A privacy protection system and method for paper medical report shooting and identification

Abstract

This invention relates to a privacy protection system and method for image capture and recognition of paper medical reports. The system is divided into a TEE (Technical Equipment Environment) world and a normal world. The normal world includes a user-operated mobile terminal application, camera driver, and operating system / storage module, responsible for user interaction and hardware control. The TEE world includes a TEE-internal control module, a secure camera data management module, a secure image buffer, an OCR recognition and privacy processing module, a secure encryption module, and a secure upload module, responsible for data protection throughout the entire process from image acquisition to text recognition. The normal world and the TEE world interact through a secure interface, ensuring that the normal world can only call predefined secure services and cannot directly access plaintext image data. Compared with existing technologies, this invention has the advantage of ensuring that data remains securely protected throughout the entire process from image data acquisition to OCR recognition.

Description

Technical Field

[0001] This invention relates to the field of medical data privacy protection technology, and in particular to a privacy protection system and method for photographing and recognizing paper medical reports. Background Technology

[0002] In modern medical applications, patient data is scattered across different hospitals, and data silos exist between hospitals. Therefore, patients often struggle to find a unified system or platform to manage their complete medical data. Helping patients manage their own medical data is therefore crucial. A vital process involves patients photographing paper reports and using Optical Character Recognition (OCR) technology to intelligently identify and collect information from the reports. Because the medical data involved (such as diagnostic reports and test results) is highly sensitive, malicious theft or leakage during data collection by operating systems, driver software, or other privileged applications could seriously infringe on patient privacy and even affect the credibility of medical data and the accuracy of medical decisions. Currently, although mobile systems possess various security technologies—for example, Chinese patent CN113223654A discloses an intelligent interpretation and management platform and method for medical test reports—the data sent by the mobile terminal to the first intermediate server is encrypted medical data and a terminal identifier. Therefore, even if the first intermediate server identifies the user based on the terminal identifier, it cannot obtain the user's medical condition. Furthermore, the first intermediate server determines the corresponding first intermediate identifier based on the terminal identifier and sends the first intermediate identifier and encrypted medical data to the data interpretation server. Therefore, even if the data interpretation server decrypts the plaintext medical data, it cannot determine the user's identity based on the first intermediate identifier. Moreover, in the report image corresponding to the plaintext medical data, the name area is covered by a solid color, so the data interpretation server cannot determine the user's identity based on the report image either. However, this method only addresses privacy during data transmission and cannot protect the privacy of I / O devices such as cameras. Summary of the Invention

[0003] The purpose of this invention is to provide a privacy protection system and method for photographing and recognizing paper medical reports. It utilizes a Trusted Execution Environment (TEE) to protect the data privacy during the acquisition of paper medical reports, ensuring that the data is always under secure protection throughout the entire process from image data acquisition to OCR recognition. Even if the system layer or driver layer is compromised, sensitive medical image data cannot be stolen or tampered with.

[0004] The objective of this invention can be achieved through the following technical solutions: A privacy protection system for photographing and recognizing paper medical reports is disclosed. The system is divided into a TEE (Technical Equipment Environment) world and a normal world. In the normal world, a user-interactive mobile terminal application, camera driver, and operating system / storage module are included, responsible for user interaction and hardware control for photographing paper medical reports. In the TEE world, a TEE-internal control module, a secure camera data management module, a secure image buffer, an OCR recognition and privacy processing module, a secure encryption module, and a secure upload module are included, responsible for data protection throughout the entire process from image acquisition to text recognition. The TEE-internal control module controls all modules within the TEE world. The full-camera data management module sends commands to the camera driver in the ordinary world to control the camera to start shooting and direct the image output to the secure image buffer. The OCR recognition and privacy processing module reads the image from the secure image buffer, recognizes the text in the image, and extracts the text of the paper medical report. The security encryption module encrypts the extracted paper medical report text and sends it to the operating system / storage module in the ordinary world through the secure upload module for data users. The ordinary world and the TEE world interact through a secure interface to ensure that the ordinary world can only call predefined security services and cannot directly access the plaintext image data.

[0005] The TEE internal control module performs the following steps: Request parsing and scheduling: Based on the photo-taking requests from the ordinary world, the type of user request is identified and the corresponding internal process is selected. For photo OCR requests, the TEE control module sequentially calls the secure camera data management module, the OCR recognition and privacy processing module, the security encryption module, and the secure upload module, executing them in the predetermined process order. State Management: By maintaining a state machine, the state of each request is tracked during execution. The state machine only triggers the next stage after the previous stage is successful. If an error occurs in the middle, the control module in the TEE is responsible for safely terminating the process and returning an error status to the caller without leaking any part of the processed data. Security context maintenance: When calling the security camera data management module, the TEE control module controls the location of the image output buffer by allocating permissions for the security image buffer; when calling the OCR recognition and privacy processing module, the TEE control module only grants the OCR recognition and privacy processing module read-only access to the security image buffer, thereby limiting the permissions of each module to the necessary range.

[0006] The security camera data management module performs the following steps: Secure Image Buffer Configuration: When a photo-taking OCR request is received, the secure camera data management module allocates a secure image buffer in secure memory to store the image based on the permissions of the secure image buffer assigned by the control module within the TEE, and prepares the physical address / handle of the secure image buffer. Subsequently, the physical address / handle of the secure image buffer is sent to the camera driver in the ordinary world through a secure call mechanism. The camera driver will only output the image captured by the camera to the corresponding buffer when it receives a call from the TEE world with a valid secure image buffer physical address / handle. Synchronization and Notification: After the data acquisition begins under command, the security camera data management module uses TrustZone's notification mechanism to either block and wait or asynchronously listen for events indicating that the acquisition is complete.

[0007] The secure camera data management module also performs data transfer protection: during the use of the secure image buffer, it locks the access permissions of the secure image buffer to prevent the ordinary world from attempting to remap the memory; after the frame acquisition end signal is issued, it checks the data integrity of the secure image buffer to confirm that the ordinary driver has not tampered with or injected forged data.

[0008] The secure image buffer is located in a secure memory area defined by TrustZone. Arm TrustZone's memory control mechanism is used to mark the corresponding memory as belonging to the TEE world. A buffer handle or descriptor is set, and the reference to the buffer is passed to the secure camera data management module and the normal driver through interface functions, so as to enable referencing the memory corresponding to the secure image buffer between the TEE world and the normal world. Whenever the OCR finishes processing a frame of image, the control module in the TEE clears or re-encrypts and overwrites the secure image buffer. When the secure image buffer is not in use, the control module in the TEE reclaims or further protects the secure image buffer, and it is only re-enabled and given driver access permissions during the next shooting.

[0009] The secure image buffer uses fragmentation or streaming processing to reduce peak memory usage.

[0010] The OCR recognition and privacy processing module performs the following steps: OCR Recognition: By using a lightweight OCR algorithm model built into the module or loaded, text recognition is performed on the image in the secure image buffer. The lightweight OCR algorithm model is stored in the TEE secure storage in read-only data form. During the recognition process, the OCR recognition and privacy processing module calls the basic library functions in the TEE world to read pixels line by line from the secure buffer, perform layout analysis, character segmentation and recognition, and obtain the paper medical report text. Sensitive content detection and encapsulation: The module uses built-in regular expressions or keyword lists to scan and mark the identified paper medical report text. Based on the scan marks, an encryption strategy is determined to encrypt sensitive content. During encapsulation, the OCR recognition and privacy processing module organizes the recognition results into a structured data format, labels each paragraph with its sensitivity level, and completes the encapsulation.

[0011] The security encryption module uses the key stored within the TEE world to call the encryption algorithm to perform the encryption operation. If the encryption operation is successful, the encryption result is encapsulated and passed to the secure upload module. If the encryption operation fails, an error code is returned. The key is stored using the TEE's key store function and is stored in a sealed form in secure storage, which only the security encryption module has the authority to use. The encryption algorithm is selected according to the key type.

[0012] After obtaining the encrypted data output by the secure encryption module, the secure upload module adds an integrity check code or digital signature to the encrypted data, and then interacts with the network subsystem of the ordinary world through the TEE internal control module to send the data to the target server. After the transmission is completed, the transmission result is fed back to the TEE internal control module.

[0013] A privacy protection method for photographing and recognizing paper medical reports, implemented based on the aforementioned system, includes the following steps: When a patient needs to photograph a paper medical report, the system interacts with the user through the user interface provided by a mobile terminal application in the ordinary world to obtain the user's request; The user request enters the TEE internal control module in the TEE world through a secure API. The TEE internal control module identifies the type of user request. When the type is a photo OCR request, it calls the secure camera data management module. The secure camera data management module sends instructions to the camera driver in the ordinary world via TrustZone secure calls to control the camera to start shooting and direct the captured image output to the secure image buffer allocated by the TEE; The OCR recognition and privacy processing module reads image data from the security buffer and executes the OCR text recognition algorithm in a trusted execution environment to extract the text of the paper medical report. The security encryption module encapsulates and encrypts sensitive information from the extracted paper medical report text based on a preset key, generating encrypted medical report data. The secure transmission module sends the encrypted medical report data to the backend cloud or server storage via the network provided by the operating system / storage module in the ordinary world. In scenarios where the recognition results need to be displayed to the user, the plaintext paper medical report text is transmitted back to the corresponding user's mobile terminal application for display.

[0014] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention directly controls the ordinary world camera driver through the secure camera data management module, so that the captured image data is transmitted in real time to the secure image buffer in the TEE without passing through ordinary world storage or relay. This design ensures that medical images enter the trusted environment of the TEE the moment they are acquired, eliminating the risk of plaintext data theft or leakage that may occur at the operating system layer, driver layer or application layer.

[0015] (2) This invention keeps the complex camera driver in the ordinary world. The TEE only interacts with the camera driver in a controlled manner through a lightweight security interface, which significantly reduces the amount of trusted code (trusted computing base) inside the TEE. This division avoids the implementation difficulty and potential vulnerabilities caused by reproducing complex drivers in the TEE while maintaining hardware-level security isolation, and improves the maintainability and overall security of the system.

[0016] (3) The OCR recognition and privacy processing module of the present invention directly reads the image from the security buffer within the TEE and completes text recognition and extraction. Subsequently, the extracted text is encrypted by the security encryption module. The encrypted data is output to the ordinary world through the secure upload module. The plaintext medical report does not leave the TEE environment, thus realizing that the entire process of "collection-recognition-encryption" is completed in a trusted environment, ensuring that the data is protected during transmission, storage and subsequent use. Even if the user requests to obtain the plaintext medical report, only the corresponding mobile terminal in the ordinary world that has passed the permission verification can obtain it. Other devices cannot obtain it, thus further ensuring data privacy.

[0017] (4) This invention, through hardware-level security isolation and encryption mechanisms, grants patients substantial control over their own medical imaging data. Patients can conveniently take reports using a user-friendly interface in the ordinary world, while ensuring that sensitive information is protected by TEE throughout the process. This effectively enhances patients' trust in the security of the digital follow-up system and promotes the efficient and secure use of medical data. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the system structure of the present invention; Figure 2 This is a flowchart of the method of the present invention. Detailed Implementation

[0019] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0020] Example 1 This embodiment provides a privacy protection system for photographing and recognizing paper medical reports, and its technical advantages are as follows: 1. Minimal security proxy concept within TEE: Instead of porting the complete and complex camera driver within the TEE, a DMA buffer isolation mechanism and a lightweight DMA data proxy component on the TEE side are used to achieve secure data acquisition, which greatly reduces the implementation complexity within the TEE. 2. Hardware-level security isolation: Hardware-level isolation is achieved by using a TrustZone memory controller (such as TZASC) to ensure that even if the system layer or driver layer is compromised, the raw medical image data cannot be read directly. 3. Real-time end-to-end data privacy protection: From the moment the data is collected, it is processed by the TEE security proxy component, encrypted and encapsulated, and then interacted with the untrusted environment in ciphertext to ensure that privacy is not leaked during data transmission.

[0021] Based on this, such as Figure 1As shown, the specific design of the system is as follows: The system is divided into a Trusted Execution Environment (TEE) world and a normal (untrusted) world. In the normal world, there are mobile terminal applications used by the user (including UI interfaces for taking pictures), camera drivers and operating system / storage modules. These normal world components are responsible for interacting with the user and controlling the hardware to take pictures of paper medical reports, but cannot obtain plaintext image data. Within the TEE world, a series of secure modules operate, including a TEE internal control module, a secure camera data management module, a secure image buffer, an OCR recognition and privacy processing module, a secure encryption module, and a secure upload module. These modules constitute a trusted computing boundary protected by TrustZone, responsible for data protection throughout the entire process from image acquisition to text recognition. Specifically, the TEE internal control module controls all modules within the TEE world; the secure camera data management module sends commands to the camera driver in the ordinary world, controlling the camera to start shooting and directing image output to the secure image buffer; the OCR recognition and privacy processing module reads images from the secure image buffer, recognizes text within the images, and extracts the text from paper medical reports; the secure encryption module encrypts the extracted paper medical report text before sending it to the operating system / storage module in the ordinary world via the secure upload module for data users. The ordinary world and the TEE world interact through a secure interface, ensuring that the ordinary world can only call predefined secure services and cannot directly access plaintext image data. The entire architecture ensures that sensitive medical report images are always under TEE protection throughout the entire process from shooting, acquisition, processing to uploading, preventing them from being stolen by unauthorized ordinary software.

[0022] The system's overall architecture achieves privacy protection at every stage, from image acquisition and processing to result output, through module separation between the TEE world and the ordinary world and strict interface control. The ordinary world is responsible for interacting with users and hardware but does not directly process sensitive data; the TEE world undertakes core data processing and protection functions, forming a lightweight but effective trusted computing boundary with the support of hardware isolation and encryption measures, thus achieving strong privacy protection for mobile medical data.

[0023] The specific implementation of each module is as follows: (1) TEE internal control module The TEE internal control module is the core scheduling unit of the entire system, similar to a service manager in a secure operating system. It is responsible for accepting service requests from the ordinary world and coordinating the corresponding modules within the TEE to complete tasks. In this solution, after the user's mobile terminal application sends a "Start Security Shooting" request to the TEE by calling the TEE's security API, the TEE internal control module first gains control. Its main functions include: Request parsing and scheduling: Based on the photo-taking request from the ordinary world, the type of user request is identified and the corresponding internal process is selected. For photo OCR requests, the TEE control module sequentially calls the secure camera data management module, the OCR recognition and privacy processing module, the security encryption module, and the secure upload module, executing them in the predetermined process order.

[0024] State Management: Tracking the state of each request during execution. For example, whether image acquisition has been completed, whether OCR was successful, and whether the encryption result is ready. In this embodiment, the TEE internal control module maintains a state machine to track the state of each request during execution. The next stage is triggered only after the previous stage is successful. If an error occurs in the middle (such as camera acquisition failure or OCR abnormality), the TEE internal control module is responsible for safely terminating the process and returning an error status to the caller without leaking any processed data.

[0025] Security Context Maintenance: Throughout the process, the TEE's internal control module ensures that resources involved (such as security buffers and keys) are under controlled access when transferred between different modules. For example, when calling the secure camera data management module, the TEE's internal control module controls the location of the image output buffer by allocating permissions for the secure image buffer; when calling the OCR recognition and privacy processing module, the TEE's internal control module only grants the OCR recognition and privacy processing module read-only access to the secure image buffer, and so on, thereby limiting the permissions of each module to the necessary scope.

[0026] The TEE's internal control module exposes a limited set of interfaces to the outside world. Ordinary applications can only interact with the TEE through these interfaces. Each interface call, after being trapped in the TEE via a Security Monitoring Command (SMC), undergoes parameter verification by the TEE's internal control module to prevent malicious applications from attempting to attack the TEE by passing in invalid parameters. For example, the control module verifies whether the caller has permission to initiate recording (which can be combined with on-device authentication) and whether the passed buffer handle is valid.

[0027] The TEE's internal control module itself does not execute specific data processing algorithms, but it connects various functional modules to ensure that the process proceeds in the expected safe sequence. It acts as a "scheduler," monitoring the entire process in a trusted environment, capturing and handling any unexpected situations, thereby enhancing the system's robustness and security.

[0028] (2) Security camera data management module The Secure Camera Data Management Module is a lightweight camera control agent running within the TEE (Tracking Equipment Environment), responsible for securely coordinating the camera acquisition process. It's important to emphasize that it doesn't fully implement all the functions of the camera driver; instead, it adopts a lightweight design: leaving complex hardware control within the standard world driver, and only providing security management for critical buffer configurations and data transfer processes. Its main functions and interfaces include: Secure Image Buffer Configuration: Upon receiving a photo-taking OCR request, the secure camera data management module allocates a secure image buffer in secure memory to store the image, based on the permissions granted to the secure image buffer by the control module within the TEE. It then prepares the physical address / handle of the secure image buffer. Subsequently, it sends the physical address / handle of the secure image buffer to the camera driver in the ordinary world via a secure call mechanism (e.g., TrustZone's secure monitoring call to SMC or using a vendor-provided secure driver interface). Typically, this requires a modified camera driver pre-installed in the ordinary world, capable of recognizing special commands from the TEE. For example, the driver can implement an ioctl interface `TEE_StartCapture(sec_buf_handle)`, which will only direct camera output to the buffer when it receives a call from the TEE with a valid secure buffer handle. The secure camera data management module is responsible for calling this ioctl and passing the necessary parameters. Throughout this process, the buffer's detailed information (e.g., address, size) may be invisible in plaintext to the camera driver in the ordinary world. The camera driver only obtains a handle or ID managed by TrustZone to reference the buffer, thus preventing the driver layer from stealing content.

[0029] Synchronization and Notification: After the command driver begins data acquisition, the security camera data management module will block and wait or asynchronously listen for the completion event of acquisition. This is typically achieved through the TrustZone notification mechanism: for example, after a normal driver completes the acquisition of a frame, it notifies the TEE by triggering a Secure Interrupt or writing a specific shared memory flag. The security camera data management module suspends its current thread to wait for this signal, and once it receives a notification indicating that an image frame has been written to the security buffer, it immediately wakes up and executes subsequent steps. It can provide a callback interface to the control module, such as OnFrameCaptured(), so that the control module within the TEE knows that OCR processing can begin, thereby further controlling the OCR recognition and privacy processing modules.

[0030] Data Transfer Protection: Although this module itself does not process image content, it ensures that every step of data transfer is completed in a controlled environment. For example, during buffer usage, it locks access to the buffer to prevent the general world from attempting to remap that memory; after the frame acquisition end signal is issued, it can verify the data integrity of the buffer (e.g., calculate a simple checksum) to confirm that the general driver has not tampered with or injected with forged data. If hardware support is available, a secure ISP can also be used to directly write images to the buffer and notify the TEE, further reducing risks at the hardware level. In short, the secure camera data management module acts as a gatekeeper, not directly involved in image processing, but monitoring the entire process of image data entering the TEE.

[0031] Through the aforementioned functions, the lightweight camera data management module establishes a secure channel between the camera and the TEE. Its interface design is concise, and the required logic is relatively simple, thereby reducing the need to execute complex driver code within the TEE. This design ensures the feasibility of the system implementation on mobile devices: it utilizes most of the existing camera driver's functionality, reducing development complexity, while ensuring that critical data paths are strictly controlled by the TEE.

[0032] (3) Secure image buffer The secure image buffer is not a "code module" in the traditional sense, but rather a dedicated memory area managed by the TEE within the system architecture. However, it is one of the key elements for achieving privacy protection, and therefore will be described separately here. The design features and interface of the secure buffer are as follows: Memory Isolation and Attribute Configuration: The secure image buffer resides in a secure memory region defined by TrustZone. In implementation, Arm TrustZone's memory control mechanism can be used to mark this memory as belonging to the Secure world. This prevents the operating system (including the kernel and drivers) in the ordinary world from reading or writing to this memory. During system initialization or the first request for shooting, the TEE reserves a buffer of a certain size (determined by the maximum resolution of the captured image) through the secure memory allocation interface. After allocation, the TEE informs the camera driver of the starting address and size of this memory via a secure call, but the camera driver can only access it for the purpose specified by the TEE and cannot change it. Furthermore, the buffer is typically set to be non-cached or only accessible to the device to avoid the risk of data residue due to caching and to improve access speed.

[0033] Buffer Handles and Sharing: To reference this memory between the TEE and the normal world, the system uses a buffer handle or descriptor. The TEE passes a reference to the buffer to the secure camera data management module and the camera driver in the normal world via interface functions (such as GetSecureBufferHandle()). The camera driver may obtain a DMA buffer pointing to secure memory by calling an API like memalloc_secure(), but it returns a protected reference. This design ensures that while the camera driver in the normal world can write data to this area, it cannot map this memory into its own address space to view the content through regular memory operations. Once the write is complete, the secure image buffer remains under the jurisdiction of the TEE.

[0034] Lifecycle Management: The secure image buffer may be used multiple times during a single shooting process (e.g., multiple acquisitions due to multiple report pages). The TEE needs to manage its lifecycle to avoid residual sensitive data. After each OCR frame is processed, the TEE's control module should immediately zero out or re-encrypt and overwrite the secure image buffer to prevent old data from remaining in memory. Furthermore, if the secure image buffer is idle, the TEE's control module can reclaim it or further protect it (e.g., mark it as inaccessible), only re-enabled and granted driver access during the next shooting session. The interface provides `SecureBuffer.Lock()` and `SecureBuffer.Unlock()` methods, which are controlled by the TEE's control module and called by the secure camera data management module before and after frame acquisition to control the DMA permissions of the ordinary driver on the buffer. For example, `Lock` is called at the start of shooting to authorize driver writing, and `Unlock` is called immediately to reclaim driver access after writing is complete.

[0035] Capacity and performance considerations: The buffer size needs to be large enough to hold a single image. For example, a high-resolution A4 report photo might require several MB of space. When allocating TEE memory, the limited memory of mobile devices must be considered. Slicing or streaming processing can be used to reduce peak memory usage. For instance, the driver can notify the TEE to perform partial processing (if the OCR algorithm supports streaming recognition) after acquiring a certain number of data blocks, release the buffer after processing, and then continue acquiring the next portion. This advanced usage requires coordinating multiple unlocking / locking of the buffer, but it reduces one-time memory requirements. In this embodiment, it can be assumed that the buffer holds the entire image at once for simplicity; however, in actual implementation, optimization should be based on hardware capabilities.

[0036] The secure image buffer is the foundation of the entire system's security. It forms a secure base that only the TEE (Trusted Image Buffer) can guard, where all sensitive image data can only be temporarily stored and processed. Whether an attacker gains root access to the Android system or attempts to read memory through the debugging interface, this memory remains an invisible black box without the assistance of the TEE. This isolation ensures an absolutely secure input / output environment for subsequent OCR and encryption operations.

[0037] (4) OCR recognition and privacy processing module The OCR recognition and privacy processing module is a trusted application running within the TEE (Trusted Application Environment), responsible for converting images into text and performing preliminary processing of sensitive information. It can be viewed as comprising two sub-functions: OCR recognition and privacy information preprocessing. The specific implementation is as follows: OCR Recognition: This module performs text recognition on images in a secure image buffer by using a built-in or loaded lightweight OCR algorithm model. Given the limitations of the TEE environment on computing resources (such as memory and CPU time), the OCR algorithm needs to be sufficiently efficient. Optimized lightweight OCR algorithm models can be used, such as a convolutional neural network + LSTM model trained for mobile phone camera resolution, or traditional OCR implemented using open-source libraries like OpenCV (such as a subset of the Tesseract library). During implementation, the OCR model can be stored as read-only data in the TEE's secure storage (to prevent the model itself from being tampered with and outputting incorrect results). During the recognition process, the OCR recognition and privacy processing module calls basic library functions provided by the TEE to read pixels line by line from the secure buffer, performing layout analysis, character segmentation, and recognition, ultimately obtaining the text string and possible layout information (such as paragraphs, tables, etc.), i.e., the text of a paper medical report.

[0038] Sensitive Content Detection and Encapsulation: Addressing healthcare data privacy concerns, the OCR recognition and privacy processing module can immediately detect and encapsulate sensitive information upon receiving text. For example, medical reports may contain highly sensitive fields such as patient names and ID numbers. The module can incorporate regular expressions or keyword lists to scan and mark the recognized text. These markers can be used to determine encryption strategies (e.g., using different keys to encrypt certain fields separately, or partially obscuring the text when displayed to the client). During encapsulation, the OCR recognition and privacy processing module can organize the recognition results into a structured data format (e.g., JSON or XML), annotating each paragraph with its sensitivity level, and then submit this structure to the subsequent security encryption module. This allows the security encryption module to select different encryption strengths or destinations based on the sensitivity level (e.g., highly sensitive information is only uploaded to the server and not displayed locally), thus achieving a refined data protection strategy.

[0039] The OCR recognition and privacy processing module provides a primary interface to the TEE-internal control module, such as PerformOCR(buffer) -> text. The TEE-internal control module calls this interface, passing in a reference to a secure buffer. Internally, the OCR recognition and privacy processing module uses this reference to read pixel data and perform recognition, ultimately returning the recognized text content (or a structured text object). For security, the interface implementation ensures that the passed buffer can only come from the secure buffer and does not accept ordinary memory, preventing manipulation to process insecure data. Furthermore, the OCR recognition and privacy processing module should not call any ordinary world services during this interface call. It runs in a purely isolated TEE environment, so complex permission switching is unnecessary. However, exception handling interfaces need to be considered. For example, if the image quality is too low, causing OCR failure, the module should return an error code or an empty result, and the control module should decide on subsequent processing (such as notifying the application to retake the image).

[0040] In summary, the OCR recognition and privacy processing module converts the original paper report image into a machine-processable and protected text format. This forms the basis for subsequent encryption and flexible protection strategies, achieving the digitization of medical information while ensuring data privacy.

[0041] (5) Security encryption module The security encryption module is responsible for encrypting and encapsulating sensitive text data output by the OCR recognition and privacy processing modules, ensuring that the data has undergone strong encryption before leaving the TEE. It implements encryption algorithms and key management within the TEE, providing interfaces for the OCR module or control module to call. Its key design features include: Key Management: The security encryption module uses keys stored within the TEE to perform encryption operations. Keys can come from various sources: they can be device-level keys (unique hardware keys for each device), session keys issued from a server, or pre-configured public keys, etc. For security, key storage utilizes the TEE's Key Store function to store keys in a secure, sealed form, accessible only to the encryption module.

[0042] Encryption Algorithm: The security encryption module should implement standard strong encryption algorithms, such as AES-256, RSA, and ECC. The specific choice depends on the key type: if using a symmetric key (e.g., for local decryption and viewing), then use a symmetric algorithm like AES; if the entire data is uploaded for server use and the client doesn't need decryption, then the server's RSA public key can be used for encryption. A hash algorithm (such as SHA-256) can also be executed simultaneously to calculate the data hash for integrity verification. Considering performance and data length, if the text volume is small (generally, the text volume of OCR results is much smaller than the image volume), RSA encryption of the entire text is feasible; if the text is large, a hybrid encryption method can be used (generating a random AES key to encrypt the text, then using RSA to encrypt the AES key).

[0043] The security encryption module provides a simple and easy-to-use interface to the OCR module, such as `EncryptData(input_text, policy) -> encrypted_blob`. Here, `input_text` is the plaintext string or structure obtained from the OCR, and `policy` indicates the encryption strategy (such as different key schemes). The security encryption module returns `encrypted_blob`, which is a pre-packaged encrypted data packet, ready for the secure upload module to send. Throughout the entire call, the security encryption module automatically completes key reading, algorithm execution, and result encapsulation internally, transparently to the caller. For error handling, if encryption fails (e.g., the key does not exist or the algorithm is incorrect), the security encryption module should return an error code, and the control module will decide whether to retry or abort the process.

[0044] Encryption operations are significantly less expensive than OCR (due to the smaller data volume), so execution within a TEE will not be a bottleneck. Conversely, key security is paramount; therefore, the secure encryption module must adhere to side-channel protection design principles, such as avoiding significant time or power consumption characteristics that could lead to key information leakage. TEE hardware typically provides encryption instructions or a secure coprocessor that can be utilized to ensure the key never leaves the hardware registers. The secure encryption module should also clear cached plaintext keys or data from memory after key use to further reduce the possibility of side-channel interception.

[0045] With the security encryption module, the system adds a robust encryption lock just before the data leaves the TEE.

[0046] (6) Secure upload module The secure upload module is responsible for sending the encrypted and encapsulated medical report data from the device. It emphasizes "secure upload," not replacing ordinary network transmission components, but rather maintaining data protection and verifying the integrity of the transmission process during the upload. Its functions and interfaces are as follows: Data Transmission: After the secure upload module receives the ciphertext data packet output by the secure encryption module, it interacts with the network subsystem in the normal world through the control module within the TEE to send the data to the target server. Since the TEE typically does not directly implement complex network protocol stacks, the most common approach is to call the network APIs provided by the operating system in the normal world. For example, through a network proxy service in the normal world, the ciphertext can be sent as a parameter in an HTTP / HTTPS request. To this end, a secure service interface such as SendEncryptedData(dest_url, encrypted_blob) can be designed. In its implementation, the TEE will pass the dest_url (target server address) and encrypted_blob to an upload proxy process in the normal world via a secure call. This proxy process runs in the normal OS, but because it receives fully encrypted data, it cannot understand the content and is only responsible for POSTing the data to the server as required. The proxy process should be subject to certain restrictions, such as only being created by our application signature to prevent impersonation by other malicious programs. However, even if the proxy is intercepted and replaced, the ciphertext itself is difficult to crack.

[0047] Integrity and Authentication: The secure upload module can attach an integrity checksum or digital signature to the encrypted data before sending. The integrity checksum (such as HMAC or SHA-256 hash) is used to detect whether the data has been tampered with during transmission. The digital signature is used by the server to verify that the data indeed originated from a trusted TEE. This system can use the device's private key to calculate a signature on the encrypted data (for example, using the device's unique Attestation Key, which is usually stored by the TEE), and then send the signature along with the data. Upon receiving it, the server verifies the signature using the pre-stored device public key, thus confirming that the data was generated by the device's TEE and has not been modified. This design prevents man-in-the-middle attacks that could tamper with or forge data, and establishes a trusted link for medical data.

[0048] Interface Feedback: After completing the upload, the secure upload module should notify the TEE control module of the result (success / failure), which in turn can notify the front-end application. If the upload fails, the TEE control module may decide to temporarily store the encrypted data in the TEE secure storage for a later retry. For this purpose, the secure upload module can provide a simple feedback interface, such as returning an HTTP status code or error code, allowing the TEE control module to take appropriate measures. Temporarily storing encrypted data also requires using TEE storage to prevent plaintext leakage. It's worth noting that if temporary storage is used, the encrypted data itself is already secure; even if stored in a regular file system and seen by others, it's not a problem. However, for integrity reasons, it can be stored in the TEE file system to ensure it won't be replaced later.

[0049] With the secure upload module, the entire privacy protection chain extends beyond what the data leaves the device. Once the data leaves the device and enters the internet, even if an attacker could intercept the communication, the multiple layers of encryption and signatures make it extremely difficult to succeed. This ensures that the patient's medical report data is encrypted and verified from the moment it is collected until it reaches a trusted server, truly achieving end-to-end privacy protection.

[0050] (7) Normal World Support Module (Camera Driver and Application Layer) The driving and applications in the ordinary world are not the focus of this invention, but for the sake of completeness, this embodiment briefly explains how they work in conjunction with the TEE module described above: Camera Driver / HAL Adaptation: The camera driver for mobile terminal (e.g., smartphone) operating systems needs minor modifications to support TEE requests. The driver adds an interface to receive a secure buffer handle from the TEE and configures the camera output accordingly. This may involve adjustments to the underlying Camera HAL framework to allow it to recognize whether it is in "safe mode." In safe mode, the driver prohibits all operations that pass images to user space and does not record image data in the kernel log (to prevent leaks through logs). If the hardware ISP supports this, a secure path should also be enabled to write the processed data directly to secure memory. The driver also needs to synchronize its state with the TEE, for example, by notifying the TEE that "a frame has been captured" via a specific interrupt. These changes are all implemented in a controlled manner at the driver level and do not need to expose APIs used by ordinary apps. Therefore, for the user layer, taking photos still uses the regular Camera API, but the application will be designed to actually call the TEE interface instead of directly opening the camera. Modifications to the driver can be encapsulated in operating system security patches and will not affect the normal functionality of the camera.

[0051] User Application: The follow-up application used by users is primarily responsible for triggering the process and displaying results. The interface provides a photo button, which calls the TEE's `StartSecureCapture` method instead of the system's camera interface. Since most of the process is within the TEE, the application's code is relatively simple: it sends a request and waits for the result. If the OCR text is returned, the application displays the recognized medical paper report text for the patient to proofread or annotate. The application does not receive the photo itself (nor does it need it, unless for manual user review and comparison, in which case a TEE-protected image thumbnail can be displayed for reference). The OCR text received by the application is also encrypted during storage and can be decrypted and displayed on the screen after patient authentication. Following the principle of least privilege, unnecessary sensitive data is not retained.

[0052] User Experience: From the user's perspective, the image recognition process is not much different from ordinary scanning applications, but there are slightly additional security prompts (if needed, a "processing securely" indicator can be displayed on the UI to let users know that their privacy is protected). There is a slight delay in speed, but it is still within an acceptable range. After receiving the OCR text, users can edit or confirm it and submit it for upload. If the user is not connected to the internet, the application can also re-trigger the TEE upload and storage process when connected to the internet later.

[0053] The cooperation of the normal world module ensures that the security capabilities of TEE can be fully utilized without affecting user habits. Minor modifications to the driver and application integration are necessary for the entire system to be deployed on mobile devices, creating an environment for each module of TEE to function effectively.

[0054] Example 2 This embodiment, based on embodiment 1, provides a method for optimizing OCR performance within the TEE world.

[0055] While performing OCR within a TEE ensures security, it may result in performance degradation compared to directly invoking OCR in the open world. To mitigate this, several optimization measures can be implemented. For example, the secure computing capabilities of the GPU (if ARM TrustZone supports GPU isolation) can be utilized to accelerate image processing. Alternatively, the priority of the OCR module can be increased within the TrustZone OS to minimize context switching interference. Furthermore, images can be pre-compressed to reduce resolution, resulting in faster processing speeds (as long as the resolution is sufficient for OCR). These optimization details are not elaborated upon at the patent level, but it should be noted that this module is feasible to execute within a trusted environment. Especially considering the performance of modern mobile SoCs, the OCR processing time for a single report is within an acceptable range (e.g., hundreds of milliseconds to less than one second), fully meeting the user experience requirements of autonomous follow-up applications.

[0056] Example 3 This embodiment, based on embodiment 1, provides an implementation method for calling an external trusted OCR service.

[0057] Considering the limitations of computing resources in the TEE environment and the diversity of practical application needs, a flexible OCR implementation scheme can be adopted: A lightweight OCR recognition model can be deployed within the TEE, solely for meeting the needs of simple and efficient text recognition in resource-constrained environments; For OCR tasks requiring high accuracy or involving complex models, a secure communication channel can be established between the TEE's internal key and an external trusted service via the HTTPS protocol. This allows the TEE to invoke the external trusted OCR recognition service, while the TEE is only responsible for encrypting the image data and securely transmitting it to the external trusted server. After recognition, the result is securely returned to the TEE. This reliance can fully unleash OCR performance; for example, services based on large models, such as recognition, parsing, and standardization, can also be added to the system. The specific implementation of the external service's trustworthiness is beyond the scope of this patent; methods such as local service deployment or data anonymization can achieve the same effect.

[0058] Example 4 This embodiment provides a privacy protection method for photographing and recognizing paper medical reports, based on the system described in Embodiment 1, as follows: Figure 2 As shown, the method includes the following steps: S1: When a patient needs to photograph a paper medical report, the system interacts with the user through the user interface provided by a mobile terminal application in the ordinary world to obtain the user's request.

[0059] S2: User requests do not directly call the ordinary camera interface to obtain image data. Instead, they enter the TEE internal control module in the TEE world through a secure API. The TEE internal control module identifies the type of user request. When the type is a photo OCR request, it calls the secure camera data management module.

[0060] S3, the secure camera data management module sends instructions to the camera driver in the ordinary world via TrustZone secure calls. This instructs the camera to start capturing images and direct the captured images to a secure image buffer allocated by the TEE. This buffer is located in a memory area protected by TrustZone, and its contents cannot be read by the ordinary operating system. After receiving the instruction to start the camera, the camera driver in the ordinary world configures the camera hardware to capture images, but the frame data is directly written to the secure memory provided by the TEE. Therefore, the camera driver itself cannot view or retain plaintext images. After the camera completes a capture, the image pixel data is securely stored in the secure buffer in the TEE world.

[0061] S4, the OCR recognition and privacy processing module reads the image data from the security buffer and executes the OCR text recognition algorithm within the trusted execution environment to extract the text from the paper medical report. Since the entire OCR processing is completed within the TEE, the image data does not leave the security boundary during the process, ensuring that the recognized text remains protected. This embodiment does not elaborate on the specific implementation process of the OCR text recognition algorithm; existing OCR recognition methods can all achieve this, and the different recognition algorithms used do not affect the achievement of the invention's objective.

[0062] S5, the security encryption module encapsulates and encrypts the extracted paper medical report text based on a preset key (stored in the TEE secure storage) to generate ciphertext medical report data.

[0063] S6, the secure transmission module sends the encrypted medical report data to the backend cloud or server storage via the network provided by the operating system / storage module in the ordinary world. Because the data is encrypted, the operating system and transmission path in the ordinary world cannot decipher the sensitive information. Furthermore, in scenarios where the recognition results need to be displayed to the user, the control module within the TEE can also transmit the plaintext paper medical report text output by the OCR recognition and privacy processing modules back to the corresponding user's mobile terminal application for display. However, this process is also controlled—the text is only visible to the trusted application, and the application itself is subject to security policies (e.g., the application cannot copy data to insecure areas). The entire architecture design ensures that, apart from the user and the TEE trusted computing environment, the system layer, driver layer, or any ordinary application layer cannot access the plaintext medical report image or the recognized text.

[0064] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A privacy protection system for photographing and recognizing paper medical reports, characterized in that, The system is divided into a TEE world and a normal world. The normal world includes the user's mobile terminal application, camera driver, and operating system / storage module, responsible for interacting with the user and controlling the hardware to capture paper medical reports. The TEE world includes a TEE control module, a secure camera data management module, a secure image buffer, an OCR recognition and privacy processing module, a security encryption module, and a secure upload module, responsible for data protection throughout the entire process from image acquisition to text recognition. Specifically, the TEE control module controls all modules within the TEE world; the secure camera data management module sends commands to the camera driver in the normal world to control the camera to start shooting and direct the image output to the secure image buffer; the OCR recognition and privacy processing module reads the image from the secure image buffer, recognizes the text in the image, and extracts the text from the paper medical report; the security encryption module encrypts the extracted text and then sends it to the operating system / storage module in the normal world via the secure upload module for data users. The normal world and the TEE world interact through a secure interface, ensuring that the normal world can only call predefined secure services and cannot directly access plaintext image data.

2. The privacy protection method for photographing and recognizing paper medical reports according to claim 1, characterized in that, The TEE internal control module performs the following steps: Request parsing and scheduling: Based on the photo-taking requests from the ordinary world, the type of user request is identified and the corresponding internal process is selected. For photo OCR requests, the TEE control module sequentially calls the secure camera data management module, the OCR recognition and privacy processing module, the security encryption module, and the secure upload module, executing them in the predetermined process order. State Management: By maintaining a state machine, the state of each request is tracked during execution. The state machine only triggers the next stage after the previous stage is successful. If an error occurs in the middle, the control module in the TEE is responsible for safely terminating the process and returning an error status to the caller without leaking any part of the processed data. Security context maintenance: When calling the security camera data management module, the TEE control module controls the location of the image output buffer by allocating permissions for the security image buffer; when calling the OCR recognition and privacy processing module, the TEE control module only grants the OCR recognition and privacy processing module read-only access to the security image buffer, thereby limiting the permissions of each module to the necessary range.

3. The privacy protection method for photographing and recognizing paper medical reports according to claim 1, characterized in that, The security camera data management module performs the following steps: Secure Image Buffer Configuration: When a photo-taking OCR request is received, the secure camera data management module allocates a secure image buffer in secure memory to store the image based on the permissions of the secure image buffer assigned by the control module within the TEE, and prepares the physical address / handle of the secure image buffer. Subsequently, the physical address / handle of the secure image buffer is sent to the camera driver in the ordinary world through a secure call mechanism. The camera driver will only output the image captured by the camera to the corresponding buffer when it receives a call from the TEE world with a valid secure image buffer physical address / handle. Synchronization and Notification: After the data acquisition begins under command, the security camera data management module uses TrustZone's notification mechanism to either block and wait or asynchronously listen for events indicating that the acquisition is complete.

4. The privacy protection method for photographing and recognizing paper medical reports according to claim 1, characterized in that, The secure camera data management module also performs data transfer protection: during the use of the secure image buffer, it locks the access permissions of the secure image buffer to prevent the ordinary world from attempting to remap the memory; after the frame acquisition end signal is issued, it checks the data integrity of the secure image buffer to confirm that the ordinary driver has not tampered with or injected forged data.

5. The privacy protection method for photographing and recognizing paper medical reports according to claim 1, characterized in that, The secure image buffer is located in a secure memory area defined by TrustZone. Arm TrustZone's memory control mechanism is used to mark the corresponding memory as belonging to the TEE world. A buffer handle or descriptor is set, and the reference to the buffer is passed to the secure camera data management module and the normal driver through interface functions, so as to enable referencing the memory corresponding to the secure image buffer between the TEE world and the normal world. Whenever the OCR finishes processing a frame of image, the control module in the TEE clears or re-encrypts and overwrites the secure image buffer. When the secure image buffer is not in use, the control module in the TEE reclaims or further protects the secure image buffer, and it is only re-enabled and given driver access permissions during the next shooting.

6. The privacy protection method for photographing and recognizing paper medical reports according to claim 1, characterized in that, The secure image buffer uses fragmentation or streaming processing to reduce peak memory usage.

7. The privacy protection method for photographing and recognizing paper medical reports according to claim 1, characterized in that, The OCR recognition and privacy processing module performs the following steps: OCR Recognition: By using a lightweight OCR algorithm model built into the module or loaded, text recognition is performed on the image in the secure image buffer. The lightweight OCR algorithm model is stored in the TEE secure storage in read-only data form. During the recognition process, the OCR recognition and privacy processing module calls the basic library functions in the TEE world to read pixels line by line from the secure buffer, perform layout analysis, character segmentation and recognition, and obtain the paper medical report text. Sensitive content detection and encapsulation: The module uses built-in regular expressions or keyword lists to scan and mark the identified paper medical report text. Based on the scan marks, an encryption strategy is determined to encrypt sensitive content. During encapsulation, the OCR recognition and privacy processing module organizes the recognition results into a structured data format, labels each paragraph with its sensitivity level, and completes the encapsulation.

8. The privacy protection method for photographing and recognizing paper medical reports according to claim 1, characterized in that, The security encryption module uses the key stored within the TEE world to call the encryption algorithm to perform the encryption operation. If the encryption operation is successful, the encryption result is encapsulated and passed to the secure upload module. If the encryption operation fails, an error code is returned. The key is stored using the TEE's key store function and is stored in a sealed form in secure storage, which only the security encryption module has the authority to use. The encryption algorithm is selected according to the key type.

9. The privacy protection method for photographing and recognizing paper medical reports according to claim 1, characterized in that, After obtaining the encrypted data output by the secure encryption module, the secure upload module adds an integrity check code or digital signature to the encrypted data, and then interacts with the network subsystem of the ordinary world through the TEE internal control module to send the data to the target server. After the transmission is completed, the transmission result is fed back to the TEE internal control module.

10. A privacy protection method for photographing and recognizing paper medical reports, characterized in that, Based on the system implementation as described in any one of claims 1-9, the method includes the following steps: When a patient needs to photograph a paper medical report, the system interacts with the user through the user interface provided by a mobile terminal application in the ordinary world to obtain the user's request; The user request enters the TEE internal control module in the TEE world through a secure API. The TEE internal control module identifies the type of user request. When the type is a photo OCR request, it calls the secure camera data management module. The secure camera data management module sends instructions to the camera driver in the ordinary world via TrustZone secure calls to control the camera to start shooting and direct the captured image output to the secure image buffer allocated by the TEE; The OCR recognition and privacy processing module reads image data from the security buffer and executes the OCR text recognition algorithm in a trusted execution environment to extract the text of the paper medical report. The security encryption module encapsulates and encrypts sensitive information from the extracted paper medical report text based on a preset key, generating encrypted medical report data. The secure transmission module sends the encrypted medical report data to the backend cloud or server storage via the network provided by the operating system / storage module in the ordinary world. In scenarios where the recognition results need to be displayed to the user, the plaintext paper medical report text is transmitted back to the corresponding user's mobile terminal application for display.

Images