Medical data homomorphic encryption and privacy protection method and system

Abstract

The present application relates to the technical field of medical data processing, and more particularly to a medical data homomorphic encryption and privacy protection method and system, wherein a data provider homomorphically encrypts medical data in blocks and generates a commitment value, a model provider verifies data compliance through challenge, constructs encrypted diagnosis model embedding probe sample insertion logic, calculates homomorphic operation execution to trigger probe sample injection, the data provider decrypts and compares with a preset label to verify model credibility, and returns an encrypted output if the verification is passed, otherwise the process is terminated, thereby realizing double verification of medical data privacy protection and model credibility and improving data sharing security.

Description

Technical Field

[0001] This invention relates to the field of medical data processing technology, and in particular to a method and system for homomorphic encryption and privacy protection of medical data. Background Technology

[0002] In the field of medical data privacy protection, current conventional practices mainly rely on homomorphic encryption technology to perform data computation in encrypted form. The data provider homomorphically encrypts the entire medical dataset or divides it into fixed-length blocks and uploads the encrypted data to the computing service provider. The computing service provider performs homomorphic operations on the encrypted data based on a pre-built encrypted diagnostic model, and finally returns the encrypted result, which is decrypted by the data provider. In this process, the data provider typically only ensures the integrity of the data during transmission through digital signatures or hash verification, but cannot verify whether the computing provider correctly executed the model computation or whether the model itself has been tampered with. Another common approach is to introduce secure multi-party computation or zero-knowledge proof protocols, verifying the correctness of the computation through multi-party interaction and complex proof generation. However, such methods often require significant communication overhead and computing resources, making them difficult to adapt to the real-time requirements of medical data diagnosis.

[0003] In current practices, data providers cannot verify whether their encrypted data meets medical constraints, such as the validity of diagnostic indicators or the consistency of data format, before the computation results are returned. Traditional homomorphic encryption schemes only provide data confidentiality guarantees and lack means to verify the semantics of data in its encrypted state. This allows the computation party to execute models on invalid data, producing invalid or misleading diagnostic results. Even if data anomalies are subsequently discovered, the consumed computational resources and delays cannot be recovered.

[0004] The current limitation is that after the model provider submits the encrypted diagnostic model to the computation executor, it cannot effectively detect whether the model has been maliciously modified or injected with additional logic. This lack of transparency in model behavior casts doubt on the credibility of medical diagnostic results, especially when dealing with sensitive medical conditions, posing a significant challenge to security. Summary of the Invention

[0005] The present invention provides a method and system for homomorphic encryption and privacy protection of medical data, which can solve the problems in the prior art.

[0006] A first aspect of the present invention provides a method for homomorphic encryption and privacy protection of medical data, comprising:

[0007] The data provider divides the medical data set into multiple data blocks and homomorphically encrypts them. Based on the homomorphic commitment scheme, a commitment value with separable open attributes is generated for each data block.

[0008] The model provider initiates a challenge request specifying the target data block index. The data provider performs a commitment to open the target data block and generates a partial open proof. The model provider verifies the partial open proof based on the corresponding commitment value, confirms the consistency of the commitment binding relationship and medical constraint rules, and obtains the data compliance verification result.

[0009] The model provider constructs an encrypted diagnostic model and embeds probe sample insertion logic in the encrypted diagnostic model calculation process to perform homomorphic hash operation on the pseudo-random seed of the ciphertext field to generate the ciphertext insertion position index, and submits the encrypted diagnostic model to the calculation execution party.

[0010] The computing executor performs homomorphic operations on the encrypted diagnostic model in blocks of encrypted data, and triggers probe sample injection based on the ciphertext insertion position index to obtain encrypted output. The data provider decrypts the probe sample results and compares them with preset labels to obtain the model credibility verification results.

[0011] When both the data compliance verification result and the model credibility verification result pass, an encrypted output is returned; otherwise, the calculation is terminated and an anomaly flag is output.

[0012] The data provider divides the medical dataset into multiple data blocks and homomorphically encrypts them. Based on a homomorphic commitment scheme, it generates a commitment value for each data block with separable open attributes, including:

[0013] The data provider divides the medical data set into multiple data blocks according to a preset block division strategy. For each data block, a homomorphic encryption scheme is applied to generate a corresponding encrypted data block. For each data block, a homomorphic commitment scheme is applied to generate a commitment value with separable and openable attributes. A cryptographic binding relationship is established between the commitment value and the corresponding data block.

[0014] The data provider generates a pseudo-random seed for the ciphertext field. The pseudo-random seed satisfies the pseudo-random property within the ciphertext field of the homomorphic encryption scheme. The set of encrypted data blocks consisting of all encrypted data blocks and the pseudo-random seed for the ciphertext field are sent to the computation execution party through a communication channel. The set of commitment values ​​consisting of all commitment values ​​and the pseudo-random seed for the ciphertext field are sent to the model provider through a communication channel.

[0015] The model provider initiates a challenge request specifying the target data block index. The data provider performs a commitment to open the target data block, generating a partial open proof. The model provider verifies the partial open proof based on the corresponding commitment value, confirming the commitment binding relationship and the consistency of medical constraint rules, and obtains the data compliance verification result, including:

[0016] The model provider generates a challenge request containing at least one target data block index and sends it to the data provider;

[0017] The data provider locates the corresponding target data block according to the target data block index, performs a commitment open operation on the target data block, and the commitment open operation only opens the commitment value corresponding to the target data block based on the separable open attribute of the homomorphic commitment scheme. It generates a partial open proof and statistical feature plaintext and sends it to the model provider. The partial open proof is used to prove the binding relationship between the statistical feature plaintext and the corresponding commitment value.

[0018] The model provider verifies the partial open proof based on the commitment value corresponding to the target data block index in the commitment value set. The partial open proof confirms the cryptographic binding relationship between the statistical feature plaintext and the corresponding commitment value. After the verification is successful, the medical statistical features in the statistical feature plaintext are checked for consistency with the preset medical constraint rules. The medical constraint rules define the reasonable value range and distribution characteristics of medical data. The data compliance verification result is generated based on the verification result.

[0019] The model provider constructs an encrypted diagnostic model and embeds probe sample insertion logic within the model's computation process. This logic involves performing a homomorphic hash operation on a pseudo-random seed in the ciphertext field to generate a ciphertext-form insertion position index. The encrypted diagnostic model is then submitted to the computation executor, including:

[0020] The model provider constructs an encrypted diagnostic model that includes model parameters and computational procedures;

[0021] The model provider constructs probe sample insertion logic, which defines the calculation steps of performing homomorphic hashing on the pseudo-random seed in the ciphertext field. The homomorphic hashing operation transforms the pseudo-random seed in the ciphertext field into a ciphertext form insertion position index through a homomorphic mapping function.

[0022] The model provider encodes the probe sample insertion logic into a homomorphic computing circuit. The homomorphic computing circuit receives the ciphertext-form insertion position index and the set of encrypted data blocks. It achieves blind positioning through the ciphertext domain condition selection operation. The ciphertext domain condition selection operation performs a ciphertext comparison operation on each encrypted data block to calculate its matching degree with the ciphertext-form insertion position index. Based on the ciphertext comparison result, the probe sample is injected at the matching position.

[0023] The model provider constructs probe samples with pre-set labels and homomorphically encrypts them to obtain encrypted probe samples. The encrypted probe samples are embedded in the homomorphic computing circuit as injection data for conditional selection operations, and the pre-set labels are stored locally.

[0024] The model provider submits the cryptographic diagnostic model, which includes homomorphic computing circuits and cryptographic probe samples, to the computing executor.

[0025] The model provider constructs probe sample insertion logic, which defines the computation steps of performing a homomorphic hash operation on the ciphertext pseudo-random seed. The homomorphic hash operation transforms the ciphertext pseudo-random seed into a ciphertext insertion position index through a homomorphic mapping function, including:

[0026] The model provider defines a homomorphic mapping function, which includes a combination of homomorphic modular operations and homomorphic linear transformations;

[0027] The model provider defines a calculation step in the probe sample insertion logic to perform homomorphic hashing on the pseudo-random seed of the ciphertext field. The homomorphic hashing operation performs homomorphic square operation on the pseudo-random seed of the ciphertext field to obtain the ciphertext square value, and performs homomorphic modulo operation on the ciphertext square value to map it to a preset ciphertext range to obtain the ciphertext hash intermediate value.

[0028] A homomorphic linear transformation is performed on the ciphertext hash intermediate value. The homomorphic linear transformation performs a homomorphic modulo operation on the ciphertext hash intermediate value and the number of blocks in the encrypted data block set to obtain the ciphertext form insertion position index located in the encrypted data block index space. The ciphertext form insertion position index encodes the injection position of the probe sample in the ciphertext field.

[0029] The model provider embeds a collision avoidance mechanism in the probe sample insertion logic. The collision avoidance mechanism defines that when the generated ciphertext insertion position index conflicts with an existing position index, a homomorphic increment operation is performed on the pseudo-random seed of the ciphertext field and a homomorphic hash operation is re-executed until a non-conflicting ciphertext insertion position index is generated.

[0030] Injected probe samples, including:

[0031] The model provider inserts the probe samples into a homomorphic computation circuit, which includes a ciphertext comparison sub-circuit and a conditional selection sub-circuit.

[0032] The ciphertext comparison sub-circuit performs homomorphic encryption on the index value of each encrypted data block in the encrypted data block set to obtain an encrypted index value, performs homomorphic subtraction on the encrypted index value and the ciphertext insertion position index to obtain a ciphertext difference, performs homomorphic square operation on the ciphertext difference and generates a ciphertext matching identifier through the homomorphic threshold judgment circuit, and the ciphertext matching identifier encodes the matching relationship between the encrypted data block and the insertion position in the ciphertext field;

[0033] The condition selection sub-circuit receives the ciphertext matching identifier corresponding to each encrypted data block, performs ciphertext multiplication on each encrypted data block, multiplies the encrypted data block with its corresponding ciphertext matching identifier to obtain the selection result, multiplies the encrypted probe sample with the ciphertext matching identifier to obtain the injected data, performs homomorphic addition on the selection result and the injected data to achieve conditional substitution, and completes the injection of the probe sample at the matching position.

[0034] The computation executor performs homomorphic operations on the encrypted diagnostic model in blocks of encrypted data, triggers probe sample injection based on the ciphertext insertion position index, and obtains encrypted output. The data provider decrypts the probe sample results and compares them with preset labels to obtain the model credibility verification results, including:

[0035] The computation executor performs homomorphic operations on the encrypted diagnostic model for the encrypted data blocks. During the homomorphic operation, the operation is selected based on the ciphertext field conditions in the homomorphic computation circuit. Based on the ciphertext form insertion position index and the ciphertext comparison result of each encrypted data block, the probe sample injection is triggered. The encrypted probe sample is fused into the homomorphic operation process at the corresponding position to obtain an encrypted output containing both normal diagnostic results and probe sample diagnostic results.

[0036] The computation executor organizes the encrypted output in a structured manner, inserts a location index based on the ciphertext to generate location marker information for the diagnostic results of the probe sample, and sends the encrypted output and location marker information to the data provider.

[0037] The data provider performs decryption and verification operations on the location marker information based on the pseudo-random seed in the ciphertext field to recover the probe sample location index. Based on the location index, the encrypted diagnostic results corresponding to the probe sample are extracted from the encrypted output and decrypted to obtain the probe sample results. The probe sample results are compared with the preset labels stored locally to calculate the consistency metric and generate the model credibility verification results.

[0038] A second aspect of the present invention provides a medical data homomorphic encryption and privacy protection system, comprising:

[0039] The block commitment unit is used by the data provider to divide the medical data set into multiple data blocks and homomorphically encrypt them. Based on the homomorphic commitment scheme, a commitment value with separable open attribute is generated for each data block.

[0040] The compliance verification unit is used by the model provider to initiate a challenge request to specify the target data block index. The data provider performs a commitment to open the target data block and generates a partial open proof. The model provider verifies the partial open proof based on the corresponding commitment value, confirms the commitment binding relationship and the consistency of medical constraint rules, and obtains the data compliance verification result.

[0041] The model construction unit is used by the model provider to construct the encrypted diagnostic model. It embeds the probe sample insertion logic in the encrypted diagnostic model calculation process to perform homomorphic hash operation on the pseudo-random seed of the ciphertext field to generate the ciphertext form insertion position index, and submits the encrypted diagnostic model to the calculation execution party.

[0042] The execution verification unit is used to calculate the homomorphic operation of the encryption diagnostic model performed by the executor on the encrypted data blocks, and to trigger the injection of probe samples according to the ciphertext form insertion position index to obtain the encrypted output. The data provider decrypts the probe sample results and compares them with the preset labels to obtain the model credibility verification results.

[0043] The result determination unit is used to return encrypted output when both the data compliance verification result and the model credibility verification result pass; otherwise, it terminates the calculation and outputs an anomaly flag.

[0044] A third aspect of the present invention provides an electronic device, comprising:

[0045] processor;

[0046] Memory used to store processor-executable instructions;

[0047] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0048] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0049] The beneficial effects of this invention are:

[0050] Medical data is homomorphically encrypted in blocks and combined with a commitment scheme that allows for separable open attributes, enabling efficient verification of data compliance. The data provider only needs to generate a partial open proof for the target data block specified in the challenge. The model provider can then confirm the binding relationship between that block and the original commitment, as well as the consistency of medical constraint rules. This avoids complete decryption or complex comparison of the entire dataset, significantly reducing verification computational overhead and communication pressure. This mechanism effectively prevents data tampering or forgery, ensuring accurate auditing of medical data even in its encrypted state. It supports fine-grained data usage legality checks and is suitable for scenarios such as large-scale federated learning of medical data.

[0051] The encrypted diagnostic model embeds probe sample insertion logic based on a pseudo-random seed in the ciphertext field and homomorphic hashing. When performing homomorphic operations, the computation executor cannot distinguish between normal data and probe data, automatically triggering the generation of a ciphertext-formatted insertion position index and completing the probe sample injection. The data provider can determine whether the model has been maliciously tampered with or implanted with backdoors during execution by decrypting the probe results and comparing them with pre-set labels, without relying on a third-party auditing institution, achieving self-verification of the model's behavioral integrity. This design completely eliminates the risk of unauthorized interference with the model logic by the computation executor without exposing the original data.

[0052] Data compliance verification and model credibility verification form a dual security barrier. The system only outputs the encrypted calculation result when both results pass; otherwise, the calculation is terminated and an anomaly flag is returned. This cascading verification strategy ensures that any data anomaly or model contamination at any stage can be immediately blocked, preventing the continuation of invalid or harmful calculations, and effectively preventing data leakage or misuse of inference results. The entire approach maintains a complete and auditable track of medical data throughout the entire encrypted domain processing, balancing privacy protection and computational efficiency, and providing highly secure and redundant technical support for cross-institutional medical collaboration. Attached Figure Description

[0053] Figure 1 A flowchart illustrating methods for homomorphic encryption and privacy protection of medical data;

[0054] Figure 2 The flowchart shows the logic for constructing and submitting the probe sample insertion for the model provider. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0057] Figure 1 This is a flowchart illustrating the homomorphic encryption and privacy protection method for medical data according to an embodiment of the present invention.

[0058] Homomorphic encryption and privacy protection methods for medical data include:

[0059] The data provider divides the medical data set into multiple data blocks and homomorphically encrypts them. Based on the homomorphic commitment scheme, a commitment value with separable open attributes is generated for each data block.

[0060] The model provider initiates a challenge request specifying the target data block index. The data provider performs a commitment to open the target data block and generates a partial open proof. The model provider verifies the partial open proof based on the corresponding commitment value, confirms the consistency of the commitment binding relationship and medical constraint rules, and obtains the data compliance verification result.

[0061] The model provider constructs an encrypted diagnostic model and embeds probe sample insertion logic in the encrypted diagnostic model calculation process to perform homomorphic hash operation on the pseudo-random seed of the ciphertext field to generate the ciphertext insertion position index, and submits the encrypted diagnostic model to the calculation execution party.

[0062] The computing executor performs homomorphic operations on the encrypted diagnostic model in blocks of encrypted data, and triggers probe sample injection based on the ciphertext insertion position index to obtain encrypted output. The data provider decrypts the probe sample results and compares them with preset labels to obtain the model credibility verification results.

[0063] When both the data compliance verification result and the model credibility verification result pass, an encrypted output is returned; otherwise, the calculation is terminated and an anomaly flag is output.

[0064] The data provider divides the medical dataset into multiple data blocks and homomorphically encrypts them. Based on a homomorphic commitment scheme, it generates a commitment value for each data block with separable open attributes, including:

[0065] The data provider divides the medical data set into multiple data blocks according to a preset block division strategy. For each data block, a homomorphic encryption scheme is applied to generate a corresponding encrypted data block. For each data block, a homomorphic commitment scheme is applied to generate a commitment value with separable and openable attributes. A cryptographic binding relationship is established between the commitment value and the corresponding data block.

[0066] The data provider generates a pseudo-random seed for the ciphertext field. The pseudo-random seed satisfies the pseudo-random property within the ciphertext field of the homomorphic encryption scheme. The set of encrypted data blocks consisting of all encrypted data blocks and the pseudo-random seed for the ciphertext field are sent to the computation execution party through a communication channel. The set of commitment values ​​consisting of all commitment values ​​and the pseudo-random seed for the ciphertext field are sent to the model provider through a communication channel.

[0067] In real-world scenarios, medical datasets often contain diverse and heterogeneous data, including patient imaging data, laboratory test result sequences, and electronic medical record text feature vectors, reaching scales of hundreds of megabytes or even larger. To ensure efficient processing by subsequent homomorphic encryption and commitment schemes, the entire medical dataset needs to be divided into multiple data blocks according to a pre-defined block-splitting strategy. This strategy determines the block granularity based on data type, data volume, and the number of plaintext slots supported by the downstream homomorphic encryption scheme. For example, when using batch encoding based on CKKS or BFV schemes, the number of elements that a single plaintext polynomial can encode in parallel determines the maximum capacity of each data block. In practice, the medical dataset is divided according to a fixed length or semantic boundaries (e.g., a single test record as a block unit). After segmentation, the dataset is obtained... Data blocks Each data block ( It contains several plaintext elements, and the blocks do not overlap and are completely equivalent to the original data set after merging.

[0068] For each data block, a homomorphic encryption scheme is applied to generate a corresponding encrypted data block. The public key of the homomorphic encryption scheme is held and used for encryption by the data provider, while the corresponding private key is kept independently by the data provider and not disclosed to any other participating party. (This applies to data blocks.) Through homomorphic encryption algorithm Encode it into ciphertext ,in The public key is used. Because the homomorphic encryption scheme employed possesses additive homomorphic or fully homomorphic properties, subsequent computation can be performed directly on the ciphertext. It performs arithmetic operations without decrypting the original plaintext, thus protecting the privacy of patient medical data. One encrypted data block Constructing a set of encrypted data blocks .

[0069] For each data block, a homomorphic commitment scheme is applied to generate a commitment value with separable open property. The homomorphic commitment scheme requires that the commitment function possesses additive homomorphism with respect to the plaintext; that is, the commitment values ​​for two blocks can be merged into a commitment for their concatenated data without decryption. This property supports the efficient generation of subsequent partial open proofs. The separable open property means that the commitment value generated for the entire dataset can open a single data block individually. This commitment is made without revealing the contents of other data blocks. Specifically, for each data block... Introducing an independent random blinding factor Through commitment algorithm Generate commitment value Commitment value Data partitioning A cryptographic binding relationship has been established between them, meaning that under the assumption of computational indistinguishability, anyone who does not know... and One party cannot forge a document with The content of the different sections matches. All Each commitment value Constitutes the set of commitment values .

[0070] The generation of the ciphertext pseudo-random seed is the key link connecting the two links of data compliance verification and model credibility verification in the entire scheme. The homomorphic encryption scheme satisfies the pseudo-random property within the ciphertext field, that is... It is a legitimate ciphertext, and the plaintext content it encrypts is invisible to both the computation executor and the model provider. However, the pseudo-random behavior of this ciphertext in the ciphertext domain can be exploited by homomorphic operations. (Generation) The method is as follows: the data provider selects a random plaintext seed locally. It is encrypted using a homomorphic encryption algorithm to obtain and will It is retained locally as a basis for subsequent verification of the probe sample results. Because... It is standard ciphertext; the computation executor can perform a homomorphic hash operation on it to derive the insertion position index, but cannot obtain it from... Inferred from The specific value is determined to ensure the unpredictability of the insertion position of the probe sample.

[0071] Encrypted data block set With ciphertext field pseudo-random seed The data is transmitted to the computation executor via a secure communication channel. This communication channel must meet integrity and confidentiality protection requirements, and can employ an encrypted channel based on transport layer security protocols to prevent man-in-the-middle attacks or data tampering. The computation executor receives... and Afterwards, the data held is in pure ciphertext form, completely invisible to the original medical plaintext content, and can only perform homomorphic operations on the ciphertext.

[0072] Set of commitment values With ciphertext field pseudo-random seed Sends the data to the model provider via a communication channel. The model provider holds... This is used to subsequently verify the partial proofs opened by the data provider, confirming whether the commitment binding relationship of a specified data block is valid, and checking whether the content of that block meets medical constraint rules (such as the reasonableness of numerical ranges, field integrity constraints, etc.). The model provider also holds... In order to embed based on the construction of the cryptographic diagnostic model The homomorphic hashing logic is used to derive the insertion position index of the probe sample within the ciphertext field. It is worth noting that... This is opaque ciphertext to the model provider, who cannot obtain the plaintext seed from it. Therefore, it cannot predict the specific insertion location of the probe sample on its own, thus ensuring the impartiality of the verification mechanism.

[0073] Throughout the entire process of data segmentation, encryption, and commitment generation, the data provider locally retains the original data segments. Random blinding factor Private key and plaintext seeds These sensitive materials will not be transmitted to any external parties. Only the encrypted collection will be transmitted externally. Set of commitment values and ciphertext field pseudo-random seed None of these three methods contain any information that can be directly used to reconstruct plaintext medical data, thus ensuring strict protection of patient privacy during the data distribution phase. A reasonable design of the chunking strategy also needs to balance efficiency and security: overly coarse chunking granularity can lead to the disclosure of too much data in a single commitment, while overly fine chunking granularity can increase the size of the commitment value set and communication overhead. In actual deployment, parameters can be adjusted according to the data scale and privacy requirements of the specific medical scenario.

[0074] The model provider initiates a challenge request specifying the target data block index. The data provider performs a commitment to open the target data block, generating a partial open proof. The model provider verifies the partial open proof based on the corresponding commitment value, confirming the commitment binding relationship and the consistency of medical constraint rules, and obtains the data compliance verification result, including:

[0075] The model provider generates a challenge request containing at least one target data block index and sends it to the data provider;

[0076] The data provider locates the corresponding target data block according to the target data block index, performs a commitment open operation on the target data block, and the commitment open operation only opens the commitment value corresponding to the target data block based on the separable open attribute of the homomorphic commitment scheme. It generates a partial open proof and statistical feature plaintext and sends it to the model provider. The partial open proof is used to prove the binding relationship between the statistical feature plaintext and the corresponding commitment value.

[0077] The model provider verifies the partial open proof based on the commitment value corresponding to the target data block index in the commitment value set. The partial open proof confirms the cryptographic binding relationship between the statistical feature plaintext and the corresponding commitment value. After the verification is successful, the medical statistical features in the statistical feature plaintext are checked for consistency with the preset medical constraint rules. The medical constraint rules define the reasonable value range and distribution characteristics of medical data. The data compliance verification result is generated based on the verification result.

[0078] When initiating a challenge request, the model provider needs to explicitly specify the target set of data chunk indexes to be verified. Specifically, the model provider selects from the set of committed values. The index range covered At least one index is selected from the dataset to construct a challenge request message. The challenge request includes a list of the selected target data chunk indexes, as well as the model provider's identity and request timestamp to prevent replay attacks. This challenge request is sent to the data provider via a secure channel to ensure that the challenge content is not tampered with or leaked during transmission. In real-world medical data collaboration scenarios, model providers may request verification of specific disease-specific test indicator data chunks or image feature data chunks; therefore, the selection of challenge indexes is usually targeted and related to the data dependencies of subsequent diagnostic tasks.

[0079] After receiving the challenge request, the data provider locates the corresponding data block in its local storage based on the target data block index carried within the request. Let the index of the target data block be... Then the data provider retrieves the first... Plaintext content of each data block The corresponding random blinding factor and commitment value Based on the separable open property of the homomorphic commitment scheme, the commitment open operation is only performed on the index. The execution of a single commitment value does not involve the plaintext or random factors of other data blocks, thus ensuring that the content of unchallenged data blocks is not exposed during the process. The core of the separable open attribute is that the entire commitment structure allows for independent open operations on each block. The commitment values ​​of each block are decoupled from each other during generation, and opening one block will not affect the privacy protection of other blocks.

[0080] After the promised open operation is completed, the data provider will retrieve the plaintext content from the target data blocks. The statistical features are extracted from the plaintext data. These plaintext features are not complete copies of the original plaintext data, but rather several medical statistics calculated from it, such as descriptive statistical features like mean, variance, maximum, minimum, and quantiles, as well as histogram information of the data distribution. The method for extracting these statistical features is agreed upon by both parties during the protocol initialization phase, ensuring that the data provider and model provider maintain consistency in their definitions and calculation methods for the statistical features. The data provider sends the partial open proof along with the plaintext features to the model provider. The partial open proof contains the plaintext content. Random blinding factor and commitment value This allows model providers to independently verify the cryptographic binding relationship between the plaintext of statistical features and the commitment value without obtaining information from other data blocks.

[0081] After receiving the partial open proof and the plaintext of statistical features, the model provider first starts from the set of commitment values. Retrieving the index Corresponding commitment value Based on the verification algorithm of the homomorphic commitment scheme, the plaintext content provided in the partial open proof is... With random blinding factor Substitute the commitment values ​​into the calculation and recalculate to obtain the verified commitment value. .like If the cryptographic binding is valid, the cryptographic binding relationship is verified, proving that the plaintext with statistical characteristics provided by the data provider does indeed originate from the original data chunks, rather than temporarily forged data. If the verification fails, the data compliance verification result is directly determined to be unsuccessful, subsequent processes are terminated, and an anomaly flag is output. The verification of the cryptographic binding relationship relies on the binding property of the homomorphic commitment scheme. That is, under the assumption of computational difficulty, any malicious data provider cannot find two different sets of plaintext and random factors that make the commitment value the same, thus ensuring the reliability of the verification result.

[0082] After the cryptographic binding relationship is verified, the process enters the medical constraint rule consistency verification stage. The pre-defined medical constraint rules define the reasonable range of values ​​and distribution characteristics of medical data across various dimensions. Value range constraints include absolute boundary constraints, such as the physically feasible range of blood glucose concentration and the physiological limit range of heart rate, as well as relative reasonableness constraints, such as the variation range of indicators for the same patient at different time points should not exceed a specific threshold. Distribution characteristic constraints focus on whether the data distribution pattern reflected in the statistical characteristics plaintext conforms to prior medical knowledge; for example, the distribution of a certain type of test indicator in a specific population should approximately follow a normal distribution, or its skewness and kurtosis should fall within a reasonable range.

[0083] The specific consistency verification process is as follows: For value range constraints, the mean, maximum, minimum, etc., in the statistical feature plaintext are compared with the corresponding boundary parameters in the preset medical constraint rules to determine whether each statistic falls within a reasonable range. Let the medical constraint rule be the statistic. Must meet ,in and These are the preset lower and upper bounds. If the corresponding statistic in the plaintext of the statistical feature exceeds this range, the constraint for that dimension is deemed unacceptable. For distribution characteristic constraints, higher-order statistics such as variance, skewness, and kurtosis in the plaintext of the statistical feature are compared with the preset distribution reference interval. If the deviation exceeds the tolerance threshold... If any constraint fails, the distribution characteristic constraint is deemed unqualified. The verification results of all constraint dimensions are logically ANDed; that is, the data compliance verification result is deemed qualified only when all constraints pass; if any constraint fails, the data compliance verification result is deemed unqualified.

[0084] In practical deployments, medical constraint rules are typically formulated by domain experts in conjunction with clinical data quality standards and are embedded into the protocol parameters in the form of hash digests during the protocol initialization phase to prevent unilateral tampering with the rule content. When performing consistency checks, the rule version used by the model provider must be consistent with the rule version used by the data provider when generating the statistical feature plaintext. Both parties ensure rule consistency by verifying the rule digests. If the rule digests do not match, it is considered an anomaly in the protocol parameters, triggering an anomaly flag output.

[0085] When the data compliance verification result is passed, it means that there is a verifiable cryptographic binding relationship between the plaintext statistical characteristics of the target data block and the committed value, and the plaintext statistical characteristics meet the preset medical constraint rules, confirming the integrity and medical rationality of the data. This verification result, together with the subsequent model trustworthiness verification result, will serve as the basis for determining whether to return encrypted output, ensuring that the entire medical data collaboration process meets security and compliance requirements in both data quality and model behavior dimensions, effectively preventing malicious data providers from injecting abnormal data or model providers from exploiting verification vulnerabilities to bypass data quality checks.

[0086] The model provider constructs an encrypted diagnostic model and embeds probe sample insertion logic within the model's computation process. This logic involves performing a homomorphic hash operation on a pseudo-random seed in the ciphertext field to generate a ciphertext-form insertion position index. The encrypted diagnostic model is then submitted to the computation executor, including:

[0087] The model provider constructs an encrypted diagnostic model that includes model parameters and computational procedures;

[0088] The model provider constructs probe sample insertion logic, which defines the calculation steps of performing homomorphic hashing on the pseudo-random seed in the ciphertext field. The homomorphic hashing operation transforms the pseudo-random seed in the ciphertext field into a ciphertext form insertion position index through a homomorphic mapping function.

[0089] The model provider encodes the probe sample insertion logic into a homomorphic computing circuit. The homomorphic computing circuit receives the ciphertext-form insertion position index and the set of encrypted data blocks. It achieves blind positioning through the ciphertext domain condition selection operation. The ciphertext domain condition selection operation performs a ciphertext comparison operation on each encrypted data block to calculate its matching degree with the ciphertext-form insertion position index. Based on the ciphertext comparison result, the probe sample is injected at the matching position.

[0090] The model provider constructs probe samples with pre-set labels and homomorphically encrypts them to obtain encrypted probe samples. The encrypted probe samples are embedded in the homomorphic computing circuit as injection data for conditional selection operations, and the pre-set labels are stored locally.

[0091] The model provider submits the cryptographic diagnostic model, which includes homomorphic computing circuits and cryptographic probe samples, to the computing executor.

[0092] Combination Figure 2 The flowchart illustrating the logic construction and submission of the probe sample insertion by the model provider is provided as an example. When constructing the encrypted diagnostic model, the model provider first initializes all parameters of the diagnostic model (including the weight matrix, bias vector, and polynomial approximation coefficients of the activation function) in plaintext form. Then, it encrypts each parameter one by one using a homomorphic encryption public key, forming a set of ciphertext parameters. The computation process is described as a sequence of homomorphic operation instructions, with each instruction corresponding to an addition or multiplication operation in the ciphertext field. This allows the entire diagnostic inference process to be executed completely in ciphertext, preventing external computation executors from obtaining any plaintext information during execution.

[0093] The core of the probe sample insertion logic lies in injecting a sample at a specified position without revealing the insertion location. To achieve this, a pseudo-random seed is introduced into the ciphertext field. Homomorphic hashing. Let the homomorphic mapping function be... Then the ciphertext insertion position index Determined by the following formula: ;in This is a homomorphic mapping function that maps a pseudo-random seed in the ciphertext field to the ciphertext at the insertion position index. Its output remains in ciphertext form, and the computation executor cannot directly read the corresponding plaintext index value. This mapping function must satisfy unidirectionality and uniform distribution during construction to ensure that the insertion position is statistically unpredictable. The model provider retains this information locally. (Plaintext random seed), through the Applying the same hash map allows for the independent computation of the plaintext value at the insertion position, which can then be used for subsequent verification.

[0094] The probe sample insertion logic is further encoded into a homomorphic computation circuit. This circuit receives two types of inputs: one is the ciphertext-form insertion position index. Second, encrypted data block sets. Circuit pairs Each encrypted data block ( Perform ciphertext comparison operation and calculate The corresponding positional ciphertext and The degree of matching between them. Let the position-encoded ciphertext be... (indicating the first) The homomorphic encrypted value of the position index of each block), then the matching degree ciphertext The following is obtained through logical calculation using ciphertext subtraction and ciphertext zero value judgment: ;in This represents the ciphertext field equality judgment function, which outputs a Boolean value in ciphertext form (encryption of 0 or 1), if and only if and When the corresponding plaintexts are equal, The corresponding plaintext value is 1, otherwise it is 0. Since all operations are performed in the ciphertext field, the compute executor cannot determine which block is selected during the execution process.

[0095] After determining the matching degree ciphertext, the homomorphic computation circuit achieves blind localization through ciphertext domain conditional selection operations. Let the encrypted probe sample be... The original encrypted data is divided into blocks. The ciphertext output after injection Given by the following linear combination of ciphertext: The multiplication and addition operations in this formula are homomorphic ciphertext field operations. When the corresponding plaintext is 1, Equivalent to That is, the probe sample is injected at this location; when When the corresponding plaintext is 0, The original encrypted data blocks remain unchanged. The entire selection process is completely opaque to the computation executor, revealing neither the insertion position nor the plaintext content of the probe sample.

[0096] The probe samples themselves are constructed locally by the model provider. The plaintext content of the probe samples is designed as special medical data vectors with deterministic diagnostic conclusions, and their corresponding pre-defined labels. The model is stored locally by the provider and not disclosed to any external party. After construction, the plaintext of the probe sample is encrypted using a homomorphic encryption public key to obtain the encrypted probe sample. . Embedded in a homomorphic computation circuit, it participates in subsequent calculations as injected data for the ciphertext field conditional selection operation. Because Since it is already in encrypted form, the computing executor cannot extract any valid plaintext information from it.

[0097] The construction of homomorphic computing circuits must also consider the impact of circuit depth on noise accumulation. In implementations based on layered homomorphic encryption schemes such as BGV or CKKS, each homomorphic multiplication operation increases ciphertext noise, leading to decryption failure when the noise exceeds the decryption threshold. Therefore, in the circuit design of the probe sample insertion logic, ciphertext comparison and conditional selection operations should be placed in shallow layers of the circuit to ensure that the multiplication depth budget consumed by the insertion logic is within a controllable range before executing the homomorphic operations of the complete diagnostic model. If necessary, bootstrapping operations can be introduced to refresh the ciphertext noise, supporting deeper computational flows.

[0098] When submitting a complete cryptographic diagnostic model containing homomorphic computation circuitry and cryptographic probe samples to the computation executor, the submission should include: a set of ciphertext parameters, a sequence of homomorphic operation instructions, a circuit description corresponding to the probe sample insertion logic, and the cryptographic probe samples. and the ciphertext insertion position index The computation executor divides the encrypted data into blocks based on the above information. The complete homomorphic inference operation is performed, and during the operation, a probe sample injection is automatically triggered by the circuit, ultimately yielding an encrypted output containing the inference result of the probe sample. Upon receiving the encrypted output, the model provider uses its private key... Decrypt the inference results corresponding to the location of the probe sample and compare them with the pre-set tags stored locally. The two are compared. If they match, it is determined that the computation executor has faithfully executed the encryption diagnostic model, and the model's credibility verification is passed. If they do not match, an anomaly flag is triggered, and the subsequent process is terminated.

[0099] The model provider constructs probe sample insertion logic, which defines the computation steps of performing a homomorphic hash operation on the ciphertext pseudo-random seed. The homomorphic hash operation transforms the ciphertext pseudo-random seed into a ciphertext insertion position index through a homomorphic mapping function, including:

[0100] The model provider defines a homomorphic mapping function, which includes a combination of homomorphic modular operations and homomorphic linear transformations;

[0101] The model provider defines a calculation step in the probe sample insertion logic to perform homomorphic hashing on the pseudo-random seed of the ciphertext field. The homomorphic hashing operation performs homomorphic square operation on the pseudo-random seed of the ciphertext field to obtain the ciphertext square value, and performs homomorphic modulo operation on the ciphertext square value to map it to a preset ciphertext range to obtain the ciphertext hash intermediate value.

[0102] A homomorphic linear transformation is performed on the ciphertext hash intermediate value. The homomorphic linear transformation performs a homomorphic modulo operation on the ciphertext hash intermediate value and the number of blocks in the encrypted data block set to obtain the ciphertext form insertion position index located in the encrypted data block index space. The ciphertext form insertion position index encodes the injection position of the probe sample in the ciphertext field.

[0103] The model provider embeds a collision avoidance mechanism in the probe sample insertion logic. The collision avoidance mechanism defines that when the generated ciphertext insertion position index conflicts with an existing position index, a homomorphic increment operation is performed on the pseudo-random seed of the ciphertext field and a homomorphic hash operation is re-executed until a non-conflicting ciphertext insertion position index is generated.

[0104] In constructing the probe sample insertion logic, the model provider needs to define a complete position index generation mechanism within the ciphertext domain, enabling the injection position of the probe sample to be deterministically calculated without exposing any plaintext information. The core of this mechanism lies in the design of the homomorphic mapping function, which uses a pseudo-random seed in the ciphertext domain. Transform into ciphertext form and insert position index The entire process requires no decryption, ensuring that the computing executor cannot deduce the true injection location of the probe sample from the computation process.

[0105] Homomorphic mapping function The structure employs a combination of homomorphic modular arithmetic and homomorphic linear transformation. Homomorphic modular arithmetic performs a modulo operation on the numerical value represented by the ciphertext within the ciphertext domain, and the result remains in ciphertext form. The computational party can only see the ciphertext and cannot know the specific input or output values ​​of the modular arithmetic. Homomorphic linear transformation performs a combination of linear coefficient multiplication and constant addition on the ciphertext within the ciphertext domain, ensuring that the transformed ciphertext falls within a predetermined index space. This combination guarantees... It has good uniformity, that is, for different Input, generated Within the ciphertext domain, it can be relatively evenly distributed in the index space of the encrypted data block set, avoiding the injection of probe samples into a fixed area, which would lead to statistical distinguishability.

[0106] The specific computation steps of homomorphic hashing are divided into two stages. The first stage involves processing the ciphertext field as a pseudo-random seed. Performing a homomorphic square operation yields the ciphertext square value, denoted as . Homomorphic square operation utilizes the multiplicative homomorphic property supported by homomorphic encryption schemes to... Multiplying by itself in secret text, the result is The corresponding plaintext random seed after decryption The square value of the expression is not known to the executor at the encrypted level, but this numerical relationship is not perceptible at the encrypted level. Perform homomorphic modular arithmetic to map it to a preset ciphertext range. Inside (of which) (Using the preset modulus parameter), the intermediate value of the ciphertext hash is obtained, denoted as . This step aims to compress the numerical range represented by the ciphertext, preventing subsequent linear transformations from introducing noise accumulation due to excessively large values. It also further increases the efficiency of the transformation. arrive The non-linearity of the mapping improves the pseudo-randomness of the hash function.

[0107] The second stage involves the intermediate value of the ciphertext hash. Perform a homomorphic linear transformation to The number of blocks in the encrypted data block set Perform homomorphic modular arithmetic to obtain the ciphertext insertion position index. Specifically, this homomorphic modulo operation is computed within the ciphertext domain. The encrypted representation makes The decrypted plaintext value must fall within Within the index space, the block index range of the encrypted data block set. Complete correspondence (alignment is achieved by adding an offset). This design ensures the legitimacy of the probe sample injection location, i.e., any generated location... Each corresponds to a real data block location, preventing out-of-bounds access. Since the entire process is completed within the ciphertext domain, the computation executor can only observe the ciphertext form. It is impossible to determine which specific location the probe sample will be injected into, thus effectively preventing the computational executor from taking targeted evasion measures against the probe sample.

[0108] Collision avoidance mechanisms are an indispensable component of probe sample insertion logic, especially when multiple probe samples need to be injected, as conflicts may occur between the insertion position indices of different probe samples. Collision avoidance mechanisms define an iterative update strategy within the ciphertext domain: when the generated ciphertext form is inserted at the insertion position index... When a conflict occurs between the ciphertext field and an element in an existing set of position indices under ciphertext field equivalence judgment, the pseudo-random seed for the ciphertext field is adjusted. Perform homomorphic increment operation, and Updated to (in (The encrypted ciphertext is set to a constant 1). Then, the homomorphic hashing process described above is re-executed to generate a new ciphertext insertion position index, until no further collisions occur. Ciphertext field equality is determined using the ciphertext field equality judgment function. The function performs an equality check on the ciphertext fields of two ciphertext inputs and outputs a ciphertext Boolean value. If the corresponding plaintexts are equal, the function outputs ciphertext 1; otherwise, it outputs ciphertext 0. No decryption is required throughout the process.

[0109] In practical deployments, the implementation of homomorphic increment operations relies on the homomorphic encryption scheme's support for the homomorphic property of addition. It is a public constant ciphertext, which any participant can access without holding the private key. Calculate under the following circumstances This ensures that the collision avoidance mechanism's iterative update process can proceed entirely autonomously within the encrypted domain, without real-time intervention from the data provider or model provider. The upper limit of the collision avoidance mechanism's iteration count can be determined based on the number of blocks. The ratio of the number of samples to the number of probes is estimated in advance, when the number of probes is much smaller than the number of probes. When the collision probability is low, the number of iterations usually converges within a constant number of rounds, without introducing significant computational overhead.

[0110] The entire probe sample insertion logic is fully embedded in the computation flow of the encrypted diagnostic model, and submitted to the computation executor along with the model in the form of ciphertext instructions. When the computation executor performs homomorphic operations on the encrypted diagnostic model, it automatically triggers probe sample injection according to the computation steps defined in the insertion logic, generating encrypted output containing the probe sample results. Because... It always exists in encrypted form, so the computation executor cannot predict the injection location of the probe sample before execution, nor can it locate the position of the probe sample result by analyzing the output structure after execution. This ensures that the probe mechanism is imperceptible to the computation executor and provides a reliable technical foundation for subsequent model credibility verification.

[0111] Injected probe samples, including:

[0112] The model provider inserts the probe samples into a homomorphic computation circuit, which includes a ciphertext comparison sub-circuit and a conditional selection sub-circuit.

[0113] The ciphertext comparison sub-circuit performs homomorphic encryption on the index value of each encrypted data block in the encrypted data block set to obtain an encrypted index value, performs homomorphic subtraction on the encrypted index value and the ciphertext insertion position index to obtain a ciphertext difference, performs homomorphic square operation on the ciphertext difference and generates a ciphertext matching identifier through the homomorphic threshold judgment circuit, and the ciphertext matching identifier encodes the matching relationship between the encrypted data block and the insertion position in the ciphertext field;

[0114] The condition selection sub-circuit receives the ciphertext matching identifier corresponding to each encrypted data block, performs ciphertext multiplication on each encrypted data block, multiplies the encrypted data block with its corresponding ciphertext matching identifier to obtain the selection result, multiplies the encrypted probe sample with the ciphertext matching identifier to obtain the injected data, performs homomorphic addition on the selection result and the injected data to achieve conditional substitution, and completes the injection of the probe sample at the matching position.

[0115] The probe sample injection process needs to be completed within the fully ciphertext domain, meaning that the encrypted probe sample must be precisely embedded into the target position specified by the ciphertext insertion position index without decrypting any intermediate data. To achieve this, the probe sample insertion logic is encoded as a structured homomorphic computation circuit, which consists of two functionally defined sub-circuits: a ciphertext comparison sub-circuit responsible for locating the target insertion position within the ciphertext domain, and a conditional selection sub-circuit responsible for performing conditional substitution injection of the probe sample based on the location result.

[0116] The core task of the ciphertext comparison subcircuit is to determine, for each encrypted data block in the set of encrypted data blocks, whether its position index matches the insertion position index in the ciphertext form. If the data matches, the result is output as a ciphertext matching identifier. Specifically, for a set of encrypted data blocks... The Middle Each encrypted data block ( ), its position index Since it is a plaintext integer, it needs to be encrypted first using the public key of a homomorphic encryption scheme. Encryption is performed to obtain the encrypted index value. This ensures that all subsequent operations are performed within the ciphertext field.

[0117] Obtain the encrypted index value Then, insert the position index into the ciphertext format. Perform homomorphic subtraction to obtain the ciphertext difference. ,Right now ,in This represents a homomorphic subtraction operation. When the... When the block is exactly the target insertion position. The corresponding plaintext decryption value is zero; for all other non-target locations, The corresponding plaintext decryption value is a non-zero integer. To convert this numerical relationship into a Boolean matching identifier within the ciphertext field, [the following steps are taken]. Perform a homomorphic square operation to obtain the ciphertext square value. Non-zero differences remain positive after squaring, while zero differences remain zero after squaring, thus further amplifying the difference between matching and non-matching in terms of numerical characteristics.

[0118] Homomorphic threshold determination circuit receives ciphertext square value By applying a preset threshold mapping logic, the ciphertext square value is converted into a ciphertext matching identifier. :when When the corresponding plaintext value is zero, Encode the logical value "1" (indicating a match) within the ciphertext field; when When the corresponding plaintext value is positive, The logical value "0" (representing a mismatch) is encoded within the ciphertext domain. The implementation of this threshold judgment circuit relies on the homomorphic encryption scheme's support for polynomial operations. Typically, a Boolean mapping within the ciphertext domain is achieved by applying a polynomial approximation function to the squared value of the ciphertext, where the value is 1 at zero and approaches 0 at non-zero points. Throughout the entire operation of the ciphertext comparison sub-circuit, the computation executor cannot obtain any plaintext information regarding the actual insertion position or data content, ensuring the privacy and security of the probe sample injection logic. (See the context: Is the "preset threshold mapping logic" sufficiently disclosed?)

[0119] The conditional selection sub-circuit receives the ciphertext comparison sub-circuit, which outputs a ciphertext matching identifier for each encrypted data block. This serves as a control signal to conditionally select and replace encrypted data blocks and encrypted probe samples within the ciphertext domain. For the first... One encrypted data block Perform ciphertext multiplication, and Its corresponding ciphertext matching identifier Multiply to get the selection result. ,in This represents the encrypted ciphertext containing the plaintext value "1". This represents the homomorphic multiplication operation. The meaning of this operation is: when... When it is a non-target location, Encoding the logical value "0", Encoding a logical value of "1" selects the result that retains the original encrypted data block. ;when When the target location is, Encoding the logical value "1", The encoded logical value is "0", and the selection result is cleared to zero in the ciphertext field.

[0120] At the same time, encrypted detection samples will be used. Cipher matching identifier with target location Perform homomorphic multiplication to obtain the injected data. For non-target locations, The encoded logical value is "0", meaning the injected data is zero in the ciphertext field; for the target location, The encoded logical value is "1", and the injected data is equal to the encrypted probe sample itself.

[0121] Ultimately, regarding the selection results With injected data After performing homomorphic addition to obtain the injected probe sample, the first... Ciphertext output at each position ,Right now ,in This represents a homomorphic addition operation. For non-target positions, Equal to the original encrypted data blocks Regarding the target location, Equivalent to encrypted probe sample This enables precise replacement of target location data within the ciphertext field.

[0122] The key advantage of the aforementioned conditional substitution logic lies in its complete reliance on a linear combination of homomorphic multiplication and homomorphic addition. It does not depend on any conditional branch jumps or plaintext judgments, thus ensuring that the entire insertion process is transparent to the computation executor and does not reveal any structural information. The computation executor can only observe a set of ciphertext output sequences and cannot distinguish which position the probe sample was substituted, nor can it infer the plaintext content or pre-set tags of the probe sample. The value of .

[0123] In actual deployment, when constructing the homomorphic computation circuit, the model provider packages the computational logic of the ciphertext comparison subcircuit and the conditional selection subcircuit into a complete circuit description file and submits it to the computation executor for execution. The computation executor then segments the encrypted data into blocks according to the circuit description. Each block in the sequence undergoes the aforementioned ciphertext comparison and conditional selection operations in turn, ultimately outputting an encrypted output sequence containing the probe sample injection result. Upon receiving the encrypted output, the data provider uses their private key... Decrypt the ciphertext output at the corresponding location of the probe sample, and compare the decryption result with the preset tag. If the two are consistent, it means that the calculation executor has completed the calculation according to the predetermined model logic, and the model credibility verification is passed; if there is a deviation, it is determined that the calculation executor has tampered or replaced the data, triggering the output of the abnormality flag and terminating the subsequent calculation process.

[0124] This method of inserting probe samples into the logic encoding as homomorphic computing circuits enables the probe process to be deeply integrated with the normal diagnostic model calculation. The calculation executor cannot bypass the injection and processing of probe samples without affecting the overall calculation results, thus effectively ensuring the verifiability of the integrity of the model execution.

[0125] The computation executor performs homomorphic operations on the encrypted diagnostic model in blocks of encrypted data, triggers probe sample injection based on the ciphertext insertion position index, and obtains encrypted output. The data provider decrypts the probe sample results and compares them with preset labels to obtain the model credibility verification results, including:

[0126] The computation executor performs homomorphic operations on the encrypted diagnostic model for the encrypted data blocks. During the homomorphic operation, the operation is selected based on the ciphertext field conditions in the homomorphic computation circuit. Based on the ciphertext form insertion position index and the ciphertext comparison result of each encrypted data block, the probe sample injection is triggered. The encrypted probe sample is fused into the homomorphic operation process at the corresponding position to obtain an encrypted output containing both normal diagnostic results and probe sample diagnostic results.

[0127] The computation executor organizes the encrypted output in a structured manner, inserts a location index based on the ciphertext to generate location marker information for the diagnostic results of the probe sample, and sends the encrypted output and location marker information to the data provider.

[0128] The data provider performs decryption and verification operations on the location marker information based on the pseudo-random seed in the ciphertext field to recover the probe sample location index. Based on the location index, the encrypted diagnostic results corresponding to the probe sample are extracted from the encrypted output and decrypted to obtain the probe sample results. The probe sample results are compared with the preset labels stored locally to calculate the consistency metric and generate the model credibility verification results.

[0129] The computation executor receives the encrypted diagnostic model submitted by the model provider and the encrypted data block set uploaded by the data provider. Subsequently, homomorphic operations are performed sequentially on each encrypted data block according to the homomorphic computation circuit. The homomorphic computation circuit incorporates probe insertion logic during its design phase, ensuring the entire computation process is self-consistent within the ciphertext domain, preventing the computation executor from obtaining any plaintext information. When the homomorphic operation reaches the processing node of each data block, the ciphertext domain conditional selection sub-circuit within the circuit is activated, inserting the position index in ciphertext form. The encrypted index value of the current data block is compared with the encrypted index value. The comparison result is output as a ciphertext boolean value, which drives the subsequent conditional branching logic.

[0130] The core of the ciphertext field condition selection operation lies in utilizing the ciphertext difference. Encrypted text of the selection result Complete the precise positioning and injection of the probe sample. When the first Encrypted index of each data block and Equivalence judgment function in the ciphertext field When the output matching signal is generated under the action of the conditional selection sub-circuit, the data ciphertext will be injected. Switch to encrypted probe sample The injected ciphertext output is obtained by fusing the original homomorphic operation result at that position with the ciphertext field linear combination. For positions that do not meet the matching criteria, Keep the value zero. The corresponding contribution item was passed by the logical complement operation. The original diagnostic calculation result is transmitted to the output without interference. The entire injection process is implemented in the form of a uniform arithmetic circuit within the ciphertext domain. The computation executor cannot distinguish which position the probe sample injection occurred at, thus ensuring the concealment and anti-evasion capability of the detection mechanism.

[0131] After all homomorphic operations are completed, the computation executor organizes the encrypted output into a structured format. The encrypted output contains two types of results: normal diagnostic results and probe sample diagnostic results, which are stored together at the ciphertext level and are indistinguishable from external sources. To enable the data provider to accurately locate the probe sample diagnostic results in the subsequent verification stage, the computation executor inserts a location index based on the ciphertext format. The location marker information for generating diagnostic results from the probe sample is generated. This location marker information is encapsulated in encrypted form and contains... The structure itself and its corresponding structural offset in the encrypted output sequence ensure that the data provider can uniquely determine the position of the probe sample result in the output sequence after decryption. The computation executor packages the complete encrypted output and position marker information and sends it to the data provider. The computation executor's task ends here, and it does not hold any plaintext information throughout the entire process.

[0132] After receiving the encrypted output and location tag information, the data provider first uses a locally stored plaintext random seed. Perform decryption and verification operations on the location marker information. Because... Yes Generated via a homomorphic hash operation chain, the data provider obtains the expected plaintext value of the insertion position index by re-executing the same hash calculation chain locally. This value is then compared with the result obtained from decrypting the position marker information. Only after confirming their consistency can the authenticity of the position marker information be trusted. This verification step prevents the computation executor from forging position marker information to obfuscate the attack path during the extraction of detection results.

[0133] After the location index is recovered, the data provider uses this index to accurately extract the encrypted diagnostic results corresponding to the probe samples from the encrypted output sequence, and then uses the private key of the homomorphic encryption scheme. Decryption is performed to obtain the plaintext diagnostic result of the probe sample, i.e., the probe sample result. This result is then compared with a pre-set tag stored locally by the data provider. Perform field-by-field comparison. Preset tags. In encrypted detection samples The generation phase is determined through negotiation between the model provider and the data provider and stored locally respectively. It represents the standard diagnostic output that the probe sample should produce when the correct model is executed. During the comparison process, an exact matching strategy is used for categorical diagnostic conclusions, and a tolerance error range is introduced for numerical diagnostic indicators. A consistency metric is then calculated comprehensively. .when Exceeding the preset trust threshold If the model passes the credibility verification, it is considered to have passed; otherwise, the verification is considered to have failed.

[0134] Consistency metrics The calculation comprehensively considers the results of the detection samples and the pre-set tags. The degree of matching across various diagnostic dimensions. For scenarios involving multiple probe samples, The weighted average of the consistency scores of each probe sample is calculated. The weights are determined by the sensitivity of each probe sample in the medical diagnostic task; diagnostic dimensions with higher sensitivity are given greater weight to ensure focused coverage of key diagnostic pathways. If the alignment result of any high-weight probe sample shows a significant deviation, even if the overall... Even if the value barely reaches the threshold, a single-item veto mechanism will be triggered, directly setting the model credibility verification result to a failure state.

[0135] In the joint determination phase of data compliance verification and model credibility verification results, both verification results must pass independently before entering the normal output process. The data compliance verification result comes from the model provider's verification of the partial open proof, confirming the binding relationship between the encrypted data blocks and the committed value, as well as the consistency of medical constraint rules. The model credibility verification result comes from the data provider's comparison of the diagnostic results of the probe samples, confirming that the computation executor faithfully executed the encrypted diagnostic model without tampering or replacement. The two verifications form a two-way check and balance structure, with the data provider and model provider each holding one verification right. Any anomaly in the data or model of either party will trigger the termination mechanism. When the joint determination passes, the encrypted output is officially returned to the authorized recipient for subsequent decryption and diagnostic analysis. When either verification fails, the computation process is immediately terminated, and an anomaly identifier is broadcast to all participants. The anomaly identifier carries a failure type code, making it easier for participants to distinguish whether the anomaly is on the data side or the model side, providing a basis for subsequent auditing and accountability.

[0136] The entire verification process strictly restricts information exchange between the ciphertext and plaintext domains. The computation executor operates in a zero-knowledge state throughout, while the data provider can only obtain the diagnostic results of the probe sample and cannot access the model structure information. The model provider can only obtain the data compliance verification conclusion and cannot access the original plaintext medical data. This layered and isolated verification architecture, while protecting medical data privacy, provides complete security and verifiability guarantees for trusted computing scenarios involving multi-party collaboration.

[0137] A second aspect of the present invention provides a medical data homomorphic encryption and privacy protection system, comprising:

[0138] The block commitment unit is used by the data provider to divide the medical data set into multiple data blocks and homomorphically encrypt them. Based on the homomorphic commitment scheme, a commitment value with separable open attribute is generated for each data block.

[0139] The compliance verification unit is used by the model provider to initiate a challenge request to specify the target data block index. The data provider performs a commitment to open the target data block and generates a partial open proof. The model provider verifies the partial open proof based on the corresponding commitment value, confirms the commitment binding relationship and the consistency of medical constraint rules, and obtains the data compliance verification result.

[0140] The model construction unit is used by the model provider to construct the encrypted diagnostic model. It embeds the probe sample insertion logic in the encrypted diagnostic model calculation process to perform homomorphic hash operation on the pseudo-random seed of the ciphertext field to generate the ciphertext form insertion position index, and submits the encrypted diagnostic model to the calculation execution party.

[0141] The execution verification unit is used to calculate the homomorphic operation of the encryption diagnostic model performed by the executor on the encrypted data blocks, and to trigger the injection of probe samples according to the ciphertext form insertion position index to obtain the encrypted output. The data provider decrypts the probe sample results and compares them with the preset labels to obtain the model credibility verification results.

[0142] The result determination unit is used to return encrypted output when both the data compliance verification result and the model credibility verification result pass; otherwise, it terminates the calculation and outputs an anomaly flag.

[0143] A third aspect of the present invention provides an electronic device, comprising:

[0144] processor;

[0145] Memory used to store processor-executable instructions;

[0146] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0147] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0148] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for homomorphic encryption and privacy protection of medical data, characterized in that, include: The data provider divides the medical data set into multiple data blocks and homomorphically encrypts them. Based on the homomorphic commitment scheme, a commitment value with separable open attributes is generated for each data block. The model provider initiates a challenge request specifying the target data block index. The data provider performs a commitment to open the target data block and generates a partial open proof. The model provider verifies the partial open proof based on the corresponding commitment value, confirms the consistency of the commitment binding relationship and medical constraint rules, and obtains the data compliance verification result. The model provider constructs an encrypted diagnostic model and embeds probe sample insertion logic in the encrypted diagnostic model calculation process to perform homomorphic hash operation on the pseudo-random seed of the ciphertext field to generate the ciphertext insertion position index, and submits the encrypted diagnostic model to the calculation execution party. The computing executor performs homomorphic operations on the encrypted diagnostic model in blocks of encrypted data, and triggers probe sample injection based on the ciphertext insertion position index to obtain encrypted output. The data provider decrypts the probe sample results and compares them with preset labels to obtain the model credibility verification results. When both the data compliance verification result and the model credibility verification result pass, an encrypted output is returned; otherwise, the calculation is terminated and an anomaly flag is output.

2. The method according to claim 1, characterized in that, The data provider divides the medical dataset into multiple data blocks and homomorphically encrypts them. Based on a homomorphic commitment scheme, it generates a commitment value for each data block with separable open attributes, including: The data provider divides the medical data set into multiple data blocks according to a preset block division strategy. For each data block, a homomorphic encryption scheme is applied to generate a corresponding encrypted data block. For each data block, a homomorphic commitment scheme is applied to generate a commitment value with separable and openable attributes. A cryptographic binding relationship is established between the commitment value and the corresponding data block. The data provider generates a pseudo-random seed for the ciphertext field, which satisfies the pseudo-random property within the ciphertext field of the homomorphic encryption scheme.

3. The method according to claim 2, characterized in that, The model provider initiates a challenge request specifying the target data block index. The data provider performs a commitment to open the target data block, generating a partial open proof. The model provider verifies the partial open proof based on the corresponding commitment value, confirming the commitment binding relationship and the consistency of medical constraint rules, and obtains the data compliance verification result, including: The model provider generates a challenge request containing at least one target data block index and sends it to the data provider; The data provider locates the corresponding target data block according to the target data block index, performs a commitment open operation on the target data block, and the commitment open operation only opens the commitment value corresponding to the target data block based on the separable open attribute of the homomorphic commitment scheme. It generates a partial open proof and statistical feature plaintext and sends it to the model provider. The partial open proof is used to prove the binding relationship between the statistical feature plaintext and the corresponding commitment value. The model provider verifies the partial open proof based on the commitment value corresponding to the target data block index in the commitment value set. The partial open proof confirms the cryptographic binding relationship between the statistical feature plaintext and the corresponding commitment value. After the verification is successful, the medical statistical features in the statistical feature plaintext are checked for consistency with the preset medical constraint rules. The medical constraint rules define the reasonable value range and distribution characteristics of medical data. The data compliance verification result is generated based on the verification result.

4. The method according to claim 1, characterized in that, The model provider constructs an encrypted diagnostic model and embeds probe sample insertion logic within the model's computation process. This logic involves performing a homomorphic hash operation on a pseudo-random seed in the ciphertext field to generate a ciphertext-form insertion position index. The encrypted diagnostic model is then submitted to the computation executor, including: The model provider constructs an encrypted diagnostic model that includes model parameters and computational procedures; The model provider constructs probe sample insertion logic, which defines the calculation steps of performing homomorphic hashing on the pseudo-random seed in the ciphertext field. The homomorphic hashing operation transforms the pseudo-random seed in the ciphertext field into a ciphertext form insertion position index through a homomorphic mapping function. The model provider encodes the probe sample insertion logic into a homomorphic computing circuit. The homomorphic computing circuit receives the ciphertext-form insertion position index and the set of encrypted data blocks. It achieves blind positioning through the ciphertext domain condition selection operation. The ciphertext domain condition selection operation performs a ciphertext comparison operation on each encrypted data block to calculate its matching degree with the ciphertext-form insertion position index. Based on the ciphertext comparison result, the probe sample is injected at the matching position. The model provider constructs probe samples with pre-set labels and homomorphically encrypts them to obtain encrypted probe samples. The encrypted probe samples are embedded in the homomorphic computing circuit as injection data for conditional selection operations, and the pre-set labels are stored locally. The model provider submits the cryptographic diagnostic model, which includes homomorphic computing circuits and cryptographic probe samples, to the computing executor.

5. The method according to claim 4, characterized in that, The model provider constructs probe sample insertion logic, which defines the computation steps of performing a homomorphic hash operation on the ciphertext pseudo-random seed. The homomorphic hash operation transforms the ciphertext pseudo-random seed into a ciphertext insertion position index through a homomorphic mapping function, including: The model provider defines a homomorphic mapping function, which includes a combination of homomorphic modular operations and homomorphic linear transformations; The model provider defines a calculation step in the probe sample insertion logic to perform homomorphic hashing on the pseudo-random seed of the ciphertext field. The homomorphic hashing operation performs homomorphic square operation on the pseudo-random seed of the ciphertext field to obtain the ciphertext square value, and performs homomorphic modulo operation on the ciphertext square value to map it to a preset ciphertext range to obtain the ciphertext hash intermediate value. A homomorphic linear transformation is performed on the ciphertext hash intermediate value. The homomorphic linear transformation performs a homomorphic modulo operation on the ciphertext hash intermediate value and the number of blocks in the encrypted data block set to obtain the ciphertext form insertion position index located in the encrypted data block index space. The ciphertext form insertion position index encodes the injection position of the probe sample in the ciphertext field. The model provider embeds a collision avoidance mechanism in the probe sample insertion logic. The collision avoidance mechanism defines that when the generated ciphertext insertion position index conflicts with an existing position index, a homomorphic increment operation is performed on the pseudo-random seed of the ciphertext field and a homomorphic hash operation is re-executed until a non-conflicting ciphertext insertion position index is generated.

6. The method according to claim 4, characterized in that, Injected probe samples, including: The model provider inserts the probe samples into a homomorphic computation circuit, which includes a ciphertext comparison sub-circuit and a conditional selection sub-circuit. The ciphertext comparison sub-circuit performs homomorphic encryption on the index value of each encrypted data block in the encrypted data block set to obtain an encrypted index value, performs homomorphic subtraction on the encrypted index value and the ciphertext insertion position index to obtain a ciphertext difference, performs homomorphic square operation on the ciphertext difference and generates a ciphertext matching identifier through the homomorphic threshold judgment circuit, and the ciphertext matching identifier encodes the matching relationship between the encrypted data block and the insertion position in the ciphertext field; The condition selection sub-circuit receives the ciphertext matching identifier corresponding to each encrypted data block, performs ciphertext multiplication on each encrypted data block, multiplies the encrypted data block with its corresponding ciphertext matching identifier to obtain the selection result, multiplies the encrypted probe sample with the ciphertext matching identifier to obtain the injected data, performs homomorphic addition on the selection result and the injected data to achieve conditional substitution, and completes the injection of the probe sample at the matching position.

7. The method according to claim 4, characterized in that, The computation executor performs homomorphic operations on the encrypted diagnostic model in blocks of encrypted data, triggers probe sample injection based on the ciphertext insertion position index, and obtains encrypted output. The data provider decrypts the probe sample results and compares them with preset labels to obtain the model credibility verification results, including: The computation executor performs homomorphic operations on the encrypted diagnostic model for the encrypted data blocks. During the homomorphic operation, the operation is selected based on the ciphertext field conditions in the homomorphic computation circuit. Based on the ciphertext form insertion position index and the ciphertext comparison result of each encrypted data block, the probe sample injection is triggered. The encrypted probe sample is fused into the homomorphic operation process at the corresponding position to obtain an encrypted output containing both normal diagnostic results and probe sample diagnostic results. The computation executor organizes the encrypted output in a structured manner, inserts a location index based on the ciphertext to generate location marker information for the diagnostic results of the probe sample, and sends the encrypted output and location marker information to the data provider. The data provider performs decryption and verification operations on the location marker information based on the pseudo-random seed in the ciphertext field to recover the probe sample location index. Based on the location index, the encrypted diagnostic results corresponding to the probe sample are extracted from the encrypted output and decrypted to obtain the probe sample results. The probe sample results are compared with the preset labels stored locally to calculate the consistency metric and generate the model credibility verification results.

8. A medical data homomorphic encryption and privacy protection system, used to implement the method as described in any one of claims 1-7, characterized in that, include: The block commitment unit is used by the data provider to divide the medical data set into multiple data blocks and homomorphically encrypt them. Based on the homomorphic commitment scheme, a commitment value with separable open attribute is generated for each data block. The compliance verification unit is used by the model provider to initiate a challenge request to specify the target data block index. The data provider performs a commitment to open the target data block and generates a partial open proof. The model provider verifies the partial open proof based on the corresponding commitment value, confirms the commitment binding relationship and the consistency of medical constraint rules, and obtains the data compliance verification result. The model construction unit is used by the model provider to construct the encrypted diagnostic model. It embeds the probe sample insertion logic in the encrypted diagnostic model calculation process to perform homomorphic hash operation on the pseudo-random seed of the ciphertext field to generate the ciphertext form insertion position index, and submits the encrypted diagnostic model to the calculation execution party. The execution verification unit is used to calculate the homomorphic operation of the encryption diagnostic model performed by the executor on the encrypted data blocks, and to trigger the injection of probe samples according to the ciphertext form insertion position index to obtain the encrypted output. The data provider decrypts the probe sample results and compares them with the preset labels to obtain the model credibility verification results. The result determination unit is used to return encrypted output when both the data compliance verification result and the model credibility verification result pass; otherwise, it terminates the calculation and outputs an anomaly flag.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images