Medical data anonymous distribution system, method, medium and terminal based on edge computing

Abstract

The application provides an edge computing-based medical data anonymous distribution system, method, medium and terminal, receives collected initial medical data, processes the initial medical data into corresponding hierarchical anonymous medical data according to a medical data calling request received from a data consumption layer through an edge node, and displays the corresponding hierarchical anonymous medical data to a user. The application overcomes the technical problems of single medical data anonymization processing means, high risk of leakage and lack of correlation between anonymous data in the prior art, can balance privacy compliance and data correlation at the source of multi-source medical data, and is suitable for diversified medical data protection and distribution requirements.

Description

Technical Field

[0001] This invention relates to the field of medical data protection, and in particular to a medical data anonymization distribution system, method, medium, and terminal based on edge computing. Background Technology

[0002] With the acceleration of healthcare digitalization, massive amounts of patient diagnosis and treatment data and health monitoring data are demonstrating immense value in clinical care, medical research, and hospital management, becoming core assets driving the upgrading of medical services and scientific innovation. However, medical data contains a large amount of sensitive personal information, and the inherent contradiction between its use and privacy protection is becoming increasingly prominent, with existing technological solutions still having significant limitations.

[0003] On the one hand, privacy compliance requirements are becoming increasingly stringent, with various regulations explicitly requiring the de-identification of patients' personal information. Currently, the industry generally adopts a "one-size-fits-all" approach of high-intensity anonymization, satisfying compliance by deleting or randomly replacing all identity-related information. However, this approach completely severs the cross-record and cross-time-based medical records of the same patient, making the data unable to support core scenarios such as longitudinal clinical research and long-term efficacy tracking, and severely damaging the scientific research and practical value of the data.

[0004] On the other hand, traditional data processing often employs a centralized architecture, requiring raw, sensitive data from various medical institutions to be transmitted to a central platform for unified processing. This not only poses risks of privacy breaches due to large-scale network transmission and centralized storage but also suffers from high bandwidth consumption and significant processing latency. Furthermore, data consumers exhibit diverse roles and needs. Clinicians require precise diagnostic data to ensure continuous care, while researchers need group correlation data to conduct trend analysis. However, current technologies can only provide static copies of data with a fixed level of anonymity, failing to achieve the refined adaptation of "on-demand services," further hindering the effective utilization of medical data. Summary of the Invention

[0005] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide a medical data anonymization distribution system, method, medium and terminal based on edge computing, to solve the technical problems of the existing medical data anonymization processing methods being singular, the risk of leakage being high, and the lack of correlation between anonymized data.

[0006] To achieve the above and other related objectives, this invention provides a medical data anonymization distribution system based on edge computing. The system includes: a data source layer, an edge processing layer, and a data consumption layer. The data source layer receives initial medical data. The edge processing layer, connected to the data source layer, includes multiple edge nodes for processing the initial medical data into corresponding graded anonymized medical data based on medical data request requests received from the data consumption layer. The data consumption layer, connected to the edge processing layer, displays the corresponding graded anonymized medical data to the user.

[0007] In one embodiment of the present invention, each edge node includes: a hierarchical mapping module, a dynamic adaptation module, an anonymization execution module, and a data distribution module; wherein, the hierarchical mapping module is used to classify the sensitivity of initial medical data; the dynamic adaptation module, connected to the hierarchical mapping module, is used to generate an adapted anonymization instruction based on the received medical data call request; the anonymization execution module, connected to the dynamic adaptation module, is used to generate hierarchically anonymized medical data based on the anonymization instruction; and the data distribution module, connected to the anonymization execution module, is used to distribute the hierarchically anonymized medical data to the data consumption layer and upload the corresponding log information to the blockchain.

[0008] In one embodiment of the present invention, the hierarchical mapping module is used to call the mapping relationship of the corresponding usage scenario in the scenario mapping library based on the usage scenario in the medical data call request; based on the mapping relationship, the initial medical data is input into the medical data sensitivity hierarchical model to perform sensitivity hierarchical classification of the initial medical data fields; wherein, the medical data sensitivity hierarchical model is used to classify the initial medical data fields into direct identifiers, quasi-identifiers, sensitive medical information and general information according to the sensitivity level from high to low.

[0009] In one embodiment of the present invention, the dynamic adaptation module is used to generate anonymization instructions based on the user identity, relevance requirements, usage scenario and data sensitivity level in the medical data retrieval request.

[0010] In one embodiment of the present invention, the anonymization execution module is used to call multiple anonymization algorithms based on the anonymization instructions, and to perform graded anonymization processing on the initial medical data based on each anonymization algorithm to obtain graded anonymized medical data; wherein, the types of anonymization algorithms include: EMPI-based pseudonymization algorithms and general anonymization algorithms.

[0011] In one embodiment of the present invention, the anonymization process of the EMPI pseudonymization algorithm includes: invoking the EMPI-based pseudonymization algorithm based on the association instruction in the anonymization instruction, matching multi-source data of the same patient through EMPI technology to generate a unique index; establishing a one-to-one encrypted mapping relationship between the unique index and meaningless pseudonym IDs to generate hierarchical anonymized medical data that retains the association relationship of the same patient's data.

[0012] In one embodiment of the present invention, the anonymization process of the general anonymization algorithm includes: calling the general anonymization algorithm based on the non-association instruction in the anonymization instruction to perform non-association anonymization processing on the initial medical data, generating hierarchically anonymized medical data of each field of the same patient; wherein, the general anonymization algorithm includes a generalization algorithm, a suppression algorithm, and a differential privacy noise injection algorithm.

[0013] To achieve the above and other related objectives, the present invention provides a method for anonymous distribution of medical data based on edge computing. The method includes: receiving initial medical data; processing the initial medical data into corresponding hierarchical anonymous medical data through an edge node according to a medical data call request received from the data consumption layer; and displaying the corresponding hierarchical anonymous medical data to the user.

[0014] To achieve the above and other related objectives, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the aforementioned method for anonymous distribution of medical data based on edge computing.

[0015] To achieve the above and other related objectives, the present invention provides an electronic terminal, comprising: one or more memories and one or more processors; the one or more memories being used to store a computer program; and the one or more processors being connected to the memories and used to run the computer program to execute the edge computing-based anonymous medical data distribution method.

[0016] As described above, this invention is a medical data anonymization distribution system, method, medium, and terminal based on edge computing, which has the following beneficial effects: This invention receives initial medical data; through edge nodes, based on the received medical data call requests from the data consumption layer, it processes the initial medical data into corresponding hierarchical anonymized medical data; and it displays the corresponding hierarchical anonymized medical data to the user. This invention overcomes the technical problems of existing medical data anonymization processing methods being singular, having a high risk of leakage, and lacking correlation between anonymized data. It can balance privacy compliance and data correlation at the source of multi-source medical data, adapting to diverse medical data protection and distribution needs. Attached Figure Description

[0017] Figure 1 The diagram shown is a schematic of a module of an edge computing-based anonymous medical data distribution system according to an embodiment of the present invention.

[0018] Figure 2 The diagram shown is a structural schematic of an edge computing-based anonymous medical data distribution method according to an embodiment of the present invention.

[0019] Figure 3 The diagram shown is a structural schematic of an electronic terminal according to an embodiment of the present invention. Detailed Implementation

[0020] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and features described therein can be combined with each other.

[0021] It should be noted that in the following description, reference is made to the accompanying drawings, which illustrate several embodiments of the invention. It should be understood that other embodiments may also be used, and changes in mechanical composition, structure, electrical system, and operation may be made without departing from the spirit and scope of the invention. The following detailed description should not be considered limiting, and the scope of the embodiments of the invention is defined only by the claims of the published patents. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. Spatially related terms, such as “upper,” “lower,” “left,” “right,” “below,” “below,” “lower part,” “above,” “upper part,” etc., may be used herein to illustrate the relationship between one element or feature shown in the figures and another element or feature.

[0022] Throughout this specification, when it is said that a part is "connected" to another part, this includes not only "direct connection" but also "indirect connection" by placing other elements in between. Furthermore, when it is said that a part "includes" a certain constituent element, unless otherwise stated otherwise, this does not exclude other constituent elements, but rather means that other constituent elements may also be included.

[0023] The terms "first," "second," and "third," etc., used herein are for the purpose of describing various parts, components, regions, layers, and / or segments, but are not limiting. These terms are used only to distinguish one part, component, region, layer, or segment from others. Therefore, the "first part," "component," "region," "layer," or "segment" described below may refer to a "second part," "component," "region," "layer," or "segment" without departing from the scope of this invention.

[0024] Furthermore, as used herein, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context indicates otherwise. It should be further understood that the terms “comprising,” “including,” indicate the presence of the stated feature, operation, element, component, item, kind, and / or group, but do not preclude the presence, occurrence, or addition of one or more other features, operations, elements, components, items, kinds, and / or groups. The terms “or” and “and / or” as used herein are interpreted as inclusive, or mean any one or any combination thereof. Thus, “A, B, or C” or “A, B, and / or C” means “any one of: A; B; C; A and B; A and C; B and C; A, B, and C.” Exceptions to this definition arise only when combinations of elements, functions, or operations are inherently mutually exclusive in some manner.

[0025] This invention provides a medical data anonymization distribution system, method, medium, and terminal based on edge computing. The invention receives initial medical data; through edge nodes, based on medical data call requests received from the data consumption layer, it processes the initial medical data into corresponding hierarchical anonymized medical data; and then displays the corresponding hierarchical anonymized medical data to the user. This invention overcomes the technical problems of existing medical data anonymization methods being singular, having a high risk of leakage, and lacking correlation between anonymized data. It can balance privacy compliance and data correlation at multi-source medical data sources, adapting to diverse medical data protection and distribution needs.

[0026] The present invention will now be described in detail with reference to the accompanying drawings, so that those skilled in the art can readily implement it. The present invention can be embodied in many different forms and is not limited to the embodiments described herein.

[0027] like Figure 1 This diagram illustrates a module schematic of an edge computing-based anonymous medical data distribution system 100 according to an embodiment of the present invention.

[0028] The system 100 includes: a data source layer 101, an edge processing layer 102, and a data consumption layer 103; wherein, the data source layer 101 is used to receive collected initial medical data; the edge processing layer 102, connected to the data source layer 101, includes: multiple edge nodes, used to process the initial medical data into corresponding graded anonymized medical data according to the medical data call request received from the data consumption layer 103; the data consumption layer 103, connected to the edge processing layer 102, is used to display the corresponding graded anonymized medical data to the user.

[0029] In one embodiment, the data source layer 101 serves as the core for the acquisition and raw storage of medical data in this invention. It is used to integrate multi-dimensional medical data acquisition terminals and securely store the acquired initial medical data in the local storage unit of the medical data center after standardized preprocessing.

[0030] Specifically, the data acquisition terminals of the data source layer 101 cover core hospital business systems such as Hospital Information System (HIS), Laboratory Information System (LIS), and Medical Image Archiving and Communication System (PACS), clinical laboratory equipment such as blood glucose meters and blood routine analyzers, wearable health monitoring devices such as smart blood pressure monitors, dynamic electrocardiogram monitors, and doctor-end input devices, etc. The initial medical data collected includes multiple types of key fields: direct identifiers such as patient name, ID number, and mobile phone number; quasi-identifiers such as date of birth, gender, postal code, and department of visit; sensitive medical information such as diagnosis results, medication records, test values, surgical plans, and general information such as consultation time and examination item names.

[0031] During the data collection process, the data source layer 101 performs format standardization processing on heterogeneous data output from multiple terminals, such as structured test reports and semi-structured medical record texts. This includes standardizing field naming and data type conversion. At the same time, lightweight preprocessing such as data deduplication and missing value marking ensures the integrity and consistency of the original data. Subsequently, the processed initial medical data is stored in the local storage module. The data storage can adopt an organization method that combines patient ID partitioning and timestamp indexing. This facilitates the edge processing layer 102 to quickly retrieve the target data and avoids the transmission of original sensitive data across nodes, reducing the risk of privacy leakage from the source.

[0032] In one embodiment, the edge processing layer 102 includes: a hierarchical mapping module 1021, a dynamic adaptation module 1022, an anonymization execution module 1023, and a data distribution module 1024; wherein, the hierarchical mapping module 1021 is used to perform sensitivity classification on initial medical data; the dynamic adaptation module 1022, connected to the hierarchical mapping module 1021, is used to generate adapted anonymization instructions based on received medical data call requests; the anonymization execution module 1023, connected to the dynamic adaptation module 1022, is used to generate hierarchically anonymized medical data based on the anonymization instructions; and the data distribution module 1024, connected to the anonymization execution module 1023, is used to distribute the hierarchically anonymized medical data to the data consumption layer 103 and upload the corresponding log information to the blockchain.

[0033] Specifically, the edge processing layer 102, as the execution unit for the anonymization and secure distribution of medical data in this invention, is deployed inside the edge node of the medical data center. Relying on the local computing power, storage, and network resources of the node, it achieves the anonymized distribution of medical data through the collaborative operation of multiple modules. The specific functions and execution logic of each module are as follows:

[0034] The edge processing layer 102 includes: a hierarchical mapping module 1021, a dynamic adaptation module 1022, an anonymization execution module 1023, and a data distribution module 1024.

[0035] In one embodiment, the hierarchical mapping module 1021 pre-installs the scene mapping library and the medical data sensitivity hierarchical model in the encrypted storage unit of the edge node, and supports administrators to update rules and manage versions through a secure channel. The medical data sensitivity grading model, based on the Personal Information Protection Law and medical data security standards, divides initial medical data fields into four levels: Level L1 corresponds to direct identifiers, such as patient name, ID number, and mobile phone number, which can directly locate an individual's identity; Level L2 corresponds to quasi-identifiers, such as date of birth, gender, postal code, and department of visit, which are not identifiable individually but can identify an individual when combined; Level L3 corresponds to sensitive medical information, such as diagnosis results, medication records, test values, and surgical plans, involving health privacy and core treatment; and Level L4 corresponds to general information, such as consultation time, examination item name, and hospital name, which have no direct privacy association. The scenario mapping library predefines the corresponding mapping rules for user roles, usage scenarios, anonymization levels, and algorithm combinations, such as "Clinician - Continuous Care Scenario - Retain L3 / L4 Accuracy + L1 Pseudonymization + L2 Mild Generalization - EMPI Pseudonymization Algorithm," and "Researcher - Group Efficacy Analysis Scenario - Retain L3 / L4 Statistical Value + L1 Complete Hiding + L2 Heavy Generalization - Generalization + Algorithms such as "Differential Privacy Noise Injection Algorithm" and "Administrative Personnel - Macro-operation Statistics Scenario - L4+L1 / L2 / L3 Retention - Suppression Algorithm" provide clear rule bases for the dynamic adaptation module 1022.

[0036] In one embodiment, the dynamic adaptation module 1022 serves as the decision core of the edge processing layer 102. It first parses the core metadata elements in the medical data call request, accurately calls the scenario mapping library in the hierarchical mapping module 1021 based on the usage scenario, matches the corresponding preset mapping relationship, and then determines the basic data sensitivity level that adapts to the usage scenario. Then, it combines the user identity and relevance requirements in the call request, overlays the actual field sensitivity features of the initial medical data and the real-time network status of the edge node, and generates accurate anonymization instructions through a multi-attribute weighted decision algorithm to ensure that the instructions not only meet privacy compliance requirements but also maximize the retention of the data's practical value.

[0037] Specifically, the dynamic adaptation module 1022 first extracts the usage scenario description from the medical data retrieval request, such as "3-year medication efficacy tracking for type 2 diabetes patients," "regional medical resource allocation statistics," and "retrieval of continuous care data for emergency patients." Then, it matches the corresponding rules in the scenario mapping library according to scenario type, such as clinical diagnosis and treatment, medical research, administrative statistics, and public health monitoring. For example, the "clinical diagnosis and treatment" scenario matches the basic rule of "preserving L3 / L4 level data accuracy, L1 level pseudonymization, and L2 level mild generalization"; the "administrative statistics" scenario matches the rule of "only retaining L4 level data and L1-L3 level suppression processing." This matching process supports fuzzy scenario recognition. If the requested scenario description is unclear, a default compliance rule will be triggered, initially matching according to the highest privacy protection level, and then adjusted based on other factors.

[0038] The system synchronously extracts user identification identifiers from the call requests, such as clinician employee IDs, research institution registration numbers, and administrative personnel permission IDs. It verifies the legitimacy of the identity using a pre-stored user identity-permission level mapping table on the edge nodes, and simultaneously retrieves the corresponding permission scope. For example, registered pharmaceutical company researchers can only access general medical data and are not authorized to access precise diagnosis and treatment details for individual patients; emergency room doctors, on the other hand, can access more private data about their patients. This ensures that anonymization commands strictly match user permissions, preventing unauthorized access.

[0039] In addition, the system analyzes implicit or explicit correlation requirements in medical data retrieval requests, such as whether the request contains keywords like "cross-time records," "multi-institutional data integration," or "follow-up of the same patient." If it identifies data correlation that needs to be preserved, such as longitudinal efficacy analysis in research scenarios or continuous care in clinical scenarios, it determines that the EMPI-based pseudonymization algorithm should be prioritized. If correlation is not required, such as in single-statistical analysis or anonymous population data sampling, it determines that a general anonymization algorithm should be used to ensure that the algorithm selection is highly consistent with the purpose of data use.

[0040] Finally, based on the data sensitivity level, and considering user identity permissions, correlation requirements, and the actual field characteristics of the initial medical data, a multi-attribute weighted decision algorithm is used to determine the final anonymization scheme. The anonymization instruction includes complete execution parameters: target algorithm type, field processing strategies for each level, data output format, transmission priority, etc., ensuring that the anonymization execution module 1023 can directly and accurately execute the instructions.

[0041] In one embodiment, the anonymization execution module 1023 is used to call the corresponding anonymization algorithm based on the anonymization instruction, and to perform anonymization and grading processing on the initial medical data based on the anonymization algorithm to obtain graded anonymized medical data. The anonymization execution module 1023, as the core execution unit of the edge processing layer 102, relies on the local computing power and encrypted storage resources of the edge node. It first parses the anonymization instruction issued by the dynamic adaptation module 1022, extracts the correlation requirement identifier, and accurately calls the corresponding anonymization algorithm; then, based on the algorithm, it performs targeted grading processing on the initial medical data stored locally on the edge node, ultimately generating graded anonymized medical data that meets the scenario requirements.

[0042] Specifically, the process of invoking the corresponding algorithm based on the anonymization instruction and completing the hierarchical processing is as follows:

[0043] When the anonymization instruction includes a command to retain the association identifier of the same patient data, i.e., the association instruction, the anonymization execution module 1023 calls the EMPI-based pseudonymization algorithm. Through the process of identity matching-index generation-pseudonym binding-hierarchical processing, the true identity is hidden while the association relationship of the same patient across records and across time is fully preserved.

[0044] The anonymization execution module 1023 first retrieves initial medical data locally from the edge node, initiates the EMPI multi-source data association mechanism, and constructs the foundation for patient data association. For the same patient's multi-source heterogeneous data in the initial medical data (including hospital HIS medical records, LIS test results, PACS image data, and wearable device monitoring data), a fusion strategy of deterministic and probabilistic matching is used to conduct precise identity matching. Deterministic matching relies on precise fields such as name, ID number, and medical card number to quickly associate patient records with complete fields. Probabilistic matching, on the other hand, for records with missing fields or errors, such as homophones in names or incomplete postal codes, calculates similarity by extracting feature information such as date of birth, gender, and disease diagnosis, ensuring that patient records across systems and time dimensions can be accurately associated. Based on the matching results, a globally unique and persistent EMPI index is generated as the core identifier for associating all data of the same patient. This index is stored only in the local encrypted storage unit of the edge node and is not transmitted externally.

[0045] Based on the aforementioned EMPI unique index, a one-to-one mapping relationship is established between it and meaningless pseudonym IDs. These pseudonym IDs are generated using a fixed prefix and random characters, containing no semantic information that can be used to deduce the patient's true identity. The mapping relationship is stored using a specific encryption algorithm and is accessible only to authorized administrators through multi-factor authentication. For example, this mapping relationship can be used to replace L1-level identifiers in the initial medical data, such as name, ID number, and mobile phone number, with meaningless pseudonym IDs. Simultaneously, hierarchical processing is performed, with slight generalization of L2-level quasi-identifiers such as date of birth and postal code, while maintaining accuracy for L3-level sensitive medical information and L4-level general information, ensuring that the data hierarchical processing meets the requirements of the scenario.

[0046] By replacing real identity identifiers with meaningless pseudonyms and encrypting the mapping relationship for dual protection, this invention completely severs the direct link between medical data and the patient's real identity, avoiding privacy leakage risks from the source of data processing. This fully complies with the compliance requirements for de-identification of sensitive personal information in the Personal Information Protection Law and the Medical Data Security Guidelines. Regarding the preservation of anonymized data association, this invention relies on the binding relationship between the EMPI index and pseudonyms to ensure that the generated hierarchical anonymized medical data fully preserves the cross-system and cross-time record associations of the same patient. For example, a patient's medical records from different periods and multiple test results can be linked through the same pseudonym. The generated association-based hierarchical anonymized medical data can be directly adapted to continuous clinical care. Doctors can grasp the patient's complete treatment trajectory through the associated data. In vertical medical research scenarios such as long-term drug efficacy tracking and chronic disease progression analysis, the data can be directly used for analysis without secondary data integration, solving the technical problem of traditional anonymization technologies severing the association of patient data.

[0047] In one embodiment, based on the non-associative instruction in the anonymization instruction, the anonymization execution module 1023 calls a general anonymization algorithm to perform non-associative hierarchical anonymization processing on the initial medical data, generating hierarchical anonymized medical data of different records of the same patient that exist independently and have no correlation clues. The general anonymization algorithm includes, but is not limited to, generalization, suppression, and differential privacy noise injection.

[0048] Specifically, the initial medical data field attributes are first analyzed, and the sensitive fields that need to be processed are accurately located by combining the medical data sensitivity classification model. Then, based on the usage scenario requirements corresponding to the non-related instructions, such as macro-operation statistics, public health group monitoring, and anonymous data sampling analysis, the algorithm combination scheme of generalization, suppression, and differential privacy noise injection is determined. For example, the macro-statistics scenario uses a combination of suppression and heavy generalization algorithms, while the group scientific research sampling scenario uses a combination of generalization and differential privacy noise injection algorithms.

[0049] Furthermore, various general anonymization algorithms can be used in medical data with different sensitivity levels. For example, the suppression algorithm can target L1 level direct identifiers such as name, ID number, and mobile phone number, as well as highly sensitive L3 level fields such as genetic history and diagnosis results of special infectious diseases. By directly executing field deletion operations, it can eliminate carriers that can be directly associated with the patient's identity from the source, thereby avoiding the leakage of individual information.

[0050] For example, the generalization algorithm can adjust the generalization granularity according to the scenario requirements for L2 quasi-identifiers such as date of birth, postal code, and department of visit, as well as L3 fields that do not require precision. In macro-statistical scenarios, heavy generalization is used, generalizing "blood glucose 8.5mmol / L" to "abnormal blood glucose". In group monitoring scenarios, medium generalization is used, such as generalizing "postal code 310000" to "the range of 310000-310100". By fuzzing, the risk of identifying patients by combining fields is reduced.

[0051] The differential privacy noise injection algorithm can inject L3 level test values, such as blood pressure, blood lipids, and tumor marker concentrations, that require preserving group statistical value while preventing the leakage of individual information. The injection process injects Laplace noise that conforms to a privacy budget ε, using a smaller value to enhance privacy protection in sensitive scenarios and a larger value to balance statistical accuracy in ordinary statistical scenarios. During the injection process, the algorithm dynamically adjusts the noise intensity to ensure that the differences in query results between adjacent datasets are controllable, thus neither leaking individual information nor disrupting the group statistical patterns of the data.

[0052] By employing algorithms such as suppressing associated fields, generalizing fuzzy feature information, and dynamically injecting noise, the correlation links between different records of the same patient are completely severed. This ensures that each piece of data in the generated hierarchical anonymized medical data exists independently, with no traceable links to the same patient, thus solving the problem of associated anonymized data being unsuitable for scenarios requiring unrelated data. Unlike a "one-size-fits-all" full deletion, this approach, through appropriate algorithm combinations, maximizes the preservation of the group statistical value of medical data while severing individual correlations. For example, the noise-injected test data can be used for regional disease incidence statistics, and the generalized outpatient data can be used for medical resource allocation analysis. This approach is suitable for core unrelated scenarios such as macro-level operational statistics, public health monitoring, and anonymized scientific research sampling, achieving a balance between privacy protection and the value of group data.

[0053] In one embodiment, the data distribution module 1024 is used to securely and controllably distribute the hierarchical anonymized medical data generated by the anonymization execution module 1023 to the data consumption layer 103, while uploading key log information of the entire distribution process to the blockchain.

[0054] Specifically, after receiving the hierarchical anonymized medical data output by the anonymization execution module 1023, the data distribution module 1024 first performs a secondary identity verification on the receiving entity of the data consumption layer 103. By matching the consumer identifier in the call request with the identity whitelist pre-stored in the edge node, it confirms that the recipient has the access rights to the corresponding level of data, preventing unauthorized access. At the same time, it automatically adapts the data output format according to the scenario requirements of the data consumption layer 103, ensuring that the data can be directly parsed and called by the consumer system. Secondly, the data distribution is completed through an encrypted communication channel. During transmission, the data is fragmented and a checksum is added to ensure the confidentiality and integrity of data transmission. In case of abnormal situations such as network fluctuations and interruptions, the edge node local caching and breakpoint resumption mechanism is activated. The data fragments that have not been transmitted are temporarily stored in the edge node encrypted cache area and automatically resumed after the network is restored, avoiding data loss or duplicate transmission and ensuring distribution efficiency and stability.

[0055] In addition, the data distribution module 1024 synchronously collects key information throughout the entire distribution process to form standardized logs. The core content includes, but is not limited to, the unique ID of the edge node, the SHA256 hash value of the hierarchical anonymized medical data, the user's identity and permission level, the core parameters of the anonymization command such as the algorithm type and anonymization level, the data distribution timestamp, the data purpose, and the transmission status, ensuring that the log information completely covers all nodes in the entire chain.

[0056] Log information is encrypted and then uploaded to the permissioned blockchain network through a blockchain proxy node. A dual strategy of real-time upload and timed re-upload is adopted. Logs are uploaded in real time under normal network conditions. If the blockchain node is temporarily unavailable, the logs will be temporarily stored in the local secure storage area of ​​the edge node and automatically re-uploaded after the network is restored to ensure that no log information is missed. After the upload is completed, the blockchain node generates an immutable evidence certificate and sends it to the data distribution module 1024 for storage.

[0057] In one embodiment, the data consumption layer 103 and the edge processing layer 102 are stably connected via an encrypted communication link. The core function is to accurately receive graded anonymized medical data from the edge processing layer 102 after initiating a medical data call request. After data integrity verification and compliance checks, the data is adapted to the user's identity type and actual usage scenario, and presented in a visually appealing manner. Finally, the graded anonymized medical data matching the request is accurately delivered to the end user. During data reception, a unique request identifier is used to accurately bind the data to the call request, preventing data confusion and mistransmission. Simultaneously, the transmitted data is encrypted, decrypted, and its integrity is verified to ensure data reception security. The presentation stage can automatically adapt to different scenarios such as clinical diagnosis and treatment, scientific research analysis, and administrative statistics, providing differentiated presentation formats such as treatment timelines, statistical analysis formats, and visual reports. This ensures that the graded anonymized medical data directly meets the user's actual business needs while simultaneously strengthening privacy protection at the data usage end, achieving a balance between compliant use of medical data and efficient service.

[0058] It should be understood that the module division in the embodiments of this application is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods. Furthermore, the functional modules in the various embodiments of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0059] Similar in principle to the above embodiments, such as Figure 2 This invention provides a method for anonymous distribution of medical data based on edge computing.

[0060] Step S21: Receive the initial medical data collected.

[0061] Step S22: Through the edge node, based on the medical data call request received from the data consumption layer, process the initial medical data into corresponding hierarchical anonymized medical data.

[0062] Step S23: Display the corresponding graded anonymized medical data to the user.

[0063] Since the implementation principle of the edge computing-based anonymous distribution method for medical data has been described in the foregoing embodiments, it will not be repeated here.

[0064] To better illustrate the edge computing-based anonymous distribution method for medical data, a specific example is a collaboration between a regional medical research platform and a hospital. This regional medical research platform needs to provide data on drug efficacy to the cooperating pharmaceutical company while strictly protecting patient privacy.

[0065] Example 1: A method for anonymous distribution of medical data at the edge of a medical research platform and a medical data center of a cooperating hospital.

[0066] Step 1: Begin.

[0067] Preliminary Deployment and Rule Configuration: The medical data center edge nodes described in this invention are deployed in each cooperating hospital. The deployment and debugging of each functional module of the edge processing layer are completed to ensure the compatibility of each module with the hospital's existing HIS, LIS and other systems. Exclusive rules are configured for "pharmaceutical company researchers" users: allowing them to access the data combination of "L1-level pseudonymization + L2-level generalization + L3 / L4-level precise retention" in the "drug efficacy analysis" usage scenario.

[0068] Step 2: Initiate a medical data access request.

[0069] Pharmaceutical company researchers submit medical data access requests through the regional medical research platform. The requests clearly state that their user role is "pharmaceutical company researcher", the background of use is "efficacy analysis of a certain drug", and submit relevant scientific research filing qualification documents for system pre-verification.

[0070] Step 3: The edge node receives and parses the initial medical data.

[0071] The hospital's edge node receives a patient's original medical record from the hospital's HIS system via the data source layer interface. The record matches the request and contains the following data: {Name: Zhang San, ID Card Number: 110101198005011234, Date of Birth: 1980-05-01, Diagnosis: Type 2 Diabetes, Medication: Metformin, Blood Glucose Level: 8.5 mmol / L, Date of Visit: 2023-10-27}. The edge node stores this original medical record in its local encrypted storage unit, awaiting further processing by the edge processing layer.

[0072] Step 4: The edge processing layer generates anonymization instructions.

[0073] The dynamic adaptation module of the edge processing layer receives and parses the call request from pharmaceutical researchers, extracts the core information of the request context (user role: pharmaceutical researcher, usage background: drug efficacy analysis), and accurately matches the corresponding "L1 level pseudonymization + L2 level generalization + L3 / L4 level precise preservation" rule by calling the rule base pre-set in the hierarchical mapping module. Based on this, it generates an adapted anonymization instruction, explicitly specifying the call to the EMPI-based pseudonymization algorithm to complete the data processing.

[0074] Step 5: The anonymized execution module performs hierarchical processing.

[0075] The anonymization execution module receives the anonymization command from the dynamic adaptation module and starts the EMPI-based pseudonymization algorithm: First, it calls the EMPI service to perform identity matching on the received initial medical data. After confirming the unique identifier of the patient corresponding to the record, it generates a persistent meaningless pseudonym "PID_ALPHA". Then, it replaces the L1 level "Zhang San" (name) and "110101198005011234" (ID number) in the original record with this pseudonym, generalizes the L2 level "1980-05-01" (date of birth) to "40-44 years old", and completely retains the L3 level "Type 2 diabetes" (diagnosis), "metformin" (medication), "8.5mmol / L" (blood glucose level) and the L4 level "2023-10-27" (visit time). The final graded anonymous medical record is generated as follows: {PID: PID_ALPHA, Age group: 40-44, Diagnosis: Type 2 diabetes, Medication: Metformin, Blood glucose level: 8.5mmol / L, Date of visit: 2023-10-27}.

[0076] Step 6: Secure data distribution and log uploading.

[0077] The data distribution module receives the hierarchical anonymized medical records output by the anonymization execution module. It first performs a secondary verification of the pharmaceutical company's research personnel's identity. Once verified, the anonymized record is securely sent to the research personnel's terminal device via a TLS 1.3 encrypted communication channel. Simultaneously, the data distribution module collects key information from the entire distribution process and generates a standardized transaction log: [Node: Hospital A Edge Node, Data Hash: HASH_XYZ, User: Pharmaceutical Company B, Anonymization Instruction: Research-grade, Background: Efficacy Analysis, Time: 2023-10-27 10:00:00]. This log is then encrypted and uploaded to the blockchain network for evidence storage, forming an immutable audit trail.

[0078] Step 7: End.

[0079] Pharmaceutical researchers successfully received graded anonymized medical data, which can be directly used for drug efficacy research. The entire data processing and distribution process did not leak patients' real privacy information and fully preserved the data correlation value and accuracy required for the research.

[0080] This invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the methods described above.

[0081] The edge computing-based anonymous medical data distribution system provided in this invention can be implemented on the terminal side or the server side. Regarding the hardware structure of the electronic terminal, please refer to... Figure 3 This is a schematic diagram of an optional hardware structure of an electronic terminal 3000 provided in an embodiment of the present invention. The electronic terminal 3000 can be a mobile phone, computer device, tablet device, personal digital processing device, factory back-end processing device, etc. The electronic terminal 3000 includes: at least one processor 3001, a memory 3002, at least one network interface 30010, and a user interface 3009. The various components in the device are coupled together through a bus system 3005. It is understood that the bus system 3005 is used to realize the connection and communication between these components. In addition to a data bus, the bus system 3005 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 3 The general will label all buses as bus systems.

[0082] The user interface 3009 may include a monitor, keyboard, mouse, trackball, clicker, button, touchpad, or touch screen.

[0083] It is understood that memory 3002 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM) or programmable read-only memory (PROM), used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM) and synchronous static random access memory (SSRAM). The memories described in the embodiments of this invention are intended to include, but are not limited to, these and any other suitable categories of memory.

[0084] In this embodiment of the invention, the memory 3002 is used to store various types of data to support the operation of the terminal 3000. Examples of this data include: any executable program for operation on the electronic terminal 3000, such as operating system 30021 and application program 30022; operating system 30021 includes various system programs, such as framework layer, core library layer, driver layer, etc., for implementing various basic services and handling hardware-based tasks. Application program 30022 may include various applications, such as media player, browser, etc., for implementing various application services. The edge computing-based anonymous medical data distribution system provided in this embodiment of the invention can be included in application program 30022.

[0085] The methods disclosed in the above embodiments of the present invention can be applied to or implemented by processor 3001. Processor 3001 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by integrated logic circuits in the hardware of processor 3001 or by instructions in software form. Processor 3001 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 3001 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. General-purpose processor 3001 may be a microprocessor or any conventional processor, etc. The steps of the accessory optimization method provided in the embodiments of the present invention can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory. The processor reads information from the memory and, in conjunction with its hardware, completes the steps of the aforementioned methods.

[0086] In an exemplary embodiment, the electronic terminal 3000 may be used by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), or complex programmable logic devices (CPLDs) to execute the aforementioned method.

[0087] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented using computer program-related hardware. The aforementioned computer program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0088] In the embodiments provided in this application, the computer-readable and writable storage medium may include read-only memory, random access memory, EEPROM, CD-ROM or other optical disc storage devices, disk storage devices or other magnetic storage devices, flash memory, USB flash drive, portable hard drive, or any other medium capable of storing desired program code in the form of instructions or data structures and accessible by a computer. Additionally, any connection may be appropriately referred to as a computer-readable medium. For example, if instructions are transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. However, it should be understood that computer-readable and writable storage media and data storage media do not include connections, carrier waves, signals, or other transient media, but are intended for non-transient, tangible storage media. The disks and optical discs used in the application include compact optical discs (CDs), laser optical discs, optical discs, digital multifunction optical discs (DVDs), floppy disks, and Blu-ray discs, where disks typically copy data magnetically, while optical discs use lasers to copy data optically.

[0089] In summary, this invention provides a medical data anonymization distribution system, method, medium, and terminal based on edge computing, offering the following advantages: The invention receives initial medical data; through edge nodes, it processes the initial medical data into corresponding hierarchical anonymized medical data based on medical data call requests received from the data consumption layer; and it displays the corresponding hierarchical anonymized medical data to the user. This invention overcomes the technical problems of existing medical data anonymization methods being singular, having a high risk of leakage, and lacking correlation between anonymized data. It can balance privacy compliance and data correlation at multi-source medical data sources, adapting to diverse medical data protection and distribution needs.

[0090] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. A medical data anonymization distribution system based on edge computing, characterized in that, include: Data source layer, edge processing layer, and data consumption layer; among them, The data source layer is used to receive the initial medical data collected. The edge processing layer, connected to the data source layer, includes: multiple edge nodes, used to process the initial medical data into corresponding graded anonymous medical data according to the medical data call request received from the data consumption layer; The data consumption layer, connected to the edge processing layer, is used to display the corresponding hierarchical anonymized medical data to the user.

2. The edge computing-based anonymous medical data distribution system according to claim 1, characterized in that, Each edge node includes: a hierarchical mapping module, a dynamic adaptation module, an anonymization execution module, and a data distribution module; among which, The graded mapping module is used to grade the sensitivity of the initial medical data; The dynamic adaptation module is connected to the hierarchical mapping module and is used to generate adapted anonymized instructions based on the received medical data call request. The anonymization execution module is connected to the dynamic adaptation module and is used to generate hierarchical anonymized medical data based on the anonymization instructions. The data distribution module, connected to the anonymization execution module, is used to distribute the hierarchical anonymized medical data to the data consumption layer and upload the corresponding log information to the blockchain.

3. The edge computing-based anonymous medical data distribution system according to claim 2, characterized in that, The hierarchical mapping module is used to call the mapping relationship of the corresponding use scenario in the scenario mapping library based on the use scenario in the medical data call request; Based on the mapping relationship, the initial medical data is input into the medical data sensitivity classification model to classify the sensitivity of the initial medical data fields; The medical data sensitivity grading model is used to classify initial medical data fields into direct identifiers, quasi-identifiers, sensitive medical information, and general information according to their sensitivity level from high to low.

4. The edge computing-based anonymous medical data distribution system according to claim 3, characterized in that, The dynamic adaptation module is used to generate anonymization instructions based on the user identity, related requirements, usage scenarios, and data sensitivity levels in the medical data retrieval request.

5. The edge computing-based anonymous medical data distribution system according to claim 4, characterized in that, The anonymization execution module is used to call multiple anonymization algorithms based on the anonymization instructions, and to perform hierarchical anonymization processing on the initial medical data based on each anonymization algorithm to obtain hierarchical anonymized medical data. The anonymization algorithms include: EMPI-based pseudonymization algorithms and general anonymization algorithms.

6. The edge computing-based anonymous medical data distribution system according to claim 5, characterized in that, The anonymization process of the pseudonymization algorithm of EMPI includes: Based on the correlation instruction in the anonymization instruction, the EMPI-based pseudonymization algorithm is invoked to match multi-source data of the same patient through EMPI technology to generate a unique index; Based on the unique index, a one-to-one encrypted mapping relationship is established with the meaningless pseudonym ID, generating hierarchical anonymized medical data that retains the association relationship of the same patient data.

7. The edge computing-based anonymous medical data distribution system according to claim 5, characterized in that, The anonymization process of the general anonymization algorithm includes: Based on the non-associative instruction in the anonymization instruction, a general anonymization algorithm is invoked to perform non-associative anonymization processing on the initial medical data, generating hierarchical anonymized medical data for each field of the same patient. The general anonymization algorithms include generalization algorithms, suppression algorithms, and differential privacy noise injection algorithms.

8. A method for anonymous distribution of medical data based on edge computing, characterized in that, The method includes: Receive the initial medical data collected; Through edge nodes, the initial medical data is processed into corresponding hierarchical anonymized medical data based on the medical data call requests received from the data consumption layer; The corresponding tiered anonymized medical data will be displayed to the user.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of claim 8.

10. An electronic terminal, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the method of claim 8.

Images