A data security storage system based on network security
By incorporating active data encryption, intelligent access control and traceability, distributed anomaly detection, and closed-loop feedback modules, the system addresses single-point-of-failure and security silo issues in medical data storage systems. This enables dynamic, closed-loop security management across the entire process, enhancing the system's trustworthy sharing and defense capabilities.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SUZHOU MUNICIPAL HOSPITAL
- Filing Date
- 2026-03-06
- Publication Date
- 2026-06-02
AI Technical Summary
Existing medical data storage systems suffer from single points of failure, lack trusted cross-institutional sharing mechanisms, have isolated security measures, and are unable to be continuously monitored and dynamically adjusted, making them difficult to cope with complex network threats.
By employing a data active encryption module, an intelligent permission and traceability module, a distributed anomaly detection and risk assessment module, and a closed-loop strategy feedback module, dynamic closed-loop security management is achieved throughout the entire process.
It achieves closed-loop security throughout the entire lifecycle, builds a three-dimensional defense system, reduces the risk of single point of failure and internal violations, and improves the credibility and security of data sharing.
Smart Images
Figure CN122137626A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of medical information technology, and more specifically to a data security storage system based on network security. Background Technology
[0002] With the deep development of medical informatization, medical institutions generate and store massive amounts of sensitive patient data, including electronic medical records, imaging data, and gene sequences. This data has extremely high privacy value and stringent compliance requirements (such as HIPAA and GDPR). Currently, the secure storage of medical data faces three major challenges: First, traditional centralized database architectures are prone to single points of failure and struggle to establish trusted sharing mechanisms across institutions, making them vulnerable to internal misuse and external attacks. Second, existing security measures are often siloed, such as relying solely on firewalls, antivirus software, or basic encryption, lacking a collaborative protection system covering the entire data transmission-storage-use process. Third, security protection is mostly static and reactive, unable to continuously monitor, intelligently analyze, and dynamically adjust system operation status and access behavior, making it difficult to cope with increasingly complex and covert network threats.
[0003] While existing technologies attempt to incorporate blockchain to enhance traceability, utilize encryption algorithms to protect data, or employ monitoring modules for anomaly alerts, they generally lack the ability to systematically integrate "data ontology encryption," "access control and traceability," "operational risk awareness," and "dynamic policy optimization" to form a closed-loop risk management system. For example, patent CN202411948274.3 primarily focuses on using hash encryption algorithms to reduce database packet loss rates but does not address complex permission models or continuous anomaly detection. While blockchain-based anomaly detection methods focus on operational security, they may lack sufficient strength and flexibility in data ontology encryption.
[0004] Therefore, there is an urgent need for a closed-loop medical data security storage system that can achieve pre-emptive defense, in-process control, post-event auditing, and strategy iteration. Summary of the Invention
[0005] The purpose of this invention is to provide a data security storage system based on network security to solve the problems existing in the prior art, and to realize dynamic and closed-loop security management of medical data from collection, storage, access to sharing.
[0006] To achieve the above objectives, the present invention provides the following solution: The present invention provides a data security storage system based on network security, comprising:
[0007] The active data encryption module is used to perform discretization preprocessing on raw medical data based on chaotic mapping, and to encrypt it using a layered hybrid encryption strategy according to the data sensitivity level and application scenario.
[0008] The intelligent access control and traceability module, built on blockchain technology, is used to achieve fine-grained dynamic access control, patient self-management of privacy policies, and to ensure the immutability and full traceability of all data operation logs through a consensus mechanism.
[0009] The distributed anomaly detection and risk assessment module is used to collect system time-series operation data from multiple dimensions, predict abnormal behavior through principal component analysis dimensionality reduction and long short-term memory network model, and periodically assess the health status of storage devices.
[0010] The closed-loop strategy feedback and optimization module is used to execute predefined dynamic security strategy adjustment actions based on the output of the anomaly detection and risk assessment module, and to feed back the adjustment effect to the system.
[0011] Preferably, in the active data encryption module, the discretization preprocessing based on chaotic mapping uses chaotic mapping, and its calculation formula is as follows:
[0012] xn+1=εxn(1-xn);
[0013] Where ε is a constant in the interval [0, 4].
[0014] Preferably, the layered hybrid encryption strategy includes using SM4 or AES-256-GCM symmetric encryption for statically stored data, and using proxy re-encryption or homomorphic encryption technology based on elliptic curve encryption for data that needs to be shared or computed across institutions.
[0015] Preferably, the intelligent permission and traceability module integrates role-based access control, attribute-based access control models, and zero-knowledge proof protocols.
[0016] Preferably, the operation log is generated by integrating operation details, timestamps, and operator identification using a Merkle tree algorithm to generate a log summary; after verification using a Byzantine fault-tolerant consensus algorithm, it is added to the blockchain.
[0017] Preferably, in the distributed anomaly detection and risk assessment module, during principal component analysis dimensionality reduction, the formula for calculating the eigenvalue contribution rate of the first j principal components is:
[0018] αj = Σ(i=1 to j) λi / Σ(i=1 to n) λi;
[0019] Where λi is the eigenvalue and i is the storage device.
[0020] Preferably, the dynamic security policy adjustment actions performed by the closed-loop policy feedback and optimization module include: triggering secondary authentication, dynamically upgrading or downgrading user access permissions, isolating or restricting abnormal nodes, automatically migrating data on high-risk storage devices, and adjusting member credit scores and rights in the data sharing ecosystem.
[0021] Preferably, it also includes a patient management platform that interacts with the intelligent permission and traceability module to allow patients to edit privacy policies, view access monitoring information, and grant real-time authorization for access requests from medical staff.
[0022] The present invention discloses the following technical effects:
[0023] Full lifecycle closed-loop security; through the collaboration of four modules, security protection is integrated throughout the data process, forming a dynamically adjusted closed loop, realizing the transformation from passive defense to active immunity.
[0024] Multi-dimensional integrated protection: It organically integrates multiple technologies such as high-strength encryption, blockchain trusted traceability, and intelligent anomaly detection, which solves the limitations of single technical solutions and builds a three-dimensional defense system. Attached Figure Description
[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0026] Figure 1 This is a schematic diagram of the overall architecture of the system of the present invention;
[0027] Figure 2 This is a flowchart illustrating the workflow of the proactive data encryption module.
[0028] Figure 3 This is a logical diagram of a closed-loop strategy feedback mechanism. Detailed Implementation
[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0030] This invention discloses a data security storage system based on network security, comprising:
[0031] The active data encryption module is used to perform discretization preprocessing on raw medical data based on chaotic mapping, and to encrypt it using a layered hybrid encryption strategy according to the data sensitivity level and application scenario.
[0032] The intelligent access control and traceability module, built on blockchain technology, is used to achieve fine-grained dynamic access control, patient self-management of privacy policies, and to ensure the immutability and full traceability of all data operation logs through a consensus mechanism.
[0033] The distributed anomaly detection and risk assessment module is used to collect system time-series operation data from multiple dimensions, predict abnormal behavior through principal component analysis dimensionality reduction and long short-term memory network model, and periodically assess the health status of storage devices.
[0034] The closed-loop strategy feedback and optimization module is used to execute predefined dynamic security policy adjustment actions based on the output of the anomaly detection and risk assessment module, and to feed back the adjustment effect to the system.
[0035] In the active data encryption module, the discretization preprocessing based on chaotic mapping uses chaotic mapping, and its calculation formula is as follows:
[0036] xn+1=εxn(1-xn);
[0037] Where ε is a constant in the interval [0, 4].
[0038] The layered hybrid encryption strategy includes using SM4 or AES-256-GCM symmetric encryption for statically stored data, and using elliptic curve cryptography-based proxy re-encryption or homomorphic encryption technology for data that needs to be shared or computed across institutions.
[0039] The intelligent permissions and traceability module integrates role-based access control, attribute-based access control models, and zero-knowledge proof protocols.
[0040] The operation log is generated by integrating operation details, timestamps, and operator identification using the Merkle tree algorithm to generate a log summary; after verification using the Byzantine fault-tolerant consensus algorithm, it is added to the blockchain.
[0041] In the distributed anomaly detection and risk assessment module, during principal component analysis dimensionality reduction, the formula for calculating the eigenvalue contribution rate of the first j principal components is:
[0042] αj = Σ(i=1 to j) λi / Σ(i=1 to n) λi;
[0043] Where λi is the eigenvalue and i is the storage device.
[0044] The dynamic security policy adjustment actions executed by the closed-loop policy feedback and optimization module include: triggering secondary authentication, dynamically upgrading or downgrading user access permissions, isolating or restricting abnormal nodes, automatically migrating data on high-risk storage devices, and adjusting member credit scores and rights in the data sharing ecosystem.
[0045] It also includes a patient management platform that interacts with the intelligent permissions and traceability module, allowing patients to edit privacy policies, view access monitoring information, and grant real-time authorization for access requests from medical staff.
[0046] In one embodiment of the present invention, the active data encryption module is used to preprocess and encrypt the raw medical data in layers. First, the raw data sequence is discretized based on chaotic mapping (such as Logistic mapping) to reduce the correlation of statistical characteristics of the plaintext data.
[0047] The discretization formula is: xn+1=εxn(1-xn); where xn+1 represents the mapped data, ε is a control parameter (value range [0,4]), and xn is the mapping variable. Subsequently, for the discretized data, a hybrid encryption strategy is adopted according to its sensitivity level (such as basic information, diagnostic records, gene data) and application scenario (storage, sharing, analysis); static storage adopts the national cryptographic SM4 or AES-256-GCM algorithm; when sharing across institutions, proxy re-encryption based on elliptic curve cryptography (ECC) or homomorphic encryption (such as the BFV scheme) technology is used to ensure that the data is "usable but not visible" during the sharing and computation process. Homomorphic encryption satisfies the properties of Enc(a) + Enc(b) = Enc(a+b) and Enc(a) × Enc(b) = Enc(a×b), supporting direct computation on ciphertext.
[0048] Furthermore, the intelligent access control and traceability module constructs a distributed ledger based on blockchain technology, enabling fine-grained access control and tamper-proof operation traceability. This module integrates Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) models, combined with the Zero-Knowledge Proof (ZKP) protocol, to verify user permissions without exposing additional user information. All details, timestamps, and operator identities for data access, modification, and sharing are generated into hash digests using the Merkle Tree algorithm and verified through the Byzantine Fault Tolerance (BFT) consensus mechanism before being stored on the blockchain, forming an immutable and fully traceable audit log. Patients can independently set privacy policies through their personal terminals (such as patient management platforms) to authorize access requests (e.g., via dynamic verification codes).
[0049] Furthermore, the distributed anomaly detection and risk assessment module is responsible for continuous monitoring and intelligent analysis of the system's operational status. This module collects time-series operational data X=(x1,x2,...,xn) from multiple dimensions, including network traffic, database access logs, user behavior sequences, and storage device performance. First, Principal Component Analysis (PCA) is used to reduce the dimensionality of the high-dimensional data, and the contribution rate of eigenvalues is calculated to retain the main features: αj=Σ(i=1toj)λi / Σ(i=1ton)λi;
[0050] Where λi is the eigenvalue, the first j principal components whose contribution rate αj is greater than a set threshold (e.g., 80%) are retained to obtain the dimensionality-reduced data Y.
[0051] Subsequently, Y is input into a Long Short-Term Memory (LSTM) network for training to construct an anomaly detection model M_LSTM, which is used to predict the future operating state of the system, Y_predicted. Simultaneously, this module also performs periodic health assessments of the storage devices, such as calculating the "read failure coefficient" for storage device i.
[0052] Read failure coefficient = ω1 * invalid read ratio + ω2 * storage failure ratio;
[0053] Wherein, ω1 and ω2 are weighting coefficients; combining the anomaly prediction results of LSTM with the equipment health score, a comprehensive risk assessment report is generated.
[0054] In one embodiment of the present invention, the closed-loop policy feedback and optimization module is the core of the dynamic security implementation. This module receives the output of the risk assessment module and automatically executes feedback actions according to a predefined policy rule base. When abnormal access behavior is detected, it automatically triggers permission restrictions or session termination; when an increased risk of failure of a storage device is predicted, it automatically migrates the data to a healthier device; when it is found that encrypted data is frequently attempted to be decrypted, it can automatically increase the encryption strength of the data or trigger secondary authentication.
[0055] All feedback actions and their effects are recorded again in the blockchain audit log, forming a complete closed loop of "monitoring -> analysis -> decision -> execution -> re-monitoring"; the M_LSTM model will also continuously perform incremental learning using new running data to achieve self-evolution of anomaly detection capabilities.
[0056] In one embodiment of the present invention, the system performs the following steps:
[0057] Active data encryption steps: Receive raw medical data and perform chaotic discretization and layered encryption processing;
[0058] Permission verification and traceability steps: When a data access request is initiated, multi-factor dynamic permission verification is performed, and traceable audit logs are recorded and uploaded to the blockchain;
[0059] Anomaly monitoring and risk assessment steps: Continuously collect and analyze system operation data and equipment status, and use AI models to predict anomalies and assess risks;
[0060] Closed-loop feedback and strategy execution steps: Based on the risk assessment results, the corresponding security policy adjustment instructions are automatically triggered and executed to complete the risk handling closed loop.
[0061] In one embodiment of the present invention, an electronic device is also included, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor performs the steps of the above method.
[0062] In Embodiment 1 of the present invention, it is applied within a large comprehensive hospital, aiming to solve the problem of secure storage and controlled access to heterogeneous data generated by multiple systems such as outpatient, inpatient, laboratory, and imaging in a unified data platform.
[0063] System Deployment and Composition:
[0064] The core server cluster of this system is deployed in the hospital's data center, including encrypted computing nodes, blockchain consensus nodes, AI analysis nodes, and policy management nodes. Various medical business systems (HIS, EMR, PACS, LIS) interface with the hospital's system through a secure API gateway. A digital identity certificate based on the national cryptographic algorithm SM2 is generated for each patient, serving as their unique identifier within the system.
[0065] Data flow and security control:
[0066] Data Acquisition and Active Encryption: Patient vital sign data v collected by the nurse workstation is first subjected to Logistic chaotic mapping to generate discrete sequences. Since this data needs to be frequently accessed in real-time by the doctor's workstation and is sensitive to latency, it is quickly encrypted using the AES-256-GCM algorithm before storage. The encryption key is dynamically generated and authorized by the intelligent access control and traceability module based on the doctor's role and current treatment task.
[0067] Fine-grained access and traceability: A gastroenterologist attempts to access a patient's gastroscopy images and pathology report. The system first verifies the patient's SM2 digital certificate, then the intelligent permissions and traceability module is activated:
[0068] a) The RBAC determined that he had the role of a "gastroenterologist";
[0069] b) ABAC further determines whether its "currently treated patient" attribute matches the target patient;
[0070] c) Upon reviewing the patient privacy policy, it was found that the pathology report was marked as "highly sensitive" and required additional authorization. The doctor initiated an access request, which was temporarily granted after authorization was obtained through the patient's mobile app (patient management platform).
[0071] The operation details, timestamps, doctor IDs, and patient authorization records of this "request-authorization-access" process were generated into a Merkle tree hash, and after passing the BFT consensus, they were written into the hospital's internal blockchain to form an undeniable audit chain.
[0072] Anomaly Detection and Risk Assessment: The distributed anomaly detection and risk assessment module runs continuously. Its LSTM model M_LSTM analyzes the time-series patterns X (such as access frequency, time, and SQL statement type) of database access logs over the past week. Late one night, the model predicted a large-scale batch download of medical records from a certain internal IP address within the next hour, Y_predicted, which deviated significantly from the normal pattern. Simultaneously, the storage device periodic performance module calculated an upward trend in the "read / storage failure coefficient" of the SSD array hosting the core database, issuing a low-risk warning.
[0073] Closed-loop policy feedback and execution: The closed-loop policy feedback and optimization module receives the aforementioned risk signals. Regarding the abnormal access prediction, it immediately executes preset rules: First, it "challenges" the session initiated by the IP address, requiring secondary biometric authentication (such as fingerprinting); second, it temporarily reduces the access permissions to "read-only" and restricts download functionality. Regarding the storage device warning, it automatically initiates a data migration task, migrating some less active "warm data" from the SSD array to another healthy storage pool. All these intervention actions ("triggering secondary authentication," "restricting permissions," and "initiating data migration") are themselves recorded on the blockchain as new "policy change events." Subsequently, the module continues to monitor the system operation data after the intervention, confirming that the abnormal access attempt has terminated and the device load has decreased, thus verifying the effectiveness of the feedback actions and completing this closed loop. The data from this event is also used to fine-tune the M_LSTM model, enhancing its ability to identify similar abnormal patterns.
[0074] Furthermore, after deployment in the hospital, this embodiment achieved precise access control and full transparent traceability for internal data access, resulting in a decrease of over 70% in patient privacy complaints. Through a closed-loop feedback mechanism, it successfully blocked three potential internal data breaches before they occurred and reduced the risk of service interruption due to storage device performance degradation by approximately 60%.
[0075] In the description of this invention, it should be understood that the terms "longitudinal", "lateral", "up", "down", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing this invention, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this invention.
[0076] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.
Claims
1. A data security storage system based on network security, characterized in that, include: The active data encryption module is used to perform discretization preprocessing on raw medical data based on chaotic mapping, and to encrypt it using a layered hybrid encryption strategy according to the data sensitivity level and application scenario. The intelligent access control and traceability module, built on blockchain technology, is used to achieve fine-grained dynamic access control, patient self-management of privacy policies, and to ensure the immutability and full traceability of all data operation logs through a consensus mechanism. The distributed anomaly detection and risk assessment module is used to collect system time-series operation data from multiple dimensions, predict abnormal behavior through principal component analysis dimensionality reduction and long short-term memory network model, and periodically assess the health status of storage devices. The closed-loop strategy feedback and optimization module is used to execute predefined dynamic security strategy adjustment actions based on the output of the anomaly detection and risk assessment module, and to feed back the adjustment effect to the system.
2. The data security storage system based on network security according to claim 1, characterized in that: In the active data encryption module, the discretization preprocessing based on chaotic mapping uses chaotic mapping, and its calculation formula is as follows: xn+1=εxn(1-xn); Where ε is a constant in the interval [0, 4].
3. A data security storage system based on network security according to claim 1, characterized in that: The layered hybrid encryption strategy includes using SM4 or AES-256-GCM symmetric encryption for statically stored data, and using proxy re-encryption or homomorphic encryption technology based on elliptic curve encryption for data that needs to be shared or computed across institutions.
4. A data security storage system based on network security according to claim 1, characterized in that: The intelligent permission and traceability module integrates role-based access control, attribute-based access control models, and zero-knowledge proof protocols.
5. A data security storage system based on network security according to claim 1, characterized in that: The operation log is generated by integrating operation details, timestamps, and operator identification using a Merkle tree algorithm to generate a log summary; after verification using a Byzantine fault-tolerant consensus algorithm, it is added to the blockchain.
6. A data security storage system based on network security according to claim 1, characterized in that: In the distributed anomaly detection and risk assessment module, during principal component analysis dimensionality reduction, the formula for calculating the eigenvalue contribution rate of the first j principal components is as follows: αj = Σ(i=1 to j) λi / Σ(i=1 to n) λi; Where λi is the eigenvalue and i is the storage device.
7. A data security storage system based on network security according to claim 1, characterized in that, The dynamic security policy adjustment actions performed by the closed-loop policy feedback and optimization module include: triggering secondary authentication, dynamically upgrading or downgrading user access permissions, isolating or restricting abnormal nodes, automatically migrating data on high-risk storage devices, and adjusting member credit scores and rights in the data sharing ecosystem.
8. A data security storage system based on network security according to claim 1, characterized in that: It also includes a patient management platform that interacts with the intelligent permission and traceability module, allowing patients to edit privacy policies, view access monitoring information, and grant real-time authorization for access requests from medical staff.