Method and device for reversible de-identification and backtracking of medical data based on authorization chain

Abstract

This application discloses a method and apparatus for reversible desensitization and backtracking of medical data based on an authorization chain. The method divides medical data into identification fields, sensitive fields, and auxiliary fields, and performs two-level desensitization; it uses a threshold secret sharing algorithm to divide the encryption key into multiple fragments and distribute them to multiple authorized parties such as patients, medical institutions, compliance agencies, and auditing agencies; all desensitization and backtracking events are recorded on the blockchain to form an auditable authorization chain; when backtracking is needed, the requesting party collects a threshold number of key fragments to reconstruct the key and decrypt the sensitive fields. This scheme overcomes the technical shortcomings of existing medical data desensitization methods, such as irreversible desensitization, single-point key storage risk, lack of multi-party authorization mechanisms, and difficulty in auditing access behavior.

Description

Technical Field

[0001] This application relates to the fields of data security and medical information technology, specifically to a method and apparatus for reversible desensitization and traceability of medical data based on an authorization chain. Background Technology

[0002] With the development of cross-border medical services, medical data needs to flow between different institutions and jurisdictions, making data anonymization a core means of protecting patient privacy. However, existing medical data anonymization methods mostly employ irreversible anonymization, which prevents doctors from obtaining complete medical histories during subsequent follow-up visits or consultations, affecting the continuity of medical care.

[0003] Existing technologies include methods for masking sensitive fields in medical data using pre-defined field rules. However, these methods have the following shortcomings: (1) the masking is irreversible and the original data cannot be recovered, affecting the continuity of clinical diagnosis and treatment; (2) there is a lack of access control mechanisms, and all visitors are exposed to the same masking result, making it impossible to differentiate authorization based on the purpose of access; (3) it does not support cross-border multi-party collaborative recovery scenarios; and (4) there is a lack of auditable evidence for the masking and backtracking process.

[0004] Existing technologies also include medical data desensitization methods based on single-key encryption, where the key is kept solely by the data controller. The shortcomings of this approach are: (1) Single-point storage poses a risk of key leakage; (2) It cannot meet the compliance requirements of multiple jurisdictions across borders (such as simultaneously meeting the "multi-party authorization" requirements of GDPR, PIPL, and HIPAA); (3) Once the controller loses contact, the encrypted data becomes "dead data".

[0005] In summary, the existing technology has the following technical problems: First, medical data cannot be traced back after anonymization, affecting the continuity of diagnosis and treatment; second, the single-point storage of anonymization keys poses a risk of leakage; third, there is a lack of a multi-party authorization mechanism that is compatible with the compliance requirements of multiple jurisdictions; and fourth, access behavior lacks auditable and traceable evidence. Summary of the Invention Technical issues

[0006] To address the problems of irreversible desensitization of medical data, single-point key storage risks, lack of multi-party authorization mechanisms, and difficulty in auditing access behavior in existing technologies, this application provides a method and apparatus for reversible desensitization and traceability of medical data based on an authorization chain. Technical solution

[0007] This application provides a method for reversible desensitization and tracing of medical data based on an authorization chain. The method is executed by a computer system and includes the following steps: S1: Receive medical data to be de-identified, and divide the fields in the medical data into three categories: identification fields, sensitive fields, and auxiliary fields; S2: Perform first-level desensitization on the identification field, replacing the identification field with a pseudo-identifier of an unidentifiable individual; perform second-level desensitization on the sensitive field, encrypting it into ciphertext using a symmetric encryption algorithm; keep the auxiliary field in plaintext; S3: Use the threshold secret sharing algorithm to divide the key used to encrypt the sensitive field into n fragments, and distribute them to m authorized parties, where m ≤ n and at least k fragments are needed to reconstruct the key; S4: Upload the data that has undergone two levels of desensitization processing, along with the key fragmentation authorization information, onto the blockchain to form a traceable evidence record; S5: When data needs to be traced back, the requesting party initiates authorization requests to at least k authorizing parties; the authorizing parties verify the identity of the requesting party, the purpose of the traceback, and the compliance basis before deciding whether to agree; S6: After collecting at least k shards, the requester reconstructs the key and decrypts the sensitive fields, and puts the decryption event on the chain as a new evidence record to form a complete authorization chain.

[0008] The core collaborative innovation of this application lies in combining three technologies—"field-level anonymization," "threshold key sharding," and "on-chain authorization chain"—into an organic whole. Field-level anonymization allows for finer granularity (identifying irreversible fields while ensuring sensitive fields are reversible), threshold sharding ensures compliance in the authorization process (meeting the "multi-party authorization" requirements across multiple jurisdictions), and the authorization chain makes the entire process auditable. The "reversible + compliant + auditable" medical data anonymization closed loop formed by these three technologies is something that cannot be achieved by a single anonymization algorithm or a single key management method.

[0009] This application also provides a reversible desensitization and traceability device for medical data based on an authorization chain, including a field classification module, a two-level desensitization module, a key sharding module, an on-chain evidence storage module, an authorization request module, and a key reconstruction module. Beneficial effects

[0010] By setting up a field-level anonymization mechanism, identification fields, sensitive fields, and auxiliary fields are processed differently, which solves the problem of auxiliary analysis failure caused by the "one-size-fits-all" anonymization in existing technologies.

[0011] By using a multi-party key sharding mechanism that secretly shares keys at a threshold, the risk of leakage due to single-point storage is avoided, and it can be flexibly adapted to the multi-party authorization compliance requirements of different jurisdictions.

[0012] By recording each data anonymization and backtracking process on the blockchain for verification, a complete authorization chain is formed, making the entire data flow and access auditable and meeting the audit requirements of major international compliance frameworks.

[0013] Through a reversible desensitization mechanism, the continuity of diagnosis and treatment is preserved. Doctors can obtain the original medical history with authorization from multiple parties, thus avoiding the impact of irreversible desensitization on clinical diagnosis and treatment. Detailed Implementation

[0014] The embodiments of this application are described in detail below.

[0015] Example 1: This embodiment addresses a scenario where the electronic medical record of a cross-border patient can be reversibly de-identified.

[0016] In step S1, the field classification module receives the patient's electronic medical record data and classifies the name, ID number, contact number, etc. as identification fields; classifies past medical history, medication records, examination results, etc. as sensitive fields; and classifies treatment time, department visited, etc. as auxiliary fields.

[0017] In step S2, the two-level desensitization module generates a pseudo identifier for the identification field using the HMAC-SHA256 algorithm; encrypts the sensitive field using the AES-256-GCM algorithm; and keeps the auxiliary field unchanged.

[0018] In step S3, the key sharding module uses a threshold secret sharing algorithm to divide the AES key into 5 shards, which are then sent to the patient's wallet, the hospital, the municipal health commission, the insurance company, and the third-party auditing agency, respectively. A 3-of-5 threshold is set, meaning that the key can be reconstructed if any 3 parties agree.

[0019] In step S4, the on-chain evidence storage module writes the de-identified data hash and sharding authorization information into the consortium blockchain, and records metadata such as the de-identified event timestamp, the operating entity, and the sharding recipient.

[0020] In step S5, when the overseas consulting hospital requests to view the complete medical history, a request is sent to the five authorized parties; after the patient, the treating hospital, and the health commission agree, they provide their respective segments to the requesting party.

[0021] In step S6, the requesting party reconstructs the AES key, decrypts the sensitive fields, and uploads the access event to the blockchain to form audit evidence.

[0022] Example 2: The difference between this embodiment and Embodiment 1 lies in the choice of the threshold secret sharing algorithm. This embodiment uses the Shamir secret sharing algorithm, which offers information-theoretic security compared to the general threshold scheme. The remaining procedures are the same as in Embodiment 1.

[0023] The above embodiments are merely illustrative of the technical solutions of this application and are not intended to limit the scope of the application.

Claims

1. A method for reversible desensitization and tracing of medical data based on an authorization chain, wherein the method is executed by a computer system, characterized in that, include: S1: Receive medical data to be de-identified, and divide the fields in the medical data into three categories: identification fields, sensitive fields, and auxiliary fields; S2: Perform the first level of desensitization on the identification field, replacing it with a pseudo-identifier of an unidentifiable individual; perform the second level of desensitization on the sensitive field, encrypting it into ciphertext using a symmetric encryption algorithm; The auxiliary fields are kept in plaintext. S3: Use the threshold secret sharing algorithm to divide the key used to encrypt the sensitive field into n pieces, and distribute them to m authorized parties. At least k pieces are needed to reconstruct the key, where k ≤ m ≤ n. S4: Upload the anonymized data along with the key fragmentation authorization information to the blockchain for evidence storage; S5: When data needs to be traced back, the requesting party initiates authorization requests to at least k authorized parties, and the authorized parties verify the data and decide whether to agree. S6: After collecting at least k shards, the requester reconstructs the key and decrypts the sensitive fields, and puts the decryption event on the chain as a new evidence record to form a complete authorization chain.

2. The method according to claim 1, characterized in that, The identification fields in step S1 include name, ID number, and contact number; the sensitive fields include at least one of past medical history, medication records, examination results, and gene sequence; and the auxiliary fields include treatment time and department visited.

3. The method according to claim 1, characterized in that, The threshold secret sharing algorithm in step S3 adopts the Shamir secret sharing algorithm; the m authorized parties include at least three of the following: patients, medical institutions, compliance regulatory agencies, and third-party auditing agencies.

4. The method according to claim 1, characterized in that, The content verified by the authorizing party in step S5 includes, but is not limited to: the legitimacy of the requester's identity, the reasonableness of the retrospective purpose, and the compliance framework of the jurisdiction on which the request is based.

5. The method according to claim 1, characterized in that, The on-chain evidence storage in steps S4 and S6 uses a consortium blockchain, and the on-chain nodes include medical institution nodes, compliance institution nodes, and audit nodes.

6. A device for reversible desensitization and traceability of medical data based on an authorization chain, characterized in that, It includes a field classification module, a two-level desensitization module, a key sharding module, an on-chain evidence storage module, an authorization request module, and a key reconstruction module; The field classification module is used to divide medical data fields into three categories: identification, sensitive, and auxiliary. The two-level desensitization module generates pseudo-identifiers for the identification fields and encrypts the sensitive fields. The key sharding module uses a threshold secret sharing algorithm to divide the encryption key into multiple shards and distribute them to multiple authorized parties; The on-chain evidence storage module writes the anonymized data and sharding authorization information into the consortium blockchain; The authorization request module is used to receive and distribute retroactive authorization requests; The key reconstruction module is used to reconstruct the key and decrypt sensitive fields after collecting the threshold number of fragments.