Mri phantom calibration semantic authentication encryption method

Abstract

The present application relates to a kind of MRI phantom calibration semantic authentication encryption method, specifically to the field of artificial calibration of MRI phantom, the present application is output by prior statistical characteristics of normal calibration data, then the homomorphic encryption is calculated ciphertext domain statistical feature vector and decrypted to obtain plaintext aggregate statistics, the multi-field Mahalanobis distance between calculation and prior statistical characteristics, according to the partial derivative calculation field contribution degree and trigger attack alarm, accurately identify the field string bit in artificial input data, half-write state and abnormal tampering;Adopting careless transmission protocol anonymous traceability, after the differential privacy disturbance is applied to the data of suspicious organization, recalculate the reference statistics, the document gating mechanism of the phased state chain is linked to lock the phase number of suspicious organization as calculation state, effectively block abnormal data continue to participate in calculation and document generation, guarantee the field identity uniqueness of artificial input data, state continuity, calculation result and input binding and the trusted gate before document generation.

Description

Technical Field

[0001] This invention relates to the field of artificial calibration of MRI phantoms, and more specifically, to a semantic authentication encryption method for MRI phantom calibration. Background Technology

[0002] Medical magnetic resonance imaging phantom calibration is usually completed in accordance with relevant metrological technical specifications. Calibration personnel manually read the measured values ​​of items such as spatial resolution, density resolution, geometric distortion, and slice thickness, and manually enter them into the calibration software. The software calculates the average value, deviation, relative error, maximum error, thickness difference, or slice thickness error according to preset calibration rules. The original data and calculation results are then filled into the calibration original record and calibration certificate template.

[0003] The challenge of this type of software lies not in automatic detection, but in maintaining the security, integrity, and consistency of a large number of manually entered subdivided fields during the processes of saving, calculating, restoring, document generation, and archiving. In MRI phantom calibration, fields such as spatial resolution (W group), density resolution (D group), geometric distortion (G group), and slice thickness (T group) are numerous, have similar meanings, and correspond to different nominal values, rounding precisions, calculation rules, and template labels. Each group corresponds to the spatial resolution detection module, density resolution detection module, geometric distortion detection module, and slice thickness detection module covered by JJF2152-2024, respectively. If saved as plain text, tables, or unencrypted files, problems such as data leakage, field misalignment, partial tampering, partial writes, invalidation of old results, mismatched template labels, and inconsistencies between the original records and certificate data sources are likely to occur.

[0004] Existing electronic calibration certificate technologies mostly focus on signing, encrypting, or verifying the final certificate, but lack comprehensive encryption protection for manually entered data, intermediate calculation states, template filling processes, and dual document generation processes. For MRI phantom calibration software, protecting only the final certificate makes it difficult to determine whether the certificate result is indeed generated from the corresponding original measurement values ​​and calculation rules, and it is also difficult to detect data tampering or mismatches that occur during the data entry, calculation, or document generation stages in a timely manner.

[0005] Therefore, a full-process encryption protection and anti-tampering mechanism is needed for the manual input calibration process of MRI phantoms, so that manually entered values, calculation results, original records and calibration certificates are stored, verified and output under the same encrypted authentication state, thereby improving the confidentiality, integrity, stability and traceability of calibration data. Summary of the Invention

[0006] This invention addresses the technical problems existing in the prior art by providing a semantic authentication encryption method for MRI phantom calibration. This method solves the problems in manually entered MRI phantom calibration software, such as field cross-referencing, inability to recognize half-written states, downstream calculation results not being invalidated after modification, calculation results being partially replaced, and lack of trusted gating before document generation.

[0007] The technical solution of this invention to solve the above-mentioned technical problems is as follows: it includes the following steps:

[0008] Step S1: The server receives the encrypted state units uploaded by each institution. The encrypted state unit carries the field semantic code digest, the AEAD encrypted value of the fixed point normalization value and the stage number. It performs integrity verification based on the AEAD authentication tag and continuity verification based on the staged state chain. Only the encrypted state units that pass the double verification are retained as legal units and stored in the statistics pool.

[0009] Step S2: The server trains a conditional variational autoencoder as a digital twin model based on historical legitimate calibration data. The digital twin model takes field semantic conditions based on field semantic code summaries as input and outputs the prior statistical features of normal calibration data in a multi-field joint space containing multiple field groups.

[0010] Step S3: The server calculates the ciphertext domain statistical feature vector using homomorphic encryption for the fixed point normalized values ​​of each field group in the current statistical pool, then decrypts it to obtain the plaintext aggregate statistics, calculates the multi-field Mahalanobis distance between the data and the prior statistical features, and calculates the field contribution based on the partial derivative of the Mahalanobis distance with respect to each field. When the attack alarm is triggered, the attack alarm is triggered when the attack exceeds the preset basic threshold and the dynamic threshold calculated from the total number of legal units in the statistical pool.

[0011] Step S4: Based on field contribution, anonymous tracing of each institution is performed using an unintentional transmission protocol. Institutions selected based on field contribution are identified as suspicious institutions. Differential privacy perturbation is applied to the data of the encrypted state unit of the suspicious institution, and the baseline statistics of the field group are recalculated. The document gating mechanism of the staged state chain is linked to lock the stage number of the encrypted state unit of the suspicious institution into the computation state.

[0012] In a preferred embodiment, the specific operation of the integrity verification based on the AEAD authentication tag in step S1 is as follows:

[0013] The server uses a key shared with the organization to perform decryption operations on the AEAD ciphertext with fixed-point normalized values ​​in the ciphertext state unit. If decryption fails or the authentication tag does not match, the current ciphertext state unit is determined to have failed the integrity check and is discarded.

[0014] If decryption is successful and the authentication tag matches, the continuity verification based on the staged state chain continues. Specifically, the server maintains a state chain pointer for each organization. The state chain pointer records the stage number of the previous legal unit and the hash value of the fixed point normalization value of the previous legal unit.

[0015] When the current ciphertext state unit is received, the server checks whether the stage number of the current ciphertext state unit is greater than the stage number of the previous valid unit, and checks whether the hash value of the fixed-point normalized value of the current ciphertext state unit is not equal to the hash value of the fixed-point normalized value of the previous valid unit.

[0016] If the continuity check passes, the server marks the current ciphertext state unit as a valid unit and updates the organization's state chain pointer with the stage number of the current ciphertext state unit and the hash value of the fixed-point normalization value; if the continuity check fails, the current ciphertext state unit is determined to be non-continuous and is discarded.

[0017] In a preferred embodiment, step S1 further includes performing a verification based on the topological dependency of the field semantic code, specifically as follows:

[0018] The server has a pre-defined directed acyclic graph of dependencies between fields. The nodes of the dependent directed acyclic graph are the semantic code digests of each field, and the edges represent the measurement order between fields.

[0019] For the current ciphertext state unit, the server searches for all parent field sets pointing to the field semantic code digest in the dependency directed acyclic graph based on the field semantic code digest it carries. Each element in the parent field set is called a parent field.

[0020] For each parent field in the set of parent fields, the server retrieves the stage number of the most recently submitted legal unit of the same institution whose field semantic code digest is the parent field from the statistical pool;

[0021] If any parent field has a stage number greater than the stage number of the current ciphertext state unit, or if the parent field has never been submitted as a valid unit by the organization, the current ciphertext state unit is deemed to violate topological dependency and is discarded.

[0022] The current ciphertext state unit is allowed to enter the statistics pool only if the stage number of all parent fields is less than the stage number of the current ciphertext state unit and all of them already have a valid unit.

[0023] In a preferred embodiment, the specific operation of training the conditional variational autoencoder in step S2 is as follows:

[0024] The server extracts the fixed-point normalized value vector for each calibration task from the historical valid calibration data in the statistical pool, and constructs a field semantic condition vector for each calibration task. The field semantic condition vector is composed of the field semantic code digest and the procedure version hash, rounding rule hash and template label hash generated based on the field semantic code digest.

[0025] The server uses the fixed-point normalized value vector and the field semantic condition vector as training sample pairs, and inputs them into the encoder and decoder of the conditional variational autoencoder for training. The encoder learns the latent variable posterior distribution parameters of the fixed-point normalized value vector under the field semantic condition, and the decoder reconstructs the fixed-point normalized value vector based on the latent variable and the field semantic condition. After training, the server saves the decoder as a digital twin model.

[0026] After receiving the semantic conditions of the fields, the server uses a decoder to sample the latent variables multiple times and calculates the empirical mean and covariance matrix of the reconstructed mean vector, which serve as the prior statistical features of the normal calibration data in the multi-field joint space containing multiple field groups.

[0027] In a preferred embodiment, the loss function for training the conditional variational autoencoder in step S2 includes a physical constraint regularization term, which is calculated as follows:

[0028] The server pre-sets a set of field pairs subject to physical constraints. Each field pair contains two field groups as well as the reference ratio and tolerance pre-set by this solution.

[0029] For each training sample, the server calculates the measured ratio of the fixed-point normalized values ​​of the two field groups in the training sample. If the absolute difference between the measured ratio and the preset reference ratio of this scheme exceeds the preset tolerance of this scheme, a penalty is applied to the training sample. The penalty value is the positive value after subtracting the tolerance from the absolute difference between the measured ratio and the reference ratio.

[0030] The physical constraint regularization term is the sum of the penalty values ​​of all field pairs multiplied by a preset weighting coefficient.

[0031] In a preferred embodiment, the specific operation of calculating the statistical feature vector of the ciphertext field using homomorphic encryption in step S3 is as follows:

[0032] The server uses its own Paillier homomorphic encryption public key to encrypt the fixed-point normalized value of each legal unit in each field group in the statistics pool, thus obtaining homomorphic ciphertext;

[0033] For each field group, the server uses the homomorphic addition property to calculate the sum of all homomorphic ciphertexts, and then divides it by the number of legal units in that field group to obtain the mean homomorphic ciphertext of that field group.

[0034] For any two field groups, the server uses homomorphic subtraction and homomorphic multiplication to calculate the homomorphic ciphertext of the product of the difference between each cell and its mean, then sums them and divides them by the number of legal cells in the field group minus one to obtain the covariance homomorphic ciphertext.

[0035] The server decrypts all mean homomorphic ciphertext and covariance homomorphic ciphertext in a secure environment, obtaining the mean vector and sample covariance matrix in plaintext form as plaintext aggregation statistics.

[0036] In a preferred embodiment, the specific operation for calculating the multi-field Mahalanobis distance between the prior statistical features is as follows:

[0037] The server calculates the difference vector between the mean vector of the current statistical pool and the prior mean vector in the prior statistical features output in step S2;

[0038] After transposing the difference vector, multiply it by the inverse of the prior covariance matrix in the prior statistical features output in step S2, and then multiply it by the difference vector again to obtain the square of the basic Mahalanobis distance.

[0039] The server calculates the ratio of the sample covariance matrix to the prior covariance matrix of the current statistical pool. Specifically, it multiplies the inverse of the prior covariance matrix by the sample covariance matrix to obtain the product matrix, calculates the trace of the product matrix, and then divides it by the total number of field groups to obtain the average ratio.

[0040] The server calculates the exponential factor using the natural constant e as the base and the product of the preset scaling factor and the average ratio as the exponential factor. The base Mahalanobis distance is then multiplied by the exponential factor to obtain the final multi-field Mahalanobis distance.

[0041] In a preferred embodiment, the specific operation of calculating the field contribution based on the partial derivatives of the Mahalanobis distance with respect to each field is as follows:

[0042] The server calculates the partial derivative of the multi-field Mahalanobis distance with respect to each component of the mean vector of the current statistical pool; the server divides the absolute value of the partial derivative of each field by the sum of the absolute values ​​of the partial derivatives of all fields to obtain the normalized contribution of each field.

[0043] The specific calculation method for the dynamic threshold is as follows: the server presets the basic threshold and reference sample size; the total number of valid units in all field groups in the current statistical pool is counted;

[0044] The server calculates the ratio of the total number to the reference sample size, takes the natural logarithm of the ratio, and multiplies it by a preset adjustment coefficient to obtain the adjustment term;

[0045] The server divides the base threshold by the sum of the adjustment terms to obtain the dynamic threshold; when the Mahalanobis distance of the multi-field is greater than the dynamic threshold, the server triggers an attack alarm.

[0046] In a preferred embodiment, the specific operation of anonymously tracing the various institutions using the unintentional transmission protocol in step S4 is as follows:

[0047] Based on the normalized contribution calculated in step S3, the server identifies the field groups whose normalized contribution exceeds a preset threshold as suspected field groups.

[0048] Based on the prior mean vector and prior covariance matrix in the prior statistical features output in step S2, the prior cumulative distribution function is derived, and the value range of each suspect field group is divided into a preset number of probability intervals, with each probability interval covering an equal probability.

[0049] The server executes an unintentional transmission protocol with each institution, enabling the server to know the probability range of the fixed-point normalized value of each institution on the suspected field group, without disclosing the specific value of the fixed-point normalized value;

[0050] The server counts the number of institutions falling into each probability interval, calculates the deviation between the actual number of institutions and the expected number of institutions. The expected number of institutions is the total number of institutions with legal units in this field group divided by the number of probability intervals. Probability intervals with deviations exceeding a preset threshold are marked as abnormal intervals; institutions falling into abnormal intervals are marked as initially suspicious institutions.

[0051] In a preferred embodiment, the specific operation of recalculating the baseline statistics of the suspected field group after applying differential privacy perturbation to the data of the encrypted state unit of the suspected organization is as follows:

[0052] The server obtains the fixed-point normalized value of each initially suspected organization on the suspected field group in the secure environment, and calls the digital twin model trained in step S2 to calculate the negative log-likelihood of the fixed-point normalized value under the corresponding field semantic conditions. The negative log-likelihood is used as the suspicion score of the initially suspected organization.

[0053] The server calculates the mean and standard deviation of the suspicion scores of all initially suspected institutions, and identifies the initially suspected institutions whose suspicion scores are greater than the mean plus twice the standard deviation as the final suspected institutions.

[0054] The server applies Laplace noise, whose scale is proportional to the suspicion score, to the fixed-point normalized value of each final suspicious institution to obtain the perturbed fixed-point normalized value.

[0055] The server uses the original fixed-point normalized value of non-suspicious institutions and the perturbed fixed-point normalized value of the final suspicious institutions as the basis. It assigns a weight that decays exponentially with the increase of the suspicion score to the data of the final suspicious institutions and calculates the weighted average as the baseline statistic after the suspected field group is updated.

[0056] Based on the state chain pointer maintained in step S1, the server finds the most recently submitted encrypted state unit for each ultimately suspicious organization and rewrites the stage number of the encrypted state unit to a preset lock value.

[0057] It also recalculates the AEAD authentication tag of the encrypted state unit, so that any subsequent request to advance the encrypted state unit to the document state is rejected due to the failure of the stage number verification.

[0058] The server simultaneously updates the state chain pointer of the final suspected organization, causing subsequent received encrypted state units to be discarded during continuity verification because the stage number cannot exceed the locked value, thereby preventing the final suspected organization from submitting new data.

[0059] The beneficial effects of this invention are as follows: By training a conditional variational autoencoder as a digital twin model, it outputs the prior statistical features of normal calibration data. Then, it uses homomorphic encryption to calculate the ciphertext domain statistical feature vector and decrypts it to obtain the plaintext aggregate statistics. It calculates the multi-field Mahalanobis distance between the ciphertext and the prior statistical features, calculates the field contribution based on the partial derivatives, and triggers attack alarms, thereby accurately identifying field cross-referencing, half-written states, and abnormal tampering in manually entered data. Furthermore, it uses an anonymous tracing mechanism based on an unintentional transmission protocol to apply differential privacy perturbations to the data of suspicious institutions and recalculate the baseline statistics. It also links a staged state chain document gating mechanism to lock the stage number of the suspicious institution into the calculation state, effectively blocking abnormal data from continuing to participate in calculation and document generation, ensuring the uniqueness of field identity, state continuity, binding of calculation results to input, and reliable gating before document generation of manually entered data. Attached Figure Description

[0060] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0061] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0062] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0063] In the description of this application, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0064] Example 1: This example provides the following... Figure 1 The MRI phantom calibration semantic authentication encryption method shown includes the following steps:

[0065] Step S1: The server receives the encrypted state units uploaded by each institution. The encrypted state unit carries the field semantic code digest, the AEAD encrypted value of the fixed point normalization value and the stage number. It performs integrity verification based on the AEAD authentication tag and continuity verification based on the staged state chain. Only the encrypted state units that pass the double verification are retained as legal units and stored in the statistics pool.

[0066] Step S2: The server trains a conditional variational autoencoder as a digital twin model based on historical legitimate calibration data. The digital twin model takes field semantic conditions based on field semantic code summaries as input and outputs the prior statistical features of normal calibration data in a multi-field joint space containing multiple field groups.

[0067] Step S3: The server calculates the ciphertext domain statistical feature vector using homomorphic encryption for the fixed point normalized values ​​of each field group in the current statistical pool, then decrypts it to obtain the plaintext aggregate statistics, calculates the multi-field Mahalanobis distance between the data and the prior statistical features, and calculates the field contribution based on the partial derivative of the Mahalanobis distance with respect to each field. When the attack alarm is triggered, the attack alarm is triggered when the attack exceeds the preset basic threshold and the dynamic threshold calculated from the total number of legal units in the statistical pool.

[0068] Step S4: Based on field contribution, anonymous tracing of each institution is performed using an unintentional transmission protocol. Institutions selected based on field contribution are identified as suspicious institutions. Differential privacy perturbation is applied to the data of the encrypted state unit of the suspicious institution, and the baseline statistics of the field group are recalculated. The document gating mechanism of the staged state chain is linked to lock the stage number of the encrypted state unit of the suspicious institution into the computation state.

[0069] In this embodiment, the specific operation of integrity verification based on the AEAD authentication tag in step S1 is as follows:

[0070] The server uses a key shared with the institution to perform decryption operations on the AEAD ciphertext of the fixed-point normalized value in the ciphertext state unit. If decryption fails or the authentication tag does not match, the current ciphertext state unit is deemed to have failed the integrity check and is discarded. The key shared by the server and the institution uses a symmetric encryption algorithm with a key length of 256 bits, and is distributed by the server through a secure channel during the institution's initial registration. The decryption operation uses the authentication decryption process in the AEAD algorithm. This process first decrypts the ciphertext to obtain the plaintext, then recalculates the authentication tag using additional authentication data and compares it with the authentication tag carried in the ciphertext. If the two match, authentication is successful; otherwise, authentication fails. The authentication tag is 128 bits long and is generated using message authentication code algorithms such as GMAC or Poly1305. The purpose of the integrity check is to ensure that the fixed-point normalized value has not been tampered with during transmission and storage, and that the semantic code digest and stage number in the additional authentication data have not been replaced.

[0071] If decryption is successful and the authentication tag matches, the continuity verification based on the staged state chain continues. Specifically, the server maintains a state chain pointer for each institution. This pointer records the stage number of the previous legitimate unit and the hash value of the fixed-point normalization value of that unit. The state chain pointers are stored in the server's security database, with one pointer record for each institution. The stage number is a 32-bit unsigned integer, incrementing from 0, and the stage number of each legitimate unit must be strictly greater than the stage number of the previous legitimate unit. The hash value of the fixed-point normalization value is calculated using the SHA-256 algorithm, outputting a 256-bit digest. This hash value is used to uniquely identify the fixed-point normalization value, preventing duplicate submissions of the same data.

[0072] When the current encrypted state unit is received, the server verifies whether the stage number of the current encrypted state unit is greater than the stage number of the previous valid unit, and also verifies whether the hash value of the fixed-point normalized value of the current encrypted state unit is equal to the hash value of the fixed-point normalized value of the previous valid unit. The server extracts the stage number and fixed-point normalized value from the current encrypted state unit and calculates the SHA-256 hash value of the current fixed-point normalized value. Then, it compares this hash value with the stage number and hash value of the previous valid unit recorded in the state chain pointer. If the current stage number is greater than the previous stage number and the current hash value is not equal to the previous hash value, the continuity check passes; otherwise, it fails. This check prevents replay attacks (attackers repeatedly submitting the same data) and out-of-order injection (attackers skipping certain stages when submitting data).

[0073] If the continuity check passes, the server marks the current encrypted state unit as a valid unit and updates the organization's state chain pointer with the current encrypted state unit's stage number and the hash value of the fixed-point normalization value. If the continuity check fails, the current encrypted state unit is deemed not to meet the continuity requirement and is discarded. When updating the state chain pointer, the server assigns the stage number of the current valid unit to the stage number of the previous valid unit and assigns the hash value of the current valid unit's fixed-point normalization value to the hash value of the previous valid unit. In this way, subsequent received encrypted state units will be checked for continuity based on the current unit. The threshold for continuity check is set as follows: the stage number must be strictly greater than, and cannot be equal to or less than; the hash value must be strictly not equal to, and cannot be equal to. If three consecutive encrypted state units that fail the continuity check come from the same organization, the server marks the organization as a suspected abnormal organization and triggers a manual review process.

[0074] Step S1 also includes performing a topological dependency check based on the field semantic code, the specific operation of which is as follows:

[0075] The server pre-defines a directed acyclic graph (DAG) of field dependencies. The nodes of the DAG are semantic code summaries of each field, and the edges represent the measurement order between fields. The DAG is predefined by the calibration procedure (e.g., JJF2152) and stored in the server's configuration database. The set of nodes in the graph contains semantic code summaries of all possible fields, such as spatial resolution field summaries, geometric distortion field summaries, and density resolution field summaries. Edges represent measurement dependencies; for example, the spatial resolution field must be measured before the geometric distortion field, therefore there exists a directed edge from the spatial resolution field node to the geometric distortion field node. This graph is acyclic, ensuring that dependencies do not form cycles. The server loads this graph when the system starts and updates it synchronously with each procedure update.

[0076] For the current encrypted state unit, the server searches for all parent field sets pointing to the field semantic code digest in the dependency directed acyclic graph based on the field semantic code digest it carries. Each element in the parent field set is called a parent field. The server uses the field semantic code digest of the current encrypted state unit as the query key to search for the starting nodes of all directed edges ending at that node in the dependency directed acyclic graph, and constructs the parent field set from these starting nodes. For example, if the current field is a geometric distortion field, the parent field set may include a spatial resolution field. The parent field set may be empty (indicating that the field has no preceding dependencies) or it may contain multiple parent fields (indicating that the field depends on multiple preceding fields).

[0077] For each parent field in the parent field set, the server retrieves the stage number of the most recently submitted legal unit of the same institution whose field semantic code digest is equal to the parent field from the statistical pool. The server uses the institution identifier and the field semantic code digest of the parent field as joint query conditions to retrieve legal units submitted by the institution in the past whose field semantic code digest is equal to the parent field from the statistical pool, and sorts them in descending order by stage number, taking the one with the largest stage number as the most recently submitted legal unit. If no such legal unit exists in the statistical pool, it is marked as "the parent field has never been submitted". The time complexity of the retrieval process is O(logn), where n is the number of historical records of the institution on this field.

[0078] If any parent field has a stage number greater than the stage number of the current encrypted state unit, or if the parent field has never been submitted as a valid unit by the organization, the current encrypted state unit is deemed to violate topological dependency and is discarded. The logic for topological dependency verification is as follows: for each parent field, the stage number of its most recently submitted valid unit must be less than the stage number of the current encrypted state unit, and the parent field must have been submitted at least once. This is because the measurement process requires that the preceding field must be measured before the subsequent field can be measured. If the stage number of the parent field is greater than the current stage number, it means that the preceding measurement occurred after the subsequent measurement, violating the time order. If the parent field has never been submitted, it means that the preceding measurement was never performed, and the subsequent measurement could not have actually occurred. Both of these situations are considered topological dependency violations.

[0079] The current encrypted state unit is allowed to enter the statistics pool only if the stage numbers of all parent fields are less than the stage number of the current encrypted state unit and all of them already have valid units. When all parent fields meet the conditions, the server puts the current encrypted state unit into the statistics pool and updates the organization's most recent submission record in that field. The statistics pool is a temporary storage area used to store valid units to be processed in subsequent steps (steps S2 and S3). Each unit in the statistics pool contains information such as field semantic code digest, fixed point normalized value, stage number, and organization identifier. The threshold for topology dependency verification is set as follows: the comparison of stage numbers uses strict less than (<), and is not allowed to be equal to. The existence requirement of the parent field is that there must be at least one historical record. If an organization violates the topology dependency five times in a row, the server blacklists the organization, suspends its upload permission, and notifies the administrator to check.

[0080] In this embodiment, the specific operation of training the conditional variational autoencoder in step S2 is as follows:

[0081] The server extracts the fixed-point normalized value vector for each calibration task from the historical valid calibration data in the statistical pool, and constructs a field semantic condition vector for each calibration task. The field semantic condition vector is composed of a field semantic code digest and a procedure version hash, a rounding rule hash, and a template label hash generated based on the field semantic code digest. The extraction process of the fixed-point normalized value vector is as follows: the server traverses all valid units belonging to the same calibration task in the statistical pool. Each valid unit carries a field semantic code digest and a fixed-point normalized value. The server arranges the fixed-point normalized values ​​of each field group in the same calibration task in the order of predefined field groups (e.g., spatial resolution W group, geometric distortion G group, density resolution D group, etc.) to form a vector with a dimension equal to the total number of field groups. If a field group is missing in the calibration task, it is filled with a preset default value (e.g., -100).

[0082] The construction process of the field semantic condition vector is as follows: The server searches for the corresponding specification version identifier, reduction rule identifier and template tag identifier based on the field semantic code digest of each legal unit, performs SHA-256 hash operation on these identifiers respectively to obtain three 256-bit hash values, and then concatenates the field semantic code digest itself (256 bits) with these three hash values ​​in order to obtain a binary vector with a length of 1024 bits as the field semantic condition vector.

[0083] The server uses the fixed-point normalized value vector and the field semantic condition vector as training sample pairs, and trains the encoder and decoder of the conditional variational autoencoder. The encoder learns the posterior distribution parameters of the latent variables of the fixed-point normalized value vector under the field semantic conditions, and the decoder reconstructs the fixed-point normalized value vector based on the latent variables and the field semantic conditions. The encoder adopts a three-layer fully connected neural network structure. The first layer has an input dimension of the total number of field groups plus the length of the field semantic condition vector, an output dimension of 512, and an activation function of a modified linear unit with leakage, with a leakage coefficient of 0.2. The second layer has an input dimension of 512 and an output dimension of 256, and the activation function is also a modified linear unit with leakage. The third layer has an input dimension of 256 and an output dimension of 64, where the first 32 neurons output the mean vector of the latent variables, and the last 32 neurons output the log-variance vector of the latent variables. The decoder employs a three-layer fully connected neural network structure symmetrical to the encoder. The first layer has an input dimension of 32 (latent variable dimension plus the field semantic condition vector length) and an output dimension of 256, with the activation function being a modified linear unit with leakage. The second layer has an input dimension of 256 and an output dimension of 512, with the activation function also being a modified linear unit with leakage. The third layer has an input dimension of 512 and an output dimension twice the total number of field groups. The first half of the neurons outputs a reconstructed mean vector, and the second half outputs a reconstructed log-variance vector. The training process uses the Adam optimizer with an initial learning rate of 0.001, which decays exponentially by multiplying by 0.9 every 20 training epochs. The batch size is set to 128, and the maximum number of training epochs is set to 200. Early stopping is used, stopping training when the validation set loss does not decrease for 10 consecutive epochs, and saving the model parameters with the lowest validation set loss as the final model.

[0084] After training, the server saves the decoder as a digital twin model; the digital twin model is saved in the secure storage area of ​​the server in the form of the decoder's network structure and parameters; the model file contains the weight matrix and bias vector of all layers, as well as metadata such as activation function type, input and output dimensions; the server maintains a cache for the semantic condition vector of each field to avoid repeated calculations;

[0085] After receiving the field semantic conditions, the server uses a decoder to sample the latent variables multiple times and calculates the empirical mean and covariance matrix of the reconstructed mean vector. These serve as the prior statistical features of the normal calibration data in a multi-field joint space containing multiple field groups. Specifically, the server independently samples 100 latent variable samples from a standard normal distribution. Each latent variable sample is a 32-dimensional vector, with each component following a normal distribution with a mean of 0 and a variance of 1. Each latent variable sample is concatenated with the input field semantic condition vector and then input into the decoder to obtain 100 latent variable samples. 100 reconstructed mean vectors are calculated; then, the arithmetic mean of these 100 reconstructed mean vectors is calculated to obtain the prior mean vector, the dimension of which is equal to the total number of field groups; then, the average of the outer products of these 100 reconstructed mean vectors and the prior mean vector is calculated to obtain the prior covariance matrix, the dimension of which is the product of the total number of field groups; to ensure that the covariance matrix is ​​invertible, a very small regularization coefficient is added to the diagonal of the covariance matrix, the regularization coefficient is set to 0.0001; the prior mean vector and the prior covariance matrix are the prior statistical features required for the Mahalanobis distance calculation in step S3;

[0086] In step S2, the loss function for training the conditional variational autoencoder includes a physical constraint regularization term. The specific calculation method for the physical constraint regularization term is as follows:

[0087] The server pre-defines a set of physically constrained field pairs. Each field pair contains two field groups, as well as a reference ratio and tolerance pre-defined in this scheme. The reference ratio and tolerance are calibration hyperparameters pre-defined in this scheme to constrain the output distribution of the digital twin model, and are not considered as physical relationship values ​​specified in the JJF2152-2024 calibration procedure. The set of physically constrained field pairs is determined by this scheme according to the detection modules (spatial resolution detection module, density resolution detection module, etc.) covered by the JJF2152-2024 calibration procedure. The distortion detection module and the layer thickness detection module are preset, for example, selecting the spatial resolution group W and the density resolution group D; for the spatial resolution group W and the density resolution group D, the preset reference ratio is set to 0.8 and the tolerance is set to 0.1. The reference ratio of 0.8 and the tolerance of 0.1 are both calibration hyperparameters preset by this scheme to constrain the output distribution of the digital twin model, and are not used as the physical relationship between spatial resolution and density resolution specified in JJF2152-2024. The tolerance represents the allowable deviation range.

[0088] For each training sample, the server calculates the measured ratio of the normalized fixed-point values ​​of the two field groups in the training sample. If the absolute difference between the measured ratio and the preset reference ratio of this scheme exceeds the preset tolerance of this scheme, a penalty is applied to the training sample. The penalty value is the positive value of the absolute difference between the measured ratio and the reference ratio minus the tolerance. The specific calculation process is as follows: For the normalized fixed-point values ​​of spatial resolution group W and density resolution group D in the training sample, the server calculates the ratio between the two, that is, the value of group W divided by the value of group D, to obtain the measured ratio; then, the absolute difference between the measured ratio and the preset reference ratio of 0.8 of this scheme is calculated; if the absolute difference is greater than the preset tolerance of 0.1 of this scheme, the penalty value is the absolute difference minus 0.1; if the absolute difference is less than 0.8, the penalty value is less than 0.1. If the value is less than or equal to 0.1, the penalty value is 0. This penalty mechanism ensures that the reconstruction ratio of the spatial resolution group W to the density resolution group D in the model reconstruction data will not deviate too far from the preset reference ratio of 0.8 in this scheme, thereby improving the rationality of the output distribution of the digital twin model. The preset reference ratio of 0.8 and tolerance of 0.1 in this scheme are calibration hyperparameters set to constrain model training and are not used as the physical relationship values ​​between spatial resolution and density resolution as specified in JJF2152-2024. Spatial resolution and density resolution are two independent imaging performance parameters with different physical meanings in JJF2152-2024. The procedure does not specify that there is a fixed theoretical ratio between the two. The ratio of density resolution will not deviate too far from the physical law.

[0089] The physical constraint regularization term is the sum of the penalty values ​​of all field pairs multiplied by a preset weight coefficient. The weight coefficient is set to 10 to control the proportion of the physical constraint regularization term in the entire loss function. The value of the physical constraint regularization term is equal to the sum of the penalty values ​​of all field pairs multiplied by 10. This regularization term, together with the reconstruction loss and KL divergence, constitutes the total loss function. The three are added together and then gradient backpropagation is performed to update the model parameters. The introduction of the physical constraint regularization term enables the digital twin model to not only pursue reconstruction accuracy during training, but also to force the output of calibration data distribution that conforms to the physical laws of MRI, thereby improving the model's generalization ability and physical rationality.

[0090] In this embodiment, the specific operation of calculating the statistical feature vector of the ciphertext field using homomorphic encryption in step S3 is as follows:

[0091] The server uses its own Paillier homomorphic encryption public key to encrypt the fixed-point normalized value of each legal unit in each field group of the statistics pool, obtaining homomorphic ciphertext. The Paillier homomorphic encryption public key is generated by the server during system initialization and contains a large integer N (N is the product of two large prime numbers, with a length of 2048 bits) and a generator g. The encryption process is as follows: for each fixed-point normalized value v, the server selects a random number r (ranging from 1 to the square of N minus one), calculates the ciphertext c as g raised to the power of v multiplied by r raised to the power of N, and then takes the modulo of the square of N. This encryption process ensures that the same plaintext is encrypted to obtain different ciphertexts each time, satisfying semantic security.

[0092] For each field group, the server uses the homomorphic addition property to calculate the sum of all homomorphic ciphertexts, then divides it by the number of legal units in that field group to obtain the mean homomorphic ciphertext for that field group. The homomorphic addition property means that multiplying two ciphertexts is equivalent to adding plaintexts. The server multiplies all homomorphic ciphertexts one by one to obtain the product ciphertext. Since division is not easily implemented directly in the ciphertext field, the server first sends the product ciphertext to a trusted execution environment, where it is decrypted to obtain the sum of all fixed-point normalized values. This sum is then divided by the number of legal units in that field group to obtain the mean plaintext, which is then re-encrypted using the public key to obtain the mean homomorphic ciphertext. This operation appears to the outside world as ciphertext calculation, but in reality, the division is performed using a secure environment, while the overall process still meets privacy protection requirements.

[0093] For any two field groups, the server uses homomorphic subtraction and homomorphic multiplication to calculate the homomorphic ciphertext of the product of the difference between each cell and its mean, then sums the products and divides them by the number of valid cells in the field group minus one to obtain the covariance homomorphic ciphertext. Homomorphic subtraction is achieved by multiplying the ciphertext by the modular inverse of the mean homomorphic ciphertext. Specifically, for each cell, the server calculates the product of the ciphertext of its fixed-point normalized value and the modular inverse of the mean homomorphic ciphertext to obtain the difference ciphertext. Homomorphic multiplication in the Paillier scheme requires the use of a secure multi-party computation protocol or a trusted execution environment. This scheme uses a trusted execution environment as an auxiliary method: the server decrypts the difference ciphertext into plaintext difference, calculates the difference product of the two field groups in a secure environment, and then encrypts the product into homomorphic ciphertext. Then, homomorphic addition is performed on all product ciphertexts, and finally, the sum is divided by the sample size minus one (also using a secure environment for division) to obtain the covariance homomorphic ciphertext.

[0094] The server decrypts all mean-homomorphic ciphertexts and covariance-homomorphic ciphertexts in a secure environment, obtaining the plaintext mean vector and sample covariance matrix as plaintext aggregation statistics. The secure environment can be a hardware-level trusted execution environment such as Intel SGX or AMD SEV, or a dedicated server that has been hardened with security. During decryption, the server uses the Paillier private key to decrypt each mean-homomorphic ciphertext and covariance-homomorphic ciphertext. The private key is strictly guarded by the secure environment and is not disclosed to the outside world. After decryption, the server obtains each component of the mean vector and each element of the sample covariance matrix. These plaintext aggregation statistics are only used for subsequent Mahalanobis distance calculations and do not expose the original data of any single institution.

[0095] The specific steps for calculating the multi-field Mahalanobis distance between the feature and prior statistical features are as follows:

[0096] The server calculates the difference vector between the mean vector of the current statistical pool and the prior mean vector in the prior statistical features output in step S2. The calculation process of the difference vector is as follows: for each field group, the server subtracts the k-th component of the prior mean vector from the k-th component of the mean vector of the current statistical pool to obtain the k-th component of the difference vector. After the components of all field groups have been calculated, a difference vector with a dimension equal to the total number of field groups is obtained. This vector reflects the average offset between the current data distribution and the expected distribution of the digital twin model on each field.

[0097] The difference vector is transposed and multiplied by the inverse of the prior covariance matrix from the prior statistical features output in step S2, and then multiplied by the difference vector again to obtain the square of the basic Mahalanobis distance. The inverse of the prior covariance matrix is ​​obtained by inverting the prior covariance matrix output in step S2. The inversion process uses the Cholesky decomposition method because the prior covariance matrix is ​​a symmetric positive definite matrix. The server first performs Cholesky decomposition on the prior covariance matrix to obtain the lower triangular matrix L, and then solves the linear equation system by back substitution to obtain the inverse matrix. When calculating the square of the basic Mahalanobis distance, the server treats the difference vector as a column vector, first calculates the product of the inverse matrix and the difference vector to obtain the intermediate vector, and then multiplies the transpose of the difference vector with the intermediate vector to obtain a scalar value, namely the square of the basic Mahalanobis distance. This scalar value measures the overall magnitude of the mean skew after considering the correlation between fields.

[0098] The server calculates the ratio of the sample covariance matrix to the prior covariance matrix in the current statistical pool. Specifically, it multiplies the inverse of the prior covariance matrix by the sample covariance matrix to obtain a product matrix. The trace of this product matrix is ​​then calculated and divided by the total number of field groups to obtain the average ratio. The calculation process for the ratio of the sample covariance matrix to the prior covariance matrix is ​​as follows: The server multiplies the inverse of the prior covariance matrix by the sample covariance matrix to obtain a product matrix with the dimension being the sum of the total number of field groups. Then, the trace of this product matrix is ​​calculated, which is the sum of the diagonal elements. The trace value reflects the closeness of the sample covariance matrix and the prior covariance matrix on the overall scale: if the trace is close to the total number of field groups, it indicates that the two scales are similar; if the trace deviates significantly from the total number of field groups, it indicates that there is a difference in the covariance structure. The trace is divided by the total number of field groups to obtain the average ratio, which is normalized to around 1.

[0099] The server calculates the exponential factor using the natural constant e as the base and the product of a preset scaling factor and the average ratio as the exponent. The preset scaling factor is 0.1, used to control the influence of covariance structure differences on the final Mahalanobis distance. The calculation process of the exponential factor is as follows: the server multiplies the scaling factor 0.1 by the average ratio to obtain the exponential value, and then calculates the natural constant e raised to the power of this exponential value. For example, if the average ratio is 1.2, the exponential value is 0.12, and the exponential factor is approximately 1.127; if the average ratio is 0.8, the exponential value is 0.08, and the exponential factor is approximately 1.083. This exponential factor is always greater than 1, playing an amplifying role, and the greater the deviation of the average ratio from 1, the stronger the amplification effect.

[0100] Multiplying the base Mahalanobis distance by an exponential factor yields the final multi-field Mahalanobis distance. This final multi-field Mahalanobis distance is a dimensionless scalar that combines information from both mean shift and covariance structure differences. Compared to using only the base Mahalanobis distance, this distance can detect covert injection attacks where the mean shift is small but the covariance structure changes significantly. For example, an attacker might only change the correlation of some fields without changing the mean. In this case, the base Mahalanobis distance is small, but the exponential factor is large, and the final distance may still exceed the threshold.

[0101] The specific steps for calculating the field contribution based on the partial derivatives of the Mahalanobis distance with respect to each field are as follows:

[0102] The server calculates the partial derivative of the multi-field Mahalanobis distance with respect to each component of the mean vector of the current statistical pool. The specific calculation process for the partial derivative is as follows: First, the server obtains the value of the multi-field Mahalanobis distance calculated in step S3, and then takes its reciprocal. Next, the server multiplies the inverse of the calculated prior covariance matrix with the difference vector to obtain an intermediate vector, the dimension of which is equal to the total number of field groups. The k-th component of this intermediate vector is taken, which corresponds to the component of the k-th field group. Finally, this component is multiplied by the reciprocal of the multi-field Mahalanobis distance, and then multiplied by an exponential factor to obtain the partial derivative of the k-th field group. This partial derivative reflects the rate of change of the multi-field Mahalanobis distance when the k-th component of the current statistical pool mean vector undergoes a small change. The larger the absolute value of the partial derivative, the greater the contribution of the mean shift of this field group to the overall anomaly.

[0103] The server divides the absolute value of the partial derivative of each field by the sum of the absolute values ​​of the partial derivatives of all fields to obtain the normalized contribution of each field. The calculation process of the normalized contribution is as follows: The server first calculates the absolute value of the partial derivative of each field group to obtain a set of non-negative numbers; then it calculates the sum of the absolute values ​​of the partial derivatives of all field groups; for each field group, it divides the absolute value of its partial derivative by the sum to obtain a value between 0 and 1, which is the normalized contribution of that field group; the sum of the normalized contributions of all field groups equals 1; this normalized contribution is used in step S4 to filter suspected field groups. Field groups with higher contribution are more likely to be the target fields for abnormal injection; for example, if there are three field groups with absolute values ​​of partial derivatives of 2, 1, and 1 respectively, the sum is 4, and the normalized contributions are 0.5, 0.25, and 0.25 respectively; the server can consider field groups with a normalized contribution exceeding 0.2 as suspected field groups.

[0104] The specific calculation method for the dynamic threshold is as follows: The server presets a base threshold and a reference sample size; the total number of valid units in all field groups in the current statistical pool is counted; the base threshold is preset to 3.0, which corresponds to the generalization of the three sigma principle in statistics, indicating that the probability of the Mahalanobis distance exceeding 3.0 under normal fluctuations is extremely low; the reference sample size is preset to 100, which is used to normalize the current sample size; the total number of valid units is the sum of the number of valid units in all field groups in the statistical pool. For example, if there are 3 field groups with 40, 50, and 60 valid units respectively, the total number is 150.

[0105] The server calculates the ratio of the total number of samples to the reference sample size, takes the natural logarithm of the ratio, and multiplies it by a preset adjustment coefficient to obtain the adjustment term. The preset adjustment coefficient is 0.5, which controls the rate at which the threshold changes with the sample size. The calculation process is as follows: the server divides the total number of samples by the reference sample size to obtain the ratio, then calculates the natural logarithm of the ratio, and multiplies it by the adjustment coefficient of 0.5 to obtain the adjustment term. For example, if the total number of samples is 150, the ratio is 1.5, the natural logarithm is approximately 0.405, and the adjustment term is approximately 0.203; if the total number of samples is 50, the ratio is 0.5, the natural logarithm is approximately -0.693, and the adjustment term is approximately -0.347.

[0106] The server divides the base threshold by the sum of the adjustment terms to obtain the dynamic threshold. The formula for calculating the dynamic threshold is: base threshold divided by the adjustment term (within parentheses). For example, when the adjustment term is 0.203, the dynamic threshold is 3.0 divided by 1.203, which is approximately 2.49; when the adjustment term is -0.347, the dynamic threshold is 3.0 divided by 0.653, which is approximately 4.59. It can be seen that the threshold decreases (more stringent) when the sample size is large, and increases (more lenient) when the sample size is small, effectively balancing false positives under small sample sizes and false negatives under large sample sizes.

[0107] When the multi-field Mahalanobis distance exceeds the dynamic threshold, the server triggers an attack alarm. After triggering the alarm, the server records the alarm time, the involved field groups, the multi-field Mahalanobis distance value, the dynamic threshold, the total number of legitimate units in the statistical pool, and pushes the alarm event to the security management module. At the same time, the server passes the field contribution vector calculated in step S3 to step S4 for subsequent source tracing and isolation operations. If the multi-field Mahalanobis distance is less than or equal to the dynamic threshold, no alarm is triggered, and the server continues to wait for the arrival of the next batch of legitimate units and performs a new round of detection.

[0108] In this embodiment, it is specifically necessary to explain the specific operation of anonymously tracing each organization using the unintentional transmission protocol in step S4:

[0109] The server identifies field groups whose normalized contribution exceeds a preset threshold as suspect field groups based on the normalized contribution calculated in step S3. The screening process for field groups whose normalized contribution exceeds the preset threshold is as follows: the server compares the normalized contribution of each field group calculated in step S3 with the preset threshold of 0.2. If the normalized contribution of a certain field group is greater than 0.2, then the field group is marked as a suspect field group. The threshold of 0.2 is set based on empirical optimization to ensure that only field groups that make a significant contribution to the overall abnormality enter the subsequent tracing process, avoiding over-processing of field groups with small contributions. For example, if there are three field groups with normalized contribution rates of 0.5, 0.3, and 0.2 respectively, then the first two field groups are selected as suspect field groups, and the third field group is not selected because it is equal to the threshold.

[0110] Based on the prior mean vector and prior covariance matrix output in step S2, the prior cumulative distribution function is derived, dividing the value range of each suspect field group into a preset number of probability intervals, with each probability interval covering an equal probability. The derivation process of the prior cumulative distribution function is as follows: the server constructs a univariate normal distribution based on the components of the corresponding suspect field group in the prior mean vector and the diagonal elements of the corresponding suspect field group in the prior covariance matrix output in step S2. The mean of this normal distribution is equal to... The variance of the corresponding component of the prior mean vector is equal to the corresponding diagonal element of the prior covariance matrix. Then, the server calculates the cumulative distribution function of the normal distribution. The range of values ​​is divided into 20 probability intervals, each covering a probability of 5%. Specifically, the server calculates the values ​​of the cumulative distribution function at quantiles 0.05, 0.10, 0.15...0.95, obtaining 19 boundary points. Adding negative infinity and positive infinity, a total of 20 intervals are formed. The probability covered by each interval is strictly equal to 0.05.

[0111] The server executes an unintentional transmission protocol with each institution, allowing the server to know the probability interval to which each institution's fixed-point normalized value belongs in the suspected field group, without revealing the specific value of the fixed-point normalized value. The specific execution process of the unintentional transmission protocol is as follows: the server, as the sender, holds 20 messages, each message being an encoding number for that probability interval (e.g., interval 1 is encoded as binary number 00001, interval 2 as 00010, and so on); each institution, as the receiver, holds a selection index, which is the interval number to which its fixed-point normalized value belongs in the cumulative distribution function; the institution obtains the message corresponding to the index from the server through the unintentional transmission protocol, while the server cannot know which message the institution selected; the protocol is implemented using elliptic curve-based 1-out-of-20 unintentional transmission, with communication overhead being 20 elliptic curve dot products, and computational overhead being negligible; after execution, the institution sends the obtained message (i.e., the interval number encoding) to the server, and the server can determine the interval number to which the institution belongs by looking up a table, but cannot know the specific fixed-point normalized value of the institution;

[0112] The server counts the number of organizations falling into each probability interval and calculates the deviation between the actual number of organizations and the expected number of organizations. The expected number of organizations is the total number of organizations with valid units in that field group divided by the number of probability intervals. Probability intervals with deviations exceeding a preset threshold are marked as abnormal intervals. The deviation calculation process is as follows: The server counts the number of organizations falling into each probability interval to obtain an array of actual organization numbers with a length of 20. The expected number of organizations is the total number of organizations with valid units in that field group divided by 20. The deviation calculation formula is: the absolute value of the actual number of organizations minus the expected number of organizations divided by the square root of the expected number of organizations. This deviation follows an approximately standard normal distribution, so the preset threshold is set to 3, corresponding to the three sigma criterion. When the deviation of an interval is greater than 3, the interval is marked as an abnormal interval. For example, if the total number of organizations is 100, the expected number of organizations is 5. If the actual number of organizations in an interval is 12, the deviation is (12-5) / √5≈3.13, which is greater than 3, so the interval is marked as an abnormal interval.

[0113] Institutions falling into the abnormal range are marked as preliminarily suspicious institutions. The process of constructing the preliminarily suspicious institution set is as follows: the server traverses all institutions, and for each institution, checks whether its probability range is marked as an abnormal range; if so, the institution is added to the preliminarily suspicious institution set. The number of institutions in this set is usually small, for example, only 10 to 20 institutions out of 100 institutions may fall into the abnormal range. The data distribution of these institutions deviates significantly from the expected distribution of the normal calibration ecosystem and needs to be further refined through suspiciousness calculation.

[0114] The specific steps for recalculating the baseline statistics of the suspected field group after applying differential privacy perturbations to the encrypted state unit data of a suspected organization are as follows:

[0115] The server obtains the fixed-point normalized value of each initially suspected institution on the suspected field group in a secure environment, and calls the digital twin model trained in step S2 to calculate the negative log-likelihood of the fixed-point normalized value under the corresponding field semantic conditions. The negative log-likelihood is used as the suspicion score of the initially suspected institution. The calculation process of the negative log-likelihood is as follows: In a trusted execution environment, for each initially suspected institution, the server obtains its fixed-point normalized value on the suspected field group, as well as the field semantic condition vector of the corresponding calibration task for that institution; the fixed-point normalized value and the field... The semantic conditional vector is input into the digital twin model (decoder of the conditional variational autoencoder) trained in step S2. The model outputs the probability density value of the normalized value of the fixed point under the given semantic conditions. Then, the negative log-likelihood is obtained by calculating the inverse of the natural logarithm of the probability density value. The larger the negative log-likelihood, the lower the probability of the data appearing under the digital twin model, i.e., the more likely it is to be anomalous data. For example, if the probability density is 0.01, the negative log-likelihood is 4.605; if the probability density is 0.001, the negative log-likelihood is 6.908.

[0116] The server calculates the mean and standard deviation of the suspicion scores for all initially suspected institutions. Institutions with suspicion scores greater than the mean plus twice the standard deviation are identified as final suspected institutions. The calculation process for negative log-likelihood is as follows: In a trusted execution environment, for each initially suspected institution, the server obtains its fixed-point normalized value on the suspected field group, as well as the field semantic condition vector for the corresponding calibration task. The fixed-point normalized value and the field semantic condition vector are input into the digital twin model (decoder of the conditional variational autoencoder) trained in step S2. The model outputs the probability density value of the fixed-point normalized value under the given field semantic conditions. Then, the negative logarithm of the probability density value is calculated to obtain the negative log-likelihood. The larger the negative log-likelihood, the lower the probability of the data appearing in the digital twin model, i.e., the more likely it is to be anomalous data. For example, if the probability density is 0.01, the negative log-likelihood is 4.605; if the probability density is 0.001, the negative log-likelihood is 6.908.

[0117] The server applies Laplace noise, proportional to the suspicion score, to the fixed-point normalized value of each ultimately suspected institution, resulting in a perturbed fixed-point normalized value. The Laplace noise application process involves the server calculating a global privacy budget parameter, which is equal to 0.1 multiplied by the maximum possible range of variation of the fixed-point normalized value. This maximum possible range is determined by the accuracy and range of the calibration procedure; for example, if the fixed-point normalized value ranges from -1 million to +1 million, the maximum range is 2 million, and the privacy budget parameter is 200,000. For each ultimately suspected institution… The noise scale is calculated as follows: the privacy budget parameter is multiplied by the institution's suspicion score and divided by the highest suspicion score among all ultimately suspicious institutions; then, random noise is sampled from a Laplace distribution whose scale parameter is equal to the noise scale and whose location parameter is 0; the noise is added to the original fixed-point normalized value to obtain the perturbed fixed-point normalized value; for example, if the original value is 50000 and the noise scale is 10000, the sampled noise may be -2000, and the perturbed value may be 48000; the addition of noise makes the original value unrecoverable, satisfying the differential privacy requirement;

[0118] The server uses the original fixed-point normalized values ​​of non-suspicious institutions and the perturbed fixed-point normalized values ​​of the final suspicious institutions as a basis. It assigns weights to the data of the final suspicious institutions that decrease exponentially with increasing suspicion scores, and calculates a weighted average as the baseline statistic after the suspicion field group is updated. The calculation process for the weighted average is as follows: the server first counts the number of non-suspicious institutions and the weight of each final suspicious institution. The weight is calculated using the formula: the natural constant e^(-0.1) multiplied by the power of the suspicion score. For example, if the suspicion score is 10, the weight is e^(-1), which is approximately 0.368; if the suspicion score is 20, ... The weight is e^(-2) = approximately 0.135. Then, the weighted sum is calculated: the sum of the original fixed-point normalized values ​​of all non-suspicious institutions plus the sum of the perturbed fixed-point normalized values ​​of all ultimately suspicious institutions multiplied by their corresponding weights. Next, the normalization factor is calculated: the number of non-suspicious institutions plus the sum of the weights of all ultimately suspicious institutions. Finally, the weighted sum is divided by the normalization factor to obtain the updated benchmark mean. This benchmark mean replaces the original statistical pool aggregation result and is used for all subsequent calibration calculations based on this field group. Institutions with higher suspicion levels contribute less to the benchmark, thus effectively suppressing the contamination of the benchmark by outlier data.

[0119] The server, based on the state chain pointer maintained in step S1, finds the most recently submitted encrypted state unit for each ultimately suspicious organization, and rewrites the stage number of this encrypted state unit to a preset locking value. The locking value is the maximum value of the stage number data type. The stage number data type is a 32-bit unsigned integer, ranging from 0 to 4294967295. The locking value is set to 4294967295, which is the maximum value of this data type. The server first finds the most recently submitted encrypted state unit for each organization based on the state chain pointer maintained for each organization in step S1. The state chain pointer records the stage number of the organization's previous legitimate unit and the hash value of the fixed-point normalization value. This pointer allows for quick location of the organization's latest encrypted state unit. The server extracts the stage number field from this encrypted state unit and overwrites it with the locking value 4294967295. The write operation is completed within a trusted execution environment to ensure the atomicity and uninterruptibility of the locking operation.

[0120] The AEAD authentication tag for the encrypted state unit is recalculated, causing any subsequent requests to advance the encrypted state unit to the document state to be rejected due to stage number verification failure. The process of recalculating the AEAD authentication tag is as follows: the server uses a 256-bit symmetric key shared with the organization, and takes all fields of the modified encrypted state unit (including the new stage number lock value, field semantic code digest, fixed point normalization value, etc.) as input to re-execute the authentication tag generation step in the AEAD encryption algorithm. Specifically, the server inputs the new stage number as part of the additional authentication data, along with the ciphertext of the original fixed point normalization value, into the authentication encryption algorithm to generate a new 128-bit authentication tag, replacing the original authentication tag. After this, any operation attempting to modify the stage number of the encrypted state unit from the lock value to another value or attempting to advance it to the document state will be rejected in the integrity verification of step S1 due to authentication tag mismatch, because modifying the stage number will cause the recalculated authentication tag to be inconsistent with the stored tag.

[0121] The server simultaneously updates the state chain pointer of the final suspected organization, causing subsequent received encrypted state units to be discarded during continuity verification because their stage numbers cannot exceed the locked value, thus preventing the final suspected organization from submitting new data. The specific operation of updating the state chain pointer is as follows: the server updates the stage number of the previous legitimate unit recorded in the organization's state chain pointer to the locked value 4294967295, and updates the hash value of the fixed-point normalized value of the previous legitimate unit to the hash value of the fixed-point normalized value of the current locked unit. Afterwards, when the organization submits a new encrypted state unit again, the server performs continuity verification in step S1. The system compares the stage number of the new unit with the previous stage number (i.e., the lock value) recorded in the state chain pointer. Since the continuity check requires the new stage number to be strictly greater than the previous stage number, and the lock value is already the maximum value, no new stage number can be greater than 4294967295. Therefore, the continuity check will inevitably fail, and the new unit will be discarded. At the same time, if the organization fails to submit three times in a row, the server will mark it as a suspected abnormal organization and trigger manual review to further strengthen the blocking effect. In this way, the server completely prevents suspicious organizations from continuing to inject new data into the statistical pool, achieving the goal of cutting off the spread of pollution at the source.

[0122] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0123] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0124] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0125] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0126] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0127] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0128] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A semantic authentication encryption method for MRI phantom calibration, characterized in that, Includes the following steps: Step S1: The server receives the encrypted state units uploaded by each institution. The encrypted state unit carries the field semantic code digest, the AEAD encrypted value of the fixed point normalization value and the stage number. It performs integrity verification based on the AEAD authentication tag and continuity verification based on the staged state chain. Only the encrypted state units that pass the double verification are retained as legal units and stored in the statistics pool. Step S2: The server trains a conditional variational autoencoder as a digital twin model based on historical legitimate calibration data. The digital twin model takes field semantic conditions based on field semantic code summaries as input and outputs the prior statistical features of normal calibration data in a multi-field joint space containing multiple field groups. Step S3: The server calculates the ciphertext domain statistical feature vector using homomorphic encryption for the fixed point normalized values ​​of each field group in the current statistical pool, then decrypts it to obtain the plaintext aggregate statistics, calculates the multi-field Mahalanobis distance between the data and the prior statistical features, and calculates the field contribution based on the partial derivative of the Mahalanobis distance with respect to each field. When the attack alarm is triggered, the attack alarm is triggered when the attack exceeds the preset basic threshold and the dynamic threshold calculated from the total number of legal units in the statistical pool. Step S4: Based on field contribution, anonymous tracing of each institution is performed using an unintentional transmission protocol. Institutions selected based on field contribution are identified as suspicious institutions. Differential privacy perturbation is applied to the data of the encrypted state unit of the suspicious institution, and the baseline statistics of the field group are recalculated. The document gating mechanism of the staged state chain is linked to lock the stage number of the encrypted state unit of the suspicious institution into the computation state.

2. The MRI phantom calibration semantic authentication encryption method according to claim 1, characterized in that: The specific operation of integrity verification based on the AEAD authentication tag in step S1 is as follows: The server uses a key shared with the organization to perform decryption operations on the AEAD ciphertext with fixed-point normalized values ​​in the ciphertext state unit. If decryption fails or the authentication tag does not match, the current ciphertext state unit is determined to have failed the integrity check and is discarded. If decryption is successful and the authentication tag matches, the continuity verification based on the staged state chain continues. Specifically, the server maintains a state chain pointer for each organization. The state chain pointer records the stage number of the previous legal unit and the hash value of the fixed point normalization value of the previous legal unit. When the current ciphertext state unit is received, the server checks whether the stage number of the current ciphertext state unit is greater than the stage number of the previous valid unit, and checks whether the hash value of the fixed-point normalized value of the current ciphertext state unit is not equal to the hash value of the fixed-point normalized value of the previous valid unit. If the continuity check passes, the server marks the current ciphertext state unit as a valid unit and updates the organization's state chain pointer with the stage number of the current ciphertext state unit and the hash value of the fixed-point normalization value. If the continuity check fails, the current ciphertext state unit is determined to be non-continuous and is discarded.

3. The MRI phantom calibration semantic authentication encryption method according to claim 2, characterized in that: Step S1 also includes performing a topological dependency check based on the field semantic code, the specific operation of which is as follows: The server has a pre-defined directed acyclic graph of dependencies between fields. The nodes of the dependent directed acyclic graph are the semantic code digests of each field, and the edges represent the measurement order between fields. For the current ciphertext state unit, the server searches for all parent field sets pointing to the field semantic code digest in the dependency directed acyclic graph based on the field semantic code digest it carries. Each element in the parent field set is called a parent field. For each parent field in the set of parent fields, the server retrieves the stage number of the most recently submitted legal unit of the same institution whose field semantic code digest is the parent field from the statistical pool; If any parent field has a stage number greater than the stage number of the current ciphertext state unit, or if the parent field has never been submitted as a valid unit by the organization, the current ciphertext state unit is deemed to violate topological dependency and is discarded. The current ciphertext state unit is allowed to enter the statistics pool only if the stage number of all parent fields is less than the stage number of the current ciphertext state unit and all of them already have a valid unit.

4. The MRI phantom calibration semantic authentication encryption method according to claim 3, characterized in that: The specific operation for training the conditional variational autoencoder in step S2 is as follows: The server extracts the fixed-point normalized value vector for each calibration task from the historical valid calibration data in the statistical pool, and constructs a field semantic condition vector for each calibration task. The field semantic condition vector is composed of the field semantic code digest and the procedure version hash, rounding rule hash and template label hash generated based on the field semantic code digest. The server uses the fixed-point normalized value vector and the field semantic condition vector as training sample pairs, and inputs them into the encoder and decoder of the conditional variational autoencoder for training. The encoder learns the latent variable posterior distribution parameters of the fixed-point normalized value vector under the field semantic condition, and the decoder reconstructs the fixed-point normalized value vector based on the latent variable and the field semantic condition. After training is complete, the server saves the decoder as a digital twin model; After receiving the semantic conditions of the fields, the server uses a decoder to sample the latent variables multiple times and calculates the empirical mean and covariance matrix of the reconstructed mean vector, which serve as the prior statistical features of the normal calibration data in the multi-field joint space containing multiple field groups.

5. The MRI phantom calibration semantic authentication encryption method according to claim 4, characterized in that: In step S2, the loss function for training the conditional variational autoencoder includes a physical constraint regularization term. The specific calculation method for the physical constraint regularization term is as follows: The server pre-sets a set of field pairs subject to physical constraints. Each field pair contains two field groups as well as the reference ratio and tolerance pre-set by this solution. For each training sample, the server calculates the measured ratio of the fixed-point normalized values ​​of the two field groups in the training sample. If the absolute difference between the measured ratio and the preset reference ratio of this scheme exceeds the preset tolerance of this scheme, a penalty is applied to the training sample. The penalty value is the positive value after subtracting the tolerance from the absolute difference between the measured ratio and the reference ratio. The physical constraint regularization term is the sum of the penalty values ​​of all field pairs multiplied by a preset weighting coefficient.

6. The MRI phantom calibration semantic authentication encryption method according to claim 5, characterized in that: The specific operation of calculating the statistical feature vector of the ciphertext field using homomorphic encryption in step S3 is as follows: The server uses its own Paillier homomorphic encryption public key to encrypt the fixed-point normalized value of each legal unit in each field group in the statistics pool, thus obtaining homomorphic ciphertext; For each field group, the server uses the homomorphic addition property to calculate the sum of all homomorphic ciphertexts, and then divides it by the number of legal units in that field group to obtain the mean homomorphic ciphertext of that field group. For any two field groups, the server uses homomorphic subtraction and homomorphic multiplication to calculate the homomorphic ciphertext of the product of the difference between each cell and its mean, then sums them and divides them by the number of legal cells in the field group minus one to obtain the covariance homomorphic ciphertext. The server decrypts all mean homomorphic ciphertext and covariance homomorphic ciphertext in a secure environment, obtaining the mean vector and sample covariance matrix in plaintext form as plaintext aggregation statistics.

7. The MRI phantom calibration semantic authentication encryption method according to claim 6, characterized in that: The specific steps for calculating the multi-field Mahalanobis distance between the feature and prior statistical features are as follows: The server calculates the difference vector between the mean vector of the current statistical pool and the prior mean vector in the prior statistical features output in step S2. After transposing the difference vector, multiply it by the inverse of the prior covariance matrix in the prior statistical features output in step S2, and then multiply it by the difference vector again to obtain the square of the basic Mahalanobis distance. The server calculates the ratio of the sample covariance matrix to the prior covariance matrix of the current statistical pool. Specifically, it multiplies the inverse of the prior covariance matrix by the sample covariance matrix to obtain the product matrix, calculates the trace of the product matrix, and then divides it by the total number of field groups to obtain the average ratio. The server calculates the exponential factor using the natural constant e as the base and the product of the preset scaling factor and the average ratio as the exponential factor. Multiplying the basic Mahalanobis distance by an exponential factor yields the final multi-field Mahalanobis distance.

8. The MRI phantom calibration semantic authentication encryption method according to claim 7, characterized in that: The specific steps for calculating the field contribution based on the partial derivatives of the Mahalanobis distance with respect to each field are as follows: The server calculates the partial derivative of the multi-field Mahalanobis distance with respect to each component of the mean vector of the current statistical pool; the server divides the absolute value of the partial derivative of each field by the sum of the absolute values ​​of the partial derivatives of all fields to obtain the normalized contribution of each field. The specific calculation method for the dynamic threshold is as follows: the server presets the basic threshold and reference sample size; the total number of valid units in all field groups in the current statistical pool is counted; The server calculates the ratio of the total number to the reference sample size, takes the natural logarithm of the ratio, and then multiplies it by a preset adjustment coefficient to obtain the adjustment term; The server divides the base threshold by the sum of the adjustment terms to obtain the dynamic threshold; when the Mahalanobis distance of the multi-field is greater than the dynamic threshold, the server triggers an attack alarm.

9. The MRI phantom calibration semantic authentication encryption method according to claim 8, characterized in that: The specific steps for anonymous tracing of various institutions using the unintentional transmission protocol in step S4 are as follows: Based on the normalized contribution calculated in step S3, the server identifies the field groups whose normalized contribution exceeds a preset threshold as suspected field groups. Based on the prior mean vector and prior covariance matrix in the prior statistical features output in step S2, the prior cumulative distribution function is derived, and the value range of each suspect field group is divided into a preset number of probability intervals, with each probability interval covering an equal probability. The server executes an unintentional transmission protocol with each institution, enabling the server to know the probability range of the fixed-point normalized value of each institution on the suspected field group, without disclosing the specific value of the fixed-point normalized value; The server counts the number of institutions falling into each probability interval, calculates the deviation between the actual number of institutions and the expected number of institutions. The expected number of institutions is the total number of institutions with legal units in this field group divided by the number of probability intervals. Probability intervals with deviations exceeding a preset threshold are marked as abnormal intervals; institutions falling into abnormal intervals are marked as initially suspicious institutions.

10. The MRI phantom calibration semantic authentication encryption method according to claim 9, characterized in that: The specific steps for recalculating the baseline statistics of the suspected field group after applying differential privacy perturbations to the encrypted state unit data of a suspected organization are as follows: The server obtains the fixed-point normalized value of each initially suspected organization on the suspected field group in the secure environment, and calls the digital twin model trained in step S2 to calculate the negative log-likelihood of the fixed-point normalized value under the corresponding field semantic conditions. The negative log-likelihood is used as the suspicion score of the initially suspected organization. The server calculates the mean and standard deviation of the suspicion scores of all initially suspected institutions, and identifies the initially suspected institutions whose suspicion scores are greater than the mean plus twice the standard deviation as the final suspected institutions. The server applies Laplace noise, whose scale is proportional to the suspicion score, to the fixed-point normalized value of each final suspicious institution to obtain the perturbed fixed-point normalized value. The server uses the original fixed-point normalized value of non-suspicious institutions and the perturbed fixed-point normalized value of the final suspicious institutions as the basis. It assigns a weight that decays exponentially with the increase of the suspicion score to the data of the final suspicious institutions and calculates the weighted average as the baseline statistic after the suspected field group is updated. Based on the state chain pointer maintained in step S1, the server finds the most recently submitted encrypted state unit for each ultimately suspicious organization and rewrites the stage number of the encrypted state unit to a preset lock value. It also recalculates the AEAD authentication tag of the encrypted state unit, so that any subsequent request to advance the encrypted state unit to the document state is rejected due to the failure of the stage number verification. The server simultaneously updates the state chain pointer of the final suspected organization, causing subsequent received encrypted state units to be discarded during continuity verification because the stage number cannot exceed the locked value, thereby preventing the final suspected organization from submitting new data.

Images