An intelligent management and security control system for cross-institutional medical data platform

Abstract

This invention relates to the field of medical information technology, specifically disclosing a cross-institutional medical data platform intelligent governance and security management system. It constructs an original gene-phenotype feature set by collecting whole-exome sequencing data and clinical phenotypic labels from multiple medical institutions; converts this set into an integer gradient tensor over a finite domain using isofrequency site scattering encoding; splits the tensor into multiple numerical fragments using a dynamic thresholding method and distributes them to independent computing nodes; each node performs masked addition aggregation on the fragments to restore the unmasked aggregated fragments; any two nodes exchange aggregated fragments and perform cross-validation recombination to recover the full gradient mean for updating local parameters; this invention achieves zero-precision loss in gradient aggregation and robust privacy protection against attacks, while ensuring that gene data does not leave the hospital.

Description

Technical Field

[0001] This invention relates to the field of medical information technology, specifically to a cross-institutional medical data platform intelligent governance and security management system. Background Technology

[0002] With the rapid development of gene sequencing technology and the increasing demand for medical data sharing, cross-institutional collaborative analysis of whole-exome sequencing data and clinical phenotypic tags has become an important means of discovering pathogenic sites for rare diseases and conducting precision medicine research. However, gene data is highly sensitive, and laws and regulations in most countries generally require that raw sequencing data not leave the hospital's internal servers, which poses a serious challenge to cross-institutional data fusion and collaborative modeling.

[0003] In existing cross-institutional gene-phenotype joint analysis, federated learning has to introduce differential privacy noise or homomorphic encryption perturbations to defend against gradient inversion attacks and member inference attacks, resulting in a decrease in model prediction accuracy to a clinically unacceptable level. This invention, however, dynamically divides the integer gradient tensor into random component fragments and uses a secret sharing method for noise-free and accurate aggregation. Under the premise that the computing nodes cannot restore any original gradient information, the recovered full gradient mean is numerically completely consistent with the plaintext direct aggregation result, thereby simultaneously achieving strong protection of gene data privacy and zero loss of clinical-grade model accuracy. Summary of the Invention

[0004] The purpose of this invention is to provide a cross-institutional medical data platform intelligent governance and security management system to solve the problems mentioned above.

[0005] The objective of this invention can be achieved through the following technical solutions: A cross-institutional medical data middleware intelligent governance and security management system includes: The data acquisition module is used to collect whole-exome sequencing data and their corresponding clinical phenotypic labels from multiple medical institutions as the original gene-phenotype feature set. The tensor coding module converts the original gene-phenotype feature set into an integer gradient tensor over the same finite field by scattering and encoding the original gene-phenotype feature set according to the equal frequency sites within each institution. The fragmentation module uses a dynamic thresholding method to split the integer gradient tensor into multiple numerical fragments, which are then distributed to multiple independent computing nodes. In the mask aggregation module, each computing node performs fragment mask addition aggregation on the received numerical fragments to obtain its corresponding aggregated fragments; The reorganization and update module is used to exchange aggregated fragments between any two computing nodes and perform asymmetric mutual verification reorganization to recover the accurate full gradient mean, which is used to update the local parameters of each mechanism.

[0006] As a further aspect of the present invention: the construction process of the original gene-phenotype feature set is as follows: Low-frequency variant sites were screened out from the whole exome sequencing data of various institutions, and sites with minor allele frequencies higher than 0.5% were retained to obtain the filtered gene sequences. The filtered gene sequences and corresponding clinical phenotypic labels are spatiotemporally aligned according to the patient's unique identifier, and hierarchical numerical mapping is performed on the phenotypic labels to obtain the aligned phenotypic codes. The aligned phenotypic codes and filtered gene sequences are spliced ​​position by position to form the original gene-phenotype feature set with patients as rows and loci as columns.

[0007] As a further aspect of the present invention: the transformation process of the integerized gradient tensor is as follows: Traverse all values ​​of each locus in the original gene-phenotype feature set, calculate the boundaries of each isofrequency quantile, and obtain the quantile threshold sequence for each locus; Based on the quantile threshold sequence, the original value at each site is mapped to its quantile interval number to generate an equal frequency scattering index matrix; Multiply each index in the equal-frequency scattering index matrix by the predefined extended field basis of the finite field, and then take the modulus of a fixed prime number to obtain the integerized gradient tensor.

[0008] As a further aspect of the present invention: the generation of the equal-frequency scattering index matrix specifically includes: For the current site, read the quantile threshold sequence of the current site, calculate the squared difference between the original value and each pair of adjacent thresholds, and select the threshold pair with the smallest squared difference as the target interval; The left and right thresholds of the target interval are geometrically averaged, and the index of the target interval is single-step corrected based on the difference in the sign between the original value and the geometric mean to obtain the corrected index. The corrected serial numbers of all sites are stacked in order of patient identification to form an isofrequency scattering index matrix.

[0009] As a further aspect of the present invention: the allocation to multiple independent computing nodes specifically includes: Extract the absolute values ​​of all non-zero elements in the integerized gradient tensor and calculate the median as the baseline splitting threshold; Each element value is compared with the baseline splitting threshold. If it is greater than the threshold, the element is split into the difference of three random components. Otherwise, it is split into the sum of two random components to obtain the component set corresponding to each element. The component sets of each element are repackaged according to the number of computing nodes, and each node obtains one component of each element, forming the numerical fragments of each node.

[0010] As a further aspect of the present invention: obtaining the respective corresponding aggregate fragments specifically includes: Each computing node will sort all received numerical fragments in ascending order according to the number of the institution from which the fragments originated, forming an ordered fragment queue; Take out each fragment from the ordered fragment queue in sequence, and perform a prime modulo addition operation on it with the one-time mask value stored locally in the node to obtain the masked fragment; Summing up all the masked fragments yields the total masked aggregate; By successively subtracting all the one-time mask values ​​used from the masked aggregate sum, the unmasked aggregate fragments are restored.

[0011] As a further aspect of the present invention: obtaining the masked fragments specifically includes: Read the source organization number and its order position in the queue of the current fragment, concatenate the two and input them into the linear feedback shift register, and iteratively generate pseudo-random integers; The dynamic mask value is obtained by taking the remainder of the pseudo-random integer with respect to a preset prime number; The current fragment value is added to the dynamic mask value, and then modulo the result by a preset prime number to obtain the masked fragment.

[0012] As a further aspect of the present invention: the updating of local parameters of each mechanism specifically includes: The first computing node sends its first aggregate fragment to the second computing node, while the second computing node sends its second aggregate fragment to the first computing node. The first computing node calculates a cross-check hash value using the second aggregated fragment and its own first aggregated fragment; the second computing node calculates a cross-check hash value using the first aggregated fragment and its own second aggregated fragment. Both parties exchange and compare the cross-check hash values. If they are equal, the following steps are taken: the first aggregate fragment and the second aggregate fragment are added bit by bit and then decoded to recover the full gradient mean. If they are not equal, the current fragment is discarded and a retransmission is requested.

[0013] The beneficial effects of this invention are: (1) This invention employs a secret sharing and noiseless gradient aggregation mechanism. Each institution only needs to upload the random components of the gradient fragments, and no single computing node can reconstruct the original gradient, thereby effectively preventing gradient inversion attacks and member inference attacks. Since the entire aggregation process does not introduce differential privacy noise, the recovered full gradient mean is numerically identical to the plaintext direct aggregation result, avoiding the problem of decreased model accuracy caused by traditional privacy protection methods, and meeting the requirements of gene-phenotype association analysis for clinical-grade prediction accuracy.

[0014] (2) This invention uses a dynamic threshold segmentation method to adaptively select a two- or three-component splitting strategy based on the gradient value, thereby reducing the generation of redundant components while ensuring security. At the same time, a linear feedback shift register is used to generate dynamic mask values, avoiding the high computational overhead caused by large integer homomorphic encryption. Attached Figure Description

[0015] The invention will now be further described with reference to the accompanying drawings.

[0016] Figure 1 This is a system block diagram of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see Figure 1 As shown, this invention is a cross-institutional medical data platform intelligent governance and security management system, comprising: The data acquisition module is used to collect whole-exome sequencing data and their corresponding clinical phenotypic labels from multiple medical institutions as the original gene-phenotype feature set. The tensor coding module converts the original gene-phenotype feature set into an integer gradient tensor over the same finite field by scattering and encoding the original gene-phenotype feature set according to the equal frequency sites within each institution. The fragmentation module uses a dynamic thresholding method to split the integer gradient tensor into multiple numerical fragments, which are then distributed to multiple independent computing nodes. In the mask aggregation module, each computing node performs fragment mask addition aggregation on the received numerical fragments to obtain its corresponding aggregated fragments; The reorganization and update module is used to exchange aggregated fragments between any two computing nodes and perform asymmetric mutual verification reorganization to recover the accurate full gradient mean, which is used to update the local parameters of each mechanism.

[0019] The data acquisition module is used to collect whole-exome sequencing data and their corresponding clinical phenotypic labels from multiple medical institutions, serving as the original gene-phenotype feature set, specifically including: Whole-exome sequencing data was collected from multiple medical institutions. This data originated from the raw base sequence files obtained after whole-exome capture sequencing of peripheral blood samples from patients. Simultaneously, clinical phenotypic labels corresponding to each sequencing sample were collected. These labels included classification information such as whether the patient had the disease and the severity level of the disease. During the collection process, sequencing files and phenotypic records from each institution's internal database were exported as comma-separated values ​​through a unified interface provided by the data platform, with the patient's unique identifier used as the primary key.

[0020] When screening for low-frequency variant sites in whole-exome sequencing data from various medical institutions, the first step is to extract all single nucleotide variant sites from each patient's sequencing file and count the occurrences of the minor allele at each site across all patient populations. The minor allele frequency is calculated, which is equal to the number of minor allele occurrences divided by the total number of alleles. This calculated frequency is compared to a 0.5% allele; sites with a frequency greater than 0.5% are retained, while sites with a frequency less than or equal to 0.5% are deleted, resulting in the filtered gene sequence. This filtered gene sequence is stored in matrix form, with rows corresponding to patients and columns corresponding to retained sites. Matrix elements encode the base type at each site.

[0021] When aligning the filtered gene sequences with their corresponding clinical phenotype tags based on patient uniqueness, the process begins by extracting the patient unique identifier from each row of the filtered gene sequence. Then, records with the same identifier are searched in the clinical phenotype tag data. If multiple phenotype records exist for the same identifier at multiple time points, the record with the closest sampling time to the gene sequencing time is used for association. After association, hierarchical numerical mapping is performed on the clinical phenotype tags. Specifically, if the phenotype is binary (e.g., diseased and not diseased), diseased is mapped to the value 1, and not diseased is mapped to the value 0; if the phenotype is ordered multi-category (e.g., mild, moderate, severe), it is mapped to the values ​​0, 1, and 2 respectively; if the phenotype is a continuous value (e.g., blood pressure), the original value is retained. The resulting aligned phenotype code matches the row order of the filtered gene sequence.

[0022] When concatenating the aligned phenotypic codes with the filtered gene sequences position by position, a new data matrix is ​​first created. This matrix has the same number of rows as the total number of patients and the same number of columns as the filtered gene sequence plus one. The aligned phenotypic codes are placed as the first column of the new matrix. Then, each column of the filtered gene sequence is sequentially filled into the subsequent columns of the new matrix in its original order. For each locus in the gene sequence, if a missing value exists at that locus, it is filled using the mode of that locus within the same institution.

[0023] After the above splicing is completed, an original gene-phenotype feature set is formed, with patients as rows and loci as columns. Each row of this feature set represents complete information for a patient, with the first column being the phenotypic coding value and subsequent columns being the coding values ​​for each gene locus. This feature set serves as the direct input data for the subsequent isofrequency scattering coding step.

[0024] For example: If an institution has 100 patients, and after screening out low-frequency variants, retains 2000 loci, then the original gene-phenotype feature set would be 100 rows and 2001 columns. The first column is the phenotype code (0 or 1), and columns 2 to 2001 are the base codes for each locus (for example, homozygous reference, heterozygous, and homozygous variant are encoded as 0, 1, and 2, respectively).

[0025] In the tensor coding module, the original gene-phenotype feature set is scattered and encoded according to the isofrequency sites within each institution, and then converted into an integer gradient tensor over the same finite field. Specifically, this includes: The original gene phenotypic feature set is converted into an integer gradient tensor over the same finite domain. This conversion takes the original gene phenotypic feature set as input, which contains multiple loci, each corresponding to a single row of numerical values. The resulting integer gradient tensor is a tensor with the same number of rows and columns as the feature set, and all its elements are integers; it is used in the subsequent fragmentation step.

[0026] When calculating the isofrequency quantile boundaries for each locus by iterating through all values ​​in the original gene phenotypic feature set, the specific steps are as follows: For the current locus, retrieve the original values ​​for that locus in all patients and arrange these values ​​in ascending order. Assuming a preset number of quantiles is ten, the arranged numerical sequence is evenly divided into ten intervals, each containing approximately the same number of values. Calculate the minimum and maximum values ​​for each interval, and arrange the minimum and maximum values ​​sequentially to obtain the quantile threshold sequence for the current locus. For example, the left boundary of the first interval is the minimum value of all values ​​for that locus, and the right boundary is the tenth percentile; the left boundary of the second interval is the tenth percentile, and the right boundary is the twentieth percentile, and so on, until the right boundary of the tenth interval is the maximum value. This yields a quantile threshold sequence containing eleven boundary values.

[0027] When mapping the original value at each site to its corresponding quantile interval number based on the quantile threshold sequence, the first step is to determine which quantile interval each original value falls into. For an original value at the current site, it is compared with each pair of adjacent boundary values ​​(i.e., the left threshold and the right threshold) in the quantile threshold sequence. If the original value is greater than or equal to the left threshold and less than the right threshold, then the value belongs to this interval. The order of this interval in the entire sequence is recorded, and this order is used as the initial index of the original value. After mapping all values, the index sequence at each site is obtained, but this index sequence still needs further correction to form the final isofrequency scattering index matrix.

[0028] The specific steps for correcting the target interval index are as follows: For an original value at the current location, first read the quantile threshold sequence of the current location and extract the pair of adjacent thresholds (i.e., the left threshold and the right threshold) within the interval containing that value. Calculate the difference between the original value and the left threshold, and square this difference; then calculate the difference between the original value and the right threshold, and square this difference as well. Add these two squared values ​​to obtain the sum of squared differences. Iterate through all adjacent threshold pairs, find the pair with the smallest sum of squared differences, and use the interval corresponding to this pair of thresholds as the target interval. Subsequently, calculate the geometric mean of the left and right thresholds of the target interval, multiply the left and right thresholds, and take the square root of the product. Compare the original value with the geometric mean: if the original value is greater than the geometric mean, increment the target interval index by one; if the original value is less than the geometric mean, decrement the target interval index by one; if they are equal, keep the index unchanged. After the above single-step correction, the corrected index is obtained.

[0029] The corrected ordinal numbers of all loci are stacked in patient identifier order to form an isofrequency scattering index matrix. Specifically, the original order of patients in the original genotype feature set is maintained. The corrected ordinal numbers for each patient at each locus are extracted, and these ordinal numbers are filled into a new matrix with patients as rows and loci as columns. This matrix has the same number of rows and columns as the original feature set, and each element is a positive integer ranging from 1 to 10 (if the number of quantiles is 10). This matrix is ​​the isofrequency scattering index matrix.

[0030] When converting an isofrequency scattering index matrix into an integer gradient tensor, a preset finite field extension cardinality and a fixed prime number are first defined. For example, the extension cardinality is set to two, and the fixed prime number is two hundred and eleven thousand four million seven hundred and forty-eight thousand three hundred and sixty-four seventy-eight thousand sixty-seven. For each index in the isofrequency scattering index matrix, the index value is first multiplied by the extension cardinality of two to obtain a product; then, the remainder of this product is calculated by dividing it by the fixed prime number, i.e., subtracting an integer multiple of the fixed prime number from the product, until the remainder is less than the fixed prime number. All the remainders obtained are arranged in the row and column order of the original matrix to form an integer gradient tensor. Each element in this tensor is an integer between zero and the fixed prime number minus one, and all elements fall within the same finite field.

[0031] In the fragmentation module, a dynamic thresholding method is used to split the integer gradient tensor into multiple numerical fragments, which are then distributed to multiple independent computation nodes. Specifically, this includes: Obtain an integerized gradient tensor where each element is a non-negative integer, and some elements may be zero. To determine a dynamic splitting threshold, extract the absolute values ​​of all non-zero elements in this tensor. Since all elements are non-negative integers, their absolute values ​​are themselves. Extract these non-zero elements to form a one-dimensional sequence, then sort the sequence and find the value in the middle position as the median. If the sequence length is odd, the median is the middle value; if the length is even, take the average of the two middle values ​​and round the average to zero as the threshold splitting threshold.

[0032] Each element value is compared to a baseline splitting threshold, and different splitting strategies are applied based on the comparison results. If the element's value is greater than the baseline splitting threshold, the element is split into the difference of three random components. Specifically, two random integers between zero and the element's value are generated, denoted as the first random component and the second random component, respectively. Then, the element's value is calculated by adding the second random component and subtracting the first random component, resulting in the third random component. At this point, the element equals the first random component minus the second random component plus the third random component, equivalent to the difference of the three random components. If the element's value is less than or equal to the baseline splitting threshold, the element is split into the sum of two random components. Specifically, a random integer between zero and the element's value is generated as the first random component, and then the element's value is subtracted from the first random component to obtain the second random component. At this point, the element equals the sum of the first and second random components. After the above splitting, each element obtains a set of components belonging to that element, where each component is an integer.

[0033] The component sets of each element are repackaged according to the number of computing nodes. Assuming three independent computing nodes are pre-set, for each element, if it is divided into three components, the three components are directly assigned to the first, second, and third nodes in sequence. If the element is divided into two components, these two components need to be expanded into three values ​​so that each node still receives one value. The expansion method is as follows: the second component is split into two random integers, the sum of which equals the original second component, and these are assigned to the second and third nodes respectively, while the first node receives the first component. After this packaging, each element generates three values, corresponding to the three computing nodes.

[0034] The numerical values ​​obtained from all elements at each node are organized according to the positional order of the elements in the original tensor, forming the numerical fragment for that node. Specifically, for the first node, the numerical value assigned to each element is extracted and arranged into a matrix with the same dimensions as the original tensor according to the row and column order of these elements in the integer gradient tensor. This matrix is ​​the numerical fragment for the first node. Similarly, numerical fragments are constructed for the second and third nodes respectively.

[0035] After the above packaging is completed, each of the three numerical fragments contains a portion of the original integerized gradient tensor after random splitting. No single fragment can reconstruct any element value from the original tensor because the splitting process introduces randomness and the components are related through addition or difference. Furthermore, the splitting threshold is dynamically determined based on the median of the current tensor's non-zero elements, thus exhibiting adaptability.

[0036] The three numerical fragments are sent to three independent computing nodes via secure channels. Each node receives one fragment and stores it in its local memory for subsequent fragment mask addition aggregation steps. During the allocation process, each node receives only one copy of the fragment, and the fragments are not mutually deducible.

[0037] In the mask aggregation module, each computing node performs fragment mask addition aggregation on the received numerical fragments to obtain its corresponding aggregated fragments, specifically including: After receiving numerical fragments from multiple medical institutions, each computing node needs to aggregate these fragments. The number of fragments received by each node equals the number of participating institutions, and each fragment is a matrix with the same dimension as the original integerized gradient tensor. To ensure data security during the aggregation process, the node first sorts all received numerical fragments in ascending order by the institution's ID. The institution ID is a unique positive integer assigned to each participating hospital by the central coordinator during the initialization phase, for example, IDs 1, 2, 3, 4, and 5. After sorting, the node forms an ordered fragment queue locally, with the fragment order in the queue consistent with the institution ID order.

[0038] The node sequentially retrieves each fragment from the ordered fragment queue and performs a masking operation on it. The masking operation requires a mask value stored locally on the node; this mask value is not pre-fixed but dynamically generated by a linear feedback shift register. The initial seed of the linear feedback shift register is randomly generated by the node at startup and securely stored in memory. For the fragment currently being processed, the node reads the source organization number of the fragment and its position in the ordered fragment queue (e.g., the first fragment's position is 1, the second is 2, and so on), concatenates these two values ​​into an integer: organization number multiplied by 100 plus the position. This concatenated integer is used as the input state of the linear feedback shift register, and then the shift operation is performed according to the following iterative formula: ; in, This indicates the current state value in the register (the initial state is a concatenated integer). The multiplier coefficient is 1664525, and cc is the increment coefficient with a value of 1013904223. The modulus is 2 to the power of 32. This is the new state value obtained after one iteration. Each iteration generates a 32-bit pseudo-random integer. After 8 consecutive iterations, the 8 32-bit integers are concatenated into a 256-bit pseudo-random integer, which serves as the dynamic mask value corresponding to the current fragment.

[0039] After obtaining the dynamic mask value, the node needs to perform a prime-number modulo addition operation between this mask value and the value of the current fragment. The preset prime number here is a fixed prime number, with a value of 2147483647. Let the value at a certain position in the current fragment be... The integer derived from the byte fragment at the corresponding position of the dynamic mask value is Then, the value zz at the same position in the masked fragment is calculated according to the following formula: ; in, That is, the preset prime number 2147483647, " indicates calculation Divide by The remainder obtained. If Exactly equal to If the remainder is an integer multiple of the sum, then the remainder is 0. Each node performs the above modular addition operation on each element in the fragment matrix, and the resulting matrix is ​​the masked fragment.

[0040] The node sums all generated masked fragments. Specifically, it creates an all-zero matrix with the same dimensions as the original fragments as an accumulator. Then, it iterates through each masked fragment, adding each element of the current fragment to the corresponding element in the accumulator, and writing the result back to the accumulator. After processing all masked fragments, the accumulator stores the total masked sum. Because dynamic mask values ​​are introduced during masking, this total sum is not the true fragment aggregation result.

[0041] The node needs to reconstruct the unmasked aggregate fragments from the masked aggregate sum. The reconstruction process involves successively subtracting all previously used one-time mask values. In the previous masking steps, the node has sequentially generated and recorded the dynamic mask value sequence corresponding to each fragment, in the same order as the ordered fragment queue. The node creates a reconstruction matrix with the same dimension as the accumulator, initialized with the masked aggregate sum. Then, following the reverse order of fragment processing (from the last fragment to the first fragment), it sequentially performs the operation of subtracting the corresponding mask value from each element in the reconstruction matrix and then taking the modulo of a preset prime number. Specifically, for the mask value matrix of the i-th fragment, each element in the reconstruction matrix is ​​updated by subtracting the value at the corresponding position in the mask value matrix from that element. If the result is negative, a preset prime number is added until the result falls within the range of 0 to the preset prime number minus one. After completing all subtraction operations, the values ​​in the reconstruction matrix are the unmasked aggregate fragments. These aggregate fragments are equal to the direct sum of the original value fragments of each node and do not contain any mask information, making them directly usable in subsequent reassembly steps.

[0042] The reorganization and update module is used to exchange aggregated fragments between any two computing nodes and perform asymmetric cross-validation reorganization to recover the accurate full gradient mean, which is then used to update the local parameters of each mechanism. Specifically, this includes: The first computing node establishes a bidirectional secure communication channel with the second computing node. The first computing node extracts its locally stored first aggregate fragment, which is an integer matrix whose elements all belong to a finite field formed by preset prime numbers. The first node converts the entire matrix into a binary data stream in row-major order, attaches its own digital signature, and sends it to the second computing node. Simultaneously, the second computing node also converts its second aggregate fragment into a binary data stream, attaches its digital signature, and sends it to the first computing node. The sending and receiving operations between the two nodes occur simultaneously without blocking each other.

[0043] After receiving the second aggregate fragment, the first computing node calculates a cross-check hash value using the second aggregate fragment and its own existing first aggregate fragment. Specifically, all elements from the first aggregate fragment are extracted in row-major order, followed by all elements from the immediately following second aggregate fragment in the same order. These two sequences are then concatenated into a single integer sequence. Each integer in this sequence is converted to a 4-byte binary representation and concatenated to form a continuous binary data segment. A 256-bit version of the secure hash algorithm is then used to hash this binary data, yielding a fixed-length 256-bit hash value, denoted as the first cross-check hash value. Similarly, the second computing node uses the received first aggregate fragment and its own second aggregate fragment, following the exact same concatenation order (first fragment first, then second fragment) and hash algorithm, to calculate the second cross-check hash value.

[0044] The first computing node sends its calculated first cross-validation hash value to the second computing node via a secure channel, while the second computing node sends its calculated second cross-validation hash value to the first computing node. Upon receiving each other's hash values, both nodes perform a comparison. The first computing node compares the received second cross-validation hash value with its own calculated first cross-validation hash value, and the second computing node performs a similar symmetrical comparison.

[0045] If the two hash values ​​are equal, it indicates that the first and second aggregated fragments have not been tampered with during transmission, and that the two fragments come from the same set of original gradient tensors, allowing for continued recombination. At this point, the first and second computing nodes jointly perform a bitwise addition operation on the aggregated fragments. Specifically, the first node adds each element of its first aggregated fragment to the corresponding element of the second aggregated fragment sent by the second node, obtaining the sum. Since the elements in both fragments belong to finite fields, if the result exceeds a preset prime number minus one, the preset prime number is subtracted until the result falls within the range of zero to the preset prime number minus one. After the addition is complete, the full gradient aggregation matrix is ​​obtained.

[0046] The full gradient aggregation matrix is ​​decoded. Decoding assumes that the method by which each original gradient element was split in the previous fragmentation step is known (based on the random component combination in the dynamic thresholding method). During decoding, the original gradient values ​​are recovered from the aggregation matrix based on the pre-stored component count flags for each element (three or two components). For elements that originally had three component differences, the values ​​of the corresponding components in the first and second fragments are added together, and then merged according to the positive / negative relationship recorded during the splitting process to obtain the original integer gradient values. After recovering all elements, a complete full gradient tensor is formed. Each value in this tensor is divided by the number of participating mechanisms (i.e., the denominator of the gradient mean) to obtain the full gradient mean.

[0047] The recovered full gradient mean is broadcast to all participating institutions via a secure channel. Each institution, upon receiving the mean, multiplies it by a negative learning rate and adds it to its local model parameters, completing one round of parameter updates. If a hash value discrepancy is found, the first and second computing nodes each discard their respective fragments and send a retransmission request to the central coordinator. The central coordinator then instructs all computing nodes to retransmit their aggregated fragments, repeating the exchange and verification steps until the hash value comparison passes.

[0048] The working principle of this invention is as follows: Whole-exome sequencing data and clinical phenotypic tags from multiple medical institutions are collected. After screening for low-frequency variant sites, spatiotemporal alignment, and hierarchical numerical mapping, an original gene phenotypic feature set is constructed with patients as rows and loci as columns. This feature set is then scatter-encoded according to the isofrequency loci within each institution. By calculating the isofrequency quantile boundary for each point, mapping the original values ​​to quantile interval indices and correcting them, and then converting them into an integer gradient tensor over the same finite field through expanded-field cardinality multiplication and fixed-prime modulo operation. Next, a dynamic threshold segmentation method is used, with the median of the absolute values ​​of the non-zero elements in the tensor as the segmentation threshold. Elements exceeding the threshold are segmented into three random segments. The difference between components and elements not exceeding a threshold are divided into the sum of two random components and repackaged according to the number of computing nodes, generating a numerical fragment for each node. Each computing node sorts all received numerical fragments by source institution number, and uses a linear feedback shift register to dynamically generate a mask value for each fragment. Prime number modulo addition is performed to obtain masked fragments, and the sum is accumulated and then the mask value is subtracted successively to restore the unmasked aggregated fragments. Any two computing nodes exchange their aggregated fragments, calculate cross-validation hash values ​​for comparison, and after verification, the two fragments are added bit by bit and decoded to recover the full gradient mean, which is used to update the local parameters of each institution.

[0049] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A cross-institutional medical data platform intelligent governance and security management system, characterized in that, include: The data acquisition module is used to collect whole-exome sequencing data and their corresponding clinical phenotypic labels from multiple medical institutions as the original gene-phenotype feature set. The tensor coding module converts the original gene-phenotype feature set into an integer gradient tensor over the same finite field by scattering and encoding the original gene-phenotype feature set according to the equal frequency sites within each institution. The fragmentation module uses a dynamic thresholding method to split the integer gradient tensor into multiple numerical fragments, which are then distributed to multiple independent computing nodes. In the mask aggregation module, each computing node performs fragment mask addition aggregation on the received numerical fragments to obtain its corresponding aggregated fragments; The reorganization and update module is used to exchange aggregated fragments between any two computing nodes and perform asymmetric mutual verification reorganization to recover the accurate full gradient mean, which is used to update the local parameters of each mechanism.

2. The intelligent governance and security management system for cross-institutional medical data platforms according to claim 1, characterized in that, The process of constructing the original gene-phenotype feature set is as follows: Low-frequency variant sites were screened out from the whole exome sequencing data of various institutions, and sites with minor allele frequencies higher than 0.5% were retained to obtain the filtered gene sequences. The filtered gene sequences and corresponding clinical phenotypic labels are spatiotemporally aligned according to the patient's unique identifier, and hierarchical numerical mapping is performed on the phenotypic labels to obtain the aligned phenotypic codes. The aligned phenotypic codes and the filtered gene sequences are spliced ​​position by position to form the original gene-phenotype feature set with patients as rows and loci as columns.

3. The intelligent governance and security management system for cross-institutional medical data platforms according to claim 1, characterized in that, The transformation process of the integerized gradient tensor is as follows: Traverse all values ​​for each locus in the original gene-phenotype feature set, calculate the boundaries of each isofrequency quantile, and obtain the quantile threshold sequence for each locus; Based on the quantile threshold sequence, the original value at each site is mapped to its quantile interval number to generate an equal frequency scattering index matrix; Multiply each index in the equal-frequency scattering index matrix by the predefined extended field basis of the finite field, and then take the modulus of a fixed prime number to obtain the integerized gradient tensor.

4. The intelligent governance and security management system for cross-institutional medical data platforms according to claim 3, characterized in that, The generation of the equal-frequency scattering index matrix specifically includes: For the current site, read the quantile threshold sequence of the current site, calculate the squared difference between the original value and each pair of adjacent thresholds, and select the threshold pair with the smallest squared difference as the target interval; The left and right thresholds of the target interval are geometrically averaged, and the index of the target interval is single-step corrected based on the difference in the sign between the original value and the geometric mean to obtain the corrected index. The corrected serial numbers of all sites are stacked in order of patient identification to form an isofrequency scattering index matrix.

5. The intelligent governance and security management system for cross-institutional medical data platforms according to claim 1, characterized in that, The allocation to multiple independent computing nodes specifically includes: Extract the absolute values ​​of all non-zero elements in the integerized gradient tensor and calculate the median as the baseline splitting threshold; Each element value is compared with the baseline splitting threshold. If it is greater than the threshold, the element is split into the difference of three random components. Otherwise, it is split into the sum of two random components to obtain the component set corresponding to each element. The component sets of each element are repackaged according to the number of computing nodes, and each node obtains one component of each element, forming the numerical fragments of each node.

6. The intelligent governance and security management system for cross-institutional medical data platforms according to claim 1, characterized in that, The acquisition of the corresponding aggregate fragments specifically includes: Each computing node will sort all received numerical fragments in ascending order according to the number of the institution from which the fragments originated, forming an ordered fragment queue; Take out each fragment from the ordered fragment queue in sequence, and perform a prime modulo addition operation on it with the one-time mask value stored locally in the node to obtain the masked fragment; Summing up all the masked fragments yields the total masked aggregate; By successively subtracting all the one-time mask values ​​used from the masked aggregate sum, the unmasked aggregate fragments are restored.

7. The intelligent governance and security management system for cross-institutional medical data platforms according to claim 6, characterized in that, The process of obtaining the masked fragments specifically includes: Read the source organization number and its order position in the queue of the current fragment, concatenate the two and input them into the linear feedback shift register, and iteratively generate pseudo-random integers; The dynamic mask value is obtained by taking the remainder of the pseudo-random integer with respect to a preset prime number; The current fragment value is added to the dynamic mask value, and then modulo the result by a preset prime number to obtain the masked fragment.

8. The intelligent governance and security management system for cross-institutional medical data platforms according to claim 1, characterized in that, The updating of local parameters for each institution specifically includes: The first computing node sends its first aggregate fragment to the second computing node, while the second computing node sends its second aggregate fragment to the first computing node. The first computing node calculates a cross-check hash value using the second aggregated fragment and its own first aggregated fragment; the second computing node calculates a cross-check hash value using the first aggregated fragment and its own second aggregated fragment. Both parties exchange and compare the cross-check hash values. If they are equal, the following steps are taken: the first aggregate fragment and the second aggregate fragment are added bit by bit and then decoded to recover the full gradient mean. If they are not equal, the current fragment is discarded and a retransmission is requested.

Images