Multi-mechanism medical data batch collaborative verification method based on homomorphic encryption and zero-knowledge proof

Abstract

The invention belongs to the technical field of privacy calculation and medical data security, and provides a multi-mechanism medical statistics collaborative verification method based on homomorphic encryption and zero-knowledge proof. The system automatically constructs an abstract syntax tree from compliance rules and generates a verification circuit, and the homomorphic encrypted ciphertexts of different hospitals are matched through ciphertext slot mapping; and dynamically dividing batches according to the institution ID + statistical period, generating batch aggregation proof by adopting multi-proof aggregation and polynomial commitment, and quickly positioning abnormal institutions and batches by utilizing sparse indexes. The system can be deployed in an alliance chain environment, batch metadata and aggregation certificates are stored on the chain, and a supervisor can complete cross-mechanism statistical result spot check only by verifying a small amount of on-chain certificates. Experiments show that under the premise of not exposing plaintext data, the method can significantly reduce verification time in a multi-mechanism scene and improve expansibility and traceability of compliance verification.

Description

Technical Field

[0001] This invention belongs to the field of privacy computing and medical data security technology, specifically involving a multi-institutional batch collaborative verification method for medical data based on homomorphic encryption and zero-knowledge proof, which is used to achieve cross-institutional statistical computing and compliance verification while protecting the privacy of medical data. Background Technology

[0002] With the continuous advancement of smart healthcare and multi-institutional collaborative research, conducting statistical computation and compliance verification has become a rigid requirement while ensuring the privacy of cross-institutional medical data. Current practices mostly combine homomorphic encryption (HE) with zero-knowledge proofs (ZKP). However, in the process of engineering implementation, two significant problems have been exposed: First, for different statistical or compliance rules, verification circuits need to be repeatedly written manually. When rules are updated or application scenarios are migrated, not only are the modification costs high and the cycle lengthy, but errors are also prone to occur. Second, parallel operations by multiple institutions generate a large number of individual proofs. Verifying these proofs one by one will cause verification time and resource consumption to increase exponentially. Furthermore, once verification fails, it is often difficult to quickly locate the source of the anomaly and the responsible party, thus affecting the efficiency of auditing and review.

[0003] From a cryptographic implementation perspective, homomorphic encryption (HE) often involves complex constraints such as slot allocation, encoding scale, and noise budget management when batch processing real medical data. Different institutions, libraries, or parameters can lead to inconsistent ciphertext structures, causing reusable verification circuits to frequently fail to adapt when used across institutions. Zero-knowledge proof (ZKP) circuits are essentially a mapping from rules to gate circuits. When reusable templates and automatic generation mechanisms are lacking, engineering teams need to repeatedly perform repetitive work on common logic such as summation verification, threshold comparison, field integrity, and hash consistency. This not only slows down the iteration speed but also challenges the traceability and consistency of compliance interpretations. Most current verification methods are performed "institution-by-institution, batch-by-batch, and transaction-by-transaction." The order of magnitude of proofs and verification overhead increase linearly or even superlinearly with the number of participants and the scale of the task, making the system prone to bottlenecks during high-concurrency audit windows.

[0004] At the methodological level, the industry needs a fundamental, universal framework that automatically parses natural language or parameterized statistical / compliance rules into abstract syntax trees (ASTs), automatically synthesizes zero-knowledge proof (ZKP) circuits and constraints using templated verification components, and includes optimization measures such as redundant gate elimination. Simultaneously, it introduces slot mapping and format consistency checks for homomorphic encryption (HE) batch ciphertext, enabling the generated circuits to maintain compatibility across institutions and implementations. The verification granularity is elevated from "record / institution" to "batch," organizing data with meta-elements such as "institutional identifier + statistical period" to generate standardized batch metadata. Through batch-level multi-proof aggregation, multiple individual proofs are compressed into a single verifiable object, and a sparse index is carried in the aggregated proof to quickly locate the specific institution and fragment in case of verification failure, balancing high-throughput verification with traceable auditing.

[0005] In summary, engineering practices for privacy-preserving computation in healthcare require a two-dimensional collaborative solution capable of simultaneously addressing both "automatic generation of rules to circuits" and "batch-level efficient verification and anomaly localization." This solution does not rely on specific cryptographic formats or parameters, but emphasizes the standardization of interfaces and data formats. It enables different institutions and toolchains to achieve rapid adaptation, stable verification, and interpretable compliance within a unified framework, reserving ample space for subsequent research such as algorithm performance optimization, parameter selection, and experimental evaluation. Ultimately, this effectively supports the secure flow and efficient utilization of cross-institutional medical data under privacy-controlled and compliant verifiable conditions. Summary of the Invention

[0006] The technical problem to be solved by this invention is to simultaneously solve the dual-dimensional collaborative problem of "automatic generation of rules to verification circuits" and "batch-level efficient verification and anomaly location" in multi-institutional medical statistics and compliance scenarios.

[0007] This invention proposes a HE-ZKP two-dimensional collaborative verification method for multi-mechanism dense-state statistics. Figure 1 As can be seen, the system consists of four logical modules: rule parsing and circuit generation, ciphertext adaptation, batch management, and aggregation verification and anomaly localization. The overall process is as follows: First, parameterized rules are input; then, rule parsing / AST is performed; subsequently, ZKP verification circuits and constraints are generated through template mapping; then, HE batch processing is performed for ciphertext slot self-adaptation and format consistency verification; next, dynamic batch partitioning is performed using "organization identifier + statistical period" as the main dimension, and batch metadata is generated; then, individual proofs are generated within each batch, and multiple proofs are aggregated to obtain batch-level aggregated proofs; if failure occurs, anomaly localization is performed based on sparse indexes. This process, with "automatic generation + batch aggregation" as its core, unifies rule adaptation efficiency and verification throughput within a feasible engineering framework.

[0008] Phase 1: Integrated automatic generation and ciphertext adaptation from rules to verification

[0009] This phase integrates the series of actions—"rules → verification circuit / constraints → interface with HE ciphertext"—into a unified pipeline, avoiding interface fragmentation and redundant overhead caused by multiple sequential steps. The task party submits parameterized rules in structured or restricted natural language. The system obtains an Abstract Syntax Tree (AST) through syntax analysis and selects and combines nodes from the verification circuit template library based on node type, automatically generating ZKP verification circuits and constraints, and simultaneously deriving the proof / verification key. To reduce the time required for subsequent proofs, this invention implements optimization measures at the circuit level, such as redundant gate elimination, gate merging, and common subexpression reuse, enabling the constraint size to converge while ensuring semantic equivalence. The subsequent step involves interface with HE data: the system receives HE batch ciphertext and its metadata from various institutions, establishing "fields..." The system generates a slot mapping table for the "slot index" and performs coverage and conflict checks. When inconsistencies in slot layout, missing fields, or inconsistent order are found across institutions, it automatically triggers rearrangement / filling / index remapping. If necessary, it performs secure backfilling of rules (e.g., setting constraint-level default values ​​for missing fields), thereby achieving a unified circuit for "one-time alignment" of ciphertext from multiple institutions. This stage outputs standardized circuit / constraint descriptions, proof keys pk and verification keys vk(pk,vk), the slot mapping table, and an aligned ciphertext view description, providing direct input for batch organization and proof generation.

[0010] Phase Two: Batch Modeling and Batch-Level Aggregation Validation

[0011] To balance verification throughput and traceability, this phase adopts a combined design for "cross-institutional data organization" and "multi-proof merging verification." Batches are established using "institutional identifier + statistical period" as the primary dimension. When the data volume of a single institution in a single period is insufficient, adjacent periods can be merged to form a unified batch, reducing the number of subsequent proofs and improving statistical robustness. The system generates batch metadata for each batch, which includes at least: batch identifier, a list of institutional identifiers, statistical interval, number of data entries, and a ciphertext set digest (e.g., hash root or digest vector). Deterministic construction rules ensure consistent identification of the same batch by different nodes. Based on the circuit / constraint and slot mapping produced in Phase 1, each institution generates a single-unit ZKP proof for its own aligned ciphertext. The single-unit proof is internally bound to the batch identifier and institutional identifier to ensure anti-aliasing and traceability during subsequent merging. The system then performs multi-proof aggregation on all single-unit proofs within the same batch to obtain a batch-level aggregated proof. This proof object satisfies the condition "aggregated proof passed = all single-unit proofs in the same batch passed," and is strongly bound to the batch metadata to prevent misuse across batches or tasks. By using batch aggregation, the verification process shifts from "verifying multiple certificates on a per-institution, per-item basis" to "verifying a single aggregated object," which reduces the amount of computation and latency to some extent, creating a throughput advantage that facilitates project scalability. This stage outputs batch-level aggregated certificates and their binding relationship with batch metadata for final verification and audit records.

[0012] Phase 3: Anomaly Location and Unified Operation and Maintenance Interface

[0013] To avoid reverting to a full re-examination when aggregation verification fails, this invention constructs a sparse index while generating batch-level aggregation proofs, incorporating the "organization identifier" The "fragment location information" (fragment start and end, fragment summary, etc.) is stored as accompanying data along with batch metadata. When aggregation verification fails, the verification end performs segmented replay or binary search based on this index, prioritizing the location of abnormal institutions and fragments, and then initiating recalculation and review of the subset as needed, thereby shortening the location time by orders of magnitude and reducing computational overhead. To ensure the maintainability and portability of the system, this invention provides a unified interface specification, including rule / compilation interface (Parse(rule)→AST, Compile(AST)→Circuit / Constraints, GenKey(Circuit)→(pk,vk)), ciphertext adaptation interface (Align(cipherSet,CircuitSpec)→SlotMap,View), and batch and aggregation interface (MakeBatch(View)). The system provides the following signatures: `OrgID,TimeWindow)→BatchMeta`, `Prove(View,pk)→Proof`, `Aggregate({Proof_i},BatchMeta)→AggProof`, `Verify(AggProof,BatchMeta)→{Pass|Fail}`, and the location interface `Locate(AggProof,Index,BatchMeta)→{OrgID,FragmentRange}`. These signatures are implementation-independent abstract definitions, allowing for the replacement of different homomorphic encryption (HE) implementations and zero-knowledge proofs (ZKP) without changing the external interface. The system provides parallel and caching strategies, degradation strategies, and performance guidelines at the engineering level to ensure stability and scalability in multi-organization, high-concurrency scenarios.

[0014] The key points of this invention and the content to be protected are as follows:

[0015] Compared to existing solutions that involve manually writing ZKP circuits and verifying each institution and each item, this invention innovates by constructing an integrated, automated generation pipeline that goes from rules to an Abstract Syntax Tree (AST), then to templates, and finally to generating verification circuits or constraints. This helps reduce scenario adaptation costs and human error. It proposes a slot mapping and format consistency verification mechanism for batch processing ciphertexts in homomorphic encryption (HE), enabling one-time alignment of ciphertexts across institutions and generating witness information. It introduces batch modeling and batch-level multi-proof aggregation methods based on "institutional identifier + statistical period" as the main dimensions, compressing multiple individual proofs into a single aggregated object, thus reducing verification overhead to some extent. A sparse index is attached to the aggregated proof, enabling rapid anomaly localization and traceable diagnosis when verification fails. These four aspects work together to form a closed-loop capability of "automatic adaptation—high throughput—localization," rather than performing single-point optimization.

[0016] The inventors wish to protect the following key aspects: the automated process of generating zero-knowledge proof (ZKP) verification circuits / constraints through rule parsing and template mapping, along with corresponding circuit-level optimization methods; slot mapping tables for batch processing ciphertexts in homomorphic encryption (HE), overlay / conflict checking, and necessary rearrangement, filling, or rule backfilling operations for cross-agency compatibility; the batch-generated metadata structure and its strong binding relationship in multi-proof aggregation; sparse indexes carrying agency-fragment location information, and fast location interfaces and processes based on these indexes. These are essential technical features, independent of specific zero-knowledge proof (ZKP) genres and homomorphic encryption (HE) implementations.

[0017] The significant benefits of this invention are mainly reflected in the following aspects: Based on "automatic generation + batch aggregation," this invention offers room for improvement in adaptation efficiency. Previously requiring manual maintenance, ZKP verification circuits can now be initially automatically generated through a pipeline of "rules → AST → template → constraints." Combined with common optimizations such as redundant gate elimination and gate merging, the constraint size and proof generation time can be compressed to some extent in certain scenarios, making the engineering iteration rhythm more closely aligned with the rhythm of requirement changes. For development and operations teams, this approach helps reduce the uncertainty caused by reinventing the wheel and manual modifications.

[0018] Regarding cross-institutional compatibility, the slot mapping and format consistency verification introduced for HE batch ciphertext can provide a one-time alignment and reuse path when multiple institutions, different implementations, or different encoding scales coexist. When there are situations such as missing fields or inconsistent order, strategies such as rearrangement, padding, or rule backfilling can help reduce the frequency of recompiling circuits or issuing certificates independently, thereby balancing the cost and stability of the interface to a certain extent.

[0019] To address verification throughput and latency, batch modeling based on "organization identifier + statistical period" as the main dimension, combined with multi-proof aggregation, can reduce the granularity of verification operations from "per organization, per item" to "per batch, per verification." This change typically leads to a decrease in the number of verifications and end-to-end latency, and helps control the consumption of computing and storage resources. Simultaneously, the sparse index accompanying the aggregated proof provides an operational path for failure localization: when verification fails, the verification end can first locate suspected organizations and fragments, and then selectively perform subset verification, reducing the overhead of full backtracking.

[0020] In terms of scalability and compliance friendliness, this invention adheres to the principle of interface and data form independence, allowing switching between different ZKP systems or HE schemes without modifying external interfaces. The scheme deliberately preserves research space for syntactic details, aggregation genres, and threshold parameters, facilitating subsequent algorithm optimization, parameter selection, and performance evaluation in academic and industrial environments, and enabling gradual integration and verification with existing processes. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating the multi-institutional medical data batch collaborative verification method based on homomorphic encryption and zero-knowledge proof of the present invention.

[0022] Figure 2 This is a schematic diagram of the multi-institutional medical data batch collaborative verification framework of the present invention.

[0023] Figure 3 This diagram illustrates the comparison of verification time for the HE-ZKP verification scheme under different data scales. Detailed Implementation

[0024] The specific implementation methods of the present invention will be summarized below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0025] Figure 2 This is the overall architecture diagram of the dual-dimensional collaborative verification method based on homomorphic encryption (HE) and zero-knowledge proof (ZKP) of the present invention. It includes a rule parsing and circuit generation module, a ciphertext adaptation module, a batch management module, and an aggregation verification and anomaly location module. The modules interact with each other through preset interfaces.

[0026] In this embodiment, multiple medical institutions were selected to participate in the verification. In the deployment environment, a laptop computer (64-bit operating system) equipped with a multi-core general-purpose processor, 16GB of memory, and a dedicated graphics card was selected as the running platform. Homomorphic encryption and zero-knowledge proof toolchains were installed to implement the method of this invention. This configuration is merely an example; this invention is also applicable to other hardware environments that meet the computational requirements.

[0027] Step 1: Integrated Automatic Generation and Ciphertext Adaptation from Rules to Validation. First, the task provider submits statistical and compliance rules in a structured format, such as "summing the number of visits by institution and time window and comparing it with a threshold," "checking that key fields are not empty," and "verifying that the hash of the field matches the reference hash." The rule parsing and circuit generation module performs syntax parsing on these rules to obtain an Abstract Syntax Tree (AST). Based on this, it selects components such as summation, comparison, non-empty verification, and hash consistency from the validation circuit template library, combining them to generate a zero-knowledge proof validation circuit and constraints, while deriving the proof key and validation key. Subsequently, the generated circuit undergoes optimization operations such as redundant gate elimination, gate merging, and common subexpression reuse, controlling the constraint size and certification time while maintaining the logical semantics.

[0028] Each institution first uses a homomorphic encryption toolchain to batch-encrypt its plaintext medical data, obtaining homomorphically encrypted batch ciphertext. The system then loads the batch ciphertexts and metadata from multiple institutions, establishing "data fields" through the ciphertext adaptation module. The mapping relationship of "ciphertext slots" is used to perform coverage and conflict checks: when differences in field order, slot overlap, or missing fields are detected, alignment is achieved through rearrangement, padding, or index remapping; for fields that are indeed missing but do not affect the overall verification objective, constraint-level backfilling can be performed at the rule level to provide a verifiable default processing strategy. After the above processing, a unified aligned ciphertext view and slot mapping table are formed for all participating institutions, providing basic input for subsequent batch modeling and certification.

[0029] Step Two: Batch Modeling and Batch-Level Aggregation Verification. After completing circuit generation and ciphertext adaptation, the batch management module divides the data from multiple institutions based on the main dimension of "institutional identifier + statistical period." In this embodiment, several batches are generated using a monthly statistical approach. For months with small sample sizes, adjacent months within the same institution can be merged to form a single batch, reducing the number of batches and improving statistical stability. For each batch, the system generates batch metadata, recording at least the batch identifier, a list of included institutions, the statistical interval, the number of data entries, and a summary of the ciphertext set. The batch identifier can be deterministically constructed based on meta-elements such as the institution set and time window, ensuring consistent identification of the same batch across multiple nodes.

[0030] Based on the verification circuits, constraints, and slot mappings obtained in Step 1, each institution generates individual zero-knowledge proofs for the aligned ciphertexts belonging to that batch, explicitly binding the batch identifier and institution identifier in the common input of the proof. After collecting all individual proofs within the same batch, the aggregation verification module first performs a consistency check on the batch identifier, institution list, and batch metadata. Then, using a multi-proof aggregation method, it combines multiple individual proofs into a single batch-level aggregated proof and establishes a binding relationship between this aggregated proof and the corresponding batch metadata. At the verification end, only one verification of the batch-level aggregated proof and batch metadata is needed to obtain a "pass" or "fail" conclusion for the batch. Compared to the item-by-item, institution-by-institution verification method, the number of verification objects is reduced from "multiple individual proofs" to "a single aggregated proof," making the end-to-end verification process more centralized. Batch verification results and related metadata can be recorded together for easy subsequent review, verification, and comparison.

[0031] Step 3: Anomaly Location and Unified Operation and Maintenance Interface. To quickly locate the source of the problem when verification fails, this embodiment, while generating batch-level aggregated proof, has the anomaly location module construct a sparse index structure to include the "organization identifier". The evidence fragment location information (such as fragment start and end positions, fragment summary hash, etc.) is stored as accompanying information along with batch-level aggregated evidence and batch metadata. In the simulation experiment, the aforementioned approximately 30 anomalous samples were injected into different institutions and different batches to simulate situations such as missing fields and inconsistent hashes. When the batch-level verification result is "failed", the system calls the location interface, first determines the suspected institution and the corresponding evidence fragment range based on the sparse index, and then performs segmented playback or targeted recalculation on the subset; if necessary, a recertification request can be initiated to the corresponding institution.

[0032] At the operations and maintenance (O&M) level, the system integrates key call processes such as rule parsing, compilation, encrypted alignment, batch creation, individual certificate issuance, aggregation, verification, and location into the O&M and audit interfaces, recording runtime, input / output summaries, and anomaly information through logs. In this way, O&M personnel can focus on the indexed organization and data segment when troubleshooting, rather than verifying all data in the entire batch. This approach leads to a convergence in the scope of review and processing time in practice. Furthermore, these runtime records facilitate subsequent comparative experiments and performance evaluations of different parameter configurations and toolchain implementations.

[0033] Building upon the aforementioned implementations, this invention completes the entire process in a single-machine environment, from automatic rule generation of verification circuits, HE ciphertext self-adaptation, batch modeling by institution and period, batch-level multi-proof aggregation, and sparse index-driven anomaly localization. Taking multiple institutions and thousands of samples as examples, under a given toolchain and parameter configuration, batch-level aggregation verification shows a decreasing trend in the number of verification objects and end-to-end verification time compared to institution-by-institution verification. Simultaneously, index-based anomaly localization allows for more focused review of verification failures on a smaller number of institutions and segments. This implementation demonstrates that, without altering the method steps and module divisions, this invention can be implemented in common desktop hardware environments and multi-institution data scenarios. Combinations of other institution numbers, data scales, and statistical periods can also be adjusted and extended with reference to this embodiment without changing the method flow.

[0034] Table 1 Comparison of rule validation results

[0035]

[0036] Table 1 shows a comparison of the number of violations for three rules in the baseline implementation and the AST circuit version on the same dataset. It can be seen that for rules R1, R2, and R3, the two implementations yielded completely identical numbers of violations: 1036, 656, and 427 respectively, without any discrepancy. This indicates that the verification circuit automatically generated based on the abstract syntax tree is logically equivalent to the manually written baseline verification code, capable of completely and accurately reproducing the semantics of the business rules, providing a correctness guarantee for subsequent execution in homomorphic encryption and zero-knowledge proof environments.

[0037] Table 2 Performance comparison of various validation schemes under different data sizes

[0038]

[0039] Table 2 shows the time consumption comparison of each verification scheme under different data scales. It can be seen that as the number of institutions and the number of records per institution gradually increase from "5×1000" to "10×5000", the total number of records expands from 5000 to 50000. The time consumption of all schemes increases approximately linearly with the total number of records, without any abnormal fluctuations, indicating that each implementation has good scalability. The baseline scheme only performs simple rule judgments in the local plaintext environment, and its time consumption remains in the millisecond range, serving as a performance upper bound reference under ideal conditions. The AST version and batch verification schemes 1 and 2 based on it, even with the introduction of additional steps such as circuit generation and batch aggregation, maintain an overall time consumption in the range of 0.08–0.8 seconds. Further comparison reveals that the time consumption of the AST version is almost equivalent to that of batch verification scheme 1, while batch verification scheme 2 is slightly higher but the difference is not significant. This indicates that while completing multi-institution batch partitioning and proof aggregation, the system does not introduce significant additional performance overhead, maintaining high verification efficiency while ensuring privacy protection and collaborative verification capabilities.

[0040] like Figure 3 As shown, the trends in total verification time for the three schemes under different total number of records are presented, where the horizontal axis represents the total number of records to be verified, and the vertical axis represents the corresponding total verification time. It can be seen that as the total number of records gradually increases from 5000 to 50000, all three curves show a basically linear increase, indicating that under the current implementation and hardware environment, the time cost of each scheme is approximately proportional to the data scale, demonstrating good scalability. Specifically, the AST circuit version and batch verification scheme one have very similar time consumption under various data scales, while batch verification scheme two is slightly higher. However, all three curves are generally on the same order of magnitude, showing no significant performance degradation. This indicates that, while ensuring aggregated verification and multi-mechanism collaboration capabilities, the introduction of batch partitioning and proof aggregation only brings a slight additional time cost and does not undermine the performance advantages of the entire HE-ZKP verification framework.

[0041] Table 3. Statistics on the number of violations by each institution in the collaborative verification scenario.

[0042]

[0043] Table 3 shows the distribution of violations across the three rules for the five institutions in a collaborative verification scenario. Under rule R1, the number of violations for each institution is 213, 199, 216, 191, and 217, totaling 1036. Under rule R2, the number of violations is 131, 115, 127, 123, and 160, totaling 656. Under rule R3, the number of violations is 84, 84, 86, 80, and 93, totaling 427. The total number of violations for each row is completely consistent with the overall statistical results above, indicating that with batch-level collaborative verification and proof aggregation, the system can obtain both the total number of violations globally and the detailed violation information for each institution, providing a basis for subsequently identifying abnormal institutions and conducting targeted audits.

Claims

1. A batch collaborative verification method for multi-institutional medical data based on homomorphic encryption and zero-knowledge proof, characterized in that, Includes the following steps: (1) Automatic generation of rule parsing and verification circuit: Obtain parameterized rules for medical statistics and compliance verification, input the parameterized rules into the rule parsing engine, perform syntactic analysis on the parameterized rules through the preset rule syntax template, and generate an abstract syntax tree (AST) containing elements such as statistical dimensions, threshold ranges, field integrity constraints, and compliance indicators; perform logical compilation based on the AST, map the AST nodes to circuit components in the zero-knowledge proof (ZKP) verification circuit, combine them to obtain a set of circuit constraints for constraining medical statistical results, and derive the corresponding proof key pk and verification key vk; (2) Homomorphic encryption ciphertext format adaptation: Each medical institution performs homomorphic encryption batch processing on its plaintext medical data locally to obtain batch ciphertext; at the collaborative verification end, the batch ciphertext and its metadata from multiple medical institutions are loaded, and the mapping relationship between medical data fields and homomorphic encryption ciphertext slots is established through the slot mapping algorithm. According to the preset format compatibility verification rules, the field order, slot usage range, and field missing situation of the ciphertext of each institution are detected and adjusted so that the batch ciphertext of different institutions meets the unified verification circuit input format. (3) Dynamic batch division: Medical data of each institution is divided based on institution identification and statistical period. When the amount of data of a single institution in a single statistical period is greater than the first threshold, the data of that institution in that statistical period is treated as an independent batch. When the amount of data of a single institution in a single statistical period is less than or equal to the first threshold, the period merging logic is triggered to merge the same type of data in multiple adjacent statistical periods into one batch, and ensure that the amount of data in the merged batch is not less than the second threshold, so as to reduce the number of scattered small batches. (4) Batch metadata generation: For each batch, a unique batch identifier is calculated based on the institution identifier, the start and end time of the statistical period, and the batch data volume. A batch ID is generated using a hash algorithm, and batch metadata containing the batch ID, the set of institution identifiers, the statistical time interval, the number of data entries, and the root hash of the ciphertext digest is constructed for blockchain notarization and subsequent proof aggregation. (5) Generation and aggregation of zero-knowledge proofs from multiple institutions: Each medical institution generates zero-knowledge single-unit proofs for its corresponding batch based on the verification circuit generated in step (1) and the homomorphic encrypted batch ciphertext adapted in step (2). The single-unit proofs, their verification result summaries, institution identifiers, and batch metadata hashes are sent to the collaborative verification end. The collaborative verification end uses a multi-proof aggregation algorithm to aggregate multiple single-unit proofs from different medical institutions within the same batch into a batch-level aggregated proof, and binds the batch-level aggregated proofs with the corresponding batch metadata. (6) Aggregation verification and anomaly location: The batch-level aggregated proof and batch metadata are submitted to the blockchain smart contract. The smart contract uses the verification key vk to verify the batch-level aggregated proof. When the verification is successful, it is determined that the statistical results of all medical institutions in the batch meet the preset rules. When the verification fails, the corresponding institution identifier and proof fragment position are located in the batch-level aggregated proof based on the pre-built sparse index table, so as to realize the backtracking and location of the abnormal institution and its corresponding data fragment.

2. The method according to claim 1, characterized in that, The automatic generation of the rule parsing and verification circuit in step (1) specifically includes: the rule parsing engine uses a dedicated rule description language to convert the natural language rules for medical scenarios into formalized parameterized rules, and then generates the abstract syntax tree (AST) through a syntax analysis tool. The AST includes at least statistical dimensions, threshold conditions, field integrity constraints, and result compliance markers. In the logic compilation stage, based on the component mapping table, the numerical threshold judgment rules are mapped to comparison circuit components, the statistical summation rules are mapped to addition circuit components, and the medical record integrity rules are mapped to a combination of field non-empty verification circuit components and hash consistency circuit components.

3. The method according to claim 1, characterized in that, The homomorphic encryption ciphertext format adaptation in step (2) specifically includes: mapping each slot of the homomorphic encryption batch ciphertext to the corresponding medical data field according to the predefined "field-slot" relationship in the configuration file; when a slot is detected to be incompatible with a field, automatically triggering slot rearrangement, slot expansion, or rule-side field masking strategy; and outputting the updated slot mapping configuration after the adaptation is completed to drive the input layout of the subsequent verification circuit; when a field is detected to be missing but its impact on the overall verification target is controllable, setting a constraint-level default value for the field on the rule side to achieve secure backfilling.

4. The method according to claim 1, characterized in that, In the dynamic batch division in step (3), the first threshold and the second threshold are pre-configured according to the actual business scenario. When the data volume of a single institution in a single period is greater than or equal to the first threshold, all data of the institution in that period is divided into a complete batch. When the data volume of a single institution in a single period is lower than the first threshold, the same type of data of the institution in two or three adjacent statistical periods are merged. The data volume after merging must be greater than or equal to the second threshold in order to achieve a balance between the number of batches and the data volume of a single batch.

5. The method according to claim 1, characterized in that, The batch metadata generation in step (4) specifically includes: using a cryptographic hash algorithm to combine the organization identifier, the start and end time of the statistical period, and the batch data volume to generate a batch ID; constructing a Merkle tree based on the hash value of the homomorphic encrypted ciphertext within each batch; taking its root hash as the root hash of the ciphertext digest; and encapsulating the batch ID, the set of organization identifiers, the statistical time interval, the number of data entries, and the root hash of the ciphertext digest into a batch metadata record for writing into the blockchain or consortium blockchain ledger.

6. The method according to claim 1, characterized in that, The multi-proof aggregation algorithm in step (5) is implemented based on the polynomial commitment scheme. The public key parameters, verification result digests and batch metadata in the zero-knowledge single proofs of each medical institution are hashed and encoded into polynomial coefficients. The consortium chain nodes collaboratively generate random secret parameters to construct a unique polynomial and calculate the corresponding commitment value. During the aggregation verification process, the blockchain smart contract compares the commitment value with the result obtained according to the polynomial calculation rules through a preset verification formula to determine the validity of the batch-level aggregation proof.

7. The method according to claim 1, characterized in that, The sparse index table in step (6) is stored in an array or key-value pair structure. Each index record includes at least the institution identifier, the start position of the proof fragment, the end position of the proof fragment, and the fragment hash value. During anomaly backtracking, the blockchain smart contract determines the range of suspicious batches based on the anomaly markers in the batch-level aggregated proofs, and locates the corresponding institution identifier and its proof fragment by searching or binary searching the sparse index table, thereby achieving rapid identification and targeted review of the abnormal institution.

Images