A medical data desensitization processing method and system fusing dynamic K-anonymity generalization and homomorphic encryption

Abstract

The application relates to the technical field of electric digital data processing, and discloses a medical data desensitization processing method and system fusing dynamic K-anonymity generalization and homomorphic encryption. The method comprises the following steps: acquiring original ICU monitoring time sequence data, adopting multi-parameter time sequence sensitivity constraints to perform a dynamic K value generation task; performing time sequence clustering and anonymous group adjustment on patient records based on a dynamic K value sequence; performing multi-parameter generalization interval time sequence smoothing based on time sequence consecutive anonymous groups; adopting a processing method combining random time offset and additive homomorphic encryption to perform timestamp encryption; and performing direct identification field deletion and desensitization field recombination according to encrypted generalization records. Due to the sequential connection of dynamic K value generation, time sequence clustering and anonymous group adjustment, generalization interval smoothing and timestamp encryption, the application realizes time sequence consecutive anonymous generalization and encryption protection, and improves the data availability and privacy security of desensitized medical data.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing technology, and in particular to a method and system for desensitizing medical data that integrates dynamic K-anonymity generalization and homomorphic encryption. Background Technology

[0002] Currently, when hospitals share multi-parameter time-series data (such as blood pressure, heart rate, and blood oxygen saturation) from continuous monitoring in the intensive care unit (ICU) for clinical retrospective studies or predictive model training, they typically use... - Anonymization and its variants perform data desensitization. There are two main processing paths: one is to treat each record in the time series as an independent snapshot, and perform a generalization operation on the quasi-identifier attribute at each time point, ensuring that each generalized record is at least as close as... -1 other records are indistinguishable; another approach is to first divide the continuous time series into fixed-length windows, and then perform analysis on the statistics (such as mean, median) or representative data points within the window. Anonymize the data and then publish the desensitized window-level data. The core operations of both of these approaches are based on constructing equivalence classes based on the static distribution of attribute values, without explicitly introducing evolutionary constraints in the time dimension. Furthermore, they typically use a globally uniform anonymity strength parameter, ignoring the significant fluctuation range of different physiological parameters, the huge differences in clinical risk thresholds, and the dramatic changes in local sensitivity during the patient's condition from the stable phase to the acute deterioration phase in multi-parameter ICU scenarios.

[0003] For example, using independent recording When anonymizing ICU time series data, the generalization intervals for the same patient at different time points are solved independently, without constraining the continuity of adjacent intervals. This easily leads to jumps, misalignments, or even empty intersections in the generalization boundaries along the time axis. In multi-parameter monitoring scenarios, the gradients of different parameters contain sensitive information about the individual's state evolution. Attackers can launch time-series correlation attacks by continuously observing the positional migration, overlap, and trends of generalization intervals for specific parameters, inferring the complete physiological trajectory of an individual patient, and thus achieving relabeling. The data set lacks sufficient privacy protection during highly sensitive instantaneous moments, while its excessive generalization during low-sensitivity phases leads to severe information loss, disrupting the dynamic change patterns of key parameters such as blood pressure and heart rate. This renders subsequent trend analysis and event prediction unusable for clinical research. Furthermore, traditional non-order-preserving encryption of timestamps completely loses the order of the time series and the time differences between adjacent points, making time-series-dependent analysis methods unusable in the encrypted domain. This further exacerbates the conflict between privacy protection and the usability of medical analysis.

[0004] Therefore, there is an urgent need for a medical data anonymization method that can explicitly model the dependencies in the time dimension, dynamically adjust the anonymity strength based on multi-parameter local sensitivity, and simultaneously ensure the order and computability of timestamp order and differences using an order-preserving homomorphic encryption mechanism. This method, while defending against temporal privacy attacks based on continuous time point associations, can still output multi-parameter temporal smoothness. Anonymize the generalized interval and provide ciphertext timestamps that maintain time order and differences, thereby maintaining time-series statistical computing capabilities within the encrypted domain, ultimately improving the data availability and analytical reliability of de-identified data in medical trend analysis. Summary of the Invention

[0005] To address the aforementioned technical shortcomings, the purpose of this invention is to propose a dynamic fusion method. The anonymization generalization and homomorphic encryption method for medical data desensitization aims to solve the technical problems in existing technologies when sharing multi-parameter ICU monitoring time series data. These problems include the failure to consider time series dependencies, which leads to the easy association and re-identification of continuous observations, and the encryption destroying the availability of time series data. This also fails to resolve the technical issues of the conflict between time series privacy protection and the needs of medical trend analysis.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention provides a medical data desensitization processing method that integrates dynamic K-anonymization generalization and homomorphic encryption.

[0007] The aforementioned method for desensitizing medical data by integrating dynamic K-anonymity generalization and homomorphic encryption includes: Step S10: Obtain the original ICU monitoring time series data, and perform a dynamic K-value generation task based on the original ICU monitoring time series data using multi-parameter time series sensitivity constraints, and output the dynamic K-value sequence; Step S20: Perform temporal clustering and anonymization group adjustment tasks on the corresponding patient records based on the dynamic K-value sequence, and output temporally coherent anonymized groups; Step S30: Perform a multi-parameter generalization interval temporal smoothing task based on the temporal coherent anonymized group, and output the temporal smoothed K-anonymized generalized record; Step S40: Based on the time-series smoothed K-anonymous generalized record, a processing method combining random time offset and additive homomorphic encryption is used to perform a timestamp encryption task, and output the encrypted generalized record; Step S50: Perform direct identifier field deletion and desensitized field recombination tasks based on the encrypted generalized record, and output the desensitized dataset.

[0008] Preferably, step S10, which involves acquiring the original ICU monitoring time-series data, performing a dynamic K-value generation task based on the original ICU monitoring time-series data using multi-parameter time-series sensitivity constraints, and outputting a dynamic K-value sequence, specifically includes: Step S101: For the original ICU monitoring time series data containing Patient records of 1 physiological parameter, using a length of 1... The preset sliding time window is used to capture continuous monitoring segments and obtain the first segment. Preset clinical risk thresholds and preset normal reference values ​​for each physiological parameter are calculated, and the patient's... The Physiological parameters at time points Standardized variation components:

[0009] The patient is composed of standardized variation components corresponding to each physiological parameter. At the point of time The change vector is calculated, and the sensitivity to multi-parameter changes is determined.

[0010] in, The number of physiological parameters contained in the original ICU monitoring time series data. The window length is the preset sliding time window. Record patient identification. For physiological parameter serial numbers, For a point in time, For patients The Physiological parameters at time points The parameter value, For the first Each physiological parameter corresponds to a preset clinical risk threshold. For the first The preset normal reference values ​​for each physiological parameter For patients The Physiological parameters at time points Standardized variation components, For patients At the point of time The changing vector, For patients At the point of time Sensitivity to multi-parameter changes, Represents the L2 norm; Step S102: For the patient At the point of time For corresponding multi-parameter records, set the preset neighborhood radius. The distance between the statistical data and the multi-parameter record is less than the preset neighborhood radius. The number of other patient records, to obtain the patient At the point of time Local recording density and calculation of patient At the point of time Uniqueness indicators:

[0011] in, For patients At the point of time Local recording density, For patients At the point of time Uniqueness indicators; Step S103: Calculate the patient's condition based on the multi-parameter change sensitivity and the uniqueness index. At the point of time Temporal sensitivity score:

[0012] And generate patient data based on the time-series sensitivity score. At the point of time The corresponding dynamic K value:

[0013] in, For patients At the point of time The time-series sensitivity score, To preset the sensitivity weights for multiple parameter changes, The preset uniqueness index weights are defined, and the sum of the preset multi-parameter change sensitivity weights and the preset uniqueness index weights is 1. To preset the basic anonymity, To preset the sensitivity scaling factor, To preset the minimum anonymity, To define the maximum anonymity, the preset minimum anonymity, the preset base anonymity, and the preset maximum anonymity are all positive integers and occur in a non-decreasing order. For patients At the point of time The corresponding dynamic K value, Represents the floor function; The generated dynamic K values ​​are sorted according to the patient record identifier and time point to form the dynamic K value sequence.

[0014] Preferably, step S20, which involves performing temporal clustering and anonymization group adjustment tasks on the corresponding patient records based on the dynamic K-value sequence, and outputting a temporally coherent anonymized group, specifically includes: Step S201: Extract patient records corresponding to the dynamic K-value sequence from the original ICU monitoring time series data; normalize the physiological parameters of each patient record at the same time point to obtain normalized attribute data corresponding to each patient record; determine the temporal pattern distance between any two patient records based on the attribute difference between the normalized attribute data of any two patient records at the current time point and the attribute change difference between any two patient records relative to the previous time point. Step S202: Cluster the patient records at the same time point according to the time sequence pattern distance to form candidate anonymization groups, and determine the maximum value of the dynamic K value corresponding to each patient record in each candidate anonymization group as the lower limit of the anonymity scale of the candidate anonymization group, so that the number of patient records contained in the candidate anonymization group is not less than the lower limit of the anonymity scale. Step S203: Determine the degree of overlap of generalization intervals based on the parameter value distribution of the same physiological parameter in the candidate anonymization groups corresponding to adjacent time points. For candidate anonymization groups that do not meet the preset temporal overlap conditions, perform merging, splitting, or patient record reallocation until the adjusted candidate anonymization groups simultaneously meet the lower limit of anonymization scale and the preset temporal overlap conditions. Then, determine the adjusted candidate anonymization groups as the temporally coherent anonymization groups.

[0015] Preferably, step S203, the step of determining the degree of overlap of generalization intervals based on the parameter value distribution of the same physiological parameter in the candidate anonymization groups at adjacent time points, specifically includes: For the same physiological parameter, the minimum and maximum parameter values ​​of the physiological parameter in the candidate anonymous group at the current time point are respectively determined as the lower and upper bounds of the current generalization interval, and the minimum and maximum parameter values ​​of the physiological parameter in the candidate anonymous group at the next time point are respectively determined as the lower and upper bounds of the next generalization interval. The overlap ratio of the generalization intervals is determined based on the intersection length and the union length of the current generalization interval and the next generalization interval, wherein the overlap ratio of the generalization intervals is the ratio of the intersection length to the union length. Set a preset overlap threshold, compare the overlap ratio of the generalization interval with the preset overlap threshold, and when the overlap ratio of the generalization interval is not less than the preset overlap threshold, determine that the corresponding physiological parameter meets the temporal overlap requirement; When all physiological parameters in the candidate anonymization group meet the temporal overlap requirement, the corresponding candidate anonymization group is determined to meet the preset temporal overlap condition; when the union length of the current generalization interval and the next generalization interval is zero, the corresponding physiological parameter is determined to meet the temporal overlap requirement.

[0016] Preferably, step S30, which involves performing a multi-parameter generalization interval temporal smoothing task based on the temporally coherent anonymization group and outputting a temporally smoothed K-anonymous generalization record, specifically includes: Step S301: For each of the aforementioned time-series coherent anonymized groups, the same physiological parameter values ​​recorded by each patient in the time-series coherent anonymized group are statistically analyzed according to the time points. The minimum and maximum values ​​of the same physiological parameter values ​​are determined as the lower bound and upper bound of the initial generalization interval for the corresponding time points, respectively, to form the initial generalization interval corresponding to each physiological parameter. Step S302: Set a preset time-series smoothing factor for each physiological parameter. The preset time-series smoothing factor is determined based on the maximum allowable parameter change between adjacent sampling time points for the corresponding physiological parameter. Limit the change of the lower bound of the initial generalization interval and the change of the upper bound of the initial generalization interval between adjacent time points according to the preset time-series smoothing factor. Under the condition of satisfying the change limit, the generalization interval covers all parameter values ​​in the corresponding time-series coherent anonymization group to obtain a smoothed generalization interval. Step S303: Arrange the patient records in chronological order, replace the physiological parameter values ​​in each patient record with the corresponding smoothed generalization interval, and retain the original timestamps corresponding to each patient record to form the temporally smoothed K-anonymous generalized record.

[0017] Preferably, step S40, which involves performing a timestamp encryption task based on the time-smoothed K-anonymous generalized record using a processing method combining random time offset and additive homomorphic encryption, and outputting the encrypted generalized record, specifically includes: Step S401: Extract the original timestamps corresponding to each patient record from the time-series smoothed K-anonymized generalized records, set a preset coarse-grained time window, and divide the original timestamps according to the preset coarse-grained time window; generate a constant random offset for the original timestamps of the same patient record located in the same preset coarse-grained time window, and superimpose the constant random offset onto the corresponding original timestamp to obtain the offset timestamp. Step S402: Obtain the pre-generated additive homomorphic encryption public key, and use the additive homomorphic encryption public key to encrypt each of the offset timestamps to obtain the corresponding ciphertext timestamps; Step S403: Generate an in-window sequence identifier according to the original time sequence of each patient's records within the corresponding preset coarse-grained time window, and write each encrypted timestamp and the corresponding in-window sequence identifier into the time-smoothed K-anonymous generalized record to replace the corresponding original timestamp, thereby forming the encrypted generalized record.

[0018] Preferably, step S50, which involves performing direct identifier field deletion and desensitization field reorganization tasks based on the encrypted generalized record and outputting the desensitized dataset, specifically includes: Step S501: Identify the direct identification field used to directly determine the patient's identity from the encrypted generalized record, and delete the direct identification field to obtain the desensitized record to be reconstructed; Step S502: According to the association between each of the desensitized records to be reconstructed and the corresponding time-series coherent anonymization group, the smooth generalization interval, ciphertext timestamp and window position identifier in the desensitized records to be reconstructed are reconstructed to obtain the reconstructed desensitized records. Step S503: Summarize the recombined and desensitized records in chronological order, and combine the summarized recombined and desensitized records into the desensitized dataset.

[0019] This invention also provides a medical data anonymization processing system that integrates dynamic k-anonymization generalization and homomorphic encryption, comprising: The dynamic K-value generation module is used to acquire the original ICU monitoring time series data, and to perform the dynamic K-value generation task based on the original ICU monitoring time series data using multi-parameter time series sensitivity constraints, and output the dynamic K-value sequence. Anonymous group construction module is used to perform temporal clustering and anonymity group adjustment tasks on the corresponding patient records based on the dynamic K-value sequence, and output temporally coherent anonymity groups; The generalized interval smoothing module is used to perform a multi-parameter generalized interval temporal smoothing task based on the temporally coherent anonymized group and output a temporally smoothed K-anonymous generalized record. The timestamp encryption module is used to perform timestamp encryption tasks based on the time-series smoothed K-anonymous generalized record using a processing method that combines random time offset and additive homomorphic encryption, and outputs encrypted generalized record; The de-identified dataset generation module is used to perform direct identification field deletion and de-identified field recombination tasks based on the encrypted generalized records, and output a de-identified dataset.

[0020] The present invention also provides a computer program product, the computer program product including a medical data desensitization processing program that integrates dynamic k-anonymization generalization and homomorphic encryption, the medical data desensitization processing program that integrates dynamic k-anonymization generalization and homomorphic encryption implements the above method when executed by a processor.

[0021] The beneficial effects of this invention are as follows: By generating a dynamic K-value sequence through multi-parameter temporal sensitivity constraints, the anonymity intensity is automatically adjusted according to the sensitivity of changes in patient physiological parameters and local recording density. The lower limit of the anonymity group size is increased at high-sensitivity moments to enhance privacy protection, and the lower limit of the anonymity group size is decreased at low-sensitivity moments to reduce information loss. This allows the dynamic change patterns of key parameters such as blood pressure and heart rate to be preserved while defending against temporal correlation attacks, thereby improving the usability of anonymized data for trend analysis and event prediction.

[0022] By constructing a temporally coherent anonymized group through temporal clustering and anonymization group adjustment, and using a preset temporal smoothing factor to limit the changes in the upper and lower bounds of the generalization interval between adjacent time points, the generalization interval remains continuous and smoothly transitions on the time axis, avoiding abrupt changes or empty intersections in the generalization boundary. This reduces the risk of attackers launching temporal correlation attacks by continuously observing the migration of the generalization interval position, while maintaining the statistical characteristics of multi-parameter time series data and improving the reliability of anonymized data in medical analysis.

[0023] By combining random time offsets with additive homomorphic encryption to process timestamps, timestamp encryption is achieved while maintaining the order of timestamps and the computability of differences between adjacent time points. This allows time-series-dependent statistical analysis methods to be executed directly within the encrypted domain, while preventing attackers from using timestamp information for re-identification. Thus, while protecting patient privacy, the ability to perform time-series statistical calculations is maintained, and the analytical value of desensitized datasets in clinical retrospective studies is improved. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating the first embodiment of a medical data anonymization processing method that integrates dynamic K-anonymization generalization and homomorphic encryption according to the present invention. Detailed Implementation

[0025] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0026] Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] Example 1: As Figure 1 The diagram shown is a flowchart illustrating a first embodiment of a medical data anonymization method integrating dynamic K-anonymization generalization and homomorphic encryption according to the present invention.

[0028] In the first embodiment, the medical data anonymization method integrating dynamic K-anonymization generalization and homomorphic encryption includes: Step S10: Obtain the original ICU monitoring time series data, and perform a dynamic K-value generation task based on the original ICU monitoring time series data using multi-parameter time series sensitivity constraints, and output the dynamic K-value sequence; The original intensive care unit time-series data consists of multi-parameter physiological observations of multiple patients at different time points, typically including parameters such as heart rate, blood pressure, and blood oxygen saturation. Each record is accompanied by a real timestamp and patient identifier. The task of multi-parameter time-series sensitivity constraint is to generate a dynamic anonymity intensity value for each patient at each time point based on these inputs. The processing first involves extracting continuous monitoring segments using a preset time window. The changes in each parameter within the window are standardized, using the difference between the clinical risk threshold and the normal reference value for each parameter as the normalization benchmark, resulting in a standardized multi-parameter change vector. The length of this change vector reflects the sensitivity to multi-parameter changes, characterizing the degree of physiological disturbance at the current moment. Simultaneously, the number of other patient records within a preset distance range from the current record is counted in the multi-parameter space to obtain the local record density, and a uniqueness index is calculated based on this. The multi-parameter change sensitivity and the uniqueness index are combined according to preset weights to form a time-series sensitivity score. This score is then mapped and limited by preset base anonymity, preset sensitivity scaling factor, and preset minimum and maximum anonymity to generate the dynamic anonymity intensity value for the patient at that time point. The generated dynamic anonymity intensity values ​​are sorted according to patient record identifiers and time points to form a dynamic anonymity intensity value sequence.

[0029] The dynamic anonymity intensity sequence provides a time-by-time lower bound for subsequent temporal clustering and anonymity group adjustment. Because the dynamic anonymity intensity fluctuates in real time with changes in physiological parameters and local record density, it reaches higher values ​​at moments of rapid physiological change and unique records, while falling back to lower values ​​at stable and densely recorded moments. In step S20, when constructing temporally coherent anonymity groups, the size of each cluster must cover the maximum dynamic anonymity intensity value occurring within its time span, ensuring that locations with the highest reidentification risk have sufficient records for masking. This avoids the problem of insufficient protection at high-risk moments and excessive information loss at low-risk moments under a fixed anonymity intensity, allowing subsequent generalization processing to maintain a balance between protection intensity and data availability.

[0030] Traditional anonymization methods typically pre-determine a globally uniform anonymity strength value when processing time series data, or specify a fixed parameter through global statistics of the dataset. In intensive care settings, the sensitivity of physiological parameters varies greatly at different time points, and the relabeling risk is drastically different between the stable period and the acute exacerbation period. If the fixed anonymity strength value is set too low, the sparse records at the exacerbation period may not be able to resist time-series correlation attacks; if it is set too high, the stable period will be overgeneralized, resulting in a severe loss of trend information. In addition, the fixed anonymity strength value does not consider the clinical risk threshold of each parameter and cannot reflect the different sensitivities implied by slight fluctuations and large abnormalities in heart rate. Step S10 introduces a standardized multi-parameter change vector, using the difference between the clinical risk threshold and the normal reference value as a normalization factor, combined with local record density. The resulting dynamic anonymity strength value can fluctuate in real time with the degree of physiological disturbance and the uniqueness of record distribution, so that the anonymity strength matches the local risk, providing an adaptive protection basis for time series scenarios that is different from the traditional one-size-fits-all approach.

[0031] Taking a shared set of intensive care data containing heart rate, systolic blood pressure, diastolic blood pressure, and oxygen saturation as an example, at a certain moment, a patient's heart rate suddenly rises from the normal range to near the danger threshold, and diastolic blood pressure drops to the critical value. The normalized denominator of each parameter component is calculated as the difference between the danger threshold and the normal reference value. The standardized change components of heart rate and diastolic blood pressure significantly increase, and the sensitivity to multi-parameter changes is significantly increased after integrating multiple parameters. At this moment, there are relatively few patients in this extreme state, the local recording density is low, and the uniqueness index is close to a high level. After combining the two with preset weights, the time-series sensitivity score is high. After mapping and limiting by a preset baseline anonymity and a preset sensitivity scaling factor, the dynamic anonymity intensity value is pushed up to the preset maximum anonymity. During stable periods, parameter fluctuations only cause lower sensitivity to multi-parameter changes, and the uniqueness index is also small, resulting in a lower time-series sensitivity score. The mapped dynamic anonymity intensity value maintains the preset baseline anonymity. This set of dynamic anonymity intensity values ​​increases to the preset maximum anonymity at high-risk windows and maintains the preset baseline anonymity at stable windows, providing differentiated intensity guidance for clustering in step S20.

[0032] Step S20: Perform temporal clustering and anonymization group adjustment tasks on the corresponding patient records based on the dynamic K-value sequence, and output temporally coherent anonymized groups; After the dynamic anonymity intensity value sequence enters from step S10, each time point corresponds to a minimum anonymity group size requirement. The processing objects are patient records in the original intensive care time series data corresponding to these intensity values. Each record contains physiological parameters such as heart rate, systolic blood pressure, diastolic blood pressure, and blood oxygen saturation of the same patient at the same time point. First, the physiological parameters of each patient record at the same time point are normalized so that parameters of different dimensions can be compared on the same scale. Then, the temporal pattern distance between any two patient records is calculated. This distance consists of two parts: one part is the difference between the normalized attribute vectors at the current time point, reflecting the degree of proximity of instantaneous states; the other part is the difference between the attribute change vectors at adjacent time points, reflecting the degree of proximity of change trends. The two parts are combined according to preset weights, which can be adjusted according to parameter sensitivity and time continuity requirements. Patient records at the same time point are clustered according to this temporal pattern distance to form candidate anonymity groups. The lower limit of the size of each candidate anonymity group is the maximum value of the dynamic anonymity intensity value corresponding to each patient record in the group, ensuring that the number of records in the group is not less than the strictest anonymity intensity requirement at that time. After clustering, the overlap of generalization intervals for the same physiological parameter between candidate anonymization groups at adjacent time points must be checked. The generalization interval is determined by the minimum and maximum values ​​of the parameter within the group, and the overlap is measured by the ratio of the intersection length to the union length of the current interval and the next interval. When this ratio is lower than a preset overlap threshold, the parameter is considered temporally discontinuous, and the candidate anonymization groups need to be merged, split, or patient records redistributed until all parameters meet the overlap condition and the group size meets the lower limit for anonymization. The resulting anonymization groups are temporally continuous and exhibit consistent trends, and are called temporally coherent anonymization groups.

[0033] When the temporally coherent anonymized group is handed over to step S30, it already possesses temporal consistency. Since the patient records within a group are similar in instantaneous state and trend, the value ranges of each parameter are relatively compact when calculating the generalization interval for each anonymized group. This prevents excessively wide generalization intervals due to large differences in records within the group, thus reducing information loss. The generalization intervals for the same parameter between anonymized groups at adjacent time points have sufficient overlap. When performing temporal smoothing of multi-parameter generalization intervals in step S30, no additional patching is needed to ensure a smooth transition between generalization intervals at adjacent time points, avoiding interval gaps or jumps. Without this temporal coherence, step S30 might need to calculate the generalization interval independently for each time point, leading to frequent fluctuations in the interval boundaries between adjacent time points. Attackers could infer the trajectory of individual patients by continuously observing interval changes. The temporally coherent anonymized group output in this step structurally closes off the path for correlation attacks via the time dimension, ensuring that subsequent encryption and desensitization operations are based on stable grouping.

[0034] Traditional anonymized clustering methods typically treat each patient's record at each time point as an independent sample, grouping them only based on attribute spatial distance without considering the dependencies between adjacent time series. In intensive care unit time series scenarios, continuous records of the same patient may be scattered across different anonymization groups, with record fragments from different patients interleaved and merged. When observed along the time axis, the parameter ranges covered by each anonymization group fluctuate greatly and are discontinuous. Attackers can exploit this characteristic of low overlap and frequent boundary jumps in generalization intervals along the time axis to infer the trajectory of individual patients through continuous observation and carry out time-series correlation attacks. This step directly uses the time-series overlap rate as a hard constraint to embed the clustering merging condition and uses the dynamic anonymity strength value to determine the minimum number of records required at each time point. During clustering, both the similarity of the current state and the similarity of the direction of change of adjacent time points are considered, so that the records within the same anonymization group are not only similar in instantaneous values ​​but also tend to be consistent in their changing trends. The anonymized equivalence classes constructed in this way have continuity in the time dimension, making up for the shortcomings of traditional methods in terms of time-series continuity and reducing the risk of time-series correlation attacks from a mechanistic perspective.

[0035] A shared set of intensive care data containing heart rate, systolic blood pressure, diastolic blood pressure, and oxygen saturation has yielded a sequence of dynamic anonymization intensity values ​​at each time point in step S10. The dynamic anonymization intensity values ​​are higher in high-risk windows and lower during stable periods. First, patient records corresponding to the dynamic anonymization intensity value sequence are extracted, and the physiological parameters of each patient record at the same time point are normalized. At a certain moment, the heart rate, blood pressure, and oxygen saturation values ​​of Patient 1 and Patient 2 are similar, and both show a slow decreasing trend; Patient 3's values ​​are similar, but the trend is increasing. When calculating the temporal pattern distance, Patient 1 and Patient 2 are closer together and are more likely to be assigned to the same candidate anonymization group; Patient 3, due to the difference in trends, is farther apart and tends to be assigned to other groups. If the dynamic anonymization intensity value at a given moment is large, the size of the candidate anonymization group needs to be expanded accordingly, possibly by adding members from other similar records. Subsequently, the degree of overlap in the generalization intervals of heart rate between candidate anonymization groups at adjacent time points is examined. If the overlap ratio between the current time point rate generalization interval and the next time point rate generalization interval is lower than a preset overlap threshold, a merging or reallocation is triggered. For example, a record that causes a significant expansion of the interval at the next time point is removed, causing the overlap ratio to rise back to meet the threshold requirement. After multiple rounds of adjustments, a temporally coherent anonymization group is finally formed that meets the lower limit of anonymization size and the temporal overlap condition. These anonymization groups cover the high-risk windows and stable periods in the original data, providing a temporally consistent grouping structure for calculating the generalization interval in step S30.

[0036] Step S30: Perform a multi-parameter generalization interval temporal smoothing task based on the temporal coherent anonymized group, and output the temporal smoothed K-anonymized generalized record; After reaching S30 in the time-series coherent anonymization group, the focus shifts from group structure to the generalization intervals of each physiological parameter within the group at consecutive time points. For each group, the minimum and maximum values ​​of the same physiological parameter recorded by all patients within the group are first calculated at each time point. These two values ​​constitute the lower and upper bounds of the initial generalization interval for that parameter at that time point. The initial interval only guarantees coverage of all observations within the group, but the interval boundaries at adjacent time points may fluctuate significantly due to changes in group members or individual outliers. A preset time-series smoothing factor is set for each physiological parameter, determined based on the maximum allowable parameter variation between adjacent sampling time points. When adjusting the interval, the changes in the lower and upper bounds at adjacent time points are limited to ensure that the movement of the lower and upper bounds on the time axis does not exceed the preset time-series smoothing factor, while still maintaining interval coverage of all parameter values ​​within the group. After this constraint, the generalization intervals at each time point are no longer solved independently, but instead form a set of interval sequences with a smooth temporal transition. Finally, the patient records are arranged in chronological order, the physiological parameter values ​​in each record are replaced with the corresponding smooth generalization intervals, and the original timestamps of each patient record are retained to obtain the temporally smoothed anonymized generalization records.

[0037] In the time-smoothed anonymized generalized records, each physiological parameter value represents a slowly changing interval over time, rather than a single point value or a drastically fluctuating interval. The changes in the lower and upper bounds of the intervals between adjacent time points are limited by the rate of physiological change. The generalized records do not produce spurious fluctuations due to changes in equivalence class members, thus avoiding subsequent trend detection algorithms misinterpreting jagged jumps at interval boundaries as sudden disease changes. The smoothed intervals still cover all original parameter values ​​within the group, without sacrificing data integrity within the anonymized group. Therefore, step S50, when deleting the direct identifier field and reorganizing the desensitized field, can retain sufficient medical statistical information for subsequent analysis.

[0038] In time series anonymization, if the generalization interval is calculated independently for each equivalence class at each time point, and only the interval is required to cover all records within the current time group without imposing any continuity constraints on the time dimension, then when the equivalence class members change at adjacent time points, the lower and upper bounds of the generalization interval may suddenly jump from one position to another. For example, the systolic blood pressure generalization interval may be at a high level at one time point, but shift significantly downward at the next time point, with both the interval position and width changing abruptly. This oscillation will form a large number of jagged steps in the time series graph, interfering with subsequent trend detection and event prediction algorithms, and may also provide attackers with clues about changes in equivalence class members, thereby assisting in relabeling. By introducing a preset time series smoothing factor, using the maximum allowable change in physiological parameters between adjacent sampling time points as a priori, the interval boundaries are forced to follow continuity constraints when evolving along the time axis. When the initial interval boundary at a certain point in time needs to be significantly expanded due to the addition of new patients, the adjustment process will move the boundary while meeting the smoothing factor constraints, and maintain coverage of all records by appropriately relaxing the boundary on the other side, thereby eliminating spurious fluctuations introduced by the replacement of equivalence class members and making the interpretation of anonymized data in medical trend analysis more reliable.

[0039] Following the time-series coherent anonymization group formed in step S20, one anonymization group contains three patients whose systolic blood pressure records at three consecutive time points are similar and show gradual changes. First, the minimum and maximum systolic blood pressure values ​​within this group are calculated at each time point to obtain the initial generalization intervals for the three time points. If these intervals are used directly, the lower and upper bounds will fluctuate slightly between adjacent time points. A preset time-series smoothing factor is set for systolic blood pressure, determined based on the maximum allowable change in systolic blood pressure between adjacent sampling time points. Under smoothing constraints, the change in the lower bound at the next time point must not exceed the preset time-series smoothing factor, and the upper bound must also meet the same change limit. If, at a certain time point, changes in group members cause the initial lower bound to need to decrease significantly, the smoothing process will adjust the lower bound to not exceed the range jointly defined by the current lower bound and the preset time-series smoothing factor, while appropriately widening the upper bound to maintain coverage of all records. In the final output time-series smoothed anonymized generalized record, the systolic blood pressure values ​​of the three patients are replaced with the corresponding smoothed generalization intervals, while the timestamps remain unchanged. These intervals exhibit a smooth transition on the timeline, without any sudden boundary jumps, providing a stable parameter expression for the timestamp encryption in step S40 and the desensitized field reorganization in step S50.

[0040] Step S40: Based on the time-series smoothed K-anonymous generalized record, a processing method combining random time offset and additive homomorphic encryption is used to perform a timestamp encryption task, and output the encrypted generalized record; In the time-series smoothed anonymized generalized records, the collection time on each record is still the real timestamp, while the physiological parameters have been replaced with smoothed generalization intervals. Once these timestamps are leaked with the desensitized data, attackers can correlate them with patient activity patterns or external events. Therefore, this step only processes the timestamps and does not change the already completed generalization intervals. First, the original timestamps corresponding to each patient are extracted from the records, and then divided according to a preset coarse-grained time window. The window granularity can correspond to hours or nursing shifts. For all timestamps of the same patient within the same window, a random offset that remains unchanged within that window is generated. The offset is derived from both the patient identifier and the window identifier, and different patients or different windows are independent of each other. The offset is added to the original timestamp to obtain the offset timestamp. The difference between any two offset timestamps within the same window is still equal to the original time interval. Next, a pre-generated additive homomorphic encryption public key is obtained, and each offset timestamp is encrypted separately to obtain the ciphertext timestamp. Additive homomorphic encryption allows direct addition operations on the ciphertext field. A certain operation result of two ciphertext timestamps corresponds to the encrypted result of the sum of the plaintext timestamps. Therefore, the difference between two ciphertext timestamps within the same window maintains its correspondence with the original time interval. Finally, a sequence identifier is generated within the window according to the original chronological order of each patient within that window. The ciphertext timestamps and corresponding sequence identifiers are written to the record, replacing the original timestamps, forming an encrypted generalized record. The sequence identifier does not depend on the value of the ciphertext; even if the ciphertext cannot be directly compared, the chronological order of events can still be restored.

[0041] In the encrypted generalized record, the timestamps are represented by both the ciphertext timestamps and the in-window ordinal markers. The actual acquisition time is hidden, but the order and interval information of the time series are preserved. Because the offset is constant within the same window, the difference between two ciphertext timestamps for the same patient within that window maintains a correspondence with the original time interval. Subsequent data users can perform certain statistical calculations on the ciphertext timestamps without decryption, such as calculating the time difference between adjacent events or performing a moving average in chronological order. The in-window ordinal markers ensure that even if the ciphertext values ​​cannot be directly compared, the order of events can be recovered through the ordinal markers. This process avoids the loss of time interval information caused by completely deleting timestamps, and also avoids the problem of global random offsets or swaps destroying the order and interval fidelity of events. Different windows use different random offsets, preventing attackers from deducing the true time mapping relationship from the ciphertext distribution patterns across windows, thus reducing the risk of frequency analysis and known-plaintext attacks. In step S50, when recombining the de-identified fields, the encrypted timestamp can be directly combined with fields such as the smooth generalization range and the anonymous group identifier, without the need for additional timestamp decryption steps, thus ensuring the continuity of the de-identification process and the availability of data.

[0042] In the anonymization of medical time-series data, traditional methods for handling timestamps are often rather crude. Completely deleting timestamps and retaining only the sequence number, while hiding the true time, loses time interval information, making subsequent clinical analysis based on time differences impossible. Applying a global random offset or swap to timestamps, while hiding precise time, disrupts the chronological order and the fidelity of intervals, leading to distorted time-series analysis results. While order-preserving encryption can maintain sequence, directly encrypting the actual timestamps allows attackers to recover the mapping relationship through frequency analysis or known-plaintext attacks due to the strong regularity of timestamp distribution. This step applies different random offsets within different coarse-grained time windows, disrupting the statistical correspondence between the absolute values ​​of timestamps and the ciphertext, while a constant offset within the window ensures the invariance of local differences. The combination of additive homomorphic encryption and random offsets makes the ciphertext timestamps neither directly decipherable nor incompatible with time difference calculations within the ciphertext domain. The introduction of sequence markers within the window further compensates for the potential incomparability of ordering caused by additive homomorphic encryption. This mechanism enhances resistance to analysis while maintaining the core information required for time series analysis, balancing the strength of timestamp privacy protection with the availability requirements of subsequent statistical calculations.

[0043] Following the time-series smoothed anonymized generalized record generated in step S30, where one anonymized group contains three patients, the systolic blood pressure records at three consecutive time points have been replaced with smoothed generalized intervals, while the timestamps remain the actual collection times. Step S40 first extracts the timestamps of each of the three patients from this record and sets a preset coarse-grained time window. Assuming this window covers a complete nursing shift, each of the three patients has several records within this window. For each patient, the system generates a constant random offset within the window based on the patient identifier and the window identifier. For example, the offset for the first patient is several minutes, the offset for the second patient is a different value, and the offset for the third patient is also different. These offsets are then superimposed on the original timestamps of the corresponding patients to obtain offset timestamps. Since the offset is constant within the same window, the difference between any two offset timestamps for the same patient within this window is still equal to the original time interval. Subsequently, each offset timestamp is encrypted using a pre-generated additive homomorphic encryption public key to obtain a ciphertext timestamp. The encrypted timestamps are numerical values ​​that cannot be directly interpreted, but a certain computable relationship is still maintained between the encrypted timestamps of the same patient within the same window, corresponding to the original time intervals. Finally, an in-window sequence identifier is generated according to the original chronological order of each patient within the window; for example, the first record is identified as the first sequence identifier, the second record as the second sequence identifier, and so on. The encrypted timestamps and in-window sequence identifiers are written into a time-series smoothed anonymized generalized record, replacing the original real timestamps, forming an encrypted generalized record. In this record, the systolic blood pressure generalization intervals for the three patients remain unchanged, and the timestamps have become a combination of encrypted and sequence identifiers. Subsequent step S50 will delete direct identifier fields such as patient name and hospital number, and reassemble the encrypted timestamps, smoothed generalization intervals, and anonymized group identifiers into a desensitized dataset for clinical research use.

[0044] Step S50: Perform direct identifier field deletion and desensitized field recombination tasks based on the encrypted generalized record, and output the desensitized dataset.

[0045] In the encrypted generalized records output in step S40, fields that directly point to specific individuals, such as patient name and hospital number, are retained. Physiological parameters have been replaced with smoothed generalization intervals, and time information is conveyed by encrypted timestamps and in-window ordinal identifiers. During processing, these records are checked one by one, identifying and deleting all directly identifying fields. The remaining content forms the desensitized records to be reconstructed. Subsequently, based on the correspondence between each record to be reconstructed and its corresponding temporally coherent anonymization group, the smoothed generalization intervals, encrypted timestamps, and in-window ordinal identifiers are rearranged into a unified field structure, resulting in reconstructed desensitized records. All reconstructed records are summarized chronologically to form the final desensitized dataset. Each row in this dataset corresponds to a desensitized monitoring record, no longer containing any directly identifying fields. Physiological parameters are presented as generalized intervals, and time information is expressed by encrypted timestamps and in-window ordinal identifiers.

[0046] After deleting the direct identifier field, the risk of identity re-identification is eliminated; the timestamps are neither completely deleted nor have their temporal causal structure disrupted by random perturbations. The encrypted timestamps maintain their correct chronological and interval relationships within the same window, and the smoothed generalization intervals transition continuously along the timeline. Therefore, external researchers can use the encrypted timestamps for time-series-based aggregation, interpolation, and other analytical tasks without decryption, while simultaneously observing the continuous trend of multi-parameter intervals evolving over time. The smoothed generalization intervals, encrypted timestamps, and in-window ordinal identifiers generated in the preceding steps are integrated into a structurally unified desensitized dataset, thus forming a complete closed loop in the desensitization process. This provides a directly usable secure data product for encrypted domain time-series statistical calculations and clinical research.

[0047] Traditional anonymization methods often output static generalized snapshots or segmented statistical summaries, lacking dedicated order-preserving encryption for the timestamp portion. This makes it difficult to retain accurate temporal causal structures and interval information in the anonymized time series data, hindering subsequent time-sensitive studies such as trend detection and event interval analysis. Some solutions, in an effort to preserve temporal information, only coarsely obfuscate the timestamps, potentially leaving vulnerabilities for time-series correlation attacks. This step, after removing the direct identifier field, collaboratively reconstructs the smoothed generalization interval and the order-preserving ciphertext timestamps, reconstructing a data view in the ciphertext domain that both hides the true spatiotemporal points of individuals and maintains an analyzable temporal structure. Because the generalization interval transitions smoothly and the temporal order is correct, classifiers or regression models trained on this dataset can learn physiological patterns consistent with the trends of the original data, avoiding modeling failures caused by pseudo-fluctuations and temporal discrepancies introduced by anonymization. This bridges the gap between usability and privacy protection in traditional methods.

[0048] The systolic blood pressure generalization intervals for the three patients remain unchanged after step S40. The timestamps have become a combination of ciphertext and ordinal identifiers, but direct identifier fields such as patient name and hospital number are still retained in the records. These direct identifier fields are first identified and deleted, resulting in the anonymized records to be reconstructed. Then, based on the association between each record to be reconstructed and its corresponding temporally coherent anonymization group, the smoothed generalization intervals, ciphertext timestamps, and in-window ordinal identifiers are rearranged into a unified field structure, forming the reconstructed anonymized records. For example, in a record of the first patient, the systolic blood pressure generalization interval is a certain numerical range, the ciphertext timestamp is an uninterpretable value, the in-window ordinal identifier is the first ordinal, and the anonymization group identifier is a group number. Finally, all the reconstructed anonymized records of the three patients are summarized in chronological order to form an anonymized dataset. This dataset no longer contains any direct identifier fields. Researchers can only restore the correct chronological order by sorting by ciphertext timestamps and calculate the shift of the interval center between adjacent time points using difference calculations to extract change features, but cannot obtain the true parameter values ​​or precise collection times of any patient.

[0049] Example 2: In addition, the present invention provides a fusion dynamic A medical data anonymization and homomorphic encryption system, employing a fusion dynamic approach as described in the above embodiments, is used. Anonymization generalization and homomorphic encryption methods for desensitizing medical data can solve a problem of fusion dynamics. The technical challenges of anonymization generalization and homomorphic encryption in medical data desensitization. This invention provides a fusion of dynamic... The beneficial effects of the medical data anonymization and homomorphic encryption desensitization system, combined with the fusion dynamic approach provided in the above embodiments, are presented in conjunction with these features. The beneficial effects of anonymization generalization and homomorphic encryption in medical data desensitization are the same, and the aforementioned fusion dynamic method... Other technical features of the anonymized generalization and homomorphic encryption medical data desensitization system are the same as those disclosed in the above embodiments and will not be repeated here.

[0050] Example 3: This invention provides a medical data anonymization processing device integrating dynamic K-anonymization generalization and homomorphic encryption. The device includes at least one processor and a memory communicatively connected to the processor. The memory stores instructions executable by the processor, which are then executed to enable the processor to perform the medical data anonymization processing method integrating dynamic K-anonymization generalization and homomorphic encryption described in Example 1. This medical data anonymization processing device can include, but is not limited to, mobile terminals such as mobile phones, laptops, digital radio receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. This medical data anonymization processing device is merely an example and should not be construed as limiting the functionality or scope of the invention. A medical data anonymization processing device integrating dynamic k-anonymization generalization and homomorphic encryption may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes based on a program stored in read-only memory or a program loaded from a storage device into random access memory. The random access memory also stores various programs and data required for the operation of the medical data anonymization processing device integrating dynamic k-anonymization generalization and homomorphic encryption. The processing unit, read-only memory, and random access memory are interconnected via a bus. An I / O interface is also connected to the bus. Typically, the following systems can be connected to the I / O interface: input devices including touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices including liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices including magnetic tapes, hard disks, etc.; and communication devices. The communication device allows the medical data anonymization processing device integrating dynamic k-anonymization generalization and homomorphic encryption to communicate wirelessly or wiredly with other devices to exchange data. While a medical data anonymization device integrating dynamic k-anonymization generalization and homomorphic encryption with various systems has been described, it should be understood that implementation of or possession of all the systems described is not required. Alternatively, more or fewer systems may be implemented.

[0051] Example 4: This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described method for de-identifying medical data by integrating dynamic K-anonymization generalization and homomorphic encryption. The computer program product provided by this invention can solve the technical problem of de-identifying medical data by integrating dynamic K-anonymization generalization and homomorphic encryption. Compared with the prior art, the beneficial effects of the computer program product provided by this invention are the same as those of the above-described method for de-identifying medical data by integrating dynamic K-anonymization generalization and homomorphic encryption, and will not be repeated here.

[0052] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a read-only memory. When the computer program is executed by a processing device, it performs the functions defined in the methods of the embodiments disclosed in this invention.

[0053] It should be understood that the various parts disclosed in this invention can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0054] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the present invention and its equivalents, the present invention also intends to include these modifications and variations.

Claims

1. A method for desensitizing medical data that integrates dynamic K-anonymity generalization and homomorphic encryption, characterized in that, The method includes: Step S10: Obtain the original ICU monitoring time series data, and perform a dynamic K-value generation task based on the original ICU monitoring time series data using multi-parameter time series sensitivity constraints, and output the dynamic K-value sequence; Step S20: Perform temporal clustering and anonymization group adjustment tasks on the corresponding patient records based on the dynamic K-value sequence, and output temporally coherent anonymized groups; Step S30: Perform a multi-parameter generalization interval temporal smoothing task based on the temporal coherent anonymized group, and output the temporal smoothed K-anonymized generalized record; Step S40: Based on the time-series smoothed K-anonymous generalized record, a processing method combining random time offset and additive homomorphic encryption is used to perform a timestamp encryption task, and output the encrypted generalized record; Step S50: Perform direct identifier field deletion and desensitized field recombination tasks based on the encrypted generalized record, and output the desensitized dataset.

2. The medical data anonymization method as described in claim 1, characterized in that, Step S10, which involves acquiring the original ICU monitoring time-series data and performing a dynamic K-value generation task based on the original ICU monitoring time-series data using multi-parameter time-series sensitivity constraints, and outputting a dynamic K-value sequence, specifically includes: Step S101: For the original ICU monitoring time series data containing Patient records of 1 physiological parameter, using a length of 1... The preset sliding time window is used to capture continuous monitoring segments and obtain the first segment. Preset clinical risk thresholds and preset normal reference values ​​for each physiological parameter are calculated, and the patient's... The Physiological parameters at time points Standardized variation components: The patient is composed of standardized variation components corresponding to each physiological parameter. At the point of time The change vector is calculated, and the sensitivity to multi-parameter changes is determined. in, The number of physiological parameters contained in the original ICU monitoring time series data. The window length is the preset sliding time window. Record patient identification. For physiological parameter serial numbers, For a point in time, For patients The Physiological parameters at time points The parameter value, For the first Each physiological parameter corresponds to a preset clinical risk threshold. For the first The preset normal reference values ​​for each physiological parameter For patients The Physiological parameters at time points Standardized variation components, For patients At the point of time The changing vector, For patients At the point of time Sensitivity to multi-parameter changes, Represents the L2 norm; Step S102: For the patient At the point of time For corresponding multi-parameter records, set the preset neighborhood radius. The distance between the statistical data and the multi-parameter record is less than the preset neighborhood radius. The number of other patient records, to obtain the patient At the point of time Local recording density and calculation of patient At the point of time Uniqueness indicators: in, For patients At the point of time Local recording density, For patients At the point of time Uniqueness indicators; Step S103: Calculate the patient's condition based on the multi-parameter change sensitivity and the uniqueness index. At the point of time Temporal sensitivity score: And generate patient data based on the time-series sensitivity score. At the point of time The corresponding dynamic K value: in, For patients At the point of time The time-series sensitivity score, To preset the sensitivity weights for multiple parameter changes, The preset uniqueness index weights are defined, and the sum of the preset multi-parameter change sensitivity weights and the preset uniqueness index weights is 1. To preset the basic anonymity, To preset the sensitivity scaling factor, To preset the minimum anonymity, To define the maximum anonymity, the preset minimum anonymity, the preset base anonymity, and the preset maximum anonymity are all positive integers and occur in a non-decreasing order. For patients At the point of time The corresponding dynamic K value, Represents the floor function; The generated dynamic K values ​​are sorted according to the patient record identifier and time point to form the dynamic K value sequence.

3. The medical data anonymization method integrating dynamic K-anonymization generalization and homomorphic encryption as described in claim 1, characterized in that, Step S20, which involves performing temporal clustering and anonymization group adjustment tasks on the corresponding patient records based on the dynamic K-value sequence, and outputting a temporally coherent anonymized group, specifically includes: Step S201: Extract patient records corresponding to the dynamic K-value sequence from the original ICU monitoring time series data; normalize the physiological parameters of each patient record at the same time point to obtain normalized attribute data corresponding to each patient record; determine the temporal pattern distance between any two patient records based on the attribute difference between the normalized attribute data of any two patient records at the current time point and the attribute change difference between any two patient records relative to the previous time point. Step S202: Cluster the patient records at the same time point according to the time sequence pattern distance to form candidate anonymization groups, and determine the maximum value of the dynamic K value corresponding to each patient record in each candidate anonymization group as the lower limit of the anonymity scale of the candidate anonymization group, so that the number of patient records contained in the candidate anonymization group is not less than the lower limit of the anonymity scale. Step S203: Determine the degree of overlap of generalization intervals based on the parameter value distribution of the same physiological parameter in the candidate anonymization groups corresponding to adjacent time points. For candidate anonymization groups that do not meet the preset temporal overlap conditions, perform merging, splitting, or patient record reallocation until the adjusted candidate anonymization groups simultaneously meet the lower limit of anonymization scale and the preset temporal overlap conditions. Then, determine the adjusted candidate anonymization groups as the temporally coherent anonymization groups.

4. The medical data anonymization method integrating dynamic K-anonymization generalization and homomorphic encryption as described in claim 3, characterized in that, Step S203, which involves determining the degree of overlap of generalization intervals based on the parameter value distribution of the same physiological parameter in the candidate anonymization groups at adjacent time points, specifically includes: For the same physiological parameter, the minimum and maximum parameter values ​​of the physiological parameter in the candidate anonymous group at the current time point are respectively determined as the lower and upper bounds of the current generalization interval, and the minimum and maximum parameter values ​​of the physiological parameter in the candidate anonymous group at the next time point are respectively determined as the lower and upper bounds of the next generalization interval. The overlap ratio of the generalization intervals is determined based on the intersection length and the union length of the current generalization interval and the next generalization interval, wherein the overlap ratio of the generalization intervals is the ratio of the intersection length to the union length. Set a preset overlap threshold, compare the overlap ratio of the generalization interval with the preset overlap threshold, and when the overlap ratio of the generalization interval is not less than the preset overlap threshold, determine that the corresponding physiological parameter meets the temporal overlap requirement; When all physiological parameters in the candidate anonymization group meet the temporal overlap requirement, the corresponding candidate anonymization group is determined to meet the preset temporal overlap condition; when the union length of the current generalization interval and the next generalization interval is zero, the corresponding physiological parameter is determined to meet the temporal overlap requirement.

5. The medical data anonymization method integrating dynamic K-anonymization generalization and homomorphic encryption as described in claim 1, characterized in that, Step S30, which involves performing a multi-parameter generalization interval temporal smoothing task based on the temporally coherent anonymized group and outputting a temporally smoothed K-anonymous generalized record, specifically includes: Step S301: For each of the aforementioned time-series coherent anonymized groups, the same physiological parameter values ​​recorded by each patient in the time-series coherent anonymized group are statistically analyzed according to the time points. The minimum and maximum values ​​of the same physiological parameter values ​​are determined as the lower bound and upper bound of the initial generalization interval for the corresponding time points, respectively, to form the initial generalization interval corresponding to each physiological parameter. Step S302: Set a preset time-series smoothing factor for each physiological parameter. The preset time-series smoothing factor is determined based on the maximum allowable parameter change between adjacent sampling time points for the corresponding physiological parameter. Limit the change of the lower bound of the initial generalization interval and the change of the upper bound of the initial generalization interval between adjacent time points according to the preset time-series smoothing factor. Under the condition of satisfying the change limit, the generalization interval covers all parameter values ​​in the corresponding time-series coherent anonymization group to obtain a smoothed generalization interval. Step S303: Arrange the patient records in chronological order, replace the physiological parameter values ​​in each patient record with the corresponding smoothed generalization interval, and retain the original timestamps corresponding to each patient record to form the temporally smoothed K-anonymous generalized record.

6. The medical data anonymization method integrating dynamic K-anonymization generalization and homomorphic encryption as described in claim 5, characterized in that, Step S40, which involves performing a timestamp encryption task based on the time-smoothed K-anonymous generalized record using a processing method combining random time offset and additive homomorphic encryption, and outputting the encrypted generalized record, specifically includes: Step S401: Extract the original timestamps corresponding to each patient record from the time-series smoothed K-anonymized generalized records, set a preset coarse-grained time window, and divide the original timestamps according to the preset coarse-grained time window; generate a constant random offset for the original timestamps of the same patient record located in the same preset coarse-grained time window, and superimpose the constant random offset onto the corresponding original timestamp to obtain the offset timestamp. Step S402: Obtain the pre-generated additive homomorphic encryption public key, and use the additive homomorphic encryption public key to encrypt each of the offset timestamps to obtain the corresponding ciphertext timestamps; Step S403: Generate an in-window sequence identifier according to the original time sequence of each patient's records within the corresponding preset coarse-grained time window, and write each encrypted timestamp and the corresponding in-window sequence identifier into the time-smoothed K-anonymous generalized record to replace the corresponding original timestamp, thereby forming the encrypted generalized record.

7. The medical data anonymization method as described in claim 6, characterized in that, Step S50, which involves performing direct identifier field deletion and de-identification field reorganization tasks based on the encrypted generalized record and outputting the de-identified dataset, specifically includes: Step S501: Identify the direct identification field used to directly determine the patient's identity from the encrypted generalized record, and delete the direct identification field to obtain the desensitized record to be reconstructed; Step S502: According to the association between each of the desensitized records to be reconstructed and the corresponding time-series coherent anonymization group, the smooth generalization interval, ciphertext timestamp and window position identifier in the desensitized records to be reconstructed are reconstructed to obtain the reconstructed desensitized records. Step S503: Summarize the recombined and desensitized records in chronological order, and combine the summarized recombined and desensitized records into the desensitized dataset.

8. A medical data anonymization system integrating dynamic K-anonymization generalization and homomorphic encryption, applied to the medical data anonymization method integrating dynamic K-anonymization generalization and homomorphic encryption as described in any one of claims 1 to 7, characterized in that, The medical data anonymization system includes: The dynamic K-value generation module is used to acquire the original ICU monitoring time series data, and to perform the dynamic K-value generation task based on the original ICU monitoring time series data using multi-parameter time series sensitivity constraints, and output the dynamic K-value sequence. Anonymous group construction module is used to perform temporal clustering and anonymity group adjustment tasks on the corresponding patient records based on the dynamic K-value sequence, and output temporally coherent anonymity groups; The generalized interval smoothing module is used to perform a multi-parameter generalized interval temporal smoothing task based on the temporally coherent anonymized group and output a temporally smoothed K-anonymous generalized record. The timestamp encryption module is used to perform timestamp encryption tasks based on the time-series smoothed K-anonymous generalized record using a processing method that combines random time offset and additive homomorphic encryption, and outputs encrypted generalized record; The de-identified dataset generation module is used to perform direct identification field deletion and de-identified field recombination tasks based on the encrypted generalized records, and output a de-identified dataset.

9. A medical data anonymization processing device integrating dynamic K-anonymization generalization and homomorphic encryption, characterized in that, The medical data desensitization processing device integrating dynamic K-anonymization generalization and homomorphic encryption includes: a memory, a processor, and a medical data desensitization processing program integrating dynamic K-anonymization generalization and homomorphic encryption stored in the memory and executable on the processor. When the medical data desensitization processing program integrating dynamic K-anonymization generalization and homomorphic encryption is executed by the processor, it implements a medical data desensitization processing method integrating dynamic K-anonymization generalization and homomorphic encryption as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes a medical data desensitization processing program that integrates dynamic k-anonymization generalization and homomorphic encryption. When the medical data desensitization processing program that integrates dynamic k-anonymization generalization and homomorphic encryption is executed by the processor, it implements a medical data desensitization processing method that integrates dynamic k-anonymization generalization and homomorphic encryption as described in any one of claims 1 to 7.

Images