC encryption is performed, and the encrypted ciphertext is stored in the database as a BLOB type. The mapping table's dedicated key... With the master encryption key Separate management is implemented by an independent key management system, which implements a key separation strategy. Even if the mapping table is stolen, the original identifier cannot be decrypted without the dedicated key for the mapping table.

[0101] Establish a complete mapping storage system based on a relational database, using MySQL or PostgreSQL to create a mapping master table, MappingTable. The mapping master table is used to check the layer master mapping identifier. As the primary key, a primary key index is created to ensure the uniqueness of each mapped record and support fast queries; during the date check... Secondary indexes are created on the fields to support batch queries by time range. Database connections to the mapping tables use SSL / TLS encrypted transmission to prevent data leakage during network transmission.

[0102] A digital signature field is added to the mapping table. A SHA-256 hash value is calculated for the key fields of each mapping record. The hash value is then signed using a private key of an asymmetric encryption algorithm. The signature value is stored in the record. When reading a mapping record, the public key is used to verify the signature to ensure the mapping relationship has not been tampered with. An off-site backup mechanism for the mapping table is established. Mapping table data is periodically exported and encrypted and stored in an independent backup system physically isolated from the de-identified data. Backup data is encrypted using a dedicated backup key different from the master key. If the master mapping table is damaged, it can be recovered from the backup.

[0103] The core idea of ​​this layered storage strategy is to separate high-value complete mapping relationships from low-risk path mappings. Lightweight path mappings are stored together with de-identified data for easy access and fault-tolerant recovery. Complete encrypted mappings are physically isolated from de-identified data and encrypted with independent keys. Even if one layer of mapping relationships is compromised, the other layer can still provide protection, reducing the risk of concentrated attacks.

[0104] like Figure 4 As shown, in one embodiment of the present invention, step S5 includes:

[0105] A multi-level directory structure is used to store the de-identified data, and a storage system with paths as indexes is designed.

[0106] From the inspection date The system extracts year, month, and date information sequentially, and creates multi-level subdirectories under the storage root directory based on year, month, and date. Specifically, the first level of the storage path is the year directory, which extracts the year portion from the date being checked and creates a subdirectory named with a four-digit year in the storage root directory; the second level is the month directory, which extracts the month portion from the date being checked and creates a subdirectory named with a two-digit month in the year directory; and the third level is the date directory, which extracts the date portion from the date being checked and creates a subdirectory named with a two-digit date in the month directory.

[0107] The fourth layer is the inspection identifier directory, which uses the inspection layer master mapping identifier. The first 64 characters are used as the directory name, and a dedicated subdirectory for this inspection is created under the date directory. Within the inspection identifier directory, further subdirectories are created: an "images" subdirectory to store de-identified JPG image files, a "videos" subdirectory to store de-identified AVI video files, and a "dicom" subdirectory to store de-identified files retaining the DICOM format. The complete storage path format is: storage root directory / YYYY / MM / DD / first 64 characters of the mapping identifier / file type subdirectory / specific filename, forming a multi-level storage path organized by time and identifier prefix.

[0108] The file naming convention uses a combination of sequence number and instance number, in the format of sequence number_instance number.extension. For example, S001_I005.jpg represents the JPG image of the 5th instance of the 1st sequence. This storage organization method directly incorporates time information and mapping identifiers into the path structure. Data location can be achieved through the directory hierarchy of the file system. At the same time, the mapping identifier prefix embedded in the path cross-validates with the complete mapping identifier stored in the file's private tag, ensuring the accurate correspondence between the mapping relationship and physical storage.

[0109] like Figure 5 As shown, in one embodiment of the present invention, a reversible traceability step is also included, specifically including: realizing a multi-granularity reversible traceability function from de-identified data to original data, supporting multiple traceability methods and different traceability granularities;

[0110] Design a flexible traceability query interface to initiate traceability requests based on the provided mapping identifier, storage path, or de-identified file;

[0111] The first method is to directly provide a known mapping identifier. If a known mapping identifier is provided, the mapping identifier can be used directly for traceability query. This is suitable for scenarios where de-identified data has been obtained and encrypted identifiers have been extracted from it.

[0112] The second method is to provide the storage path for the de-identified data. If the storage path for the de-identified data is provided, the mapping identifier prefix contained in the directory name is parsed and extracted from the path. Since the path contains the mapping identifier prefix, it is sufficient to locate the unique record in the mapping table.

[0113] The third method is to directly submit the de-identified DICOM file or image file. If a de-identified DICOM file or image file is submitted, the pydicom library or image metadata reading tool is used to read the embedded mapping identifier from the file's private tag or metadata area, and the mapping identifier is extracted using the pydicom library or image metadata reading tool.

[0114] Using the obtained mapping identifier as the query key, a lookup is performed in the mapping master table. After retrieving the corresponding mapping record, the mapping table's dedicated decryption key is used. Decrypt the encrypted original identifier ciphertext to restore the original examination sequence number and original patient number, and return the traceability results;

[0115] Traceability queries support three levels of granularity;

[0116] Check the hierarchical tracing to examine the layer master mapping identifier. To perform a lookup in the mapping master table using the lookup key, a dedicated decryption key for the mapping table is used. The decryption formula for the encrypted original identifier ciphertext is:

[0117] ;

[0118] in This represents the encrypted check sequence number ciphertext stored in the database. This indicates an AES-256-CBC decryption operation, and the traceability result returns complete information about the examination, including the original examination number, original patient number, examination date, and desensitized data storage path;

[0119] Sequence-level tracing: When it is necessary to trace back to a specific sequence, the main mapping identifier of the inspection layer is obtained through inspection layer tracing. Based on the sequence identifier of the target sequence Use a derived algorithm to compute the sequence level mapping identifier for this sequence:

[0120] ;

[0121] Since the sequence identifier can be obtained from the DICOM tags of the de-identified data, the mapping identifier of the target sequence can be quickly calculated. According to the storage path rules, the de-identified data for this sequence is located in the storage root directory / YYYY / MM / DD / H study In the [0:64] / dicom or images subdirectory, by traversing the files in this directory and reading their SeriesInstanceUID tags, all instance files of the target sequence can be accurately located, realizing the tracing of the sequence level;

[0122] Instance-level tracing: When it is necessary to trace back to a specific instance, based on the sequence-level tracing, the instance identifier of the target instance is used. The instance-level mapping identifier for this instance is computed using a two-level derivation algorithm:

[0123] ;

[0124] According to the file naming rules, the de-identified file name corresponding to this instance is: The file extension allows for precise location of the instance file through the file system. The advantage of this multi-granularity tracing mechanism is that users can choose the tracing granularity according to their actual needs. If only information at the inspection level is required, inspection-level tracing can be performed, which is fast and has low overhead. If a specific sequence or instance needs to be located, it can also be quickly achieved through derived algorithms and path rules, without needing to store massive sequence and instance-level mapping relationships in the mapping table, thus maintaining the system's efficiency.

[0125] A fault-tolerant recovery mechanism for mapping relationships is established to handle situations where the mapping table is corrupted or partially lost. When the complete mapping table is unavailable, a partial recovery process based on lightweight path mapping is initiated. The de-identified data storage directory is scanned, all de-identified DICOM files are traversed, and the private tags of each file are read using the pydicom library to extract the embedded inspection layer master mapping identifier. and random salt value Simultaneously, the mapping identifier prefix is ​​extracted from the file's storage path and cross-validated with the mapping identifier embedded within the file to confirm consistency. The scanned mapping identifier, storage path, examination date (extracted from the path), sequence number, and instance number (obtained from a statistics file) are used to reconstruct a temporary mapping index table. Although this temporary index table does not contain the original examination sequence number and patient number, and cannot fully restore the original data, it can at least reconstruct the correspondence between the mapping identifier and the desensitized data storage location, allowing the desensitized data to still be managed, retrieved, and used. If an off-site backup of the mapping table exists, the complete mapping table can be restored from the backup. The backup data is decrypted using a dedicated decryption key and imported into the main mapping table, restoring complete reversible traceability. Through the embedded storage of lightweight path mapping and the off-site backup of the complete mapping table, this invention achieves multi-layered fault tolerance protection. Even in the worst-case scenario where the mapping table is completely lost, the association between the mapping identifier and the storage location can be restored through the desensitized data file itself, ensuring the system's robustness.

[0126] Establish an audit log mechanism for traceability operations. Each traceability query operation records detailed log information, including the initiator's identifier, operation timestamp, query mapping identifier, traceability result status, and operation type identifier. Audit logs are stored in a separate log database using an append-only write mode to ensure that log records cannot be modified or deleted. Regularly perform statistical analysis on the audit logs to identify abnormal traceability behavior, meeting compliance requirements for medical data use and privacy protection audit needs.

[0127] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A reversible intelligent mapping method for anonymized medical ultrasound data, characterized in that, include: S1. Parse the raw ultrasound DICOM data and extract the examination sequence number of the examination layer, the sequence identifier of the sequence layer, the instance identifier of the instance layer, the examination date, the patient number, and the patient's sensitive information. S2. Generate a random salt value. Use an encryption method to encrypt the inspection sequence number and the random salt value to generate a main mapping identifier. Use a derivation algorithm to concatenate the main mapping identifier with the sequence identifier to derive a sequence-level derived mapping identifier. Then, based on the concatenation of the sequence-level derived mapping identifier with the instance identifier, derive an instance-level derived mapping identifier to obtain a hierarchical mapping identifier system. S3. Desensitize the patient-sensitive information in the DICOM data, and embed the master mapping identifier and random salt value into the desensitized DICOM data to obtain desensitized data with embedded mapping identifier; S4. Establish a hierarchical and separate mapping relationship storage system. Establish a path mapping between the prefix of the main mapping identifier and the data storage path of the desensitized data. After encrypting the original examination serial number and the original patient number, establish an encrypted mapping with the main mapping identifier as the primary key and use an independent storage method. S5. A multi-level directory structure is used to store the de-identified data. The directory hierarchy is established according to the inspection date and the prefix of the main mapping identifier to complete the reversible intelligent mapping storage of the de-identified data.

2. The reversible intelligent mapping method for desensitized medical ultrasound data according to claim 1, characterized in that, Step S2 involves generating a random salt value and using an encryption method to encrypt the check sequence number and the random salt value to generate the main mapping identifier. Specifically, this includes: Random salt values ​​were generated during the initial desensitization of a certain examination record. And store it in the mapping table; when incrementally desensitizing or repeatedly processing the same inspection record, search the mapping table to see if the inspection record already exists. If it exists, reuse the existing random salt value; if it does not exist, generate a new random salt value and create a new mapping record. Encryption is performed using the AES-256 symmetric encryption algorithm, with CBC working mode selected, PKCS7 padding method used, and initialization vector IV randomly generated. The encrypted input is the concatenation of the check sequence number and the random salt value. ,in To check the serial number, This represents a string concatenation operation; Use the master encryption key The encrypted input is encrypted using AES-256-CBC to obtain the inspection layer master mapping identifier: ； in This indicates that the encryption operation is performed using AES-256-CBC mode.

3. The reversible intelligent mapping method for desensitized medical ultrasound data according to claim 2, characterized in that, In step S2, a derivation algorithm is used to concatenate the primary mapping identifier and the sequence identifier to generate a sequence-level derived mapping identifier. Then, based on the sequence-level derived mapping identifier, an instance-level derived mapping identifier is generated by concatenating it with the instance identifier. Specifically, this includes: For each sequence in the inspection, the inspection layer master mapping identifier will be checked. Concatenate the sequence identifier with the sequence number of the given sequence, and use the SHA-256 hash algorithm to calculate the derived sequence layer mapping identifier: ； The superscript (k) indicates the k-th sequence in the check. Let k be the sequence identifier. This refers to the SHA-256 hash algorithm; For each instance in the sequence, derive the sequence-level mapping identifier. Concatenate the instance identifier with the instance identifier and use the SHA-256 hash algorithm to calculate the derived instance layer mapping identifier: ； The superscript (j) indicates the j-th instance in the sequence. is the instance identifier for instance j.

4. The reversible intelligent mapping method for desensitized medical ultrasound data according to claim 1, characterized in that, Step S3 involves desensitizing sensitive patient information in the DICOM data, specifically including two stages: metadata desensitization and image desensitization. Metadata desensitization stage: Parse the DICOM file, identify sensitive fields containing patient personal information, and uniformly replace the values ​​of sensitive fields with preset desensitization identifier strings; Image desensitization stage: Read the pixel data in the DICOM file, identify sensitive areas in the image that contain patient-related information, and set the pixel values ​​of the identified sensitive areas to zero.

5. The reversible intelligent mapping method for desensitized medical ultrasound data according to claim 3, characterized in that, Step S3 involves embedding the master mapping identifier and random salt value into the desensitized DICOM data, specifically including: Create a private tag group in the de-identified DICOM file; The generated check layer master mapping identifier Write the first private tag; random salt value Write the second private tag; The first and second private tags are saved together with the de-identified DICOM file.

6. The reversible intelligent mapping method for desensitized medical ultrasound data according to claim 5, characterized in that, In step S4, a hierarchical and separate mapping relationship storage system is established. The prefix of the main mapping identifier is mapped to the data storage path of the desensitized data. Specifically, three methods are used for embedded storage. The first method is file embedding, where the main mapping identifier is stored in the private tag of the desensitized DICOM file, and the mapping clue can be obtained by reading the file. The second method is path embedding, where the prefix of the main mapping identifier is directly used as part of the directory name when organizing the data storage path of the desensitized data, and the prefix of the main mapping identifier is extracted from the storage path itself. The third approach is a lightweight index table, which creates a lightweight data table that contains only the primary mapping identifier prefix and storage path, and does not store any original identifier information.

7. The reversible intelligent mapping method for desensitized medical ultrasound data according to claim 5, characterized in that, Step S4 involves encrypting the original examination sequence number and the original patient number, establishing an encrypted mapping using the primary mapping identifier as the primary key, and storing it independently. Specifically, this includes: Use the mapping table's private key For the original inspection serial number and original patient number AES-256-CBC encryption is performed, and the encrypted ciphertext is stored in the database. Mapping table private key With the master encryption key Separate management; For each mapping record, a SHA-256 hash value is calculated by combining the key fields. The hash value is then signed using a private key of an asymmetric encryption algorithm. The signature value is stored in the record. When reading a mapping record, the public key is used to verify the signature to ensure that the mapping relationship has not been tampered with.

8. The reversible intelligent mapping method for desensitized medical ultrasound data according to claim 1, characterized in that, Step S5 uses a multi-level directory structure to store the de-identified data, establishing directory levels according to the inspection date and the prefix of the main mapping identifier. Specifically, this includes: starting from the inspection date... Extract year, month, and date information sequentially, and create multi-level subdirectories under the storage root directory according to year, month, and date; use the inspection layer master mapping identifier. The prefix is ​​used as the directory name, and a subdirectory dedicated to this check is created under the date directory; forming a multi-level storage path organized by time and identifier prefix.

9. A reversible intelligent mapping method for desensitized medical ultrasound data according to claim 7, characterized in that, It also includes reversible traceability steps: Initiate a traceability request based on the provided master mapping identifier, storage path, or de-identified file; If a known mapping identifier is provided, then the mapping identifier is used directly for trace query; If a storage path for the de-identified data is provided, the mapping identifier prefix contained in the directory name is parsed and extracted from the path; If an anonymized DICOM file or image file is submitted, the embedded mapping identifier is read from the file's private tag or metadata area; Using the obtained mapping identifier as the query key, a lookup is performed in the mapping master table. After retrieving the corresponding mapping record, the mapping table's dedicated decryption key is used. The encrypted original identifier is decrypted to restore the original examination sequence number and original patient number, and the tracing results are returned.

10. A reversible intelligent mapping method for desensitized medical ultrasound data according to claim 9, characterized in that, The traceability query supports three levels of granularity: Check the hierarchical trace to examine the layer master mapping identifier. To perform a lookup in the mapping master table using the lookup key, a dedicated decryption key for the mapping table is used. The decryption formula for the encrypted original identifier ciphertext is: ； in This represents the encrypted check sequence number ciphertext stored in the database. This indicates an AES-256-CBC decryption operation, and the traceback result returns complete information about the inspection. Sequence-level tracing, obtaining the main mapping identifier of the inspection layer through inspection layer tracing. Based on the sequence identifier of the target sequence Use a derived algorithm to compute the sequence level mapping identifier for this sequence: ； Locate all instance files of the target sequence according to the storage path rules; Instance hierarchy tracing, based on the instance identifier of the target instance. The instance-level mapping identifier for this instance is computed using a two-level derivation algorithm: ； The instance file is located precisely by searching the file system.

Images