Secure transmission method for medical data
By serializing and pseudo-randomizing medical data and adjusting the length of encrypted data packets, the side-channel leakage problem in medical data transmission is solved, and privacy protection is achieved in a high-frequency sampling environment.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-02-05
- Publication Date
- 2026-04-10
AI Technical Summary
Existing medical data transmission protocols have the risk of side-channel leakage during encryption. Bypass observers can infer a patient's clinical status by monitoring the length profile of network traffic, leading to the leakage of sensitive privacy information.
The real-time waveform signal is converted into a serialized data stream in which effective numerical data units and explicit abnormal state identifiers are interleaved. The occupancy rate of the abnormal state identifiers is calculated. The load length variation coefficient is determined according to the sampling interval and channel dimension attributes. The filling fluctuation intensity parameter is generated through pseudo-random generation logic. The length of the encrypted data packet is adjusted to mask the occupancy rate of the abnormal state identifiers.
In a high-frequency sampling environment, it ensures that bypass observers cannot infer sensitive clinical situations such as sensor detachment or emergency treatment of patients by analyzing ciphertext profiles, thus eliminating the risk of side-channel leakage and protecting patient privacy.
Smart Images
Figure CN121841841A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network information security, and more particularly, it relates to a medical data secure transmission method. BACKGROUND
[0002] In modern intensive care units (ICUs) and operating rooms (ORs), service-oriented device connection architectures (such as SDC / SDPi) are widely used to achieve interconnection and intercommunication of multiple types of medical devices and medical information systems. Such scenarios require devices to report high-resolution physiological waveforms (such as electrocardiogram, invasive blood pressure, etc.) in real time, and to synchronize alarm information and device status, and ultimately to archive these data into electronic medical records (EMR) or electronic health records (EHR) systems.
[0003] The mainstream medical data exchange standard (such as HL7 FHIR) usually uses a specific structured object (such as SampledData) to carry such high-frequency continuous signals. This type of data structure usually has properties arranged in multiple channel dimensions, and explicitly specifies the use of specific single-character symbols (such as E for error, L for lower than the detection limit, and U for higher than the detection limit) to replace invalid or missing numerical sampling points, while valid numerical sampling points are usually represented as multi-byte length decimal strings.
[0004] However, this data structure has a hidden side-channel leakage risk during encrypted transmission. Although the current transport layer security protocol (such as TLS 1.3) can encrypt the payload content, the length of the encrypted ciphertext often retains a high correlation with the length of the plaintext. Since data loss or abnormal markers in the clinical environment are not random noise, but are highly related to sensor detachment, patient position changes, insufficient perfusion, or rescue interventions, etc. clinical actual situation, which leads to the change of abnormal symbol occupancy rate directly mapping to the statistical fluctuation of the ciphertext length sequence.
[0005] In the prior art, although the transmission protocol supports padding the record layer to hide the real length, the existing padding mechanism is usually based on fixed length or simple random number generation, lacking a quantitative calibration mechanism for medical waveform sampling frequency and data structure attributes. In the absence of targeted traffic shaping, a bypass observer can infer that the patient is in a certain specific clinical critical state by monitoring the length profile of network traffic, even if the content cannot be decrypted, thereby causing sensitive private information to be leaked. SUMMARY
[0006] The present application provides a medical data secure transmission method, which solves the technical problems raised in the background art.
[0007] The present application provides a medical data secure transmission method, comprising: convert the collected real-time waveform signals into a serialized data stream interleaved by valid numerical data units and explicit abnormal state identifiers; count the abnormal state identifier occupancy rate in the serialized data stream within a preset fixed transmission aggregation time slice; determine a payload length variation coefficient according to the sampling interval attribute and channel dimension attribute of the real-time waveform signals, and inversely deduce a filling fluctuation intensity parameter for masking the abnormal state identifier occupancy rate according to a preset flow inference estimation error limit and the payload length variation coefficient; call pseudo-random generation logic to generate a deterministic filling adjustment amount conforming to the filling fluctuation intensity parameter, superimpose the expected payload length of the serialized data stream on the deterministic filling adjustment amount and a fixed protocol overhead, and calculate a target transmission frame length; perform a bit filling operation on the encrypted payload data to match the length of the target transmission frame length, and send encrypted data packets according to the time slice beat defined by the fixed transmission aggregation time slice.
[0008] The beneficial effects of the present application include: by establishing a quantitative correlation mechanism between the sampling interval attribute and the payload length variation coefficient, inversely deducing and calibrating the filling fluctuation intensity parameter according to the flow inference estimation error limit, so that the length statistical distribution of the encrypted transmission flow is completely decoupled from the abnormal state identifier occupancy rate inherent in the electronic medical record structure in statistics; This mechanism can ensure that in the high-frequency sampling environment of critical care points, the bypass observer cannot analyze the ciphertext profile to deduce the sensitive clinical situation such as sensor falling off and rescue moving of the patient, and eliminate the side channel leakage hazard caused by the medical data structure. BRIEF DESCRIPTION OF DRAWINGS
[0009] Figure 1 is a flowchart of a medical data secure transmission method of the present application; Figure 2 is a schematic diagram of an implementation scenario of the present application. DETAILED DESCRIPTION
[0010] The subject matter described herein will now be discussed with reference to example implementations. It should be understood that the discussion of these implementations is merely meant to provide a better understanding of the subject matter described herein and can include changes, modifications, additions, or omissions of the functions and arrangements of the elements discussed without departing from the scope of the present disclosure. Various examples can omit, substitute, or add various procedures or components as appropriate, and the embodiments described should not be taken as limiting. Features described in relation to some examples can also be combined in other examples.
[0011] As shown in Figure 1 a medical data secure transmission method, comprising: converting the collected real-time waveform signals into a serialized data stream interleaved by valid numerical data units and explicit abnormal state identifiers; counting the abnormal state identifier occupancy rate in the serialized data stream within a preset fixed transmission aggregation time slice; determining a payload length variation coefficient according to the sampling interval attribute and the channel dimension attribute of the real-time waveform signals, and inversely deducing a filling fluctuation intensity parameter for masking the abnormal state identifier occupancy rate according to a preset flow inference estimation error limit and the payload length variation coefficient; calling pseudo-random generation logic to generate a deterministic filling adjustment amount conforming to the filling fluctuation intensity parameter, and calculating a target transmission frame length by adding the expected payload length of the serialized data stream, the deterministic filling adjustment amount, and a fixed protocol overhead; performing a bit filling operation on the encrypted payload data to match its length to the target transmission frame length, and sending encrypted data packets according to the time slice beat defined by the fixed transmission aggregation time slice.
[0012] In a preferred embodiment, converting the collected real-time waveform signals into a serialized data stream interleaved by valid numerical data units and explicit abnormal state identifiers comprises: parsing each sampling point in the real-time waveform signals, and if the sampling point is a valid number, converting it into the valid numerical data unit in the form of a decimal string; if the sampling point is a non-numerical state, converting it into the explicit abnormal state identifier in the form of a single character according to the electronic medical record data structure specification, wherein the explicit abnormal state identifier includes an error-representing character E, a lower-than-detection lower limit-representing character L, and a higher-than-detection upper limit-representing character U; when the real-time waveform signals contain multiple channel dimensions, interleaving the conversion results of different channel dimensions at the same time in a predetermined order to form the serialized data stream.
[0013] In detail, in the PoC scenario of an ICU, the real-time waveform signals collected by a multi-parameter monitor are processed to convert them into a serialized data stream conforming to the electronic medical record data structure specification, and the specific process is as follows: the sampling interval of the real-time waveform signals is , the collection start time is , the time corresponding to any sampling point can be expressed as , where is a non-negative integer ( ), the value of which is determined by the sampling frequency of the monitor, and For the corresponding sampling point, firstly judge whether its value is in the effective range corresponding to the signal type , is the detection lower limit of the signal, and the value is determined by the clinical detection standard corresponding to the signal; if the value of the sampling point is in , it is determined that the sampling point is an effective value, which is converted into a valid value data unit in the decimal string format, and the format of integer part-decimal point-fraction part is adopted in the conversion, wherein the number of bits of the fraction part is , , is a preset prior parameter, and the preferred value is 2, which is determined according to the requirement of the electronic medical record data structure specification for the accuracy of physiological waveform values; if the value of the sampling point is not in , it is determined that the sampling point is in a non-value state, and further distinguished: if the value is less than , it is converted into an explicit abnormal state identifier “L” in single character format; if the value is greater than , it is converted into an explicit abnormal state identifier “U” in single character format; if the sampling point cannot obtain the value due to sensor failure or other reasons, it is converted into an explicit abnormal state identifier “E” in single character format. When the real-time waveform signal contains multiple channel dimensions, for example, the signals of two channels of ECG (channel 1) and ABP (channel 2) are collected at the same time, for the same time , the conversion result (valid value data unit or explicit abnormal state identifier) corresponding to channel 1 is obtained first, and then the conversion result corresponding to channel 2 is obtained, and the two results are arranged in the predetermined order of “channel 1 result+separator+channel 2 result”, wherein the separator is a preset single character symbol “,”, and the value of the symbol is determined according to the requirement of the electronic medical record data structure specification for the separation of multi-dimensional data; for subsequent time , , the arrangement of the conversion results is carried out in the same channel order as the above-mentioned same time, and the conversion results of different times are separated by a single character symbol “;”, and the value of “;” is also determined according to the requirement of the electronic medical record data structure specification for the separation of data of different times, and the finally formed serialized data stream format is “channel 1 result of time , channel 2 result of time ; channel 1 result of time , channel 2 result of time ; ……”.
[0014] It should be noted that the sampling points are parsed into two forms: valid numerical data units and explicit abnormal state identifiers. This is because the electronic medical record data structure specification requires a clear distinction between valid data and abnormal states in physiological waveforms. Furthermore, during subsequent encrypted transmission, the lengths of valid numerical data units and explicit abnormal state identifiers differ. This distinction is used to calculate the occupancy rate of abnormal state identifiers later. The foundation; and at the same time The conversion results from different channel dimensions are arranged in a staggered order according to a predetermined sequence because the core attribute of real-time waveform signals is temporal correlation. Data from different channels at the same moment correspond to the patient's physiological state at the same moment. This arrangement ensures that subsequent aggregation of transmission time slices is performed correctly. When processing data, it can accurately acquire data from all channels within the same time slice, avoiding misalignment in the time dimension. With sampling interval satisfy , It is a positive integer, preferably 10, and this value is determined based on the transmission efficiency requirements of the TLS protocol record layer.
[0015] In a preferred embodiment, within a preset fixed transmission aggregation time slice, the occupancy rate of abnormal state identifiers in the serialized data stream is statistically analyzed, including: Based on the sampling period of the real-time waveform signal With channel dimension Calculate the fixed transmission aggregation time slice Total number of data units contained within : ; ; in, The number of timestamps within the fixed transmission aggregation time slice. This indicates the floor function; The cumulative number of explicit exception status identifiers appearing in the serialized data stream within the fixed transmission aggregation time slice is counted. ; Calculate the occupancy rate of the abnormal status identifier. : .
[0016] In detail, in the ICU PoC scenario, when processing the serialized data stream corresponding to the real-time waveform signals acquired by the multi-parameter monitor, a fixed transmission aggregation time slice is first preset. , The preferred value is 1 second, which is determined by the transmission frequency requirements of the TLS protocol record layer; where, The sampling period of the real-time waveform signal is determined by the sampling frequency of the real-time waveform signal; that is, the sampling period is the reciprocal of the sampling frequency. This represents the channel dimension of the real-time waveform signal, and its value is determined by the actual number of channels acquired in the real-time waveform signal. Next, the fixed transmission aggregation time slice is calculated. Number of timestamps contained The corresponding calculation formula is: In the formula This indicates the floor function. This represents the number of timestamps corresponding to complete sampling periods within a fixed transmission aggregation time slice. Subsequently, the fixed transmission aggregation time slice is calculated. Total number of data units contained within The corresponding calculation formula is: This is because each timestamp corresponds to The transformation results are for each channel dimension, and each transformation result corresponds to a data unit. This represents the total number of all data units within that time slice. Subsequently, during fixed transmission aggregation time slices... In the corresponding serialized data stream, the cumulative number of explicit anomaly status identifiers (including the character E representing error, the character L representing below the detection lower limit, and the character U representing above the detection upper limit) is denoted as . Finally, calculate the occupancy rate of abnormal state identifiers. The corresponding calculation formula is: , This represents the proportion of explicit exception status identifiers within all data units in a fixed transmission aggregation time slice.
[0017] It should be noted that a fixed transmission aggregation time slice is preset. This is to divide the continuous real-time waveform data stream into segments of fixed duration, so that subsequent encrypted transmission processing can be performed according to uniform time segments; calculation The floor function is used because a fixed transmission aggregation time slice can only contain timestamps corresponding to complete sampling periods, and the number of timestamps must be an integer; through and The product of This is because each channel dimension under each timestamp corresponds to an independent data unit, thus completely covering all data units within a fixed transmission aggregation time slice; statistics This is to obtain the specific number of abnormal states within that time slice, and through... and The ratio is obtained This is to convert the number of abnormal states into a relative proportion, which can quantify the impact of the difference in length between the abnormal state identifier and the effective numerical data unit on the total length of the data in the time slice.
[0018] In a preferred embodiment, determining the load length variation coefficient based on the sampling interval attribute and channel dimension attribute of the real-time waveform signal includes: Based on the sampling interval attribute and the aforementioned channel dimension attributes Calculate the fixed transmission aggregation time slice Total number of data units contained within : ; in, This indicates the floor function; Calculate the load length variation coefficient : ; in, The average character length constant of the effective numerical data units, is a character length constant for the explicit exception status identifier.
[0019] In detail, in the ICU PoC scenario, when processing the real-time waveform signals acquired by the multi-parameter monitor, the first step is to determine the preset fixed transmission aggregation time slice. Its preferred value is 1 second, which is based on the transmission efficiency requirements of the TLS protocol record layer; among which, the sampling interval attribute This is the sampling interval of the real-time waveform signal, and its value is determined by the sampling frequency of the real-time waveform signal. (Channel dimension attribute) This represents the number of channel dimensions contained in the real-time waveform signal, and its value is determined by the actual number of channels acquired in the real-time waveform signal. Next, the fixed transmission aggregation time slice is calculated. Total number of data units contained within The corresponding calculation formula is: In the formula Represents a fixed transmission aggregation time slice The number of timestamps corresponding to the complete sampling period contained within, each timestamp corresponding to The transformation results are for each channel dimension, and each transformation result corresponds to a data unit. This represents the total number of all data units within that time slice. Subsequently, the load length variation coefficient is calculated. The corresponding calculation formula is: ,in This is a constant representing the average character length of the effective numerical data unit, with a preferred value of 5. This value is based on the format requirements of the effective numerical data unit in the electronic medical record data structure specification. It is a character length constant for explicit exception status identifiers, and its value is fixed at 1. This is because explicit exception status identifiers (including E, L, and U) are all single-character formats.
[0020] It should be noted that determining a fixed transmission aggregation time slice This is to divide a continuous data stream into segments of fixed duration, so that subsequent processing can be performed in uniform time units; computation The floor function is used because it can only count the timestamps corresponding to complete sampling periods within a time slice, and the number of timestamps must be an integer. and The product of This is to ensure complete coverage of all data units corresponding to all channels within the time slice; calculation hour, and The difference represents the length change of a single data unit when it is converted from a valid numerical data unit to an explicit exception status identifier. This difference is then compared with the total number of data units. Multiply, the result is This represents the total length change when all data units within a fixed transmission aggregation time slice undergo this conversion. This total change can quantify the proportion of abnormal state identifiers. The extent to which it affects the total length of the load within that time slice.
[0021] In a preferred embodiment, based on a preset flow rate estimation error limit and the load length variation coefficient, the filling fluctuation intensity parameter used to mask the occupancy rate of the abnormal state identifier is derived and calibrated in reverse, including: Based on the Fisher information bound principle, the filling fluctuation intensity parameter is established. Error limit of the flow inference estimation and the load length variation coefficient The calibration relationship formula between them is: ; in, This is a preset minimum estimated standard deviation threshold for the occupancy rate of the abnormal state identifiers; The calculated This serves as the filling fluctuation intensity parameter.
[0022] In detail, in the ICU PoC scenario, when encrypting and transmitting the serialized data stream corresponding to the real-time waveform signal, the preset flow inference estimation error limit is first determined. , This is the minimum estimated standard deviation threshold for the occupancy rate of abnormal state identifiers, with a preferred value of 0.1. This value is based on the limitation requirements for the accuracy of inferring the occupancy rate of abnormal state identifiers in encrypted transmission scenarios. Simultaneously, the previously calculated payload length variation coefficient is obtained. , This is the total length change when all data units within a fixed transmission aggregation time slice are converted from valid numerical data units to explicit abnormal state identifiers. Next, based on the Fisher information content lower bound principle, a filling fluctuation intensity parameter is established. and , The calibration relationship between them, and the corresponding calculation formula is: ; in This is the filling fluctuation intensity parameter used to mask the occupancy rate of anomalous state identifiers. Finally, the result calculated using this formula... It is directly used as the filling fluctuation intensity parameter required in the subsequent encrypted transmission process.
[0023] It should be noted that the Fisher information bound principle was chosen because it can determine the minimum variance lower bound for estimating the occupancy rate of anomalous state identifiers. Establishing a relationship using this principle ensures that the filling fluctuation intensity is sufficient to mask occupancy rate-related information. The minimum estimated standard deviation threshold is used to clearly define the limiting target for the accuracy of occupancy rate inference, and to prevent external entities from inferring accurate abnormal status identifiers of occupancy rates from traffic data; and Combined construction The calibration formula is because This reflects the degree to which the occupancy rate of abnormal status identifiers affects the load length. This reflects the limitation requirements on the accuracy of occupancy rate inference. The square product of the two can match the intensity of the filling fluctuation with the degree of influence of the occupancy rate and the limitation of the inference accuracy. This allows the fluctuation of the ciphertext length after filling to be sufficient to mask the change in load length caused by the occupancy rate of the abnormal status identifier, so that external entities cannot infer the effective occupancy rate of the abnormal status identifier through the flow length information.
[0024] In a preferred embodiment, invoking pseudo-random generation logic to generate a deterministic fill adjustment amount that conforms to the fill fluctuation intensity parameter includes: Generating uniformly distributed numerical values using pseudo-random function algorithms : ; in, Export the key for the session. The time sequence number of the fixed transmission aggregation time slice. It is a pseudo-random function; Will Approximate statistics converted to a standard normal distribution ; Calculate the deterministic fill adjustment amount : ; in, The filling fluctuation intensity parameter, This represents the square root operation.
[0025] In detail, in the ICU PoC scenario, when encrypting and transmitting the serialized data stream corresponding to the real-time waveform signal, the session-derived key is first obtained during the current encryption session. , It is a key derived from the TLS protocol session phase according to a predetermined process, and its value is determined by the key negotiation result of that session; at the same time, it determines the sequence number of the fixed transport aggregation time slice. , Non-negative integers ( Its value increases sequentially with the transmission order of the fixed transmission aggregation time slices, and each time slice corresponds to a unique value. Next, a pseudo-random function algorithm is used to generate uniformly distributed numerical values. The corresponding calculation formula is: ; in It is a pseudo-random function, preferably using the HMAC-SHA256 algorithm, which is consistent with the pseudo-random function types commonly used in the TLS protocol; These are uniformly distributed values between 0 and 1. Then, the generated uniformly distributed values... Approximate statistics converted to a standard normal distribution During the conversion, the offset can be adjusted by accumulating multiple independent uniformly distributed values (e.g., accumulating 12 uniformly distributed values and then subtracting 6). This method can obtain statistical values that are close to the standard normal distribution with lower computational complexity. The values of satisfy the statistical properties of a standard normal distribution. Finally, the deterministic fill adjustment is calculated. The corresponding calculation formula is: ; in These are the filling fluctuation intensity parameters previously obtained by estimating the error limit based on flow rate and calibrating the load length variation coefficient. This represents the square root operation. This is the deterministic padding adjustment amount used to subsequently adjust the ciphertext length corresponding to the fixed transmission aggregation time slice.
[0026] For details, select "Export Session Key". As input to the pseudo-random function, because It is a key specific to the current encrypted session, ensuring the security of keys generated in different sessions. This prevents duplication and avoids cross-session padding adjustment correlation; it also introduces a fixed transmission aggregation time slice timing number. As input, because The time slices are uniquely incremented sequentially, ensuring that different time slices within the same session correspond to each other. It is unique, ensuring that the fill adjustment amount for each time slice is independent; a pseudo-random function is used to generate it. This is because pseudo-random functions can output values with statistical characteristics close to a uniform distribution, providing a basic input for obtaining the required fluctuation adjustment amount; Converted to a standard normal distribution This is because the standard normal distribution has the characteristics of continuity and symmetry, which allows the fluctuations in the filling adjustment to better match the requirements of changes in the covering load length; through and Multiply to get Because It is the standard deviation of the filling fluctuation intensity parameter, and the standard normal distribution. After multiplication, The variance of the distribution is exactly equal to It can accurately match the previously calibrated filling fluctuation intensity, so that the fluctuation of the filling adjustment amount can meet the requirement of masking the length change related to the occupancy rate of the abnormal state identifier.
[0027] In a preferred embodiment, the target transmission frame length is calculated by superimposing the deterministic padding adjustment and fixed protocol overhead on the expected payload length of the serialized data stream, including: Calculate the theoretically expected plaintext length of the serialized data stream. : ; in, This represents the total number of data units. The occupancy rate of the abnormal state identifier. The average character length constant of the effective numerical data units, The length of the separator; Calculate the target transmission frame length : ; ; in, For the fixed protocol overhead, For the deterministic fill adjustment amount, The minimum length allowed by the protocol, Maximum length of protected records, To find the minimum value function, This is the function for finding the maximum value.
[0028] In detail, in the ICU PoC scenario, when encrypting and transmitting the serialized data stream corresponding to the real-time waveform signal, the total number of data units calculated previously is first obtained. Utilization rate of abnormal status identifiers and the average character length constant of effective numerical data units. ,in The preferred value is 5, which is based on the format requirements of valid numerical data units in the electronic medical record data structure specification; at the same time, the length of the separator is determined to be... This is because Each data unit needs to be communicated via... Each character is separated by a single-character delimiter. Then, the theoretically expected plaintext length of the serialized data stream within this fixed-transmission aggregation time slice is calculated. The corresponding calculation formula is: ; In the formula, The percentage of valid numerical data units among all data units. This represents the total character length of valid numerical data units within this percentage. The total character length representing the exception status identifier, multiplied by the sum of the two. It is the total length of all data units, then summed. By determining the delimiter length, the theoretically expected plaintext length of the serialized data stream can be obtained. Next, the fixed protocol overhead is obtained. , This is the fixed overhead of the TLS protocol record layer, with a preferred value of 13 bytes, consistent with the basic overhead length of the TLS 1.3 record layer; simultaneously, a deterministic padding adjustment amount is obtained. And calculate the original target transmission frame length. The corresponding calculation formula is: ; Subsequently, the minimum length allowed by the protocol was determined. Maximum length of protected records ,in The preferred value is 16 bytes, which is the minimum record length specified by the TLS protocol. This value is obtained through negotiation using the TLS protocol's record_size_limit, with a preferred value of 16384 bytes; finally, the target transmission frame length is calculated. The corresponding calculation formula is: ; In the formula, This is a function to maximize the value, used to ensure that the transmitted frame length is not less than the minimum length allowed by the protocol. This is a minimum value function used to ensure that the length of the transmitted frame does not exceed the maximum length of the protected record.
[0029] It should be noted that the calculation Combining time , The separator length is used to accurately determine the plaintext length of the serialized data stream within a fixed transmission aggregation time slice, and this length is related to... Directly related, it forms the basis for subsequent length adjustments; superimposed This is because the TLS protocol record layer has a fixed overhead component, which must be included in the transmission frame length to meet the protocol's format requirements; adding... This is to adjust the sum of the original plaintext length and protocol overhead by adjusting the padding amount, so that the final transmitted frame length fluctuation conforms to the previously calibrated padding fluctuation intensity, thereby masking the padding fluctuation. Corresponding length features; for conduct and The clamping function is used because the TLS protocol has explicit upper and lower limits on record length. If the length exceeds these limits, the transmission will fail. Therefore, clamping is necessary to ensure that the length of the target transmission frame is within the valid range allowed by the protocol.
[0030] In a preferred embodiment, performing a bit-stuffing operation on the encrypted payload data to make its length match the target transmission frame length, and sending the encrypted data packets according to the time slots defined by the fixed transmission aggregation time slice, includes: Calculate the actual physical byte length of the serialized data stream. And calculate the required fill length. : ; in, The target transmission frame length, For the fixed protocol overhead; Construction length is The zero-value bit sequence is appended to the end of the serialized data stream to form an aligned payload, which is then encrypted to generate the encrypted data packet. Calculate the sending trigger timestamp : ; in, The current time slice sequence number. The duration of the fixed transmission aggregation time slice; at time... Send the encrypted data packet.
[0031] In detail, in the ICU PoC scenario, when encrypting and transmitting the serialized data stream corresponding to the real-time waveform signal, the actual physical byte length of the serialized data stream within the fixed transmission aggregation time slice is first calculated. , This refers to the actual number of bytes occupied by the serialized data stream during storage or transmission, which needs to be obtained directly through byte counting operations; simultaneously, the previously calculated target transmission frame length is also obtained. and fixed protocol overhead ( The preferred value is 13 bytes, consistent with the base overhead length of the TLS 1.3 record layer. Then, the required padding length is calculated. The corresponding calculation formula is: ; In the formula, It is the sum of the actual physical byte length of the serialized data stream and the fixed protocol overhead, using the target transmission frame length. Subtracting the sum, we get This refers to the padding length required to ensure the final transmitted data length matches the target transmitted frame length. Next, a padding length of [length to be filled in] is constructed. The zero-value bit sequence is appended to the end of the serialized data stream to form the alignment payload. The length of the alignment payload is then equal to... The alignment payload is then encrypted according to the encryption rules of the TLS protocol to generate an encrypted data packet. Subsequently, the sequence number of the current fixed-transmission aggregation time slice is obtained. ( (A non-negative integer, increasing sequentially with the time slice transmission order), and the duration of a fixed transmission aggregation time slice. (The preferred value is 1 second, based on the transmission efficiency requirements of the TLS protocol record layer), calculate the sending trigger timestamp. The corresponding calculation formula is: ; In the formula, It is the sequence number of the current time slice. It is the duration of a single fixed-time aggregated transmission slice, and the product of the two. That is, the transmission trigger time corresponding to that time slice; finally, strictly within The generated encrypted data packet is sent at the corresponding time.
[0032] Detailed statistics This is because the actual physical byte length of the serialized data stream may differ slightly from the theoretically expected plaintext length; actual statistics ensure that the subsequent calculation of the padding length is more accurate. The purpose of padding is to ensure that the total length of the serialized data stream, fixed protocol overhead, and padding data exactly matches the target transmission frame length. To meet the TLS protocol's requirements for transmission record length; constructing a sequence of zero-value bits and appending it to the end of the data stream is because zero-value padding does not interfere with the original content of the serialized data stream and conforms to the TLS protocol's format specifications for padding data; calculating When adopted The form is because the duration of the fixed transmission aggregation time slice is... Time sequence number The corresponding time slice should be after the data acquisition is started. Sending encrypted data packets at precisely the designated time ensures a consistent sending rhythm, preventing fluctuations in sending time from becoming additional sources of information leakage and further enhancing the security of the transmission process.
[0033] It should be noted that real-time waveform signals refer to the physiological waveform data of patients collected by medical equipment such as multi-parameter monitors in ICU / ORPoC (acute care point) scenarios. The core purpose is to reflect the patient's real-time physiological state. Common types include electrocardiogram (ECG), arterial blood pressure (ABP), blood oxygen saturation (SpO2), etc. The acquisition process must meet the real-time requirements of Real-Time Waveforms in the SDPi standard.
[0034] It should be noted that the effective numerical data unit refers to the part of the real-time waveform signal that is within the effective detection range. The sampling points within the data are converted into decimal string data units. The conversion format is uniformly set to integer part-decimal point-decimal part, where the number of decimal places is preset to 2 (which meets the requirements of the electronic medical record data structure specification for the accuracy of physiological values). For example, if the effective value of the sampling point is 120.56, then the corresponding effective value data unit is 120.56.
[0035] It should be noted that the explicit abnormal state identifier refers to a single-character identifier converted according to the electronic medical record data structure specification when the sampling point in the real-time waveform signal is in a non-numerical state. It is used to clearly distinguish different types of abnormal situations. Here, E represents numerical acquisition errors caused by sensor failure, etc., and L represents the sampling value being lower than the detection limit. U represents a sample value higher than the detection limit. For example, if an ABP sample value is 30 (below the detection limit of 40), the corresponding explicit abnormal state identifier is L.
[0036] It should be noted that channel dimension refers to the number of acquisition channels for real-time waveform signals, corresponding to different physiological parameter types monitored simultaneously by medical devices. The sampling data of each channel dimension is generated and processed synchronously. For example, if a multi-parameter monitor simultaneously acquires ECG (channel 1) and ABP (channel 2), then the channel dimension of the real-time waveform signal is 2.
[0037] It should be noted that a serialized data stream refers to a continuous data stream formed by arranging valid numerical data units and explicit abnormal state identifiers according to a preset rule. The arrangement rule is as follows: the transformation results of different channel dimensions at the same time are arranged as "Channel 1 result + separator ',' + Channel 2 result + ... + Channel d result", and the transformation results at different times are connected by the separator ";". For example, at time... The result for channel 1 is "120.56" and the result for channel 2 is "80.23", time... If the result of channel 1 is "E" and the result of channel 2 is "81.15", then the corresponding serialized data stream is "120.56,80.23;E,81.15".
[0038] It should be noted that the sampling interval (p) refers to the time interval between two adjacent sampling points of the real-time waveform signal. Its value is determined by the sampling frequency of the medical device (sampling interval = 1 / sampling frequency). For example, when the sampling frequency is 100Hz, the sampling interval is... The second parameter directly affects the number of sampling points and the total number of data units within a fixed transmission aggregation time slice.
[0039] It should be noted that the lower limit of signal detection ( This refers to the lowest clinically valid detection limit for a certain type of physiological signal. Its value is determined by the clinical detection standard for that signal and is used to determine whether a sampling point is a valid value. For example, the detection limit of ABP in adults. Sampling points below this value will be marked as L.
[0040] It should be noted that the upper limit of signal detection ( ABP (Acute Blood Pressure) refers to the highest clinically effective detection value corresponding to a certain type of physiological signal. Its value is also determined by the clinical detection standards for that signal, such as the upper limit of detection for adult ABP. Sampling points with values higher than this will be labeled as U.
[0041] It should be noted that the fixed transmission aggregation time slice (W) refers to a preset fixed duration segment used to aggregate real-time waveform data streams. Its preferred value is 1 second (to adapt to the transmission frequency requirements of the TLS protocol record layer). Its function is to divide the continuous real-time data stream into a unified processing unit, so that subsequent operations such as abnormal state identifier occupancy rate statistics and fluctuation intensity calibration can be performed at a fixed time granularity, ensuring the consistency of encrypted transmission processing.
[0042] It should be noted that the total number of data units (N) refers to the total number of transformation results across all channel dimensions within a fixed transmission aggregation time slice, calculated using the following formula: (in For the number of timestamps, For floor operations, (for channel dimensions), for example Second, Second, hour, ,but This parameter is the basis for calculating the occupancy rate of abnormal status identifiers.
[0043] It should be noted that the cumulative number of explicit exception status identifiers (M) refers to the total number of times the three types of explicit exception status identifiers E, L, and U appear in the serialized data stream within a fixed transmission aggregation time slice. The statistical range is strictly limited to a single fixed transmission aggregation time slice. For example, if E appears 3 times, L appears 2 times, and U appears 1 time slice, then... .
[0044] It should be noted that the occupancy rate of abnormal status identifiers ( () refers to the proportion of explicit exception status identifiers to the total number of data units, calculated using the following formula: Used to quantify the proportion of abnormal data within a fixed transmission aggregation time slice, for example , hour, This parameter directly reflects the degree of impact of abnormal states on the length of the data stream and is a key basis for subsequent filling fluctuation intensity calibration.
[0045] It should be noted that the average character length constant of the effective numerical data unit ( The value is the average length of the valid numerical data unit after it has been converted into a decimal string. The preferred value is 5 (based on the format requirements of valid numerical values in the electronic medical record data structure specification, such as the average length of strings like 120.5 and 89.32 is about 5). This parameter is a fixed constant and does not need to be adjusted with the length of a single data unit.
[0046] It should be noted that the character length constant of the explicit exception status identifier ( ) refers to the fixed character length of the explicit abnormal status identifier, which is always 1. This is because E, L, and U are all single-character identifiers. This parameter is the basis for quantifying the difference between the length of the effective numerical data unit and the abnormal identifier, ensuring the uniformity of the load length variation coefficient calculation.
[0047] It should be noted that the load length variation factor (b) refers to the total length change when all data units within a fixed transmission aggregation time slice are converted from valid numerical data units to explicit abnormal state identifiers. The calculation formula is as follows: ,For example , , hour, This parameter quantifies the occupancy rate of abnormal status identifiers. The degree of impact on the total length of the data stream.
[0048] It should be noted that the error limit for flow inference estimation ( () refers to a preset limit on the occupancy rate of abnormal state identifiers by bypass observers. The minimum estimated standard deviation threshold for inference accuracy, preferably set at 0.1 (based on the privacy protection requirements of encrypted transmission scenarios), serves to clarify... The lower bound of the inference error is set to prevent external entities from obtaining accurate data through reverse inference from traffic data. This parameter is a dimensionless constant. The smaller the set value, the higher the requirement for the intensity of filling fluctuations, and the stronger the privacy protection effect. For example, if a requirement is... If the estimation error is not less than 0.1, then .
[0049] It should be noted that the filling fluctuation intensity parameter ( () refers to the occupancy rate of identifiers used to mask abnormal states. The quantization parameter for the fluctuation intensity of the filled data is calculated using the following formula: (in To limit the error of flow inference estimation, (This is the load length variation coefficient), its function is to ensure that the fluctuation of the ciphertext length after filling is sufficient to offset the load length variation coefficient. The resulting change in load length. For example, if , ,but This parameter determines the fluctuation range of the subsequent deterministic filling adjustment.
[0050] It should be noted that the session export key ( This refers to a proprietary key derived during the TLS protocol session through a key negotiation process (such as ECDH key exchange). Its value is uniquely determined by the negotiation result of the current encrypted session and is only valid for the current session. This parameter serves as input to a pseudo-random function to ensure that the padding adjustment values generated in different sessions are not duplicated, preventing information leakage across sessions. For example, a TLS session might obtain a padding adjustment value through ECDH negotiation. If so, then the generation of all fill adjustment amounts in this session is based on this key.
[0051] It should be noted that the timing sequence number of the fixed transmission aggregation time slice ( ) refers to a non-negative integer used to identify the transmission order of fixed-time-slice aggregation. Its value increases sequentially with the transmission of time slices, and each time slice corresponds to a unique time sequence number. This parameter, together with the session-derived key, serves as the input to the pseudo-random function, ensuring that the padding adjustments for different time slices within the same session are independent of each other. For example, in the first time slice... The second time slice Even two time slices The same, will also be due to Different generation methods require different fill adjustment amounts.
[0052] It should be noted that a pseudo-random function (PRF) refers to a pre-defined algorithm used to generate uniformly distributed values. The HMAC-SHA256 algorithm is preferred (to maintain consistency with the pseudo-random function types commonly used in the TLS protocol, ensuring compatibility and security). Its input is the session-derived key. and time sequence number The output is a uniformly distributed value between 0 and 1. The function's purpose is to provide a basic input with statistical properties close to true randomness.
[0053] It should be noted that uniformly distributed values ( () refers to a value generated by a pseudo-random function, ranging from 0 to 1, and is calculated using the following formula: Its distribution satisfies uniformity, meaning that the probability of any value occurring within the interval is equal. For example, when , At that time, generated by HMAC-SHA256 This value is the basic input for converting to a standard normal distribution statistic.
[0054] It should be noted that the approximate statistical value of the standard normal distribution ( This refers to using an accumulation mapping algorithm to transform uniformly distributed numerical values. The transformed statistical values conforming to a standard normal distribution (mean 0, variance 1) are preferably obtained by summing 12 independent uniformly distributed values and then subtracting 6 (to achieve an approximate standard normal distribution with lower computational complexity). For example, summing 12 values generated by PRF... ( The sum is 6.8. The continuity and symmetrical distribution of this value make the fluctuation of the filling adjustment amount more in line with the needs of covering the changes in the load length.
[0055] It should be noted that the deterministic filling adjustment amount ( () refers to the adjustment amount used to adjust the ciphertext length corresponding to a fixed transmission aggregation time slot, and the calculation formula is: (in To fill the standard deviation of the fluctuation intensity parameter, (This is an approximate statistical value of the standard normal distribution), its core characteristic is determinism (given...) and (Uniquely identifiable) and statistically consistent with the preset fluctuation intensity. For example, if , ,but This adjustment, when added to the expected payload length, ensures that the ciphertext length fluctuation meets privacy protection requirements.
[0056] It should be noted that the theoretically predicted plaintext length ( () refers to the theoretical plaintext length of the serialized data stream within a fixed transmission aggregation time slice, calculated using the following formula: (in This represents the total number of data units. This refers to the occupancy rate of abnormal status identifiers. The average character length constant of the effective numerical data units. (Total length of separators), used to accurately estimate the base length of the data stream within that time slice. For example, if... , , ,but This parameter is the basis for calculating the target transmission frame length.
[0057] It should be noted that the fixed agreement overhead ( The ciphertext length is the fixed overhead of the TLS protocol record layer, including the record header, AEAD tag, and other fixed-length parts. Its preferred value is 13 bytes (consistent with the basic overhead length of the TLS 1.3 record layer). This parameter is a fixed component of the transmission frame length and must be included in the calculation of the target transmission frame length; otherwise, the ciphertext length will not meet the protocol requirements.
[0058] It should be noted that the original target transmission frame length ( This refers to the sum of the theoretically expected plaintext length, fixed protocol overhead, and deterministic fill adjustment, calculated using the following formula: This is used to initially obtain the transmission frame length that meets the filling fluctuation requirements. For example, if , , ,but This length does not yet take into account the upper and lower limits of the record length constraints imposed by the protocol.
[0059] It should be noted that the protocol allows a minimum length ( The minimum length of the transmission record specified by the TLS protocol is 16 bytes (the standard minimum length requirement of the TLS protocol). It is used to limit the lower limit of the target transmission frame length and avoid the ciphertext length being lower than the protocol's allowed range due to insufficient padding adjustment.
[0060] It should be noted that the maximum length of a protected record ( The record_size_limit parameter refers to the maximum length of the transmission record negotiated through the record_size_limit extension of the TLS protocol. Its preferred value is 16384 bytes (adapting to the transmission capabilities of most medical IT systems). It is used to limit the upper limit of the target transmission frame length and avoid transmission efficiency reduction or protocol compatibility issues caused by excessive padding adjustment.
[0061] It should be noted that the target transmission frame length ( () refers to the final transmission frame length that conforms to the TLS protocol length constraints, calculated using the following formula: (in To find the maximum value function, This is a function that minimizes the ciphertext length, ensuring that the length satisfies both privacy protection requirements and protocol specifications. For example, if... , , ,but ;like ,but ;like ,but .
[0062] It should be noted that the actual physical byte length of the serialized data stream ( The byte count () refers to the actual number of bytes occupied by the serialized data stream during storage or transmission within a fixed transmission aggregation time slice. It is calculated character-by-character through byte counting (each visible character and separator is counted as 1 byte, conforming to general character encoding rules). For example, a serialized data stream "120.56,80.23;E,81.15" contains numbers, a decimal point, separators "," and ";", and the exception identifier "E", totaling 18 characters. Therefore, the byte count of this data stream is... bytes. This parameter is related to the theoretically expected plaintext length. The difference is that, It is the actual statistical result, unaffected by format, and can accurately reflect the real storage usage of the data stream.
[0063] It should be noted that the required fill length ( This refers to ensuring that the actual length of the serialized data stream plus fixed protocol overhead plus padding data length exactly matches the target transmission frame length. The length of the zero-value bit sequence to be added is calculated using the following formula: (in For the target transmission frame length, The actual physical byte length. (For fixed protocol overhead). For example, if byte, byte, byte, then Bytes, the corresponding zero-value bit sequence length is Bits. This parameter is used to offset the occupancy rate of the abnormal status identifier. The impact on the data stream length stabilizes the ciphertext length. To prevent bystanders from inferring from length fluctuations .
[0064] It should be noted that the aligned payload refers to the normalized payload formed by appending a sequence of zero-value bits of the required length to the serialized data stream; its length is equal to... And with Strictly equal (ensuring the total length after adding fixed protocol overhead is 1) For example, the above. byte, In the byte-based scenario, the alignment payload is the original serialized data stream 120.56,80.23;E,81.15 appended with 589 zero-value bytes (607 bytes in total) to form a structurally complete and fixed-length data to be encrypted. The design of the alignment payload ensures the consistency of the length of the encrypted input.
[0065] It should be noted that an encrypted data packet refers to a transmittable network data packet generated after the aligned payload has been encrypted using the TLS protocol. It consists of encrypted payload data, a TLS record header, an AEAD authentication tag, and other parts, and its total length is strictly equal to the length of the target transmission frame. For example, the aforementioned 607-byte alignment payload is encrypted using the AES-GCM algorithm in TLS 1.3, generating a data packet containing a 5-byte TLS record header, a 607-byte encrypted payload, and a 16-byte authentication tag (total length...). Bytes, need adjustment Make the final length match The encrypted length is determined by the number of bytes (ensuring the encrypted length meets the preset target). This data packet possesses the security of the TLS protocol (confidentiality, integrity, authenticity) and can be directly transmitted in ICU / ORPoC network scenarios. Furthermore, the ciphertext appearance does not reflect the original data stream. feature.
[0066] It should be noted that the current fixed transmission aggregation time slice's sequence number ( ) refers to a non-negative integer used to identify the transmission order of fixed-time-slice aggregation. Its function is to anchor the sending trigger timestamp. For example, At the same time, combined with the duration of the fixed transmission aggregation time slice The seconds can be used to determine the sending trigger timestamp of this time slice. Seconds. The timing sequence number ensures that the transmission clock of each time slice is independent and fixed, avoiding issues arising from different time slices. The discrepancies cause fluctuations in transmission time, further preventing the leakage of information in the time dimension.
[0067] It should be noted that the sending trigger timestamp ( () refers to the fixed transmission time of the encrypted data packet, calculated using the following formula: (in For time sequence number, (This refers to the duration of a fixed transmission aggregation time slice), whose value strictly increases sequentially according to the time slice order, and is related to the data stream processing speed. Size is irrelevant. For example, Second, hour Second, hour Seconds, even The corresponding alignment load is processed 1 second in advance, but it still needs to wait until... Send again after a few seconds. This parameter is designed to meet the time synchronization requirements of real-time waveform transmission in PoC scenarios (compliant with the STAD use case of SDPi), while strengthening privacy protection by severing the correlation between sending time and ρ through a fixed beat.
[0068] It should be noted that the fixed transmission clock rule means that encrypted data packets must be sent precisely at the trigger timestamp. The execution rules for sending at the corresponding time are invariably in place (except for extreme failures such as network outages, which are not covered by this rule). The core logic of this rule is to prevent the sending time from becoming an additional leakage channel, specifically in ICU / OR scenarios. Blocky changes (such as sensor detachment during rescue) A sudden increase in data transmission speed may be accompanied by changes in data stream processing speed. If the transmission time drifts with the processing speed, it will indirectly expose [the problem]. The changing trend. Fixed rules ensure consistent transmission behavior across all time slices by unifying the transmission rhythm, retaining only the fluctuations in the target transmission frame length (controlled by padding adjustment), thus ensuring that leakage risks are focused solely on the length dimension and effectively masked.
[0069] It should be noted that the fixed agreement overhead ( The fixed-byte overhead () refers to the record layer overhead of the TLS protocol, including core components such as the record header and the base length of the authentication tag. Its preferred value is 13 bytes (for the lightweight design adapted to the TLS 1.3 protocol, where the record header is 5 bytes and the base authentication tag is 8 bytes; the specific structure must conform to RFC 8449). This parameter is an inherent property of the TLS protocol in encrypted transmission scenarios and does not change with the original data stream or padding length. It must be included in the calculation of the required padding length; that is, ignoring the fixed protocol overhead will result in the encrypted data packet length exceeding the limit. or below This can cause protocol compatibility issues. For example, When bytes are used, regardless of and How it changes, Must equal This is necessary to ensure that encrypted data packets conform to the TLS protocol format.
[0070] It's important to note that the encryption rules for the TLS protocol refer to the AEAD (Authenticated Encryption with Associated Data) encryption process conforming to the TLS 1.3 protocol specification. This process includes four steps: Associated Data (AAD) construction, non-CE generation, plaintext encryption, and authentication tag calculation. Specifically, the Associated Data (AAD) contains TLS record header information (such as protocol version and content type), the non-CE is derived from the session key, the plaintext is the alignment payload, and the authentication tag is used to verify the integrity and authenticity of the data packet. For example, when using the AES-256-GCM algorithm, the alignment payload is used as plaintext input, encrypted to generate ciphertext, and a 16-byte authentication tag is calculated simultaneously. Finally, this is concatenated with the TLS record header to form the encrypted data packet. This rule ensures the standardization of the encryption process, thus ensuring compatibility with the existing TLS protocol stack of medical IT systems without requiring the deployment of additional proprietary encryption components.
[0071] It should be noted that the protocol length constraint refers to the upper and lower limits of the TLS protocol's requirements for the length of the transmitted record, i.e. (in The minimum length allowed by the protocol, (This refers to the maximum length of the protected record), and its value is determined by the TLS protocol specification and the negotiation result. Bytes are a mandatory requirement of the TLS protocol. (The number of bytes is a common value for extended negotiation of record_size_limit). For example, if the original computed length of a time slice... bytes (less than) (bytes), then according to the protocol length constraints, the target transmission frame length is... bytes, required padding length ;like bytes (greater than) (bytes), then byte, This constraint is a prerequisite for ensuring that encrypted data packets can be received and decrypted normally by TLS-compatible devices, avoiding transmission failures due to abnormal length.
[0072] It should be noted that the padding data format specification refers to the format requirements of the TLS protocol for padding data. Padding data is a sequence of zero-value bits (i.e., each bit is 0), conforming to the TLS 1.3 record layer trailing zeropadding format specification (RFC 8449 explicitly allows zero-value padding for length hiding). For example, the required padding length... When the number of bytes is 20, the padding data consists of 20 consecutive bytes of zero values (represented in hexadecimal). The padding data (20 bytes in total) is appended to the end of the serialized data stream to form an alignment payload. This specification ensures that the padding data can be automatically stripped by the TLS protocol stack during decryption (by removing the trailing zero-value bytes using the strip0 function), without the need for additional padding identifiers or parsing logic, simplifying the processing flow at the receiving end while ensuring compatibility with the TLS protocol.
[0073] like Figure 2 As shown, Figure 2 This diagram illustrates the process and security logic for transmitting medical data to the electronic medical record system in PoC (Acute Care Point) scenarios such as ICUs and ORs. On the left, physiological data of patients being examined is collected by devices such as monitors and anti-drip devices and then fed into the medical device local area network. This collected information is converted into a data stream consisting of numerical data units (such as physiological values like 123.45 and 98.6) and anomaly identifiers (E / L / U, corresponding to data errors, values below / above detection limits). This data stream is transmitted to the encryption module integrated in the PoC interoperability gateway, processed, and then sent to the electronic medical record system / EMR server through an encrypted transmission channel. The diagram also highlights the risks of an unencrypted scenario: bystanders can infer the occupancy rate of anomaly identifiers through the shape characteristics of the data stream (such as length fluctuations). The encryption module of the PoC interoperability gateway is designed to block this risk of shape leakage, ensuring the privacy and security of medical data transmission.
[0074] The embodiments of this example have been described above. However, this example is not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms based on the guidance of this example, and all of them are within the protection scope of this example.
Claims
1. A method for securely transmitting medical data, characterized in that, include: The acquired real-time waveform signal is converted into a serialized data stream consisting of alternating valid numerical data units and explicit abnormal state identifiers; Within a preset fixed transmission aggregation time slice, the occupancy rate of abnormal state identifiers in the serialized data stream is statistically analyzed. The load length variation coefficient is determined based on the sampling interval attribute and channel dimension attribute of the real-time waveform signal. Based on the preset flow inference estimation error limit and the load length variation coefficient, the filling fluctuation intensity parameter used to mask the occupancy rate of the abnormal state identifier is derived and calibrated in reverse. The pseudo-random generation logic is invoked to generate a deterministic padding adjustment amount that conforms to the padding fluctuation intensity parameter. The expected payload length of the serialized data stream is superimposed with the deterministic padding adjustment amount and fixed protocol overhead to calculate the target transmission frame length. The encrypted payload data is bit-stuffed to match the length of the target transmission frame, and the encrypted data packets are sent according to the time slots defined by the fixed transmission aggregation time slice.
2. The method for secure transmission of medical data according to claim 1, characterized in that, The acquired real-time waveform signal is converted into a serialized data stream consisting of interleaved valid numerical data units and explicit abnormal state identifiers, including: Each sampling point in the real-time waveform signal is parsed. If the sampling point is a valid value, it is converted into a valid value data unit in decimal string format. If the sampling point is an error, below the detection lower limit, or above the detection upper limit, it is converted into an explicit abnormal state identifier in single-character format. When the real-time waveform signal contains multiple channel dimensions, the conversion results of different channel dimensions at the same time are interleaved in a predetermined order and connected using a delimiter to form the serialized data stream.
3. The method for secure transmission of medical data according to claim 1, characterized in that, Within a preset fixed transmission aggregation time slice, the occupancy rate of abnormal state identifiers in the serialized data stream is statistically analyzed, including: Based on the sampling period and channel dimension of the real-time waveform signal, the total number of data units contained in the fixed transmission aggregation time slice is calculated, wherein the sampling period is processed by rounding down; the cumulative number of explicit abnormal status identifiers appearing in the serialized data stream within the fixed transmission aggregation time slice is counted; the cumulative number is divided by the total number of data units to obtain the abnormal status identifier occupancy rate.
4. The method for secure transmission of medical data according to claim 1, characterized in that, The load length variation coefficient is determined based on the sampling interval attribute and channel dimension attribute of the real-time waveform signal, including: Based on the sampling interval attribute and the channel dimension attribute, calculate the total number of data units contained in the fixed transmission aggregation time slice; obtain the pre-set average character length constant of the effective numerical data units and the character length constant of the explicit abnormal state identifier; calculate the difference between the average character length constant of the effective numerical data units and the character length constant of the explicit abnormal state identifier; multiply the total number of data units by the difference, and use the product as the load length variation coefficient.
5. A method for secure transmission of medical data according to claim 4, characterized in that, Based on the preset flow rate estimation error limit and the load length variation coefficient, the filling fluctuation intensity parameter used to mask the occupancy rate of the abnormal state identifier is derived and calibrated in reverse, including: Based on the Fisher information bound principle, an indiscernibility model is established regarding the occupancy rate of the abnormal state identifier; the error limit of the flow inference estimation is squared to obtain the squared error limit value; the load length variation coefficient is squared to obtain the squared coefficient value; the squared error limit value and the squared coefficient value are multiplied together, and the resulting product is calibrated as the filling fluctuation intensity parameter to ensure that the estimated variance of the occupancy rate of the abnormal state identifier by the bypass observer is not lower than the squared error limit value.
6. A method for secure transmission of medical data according to claim 5, characterized in that, The pseudo-random generation logic is invoked to generate a deterministic filling adjustment amount that conforms to the filling fluctuation intensity parameter, including: Using a pre-set pseudo-random function algorithm, with the time sequence number of the fixed transmission aggregation time slice and the session export key as input, uniformly distributed pseudo-random values are generated; the uniformly distributed pseudo-random values are converted into approximate statistical values that follow a standard normal distribution through an accumulation mapping algorithm; the square root operation is performed on the filling fluctuation intensity parameter to obtain the standard deviation, and the standard deviation is multiplied by the approximate statistical value to obtain the deterministic filling adjustment amount.
7. A method for secure transmission of medical data according to claim 6, characterized in that, The target transmission frame length is calculated by adding the deterministic padding adjustment and fixed protocol overhead to the expected payload length of the serialized data stream, including: Based on the total number of data units, the occupancy rate of the abnormal state identifiers, and the average character length constant of the effective numerical data units, the theoretically expected plaintext length of the serialized data stream is calculated. The theoretically expected plaintext length, the fixed protocol overhead, and the deterministic padding adjustment are summed to obtain the original calculated length. The original calculated length is compared with the protocol's minimum allowed length and the maximum length of the protected record for numerical clamping: if the original calculated length is less than the protocol's minimum allowed length, the protocol's minimum allowed length is used; if the original calculated length is greater than the maximum length of the protected record, the maximum length of the protected record is used; otherwise, the original calculated length remains unchanged, thereby obtaining the target transmission frame length.
8. The method for secure transmission of medical data according to claim 1, characterized in that, Performing bit stuffing on the encrypted payload data to make its length match the target transmission frame length, and sending encrypted data packets according to the time slots defined by the fixed transmission aggregation time slice, including: The actual physical byte length of the serialized data stream is calculated, and the sum of the actual physical byte length and the fixed protocol overhead is subtracted from the target transmission frame length to obtain the required padding length. A zero-value bit sequence equal to the required padding length is constructed and appended to the end of the serialized data stream to form the alignment payload to be encrypted. Subsequently, the alignment payload is encrypted to generate the encrypted data packet. The product of the duration of the fixed transmission aggregation time slice and the current time slice sequence number is calculated, and the obtained time is used as the transmission trigger timestamp. The transmission instruction for the encrypted data packet is executed at the transmission trigger timestamp.