A personalized medication service data security processing system fusing zero-trust architecture and differential privacy

Abstract

The application discloses a kind of personalized medication service data security processing systems of fusing zero trust architecture and differential privacy, it is related to medical data security technical field, including dynamic trust evaluation to request subject;Inject differential privacy noise;Combining zero trust strategy continues to obtain trust score;Only receive desensitized statistical information or encrypted intermediate representation in the cloud.The application solves the privacy leakage and trust loss problems caused by static protection and weak desensitization in traditional personalized medication services, significantly improves the security, compliance and user trustworthiness of medical data during collection, use and sharing, and provides a secure foundation that can be implemented, verified and continuously evolved for intelligent medication services in high-sensitivity scenarios.

Description

Technical Field

[0001] This invention relates to the field of medical data security technology, and in particular to a personalized medication service data security processing system that integrates zero-trust architecture and differential privacy. Background Technology

[0002] The demand for personalized healthcare services is growing rapidly, particularly in areas such as chronic disease management, precision medicine, and intelligent health management. Personalized medication recommendation systems based on user health data are gaining popularity. With the deep integration of artificial intelligence, big data, and the Internet of Things (IoT) in healthcare, massive amounts of sensitive personal health information, such as genetic data, medication records, and physiological indicators, are being collected, transmitted, and analyzed at high frequency to support more accurate medication decisions. However, this data is highly sensitive and involves personal privacy, and the security risks during its transfer and use are becoming increasingly prominent. The public and regulatory agencies are raising their requirements for medical data security and privacy protection, necessitating the construction of a new secure processing mechanism that balances data utility and privacy protection.

[0003] Existing personalized medication service systems generally adopt traditional perimeter defense security models, relying on network firewalls or access control lists for data protection. Once internal credentials are leaked or devices are compromised, attackers can move laterally and steal sensitive health data in bulk. At the same time, most systems only use simple anonymization or static desensitization methods in the data sharing or model training stages, which are difficult to resist re-identification attacks based on background knowledge. They lack dynamic trust assessment and fine-grained access control throughout the entire data lifecycle, and cannot achieve secure interaction in an open collaborative environment, resulting in high privacy leakage risks, high compliance costs, and low user trust. Summary of the Invention

[0004] In view of the problems existing in the data security processing system of personalized medication service that integrates zero trust architecture and differential privacy, this invention is proposed.

[0005] Therefore, the problem that this invention aims to solve is that existing personalized medication service systems rely on static boundary protection for data access control and weak desensitization methods for privacy protection. They lack dynamic trust assessment and provable privacy protection throughout the entire lifecycle of health data, which leads to sensitive medical information being easily leaked, difficult to comply with regulations, and untrustworthy.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, embodiments of the present invention provide a personalized medication service data security processing system that integrates zero-trust architecture and differential privacy, comprising a zero-trust access control module for dynamically assessing the trust of the requesting subject each time a data access request occurs; The differential privacy data processing module is used to inject differential privacy noise into the raw health data before it enters the data usage process, based on a preset privacy budget. The data lifecycle audit trust assessment module is used to record health data from the entire chain of operation logs in an immutable manner, and continuously obtain trust scores in combination with a zero-trust strategy. The edge cloud collaborative privacy execution module is used to perform local differential privacy perturbation and feature extraction of raw sensitive data, and only receives de-identified statistical information or encrypted intermediate representations in the cloud.

[0007] As a preferred embodiment of the personalized medication service data security processing system integrating zero-trust architecture and differential privacy described in this invention, the zero-trust access control module includes a continuous identity verification submodule, a device security status awareness submodule, and an integrated behavior context analysis submodule. The continuous identity verification submodule is used to verify the real identity of the requesting subject in real time based on a multi-factor authentication mechanism each time a data access request is initiated, and to continuously refresh the authentication status in combination with the session lifecycle. The device security status awareness submodule is used to collect and evaluate the integrity of the operating environment of the requesting device. The integrated behavioral context analysis submodule is used to capture and parse the spatiotemporal context information of the access request, and quantify the contextual features of the spatiotemporal context information into risk scoring factors.

[0008] As a preferred embodiment of the personalized medication service data security processing system integrating zero-trust architecture and differential privacy described in this invention, the differential privacy data processing module includes a privacy budget management submodule, a sensitivity analysis submodule, and an integrated adaptive noise injection submodule. The privacy budget management submodule is used to dynamically allocate and manage global and local privacy budgets based on different data usage scenarios of medication services; The sensitivity analysis submodule is used to obtain the global or local sensitivity of the original health data type under the query function for the original health data type to be processed; The integrated adaptive noise injection submodule is used to automatically select an appropriate differential privacy mechanism based on the local privacy budget allocated by the privacy budget management submodule and the sensitivity parameters output by the sensitivity analysis submodule. Before the original health data enters the data usage process, the submodule injects calibrated differential privacy noise into the data using intermediate quantities.

[0009] As a preferred embodiment of the personalized medication service data security processing system that integrates zero-trust architecture and differential privacy as described in this invention, the data full-cycle audit trust assessment module includes an operation log collection submodule, a log tamper-proof storage submodule, a trust scoring submodule, and a trust status feedback submodule. The operation log collection submodule is used to capture and structurally record the entire operation log throughout the entire lifecycle of health data. The log immutable storage submodule is used to perform time-series distributed storage of the entire link operation log through cryptographic time-series evidence storage technology. The trust scoring submodule is used to parse behavioral events in the end-to-end operation log based on a preset zero-trust rule base and obtain a comprehensive trust score. The trust status feedback submodule is used to send the comprehensive trust score back to the zero trust access control module and the permission policy engine, forming a dynamic trust closed-loop control mechanism.

[0010] As a preferred embodiment of the personalized medication service data security processing system integrating zero-trust architecture and differential privacy described in this invention, the edge cloud collaborative privacy execution module includes an edge-side privacy perturbation submodule, an edge feature extraction submodule, a secure intermediate representation encapsulation submodule, and a cloud receiving interface submodule. The edge-side privacy perturbation submodule is used to perform localized differential privacy perturbation operations on the collected raw sensitive health data based on the privacy parameters issued by the differential privacy data processing module; The edge feature extraction submodule is used to perform lightweight feature engineering on the perturbed data at the edge side after completing the local differential privacy perturbation, based on the needs of medication service, and extract medication-related feature representations related to medication recommendation. The secure intermediate representation encapsulation submodule is used to further encapsulate the extracted medication-related feature representation into an encrypted intermediate representation, which is encoded using a privacy-compatible encryption format; The cloud receiving interface submodule is used to receive and parse de-identified statistical information or encrypted intermediate representations from the edge on the central cloud platform side, and reject data upload requests that have not been locally disturbed or have not been packaged according to specifications.

[0011] As a preferred embodiment of the personalized medication service data security processing system integrating zero-trust architecture and differential privacy described in this invention, the integrated adaptive noise injection submodule includes a differential privacy mechanism selection unit, a sensitivity adaptation unit, and a noise injection execution unit. The differential privacy mechanism selection unit is used to automatically determine whether to use the Laplace mechanism or the Gaussian mechanism based on the currently allocated local privacy budget and the data query type. The sensitivity adaptation unit is used to receive global or local sensitivity parameters output by the sensitivity analysis submodule and map them to the scale factor of the corresponding noise distribution. The noise injection execution unit is used to apply calibrated differential privacy noise to intermediate data usage quantities before the original health data enters the data usage process.

[0012] As a preferred embodiment of the personalized medication service data security processing system integrating zero-trust architecture and differential privacy described in this invention, the noise injection execution unit includes an intermediate quantity type identification subunit, a noise parameter binding subunit, and a disturbance operation scheduling subunit. The intermediate quantity type identification subunit is used to parse the structure and semantic type of the intermediate quantity in the data to be processed and make a judgment. The noise parameter binding subunit is used to combine the noise mechanism type determined by the differential privacy mechanism selection unit with the scale factor output by the sensitivity adaptation unit to generate a noise configuration template that matches the intermediate quantity dimension and numerical range. The perturbation operation scheduling subunit is used to call the corresponding perturbation operator according to the intermediate quantity type, and apply calibrated differential privacy noise to the data element by element or block by block in local memory using the intermediate quantity.

[0013] Secondly, embodiments of the present invention provide a method for data security processing of personalized medication services that integrates zero-trust architecture and differential privacy, which includes: performing dynamic trust assessment on the requesting subject each time a data access request occurs; Before the raw health data enters the data usage process, differential privacy noise is injected according to the preset privacy budget; Health data is recorded in an immutable manner from the end-to-end operation logs, and a trust score is continuously obtained in conjunction with a zero-trust strategy. Complete local differential privacy perturbation and feature extraction of raw sensitive data, and only receive desensitized statistical information or encrypted intermediate representations in the cloud.

[0014] Thirdly, embodiments of the present invention provide a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement any step of the above-described personalized medication service data security processing system that integrates zero-trust architecture and differential privacy.

[0015] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the aforementioned personalized medication service data security processing system that integrates zero-trust architecture and differential privacy.

[0016] The beneficial effects of this invention are as follows: By integrating a zero-trust architecture and a differential privacy mechanism, this invention constructs a full-stack security processing system covering access control, privacy protection, audit traceability, and edge collaboration. This effectively solves the privacy leakage and trust loss problems caused by static protection and weak anonymization in traditional personalized medication services. The system implements dynamic authorization with no trust and continuous verification on the access side, and provides mathematically provable privacy protection on the data side, ensuring that original health data does not leave the edge and only participates in cloud computing in anonymized or encrypted form. Simultaneously, through the immutable recording of the entire lifecycle operation log and the closed-loop feedback of trust scores, it supports fine-grained permission control and compliance auditing. Overall, it significantly improves the security, compliance, and user trust of medical data during collection, use, and sharing, providing a feasible, verifiable, and sustainably evolving security foundation for intelligent medication services in highly sensitive scenarios. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a schematic diagram of a personalized medication service data security processing system that integrates zero-trust architecture and differential privacy, provided as an embodiment of the present invention.

[0018] Figure 2 This is a flowchart illustrating a method for a personalized medication service data security processing system that integrates zero-trust architecture and differential privacy, as provided in an embodiment of the present invention. Detailed Implementation

[0019] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0020] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0021] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0022] This invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of this invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not adhering to the usual scale. Furthermore, the schematic diagrams are merely examples and should not be construed as limiting the scope of protection of this invention. In actual fabrication, the three-dimensional spatial dimensions of length, width, and depth should be included.

[0023] Furthermore, in the description of this invention, it should be noted that the terms "upper," "lower," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are used solely for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. In addition, the terms "first," "second," or "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0024] Unless otherwise explicitly specified and limited, the terms "installation," "connection," and "joining" in this invention should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; similarly, they can refer to mechanical connections, electrical connections, or direct connections, or indirect connections through an intermediate medium, or internal connections between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0025] Example: Reference Figure 1 and Figure 2 This is the first embodiment of the present invention, which provides a personalized medication service data security processing system that integrates zero-trust architecture and differential privacy, including: S1: Zero Trust Access Control Module, used to perform dynamic trust assessment on the requesting subject each time a data access request occurs.

[0026] The zero-trust access control module includes a continuous identity verification submodule, a device security status awareness submodule, and an integrated behavioral context analysis submodule. The continuous identity verification submodule is used to verify the real identity of the requesting subject in real time based on a multi-factor authentication mechanism each time a data access request is initiated, and continuously refreshes the authentication status in combination with the session lifecycle; The device safety status awareness submodule is used to collect and assess the integrity of the operating environment of the requesting device; The integrated behavioral context analysis submodule is used to capture and parse the spatiotemporal context information of access requests, and quantify the contextual features of the spatiotemporal context information into risk scoring factors.

[0027] Furthermore, the zero-trust access control module achieves refined and dynamic security assessment of each data access request through three closely coordinating sub-modules. The continuous identity verification sub-module not only requires users to complete multi-factor authentication (such as password + biometrics or hardware token) when they first initiate medication data access, but also dynamically triggers re-authentication based on operation sensitivity or time intervals during the session, ensuring that identity credentials remain valid and unused. The device security status awareness sub-module simultaneously checks whether the requesting terminal device is in a trusted state, including whether the operating system has been patched, whether it is running in a controlled environment, and whether there are signs of jailbreaking or malware, thus excluding high-risk devices from the source. Meanwhile, the integrated behavioral context analysis sub-module analyzes the spatiotemporal context of the access in real time, such as whether it occurred during the user's regular medication consultation period, whether the geographical location is in their frequently used location, and whether the operation path matches historical behavioral patterns, transforming these contextual features into quantifiable risk scoring factors. Together, these three elements constitute a multi-dimensional dynamic trust assessment system that integrates who you are, what device you use, where you are, and what you do, providing comprehensive and real-time basis for subsequent access decisions and completely abandoning the traditional static trust model of one-time authentication and long-term access.

[0028] Furthermore, the Zero Trust Access Control module operates on the core principles of continuous verification and dynamic authorization. Its three internal sub-modules are closely linked according to the request processing sequence: When a medication data access request is initiated, the continuous identity verification sub-module intervenes first, enforcing multi-factor authentication (such as combining user biometrics with a one-time dynamic password), and automatically triggering secondary authentication during the session based on the operation type (such as viewing a prescription vs. modifying a medication plan) or time threshold (such as no operation for more than 10 minutes) to prevent session hijacking or credential reuse; At the same time, the device security status awareness sub-module collects the terminal device's operating context in parallel, including whether secure boot is enabled, system integrity verification results, antivirus software status, and whether it is within the enterprise MDM management domain, and uses the device's trust level as a hard condition for access admission; On this basis, the integrated behavioral context analysis sub-module further integrates the user's historical behavior profile, and compares in real time the time regularity of the current access (such as whether there is abnormal query at night), geographical rationality (such as a sudden change from the city of residence to an overseas IP), and interaction path consistency (such as skipping regular consultations and directly retrieving highly sensitive medication records), etc., to generate a structured context risk vector. The outputs of these three sub-modules—identity credibility, device health, and abnormal behavior—are uniformly fed into the policy decision engine to comprehensively derive a dynamic trust score for this request. Based on this score, the engine decides whether to allow access, restrict access, or block access directly. This achieves fine-grained, context-aware, and unbypassable security control in every data interaction, truly implementing a zero-trust, never-trust, and always-verified security paradigm.

[0029] S2: Differential privacy data processing module, used to inject differential privacy noise according to a preset privacy budget before the raw health data enters the data usage process.

[0030] The differential privacy data processing module includes a privacy budget management submodule, a sensitivity analysis submodule, and an integrated adaptive noise injection submodule. The privacy budget management submodule is used to dynamically allocate and manage global and local privacy budgets based on different data usage scenarios for medication services; The sensitivity analysis submodule is used to obtain the global or local sensitivity of the original health data type under the query function for the original health data type to be processed; The integrated adaptive noise injection submodule is used to automatically select an appropriate differential privacy mechanism based on the local privacy budget allocated by the privacy budget management submodule and the sensitivity parameters output by the sensitivity analysis submodule. Before the raw health data enters the data usage process, calibrated differential privacy noise is injected into the data using intermediate quantities.

[0031] Furthermore, the differential privacy data processing module constructs an automated, scenario-adaptive privacy protection mechanism for personalized medication services through three collaborative sub-modules. When raw health data (such as medication records, physiological indicators, or chronic disease follow-up information) is about to enter the data usage process such as analysis, sharing, or model training, the privacy budget management submodule first dynamically allocates the corresponding privacy budget ε according to the sensitivity of the current usage scenario (e.g., individual query, group statistics, or cross-institutional joint modeling), and performs fine-grained control over global and local queries to prevent excessive privacy leakage due to multiple operations. Subsequently, the sensitivity analysis submodule automatically analyzes the maximum impact of the operation on individual user data for specific data types and executed query functions (e.g., calculating the average medication frequency or counting the number of users of a certain type of drug), that is, determines its global or local sensitivity, providing key parameter basis for noise injection. On this basis, the integrated adaptive noise injection submodule combines the outputs of the above two submodules and intelligently selects the most suitable differential privacy mechanism. In scenarios with high accuracy requirements and pure ε-differential privacy, the Laplace mechanism is adopted, while in complex queries that allow for a small probability of failure but require lower noise, the Gaussian mechanism is selected, and the calibrated differential privacy noise is accurately applied to intermediate data usage quantities (such as aggregation results, query responses, or gradient updates). The entire process is completed before the data leaves the security boundary, ensuring that no subsequent use of the data can deduce a specific user's original health information from the output. This ensures the effectiveness of personalized medication service data while achieving strong privacy protection that is verifiable, configurable, and auditable.

[0032] S3: Data lifecycle audit trust assessment module, used to record health data from the entire chain of operation logs in an immutable manner, and continuously obtain trust scores in combination with a zero-trust strategy.

[0033] The data lifecycle audit trust assessment module includes an operation log collection submodule, an immutable log storage submodule, a trust scoring submodule, and a trust status feedback submodule. The operation log collection submodule is used to capture and structure the operation logs throughout the entire lifecycle of health data. The log immutable storage submodule is used to perform time-series distributed storage of the entire link operation log through cryptographic time-series evidence storage technology; The trust scoring submodule is used to parse behavioral events in the end-to-end operation log based on a preset zero-trust rule base and obtain a comprehensive trust score. The Trust Status Feedback Submodule is used to send the comprehensive trust score back to the Zero Trust Access Control Module and the Permission Policy Engine, forming a dynamic trust closed-loop control mechanism.

[0034] Furthermore, the data lifecycle audit trust assessment module, through four closely connected sub-modules, constructs a trust governance mechanism that covers the entire process of health data from generation to destruction, ensuring traceability, tamper-proof protection, and dynamic feedback. The operation log collection submodule monitors and records all data interaction-related operation events in real time at every critical stage of the data lifecycle, including collection, storage, access, processing, and destruction. This includes tracking who accessed which medication records, when, and with what permissions. These logs are then sent to the log immutability storage submodule, which uses cryptographic time-series evidence storage technology (such as hash chains or lightweight blockchain structures) to bind the logs chronologically and store them in a distributed manner. This ensures that any subsequent tampering will disrupt the chain consistency, thus guaranteeing the authenticity and integrity of audit evidence. Based on this, the trust scoring submodule continuously reads these trusted logs and, combined with a pre-defined zero-trust rule base (e.g., abnormal patterns such as high-frequency access to sensitive data outside of working hours or switching multiple user identities on the same device within a short period), performs semantic analysis and risk quantification on user, device, and service behaviors, dynamically generating a comprehensive trust score between 0 and 1. Finally, the trust status feedback submodule sends this trust score back to the zero-trust access control module and the permission policy engine in real time for immediate adjustment of the authorization level of subsequent access requests. If the trust score drops sharply, secondary authentication or temporary permission freeze is triggered. Thus, the entire module not only achieves complete traceability and non-repudiation auditing of data operations, but also transforms audit results into live data that drives the evolution of security strategies, forming a closed-loop dynamic trust management system of recording, evaluation, feedback and control.

[0035] Furthermore, the data lifecycle audit trust assessment module, aiming for verifiability, quantifiability, and interoperability, is deeply embedded in the entire data flow process of personalized medication services. The operation log collection submodule does not simply record logs; instead, it deploys lightweight probes at the system kernel layer or API gateway to capture the operation subjects, objects, actions, permission levels, and timestamps at each stage of health data collection (e.g., uploading medication time to smart pillboxes), storage (e.g., writing to encrypted databases), access (e.g., doctors accessing patient medication history), processing (e.g., AI models generating recommendations), and destruction (e.g., data erasure after user logout). These are uniformly encoded into structured audit events. These events are transmitted almost in real-time to the log immutable storage submodule, which employs a time-series distributed evidence storage mechanism based on Merkle hash trees. Each new log entry is concatenated with the hash value of the previous log entry to generate a new hash, forming an irreversible chain structure. This chain structure is synchronously stored and backed up on multiple trusted nodes, ensuring that any single-point tampering cannot pass hash verification or be detected by multiple nodes. The nodes reach a consensus; subsequently, the trust scoring submodule continuously consumes these solidified and stored log streams in a streaming manner, combining them with the zero-trust rule base issued by the security policy center. This rule base contains multiple risk patterns, such as cross-regional abnormal logins, batch export of medication records for multiple patients in a short period of time, and low-privilege accounts attempting to access genetic data. Semantic matching and weighted calculations are performed on the behavioral context to output a dynamic comprehensive trust score reflecting the overall trust status of the current entity (user / device / service). This score is then pushed by the trust status feedback submodule through a secure channel to the zero-trust access control module and the permission policy engine as a key input for the next access decision: for example, when a doctor's account trust score drops below the threshold due to abnormal behavior, the system will automatically require the doctor to re-complete biometric authentication, or temporarily restrict the doctor to only view basic medication information and not export complete medical records. The entire process realizes a leap from passive recording to proactive governance, making auditing no longer a tool for post-event traceability, but a core feedback signal driving the system's real-time adaptive defense, truly building a closed-loop dynamic trust control system that spans the entire data lifecycle.

[0036] S4: Edge cloud collaborative privacy execution module, used to complete local differential privacy perturbation and feature extraction of raw sensitive data, and only receive desensitized statistical information or encrypted intermediate representation in the cloud.

[0037] The edge cloud collaborative privacy execution module includes an edge-side privacy perturbation submodule, an edge feature extraction submodule, a secure intermediate representation encapsulation submodule, and a cloud receiving interface submodule. The edge-side privacy perturbation submodule is used to perform localized differential privacy perturbation operations on the collected raw sensitive health data based on the privacy parameters issued by the differential privacy data processing module; The edge feature extraction submodule is used to perform lightweight feature engineering on the perturbed data at the edge side after completing the local differential privacy perturbation, based on the needs of medication service, and extract medication-related feature representations related to medication recommendation. The secure intermediate representation encapsulation submodule is used to further encapsulate the extracted medication-related feature representation into an encrypted intermediate representation, which is encoded using a privacy-compatible encryption format; The cloud receiving interface submodule is used to receive and parse de-identified statistical information or encrypted intermediate representations from the edge on the central cloud platform side, and reject data upload requests that have not been locally disturbed or have not been packaged according to specifications.

[0038] Furthermore, the edge cloud collaborative privacy execution module, through four orderly collaborative sub-modules, achieves effective collaboration between privacy security and cloud-based intelligent services while ensuring that the original health data does not leave the local device. When a user's original sensitive health data (such as real-time blood glucose levels, medication records, or chronic disease indicators) is collected on the terminal device or edge node, the edge-side privacy perturbation sub-module first performs strict differential privacy perturbation on the original data locally on the device, based on the privacy parameters (including privacy budget ε and noise mechanism type) issued by the differential privacy data processing module. This ensures that any individual information has been mathematically provably obfuscated before leaving the device. Subsequently, the edge feature extraction sub-module, based on the perturbated data and combined with the specific needs of personalized medication services (such as drug interaction analysis, adherence assessment, or dosage adjustment recommendations), performs lightweight feature engineering processing. For example, it aggregates continuous physiological indicators into daily averages and converts medication events into frequency or regularity labels, generating low-dimensional, semantically clear, and... The system uses medication-related features highly relevant to the recommendation task to avoid uploading redundant or high-dimensional raw data. Next, a secure intermediate representation encapsulation submodule further encapsulates these feature representations into encrypted intermediate representations, employing an encoding format compatible with privacy computing frameworks (such as homomorphic encrypted ciphertext or secret-shared fragments), and attaching integrity verification tags and perturbation compliance identifiers to ensure that the data cannot be stolen, restored, tampered with, or replaced during transmission. Finally, the cloud receiving interface submodule performs strict access checks on all upload requests on the central cloud platform, accepting only anonymized statistical information or encrypted intermediate representations that carry valid perturbation proofs and conform to encapsulation specifications. If a data packet is detected that has not been locally perturbed, lacks privacy parameter signatures, or has an abnormal format, it is immediately rejected and a security event is recorded. This entire process achieves the technical goals of ensuring raw data does not leave the domain, sensitive information is not exposed, and cloud services are operational, meeting both the strong privacy protection requirements of medical data and supporting efficient and accurate personalized medication intelligent services.

[0039] Further refinement of step S2: The integrated adaptive noise injection submodule includes a differential privacy mechanism selection unit, a sensitivity adaptation unit, and a noise injection execution unit; The differential privacy mechanism selection unit is used to automatically determine whether to use the Laplace mechanism or the Gaussian mechanism based on the currently allocated local privacy budget and the data query type. The sensitivity adaptation unit is used to receive global or local sensitivity parameters output by the sensitivity analysis submodule and map them to the scale factor of the corresponding noise distribution. The noise injection execution unit is used to apply calibrated differential privacy noise to intermediate data usage quantities before the raw health data enters the data usage process.

[0040] The noise injection execution unit includes an intermediate quantity type identification subunit, a noise parameter binding subunit, and a disturbance operation scheduling subunit. The intermediate quantity type identification subunit is used to parse the data to be processed, use the structure and semantic type of the intermediate quantity, and make a judgment. The noise parameter binding subunit is used to combine the noise mechanism type determined by the differential privacy mechanism selection unit with the scale factor output by the sensitivity adaptation unit to generate a noise configuration template that matches the intermediate quantity dimension and numerical range. The perturbation operation scheduling subunit is used to call the corresponding perturbation operator according to the intermediate quantity type, and apply calibrated differential privacy noise to the data element by element or block by block in local memory using the intermediate quantity.

[0041] In a preferred embodiment, a method for securely processing personalized medication service data that integrates a zero-trust architecture and differential privacy includes: performing a dynamic trust assessment on the requesting subject each time a data access request occurs; injecting differential privacy noise according to a preset privacy budget before the original health data enters the data usage process; recording the health data in an immutable manner from the end-to-end operation log and continuously obtaining a trust score in conjunction with the zero-trust strategy; completing local differential privacy perturbation and feature extraction of the original sensitive data; and receiving only de-identified statistical information or encrypted intermediate representations in the cloud.

[0042] The above-mentioned unit modules can be embedded in the processor of the computer device in hardware form or independent of it, or they can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of the above modules.

[0043] In one embodiment, a computer device is provided, which may be a terminal. The computer device includes a processor, memory, a communication interface, a display screen, and an input device connected via a system bus. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage medium. The communication interface of the computer device is used for wired or wireless communication with external terminals. Wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen of the computer device may be an LCD screen or an e-ink display screen. The input device of the computer device may be a touch layer covering the display screen, or buttons, a trackball, or a touchpad located on the casing of the computer device, or an external keyboard, touchpad, or mouse, etc.

[0044] In summary, this invention, by integrating a zero-trust architecture and a differential privacy mechanism, constructs a full-stack security processing system covering access control, privacy protection, audit traceability, and edge collaboration. This effectively solves the privacy leaks and trust deficiencies caused by static protection and weak anonymization in traditional personalized medication services. The system implements dynamic authorization with zero trust and continuous verification on the access side, and provides mathematically provable privacy protection on the data side, ensuring that raw health data does not leave the edge and only participates in cloud computing in anonymized or encrypted form. Simultaneously, through the immutable recording of the entire lifecycle operation log and closed-loop feedback of trust scores, it supports fine-grained permission control and compliance auditing. Overall, it significantly improves the security, compliance, and user trust of medical data during collection, use, and sharing, providing a feasible, verifiable, and sustainably evolving security foundation for intelligent medication services in highly sensitive scenarios.

[0045] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A personalized medication service data security processing system integrating zero-trust architecture and differential privacy, characterized in that: include, The zero-trust access control module is used to perform dynamic trust assessment on the requesting subject each time a data access request occurs. The differential privacy data processing module is used to inject differential privacy noise into the raw health data before it enters the data usage process, based on a preset privacy budget. The data lifecycle audit trust assessment module is used to record health data from the entire chain of operation logs in an immutable manner, and continuously obtain trust scores in combination with a zero-trust strategy. The edge cloud collaborative privacy execution module is used to perform local differential privacy perturbation and feature extraction of raw sensitive data, and only receives de-identified statistical information or encrypted intermediate representations in the cloud.

2. The personalized medication service data security processing system integrating zero-trust architecture and differential privacy as described in claim 1, characterized in that: The zero-trust access control module includes a continuous identity verification submodule, a device security status awareness submodule, and an integrated behavioral context analysis submodule. The continuous identity verification submodule is used to verify the real identity of the requesting subject in real time based on a multi-factor authentication mechanism each time a data access request is initiated, and to continuously refresh the authentication status in combination with the session lifecycle. The device security status awareness submodule is used to collect and evaluate the integrity of the operating environment of the requesting device. The integrated behavioral context analysis submodule is used to capture and parse the spatiotemporal context information of the access request, and quantify the contextual features of the spatiotemporal context information into risk scoring factors.

3. The personalized medication service data security processing system integrating zero-trust architecture and differential privacy as described in claim 2, characterized in that: The differential privacy data processing module includes a privacy budget management submodule, a sensitivity analysis submodule, and an integrated adaptive noise injection submodule. The privacy budget management submodule is used to dynamically allocate and manage global and local privacy budgets based on different data usage scenarios of medication services; The sensitivity analysis submodule is used to obtain the global or local sensitivity of the original health data type under the query function for the original health data type to be processed; The integrated adaptive noise injection submodule is used to automatically select an appropriate differential privacy mechanism based on the local privacy budget allocated by the privacy budget management submodule and the sensitivity parameters output by the sensitivity analysis submodule. Before the original health data enters the data usage process, the submodule injects calibrated differential privacy noise into the data using intermediate quantities.

4. The personalized medication service data security processing system integrating zero-trust architecture and differential privacy as described in claim 3, characterized in that: The data full-cycle audit trust assessment module includes an operation log collection submodule, an untamperable log storage submodule, a trust scoring submodule, and a trust status feedback submodule. The operation log collection submodule is used to capture and structurally record the entire operation log throughout the entire lifecycle of health data. The log immutable storage submodule is used to perform time-series distributed storage of the entire link operation log through cryptographic time-series evidence storage technology. The trust scoring submodule is used to parse behavioral events in the end-to-end operation log based on a preset zero-trust rule base and obtain a comprehensive trust score. The trust status feedback submodule is used to send the comprehensive trust score back to the zero trust access control module and the permission policy engine, forming a dynamic trust closed-loop control mechanism.

5. The personalized medication service data security processing system integrating zero-trust architecture and differential privacy as described in claim 4, characterized in that: The edge cloud collaborative privacy execution module includes an edge-side privacy perturbation submodule, an edge feature extraction submodule, a secure intermediate representation encapsulation submodule, and a cloud receiving interface submodule. The edge-side privacy perturbation submodule is used to perform localized differential privacy perturbation operations on the collected raw sensitive health data based on the privacy parameters issued by the differential privacy data processing module; The edge feature extraction submodule is used to perform lightweight feature engineering on the perturbed data at the edge side after completing the local differential privacy perturbation, based on the needs of medication service, and extract medication-related feature representations related to medication recommendation. The secure intermediate representation encapsulation submodule is used to further encapsulate the extracted medication-related feature representation into an encrypted intermediate representation, which is encoded using a privacy-compatible encryption format; The cloud receiving interface submodule is used to receive and parse de-identified statistical information or encrypted intermediate representations from the edge on the central cloud platform side, and reject data upload requests that have not been locally disturbed or have not been packaged according to specifications.

6. The personalized medication service data security processing system integrating zero-trust architecture and differential privacy as described in claim 5, characterized in that: The integrated adaptive noise injection submodule includes a differential privacy mechanism selection unit, a sensitivity adaptation unit, and a noise injection execution unit. The differential privacy mechanism selection unit is used to automatically determine whether to use the Laplace mechanism or the Gaussian mechanism based on the currently allocated local privacy budget and the data query type. The sensitivity adaptation unit is used to receive global or local sensitivity parameters output by the sensitivity analysis submodule and map them to the scale factor of the corresponding noise distribution. The noise injection execution unit is used to apply calibrated differential privacy noise to intermediate data usage quantities before the original health data enters the data usage process.

7. The personalized medication service data security processing system integrating zero-trust architecture and differential privacy as described in claim 6, characterized in that: The noise injection execution unit includes an intermediate quantity type identification subunit, a noise parameter binding subunit, and a disturbance operation scheduling subunit; The intermediate quantity type identification subunit is used to parse the structure and semantic type of the intermediate quantity in the data to be processed and make a judgment. The noise parameter binding subunit is used to combine the noise mechanism type determined by the differential privacy mechanism selection unit with the scale factor output by the sensitivity adaptation unit to generate a noise configuration template that matches the intermediate quantity dimension and numerical range. The perturbation operation scheduling subunit is used to call the corresponding perturbation operator according to the intermediate quantity type, and apply calibrated differential privacy noise to the data element by element or block by block in local memory using the intermediate quantity.

8. A method for securely processing personalized medication service data that integrates zero-trust architecture and differential privacy, based on the personalized medication service data security processing system that integrates zero-trust architecture and differential privacy as described in any one of claims 1 to 7, characterized in that: include, A dynamic trust assessment is performed on the requesting entity each time a data access request occurs; Before the raw health data enters the data usage process, differential privacy noise is injected according to the preset privacy budget; Health data is recorded in an immutable manner from the end-to-end operation logs, and a trust score is continuously obtained in conjunction with a zero-trust strategy. Complete local differential privacy perturbation and feature extraction of raw sensitive data, and only receive desensitized statistical information or encrypted intermediate representations in the cloud.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the personalized medication service data security processing system that integrates zero-trust architecture and differential privacy as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the personalized medication service data security processing system that integrates zero-trust architecture and differential privacy as described in any one of claims 1 to 7.

Images