An edge real-time desensitization processing system and method for physiological private data

Abstract

The application discloses an edge terminal real-time desensitization processing system and method for physiological private data, and belongs to the technical field of edge embedded data processing, privacy desensitization, and private data hierarchical control. In view of the high risk of physiological plaintext data transmission, the large delay of cloud desensitization, and the serious privacy leakage hidden danger of centralized processing in the existing health care, medical treatment and brain-computer terminal collection industry, the application proposes a lightweight real-time desensitization architecture deployed in an edge embedded terminal. According to the physiological data sensitivity level, the application is classified and divided, combined with the triple desensitization logic of static field masking, dynamic differential disturbance and irreversible hash confusion, and the sensitive field shielding, private feature blurring and original plaintext destruction are completed locally at the edge terminal. Meanwhile, the application is internally provided with a desensitization strength self-adaptive adjustment mechanism, which dynamically switches the desensitization mode according to the device computing power, network state and security level. The application completely avoids uploading the original physiological plaintext to the cloud. The application belongs to the second echelon privacy security reinforcement module of the patent matrix, and is connected with the first echelon sensing collection layer and the storage layer, and provides front privacy protection for physiological data, and is suitable for landing use of medical and health care terminals, wearable monitoring devices, distributed sensing nodes and brain-computer interaction private terminals.

Description

Technical Field

[0001] This invention relates to the fields of edge embedded terminal data processing, privacy desensitization algorithms, hierarchical management and control of biometric private data, and lightweight security processing. Specifically, it relates to an edge-end real-time desensitization processing system and method for physiological private data. This invention belongs to the privacy security enhancement module of a multi-level unit dynamic linkage and collaborative control system, deployed between the perception layer and the transmission layer. It specifically performs pre-processing desensitization of private physiological data such as electrocardiograms, electroencephalograms, electromyograms, body temperature, blood oxygen, and human biometrics. It is applicable to health and wellness terminals, smart wearable devices, distributed sensing nodes, and private brain-computer interface terminals, belonging to the cross-disciplinary technology field of embedded privacy security and medical data compliance. Background Technology

[0002] Current physiological monitoring devices generally employ an architecture of plaintext data collection, plaintext uploading, and unified cloud processing. The raw physiological data contains a large amount of unique personal biometric characteristics, posing a high risk of privacy breaches. Traditional desensitization solutions are mostly deployed on cloud servers, presenting security vulnerabilities such as exposed plaintext transmission links, network hijacking and theft, and mass leaks of centralized databases. Furthermore, existing desensitization algorithms generally require high computing power and are computationally intensive, making them unsuitable for embedded low-power edge terminals and unable to achieve local real-time desensitization. Conventional desensitization methods are often simple masking or obfuscation, failing to differentiate data sensitivity levels and exhibiting the dual drawbacks of over-desensitization leading to data invalidation and under-desensitization leaving residual privacy features. The industry lacks a lightweight, tiered, and edge-localized physiological desensitization system, failing to meet the requirements of the Personal Information Protection Law and the compliance management of sensitive medical data, representing a significant technological gap. Summary of the Invention

[0003] To address the shortcomings of existing technologies such as plaintext transmission of physiological data, high latency in cloud-based desensitization, significant centralized leakage risks, cumbersome algorithms unsuitable for edge hardware, and inability to adaptively adjust desensitization intensity, this invention proposes a real-time edge-side desensitization system and method for handling sensitive physiological data. This invention builds a lightweight desensitization architecture locally on the edge embedded terminal, employing a three-level data classification and judgment mechanism to match differentiated desensitization strategies for different sensitivity levels; it integrates masking, perturbation, and hashing desensitization logic, balancing data usability and privacy security; it incorporates a computing power adaptive adjustment mechanism to adapt to various low-end and mid-range embedded hardware; and it uses a volatile memory cache + plaintext overwrite and destruction mechanism to eliminate plaintext retention at the physical memory level. The core innovation of this invention, distinguishing it from traditional desensitization technologies, lies in: achieving local edge desensitization without uploading plaintext; graded and differentiated processing to avoid over-desensitization; strong hardware adaptability and extremely low computing power consumption; unique salting and obfuscation on each device, making reverse engineering extremely difficult; and immediate plaintext destruction, eliminating persistent leakage risks.

[0004] Furthermore, the edge local cache uses only RAM volatile memory, prohibiting plaintext writing to non-volatile storage media such as Flash and ROM, thereby reducing the risk of static leakage; Furthermore, the adaptive adjustment module can dynamically reduce or increase the number of desensitization iterations based on the remaining computing power of the device, ensuring the quality of desensitization without affecting the device's sampling refresh rate; Furthermore, the unique hardware serial number is used as a hash salt value to ensure that the obfuscation features generated by each terminal are unique, thus avoiding batch cracking and deduction. Furthermore, this invention can be independently packaged as a desensitized IP core, or it can be seamlessly embedded into the first-tier four-layer linkage architecture to achieve a secure closed loop across the entire chain of collection, purification, desensitization, encryption, and storage.

[0005] The beneficial effects of this invention are as follows: 1. Edge-based local anonymization: Plain text is not sent to the cloud, and raw data is not leaked, blocking the privacy leakage link at the source; 2. Tiered and precise control: Differentiate between common physical signs and private biometric characteristics, ensuring strong desensitization of sensitive data and maintaining accuracy of routine data; 3. Lightweight and low computing power: Low memory consumption per processing session, compatible with all mainstream embedded low-power chips; 4. Anti-reverse engineering: The hardware uses a unique salt value plus salt hashing, and the biometric features are irreversibly obfuscated, making it impossible to reverse engineer the original data; 5. Complete plaintext destruction: The memory is overwritten twice to clear the data, leaving no trace of plaintext, which meets the high-level privacy destruction standards; 6. Compliant Commercial Application: Fully compliant with domestic regulations on personal information protection and medical data compliance, suitable for mass commercial production in medical, health and wellness, and civilian wearable devices. Detailed Implementation

[0006] The present invention will be further described in detail below with reference to specific embodiments.

[0007] This embodiment provides a real-time edge-end desensitization processing system for physiological privacy data, applied to a portable intelligent ECG health monitoring terminal, and adapted to privacy and security protection scenarios in multi-level unit dynamic linkage collaborative control systems. The main control chip in this embodiment uses an STM32L5 ultra-low power embedded microcontroller, equipped with the lightweight desensitization processing architecture of this invention, to perform real-time edge-end local desensitization of collected ECG waveforms, heart rate, and human feature identification data.

[0008] At the desensitization operation level, the raw ECG data collected by the terminal first enters the grading judgment module, which classifies the ECG waveform into Level 2 sensitive data and the unique human biometric identifier into Level 3 high-sensitivity data. The original plaintext is temporarily stored in the chip's built-in RAM volatile memory and is not written to the local Flash. The system automatically matches a medium desensitization intensity according to the current computing power occupied by the chip. The ECG waveform is perturbed by a small amount of Gaussian difference to retain the medical characteristics of the waveform and remove extreme distinguishing features. The human biometric identifier is obfuscated by hardware serial number plus salt hash to achieve irreversible encryption. After the desensitization is completed, a second random overwrite is initiated to clear the plaintext in memory, which takes 2.1ms. Finally, the desensitized harmless data packet is uploaded to the system platform through an encrypted link.

[0009] In this embodiment, the desensitization operation for a single physiological data point occupies no more than 58KB of memory, with a computing power utilization rate of less than 18%, which will not affect the normal sampling frequency of the device. The waveform distortion rate of the desensitized data is less than 2.3%, meeting the medical and health assessment standards. The highly sensitive features are irreversible and leave no plaintext residue, exhibiting extremely strong resistance to scraping, reverse engineering, and deduction. Furthermore, after multiple memory overwrite residue tests, a very small probability of memory residue remains after a single overwrite, and the probability of plaintext residue after a second overwrite is less than 0.01%, significantly improving the reliability of plaintext destruction. This invention can be widely adapted to various civilian wearable devices, medical and health care devices, and distributed sensing terminals, possessing strong compliance implementation capabilities and commercial promotion value.

Claims

1. A real-time edge-end desensitization processing system for physiological privacy data, characterized in that, include: Physiological data classification and judgment module, edge local caching module, multi-mode lightweight desensitization processing module, desensitization intensity adaptive adjustment module, plaintext instant destruction module, and encrypted packaging and uploading module; The physiological data grading and judgment module is used to classify the sensitivity level of the collected raw physiological data and distinguish between general vital signs data, moderately sensitive data, and highly private biometric data. The edge-side local caching module uses short-term volatile memory to cache the original plaintext data, prohibiting persistent storage of plaintext information; the multi-mode lightweight de-identification processing module integrates three types of de-identification logic: static field masking, dynamic differential data perturbation, and irreversible hash obfuscation, matching corresponding de-identification strategies for different sensitivity levels; the de-identification intensity adaptive adjustment module collects edge device computing power, network transmission latency, and system security level labels in real time, and adaptively switches the de-identification processing intensity. The plaintext instant destruction module overwrites and clears the plaintext in memory after the desensitization process is completed, eliminating any remaining traces of plaintext. The encrypted packaging and uploading module encrypts and encapsulates the desensitized non-sensitive data packets and transmits them securely to the upper-level control system.

2. A real-time edge-end desensitization method for physiological privacy data, applied to the edge-end real-time desensitization system described in claim 1, characterized in that, Includes the following steps: S1. Data reception and classification: Receive raw physiological data collected by the front end, classify and label the data according to the preset sensitivity level standard; S2, Plaintext Temporary Cache: Stores the original plaintext data in the volatile memory at the edge and does not write it to non-volatile storage media; S3. Adaptive strategy matching: Automatically matches the corresponding de-identification mode and processing intensity based on device computing power, network latency, and security level; S4. Hierarchical desensitization processing: Low-sensitivity data should at least use field masking, medium-sensitivity data should at least use differential perturbation, and high-sensitivity biometric features should at least use irreversible hash obfuscation. S5. Plaintext Overwrite and Destruction: After the desensitization is completed, random data is used to overwrite the memory area to completely remove the original plaintext and eliminate plaintext residue. S6. Encrypted Packaging Upload: The desensitized harmless data is encrypted and packaged to complete secure transmission of the link and achieve closed-loop privacy protection at the edge.

3. The edge-end real-time desensitization processing system according to claim 1, characterized in that, The physiological data grading and judgment module divides physiological data into at least three levels, including routine vital sign data, continuously fluctuating physiological data, and unique biometric data. The grading criteria include data reversibility, identifiability, and the level of privacy leakage risk.

4. The edge-end real-time desensitization processing system according to claim 1, characterized in that, The multi-mode lightweight desensitization processing module has a computational load of less than 80KB per processing cycle, which is compatible with the computing power limitations of edge hardware such as embedded MCUs and low-power ARM.

5. The edge-end real-time desensitization processing system according to claim 1, characterized in that, The differential perturbation uses a probability distribution noise superposition method, preferably with Gaussian micro noise. The perturbation amplitude is controlled and does not change the overall trend of physiological data, thus preserving the effective characteristics of medical analysis.

6. The edge-end real-time desensitization processing system according to claim 1, characterized in that, The irreversible hash obfuscation uses a salted hash algorithm, with the salt value generated based on the device's unique identifier, preferably the hardware serial number, to achieve one device, one password, and irreversible deduction of the original biometric characteristics.

7. The edge-end real-time desensitization processing system according to claim 1, characterized in that, The plaintext instant destruction module adopts a random overwrite mechanism, with at least one overwrite and a clearing time of no more than 4ms, eliminating plaintext residue traces in memory.

8. The edge-end real-time desensitization processing method according to claim 2, characterized in that, The desensitized data retains physiological trend characteristics and waveform change patterns, while removing the only identifiable privacy information.