Secure transmission method of medical data and big data digital signature system

Abstract

The invention relates to the technical field of data management, and discloses a medical data secure transmission method and a big data digital signature system, and the method comprises a hierarchical processing step, a privacy enhancement step, a key negotiation step, a segmented transmission step and an audit tracking step. The system comprises a signature preprocessing module, a hierarchical signature module, a privacy purification module, a verification module and a tracing module. According to the method, a risk association map is constructed through hierarchical processing, and accurate identification of data association risks is realized; privacy and availability are balanced through differentiated privacy enhancement, authorization controllability is enhanced in combination with block chain key management, large file transmission integrity and non-repudiation are guaranteed, and whole-course audit is controllable. According to the system, the relevance between the signature and the privacy feature is improved through module design, the integrity and relevance of the signature chain are guaranteed, privacy protection and verifiability are compatible, efficient verification is achieved, the dispute traceability is provided, and pediatric medical data safety is guaranteed in cooperation with the method.

Description

Technical Field

[0001] This invention relates to the field of data management technology, specifically a method for secure transmission of medical data and a big data digital signature system. Background Technology

[0002] With the development of medical informatization and big data technology, the cross-institutional sharing of pediatric medical data (such as patient identity information, medical records, medication history, family medical history, etc.) is becoming increasingly frequent (such as cross-hospital consultations, remote diagnosis and treatment, scientific research collaboration, etc.). While improving the efficiency of diagnosis and treatment and promoting medical research, it also faces serious challenges of privacy leakage and secure transmission due to the high sensitivity of the data.

[0003] Children are a special group, and their medical data involves not only personal privacy but also family information. Therefore, strict privacy protection and authorization requirements must be met when transmitting and using medical data for pediatric patients.

[0004] However, existing data transmission methods often employ static classification approaches (such as direct and indirect identification) to anonymize or protect medical data, neglecting the risk of dynamic associations between different data features. If a low-sensitivity feature (such as the age of onset of a specific disease) frequently co-occurs with direct identification features (such as name and ID number), it may be possible to infer the patient's identity through association analysis, leading to privacy leaks. Secondly, in the segmented transmission of large medical data files (such as imaging examination results and long-term medical records), existing verification mechanisms (such as simple hash verification) do not incorporate data privacy features, potentially leading to the leakage of sensitive information due to checksums. Furthermore, transmission logs are easily tampered with, and when disputes arise regarding data integrity or authorization validity, the lack of immutable evidence preservation and traceability methods makes it difficult to clearly identify the responsible party.

[0005] Therefore, given the unique nature of pediatric medical data, there is an urgent need for a sophisticated medical data management technology that provides both refined privacy protection and ensures full traceability throughout the transmission process. Summary of the Invention

[0006] The purpose of this invention is to provide a secure transmission method for medical data and a big data digital signature system to solve the technical problems mentioned in the background.

[0007] To achieve the above objectives, the present invention discloses the following technical solutions: In a first aspect, the present invention discloses a method for secure transmission of medical data, the method comprising: Layered processing steps: Pediatric medical data is divided into identity data, diagnosis and treatment data and related data according to sensitivity. A risk association graph is constructed based on a preset pediatric privacy policy. The risk association graph is used to quantify the sensitivity association strength between various data features. Privacy enhancement steps: Reversibly desensitize identity data based on the risk association graph, perform feature obfuscation transformation on medical data, and add access constraint tags to associated data; Key negotiation steps: Based on blockchain nodes, a session key pool with symmetric and asymmetric key pairs is generated with the authorization of the guardian. The two parties transmitting the data after the privacy enhancement steps are negotiated through a key exchange algorithm. The key validity period is bound to the authorization duration. Segmented transmission step: The large file data to be transmitted as determined in the key negotiation step is segmented for transmission. Each data segment is equipped with a check code based on a privacy protection factor, and the check code is bound to the guardian's timestamp signature. Audit trail steps: The entire transmission process in the segmented transmission steps is transmitted using an encrypted protocol, and the operation log is stored on the blockchain. Transmission event notifications are also pushed to the guardian in real time.

[0008] Preferably, the risk association map is constructed through the following steps: Extract personal identification features from identity data, extract clinical features from medical data, and extract association features from related data; The extracted features are classified according to their sensitivity type, which includes direct identification type, indirect association type and low sensitivity type, and each type of feature is uniquely encoded and assigned a basic sensitivity weight; An N×N initial matrix is ​​constructed using the feature encoding as row or column index. The initial matrix is ​​used to store the sensitive correlation strength between features, and the initial value of each element is 0. N is the total number of features. Based on historical pediatric medical data within a preset time period, the number of times any two features appear simultaneously in the same data record is counted. The ratio of this number to the total number of historical data records is used as the co-occurrence frequency and updated to the corresponding position in the initial matrix to form an association matrix. Multiply the basic sensitivity weight of the feature by the corresponding co-occurrence frequency to obtain the sensitivity correlation strength value between the features, and fill it into the correlation matrix; According to the preset cycle, the calculation of the recurrence frequency and sensitive association strength values ​​of newly added pediatric medical data and the update of the association matrix are carried out. The updated association matrix is ​​converted into a risk association graph, where the nodes of the risk association graph represent features and the thickness of the edges corresponds to the sensitivity association strength value.

[0009] As a preferred approach, when classifying features by sensitivity type: If a feature belonging to the indirect association class is confirmed in historical medical data to be linked to a patient's identity through publicly available information, then the type of that feature will be upgraded from the indirect association class to the direct identification class. If the co-occurrence frequency of a feature of a low-sensitivity class exceeds a preset frequency threshold, the sensitivity type of the feature of that low-sensitivity class will be temporarily upgraded to the indirect association class until the co-occurrence frequency drops below the threshold and is restored to the low-sensitivity class.

[0010] Preferably, in the privacy enhancement step: The reversible desensitization includes: pseudonym replacement and local field encryption based on the SM4 algorithm; The feature obfuscation transformation includes: compressing the feature dimensions of diagnostic and treatment data with a higher than preset correlation strength, and retaining the original dimensions of the feature dimensions of diagnostic and treatment data with a lower than preset correlation strength; The access constraint tags include: authorized subject type, data usage scenario, and access time limit.

[0011] Preferably, the generation of the session key pool includes: The guardian submits an authorization request to the blockchain node through two-factor authentication. After the node verifies the request, it triggers the key generation algorithm to generate a session key pool with a symmetric key pair (A) and an asymmetric key pair (B). The symmetric key is generated using the national cryptographic SM4 algorithm, while the asymmetric key pair is generated based on the SM2 elliptic curve cryptography algorithm. Each key pair is also assigned a unique identifier that is bound to the guardian's authorization ID and the transmission session ID.

[0012] Preferably, the key negotiation between the transmitting parties corresponding to the data processed in the privacy enhancement step using a key exchange algorithm includes: The initiator of the transmission randomly selects an asymmetric key pair from the session key pool and transmits the public key to the receiver through the blockchain node in an encrypted manner; The receiver uses its own generated temporary private key and the initiator's public key to calculate the shared key, and then uses the initiator's public key to encrypt and send back confirmation information. After the integrity is verified by the blockchain node, the sender and receiver deduce the session master key based on the shared key. Blockchain nodes generate an immutable negotiation log for the key negotiation process, which includes the key exchange time, participant identifiers, and public key fingerprints.

[0013] Preferably, in the segmented transmission step: The method of transmitting large file data determined in the key negotiation step in the above steps in the form of fragmented transmission includes: splitting the large file data determined in the key negotiation step into data fragments according to a preset size threshold, and generating a unique identifier ID for each data fragment; The privacy protection factor includes a random noise value dynamically generated based on the sensitivity level of the fragmented data; The timestamp signature includes: a signature generated by a blockchain node pre-authorized by the guardian based on UTC standard time and obtained by signing with the guardian's private key.

[0014] Preferably, in the segmented transmission step, when the receiver verifies, if the checksum of the data fragment is inconsistent with the local calculation result, the timestamp signature verification fails, or the transmission interruption exceeds a preset duration, the invalid data fragment is deleted and the verified timestamp signature is retained. Based on the segmented transmission status log stored in the blockchain, a new request is made to transmit the data fragment corresponding to the invalid fragment.

[0015] Secondly, this invention discloses a big data digital signature system applied to the secure transmission method of medical data as described above, the system comprising: The signature preprocessing module is configured to: receive pediatric medical data, split the data into blocks based on the constructed risk association graph, the data blocks including identity data blocks, diagnosis and treatment data blocks and association data blocks, and extract identity data and diagnosis and treatment data with privacy features; The layered signature module is configured to generate a data block signature for each split data block at the bottom layer using a batch signature algorithm and keys from the session key pool, and to aggregate the data block signatures at the top layer to form an associated signature chain, wherein the associated signature chain includes data association relationship encoding and blockchain anchors; The privacy purification module is configured to: perform reversible desensitization processing on the identity data in the associated signature chain and feature obfuscation on the medical data based on the guardian's access constraint tags, while retaining the verification identifier; The verification module is configured to verify the integrity and authenticity of the associated signature chain processed by the privacy sanitization module using the aggregated public key in the asymmetric key pair. The traceability module is configured to: when a dispute arises in the verification of the associated signature chain processed by the verification module, generate an evidence chain based on the audit logs stored in the blockchain to perform closed-loop verification for tracing the source of the dispute.

[0016] Preferably, the closed-loop verification method for tracing disputes based on the evidence chain generated from audit logs stored in the blockchain includes the following steps: Based on the blockchain anchor point generated by the layered signature module, the audit log in the blockchain is located, and the transmission session ID, guardian authorization details and data status records associated with the signature chain are extracted. Using zero-knowledge proof technology, with timestamps and access constraint tags in audit logs as input, the fragments related to the disputed points in the associated signature chain generation path are reconstructed, while hiding the privacy features and complete processing logic of the original data; The reconstructed fragments are bound to blockchain anchors to form a chain of evidence, and the minimum information required for verification is disclosed to regulators.

[0017] Beneficial effects: 1. The medical data secure transmission method of this invention achieves precise data layering by constructing a risk association graph to dynamically quantify the strength of sensitive associations between features of pediatric medical data; it combines reversible desensitization, feature obfuscation transformation, and differentiated privacy enhancement mechanisms with access constraint tags to protect privacy while preserving data availability; it enhances the security and controllability of key management by generating a session key pool based on blockchain nodes and binding it to the guardian's authorization duration; it ensures the integrity and non-repudiation of large file transmission through fragmented transmission using a verification code with privacy protection factors combined with the guardian's timestamp signature; and it achieves traceability and real-time monitoring of transmission behavior through end-to-end encrypted transmission and blockchain-based audit tracking, fully meeting the privacy protection and compliance requirements for pediatric medical data transmission. 2. The big data digital signature system of this invention splits data blocks by associating risk correlation graphs through a signature preprocessing module, deeply integrating the privacy features of pediatric medical data into the signature logic; a layered signature module generates data block signatures and aggregates them into a signature chain containing correlation codes and blockchain anchors, ensuring the authenticity of individual data blocks while preserving the correlation between data; a privacy purification module retains verification identifiers while stripping sensitive features, achieving compatibility between privacy protection and signature validity; a verification module improves verification efficiency in multi-data-block scenarios by aggregating public keys; and a traceability module generates an evidence chain based on blockchain audit logs, providing closed-loop verification capabilities for dispute resolution, effectively adapting to the signature and traceability requirements in the secure transmission of pediatric medical data. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a secure medical data transmission method provided in an embodiment of the present invention; Figure 2 This is a structural block diagram of a big data digital signature system provided in an embodiment of the present invention. Detailed Implementation

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] In this document, the term "comprising" is intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0022] This embodiment provides a first aspect such as Figure 1 The illustrated method for secure transmission of medical data aims to address issues in existing technologies such as the imbalance between privacy protection and data availability, lax authorization control, and insufficient secure transmission and audit traceability capabilities. This embodiment of the secure medical data transmission method includes a layered processing step, a privacy enhancement step, a key negotiation step, a segmented transmission step, and an audit traceability step.

[0023] In detail Layered processing steps: Receive pediatric medical data (such as child's name, ID number, medical records, examination images, family medical history, etc.), and divide it into three categories according to sensitivity: identity data (name, ID number, guardian information), diagnosis and treatment data (disease diagnosis, medication records, examination results), and related data (visit time, department information). Based on a preset pediatric privacy policy (such as the sensitivity standards in the "Regulations on the Protection of Children's Personal Information Online"), a risk association graph is constructed. The risk association graph is used to quantify the sensitivity association strength between various data features.

[0024] The stratified processing steps accurately identify the dynamic correlation risks between identity data, medical data, and related data through sensitivity classification and risk association mapping, thus solving the problem that traditional static classification does not adequately consider data correlation.

[0025] In this embodiment, the risk association map is constructed through the following steps: Extract personal identification features (such as name, ID number, guardianship relationship) from identity data; extract clinical features (such as imaging lesion parameters, gene sequence fragments, laboratory test values) from medical data; and extract correlation features (such as the mapping relationship between medication records and diagnostic results, family medical history correlation tags) from related data. The extracted features are classified according to their sensitivity type, which includes direct identification type, indirect association type and low sensitivity type. Each type of feature is uniquely encoded and assigned a basic sensitivity weight (e.g., using hash value to map feature name). An N×N initial matrix is ​​constructed using the feature encoding as row or column index. The initial matrix is ​​used to store the sensitive correlation strength between features, and the initial value of each element is 0. N is the total number of features. Based on historical pediatric medical data within a preset time period, the number of times any two features appear simultaneously in the same data record is counted. The ratio of this number to the total number of historical data records is used as the co-occurrence frequency and updated to the corresponding position in the initial matrix to form an association matrix. Multiply the basic sensitivity weight of the features (such as preset values: 0.8-1.0 for direct identification class, 0.4-0.7 for indirect association class, and 0.1-0.3 for low sensitivity class) by the corresponding co-occurrence frequency to obtain the sensitivity association strength value between features, and fill it into the association matrix; According to the preset cycle (consistent with the longest validity period authorized by the guardian), the calculation of the recurrence frequency and sensitive association strength value of the newly added pediatric medical data and the update of the association matrix are carried out. The updated association matrix is ​​converted into a risk association graph, where the nodes of the risk association graph represent features and the thickness of the edges corresponds to the sensitivity association strength value.

[0026] In this embodiment, the specific rules for classifying features by sensitivity type are as follows: (1) Direct Identification Type: This refers to features that can be used alone or directly associated with the identity of pediatric patients. Disclosure of these features directly exposes the individual's identity. Specifically, this includes: The identity data includes the name, ID number, medical insurance card number, guardian's ID number, and direct contact information (mobile phone number, home address). The diagnostic data includes clear images of the patient's face (such as photos of a newborn's face) and images of wristbands with unique identification codes; The associated data includes the electronic health card ID, which is uniquely linked to the patient's identity, and the hospital's internal unique identifier (such as the inpatient number, which is strongly linked to the identity and cannot be anonymized).

[0027] (2) Indirect association type: refers to features that cannot be directly identified when existing alone, but can be used to infer the patient's identity when combined with other data, or features that are strongly associated with sensitive medical information (such as disease, genes), specifically including: The identity data includes date of birth (which, combined with region, gender, etc., can narrow down the location range) and guardian's name (not direct contact information); Gene sequence fragments (including mutation sites) in diagnostic and treatment data, location of imaging lesions and patient age / gender combination characteristics, and specific biomarkers in laboratory test results (such as rare disease-specific indicators). The mapping relationship between medication history and specific diseases in the associated data (such as medication records specific to a rare disease), and the types of diseases of relatives in family medical history (which can be used to inversely correlate the patient's genetic risk).

[0028] (3) Low-sensitivity category: refers to categories that cannot be identified by means of other data alone or in combination with other data, do not involve sensitive medical treatment links, and have extremely low privacy risks after leakage. Specifically, these include: The gender identifiers in the identity data have been anonymized (such as "male / female" rather than gender records associated with specific identities); The diagnostic data includes generic examination equipment models (such as "MRI equipment model X"), standardized diagnostic and treatment process codes (such as the generic code for "routine blood routine test"), and anonymized imaging equipment parameters (such as slice thickness and resolution, without individual patient characteristics). Non-specific timestamps in the associated data (such as "Q2 2024" instead of treatment time accurate to the day) and identifiers of common data transmission protocols between institutions (such as "HL7 standard format").

[0029] By constructing the risk association graph as described above, based on feature extraction, classification coding, and co-occurrence frequency calculation, the strength of sensitive associations between features is quantified, providing a quantitative basis for subsequent differentiated protection. At the same time, by updating the association matrix at preset periods, the risk association graph can reflect the changes in associations of newly added data in real time, ensuring continuous identification of dynamic risks. In addition, the association matrix is ​​converted into a visual graph, which intuitively presents the data association risks, facilitating the precise implementation of subsequent privacy enhancement steps and solving the problem that traditional static data classification cannot identify implicit association risks between features.

[0030] Furthermore, when classifying features by sensitivity type: If a feature belonging to the indirect association class is confirmed in historical medical data to be linked to a patient's identity through publicly available information (such as social media or public case databases), then the feature's type is upgraded from the indirect association class to the direct identification class. If the co-occurrence frequency of a feature of a low-sensitivity class exceeds a preset frequency threshold (e.g., >50%), the sensitivity type of the feature of that low-sensitivity class will be temporarily upgraded to the indirect association class until the co-occurrence frequency drops below the threshold and is restored to the low-sensitivity class.

[0031] By using the aforementioned settings for classifying features by sensitivity type, the upgrade rules for indirectly related features prevent the omission of implicit identification risks. At the same time, the temporary upgrade rules for low-sensitivity features prevent privacy leaks caused by the formation of quasi-identifiers due to feature co-occurrence. In addition, the recovery mechanism for temporary upgrades protects privacy while avoiding over-protection that could affect data availability. This solves the problem of low-risk features being upgraded to high-risk due to association but not being protected because of static classification.

[0032] Privacy enhancement steps: Reversibly desensitize identity data based on the risk association graph, perform feature obfuscation transformation on medical data, and add access constraint tags to associated data.

[0033] Privacy enhancement measures implement differentiated protection for different data types, balancing privacy protection with clinical data usability and avoiding data value loss due to over-processing.

[0034] In this embodiment, during the privacy enhancement step: The reversible desensitization includes: pseudonym replacement and partial field encryption based on the SM4 algorithm (such as encrypting only the year field in the birth date). The feature obfuscation transformation includes: compressing the feature dimensions of diagnostic and treatment data with a higher than preset correlation strength, and retaining the original dimensions of the feature dimensions of diagnostic and treatment data with a lower than preset correlation strength; The access constraint tags include: the type of authorized entity (such as a hospital or research institution), the data usage scenario (such as medical collaboration or academic research), and the access time limit.

[0035] The aforementioned privacy enhancement steps ensure that identity data, while protecting privacy, can be decrypted to recover the original information, meeting the needs of subsequent authorized scenarios. Simultaneously, feature obfuscation and transformation reduce privacy risks associated with medical data while preserving its clinical relevance and analytical value. Furthermore, access constraint tags implement refined permission control over associated data, preventing data from being used beyond its scope or expiration date, thus complying with regulations. This addresses the issues of mismatch between privacy protection measures and data types, as well as insufficient usability of protected data.

[0036] Key negotiation steps: Based on blockchain nodes, a session key pool with symmetric and asymmetric key pairs is generated with the authorization of the guardian. The two parties transmitting the data after the privacy enhancement steps are negotiated through a key exchange algorithm, and the key validity period is bound to the authorization duration.

[0037] The key negotiation process generates a key pool based on blockchain and guardian authorization, and the key validity period is bound to the authorization duration. This not only prevents the vulnerability of centralized key management, but also meets the strict compliance requirements of guardian authorization for pediatric data.

[0038] In this embodiment, the generation of the session key pool includes: The guardian submits an authorization request to the blockchain node through two-factor authentication (biometrics + authorization password). After the node verifies the request, it triggers the key generation algorithm to generate a session key pool with A (e.g., 3-5) sets of symmetric keys and B (e.g., 2-3) sets of asymmetric key pairs. The symmetric key is generated using the national cryptographic SM4 algorithm, while the asymmetric key pair is generated based on the SM2 elliptic curve cryptography algorithm. Each key pair is also assigned a unique identifier that is bound to the guardian's authorization ID and the transmission session ID.

[0039] Through the aforementioned session key pool generation process, two-factor authentication ensures the authenticity of guardian authorization and prevents the generation of unauthorized keys. Secondly, the use of national cryptographic algorithms to generate keys complies with national cryptographic standards, enhancing key security. Simultaneously, each key is bound to the guardian's authorization ID and the transmission session ID, achieving a unique association between the key and the authorized entity and transmission scenario. Furthermore, the multi-key design of the key pool meets the key requirements of different transmission scenarios (such as data encryption and signature verification), thereby solving the problems of centralized key management vulnerabilities and loss of control over authorization permissions.

[0040] In this embodiment, the key negotiation between the transmitting parties corresponding to the data processed in the privacy enhancement step using a key exchange algorithm includes: The initiator of the transmission randomly selects an asymmetric key pair from the session key pool and transmits the public key to the receiver through the blockchain node in an encrypted manner; The receiver uses its own generated temporary private key and the initiator's public key to calculate the shared key, and then uses the initiator's public key to encrypt and send back confirmation information. After the integrity is verified by the blockchain node, the sender and receiver deduce the session master key based on the shared key. Blockchain nodes generate an immutable negotiation log for the key negotiation process, which includes the key exchange time, participant identifiers, and public key fingerprints.

[0041] Through the aforementioned blockchain-based key negotiation process, the transmitting parties exchange asymmetric key pairs and derive a shared key, ensuring the confidentiality of the key negotiation (only the transmitting parties can obtain the session master key). Simultaneously, blockchain nodes generate an immutable log of the negotiation process, enabling full traceability and facilitating the determination of responsibility in case of subsequent disputes. Furthermore, the encryption and blockchain verification mechanisms of the recipient's confirmation information ensure the integrity of the negotiation process and prevent information tampering in intermediate stages. This solves the problems of key tampering and untraceable negotiation processes in traditional key exchanges.

[0042] Segmented transmission step: The large file data to be transmitted as determined in the key negotiation step is segmented for transmission. Each data segment is equipped with a check code based on a privacy protection factor, and the check code is bound to the guardian's timestamp signature.

[0043] The segment transmission process uses a privacy protection factor check code and a guardian's timestamp signature to ensure the integrity of large file transmissions, while preventing the leakage of sensitive content through verification information and preventing authorization repudiation.

[0044] In this embodiment, during the segmented transmission step: The method of transmitting large file data determined in the key negotiation step in the above steps in the form of fragmented transmission includes: splitting the large file data determined in the key negotiation step into data fragments according to a preset size threshold, and generating a unique identifier ID for each data fragment; The privacy protection factor includes a random noise value dynamically generated based on the sensitivity level of the fragmented data (determined by the quantification results of the risk association graph) (which is XORed with the child's medical visit timestamp and the guardian's authorization ID). The timestamp signature includes: a signature generated by a blockchain node pre-authorized by the guardian based on UTC standard time and obtained by signing with the guardian's private key.

[0045] By employing the refined design of the segmented transmission steps described above, data is split into fragments according to preset thresholds and unique IDs are generated, facilitating the management and retransmission of fragmented data (such as precise location of lost fragments). Simultaneously, a checksum is generated based on privacy protection factors to prevent verification information from directly exposing sensitive features of the fragmented data. Furthermore, a UTC timestamp signed with the guardian's private key ensures the time validity and authorization authenticity of the fragmented transmission, preventing unauthorized transmission or time forgery leading to abuse of permissions. This solves the problems of privacy leaks during integrity verification and the unprovable nature of transmission behavior in large-file medical data transmission.

[0046] Furthermore, when the receiver verifies the data fragment, if the checksum of the data fragment is inconsistent with the local calculation result, the timestamp signature verification fails (e.g., the signature time exceeds the authorized validity period), or the transmission interruption exceeds the preset duration (e.g., 5 minutes), the invalid data fragment is deleted while the verified timestamp signature is retained. Based on the fragment transmission status log stored in the blockchain, the receiver re-requests the transmission of the data fragment corresponding to the invalid fragment.

[0047] By employing the aforementioned verification and retransmission mechanism, invalid fragments are deleted when verification fails, reducing storage resource waste. Simultaneously, verified timestamp signatures are retained to avoid repeated verification of already passed fragments, improving retransmission efficiency. Furthermore, the fragment status log stored on the blockchain is used to re-request invalid fragments, ensuring transmission integrity. The immutability of the blockchain also guarantees the authenticity of the retransmission basis. This solves the problems of inefficient data recovery after corruption / loss and the resource consumption of invalid data during large file transmissions.

[0048] Audit trail steps: The entire transmission process in the segmented transmission steps is transmitted through an encrypted protocol (such as through the national cryptographic SSL protocol), and the operation log is stored on the blockchain, and transmission event notifications are pushed to the guardian in real time.

[0049] The audit trail process achieves full traceability of transmission through encrypted transmission, blockchain evidence storage, and real-time notifications, satisfying the regulatory and guardians' right to know the flow of data.

[0050] This embodiment provides a second aspect as follows: Figure 2 The big data digital signature system shown applies the secure transmission method for medical data as described above. The system includes: The signature preprocessing module is configured to: receive pediatric medical data, and split the received pediatric medical data into data blocks through a risk association graph constructed by a hierarchical processing step. The data blocks include identity data blocks, diagnosis and treatment data blocks, and association data blocks, and extract identity data and diagnosis and treatment data with privacy features. The layered signature module is configured to generate a data block signature for each split data block at the bottom layer using a batch signature algorithm and a key in the session key pool, and to aggregate the data block signatures at the top layer to form an associated signature chain. The associated signature chain includes a data association relationship encoding (corresponding to the feature association strength in the risk association graph) and a blockchain anchor (i.e., the log address stored in the audit trail step). The privacy purification module is configured to: perform reversible desensitization processing on the identity data in the associated signature chain and feature obfuscation on the medical data based on the guardian's access constraint label, leaving the hash value identifier required for signature verification; The verification module is configured to verify the integrity and authenticity of the associated signature chain processed by the privacy purification module using the aggregated public key in the asymmetric key pair (corresponding to the checksum verification logic in the segmented transmission step), and the verification logic is bound to the derivation result of the session master key in the secure transmission method of medical data. The traceability module is configured to: when a dispute arises in the verification of the associated signature chain processed by the verification module, generate an evidence chain containing the transmission session ID and guardian authorization details based on the audit log stored in the blockchain and the timestamp signature in the segmented transmission steps, and perform closed-loop verification for dispute tracing.

[0051] Leveraging the aforementioned big data digital signature system, the signature preprocessing module splits data blocks based on a risk association graph and extracts vector sets with privacy features. This deeply binds the digital signature process to the privacy attributes of pediatric medical data, ensuring that the signature not only verifies data integrity but also associates sensitive data features, thus addressing the issue of insufficient consideration for privacy features in traditional signature systems. The layered signature module generates data block signatures at the bottom layer and aggregates them at the top layer to form an associated signature chain. This ensures the authenticity of each data block through the bottom-layer signatures and preserves the logical relationships between data through the high-level associated signature chain. Simultaneously, the blockchain anchor provides a trusted index for subsequent traceability, enhancing the signature system's ability to support complex medical data relationships. The privacy purification module strips or replaces privacy features from the associated signature chain according to the guardian's audit strategy, while retaining the verification token. The system can both remove or hide sensitive information during the signing process to protect privacy and ensure that the signature chain can still be effectively verified by retaining the verification identifier, thus avoiding the problem of privacy processing compromising signature validity. The verification module verifies the validity of the processed associated signature chain by aggregating public keys, simplifying the signature verification process in multi-data-block scenarios and improving verification efficiency. At the same time, it uses the encryption properties of public keys to ensure the security of the verification process, ensuring that only authorized parties can complete effective verification. When a dispute arises during verification, the traceability module generates an evidence chain based on the audit logs in the blockchain and performs closed-loop verification. By combining the blockchain anchor points and data association encoding of the associated signature chain, it can accurately locate the disputed link and generate credible evidence, solving the problems of fragmented logs and difficult traceability in traditional systems, and meeting the compliance requirements for dispute resolution in pediatric medical data transmission.

[0052] Furthermore, the closed-loop verification for dispute tracing based on the evidence chain generated from audit logs stored in the blockchain includes the following steps: Based on the blockchain anchor point generated by the layered signature module, locate the audit log in the blockchain (i.e., the log stored in the audit trace steps), and extract the transmission session ID, guardian authorization details (with authorization ID, validity period and two-factor authentication record) and data status record (i.e. fragmented data transmission result) associated with the signature chain. Using zero-knowledge proof technology, with the timestamp in the audit log (i.e. the UTC timestamp used in the secure transmission method of medical data) and access constraint labels as input, the fragments related to the disputed points in the associated signature chain generation path (such as the signature parameters of specific data blocks and the feature stripping rules of privacy purification units) are reconstructed, and the privacy features and complete processing logic of the original data are hidden. The reconstructed fragments are bound to blockchain anchors to form a chain of evidence, and the minimum information required for verification (such as signature hash value and timestamp validity) is disclosed to regulators. This process calls the evidence storage log and key negotiation records in the blockchain to ensure that the evidence is tamper-proof.

[0053] The reconstructed evidence chain needs to be cross-verified through blockchain to ensure consistency with the privacy processing traces in the audit log (such as dynamic desensitization methods and obfuscated parameters), and the original pediatric medical data content is not called throughout the process, relying only on the signature chain and the metadata of the audit log to complete the traceability.

[0054] By employing the aforementioned closed-loop verification mechanism for dispute tracing, and using blockchain anchors to locate audit logs, the immutability of the tracing evidence is ensured. The transmission session ID, guardian authorization details, and data status records are extracted to ensure the integrity of the evidence chain. Zero-knowledge proof technology hides original privacy features when reconstructing disputed fragments, balancing tracing needs with privacy protection. The minimum necessary information is disclosed to regulators, satisfying compliance tracing while avoiding secondary privacy leaks due to excessive disclosure, consistent with the method's privacy protection goals. This addresses the problems of fragmented logs and the inability to balance privacy and tracing in existing audit systems.

[0055] Secondly, it should be noted that the big data digital signature system of this embodiment corresponds to the aforementioned secure transmission method for medical data. Therefore, for the parts of the big data digital signature system of this embodiment that are not described in detail (including but not limited to specific implementation methods, technical effects, etc.), you can refer to the relevant descriptions in the aforementioned secure transmission method for medical data. This text will not repeat them here.

[0056] In the embodiments provided by this invention, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code, or any suitable combination thereof. For hardware implementation, the processor can be implemented in one or more of the following: application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, other electronic units designed to implement the functions described herein, or combinations thereof. For software implementation, some or all of the processes of the embodiments can be performed by a computer program instructing the associated hardware. During implementation, the program can be stored in a computer-readable storage medium or transmitted as one or more instructions or code on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media can be any available medium accessible to a computer. Computer-readable storage media can include, but are not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code having the form of instructions or data structures and accessible to a computer.

[0057] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for securely transmitting medical data, characterized in that, The method includes: Layered processing steps: Pediatric medical data is divided into identity data, diagnosis and treatment data and related data according to sensitivity. A risk association graph is constructed based on a preset pediatric privacy policy. The risk association graph is used to quantify the sensitivity association strength between various data features. Privacy enhancement steps: Reversibly desensitize identity data based on the risk association graph, perform feature obfuscation transformation on medical data, and add access constraint tags to associated data; Key negotiation steps: Based on blockchain nodes, a session key pool with symmetric and asymmetric key pairs is generated with the authorization of the guardian. The two parties transmitting the data after the privacy enhancement steps are negotiated through a key exchange algorithm. The key validity period is bound to the authorization duration. Segmented transmission step: The large file data to be transmitted as determined in the key negotiation step is segmented for transmission. Each data segment is equipped with a check code based on a privacy protection factor, and the check code is bound to the guardian's timestamp signature. Audit trail steps: The entire transmission process in the segmented transmission steps is transmitted using an encrypted protocol, and the operation log is stored on the blockchain. Transmission event notifications are also pushed to the guardian in real time.

2. The secure transmission method for medical data according to claim 1, characterized in that, The risk association map is constructed through the following steps: Extract personal identification features from identity data, extract clinical features from medical data, and extract association features from related data; The extracted features are classified according to their sensitivity type, which includes direct identification type, indirect association type and low sensitivity type, and each type of feature is uniquely encoded and assigned a basic sensitivity weight; An N×N initial matrix is ​​constructed using the feature encoding as row or column index. The initial matrix is ​​used to store the sensitive correlation strength between features, and the initial value of each element is 0. N is the total number of features. Based on historical pediatric medical data within a preset time period, the number of times any two features appear simultaneously in the same data record is counted. The ratio of this number to the total number of historical data records is used as the co-occurrence frequency and updated to the corresponding position in the initial matrix to form an association matrix. Multiply the basic sensitivity weight of the feature by the corresponding co-occurrence frequency to obtain the sensitivity correlation strength value between the features, and fill it into the correlation matrix; According to the preset cycle, the calculation of the recurrence frequency and sensitive association strength values ​​of newly added pediatric medical data and the update of the association matrix are carried out. The updated association matrix is ​​converted into a risk association graph, where the nodes of the risk association graph represent features and the thickness of the edges corresponds to the sensitivity association strength value.

3. The method for secure transmission of medical data according to claim 2, characterized in that, When classifying features by sensitivity type: If a feature belonging to the indirect association class is confirmed in historical medical data to be linked to a patient's identity through publicly available information, then the type of that feature will be upgraded from the indirect association class to the direct identification class. If the co-occurrence frequency of a feature of a low-sensitivity class exceeds a preset frequency threshold, the sensitivity type of the feature of that low-sensitivity class will be temporarily upgraded to the indirect association class until the co-occurrence frequency drops below the threshold and is restored to the low-sensitivity class.

4. The secure transmission method for medical data according to claim 1, characterized in that, In the privacy enhancement steps: The reversible desensitization includes: pseudonym replacement and local field encryption based on the SM4 algorithm; The feature obfuscation transformation includes: compressing the feature dimensions of diagnostic and treatment data with a higher than preset correlation strength, and retaining the original dimensions of the feature dimensions of diagnostic and treatment data with a lower than preset correlation strength; The access constraint tags include: authorized subject type, data usage scenario, and access time limit.

5. The method for secure transmission of medical data according to claim 1, characterized in that, The generation of the session key pool includes: The guardian submits an authorization request to the blockchain node through two-factor authentication. After the node verifies the request, it triggers the key generation algorithm to generate a session key pool with a symmetric key pair (A) and an asymmetric key pair (B). The symmetric key is generated using the national cryptographic SM4 algorithm, while the asymmetric key pair is generated based on the SM2 elliptic curve cryptography algorithm. Each key pair is also assigned a unique identifier that is bound to the guardian's authorization ID and the transmission session ID.

6. The method for secure transmission of medical data according to claim 1, characterized in that, The key negotiation between the transmitting parties for the data corresponding to the privacy enhancement step, using a key exchange algorithm, includes: The initiator of the transmission randomly selects an asymmetric key pair from the session key pool and transmits the public key to the receiver through the blockchain node in an encrypted manner; The receiver uses its own generated temporary private key and the initiator's public key to calculate the shared key, and then uses the initiator's public key to encrypt and send back confirmation information. After the integrity is verified by the blockchain node, the sender and receiver deduce the session master key based on the shared key. Blockchain nodes generate an immutable negotiation log for the key negotiation process, which includes the key exchange time, participant identifiers, and public key fingerprints.

7. The secure transmission method for medical data according to claim 1, characterized in that, In the segmented transmission step: The method of transmitting large file data determined in the key negotiation step in the above steps in the form of fragmented transmission includes: splitting the large file data determined in the key negotiation step into data fragments according to a preset size threshold, and generating a unique identifier ID for each data fragment; The privacy protection factor includes a random noise value dynamically generated based on the sensitivity level of the fragmented data; The timestamp signature includes: a signature generated by a blockchain node pre-authorized by the guardian based on UTC standard time and obtained by signing with the guardian's private key.

8. The method for secure transmission of medical data according to claim 7, characterized in that, In the segmented transmission step, when the receiver verifies, if the checksum of the data fragment is inconsistent with the local calculation result, the timestamp signature verification fails, or the transmission interruption exceeds the preset duration, the invalid data fragment is deleted and the verified timestamp signature is retained. Based on the fragmented transmission status log stored in the blockchain, the receiver re-requests the transmission of the data fragment corresponding to the invalid fragment.

9. A big data digital signature system applying the secure transmission method for medical data as described in any one of claims 1-8, characterized in that, The system includes: The signature preprocessing module is configured to: receive pediatric medical data, split the data into blocks based on the constructed risk association graph, the data blocks including identity data blocks, diagnosis and treatment data blocks and association data blocks, and extract identity data and diagnosis and treatment data with privacy features; The layered signature module is configured to generate a data block signature for each split data block at the bottom layer using a batch signature algorithm and keys from the session key pool, and to aggregate the data block signatures at the top layer to form an associated signature chain, wherein the associated signature chain includes data association relationship encoding and blockchain anchors; The privacy purification module is configured to: perform reversible desensitization processing on the identity data in the associated signature chain and feature obfuscation on the medical data based on the guardian's access constraint tags, while retaining the verification identifier; The verification module is configured to verify the integrity and authenticity of the associated signature chain processed by the privacy sanitization module using the aggregated public key in the asymmetric key pair. The traceability module is configured to: when a dispute arises in the verification of the associated signature chain processed by the verification module, generate an evidence chain based on the audit logs stored in the blockchain to perform closed-loop verification for tracing the source of the dispute.

10. The big data digital signature system according to claim 9, characterized in that, The closed-loop verification method for tracing disputes based on evidence chains generated from audit logs stored in the blockchain includes the following steps: Based on the blockchain anchor point generated by the layered signature module, the audit log in the blockchain is located, and the transmission session ID, guardian authorization details and data status records associated with the signature chain are extracted. Using zero-knowledge proof technology, with timestamps and access constraint tags in audit logs as input, the fragments related to the disputed points in the associated signature chain generation path are reconstructed, while hiding the privacy features and complete processing logic of the original data; The reconstructed fragments are bound to blockchain anchors to form a chain of evidence, and the minimum information required for verification is disclosed to regulators.

Images