A medical electronic signature verification method and system based on network traffic analysis

Abstract

The application discloses a medical electronic signature verification method and system based on network flow analysis, and belongs to the technical field of information security. The method deploys a directional password application analysis device through a bypass, and collects full-amount flow by using zero-copy flow processing technology. Based on a bidirectional semantic mapping mechanism, a business flow serial number is associated with a bottom-layer TLS certificate serial number to identify an abnormality of "signature behavior being decoupled from business operation". In combination with a dynamic password behavior baseline and multi-dimensional cryptography analysis, real-time checking of algorithm compliance and certificate chain integrity is realized. In addition, the system deduces risk root causes through a fault tree model, automatically repairs illegal signatures by using non-susceptible replacement technology, and prevents bypass risks based on multi-modal time sequence alignment auditing. The application effectively fills the blank of effectiveness detection of medical electronic signature technology, realizes closed-loop management from passive auditing to active defense, and ensures the legal effect of electronic medical records.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically, to a medical electronic signature verification method and system based on network traffic analysis. Background Technology

[0002] With the advent of the Internet era, hospitals have placed higher demands on identity authentication and electronic signature applications. Currently, based on electronic signature service technology, hospitals have built supporting medical online signature application systems and patient electronic signature application systems to achieve strong identity authentication for medical staff based on digital certificates, electronic signatures and timestamps for key business processes, and reliable handwritten electronic signatures of patients for informed consent documents, thus comprehensively ensuring the legality of electronic medical records.

[0003] However, in the actual implementation of electronic signature services, problems arise due to system configuration errors and human misoperation, leading to incorrect system usage and compromising the legitimacy of electronic medical records. Furthermore, the current hospital electronic signature service system lacks a verification and validation mechanism, making it impossible to confirm whether the system configuration is correct and whether medical staff and patients are using the system correctly.

[0004] Furthermore, traditional auditing methods rely heavily on post-event analysis of application-layer logs, making it difficult to correlate with specific technical parameters at the cryptographic protocol level and enabling real-time intervention during signature operations. When compliance issues arise, administrators often only see the results and cannot trace the root cause, making it difficult to distinguish between system malfunctions and human error.

[0005] Therefore, there is an urgent need for a technical solution that can perform in-depth testing, dynamic evaluation, and closed-loop feedback on the effectiveness of medical electronic signature services, so as to ensure the compliant, correct, and effective use of electronic signature technology in medical scenarios. Summary of the Invention

[0006] The purpose of this invention is to provide a medical electronic signature verification method and system based on network traffic analysis, so as to solve the problems in the current hospital electronic signature service technology system, such as the lack of detection and verification links, the inability to confirm whether the system configuration is correct, and the inability to trace the root cause of compliance failures.

[0007] According to a first aspect of the present invention, a medical electronic signature verification method based on network traffic analysis is provided, comprising the following steps:

[0008] S1: Passively connect the targeted cryptographic application parsing device to the core switch of the hospital network under test through the optical splitter or mirror port, use DPDK-based zero-copy stream processing technology to collect all network traffic involving electronic signature service technology, and filter irrelevant business traffic based on the preset whitelist policy.

[0009] S2: Perform protocol-deep decoding on the filtered full network traffic, establish a session-level bidirectional flow table, and identify and extract medical online signature application data, patient electronic signature application data and collaborative signature data through a bidirectional semantic mapping mechanism, and normalize the extracted data into standardized signature event objects.

[0010] S3: Construct a dynamic cryptographic behavior baseline, input the signature event object into the data analysis module, compare the deviation of real-time signature behavior from the baseline, and combine it with commercial cryptographic algorithm compliance verification to conduct multi-dimensional analysis of the technical effectiveness of electronic signatures;

[0011] S4: Based on the results of multi-dimensional analysis, the fault tree model is called to deduce the root causes of risks, generate a compliance assessment report containing risk location and remediation suggestions for visualization, and execute a preset closed-loop handling strategy according to the assessment results. The closed-loop handling strategy includes blocking abnormal sessions, or triggering application layer identity forced redirection, or adjusting the granularity of subsequent traffic collection.

[0012] Optionally, the collection of all network traffic related to electronic signature service technology in step S1 adopts zero-copy stream processing technology, and the specific steps include:

[0013] By using DPDK technology to bypass the operating system kernel protocol stack, network packets are captured and buffered directly in user space, and a circular buffer is established by pre-allocating large pages of memory in memory.

[0014] When the detected traffic peak exceeds the preset line rate threshold, the adaptive sampling algorithm is activated, prioritizing the retention of key data packets containing TCP three-way handshake, TLS certificate exchange and signature payload, while directly discarding TCP retransmission packets and empty acknowledgment packets at the driver layer.

[0015] Optionally, step S2 identifies and extracts medical online signature application data, patient electronic signature application data, and collaborative signature data through a bidirectional semantic mapping mechanism, specifically including:

[0016] Establish a mapping table between application layer business semantics and underlying cryptographic operation semantics;

[0017] Parse the business serial number and personnel UID from the JSON or XML payload of the application layer traffic, and extract the digital certificate sequence number from the Certificate message in the subsequent TLS handshake packet of the session within a millisecond time window;

[0018] If a business serial number exists within the same session period but the corresponding digital certificate serial number is not detected, an "uncoupling of signature behavior and business operation" exception is triggered.

[0019] Optionally, step S3, which involves a multi-dimensional analysis of the validity of the electronic signature, specifically includes:

[0020] Step S31: Parse the OID identifier in the signed data packet to determine whether the public key algorithm and hash algorithm comply with the national commercial cryptographic algorithm standard;

[0021] Step S32: Certificate chain integrity verification: Extract the digital certificate path, recursively verify the revocation status list of the upper-level CA certificate and the OCSP response. If it is detected that the certificate has been revoked but is still used for signing, a high-risk alarm is triggered.

[0022] Step S33: Timestamp Non-repudiation Verification: Verify the logical binding relationship between the token issued by the timestamp server and the electronic signature value to prevent retroactive signature.

[0023] Optionally, step S3 further includes the following steps:

[0024] Step S34: Context consistency verification: Extract the hash values ​​of key fields in the electronic medical record business data; compare the hash values ​​with the original hash values ​​encapsulated in the digital envelope; if the two are inconsistent, it is determined to be a shadow signature attack or system configuration tampering, and the session connection is immediately terminated.

[0025] Optionally, step S4, which involves deriving the root causes of risk based on the results of multidimensional analysis, specifically includes:

[0026] When an invalid electronic signature is detected, a pre-defined fault tree analysis model is invoked.

[0027] The decision tree algorithm is used to locate the failure node and distinguish whether it is "client driver not installed", "USB key hardware failure" or "server certificate configuration expired".

[0028] Generate a work order containing specific repair suggestions and associate it with the digital identity UID of the specific medical staff.

[0029] Optionally, an adaptive response step S5 is included after step S4, specifically including:

[0030] Receive rectification confirmation signals triggered by the front end and mark electronic medical record data that have not passed the compliance assessment;

[0031] The next time the healthcare worker attempts to log in to the system, they will be forcibly redirected to the digital certificate update page until a compliant signature replacement is completed.

[0032] For archived illegal signature data, the backend data correction interface automatically generates and executes data cleaning tasks based on the rule engine to replace the illegal signature data with verified compliant signature data.

[0033] Optionally, the compliant signature replacement step in step S5 specifically includes:

[0034] By employing seamless replacement technology, non-compliant signature requests from the backend are intercepted without altering the original business processes and user interface. The system automatically calls a collaborative signature interface that conforms to specific standards to regenerate the signature and writes the new signature back to the electronic medical record database.

[0035] Optionally, the medical electronic signature verification method based on network traffic parsing further includes a multimodal temporal alignment audit step, specifically including:

[0036] Align the password operation logs parsed from network traffic with the business operation logs exported from the hospital information system on the timeline.

[0037] The two types of logs are divided into time-series segments according to fixed time intervals; the Jaccard similarity coefficient between the number of password operation events and the number of business operation events in each window is calculated; when the similarity coefficient is lower than a preset threshold, it is determined that there is a risk.

[0038] A second aspect of the present invention provides a medical electronic signature verification system based on network traffic analysis, comprising a targeted cryptographic application parsing device. The device is deployed in the network of the hospital under test and is communicatively connected to a core switch. The device has a built-in processor and a memory storing a computer program. When the processor executes the program in the memory, it performs the functions of the following modules:

[0039] The online data acquisition module is used to passively access the core switch of the hospital network under test through the optical splitter or mirror port, collect all network traffic involving electronic signature service technology, and filter irrelevant business traffic based on the preset whitelist policy.

[0040] The data parsing module is used to perform protocol-level deep decoding on the filtered full network traffic, identify and extract medical online signature application data, patient electronic signature application data and collaborative signature data through a bidirectional semantic mapping mechanism, and normalize the extracted data into standardized signature event objects.

[0041] The data analysis module is used to construct a dynamic cryptographic behavior baseline. The signature event object is input into the data analysis module, and the validity of the electronic signature is analyzed from multiple dimensions by comparing the deviation between the real-time signature behavior and the baseline and combining cryptographic algorithm verification.

[0042] The results output module is used to generate a compliance assessment report containing risk root cause inferences based on the results of multi-dimensional analysis, and to visualize the report through the front-end interface. It also dynamically adjusts the subsequent traffic collection strategy based on the assessment results.

[0043] The medical electronic signature verification method and system based on network traffic analysis disclosed herein have the following technical effects:

[0044] This invention employs zero-copy stream processing technology based on DPDK, bypassing the overhead of the operating system kernel protocol stack and solving the problem of data packet loss caused by massive network traffic during peak medical periods. This enables lossless collection of fully signed traffic in high-concurrency medical business environments, ensuring the integrity of the test samples.

[0045] By comparing the deviation of real-time signature behavior from the baseline and combining cryptographic algorithm verification, the validity of electronic signatures is analyzed from multiple dimensions. This solves the problem that existing technologies only verify the signature result without verifying the compliance of the algorithm. In this way, it can automatically identify the application of non-national cryptographic algorithms and the use of expired certificates, ensuring that electronic signatures strictly comply with the GM / T national standard.

[0046] By using a bidirectional semantic mapping mechanism to identify and extract medical online signature application data, patient electronic signature application data, and collaborative signature data, and by using the business serial number to trace the digital certificate sequence number in the underlying TLS handshake packet, the traditional technology breaks the separation between application layer business data and link layer cryptographic data. This enables the accurate identification of signature behavior where the business shows a successful signature but the underlying certificate is not invoked, thus eliminating blind spots caused by system configuration errors.

[0047] Based on the results of multi-dimensional analysis, a compliance assessment report containing risk root cause deduction is generated. The fault tree analysis model and decision tree algorithm are introduced, thereby changing the traditional time-consuming and labor-intensive manual troubleshooting, solving the pain point of "only knowing the error, but not knowing the cause", generating accurate repair work orders, and greatly reducing the operation and maintenance complexity of system administrators.

[0048] A multimodal timing alignment audit step was added, which calculates the overlap between password logs and business logs through a sliding window. This effectively identifies hidden violations such as bypass signatures, thereby filling the gap that simple traffic analysis cannot cover application layer logic fraud and fully guaranteeing the legal validity of electronic medical records.

[0049] Other features and advantages of the invention will become clear from the following detailed description of exemplary embodiments of the invention with reference to the accompanying drawings. Attached Figure Description

[0050] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments of the invention and, together with their description, serve to explain the principles of the invention.

[0051] Figure 1 A flowchart illustrating the medical electronic signature verification method based on network traffic parsing provided in an embodiment of the present invention;

[0052] Figure 2An architecture block diagram of a medical electronic signature verification system based on network traffic parsing provided in an embodiment of the present invention;

[0053] Figure 3 This is a schematic diagram of the risk root cause derivation and adaptive response process provided in an embodiment of the present invention;

[0054] Figure 4 This is a schematic diagram of the multimodal timing alignment audit logic provided in an embodiment of the present invention. Detailed Implementation

[0055] Various exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the invention.

[0056] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the invention or its application or use.

[0057] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0058] In all the examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0059] This invention proposes an embodiment of a medical electronic signature verification method based on network traffic parsing, specifically, as follows: Figure 1 As shown, it includes the following steps:

[0060] S1: The targeted cryptographic application parsing device is passively connected to the core switch of the hospital network under test in bypass mode via a splitter or mirror port. Zero-copy stream processing technology is used to collect all network traffic involving electronic signature services, and irrelevant business traffic is filtered based on a preset whitelist policy. In this embodiment, step S1, collecting all network traffic involving electronic signature services, employs zero-copy stream processing technology. Specific steps include: using DPDK technology to bypass the operating system kernel protocol stack, directly capturing and buffering network data packets in user space, and establishing a circular buffer in memory; when a traffic peak exceeds a preset threshold, an adaptive sampling algorithm is activated, prioritizing the retention of data packets containing the complete handshake process and signature payload, while discarding redundant TCP retransmission packets. By bypassing the kernel protocol stack and optimizing memory large pages, CPU utilization is significantly reduced and data packet processing throughput is improved, thereby solving the packet loss problem caused by insufficient processing capacity at the collection end in high-concurrency medical business scenarios. It's important to note that traditional packet capture methods require navigating the kernel network stack, resulting in significant context switching and memory copying overhead. DPDK, however, runs the network interface card (NIC) driver in user space, allowing the device to read data packets directly from the NIC buffer. A circular buffer is established in memory, with pre-allocated large pages for packet storage and forwarding, avoiding performance fluctuations caused by frequent memory allocation and deallocation. When a traffic peak exceeds a preset threshold (10Gbps line speed), an adaptive sampling algorithm is activated. This algorithm prioritizes critical packets containing TCP three-way handshakes, TLS certificate exchanges, and signature payloads, while discarding the large number of repetitive TCP retransmission packets or empty acknowledgment packets at the driver layer, preventing them from being uploaded to the analysis engine.

[0061] S2: Perform deep protocol decoding on the filtered full network traffic, identify and extract medical online signature application data, patient electronic signature application data, and collaborative signature data through a bidirectional semantic mapping mechanism, and normalize the extracted data into standardized signature event objects; In this embodiment of the invention, step S2, which identifies and extracts medical online signature application data, patient electronic signature application data, and collaborative signature data through a bidirectional semantic mapping mechanism, specifically includes: establishing a mapping table between application layer business semantics and underlying cryptographic operation semantics; parsing the business serial number from the medical online signature application data, and tracing the digital certificate sequence number in the underlying TLS handshake packet corresponding to the serial number; if a business serial number exists but there is no corresponding digital certificate sequence number, it is directly determined as an "abnormality of decoupling between signature behavior and business operation".

[0062] Specifically, it should be noted that the device's built-in protocol decoding engine not only parses single-packet data but also maintains a session-level bidirectional flow table in memory. When parsing application-layer HTTP / HTTPS traffic, it extracts a unique business serial number and operator UID from the JSON / XML payload of medical signature application data or HIS business messages. Within the same TCP session stream, or within a set millisecond time window, it traces down the subsequent TLS handshake packets of the connection. This millisecond time window is a bidirectional sliding window, tracing not only the certificate messages after the serial number but also the business serial number within a preset time period before the certificate messages. If the association fails, the session is marked as a "pre-authentication session pending confirmation" and transferred to the asynchronous audit queue. The device parses the Client Hello and Certificate messages to extract the digital certificate serial number and public key hash value. A key-value mapping table for the digital certificate serial number is established and stored in a cache. The extracted heterogeneous data is normalized to generate standardized signature event objects. After the bidirectional mapping is completed, the system executes consistency verification logic: if a business transaction number exists within the same session period, but a corresponding digital certificate serial number does not exist, the system immediately triggers an "uncoupling of signature behavior and business operation" anomaly flag. For collaborative signature scenarios, it further verifies whether the business transaction number is associated with both the doctor's certificate and the patient's certificate; if the mapping relationship of either party is missing, it is also judged as an anomaly. By establishing a strong binding relationship between the business transaction number and the digital certificate serial number, it can accurately identify configuration errors or logical vulnerabilities such as "the business system records a successful signature, but the cryptographic device is not actually invoked," filling the gap in existing technologies that cannot detect internal system logic errors.

[0063] S3: Construct a dynamic cryptographic behavior baseline. Input the signature event object into the data analysis module. By comparing the deviation of real-time signature behavior from the baseline and combining cryptographic algorithm verification, perform multi-dimensional analysis of the validity of the electronic signature. This includes extracting multi-dimensional feature vectors from historical signature events, including signature time interval, certificate usage frequency, source IP geographical distribution, and algorithm combination preferences. Establish differentiated behavioral baselines for different departments. For example, the system automatically learns that a doctor typically uses the "SM2+SM3" algorithm for signatures between 8:00 AM and 12:00 PM, forming the user's behavioral index. Input the real-time signature event into the model, calculate its Mahalanobis distance from the baseline, and output the deviation score.

[0064] In this embodiment of the invention, step S3, which involves multi-dimensional analysis of the validity of the electronic signature, specifically includes:

[0065] Step S31: Algorithm compliance verification: Parse the OID identifier in the signature data packet to determine whether the public key algorithm and hash algorithm comply with the national commercial cryptographic algorithm standard GM / T 0034. For example, non-standard mixed combinations such as "SM2+RSA" or "SHA1+SM2" are prohibited.

[0066] Step S32: Certificate Chain Integrity Verification: Extract the digital certificate path, recursively verify the Revocation Status List (CRL) and OCSP (Online Certificate Status Protocol) response of the parent CA certificate. If a certificate is detected as revoked but still being used for signing, a high-risk alarm is triggered, and all session tokens associated with that certificate are frozen, simultaneously blocking subsequent signing requests based on that certificate. To prevent OCSP service timeouts from blocking business, the system employs an asynchronous callback mechanism. If a certificate is detected as revoked, a high-risk alarm is immediately triggered, and all session tokens associated with that certificate are frozen.

[0067] Step S33: Timestamp Non-repudiation Verification: Verify the logical binding relationship between the token issued by the timestamp server and the electronic signature value to prevent retroactive signature.

[0068] In this embodiment of the invention, step S3 further includes the following steps:

[0069] Step S34: Context Consistency Verification: Extract the hash values ​​of key fields (such as patient ID and diagnosis result) from the electronic medical record business data; compare the hash values ​​with the original hash values ​​encapsulated in the digital envelope; if the two are inconsistent, it is determined to be a "shadow signature" attack or system configuration tampering, and the session connection is immediately terminated. Specifically, in the data parsing stage, the system extracts key fields from the electronic medical record business data to generate business data hash H1, decrypts the digital envelope from the signature data packet, extracts the original signature hash H2, compares H1 and H2, if they are inconsistent, it is determined to be a shadow signature, and then not only logs it, but also sends a TCP Reset message to the core switch through a bypass blocking device to forcibly terminate the session connection. Through this step scheme, malicious behavior that tampered with business content even if it passed certificate verification can be effectively detected, and illegal data entry can be prevented through real-time connection termination.

[0070] S4: Generate a compliance assessment report containing risk root cause deduction based on the results of multi-dimensional analysis, and display it visually through the front-end interface. At the same time, execute a preset closed-loop handling strategy according to the assessment results. The closed-loop handling strategy includes blocking abnormal sessions, triggering application layer identity forced redirection, or adjusting the granularity of subsequent traffic collection.

[0071] In embodiments of the present invention, such as Figure 3As shown, the steps in step S4 for risk root cause deduction based on the results of multi-dimensional analysis specifically include: when it is detected that the electronic signature is not used effectively, such as "signing without a certificate" or "algorithm non-compliant", the preset fault tree analysis model (FTA) is invoked; the failure node is located based on the decision tree algorithm, and feature vectors such as error code, traffic packet size, and session duration are used to distinguish whether it is "client driver not installed", "USB key hardware failure" or "server certificate configuration expired". Among them, client driver not installed is manifested as no APDU command interaction, USB key hardware failure is manifested as frequent handshake protocol reset, and server certificate configuration expired is manifested as detection of various types of TLS protocol Alert Message alarm messages.

[0072] The system generates work orders containing specific repair suggestions and links them to the digital identity UID of the specific medical staff member. Specifically, instead of simply outputting text alerts, the system generates structured work orders containing repair SOPs (Standard Operating Procedures). For example, if the issue is determined to be an expired server certificate configuration, the work order automatically includes a link to the certificate update manual and the expected scope of impact. Using the mapping table established in step S2, the system uses the business transaction number to look up the medical staff member's digital identity UID and accurately pushes the work order to the individual's mobile OA system or workstation pop-up. Through the correlation and reasoning of multi-source data, the system can accurately distinguish between hardware failures and software configuration errors. Precise responsibility identification eliminates the time cost of inter-departmental buck-passing, and combined with specific repair suggestions, shortens the average fault recovery time.

[0073] Furthermore, the system dynamically adjusts the collection strategy in phase S1 based on the root cause inference results. If the root cause is an expired server certificate, the sampling rate of the entire network traffic collection is automatically increased, and the system enters the network-wide survey mode. If the root cause is a client driver issue in a specific department, an ACL policy is automatically issued to perform deep packet inspection (DPI) only on the traffic of that department's network segment, reducing the collection frequency of other irrelevant areas to save computing power.

[0074] Furthermore, the front-end interface uses a Sankey diagram to illustrate the risk transmission path, visually showing how certificate expiration leads to invalid signatures, which in turn affects the legality of medical records.

[0075] In this embodiment of the invention, an adaptive response step S5 is further included after step S4, specifically including:

[0076] The system receives rectification confirmation signals triggered by the front end and marks electronic medical record data that have not passed the compliance assessment. Specifically, if the administrator clicks the "Confirm Rectification" button, the back end marks the medical staff's digital identity UID as "Pending Rectification" and records the specific signature hash value of the violation.

[0077] The next time the healthcare worker attempts to log in to the system, they are forcibly redirected to the digital certificate update page until a compliant signature replacement is completed. Specifically, a seamless replacement technology is used to intercept non-compliant signature requests from the backend without altering the original business processes and user interface. It automatically calls the collaborative signature interface conforming to the GM / T 0034 standard to regenerate the signature and writes the new signature back to the electronic medical record database. The entire process is completely transparent to the front-end user and application system, requiring no modification to any business code.

[0078] For archived illegally signed data, the system automatically generates and executes data cleaning tasks based on the rules engine through the backend data correction interface, replacing the illegally signed data with verified compliant signature data. Specifically, for archived read-only data that cannot be modified online, the system generates data cleaning scripts with checksums and provides simulation execution functionality to assist DBAs in completing batch corrections without compromising data integrity. This reduces the burden on database administrators to manually filter and correct massive amounts of historical data and avoids new errors that might be introduced by manual operations.

[0079] In this embodiment of the invention, the medical electronic signature verification method based on network traffic parsing further includes a multimodal temporal alignment audit step, specifically as follows: Figure 4 As shown, the steps include: aligning the password operation logs parsed from network traffic with the business operation logs exported from the Hospital Information System (HIS) along the timeline; dividing the two types of logs into time-series segments at fixed time intervals; calculating the Jaccard similarity coefficient between the number of password operation events and the number of business operation events within each window; and determining a risk when the similarity coefficient is lower than a preset threshold. The password operation logs include network card timestamps, certificate serial numbers, and signature actions, while the business operation logs include the business occurrence time, the user's UID, and the business type. The business serial number is extracted from the logs as a logical anchor point, constructing a tuple of {timestamp, serial number} to reconstruct the two timelines and eliminate errors caused by physical clock asynchrony. The cosine similarity or Pearson correlation coefficient between the two vectors within the sliding window is calculated as an overlap index. The baseline overlap is automatically calculated based on historical data; when the real-time overlap is lower than a preset threshold (e.g., 0.8), a bypass signature risk is identified. Once a bypass signature is detected, the system immediately captures the current network session state, generates an audit report containing a timing deviation graph, and uses blockchain evidence storage technology to secure the report, preventing the audit log itself from being tampered with.

[0080] In this embodiment of the invention, the medical electronic signature verification method based on network traffic parsing includes policy hot loading and sandbox verification steps. Specifically, it includes: receiving the latest cryptographic application policy documents in the medical industry, extracting compliance constraints using natural language processing technology, and automatically converting them into machine-readable rule code; simulating the new rules in a sandbox environment to perform regression testing on historical traffic, and dynamically injecting the new rules into the runtime memory of the data analysis module after verification, achieving non-stop policy updates. While importing historical traffic for regression testing, the system automatically generates mutated traffic for adversarial testing to check for any missed detections in the new rules. The sandbox system simulates high concurrency pressure to predict the CPU utilization and expected false positive rate of the new rules after deployment. The compiled rule code is encapsulated into an independent dynamic link library, and the new rule library pointer replaces the old pointer through atomic operations, without restarting the data analysis module process.

[0081] This invention also provides an embodiment of a medical electronic signature verification system based on network traffic analysis, specifically as follows: Figure 2 As shown, the device includes a targeted cryptographic application parsing device. This device is deployed in the tested hospital network and communicates with the core switch. The device has a built-in processor and a memory storing computer programs. When the processor executes the programs in the memory, it performs the functions of the following modules:

[0082] The online data acquisition module is used to passively access the core switch of the hospital network under test through the optical splitter or mirror port, collect all network traffic involving electronic signature service technology, and filter irrelevant business traffic based on the preset whitelist policy.

[0083] The data parsing module is used to perform protocol-level deep decoding on the filtered full network traffic, identify and extract medical online signature application data, patient electronic signature application data and collaborative signature data through a bidirectional semantic mapping mechanism, and normalize the extracted data into standardized signature event objects.

[0084] The data analysis module is used to construct a dynamic cryptographic behavior baseline. The signature event object is input into the data analysis module, and the validity of the electronic signature is analyzed from multiple dimensions by comparing the deviation between the real-time signature behavior and the baseline and combining cryptographic algorithm verification.

[0085] The results output module is used to generate a compliance assessment report containing risk root cause inferences based on the results of multi-dimensional analysis, and to visualize the report through the front-end interface. It also dynamically adjusts the subsequent traffic collection strategy based on the assessment results.

[0086] In one embodiment of the present invention, the system further includes an adaptive response module, which implements the following control steps: receiving a rectification confirmation signal triggered by the front end, and marking electronic medical record data that has not passed the compliance assessment; specifically, if the administrator clicks the "Confirm Rectification" button, the back end marks the digital identity UID of the medical staff as "pending rectification" and records the specific signature hash value of the violation. The next time the medical staff attempts to log in to the system, they are forcibly redirected to the digital certificate update page until the compliant signature replacement is completed; specifically, a seamless replacement technology is adopted to intercept non-compliant signature requests from the back end without changing the original business processes and operation interface, automatically calling the collaborative signature interface conforming to the GM / T 0034 standard to regenerate the signature, and writing the new signature back to the electronic medical record database. The entire process is completely transparent to the front-end user and application system, requiring no modification to any business code. For archived illegal signature data, a data cleaning script is generated to assist the database administrator in batch correction. Specifically, for archived read-only data that cannot be modified online, the system generates a data cleaning script with a checksum and provides a simulation operation function to assist the DBA in completing batch correction without compromising data integrity. It reduces the burden on database administrators to manually filter and correct massive amounts of historical data, and avoids new errors that may be introduced by manual operation.

[0087] In one specific embodiment of the present invention, during the daily operation of a tertiary hospital, due to system configuration oversights or terminal driver malfunctions, a false signature incident occurred where medical staff performed electronic signature actions, but the underlying layer did not actually call the personal digital certificate private key for cryptographic calculations: erroneous electronic medical record data was transmitted in plaintext over the network and silently written to the background database.

[0088] In this embodiment of the invention, a targeted cryptographic application parsing device deployed in the network captures the traffic in real time using zero-copy stream processing technology. The data parsing module associates the business serial number with the underlying TLS handshake packet through a bidirectional semantic mapping mechanism, instantly identifying the anomaly of "signature behavior decoupled from business operation" where "there is a business operation but no certificate sequence number." Subsequently, the data analysis module constructs a dynamic cryptographic behavior baseline for deep verification, confirming that the signature is not associated with a valid digital certificate. It then generates an assessment report containing risk root cause inferences and submits it to the front end. Based on this, system administrators accurately locate the specific medical staff member and their UID, immediately triggering an adaptive response mechanism: on the one hand, forcibly redirecting the person to the certificate update page to block subsequent unauthorized operations; on the other hand, intercepting backend requests through seamless replacement technology, automatically calling the GM / T 0034 standard interface to regenerate a compliant signature and write it back to the database. Ultimately, without affecting the business process, the cleaning of existing data and the compliance of incremental data are completed, effectively ensuring the legal validity of electronic medical records.

[0089] It should be noted that the information interaction and execution process between the above modules are based on the same concept as the method embodiments of this application. It is a system corresponding to the above-mentioned medical electronic signature verification method based on network traffic analysis. All implementation methods in the above method embodiments are applicable to the embodiments of this system. For details on its specific functions and the technical effects it brings, please refer to the method embodiments section, which will not be repeated here.

[0090] The above description of the structure, features, and effects of the present invention is based on the embodiments shown in the figures. However, the above are only preferred embodiments of the present invention. It should be noted that the technical features involved in the above embodiments and their preferred methods can be reasonably combined and matched by those skilled in the art to form a variety of equivalent solutions without departing from or changing the design concept and technical effects of the present invention. Therefore, the present invention is not limited to the scope of implementation shown in the figures. Any changes made in accordance with the concept of the present invention, or modifications to equivalent embodiments, that do not exceed the spirit covered by the specification and figures, should be within the protection scope of the present invention.

Claims

1. A medical electronic signature verification method based on network traffic parsing, characterized in that, Includes the following steps: S1: Passively connect the targeted cryptographic application parsing device to the core switch of the hospital network under test through the optical splitter or mirror port, use DPDK-based zero-copy stream processing technology to collect all network traffic involving electronic signature service technology, and filter irrelevant business traffic based on the preset whitelist policy. S2: Perform protocol-deep decoding on the filtered full network traffic, establish a session-level bidirectional flow table, and identify and extract medical online signature application data, patient electronic signature application data and collaborative signature data through a bidirectional semantic mapping mechanism, and normalize the extracted data into standardized signature event objects. S3: Construct a dynamic cryptographic behavior baseline, input the signature event object into the data analysis module, compare the deviation of real-time signature behavior from the baseline, and combine it with commercial cryptographic algorithm compliance verification to conduct multi-dimensional analysis of the technical effectiveness of electronic signatures; S4: Based on the results of multi-dimensional analysis, a fault tree model is invoked to deduce the root causes of risks, generating a compliance assessment report containing risk location and remediation suggestions for visualization. A preset closed-loop handling strategy is then executed based on the assessment results. This closed-loop handling strategy includes blocking abnormal sessions, triggering forced redirection of application-layer identity, or adjusting the granularity of subsequent traffic collection. In step S2, a bidirectional semantic mapping mechanism is used to identify and extract medical online signature application data, patient electronic signature application data, and collaborative signature data, including: Establish a mapping table between application layer business semantics and underlying cryptographic operation semantics; Parse the business serial number and personnel UID from the JSON or XML payload of the application layer traffic, and extract the digital certificate sequence number from the Certificate message in the subsequent TLS handshake packet of the session within a millisecond time window; If a business serial number exists within the same session period but the corresponding digital certificate serial number is not detected, an "uncoupling of signature behavior and business operation" exception is triggered.

2. The medical electronic signature verification method based on network traffic analysis according to claim 1, characterized in that, Step S1 involves collecting all network traffic related to electronic signature services using zero-copy stream processing technology. The specific steps include: By using DPDK technology to bypass the operating system kernel protocol stack, network packets are captured and buffered directly in user space, and a circular buffer is established by pre-allocating large pages of memory in memory. When the detected traffic peak exceeds the preset line rate threshold, the adaptive sampling algorithm is activated, prioritizing the retention of key data packets containing TCP three-way handshake, TLS certificate exchange and signature payload, while directly discarding TCP retransmission packets and empty acknowledgment packets at the driver layer.

3. The medical electronic signature verification method based on network traffic analysis according to claim 1, characterized in that, Step S3, which involves a multi-dimensional analysis of the validity of the electronic signature, specifically includes: Step S31: Parse the OID identifier in the signed data packet to determine whether the public key algorithm and hash algorithm comply with the national commercial cryptographic algorithm standard; Step S32: Certificate chain integrity verification: Extract the digital certificate path, recursively verify the revocation status list of the upper-level CA certificate and the OCSP response. If it is detected that the certificate has been revoked but is still used for signing, a high-risk alarm is triggered. Step S33: Timestamp Non-repudiation Verification: Verify the logical binding relationship between the token issued by the timestamp server and the electronic signature value to prevent retroactive signature.

4. The medical electronic signature verification method based on network traffic analysis according to claim 3, characterized in that, Step S3 also includes the following steps: Step S34: Context consistency verification: Extract the hash values ​​of key fields in the electronic medical record business data; compare the hash values ​​with the original hash values ​​encapsulated in the digital envelope; if the two are inconsistent, it is determined to be a shadow signature attack or system configuration tampering, and the session connection is immediately terminated.

5. The medical electronic signature verification method based on network traffic analysis according to claim 1, characterized in that, Step S4, which involves deriving the root causes of risk based on the results of multidimensional analysis, specifically includes: When an invalid electronic signature is detected, a pre-defined fault tree analysis model is invoked. The failure node is located based on the decision tree algorithm, which distinguishes between "client driver not installed", "USB key hardware failure" and "server certificate configuration expired". Generate a work order containing specific repair suggestions and associate it with the digital identity UID of the specific medical staff.

6. The medical electronic signature verification method based on network traffic analysis according to claim 5, characterized in that, Following step S4, an adaptive response step S5 is also included, which specifically includes: Receive rectification confirmation signals triggered by the front end and mark electronic medical record data that have not passed the compliance assessment; The next time the healthcare worker attempts to log in to the system, they will be forcibly redirected to the digital certificate update page until a compliant signature replacement is completed. For archived illegal signature data, the backend data correction interface automatically generates and executes data cleaning tasks based on the rule engine to replace the illegal signature data with verified compliant signature data.

7. The medical electronic signature verification method based on network traffic analysis according to claim 6, characterized in that, The compliant signature replacement step in step S5 specifically includes: By employing seamless replacement technology, non-compliant signature requests from the backend are intercepted without altering the original business processes and user interface. The system automatically calls a collaborative signature interface that conforms to specific standards to regenerate the signature and writes the new signature back to the electronic medical record database.

8. A medical electronic signature verification system based on network traffic analysis, characterized in that, The device includes a targeted cryptographic application parsing device, which is deployed in the tested hospital network and communicates with the core switch. The device has a built-in processor and a memory storing computer programs. When the processor executes the programs in the memory, it performs the functions of the following modules: The online data acquisition module is used to passively access the core switch of the hospital network under test through the optical splitter or mirror port, collect all network traffic involving electronic signature service technology, and filter irrelevant business traffic based on the preset whitelist policy. The data parsing module is used to perform protocol-level deep decoding on the filtered full network traffic, identify and extract medical online signature application data, patient electronic signature application data and collaborative signature data through a bidirectional semantic mapping mechanism, and normalize the extracted data into standardized signature event objects. The data analysis module is used to construct a dynamic cryptographic behavior baseline. The signature event object is input into the data analysis module, and the validity of the electronic signature is analyzed from multiple dimensions by comparing the deviation between the real-time signature behavior and the baseline and combining cryptographic algorithm verification. The results output module generates a compliance assessment report based on multi-dimensional analysis, including risk root cause deductions, and displays it visually through the front-end interface. It also dynamically adjusts subsequent traffic collection strategies based on the assessment results. Specifically, a bidirectional semantic mapping mechanism is used to identify and extract data from medical online signature applications, patient electronic signature applications, and collaborative signatures, including: Establish a mapping table between application layer business semantics and underlying cryptographic operation semantics; Parse the business serial number and personnel UID from the JSON or XML payload of the application layer traffic, and extract the digital certificate sequence number from the Certificate message in the subsequent TLS handshake packet of the session within a millisecond time window; If a business serial number exists within the same session period but the corresponding digital certificate serial number is not detected, an "uncoupling of signature behavior and business operation" exception is triggered.

Images