A method and system for constructing a medical informationization data system

Abstract

This invention discloses a method and system for constructing a medical information data system, belonging to the field of big data processing technology. It includes the following steps: collecting medical data; grouping data from the same source into the same data source list; creating an independent logical port for each data source list; dynamically adjusting the computing power allocation value based on the data interaction information of each logical port; dynamically adjusting the storage space allocation value based on the data storage and data interaction information of each logical port; instantiating each logical port into a data management module according to the computing power allocation value and the storage space allocation value; monitoring the interaction behavior of medical data within each data management module, determining the number of target logical ports for the transmission of each piece of medical data, thereby determining the storage level of each piece of medical data, performing hierarchical storage of medical data, and generating a storage file module; and performing multi-layer encryption on the storage file module based on privacy levels to generate an encrypted file.

Description

Technical Field

[0001] This invention relates to the field of big data processing technology, and more specifically, to a method and system for constructing a medical information data system. Background Technology

[0002] Healthcare informatics is a crucial manifestation of the transformation of healthcare services towards digitalization, networking, and intelligence. Its core lies in using computer, network communication, and database technologies to collect, store, process, and exchange medical data to meet the data needs of medical institutions, healthcare professionals, and patients. With the continuous expansion of the scale of medical data and the increasing complexity of its types, the efficient and secure construction and management of healthcare informatics data systems has become key to improving the quality of healthcare services and management efficiency.

[0003] Currently, most common medical information data systems are built based on hospital departments or business modules, organizing data storage and access by department. While this approach achieves structured data management to some extent, it still has significant shortcomings: First, the data organization granularity is coarse, with similar data easily being stored repeatedly across different departments, and dissimilar data lacking effective connections, leading to low efficiency in cross-departmental data integration and retrieval. Second, system resources (such as computing power and storage space) are usually configured statically or distributed simply, making it difficult to adapt to the dynamic fluctuations in the actual data interaction volume and storage needs of different business modules, easily resulting in uneven resource utilization and waste. Third, medical data contains a large amount of sensitive information, and existing systems often have relatively simple encryption strength, access control, and privacy protection mechanisms, failing to adequately address increasingly stringent data security and compliance requirements.

[0004] As can be seen from the above, existing technologies have not yet provided an effective solution for achieving dynamic optimization and refined modular management of medical data system resources while ensuring data security. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, this invention provides a method and system for constructing a medical information data system. It can reduce coupling by dividing logical ports based on data sources and improve utilization by adjusting the resource allocation of each logical port through dynamic monitoring and model calculation.

[0006] The objective of this invention is achieved through the following technical solutions.

[0007] The summary section of this application is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0008] Some embodiments of this application propose a method and system for constructing a medical information data system to solve the technical problems mentioned in the background section above.

[0009] As a first aspect of this application, some embodiments of this application provide a method for constructing a medical information data system, including the following steps: S1: Collect medical data to form an initial medical data set; identify the data categories of medical data in the initial medical data set, and analyze the data source of each data category; group data categories with the same data source into the same data source list, and create an independent logical port for each data source list; S2: Monitor the data interaction and data storage information of each logical port; based on the data interaction information, dynamically adjust the computing power allocation value of each logical port by calculating the instantaneous resource consumption; based on the data storage information and data interaction information, dynamically adjust the storage space allocation value of each logical port through weighted calculation. S3: Based on the computing power allocation value and storage space allocation value, instantiate each logical port into a data management module; monitor the interaction behavior of medical data within each data management module, determine the number of target logical ports for each piece of medical data based on the interaction behavior, determine the storage level of each piece of medical data based on the number of target logical ports, and perform hierarchical storage of medical data according to the storage level to generate a storage file module; S4: Perform multi-layer encryption on the storage file module based on privacy level to generate encrypted files, thus completing the construction of the medical information data system.

[0010] Furthermore, the computing power allocation value of each logic port is dynamically adjusted by calculating instantaneous resource consumption, specifically including: Based on the total computing power and the total number of logical ports of the medical information data system, an initial computing power is pre-allocated to each logical port; Monitor the data interaction information of each logical port within a preset time window; Based on data interaction information, calculate the instantaneous resource consumption of each logical port at each moment within a preset time window. The calculation formula is: ; In the formula: This represents the number of interaction types occurring at the current logical port. Indicates the current logical port at time [time]. The The total computing resource consumption of all interaction types; Indicates the current logical port at time [time]. The computational resource consumption of data processing tasks; The time required for the current logical port to complete the data processing task; Based on the pre-allocated initial computing power and the calculated instantaneous resource consumption of each logical port at each moment within a preset time window, the pre-allocated initial computing power is optimized to obtain the final computing power allocation value.

[0011] Furthermore, the optimization of computing power allocation values ​​is based on the pre-allocated initial computing power, specifically including: Initial computing power is pre-allocated using logical ports. Based on this, the optimal computing power adjustment value is found using the interval traversal method. This makes the adjusted computing power allocation value Instantaneous resource consumption at each moment within the preset time window Overall deviation between Minimum; Overall deviation The calculation formula is: ; In the formula: Indicates the preset time window; Among them, the computing power adjustment value that minimizes the overall deviation is the optimal computing power adjustment value, and the corresponding computing power allocation value is the final computing power allocation value.

[0012] Furthermore, the storage space allocation values ​​for each logical port are dynamically adjusted through weighted calculations, specifically including: Based on the total storage space and the total number of logical ports of the medical information data system, pre-allocate initial storage space for each logical port; Obtain the basic storage requirements and historical interaction volume of each data category managed by each logical port; Calculate the storage space requirement for each logical port separately. The calculation formula is: ; In the formula: This indicates the number of data categories managed within the current logical port. Indicates data category, Indicates data category Historical interaction volume, Indicates data category Basic storage requirements; Based on the storage space requirements of all logical ports, the total system storage space is reallocated to determine the final storage space allocation value for each logical port.

[0013] Furthermore, the storage level of each piece of medical data is determined based on the number of logical ports of the transmission target, specifically including: Based on the relationship between the number of target logical ports for each piece of medical data transmission and the total number of logical ports in the system, a numerical storage level is calculated. The calculation formula is as follows: ; In the formula: For storage level, This represents the total number of logical ports in the system. The number of target logical ports for transmitting medical data; Storage level The higher the value, the smaller the scope of medical data interaction, and the higher the required level of security protection.

[0014] Furthermore, medical data is stored in tiers based on storage levels, specifically including: tiered storage based on storage level. The value is evaluated as follows: when At that time, deep storage is performed on medical data; when At that time, medical data is stored quickly; When 1 < < At that time, balanced storage is performed on medical data.

[0015] Furthermore, the file storage module undergoes multi-layered encryption based on privacy levels, specifically including: The file storage module is encrypted and evaluated based on a predefined privacy level. The medical data content is encrypted using a key derived from the requester's personal password; The storage address of medical data is encrypted using a key randomly generated by the system; The system key, which is tied to the privacy level determined by the assessment, is used to re-encrypt or sign the content and storage address of the encrypted medical data.

[0016] Furthermore, the methods for constructing medical information data systems also include: Step S5: Construct an access control mechanism. The access control mechanism is used to perform authentication, permission judgment, and targeted decryption on the requesting subject of the request to access the encrypted file when the medical information data system is running. Performing targeted decryption specifically includes: Verify the identity of the requesting entity and its access permissions to the data privacy level; Based on the verified identity and access permissions, decrypt the storage address of the encrypted file to locate the encrypted file; Verify the key provided by the requesting entity and decrypt the contents of the encrypted file to recover the medical data.

[0017] As a second aspect of this application, some embodiments of this application provide a system for constructing a medical information data system, including: Data Acquisition and Logical Port Segmentation Module: Used to collect medical data to form an initial medical data set; identify the data categories of medical data in the initial medical data set and analyze the data source of each data category; group data categories with the same data source into the same data source list and create an independent logical port for each data source list; The resource dynamic allocation module is connected to the data acquisition and logical port allocation module. It is used to pre-allocate initial computing power and storage space to each logical port; monitor the data interaction information and data storage information of each logical port; dynamically adjust the computing power allocation value of each logical port based on the data interaction information; and dynamically adjust the storage space allocation value of each logical port based on the data storage information and data interaction information. Modular data storage module: It is communicatively connected to the data acquisition and logical port partitioning module and the resource dynamic allocation module, respectively. It is used to instantiate each logical port into a data management module according to the computing power allocation value and storage space allocation value; it monitors the interaction behavior of medical data in each data management module to determine the number of transmission target logical ports and the corresponding storage level, and performs hierarchical storage of medical data according to the storage level to form a storage file module; Security and Access Control Module: This module connects to the modular data storage module and performs multi-layer encryption on the stored files based on privacy levels to generate encrypted files. Upon receiving an access request, it verifies the identity and access permissions of the requesting entity. If the verification is successful, it performs targeted decryption and outputs the corresponding medical data.

[0018] As a third aspect of this application, some embodiments of this application provide a medical information data system, characterized in that the system is constructed by the method of any one of claims 1 to 8.

[0019] Compared with the prior art, the advantages of this invention are: (1) This invention first organizes the data based on its inherent source (such as medical equipment or information systems), breaking away from the traditional coarse-grained management approach based on departments. By creating an independent logical port for each data source, the decoupling and orderly classification of data in the early stages of system design are achieved, providing a clear logical unit for subsequent differentiated resource allocation and security management based on the characteristics of different logical ports.

[0020] (2) This invention monitors the real-time data interaction and processing volume of the logical ports and uses time-series-based instantaneous resource consumption calculation to accurately quantify their computing power requirements, thereby dynamically adjusting the computing power allocation; at the same time, by incorporating the data interaction volume as a weight into the storage space requirement calculation, it realizes the intelligent tilt allocation of storage space to high-demand and high-heat logical ports, so that system resources (computing power and storage space) can be dynamically matched with the actual load of each logical port, thereby improving the overall resource utilization rate.

[0021] (3) This invention automatically determines the storage level of data based on the interaction range of data within the system (i.e., the number of target logical ports for transmission), enabling deep storage of data used only internally to ensure security, and fast storage of data that needs to be shared globally to ensure efficiency. This automated hierarchical storage strategy based on data interaction behavior achieves an on-demand balance between security and performance.

[0022] (4) This invention implements multi-layered dynamic encryption of data from content to address, and uses a combination of user personal keys and system random keys. During access, strict permission verification and targeted decryption are performed to ensure that only authorized users can access specific data. This method constructs a security mechanism of "opaque data, targeted access", effectively protecting the security of personal information and medical data. Attached Figure Description

[0023] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0024] Figure 1 This is a schematic diagram of the overall process of constructing a medical information data system according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a logical port division based on data source in one embodiment of the present invention; Figure 3 This is a schematic diagram illustrating dynamic adjustment of computing power based on an instantaneous resource consumption model in one embodiment of the present invention; Figure 4 This is a schematic diagram illustrating dynamic allocation of storage space based on interaction popularity weighting in one embodiment of the present invention. Detailed Implementation

[0025] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings and specific embodiments.

[0026] like Figure 1 As shown, this embodiment of the invention first provides a construction system for a medical information data system, including a data acquisition and logical port division module, a resource dynamic allocation module, a data modular storage module, and a security and access control module.

[0027] Specifically, the data acquisition and logical port segmentation module receives raw medical data from multiple heterogeneous sources and categorizes it in a structured manner according to the source of the raw medical data to form a clear management unit.

[0028] The data acquisition and logical port partitioning module includes a data acquisition unit, a source analysis unit, and a logical port partitioning unit.

[0029] The data acquisition unit is used to collect medical data in real time or at regular intervals from various medical information nodes (such as medical testing equipment, electronic medical record systems, hospital management information systems and patient terminals) to form an initial medical data set.

[0030] The source analysis unit communicates with the data acquisition unit to receive and analyze the initial medical dataset. The source analysis unit first identifies and statistically analyzes the data categories (such as test reports, imaging data, and diagnostic texts) within the initial medical data set, tracing the data source of each category—the specific device or system that generated the data. Then, it aggregates multiple data categories with the same data source to form a data source list corresponding to that source. Thus, all data categories with the same data source are grouped into the same data source list.

[0031] The logical port partitioning unit communicates with the source analysis unit to create and manage multiple independent logical ports based on the identified different data sources. Each logical port is configured to specifically manage and control a list of data sources generated by the source analysis unit, corresponding to a single data source, and all the data contained therein.

[0032] Specifically, the data acquisition and logical port segmentation module is the system's data entry point and organizational core, responsible for the initial data access and structuring. The data acquisition unit continuously receives raw medical data from various medical information nodes (such as testing equipment and medical record systems), forming a unified data stream. The source analysis unit then processes this data stream, identifying data categories (such as images and test reports) and tracing the source of each category. Based on the analysis results, the logical port segmentation unit aggregates all data categories with the same source, forming an independent data source list, and creates a dedicated logical port for each list for management. At this point, the raw data stream is decoupled according to its source and distributed to different logical ports, completing the initial organization and distribution of data within the system.

[0033] In one specific embodiment, an image data logical port can be created to manage data generated by all medical imaging devices, and a laboratory data logical port can be created to manage data generated by all laboratory testing systems. The collection of all logical ports constitutes the basic framework for the system's underlying data organization.

[0034] Specifically, the resource dynamic allocation module is communicatively connected to the data acquisition and logical port partitioning module. It is responsible for monitoring the actual operating load of each logical port and dynamically adjusting the allocation strategy of the system's core resources (including computing power and storage space) among the logical ports accordingly. This achieves the matching of resource supply and real-time load to maximize resource utilization efficiency.

[0035] The dynamic resource allocation module includes a resource configuration initialization unit, a computing power dynamic adjustment unit, and a space dynamic adjustment unit.

[0036] The resource configuration initialization unit is used to obtain the total computing power configuration and total storage space configuration of the data system, and to pre-allocate them equally according to the initial number of logical ports, providing a basic share of computing power and storage space for each logical port.

[0037] The dynamic computing power adjustment unit monitors data interaction information (such as access request frequency and data processing task queue) under each logical port in real time. The unit has a built-in specific algorithm model (e.g., a time-series-based instantaneous resource consumption calculation and optimization algorithm) to analyze the fluctuations in computing power demand for each monitored logical port. Based on the analysis results, the unit dynamically allocates computing resources among different logical ports, directing more computing power to high-load logical ports to ensure system response speed and prevent resource idleness on low-load logical ports.

[0038] The dynamic space adjustment unit analyzes the data storage information (such as data type, data volume, and growth trend) and data interaction frequency (such as access frequency) of each logical port. Through a weighted calculation model, the dynamic space adjustment unit allocates higher storage space quotas to logical ports with high data storage demand and frequent access, achieving on-demand and efficient allocation of storage space.

[0039] Specifically, the dynamic resource allocation module is the system's intelligent scheduling center. Through continuous monitoring and analysis, it dynamically adjusts the resource supply to downstream modules. It receives real-time operational status data from each logical port, including data interaction volume, processing task queues, and data storage information such as data type and storage requirements. Its internal dynamic computing power adjustment unit calculates the instantaneous computing power demand of each port based on the interaction information using a time-series analysis model, and dynamically adjusts the computing resources allocated to each port using optimization algorithms. Simultaneously, the dynamic space adjustment unit combines storage information and interaction frequency to dynamically adjust the storage space allocated to each port using a weighted calculation model. The output of this module is not the data itself, but rather real-time updated resource allocation strategies and control commands that act on downstream modules, ensuring precise matching between resource supply and port load.

[0040] The modular data storage module is communicatively connected to the data acquisition and logical port partitioning module and the resource dynamic allocation module, respectively. It is responsible for further logical organization and physical storage of the data within the logical ports based on the allocated resources.

[0041] The modular data storage module includes modular processing units and multi-level storage execution units.

[0042] The modular processing unit instantiates each logical port as an independently running data management module based on the final resource quota determined by the dynamic resource allocation module. The modular processing unit categorizes and integrates the medical data within the logical ports and classifies the collected data according to the interaction relationships between the logical ports (e.g., the number of target logical ports for transmission).

[0043] The multi-level storage execution unit communicates with the modular processing unit to implement differentiated storage strategies. The multi-level storage execution unit stores the tiered medical data in different storage media or paths. For example, sensitive data accessible only on its own logical port is stored using deep storage (e.g., encrypted cold storage); data requiring frequent sharing across logical ports is stored using fast storage (e.g., cache or hot storage). Ultimately, medical data with the same storage level are aggregated into logical storage file modules.

[0044] Specifically, the modular data storage module serves as the data warehousing and governance layer, executing the physical storage and logical organization of data under the guidance of resource strategies. It receives raw data from upstream logical ports and, based on resource quota instructions from the dynamic resource allocation module, instantiates each logical port as an independent data management module. Next, its modular processing unit analyzes the interaction behavior of medical data within the data management module, automatically determining the data's storage level based on the number of target logical ports. The multi-level storage execution unit then implements differentiated storage (such as deep encryption or caching) based on this level, ultimately packaging the data into storage file modules. This process transforms the chaotic data flow into standardized storage units with clear structures and well-defined strategies.

[0045] The security and access control module communicates with the modular data storage module to provide comprehensive data security and privacy protection for the system.

[0046] Specifically, the security and access control module includes a key management unit, a multi-layer encryption unit, and a permission verification and extraction unit.

[0047] More specifically, the security and access control module has a built-in or associated independent key management unit responsible for the generation, secure storage and lifecycle management of system-level keys (such as address encryption keys and privacy level master keys).

[0048] The multi-layer encryption unit is used to perform encryption evaluation and processing on the storage file modules generated by the modular data storage module. The multi-layer encryption unit comprehensively considers the requesting subject's personal settings, the system-generated random key, and the data's privacy level (such as personal privacy, departmental sharing, and public information) to encrypt the file content and its storage address in multiple layers, generating an encrypted file.

[0049] The authorization verification and extraction unit is used to process access requests for medical data. When an access request for specified target medical data is received, the authorization verification and extraction unit first verifies the identity of the requesting subject, parses the access request to determine the target medical data and its privacy level, and verifies the requesting subject's access permissions to the target medical data's privacy level.

[0050] For access to encrypted files, the authorization verification and extraction unit requires the requesting entity to provide or the system to verify the corresponding key. After successful authorization verification, the authorization verification and extraction unit locates the file based on the encrypted address and performs the decryption operation, ultimately securely outputting the plaintext data to the authorized requesting entity.

[0051] The key management unit is responsible for generating high-strength cryptographic random keys during system initialization or periodically according to policy. These keys include address encryption keys for encrypting storage addresses and system master keys bound to different privacy levels. All system-level keys are encrypted and stored in a hardware-protected keystore or hardware security module, and their access and use are subject to strict access control policy auditing.

[0052] Specifically, the security and access control module is the system's secure endpoint, providing the last line of defense for stored data and controlling all outgoing access. The multi-layered encryption unit performs encryption evaluation on incoming storage files, combining user and system keys to encrypt the file content and storage address, converting it into an encrypted file. When an external access request arrives, the permission verification and extraction unit initiates a strict security pipeline: first verifying the requester's identity, then checking if their permissions match the privacy level of the target data; after successful permission verification, the system sequentially decrypts the file address to locate the file, verifies the user key to decrypt the content, and finally securely outputs the plaintext data. This module ensures the confidentiality, integrity, and controllability of data throughout its entire lifecycle, from static storage to dynamic access.

[0053] After being categorized by the acquisition and port segmentation module, medical data enters the parallel processing channel. The dynamic resource allocation module, acting as the monitoring and scheduling hub, analyzes the load on each channel and issues resource control commands in real time. The modular data storage module, following these commands, transforms the data into hierarchical, encrypted, standardized storage units. Finally, all external access is centrally authenticated, authorized, and decrypted by the security and access control module. Through the coordination of these data and control flows, the system achieves closed-loop management from data access and intelligent resource allocation to secure storage and controlled access.

[0054] Through the coordinated operation of the above modules, a closed-loop management of medical data is achieved, from source classification and intelligent resource allocation to secure structured storage, effectively improving the management capabilities, resource utilization, and data security of the medical information system.

[0055] like Figure 2 As shown, this embodiment also provides a method for constructing a medical information data system, including the following steps: S1: Data Acquisition and Logical Port Division Based on Data Source This step aims to perform the following operations on the collected medical data: identify its data category, analyze the data source of each data category, group data categories with the same source into the same data source list, and create an independent logical port for each data source list. In this way, the mixed medical data stream is decoupled according to its source and divided into multiple parallel logical ports for management. Specifically: S101: Data Acquisition and Source Analysis First, data acquisition is performed. Medical data is collected in real time or periodically from various medical information nodes to form an initial medical dataset. Medical information nodes include medical testing equipment, electronic medical record systems, hospital management information systems, and patient terminals, etc.

[0056] Next, a source analysis is performed on the initial medical dataset. Specifically, the data categories to which the medical data in the dataset belongs are identified and statistically analyzed, such as test reports, imaging data, and diagnostic texts. Then, for each identified data category, its data source is traced and determined. The data source refers to the device or system that generates or provides that category of medical data, such as medical imaging equipment and laboratory testing systems.

[0057] Iterate through all identified data categories and categorize them according to their data sources. Data categories with the same data source are grouped into the same data source list. Each data source list corresponds to one data source, and the elements in the data source list are all data categories belonging to that data source. The data source list is a logical data structure used to classify and manage all different categories of medical data originating from the same device or system.

[0058] S102: Logical Port Division Based on the data source list obtained in step S101, create a separate logical port for each data source list. Each logical port is configured to specifically manage one data source list and process all medical data corresponding to that data source list. For example, an imaging data logical port can be created to manage all data categories from medical imaging equipment, and a laboratory data logical port can be created to manage all data categories from laboratory testing systems.

[0059] Through the above operations, the logical ports based on the data source are divided into a set of logical ports for subsequent resource allocation and data management.

[0060] S2: Dynamic allocation of logical port resources based on load monitoring This step aims to adjust the allocation of computing power and storage space for each logical port partitioned in step S1. By monitoring the data interaction volume, data processing task volume, and data storage requirements of each logical port in real time, the computing power and storage space are transformed from an initial equal pre-allocation state to an allocation state calculated based on the real-time monitoring data of each logical port, thereby improving the overall resource utilization efficiency.

[0061] S201: Initial pre-allocation of system resources First, obtain the total computing power of the medical information data system, denoted as the total computing power ( ). ); and the total storage space of the medical information data system, denoted as the total space ( Simultaneously, the total number of logical ports partitioned in step S1 is obtained and recorded as the total number of logical ports ( ). ).

[0062] Based on the above information, an initial equal-sharing pre-allocation is performed for each logical port to provide a fair adjustment benchmark: Pre-allocated computing power for each logical port ( )for: ; Pre-allocated space for each logical port ( )for: .

[0063] At this point, the total storage space of the system can also be expressed as .

[0064] S202: Dynamic Adjustment of Computing Power This step involves quantitatively analyzing the real-time computing power requirements of the logic ports and adjusting the computing power allocation of the logic ports accordingly.

[0065] First, for each logical port, monitor and obtain its status within a preset optimization time window in real time. Internal data interaction information. Data interaction information includes the amount of data exchanged and the amount of data processed.

[0066] Data interaction volume refers to concurrency pressure indicators such as the frequency of access requests and data queries to logical ports. Data processing volume refers to the computing resources consumed by executing specific computing tasks (such as medical image rendering and batch report generation) within a logical port.

[0067] Next, based on the acquired data interaction information, the optimization time window for each logical port is calculated. Every moment Instantaneous resource consumption The calculation formula is: ; In the formula: This represents the number of interaction types occurring at the current logical port. Indicates the current logical port at time [time]. The The total computing resource consumption of all interaction types; Indicates the current logical port at time [time]. The computational resource consumption of data processing tasks; The time required for the current logical port to complete the data processing task.

[0068] like Figure 3 As shown, the calculation model and optimization process for the above instantaneous resource consumption are illustrated.

[0069] Finally, the pre-allocated computing power of the logical ports Based on this, an optimal computing power adjustment value is found using an optimization algorithm (such as interval traversal). This leads to the adjusted computing power allocation Throughout the preset optimization time window Instantaneous resource consumption at all times The overall deviation between them is minimized. The overall deviation is determined by the judgment value. The calculation formula is as follows: ; Select to make smallest This serves as the optimal computing power adjustment value, and based on this, the final computing power allocation value for the current logical port is determined. Perform this optimization on all logical ports to enable intelligent allocation of computing power based on real-time load.

[0070] In one specific implementation, the optimal computing power adjustment value is solved using an interval traversal method. The process is as follows: Based on historical system data or experience, set a reasonable search range for the computing power adjustment value. For example, the range can be set to [-50%, +50%] of the pre-allocated computing power. , .

[0071] Determine the precision of the traversal, i.e., the step size. For example, set the step size to 0.01. .

[0072] from Start with a step size of 0.01 Increment by increment, taking each computing power adjustment value in turn, until the computing power adjustment value exceeds... Substitute them into the above formula respectively Calculate the corresponding judgment value .

[0073] Compare all the calculated judgment values ​​and select the adjustment value corresponding to the minimum value as the optimal computing power adjustment value.

[0074] S203: Dynamic adjustment of storage space This sub-step dynamically adjusts the storage space allocation based on the usage frequency (popularity) of the data within the logical port.

[0075] First, for each logical port, analyze its data storage information and data interaction information: Get the number of data categories managed within the current logical port. .

[0076] Obtain the basic storage requirements for each data category , Indicates the data category.

[0077] Get the historical interaction volume for each data category (Such as the number of visits, call frequency, etc.) as indicators of its popularity.

[0078] Next, to meet the performance requirements of high-frequency data access, the interaction volume is used as a weight to calculate the storage space requirement of the current logical port. .like Figure 4 As shown, it illustrates the process of calculating and dynamically allocating storage space requirements based on interaction-weighted calculations. The calculation formula is as follows: ; This calculation assigns a higher weight to data categories with high interaction volume, based on their storage requirements.

[0079] Finally, based on the storage space requirements of all logical ports, the total storage space is calculated. Perform on-demand reallocation. Calculate the storage space allocation value that each logical port should receive. (i.e., relative to pre-allocated space) The adjustment amount is calculated using the following formula: ; Ultimately, logical ports The actual storage space obtained is + This allocation strategy enables dynamic adjustment of storage space to logical ports with high data activity and demand.

[0080] In one specific embodiment, the system has an image data logical port (complex interaction, large fluctuations in computing power requirements) and a document data logical port (simple and stable interaction). Through monitoring and calculation in S202, a portion of the surplus computing power from the document port is dynamically allocated to the image port, so that both can operate in a balanced manner. The overall demand-allocation deviation within the image port is minimized. Simultaneously, if the interaction volume of the "CT images" category within the image port is detected to be significantly higher than other categories, then in S203, the storage space requirement value for that port increases significantly, thereby obtaining a larger quota during space reallocation and ensuring sufficient storage resources for frequently accessed data.

[0081] Step S2 enables dynamic and intelligent allocation of computing power and storage space for each logical port. Computing power allocation is optimized based on real-time load modeling, shifting from static pre-allocation to dynamic scheduling; storage space allocation is weighted based on data interaction frequency, changing from allocation according to basic needs to allocation according to usage value. The synergy of these two approaches significantly improves the system's resource utilization efficiency and operational stability under varying loads.

[0082] S3: Modular Tiered Storage Based on Resource Quotas and Interaction Relationships This step aims to transform the logical ports that have already been allocated computing power and storage space into data management modules, and to perform tiered storage based on the scope of medical data interaction within the system.

[0083] S301: Modular Processing and Data Classification Integration First, based on the computing power allocation value and storage space allocation value determined in step S2 and assigned to each logical port, the system creates an independent running instance for each logical port and configures each logical port as a data management module.

[0084] Specifically, the instantiation process includes: allocating corresponding computing resources to each data management module based on the computing power allocation value of the logical port, and allocating corresponding storage space regions to each data management module based on the storage space allocation value of the logical port; initializing an independent runtime environment (e.g., an independent container, process, or virtual machine instance) for each module to ensure that it runs within the allocated resource quota; configuring a corresponding management interface for each data management module, and configuring the communication interface and permissions between the data management module and other data management modules according to a preset access control policy associated with the data storage level.

[0085] Therefore, each logical port is concretized into a data management module with clearly defined responsibilities, independent resources, and the ability to operate autonomously. Each data management module is responsible for processing all medical data in the data source list corresponding to its logical port.

[0086] Next, within each data management module, the medical data managed by that module is categorized. The system uses each individual piece of medical data (such as an image file or a test report) as the basic unit and monitors its interactive behavior within a preset monitoring period. When this piece of medical data is accessed by a user or application under another logical port, the logical port to which the user or application that initiated the access belongs is regarded as a transmission target logical port for that interaction.

[0087] For each piece of medical data, the system records all logical ports of transmission targets involved in the interaction. The number of different logical ports of transmission targets involved in that piece of medical data is counted and recorded as the number of transmissions (…). ).

[0088] Based on the number of transmissions The data management module categorizes the managed medical data into three types: private data, shared data, and global data.

[0089] Specifically, when At that time, medical data was classified as private data. This means that the medical data is only used within its own data management module and is not transmitted to any other module.

[0090] when At this time, medical data is classified as shared data. This indicates that medical data is shared among a limited number of other data management modules.

[0091] when At this time, medical data is classified as global data. This means that medical data needs to be accessed by almost all other data management modules in the system besides itself.

[0092] This completes the classification of medical data based on the scope of interaction.

[0093] S302: Multi-level storage strategy and modular storage This step involves tiered storage of the medical data based on the aforementioned classification results. First, for the already classified medical data, the storage is determined according to the quantity of data to be transmitted. Total number of system logical ports Calculate the storage level of medical data ( The calculation formula is: ; Storage level The higher the value, the smaller the scope of interaction of the medical data, and the higher the required level of security protection.

[0094] Then, according to storage level Execute the corresponding storage policy: Deep storage: when Time (i.e.) (At the time), medical data is private data, and the privacy requirements for this type of medical data are the highest. The system stores it in encrypted offline storage media or a secure storage area with highly restricted access to ensure security to the greatest extent.

[0095] Fast storage: when Time (i.e.) When medical data is global data, the demand for sharing such medical data is the highest. The system stores it in high-performance solid-state drives or memory caches and other high-speed media to ensure a low-latency access experience.

[0096] Balanced storage: when 1 < < At that time, medical data was shared data. The system stored it on a hard disk array that balanced performance and security, and imposed appropriate access controls.

[0097] Finally, the system creates multiple storage file modules for each data management module, with each storage file module specifically used to store data at the same storage level. Medical data. For example, a data management module might have both a storage file module for storing private data and a storage file module for storing shared data. In a specific embodiment, the system includes an image data logical port, a test data logical port, and a medical record index logical port. A newly generated patient CT image, if only accessed within the radiology department in the short term (without being transmitted to other ports), then... , The system classifies this as private data and performs deep storage operations. However, if a critical test value report needs to be synchronized to the medical record index module and the clinical workstation (i.e., transmitted to two other ports), then... , The system classifies it as global data and implements rapid storage to ensure instant access.

[0098] Step S3 enables modular encapsulation and automated, secure, and hierarchical storage of medical data.

[0099] S4: Encrypted storage and secure access control based on permissions and privacy levels This step aims to perform encryption evaluation and multi-layer encryption on the storage file module generated in step S3 to generate an encrypted file; and to perform targeted extraction and decryption of access requests to the encrypted file.

[0100] S401: Encryption Assessment and Multi-Layer Encryption This step aims to perform an encryption evaluation on the storage file module, and based on the encryption evaluation results, perform multi-layer encryption to ultimately generate an encrypted file.

[0101] First, the encryption of the storage file module is evaluated based on the privacy level of the medical data within the storage file module.

[0102] Specifically, privacy levels are predefined categories based on the scope of data that is allowed to be accessed, for example: Privacy level: Access is limited to the data uploader and their designated medical staff.

[0103] Departmental sharing level: Access is available to authorized personnel within a specific department.

[0104] Public information level: After being anonymized, it can be accessed by a wider range of people.

[0105] Based on the encryption evaluation results, perform the following multi-layered encryption operations to generate an encrypted file: (1) Content encryption: The system retrieves the personal password of the data owner (i.e., the user who uploaded the medical data). Using a standard key derivation function (such as PBKDF2), the system combines this password with a system-assigned salt value to generate a high-strength content encryption key.

[0106] Using the generated content encryption key, the medical data content in the storage file module is encrypted using a symmetric encryption algorithm (such as AES-256) to generate encrypted content.

[0107] Specifically, the derived encryption key itself is not stored in the system's persistent storage. It is used only in secure memory during the encryption / decryption session and is destroyed afterwards. The only way to decrypt is for the user to provide the correct personal password again to derive the same key again.

[0108] (2) Address encryption: A high-strength address encryption key is randomly generated by the medical information data system.

[0109] Using an address encryption key, a symmetric encryption algorithm is used to encrypt the physical storage path (i.e., data address) of the file storage module in the system, generating an encrypted address.

[0110] The address encryption key is securely and centrally managed by the system and stored in a key management system or hardware security module subject to strict access control, for use in address decryption during subsequent authorized access.

[0111] (3) Comprehensive encryption: Based on the privacy level of the file storage module, the encrypted content and encrypted address are structurally encapsulated. Then, the system master key uniquely bound to the privacy level is requested from the key management unit of the security and access control module. This key is then used to re-encrypt the encapsulated content or attach a digital signature to ensure data integrity and the immutability of the privacy level.

[0112] After completing the above steps, an encrypted file containing encrypted content, an encrypted address, and privacy level verification information is generated. The medical information data system uses this encrypted file to replace the original storage file module, completing encrypted storage.

[0113] S402: Directional Extraction and Decryption Output This step is designed to handle access requests to encrypted files.

[0114] When a requesting entity, such as a user (e.g., a doctor, patient) or an external application system, initiates an access request to the medical information data system, specifying that it needs to obtain a particular piece of medical data, the medical information data system performs the following operations: First, verify the identity of the requesting entity. For example, check their login account and password, verify their digital certificate or biometrics.

[0115] After successful authentication, the medical information data system determines whether the requesting entity has read permissions based on its identity and role, as well as the privacy level of the encrypted file containing the requested medical data. If the permission determination is successful, the medical information data system uses its securely stored address encryption key to decrypt the encrypted address contained in the encrypted file, obtain the original storage path, and thus locate and read the encrypted file.

[0116] Then, the medical information data system prompts the requesting subject to enter their personal password. The system uses the same key derivation function and salt value as during encryption to regenerate the content encryption key based on the entered password. The system verifies that the regenerated key can correctly decrypt the header or Authentication Message Code (MAC) of the encrypted content, thus verifying the key's correctness. After successful verification, the content encryption key is used to decrypt the encrypted content in the encrypted file, restoring the original medical data.

[0117] Finally, the decrypted original medical data is returned to the requesting entity through a secure communication channel.

[0118] In one specific embodiment, a requesting entity needs to view the medical records of a patient under their care. The storage file module containing these medical records is encrypted, with a privacy level of personal privacy. The requesting entity logs into their account on the client side of the medical information data system (authentication). The system verifies their identity and their binding relationship with the patient, confirming that they have permission to access personal privacy-level data (permission judgment). Subsequently, the system uses an internal address encryption key to decrypt the storage address of the encrypted medical record file, reads the file from the storage device, and prompts the requesting entity to enter their personal password. After the requesting entity enters the password, the system generates a key based on the password, verifies it, decrypts the data if the verification is successful, and displays the medical record to the requesting entity.

[0119] Step S4 provides end-to-end security protection for medical data from storage to access. Layered encryption, combining a content encryption key derived from the user's password and a system-randomized address encryption key, ensures the confidentiality of statically stored data. Sequential authentication, privacy-level-based permission checks, and a key verification process based on the user's password ensure the security and controllability of dynamic data access, enabling targeted and secure data retrieval.

[0120] Using the above construction method, firstly, logical ports are divided according to the data generation source to achieve initial data decoupling and classification; secondly, by monitoring data interaction and storage information, and based on formula calculation and optimization algorithms, the computing power and storage space allocation of each port are dynamically adjusted; then, the storage level of each piece of medical data is determined according to its actual interaction range, and differentiated storage strategies are implemented; finally, a multi-layer encryption method based on user passwords and system random keys is adopted, combined with strict identity, permission, and key verification processes to control data access, ultimately constructing a medical information data system with a clear structure, reasonable resource allocation, and both efficient access and security management capabilities.

[0121] Specifically, this invention achieves source decoupling and orderly classification of medical data in the early stages of system construction by dividing the data into independent logical ports based on its inherent origin. This results in a clearer data organization architecture and lays a precise foundation for subsequent differentiated processing of different data domains. By monitoring the data interaction and storage load of each logical port in real time and dynamically adjusting the allocation of computing power and storage space, system resources can be transformed from a static, average allocation mode to a dynamically optimized state that closely matches the real-time needs and data value of each port, thereby improving overall resource utilization and system performance.

[0122] Security storage levels are determined by monitoring the actual interaction scope of each piece of medical data, and differentiated storage strategies are implemented accordingly. This abandons a one-size-fits-all approach, providing stronger protection for highly sensitive data and faster access to frequently shared data, achieving an intelligent balance between security and efficiency at the system level. Data is encrypted in multiple layers, from content to address, by combining user password-derived keys with system-random keys. During data access, a progressive process of strict identity authentication, privacy-level permission verification, and user key verification is implemented, providing closed-loop security protection for medical data from static storage encryption to dynamic access control, effectively ensuring data privacy and compliance.

[0123] The invention and its embodiments have been described above illustratively. This description is not restrictive, and the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. The accompanying drawings are only one embodiment of the invention, and the actual structure is not limited thereto. No reference numerals in the claims should limit the scope of the claims. Therefore, if a person skilled in the art is inspired by this description and designs a similar structure and embodiment without departing from the spirit of the invention, such design should fall within the scope of protection of this patent. Furthermore, the word "comprising" does not exclude other elements or steps, and the word "a" preceding an element does not exclude the inclusion of "a plurality" of that element. Multiple elements stated in the product claims may also be implemented by a single element through software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any specific order.

Claims

1. A method for constructing a medical information data system, comprising the following steps: S1: Collect medical data to form an initial medical data set; Identify the data categories of medical data in the initial medical data set, analyze the data source of each data category; group data categories with the same data source into the same data source list, and create an independent logical port for each data source list; S2: Monitors data interaction and data storage information of each logical port; Based on the data interaction information, the computing power allocation value of each logical port is dynamically adjusted by calculating the instantaneous resource consumption; based on the data storage information and data interaction information, the storage space allocation value of each logical port is dynamically adjusted by weighted calculation. S3: Based on the computing power allocation value and storage space allocation value, instantiate each logical port into a data management module; monitor the interaction behavior of medical data within each data management module, determine the number of transmission target logical ports for each piece of medical data based on the interaction behavior, determine the storage level of each piece of medical data based on the number of transmission target logical ports, and perform hierarchical storage of medical data according to the storage level to generate a storage file module; S4: Perform multi-layer encryption on the storage file module based on the privacy level to generate an encrypted file, thus completing the construction of the medical information data system.

2. The method for constructing a medical information data system according to claim 1, characterized in that, The method of dynamically adjusting the computing power allocation value of each logic port by calculating instantaneous resource consumption specifically includes: Based on the total computing power and the total number of logical ports of the medical information data system, an initial computing power is pre-allocated to each logical port; Monitor the data interaction information of each logical port within a preset time window; Based on the data interaction information, calculate the instantaneous resource consumption of each logical port at each moment within the preset time window. The calculation formula is: ； In the formula: This represents the number of interaction types occurring at the current logical port. Indicates the current logical port at time [time]. The The total computing resource consumption of all interaction types; Indicates the current logical port at time [time]. The computational resource consumption of data processing tasks; The time required for the current logical port to complete the data processing task; Based on the pre-allocated initial computing power and the calculated instantaneous resource consumption of each logical port at each moment within the preset time window, the pre-allocated initial computing power is optimized to obtain the final computing power allocation value.

3. The method for constructing a medical information data system according to claim 2, characterized in that, The optimization of computing power allocation values ​​based on the pre-allocated initial computing power specifically includes: Initial computing power is pre-allocated using logical ports. Based on this, the optimal computing power adjustment value is found using the interval traversal method. This makes the adjusted computing power allocation value Instantaneous resource consumption at each moment within the preset time window Overall deviation between Minimum; The overall deviation The calculation formula is: ； In the formula: Indicates the preset time window; Among them, the computing power adjustment value that minimizes the overall deviation is the optimal computing power adjustment value, and the corresponding computing power allocation value is the final computing power allocation value.

4. The method for constructing a medical information data system according to claim 1, characterized in that, The method of dynamically adjusting the storage space allocation value of each logical port through weighted calculation specifically includes: Based on the total storage space and the total number of logical ports of the medical information data system, pre-allocate initial storage space for each logical port; Obtain the basic storage requirements and historical interaction volume of each data category managed by each logical port; Calculate the storage space requirement for each logical port separately. The calculation formula is: ； In the formula: This indicates the number of data categories managed within the current logical port. Indicates data category, Indicates data category Historical interaction volume, Indicates data category Basic storage requirements; Based on the storage space requirements of all logical ports, the total system storage space is reallocated to determine the final storage space allocation value for each logical port.

5. The method for constructing a medical information data system according to claim 1, characterized in that, The process of determining the storage level of each piece of medical data based on the number of target logical ports specifically includes: Based on the relationship between the number of target logical ports for each piece of medical data transmission and the total number of logical ports in the system, a numerical storage level is calculated. The calculation formula is as follows: ； In the formula: For storage level, This represents the total number of logical ports in the system. The number of target logical ports for transmitting medical data; The storage level The higher the value, the smaller the scope of medical data interaction, and the higher the required level of security protection.

6. The method for constructing a medical information data system according to claim 5, characterized in that, The hierarchical storage of medical data based on storage levels specifically includes: classifying the storage levels... The value is evaluated as follows: when At that time, deep storage is performed on medical data; when At that time, medical data is stored quickly; When 1 < < At that time, balanced storage is performed on medical data.

7. The method for constructing a medical information data system according to claim 1, characterized in that, The multi-layer encryption of the storage file module based on privacy levels specifically includes: The storage file module is encrypted and evaluated according to a predefined privacy level. The medical data content is encrypted using a key derived from the requester's personal password; The storage address of medical data is encrypted using a key randomly generated by the system; The system key, which is tied to the privacy level determined by the assessment, is used to re-encrypt or sign the content and storage address of the encrypted medical data.

8. The method for constructing a medical information data system according to claim 1, characterized in that, Also includes: Step S5: Construct an access control mechanism, which is used to perform authentication, permission judgment and targeted decryption on the requesting subject of the request to access the encrypted file when the medical information data system is running; The execution of targeted decryption specifically includes: Verify the identity of the requesting entity and its access permissions to the data privacy level; Based on the verified identity and access permissions, the storage address of the encrypted file is decrypted to locate the encrypted file; Verify the key provided by the requesting entity and decrypt the contents of the encrypted file to restore the medical data.

9. A system for constructing a medical information data system, characterized in that, include: Data acquisition and logical port partitioning module: used to collect medical data to form an initial medical data set; Identify the data categories of medical data in the initial medical data set and analyze the data source of each data category; group data categories with the same data source into the same data source list and create an independent logical port for each data source list; Resource dynamic allocation module: Communicatively connected to the data acquisition and logical port allocation module, used to pre-allocate initial computing power and storage space to each logical port; monitor data interaction information and data storage information of each logical port; The computing power allocation value of each logical port is dynamically adjusted based on the data interaction information; the storage space allocation value of each logical port is dynamically adjusted based on the data storage information and data interaction information. Modular data storage module: It is communicatively connected to the data acquisition and logical port partitioning module and the resource dynamic allocation module, respectively. It is used to instantiate each logical port into a data management module according to the computing power allocation value and storage space allocation value; monitor the interaction behavior of medical data in each data management module to determine the number of transmission target logical ports and the corresponding storage level, and perform hierarchical storage of medical data according to the storage level to form a storage file module. Security and Access Control Module: Communicatively connected to the modular data storage module, used to perform multi-layer encryption on the storage file module based on privacy levels to generate encrypted files; upon receiving an access request, it verifies the identity and access permissions of the requesting subject, and after successful verification, performs targeted decryption and outputs the corresponding medical data.

10. A medical information data system, characterized in that, The system is constructed by the method described in any one of claims 1 to 8.

Images