LIMS original record digital storage tamper-proof method based on block chain evidence storage

Abstract

The invention relates to the technical field of data security, in particular to an LIMS original record digital storage tamper-proof method based on block chain evidence storage. The method comprises the steps that under the condition that the interval between the closing moment of a write-in process corresponding to a target file and the last load write-in moment of the target file is smaller than an interval threshold value, the data loss amount is determined according to the write-in interruption interval and the reference write-in rate of the target file, and the target file is a file used for storing experimental data generated by the LIMS; performing process exception analysis according to the data loss amount to obtain an analysis result; and under the condition that the analysis result indicates that the write-in process of the target file is abnormally terminated, constructing an exception log based on the data loss amount, the write-in interruption interval of the target file and the closing moment of the write-in process corresponding to the target file, and uploading hash data corresponding to the exception log to a preset block chain. According to the invention, the supervision effect on the experiment data generated by the LIMS can be improved.

Description

Technical Field

[0001] This invention relates to the technical field of data security, and specifically to a method for preventing tampering in the digital storage of LIMS original records based on blockchain evidence. Background Technology

[0002] In regulated industries such as pharmaceuticals, chemicals, and third-party testing, ensuring the integrity of laboratory information management system (LIMS) data is crucial for compliance audits. Laboratory data generated by analytical instruments (such as chromatographs and mass spectrometers) is typically cached by the workstation operating system before being written to disk.

[0003] Under the existing compliance and regulatory system, relying solely on the application software's own logging function (ApplicationLogs) is insufficient to detect violations such as the deliberate destruction of unqualified results. For example, when researchers interrupt data acquisition by means of operating system-level methods (such as using Task Manager to forcibly terminate the experimental data acquisition process, directly unplugging the power supply of the experimental instrument, or forcibly shutting down the power supply of the experimental instrument), the application software process is terminated instantly, making it impossible to execute the log writing logic, resulting in the violation being completely hidden in the application layer logs.

[0004] In other words, existing technologies are not very effective at monitoring experimental data generated by LIMS. Summary of the Invention

[0005] The purpose of this invention is to provide a tamper-proof method for digital storage of original LIMS records based on blockchain evidence, which solves the technical problem of poor monitoring effect of experimental data generated by LIMS in existing technologies.

[0006] In a first aspect, the present invention provides a method for tamper-proof digital storage of LIMS original records based on blockchain evidence, the method comprising: When the write interruption interval of the target file is less than the interval threshold, the amount of data loss is determined based on the write interruption interval of the target file and the baseline write rate. The target file is a file used to store experimental data produced by LIMS. The write interruption interval of the target file indicates the interval between the closing time of the write process corresponding to the target file and the last load write time of the target file. The baseline write rate of the target file is used to characterize the file write rate of the experimental data corresponding to the target file under ideal experimental conditions. Based on the amount of data loss, process anomaly analysis is performed to obtain the analysis results; If the analysis results indicate that the writing process of the target file terminates abnormally, an abnormal log is constructed based on the amount of data loss, the writing interruption interval of the target file, and the closing time of the corresponding writing process of the target file, and the hash data corresponding to the abnormal log is uploaded to a preset blockchain.

[0007] In some embodiments, the step of obtaining the baseline write rate of the target file includes: Before the write process corresponding to the target file is closed, obtain the load write rate of the target file at each load write moment; The target file's write rate at each load write time is analyzed to determine the baseline write rate of the target file.

[0008] In some embodiments, the step of obtaining the load write rate of the target file at each load write moment before the write process corresponding to the target file is closed includes: Before the writing process corresponding to the target file is closed, the total amount of load data written to the target file within the monitoring time window corresponding to each load writing moment is counted to obtain the total write load corresponding to each load writing moment. Calculate the ratio of the total write load at each write time point to the width of its corresponding monitoring time window to obtain the write load rate of the target file at each write time point.

[0009] In some embodiments, the step of calculating the total amount of load data written to the target file within the monitoring time window corresponding to each load write moment, and obtaining the total write load corresponding to each load write moment, includes: Within the monitoring time window corresponding to each load write moment, the data volume of multiple load data written to the target file is weighted and calculated to obtain the total write load corresponding to each load write moment. The calculation weight corresponding to the load data written to the target file is negatively correlated with its corresponding time domain distance, which indicates the distance between the time when the corresponding load data is written to the target file and the end time of the corresponding monitoring time window.

[0010] In some embodiments, the step of analyzing the load write rate of the target file at each load write moment to determine the baseline write rate of the target file includes: The fluctuation of the load write rate corresponding to multiple load write moments included in the set time window is analyzed to obtain the rate fluctuation value. The set time window is a time window that traces back a set duration from the current moment. If the rate fluctuation value is less than the fluctuation threshold, calculate the average value of the load write rate corresponding to multiple load write moments included in the set time window to obtain the average write rate. If the average write rate is greater than the rate threshold, the average write rate is determined as the baseline write rate for the target file.

[0011] In some embodiments, the step of performing process anomaly analysis based on the amount of data loss to obtain analysis results includes: The amount of data loss is compared with the loss tolerance threshold to obtain the data loss factor; Analyze the alignment of the target file's storage space to obtain alignment feature factors; Analyze the difference between the final payload content written to the target file and the standard termination content to determine the termination characteristic factor, wherein the standard termination content is the termination content when the corresponding writing process of the target file is normally closed. The analysis results are determined based on the data loss factor, alignment feature factor, and termination feature factor.

[0012] In some embodiments, the step of analyzing the alignment degree of the file storage space of the target file to obtain the alignment feature factor includes: The alignment between the physical storage size of the target file and the memory page size of the corresponding operating system is analyzed to obtain the first alignment feature; The alignment between the physical storage size of the target file and the disk sector size of the corresponding operating system is analyzed to obtain the second alignment feature; The alignment feature factor is obtained based on the first alignment feature and the second alignment feature.

[0013] In some embodiments, the step of analyzing the difference between the payload content finally written to the target file and the standard termination content to determine the termination characteristic factor includes: If the size of the payload content finally written to the target file matches the size range indicated by the standard closing content, a termination characteristic factor is generated to indicate that the writing process of the target file is normally closed. If the size of the payload content written to the target file at the end does not match the size range indicated by the standard closing content, a termination characteristic factor is generated to indicate that the corresponding writing process of the target file has an abnormal closing.

[0014] In some embodiments, the step of analyzing the difference between the payload content finally written to the target file and the standard termination content to determine the termination characteristic factor includes: If the payload content written to the target file is the same as the standard termination content, a termination characteristic factor is generated to indicate that the corresponding writing process of the target file has terminated normally. If the payload content written to the target file at the end is different from the standard termination content, a termination characteristic factor is generated to indicate that the corresponding write process of the target file has terminated abnormally.

[0015] In some embodiments, the closing time of the writing process corresponding to the target file is determined based on a target clock, and any load writing time of the target file is determined based on the target clock, wherein the target clock is a clock with anti-administrator tampering characteristics.

[0016] Secondly, another embodiment of the present invention provides a tamper-proof system for digitized storage of LIMS original records based on blockchain evidence storage, the system comprising: The data loss monitoring module is used to determine the amount of data loss when the write interruption interval of the target file is less than the interval threshold, based on the write interruption interval of the target file and the baseline write rate. The target file is a file used to store experimental data produced by LIMS. The write interruption interval of the target file indicates the interval between the closing time of the write process corresponding to the target file and the last load write time of the target file. The baseline write rate of the target file is used to characterize the file write rate of the experimental data corresponding to the target file under ideal experimental conditions. The process analysis module is used to perform process anomaly analysis based on the amount of data loss and obtain the analysis results. The on-chain module is used to construct an exception log based on the amount of data loss, the write interruption interval of the target file, and the closing time of the corresponding write process of the target file when the analysis result indicates that the write process of the target file has terminated abnormally, and upload the hash data corresponding to the exception log to the preset blockchain.

[0017] Thirdly, in another embodiment of the present invention, an electronic device is provided, including a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method described in the first aspect.

[0018] Fourthly, in another embodiment of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0019] The present invention has the following beneficial effects: When the closing of the write process corresponding to the target file is detected, the interval between the process closing time and the last load write time of the target file is statistically analyzed. Combined with the pre-acquired baseline write rate, the amount of load data that was not written normally before the process closing instruction was triggered is estimated. Based on this, process anomaly analysis is performed to identify whether the termination behavior of the target file's write process is a normal termination behavior or an abnormal termination behavior. If the process is determined to be abnormally terminated, an anomaly log is formed by combining the estimated data loss amount with the data indicating the occurrence time of the corresponding termination behavior. This log is then hashed to obtain the corresponding hash data, which is subsequently recorded into the blockchain. By leveraging the immutability of the blockchain and the high sensitivity of the hash algorithm to the content of the anomaly log, an anti-counterfeiting mark is implemented for the anomaly log. Based on the setting of this anti-counterfeiting mark, it can help reviewers quickly identify possible violations and improve the supervision effect of experimental data generated by LIMS. Attached Figure Description

[0020] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating a method for preventing tampering in the digital storage of LIMS original records based on blockchain evidence, provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of a blockchain-based LIMS original record digital storage anti-tampering system provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0022] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a blockchain-based LIMS original record digital storage anti-tampering method proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0023] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0024] The following description, in conjunction with the accompanying drawings, details the specific scheme of the LIMS original record digitization and anti-tampering method provided by the present invention.

[0025] In one embodiment, the present invention provides a method for tamper-proof digital storage of LIMS original records based on blockchain evidence, such as... Figure 1 As shown, the method includes: Step S1: If the write interruption interval of the target file is less than the interval threshold, determine the amount of data loss based on the write interruption interval of the target file and the baseline write rate.

[0026] The target file is a file used to store experimental data generated by the Laboratory Information Management System (LIMS). The write interruption interval of the target file indicates the interval between the closing time of the corresponding write process of the target file and the last load write time of the target file. The baseline write rate of the target file is used to characterize the file write rate of the experimental data corresponding to the target file under ideal experimental conditions.

[0027] To simplify the initial setup for users tracking target files, a whitelist can be maintained to automatically identify target files in the corresponding operating system, thus achieving adaptive identification of target files.

[0028] Based on the above settings, users only need to maintain the whitelist when applying this solution, without having to manually identify each file used to store experimental data generated by the Laboratory Information Management System (LIMS) and configure the storage path of each file one by one. This greatly facilitates the application of this solution by users.

[0029] Specifically, the process for maintaining and applying the whitelist is as follows: Maintain a whitelist that records file extensions to screen several files suspected of being target files. The file extensions mentioned above include, but are not limited to, ".raw", ".dat", and ".lcd". The whitelist can be adaptively adjusted according to the file extensions of data storage files supported by the LIMS vendor.

[0030] Subsequently, the file system filter driver is used to intercept requests. When an IRP_MJ_CREATE or IRP_MJ_OPEN request is intercepted, the path and extension of the file indicated by the request are parsed. If the parsed extension matches the whitelist and the open intent contains "write permission", the relevant request for the target file is identified, and the corresponding abnormal monitoring process is started (abnormal monitoring of the writing process of the target file is enabled).

[0031] It should be noted that in practical applications, there may be one or multiple target files corresponding to the laboratory information management system.

[0032] Additionally, the laboratory information management system will initiate a writing process corresponding to the target file to continuously write the experimental data generated in real time into the target file.

[0033] In one example, the baseline write rate can be determined by analyzing the average of multiple write rates for the corresponding file extension in the historical data under the corresponding experiment.

[0034] In some implementations, the step of obtaining the baseline write rate of the target file includes: Before the write process corresponding to the target file is closed, obtain the load write rate of the target file at each load write moment; The target file's write rate at each load write time is analyzed to determine the baseline write rate of the target file.

[0035] Based on the above settings, the corresponding baseline write rate is dynamically determined by combining the actual write load of the target file. This allows the determined baseline write rate to more accurately reflect the file write rate of the target file under ideal experimental conditions.

[0036] Specifically, the steps of obtaining the load write rate of the target file at each load write moment before the write process corresponding to the target file is closed include: Before the writing process corresponding to the target file is closed, the total amount of load data written to the target file within the monitoring time window corresponding to each load writing moment is counted to obtain the total write load corresponding to each load writing moment. Calculate the ratio of the total write load at each write time point to the width of its corresponding monitoring time window to obtain the write load rate of the target file at each write time point.

[0037] In this invention, the monitoring time window width is the same for different load write times, and each load write time is the end time of its corresponding monitoring time window. For example, the monitoring time window width can be set to 3 seconds or 5 seconds (to ensure that the window width can cover 3-5 typical I / O cycles).

[0038] Based on the above-mentioned monitoring time window setting, the influence of extreme values ​​caused by noise can be effectively suppressed, making the determined load write rate more accurate and reliable.

[0039] Furthermore, the step of calculating the total amount of write load data to the target file within the monitoring time window corresponding to each load write moment, and obtaining the total write load corresponding to each load write moment, includes: Within the monitoring time window corresponding to each load write moment, the data volume of multiple load data written to the target file is weighted and calculated to obtain the total write load corresponding to each load write moment. The calculation weight corresponding to the load data written to the target file is negatively correlated with its corresponding time domain distance, which indicates the distance between the time when the corresponding load data is written to the target file and the end time of the corresponding monitoring time window.

[0040] Based on the above settings, within the corresponding monitoring time window, a larger calculation weight is assigned to the load data collected later (that is, the shorter the time domain distance). This is to suppress noise while adaptively amplifying the influence of the load data recently written to the target file when participating in the rate calculation, so that the determined load write rate can more accurately reflect the data write rate at the corresponding load write time.

[0041] For example, the load write rate It can be represented as: in, This can be understood as a set formed by multiple load write times included in the corresponding monitoring time window. Indicates the first time within the corresponding monitoring time window The amount of data in the payload corresponding to each payload write time (also known as the total number of characters or the payload data length). The first time window corresponding to the monitoring time window The calculation weight of the load data corresponding to each load write time. This is the window width corresponding to the monitoring time window.

[0042] In this invention, the load write time should be understood as the time when load data is detected being written to the target file. Load data should be understood as data with a data volume greater than the noise floor threshold (usually experimental data), while data with a data volume less than or equal to the noise floor threshold is non-load data (such as noise data or heartbeat packets). The writing of non-load data will not be intercepted, but the writing time of non-load data will not be determined as the load write time.

[0043] In applications, determining whether the data written to the target file is payload data or non-payload data can be done based on the write status tracker object corresponding to the target file. That is, after identifying the target file, a corresponding write status tracker object is allocated and initialized in the kernel's non-paged memory pool. It is used as a kernel context container, and its lifecycle is strictly bound to the target file object. This write status tracker object can be used to record the load write rate of the target file at each load write moment, and maintain a latest baseline write rate of the target file.

[0044] The aforementioned noise floor threshold can be obtained by analyzing the data writing situation in the historical experiment process. Specifically, users can be guided to conduct a pre-experiment lasting 10-30 minutes before executing the formal experiment. The experimental content of the pre-experiment is consistent with that of the formal experiment. During the pre-experiment, the average amount of data written to the target file is calculated, and the product of this average and the preset noise coefficient (such as 0.1) is determined as the noise floor threshold.

[0045] In some embodiments, the step of analyzing the load write rate of the target file at each load write moment to determine the baseline write rate of the target file includes: The fluctuation of the load write rate corresponding to multiple load write moments included in the set time window is analyzed to obtain the rate fluctuation value. The set time window is a time window that traces back a set duration from the current moment. If the rate fluctuation value is less than the fluctuation threshold, calculate the average value of the load write rate corresponding to multiple load write moments included in the set time window to obtain the average write rate. If the average write rate is greater than the rate threshold, the average write rate is determined as the baseline write rate for the target file.

[0046] The above-mentioned duration should cover at least 3-5 typical I / O cycles to minimize the adverse effects of random noise and ensure that the statistically obtained baseline write rate accurately reflects the file write rate of the experimental data under ideal experimental conditions. In this invention, the above-mentioned duration can be 3 seconds or 5 seconds.

[0047] It should be noted that the baseline write rate of the target file is dynamically updated over time, and the baseline write rate used in subsequent processes is the rate value of the most recently updated rate.

[0048] In this invention, if the rate fluctuation value is greater than or equal to the fluctuation threshold, or if the average write rate is less than or equal to the rate threshold, the step of updating the baseline write rate will be skipped directly.

[0049] In this invention, the coefficient of variation is used to quantify the fluctuation of the load write rate corresponding to multiple load write times included in the set time window. In this case, the fluctuation threshold is set to 3 times the coefficient of variation of multiple data write rates statistically analyzed in the aforementioned pre-experiment.

[0050] In practical applications, the write rate will show a decay trend at the end of the formal experiment. To avoid the rate change during this decay phase from polluting the baseline write rate (to ensure that the baseline write rate can accurately reflect the write situation in the normal phase of the formal experiment, and thus ensure the accuracy of the data loss amount calculated later), the baseline write rate can be updated only when the absolute difference between the expected updated baseline write rate and the current baseline write rate is less than the update fluctuation threshold (specifically, the product of the baseline write rate before the update and the set fluctuation coefficient, which can be set empirically to 0.2 or 0.15). Otherwise, the update operation is terminated.

[0051] Due to natural termination of the experiment, abnormal process, or deliberate concealment of substandard experimental data, the writing process corresponding to the target file will be closed. In the case of natural termination, the experimenter usually needs to click the stop acquisition button on the experimental software (at which point the writing process stops sending data and the writing rate returns to zero), then get up to handle other tasks (such as performing the final work of the experimental instrument), and close the software window several minutes later (triggering handle release, and the writing process corresponding to the target file is terminated). Therefore, in the case of natural termination, there will be a large interval between the closing time of the software window and the last load writing time of the target file. However, in the case of abnormal process causing process crash or deliberate termination of the process, the interval between the closing time of the software window and the last load writing time of the target file is relatively short. Based on this, when the termination of the writing process corresponding to the target file is detected, this invention distinguishes between natural interruption and suspected abnormal interruption by statistically analyzing the writing interruption interval of the target file and comparing it with the interval threshold. When a suspected abnormal interruption is identified (i.e., the writing interruption interval of the target file is less than the interval threshold), the amount of data lost during the interruption is predicted based on the writing interruption interval of the target file and the baseline writing rate.

[0052] It should be understood that if the write interruption interval of the target file is greater than or equal to the interval threshold, the subsequent related processing will be skipped, and the corresponding experimental data will be marked as trustworthy data that can skip manual review.

[0053] In one example, the amount of data lost in the target file is the product of the write interruption interval of the target file and the baseline write rate.

[0054] In this invention, the process of obtaining the interval threshold is as follows: In multiple experiments in historical statistics (the experiments here are the same type of experiments as the experiments corresponding to the target file), the interval value between the interruption time of the writing process in each historical experiment and the data writing time of the last experiment is obtained, and the minimum value among the multiple interval values ​​is determined as the reference interval value. Then, the product of the reference interval value and the correction coefficient is determined as the interval threshold. The correction coefficient is an integer less than 1. In this invention, the correction coefficient is set to 0.8 based on experience.

[0055] Step S2: Perform process anomaly analysis based on the amount of data loss to obtain the analysis results.

[0056] Specifically, the steps for performing process anomaly analysis based on the data loss amount and obtaining the analysis results include: The amount of data loss is compared with the loss tolerance threshold to obtain the data loss factor; Analyze the alignment of the target file's storage space to obtain alignment feature factors; Analyze the difference between the final payload content written to the target file and the standard termination content to determine the termination characteristic factor, wherein the standard termination content is the termination content when the corresponding writing process of the target file is normally closed. The analysis results are determined based on the data loss factor, alignment feature factor, and termination feature factor.

[0057] As mentioned earlier, abnormal termination of the write process can be further subdivided into automatic process crashes caused by program execution errors and manual process termination caused by malicious concealment of substandard experimental data. However, in terms of data, both automatic process crashes and manual terminations are sudden situations that occur during the normal writing of experimental data and may lead to serious data loss. Therefore, it is necessary to combine the loss tolerance threshold to judge the data loss situation in order to identify process termination events with serious data loss problems (data loss amount is greater than the loss tolerance threshold). At the same time, in order to avoid omissions caused by coincidental events, this invention further combines the analysis of data alignment dimension and end-of-process feature dimension to comprehensively form the analysis results for the write process termination situation.

[0058] The aforementioned loss tolerance threshold can be set based on experience. In this invention, the loss tolerance threshold is set to the size of one disk sector, i.e., 512 bytes.

[0059] Specifically, the steps of analyzing the alignment degree of the target file's storage space and obtaining the alignment feature factor include: The alignment between the physical storage size of the target file and the memory page size of the corresponding operating system is analyzed to obtain the first alignment feature; The alignment between the physical storage size of the target file and the disk sector size of the corresponding operating system is analyzed to obtain the second alignment feature; The alignment feature factor is obtained based on the first alignment feature and the second alignment feature.

[0060] Analysis revealed that when the operating system kernel forcibly reclaims file objects due to process crashes or forced termination, the memory manager typically discards the remaining portion of a memory page that is cached but not yet filled, or forcibly flushes it to disk in units of memory page size.

[0061] In this embodiment, the alignment between the physical storage size of the target file and the memory page size of the corresponding operating system can be quantified by modulo operation, and the alignment between the physical storage size of the target file and the disk sector size of the corresponding operating system can also be quantified by modulo operation. That is, when the physical storage size of the target file is divisible by the memory page size of the corresponding operating system, a first alignment feature indicating that the physical storage size of the target file and the memory page size of the corresponding operating system are aligned is generated; when the physical storage size of the target file is not divisible by the memory page size of the corresponding operating system, a first alignment feature indicating that the physical storage size of the target file and the memory page size of the corresponding operating system are not aligned is generated.

[0062] Furthermore, if the physical storage size of the target file is divisible by the disk sector size of the corresponding operating system, a second alignment feature is generated indicating that the physical storage size of the target file is aligned with the disk sector size of the corresponding operating system; if the physical storage size of the target file is not divisible by the disk sector size of the corresponding operating system, a second alignment feature is generated indicating that the physical storage size of the target file is not aligned with the disk sector size of the corresponding operating system.

[0063] When the first alignment feature indicates that the physical storage size of the target file is aligned with the memory page size of the corresponding operating system, or when the second alignment feature indicates that the physical storage size of the target file is aligned with the disk sector size of the corresponding operating system, an alignment feature factor is generated that detects a forced alignment mechanism phenomenon of process killing or crashing; when the first alignment feature indicates that the physical storage size of the target file is not aligned with the memory page size of the corresponding operating system, and the second alignment feature indicates that the physical storage size of the target file is not aligned with the disk sector size of the corresponding operating system, an alignment feature factor is generated that does not detect a forced alignment mechanism phenomenon of process killing or crashing.

[0064] Analysis revealed that standard LIMS acquisition software performs standard closing actions when the acquisition process ends normally, such as writing a footer block containing checksums, sampled metadata, or a specific magic number. Therefore, when the writing process terminates normally due to the end of the experiment, the payload of the last write to the target file will match the set closing criteria in terms of data size or data content.

[0065] Based on this, in one example, the steps to analyze the difference between the final payload content written to the target file and the standard termination content, and to determine the termination characteristic factor, include: If the size of the payload content finally written to the target file matches the size range indicated by the standard closing content, a termination characteristic factor is generated to indicate that the writing process of the target file is normally closed. If the size of the payload content written to the target file at the end does not match the size range indicated by the standard closing content, a termination characteristic factor is generated to indicate that the corresponding writing process of the target file has an abnormal closing.

[0066] Alternatively, in another example, the steps of analyzing the difference between the final payload content written to the target file and the standard termination content to determine the termination characteristic factor include: If the payload content written to the target file is the same as the standard termination content, a termination characteristic factor is generated to indicate that the corresponding writing process of the target file has terminated normally. If the payload content written to the target file at the end is different from the standard termination content, a termination characteristic factor is generated to indicate that the corresponding write process of the target file has terminated abnormally.

[0067] The aforementioned standard closing content can be adaptively determined based on the closing rules of the corresponding LIMS. For example, the size range indicated by the standard closing content can be a range of 0-1024 bytes, or the standard closing content can be a predefined hexadecimal sequence.

[0068] In applications, the two examples above can also be combined. In this case, a termination feature factor indicating abnormal termination of the writing process corresponding to the target file is generated only when the size of the data content of the last written target file does not match the size range indicated by the standard termination content, or when the data content of the last written target file is different from the standard termination content. Otherwise, a termination feature factor indicating normal termination of the writing process corresponding to the target file is generated.

[0069] In this invention, a score accumulation method is used to form the corresponding analysis results. Specifically, when the amount of data loss is greater than the loss tolerance threshold, the score corresponding to the data loss factor is 50, and when the amount of data loss is less than or equal to the loss tolerance threshold, the score corresponding to the data loss factor is 0. The score corresponding to the alignment feature factor indicating the detection of a forced alignment mechanism phenomenon of process killing or crashing is 20, and the score corresponding to the alignment feature factor indicating that no forced alignment mechanism phenomenon of process killing or crashing is detected is 0. The score corresponding to the termination feature factor indicating abnormal termination of the writing process corresponding to the target file is 30, and the score corresponding to the termination feature factor indicating normal termination of the writing process corresponding to the target file is 0.

[0070] When the sum of the scores corresponding to the data loss factor, alignment feature factor, and termination feature factor is greater than the score threshold (set to 60 in this invention based on experience), an analysis result indicating abnormal termination of the target file writing process is generated; otherwise, an analysis result indicating normal termination of the target file writing process is generated.

[0071] Based on the above settings, while ensuring the accuracy of the analysis results, this method can adapt to situations where some dimensions of the analysis results are missing or ambiguous in real-world scenarios, thereby ensuring its robustness when applied to complex scenarios.

[0072] Step S3: If the analysis result indicates that the writing process of the target file terminates abnormally, an abnormal log is constructed based on the amount of data loss, the writing interruption interval of the target file, and the closing time of the writing process corresponding to the target file, and the hash data corresponding to the abnormal log is uploaded to the preset blockchain.

[0073] It should be understood that if the analysis results indicate that the writing process of the target file has terminated normally, subsequent related processing will be skipped, and the corresponding experimental data will be marked as reliable data that can skip manual review.

[0074] Additionally, the exception log may include the hardware signature of the corresponding experimental instrument or operating system (such as the MAC address of the network card), the complete path hash of the target file, and the last payload data written to the target file.

[0075] The anomaly logs, combined with their corresponding hash data, provide reliable data support for subsequent manual review. Specifically, the hash data corresponding to the anomaly logs is used to verify the authenticity of the anomaly logs extracted by the reviewers (to prevent tampering), while the anomaly logs themselves provide data support for the verification work carried out by the reviewers.

[0076] The amount of data loss is used to illustrate the damage to the integrity of the test data record caused by the abnormal termination of the process. The interruption interval of the target file writing and the closing time of the corresponding writing process of the target file are used to provide time evidence, so as to quickly locate the identity of the person who performed the illegal operation by combining the monitoring video and access control information, or to indicate the specific time node of the program crash for subsequent backtracking analysis.

[0077] The hash data mentioned above can be obtained by processing the abnormal logs using an industrial-grade hash algorithm (such as the SHA-256 algorithm).

[0078] Specifically, when the network connection is normal, the smart contract is invoked immediately after the hash data is generated to send the generated hash data as transaction input data to the designated blockchain. After the blockchain nodes reach a consensus and confirm, a unique evidence of the transaction is formed for local archiving. However, when the network connection is interrupted, the hash data is temporarily stored in a protected local encrypted queue after it is generated. Once the network is restored, the retransmission operation is automatically executed and the corresponding evidence of the transaction is obtained.

[0079] The abnormal logs and the corresponding evidence-based transaction credentials will be jointly encrypted and written to a local hidden audit log file for auditors to use during the abnormal audit process.

[0080] In summary, when the write process corresponding to the target file is detected to be closed, this invention estimates the amount of load data that was not written normally before the process closure instruction was triggered by statistically analyzing the interval between the process closure time and the last load write time of the target file, combined with a pre-acquired baseline write rate. Based on this, process anomaly analysis is performed to identify whether the termination behavior of the target file's write process is a normal termination behavior or an abnormal termination behavior. If the process is determined to be abnormally terminated, an anomaly log is formed by combining the estimated data loss amount with the data indicating the occurrence time of the corresponding termination behavior. This log is then hashed to obtain the corresponding hash data, which is subsequently recorded into the blockchain. By utilizing the immutability of the blockchain and the high sensitivity of the hash algorithm to the content of the anomaly log, an anti-counterfeiting mark is achieved for the anomaly log. Based on the setting of this anti-counterfeiting mark, it can help reviewers quickly identify possible violations and improve the supervision effect of experimental data generated by LIMS.

[0081] During the review of process anomalies, if the reviewers find that the hash data corresponding to the anomaly log extracted from the local hidden audit log file is inconsistent with the hash data recorded on the blockchain, they can directly determine that the anomaly log has been tampered with and initiate the corresponding handling process (such as directly determining that the anomaly log and its corresponding experimental data are unreliable). Only when the hash data corresponding to the anomaly log extracted from the hidden audit log file is consistent with the hash data recorded on the blockchain will the content of the anomaly log be further analyzed, and a corresponding review report be generated (determining whether the corresponding abnormal process termination is a crash caused by a program execution error or a violation caused by a forced termination).

[0082] In some implementations, the closing time of the writing process corresponding to the target file is determined based on a target clock, and any load writing time of the target file is determined based on the target clock, which is a clock with anti-administrator tampering characteristics.

[0083] Based on the above settings, the reliability of the time information recorded in the exception log is ensured.

[0084] The target clock mentioned above can be understood as the CPU's high-precision timestamp counter (TSC) or the Trusted Platform Module (TPM) chip on the motherboard.

[0085] The anti-administrator tampering feature can be understood as: the feature that allows modification permissions to be independent of the operating system's administrator privileges.

[0086] In one embodiment, the present invention also provides a tamper-proof system for the digital storage of LIMS original records based on blockchain evidence storage, such as... Figure 2 As shown, the system includes: The data loss monitoring module 201 is used to determine the amount of data loss based on the write interruption interval of the target file and the baseline write rate when the write interruption interval of the target file is less than the interval threshold. The target file is a file used to store experimental data produced by LIMS. The write interruption interval of the target file indicates the interval between the closing time of the write process corresponding to the target file and the last load write time of the target file. The baseline write rate of the target file is used to characterize the file write rate of the experimental data corresponding to the target file under ideal experimental conditions. Process analysis module 202 is used to perform process anomaly analysis based on the amount of data loss and obtain analysis results; The on-chain module 203 is used to construct an exception log based on the amount of data loss, the write interruption interval of the target file, and the closing time of the corresponding write process of the target file when the analysis result indicates that the write process of the target file terminates abnormally, and upload the hash data corresponding to the exception log to a preset blockchain.

[0087] It should be noted that the system provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device can be divided into different functional modules to complete all or part of the functions described above. In addition, the LIMS original record digitization anti-tampering system based on blockchain evidence and the LIMS original record digitization anti-tampering method based on blockchain evidence provided in the above embodiments belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0088] This invention also provides an electronic device. Please refer to [link to relevant documentation]. Figure 3 The electronic device may include a processor 301, a memory 302, and a program 3021 stored in the memory 302 and capable of running on the processor 301.

[0089] When program 3021 is executed by processor 301, it can achieve the following: Figure 1 Any steps in the corresponding method embodiments and the achievement of the same beneficial effects will not be repeated here.

[0090] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by hardware related to program instructions, and the program can be stored in a readable medium.

[0091] This invention also provides a readable storage medium storing a computer program, which, when executed by a processor, can perform the above-described functions. Figure 1 Any step in the corresponding method embodiment can achieve the same technical effect, and will not be repeated here to avoid repetition.

[0092] The computer-readable storage medium of this invention can be any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. For example, a computer-readable storage medium can be an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0093] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0094] The program code contained on the storage medium can be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0095] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or terminal. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0096] This invention also provides a computer program product that, when run on a computer, causes the computer to perform the aforementioned steps to achieve the tamper-proof method for digitized storage of LIMS original records based on blockchain evidence provided in the above embodiments.

[0097] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0098] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A method for tamper-proof digital storage of LIMS original records based on blockchain evidence, characterized in that, The method includes: When the write interruption interval of the target file is less than the interval threshold, the amount of data loss is determined based on the write interruption interval of the target file and the baseline write rate. The target file is a file used to store experimental data produced by LIMS. The write interruption interval of the target file indicates the interval between the closing time of the write process corresponding to the target file and the last load write time of the target file. The baseline write rate of the target file is used to characterize the file write rate of the experimental data corresponding to the target file under ideal experimental conditions. Based on the amount of data loss, process anomaly analysis is performed to obtain the analysis results; If the analysis results indicate that the writing process of the target file terminates abnormally, an abnormal log is constructed based on the amount of data loss, the writing interruption interval of the target file, and the closing time of the corresponding writing process of the target file, and the hash data corresponding to the abnormal log is uploaded to a preset blockchain.

2. The method for tamper-proof digital storage of LIMS original records based on blockchain evidence storage according to claim 1, characterized in that, The steps for obtaining the baseline write rate of the target file include: Before the write process corresponding to the target file is closed, obtain the load write rate of the target file at each load write moment; The target file's write rate at each load write time is analyzed to determine the baseline write rate of the target file.

3. The method for tamper-proof digital storage of LIMS original records based on blockchain evidence storage according to claim 2, characterized in that, Before the write process corresponding to the target file is closed, the steps to obtain the load write rate of the target file at each load write moment include: Before the writing process corresponding to the target file is closed, the total amount of load data written to the target file within the monitoring time window corresponding to each load writing moment is counted to obtain the total write load corresponding to each load writing moment. Calculate the ratio of the total write load at each write time point to the width of its corresponding monitoring time window to obtain the write load rate of the target file at each write time point.

4. The method for tamper-proof digital storage of LIMS original records based on blockchain evidence storage according to claim 3, characterized in that, Within the monitoring time window corresponding to each load write moment, the steps for calculating the total amount of load data written to the target file and obtaining the total write load for each load write moment include: Within the monitoring time window corresponding to each load write moment, the data volume of multiple load data written to the target file is weighted and calculated to obtain the total write load corresponding to each load write moment. The calculation weight corresponding to the load data written to the target file is negatively correlated with its corresponding time domain distance, which indicates the distance between the time when the corresponding load data is written to the target file and the end time of the corresponding monitoring time window.

5. The method for tamper-proof digital storage of LIMS original records based on blockchain evidence storage according to claim 2, characterized in that, The steps for analyzing the load write rate of the target file at each load write time to determine the baseline write rate of the target file include: The fluctuation of the load write rate corresponding to multiple load write moments included in the set time window is analyzed to obtain the rate fluctuation value. The set time window is a time window that traces back a set duration from the current moment. If the rate fluctuation value is less than the fluctuation threshold, calculate the average value of the load write rate corresponding to multiple load write moments included in the set time window to obtain the average write rate. If the average write rate is greater than the rate threshold, the average write rate is determined as the baseline write rate for the target file.

6. The method for tamper-proof digital storage of LIMS original records based on blockchain evidence storage according to claim 1, characterized in that, The steps for performing process anomaly analysis based on the data loss amount and obtaining the analysis results include: The amount of data loss is compared with the loss tolerance threshold to obtain the data loss factor; Analyze the alignment of the target file's storage space to obtain alignment feature factors; Analyze the difference between the final payload content written to the target file and the standard termination content to determine the termination characteristic factor, wherein the standard termination content is the termination content when the corresponding writing process of the target file is normally closed. The analysis results are determined based on the data loss factor, alignment feature factor, and termination feature factor.

7. The method for tamper-proof digital storage of LIMS original records based on blockchain evidence as described in claim 6, characterized in that, The steps for analyzing the alignment of the target file's storage space and obtaining alignment feature factors include: The alignment between the physical storage size of the target file and the memory page size of the corresponding operating system is analyzed to obtain the first alignment feature; The alignment between the physical storage size of the target file and the disk sector size of the corresponding operating system is analyzed to obtain the second alignment feature; The alignment feature factor is obtained based on the first alignment feature and the second alignment feature.

8. The method for tamper-proof digital storage of LIMS original records based on blockchain evidence as described in claim 6, characterized in that, The steps for analyzing the difference between the final payload content written to the target file and the standard termination content to determine the termination characteristic factor include: If the size of the payload content finally written to the target file matches the size range indicated by the standard closing content, a termination characteristic factor is generated to indicate that the writing process of the target file is normally closed. If the size of the payload content written to the target file at the end does not match the size range indicated by the standard closing content, a termination characteristic factor is generated to indicate that the corresponding writing process of the target file has an abnormal closing.

9. The method for tamper-proof digital storage of LIMS original records based on blockchain evidence as described in claim 6, characterized in that, The steps for analyzing the difference between the final payload content written to the target file and the standard termination content to determine the termination characteristic factor include: If the payload content written to the target file is the same as the standard termination content, a termination characteristic factor is generated to indicate that the corresponding writing process of the target file has terminated normally. If the payload content written to the target file at the end is different from the standard termination content, a termination characteristic factor is generated to indicate that the corresponding write process of the target file has terminated abnormally.

10. The method for tamper-proof digital storage of LIMS original records based on blockchain evidence storage according to claim 1, characterized in that, The closing time of the writing process corresponding to the target file is determined based on the target clock, and any load writing time of the target file is determined based on the target clock, which is a clock with anti-administrator tampering characteristics.

Images