A blockchain-based drug clinical trial data security archiving system

Abstract

This invention discloses a blockchain-based secure data storage system for drug clinical trials, relating to the field of drug clinical trial data management technology. The system includes a multi-source heterogeneous data acquisition and preprocessing module, a data hierarchical encryption and off-chain distributed storage module, a consortium blockchain network module, a smart contract automated management module, a data ownership confirmation and storage certificate management module, and a data traceability and auditing module. The acquisition and preprocessing module acquires multi-source trial data and performs standardization and anonymization processing; the hierarchical encryption and off-chain storage module performs differentiated encryption according to data security levels, stores encrypted data in IPFS, and only uploads data fingerprints to the blockchain; the consortium blockchain network is jointly maintained by all participating parties; smart contracts automate storage, permission verification, and auditing; the certificate management module generates electronic storage certificates; and the traceability and auditing module enables full-process traceability. This invention achieves secure storage and trusted management of clinical trial data throughout its entire lifecycle.

Description

Technical Field

[0001] This invention relates to the field of drug clinical trial data management technology, specifically a blockchain-based drug clinical trial data security storage system. Background Technology

[0002] Clinical trials are a crucial stage in new drug development. The authenticity, completeness, and traceability of the data collected directly affect the safety and efficacy of drugs and serve as the core basis for drug regulatory authorities' review and approval. Clinical drug trials are complex, involving numerous stakeholders, large amounts of data, and stringent regulations. Traditional systems used for recording, storing, and sharing trial data often face challenges related to data integrity, transparency, security, and interoperability.

[0003] However, current clinical trial data management faces the following prominent issues: First, the data is easily tampered with and difficult to trace. Traditional centralized databases are vulnerable to various threats such as human error, malicious tampering, system vulnerabilities, and cyberattacks. Once the data is tampered with, its authenticity will be questioned, directly affecting the reliability of the experimental results.

[0004] Second, there is a lack of trust mechanisms in multi-stakeholder collaboration. Clinical trial data has a long lifecycle, involving multiple stakeholders such as sponsors, contract research organizations, research centers, laboratories, and independent data monitoring committees. Due to multi-center collaboration leading to an increase in clinical trial participants, deficiencies in the data management systems of intermediary companies, the privacy of trial data cannot be guaranteed, the trial data lacks security, and the clinical trial process is not strictly controlled, resulting in a lack of data authenticity.

[0005] Third, regulatory compliance requirements are becoming increasingly stringent. The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) guidelines on Good Clinical Practice (GCP), the US FDA's guidelines on electronic records and signatures, and relevant regulations of the China National Medical Products Administration (NMPA) all impose extremely high requirements on data traceability and auditing. A significant amount of auditing resources is consumed in verifying data reliability.

[0006] While existing technologies have attempted to apply blockchain to clinical trial data management, such as methods for uploading and sharing clinical trial data based on blockchain channels and blockchain-based clinical trial data sharing systems, these solutions still have shortcomings in areas such as data privacy protection, fine-grained access control, and full lifecycle evidence preservation. Particularly in the context of drug clinical trials, subject privacy data (such as medical records and test results) and trial outcome data have different security levels and access permission requirements, and existing solutions lack targeted layered evidence preservation and differentiated protection mechanisms. Therefore, we propose a blockchain-based secure evidence preservation system for drug clinical trial data. Summary of the Invention

[0007] The technical problem to be solved by this invention is to overcome the existing defects and provide a blockchain-based secure storage system for drug clinical trial data. This system can solve technical problems such as easy tampering, difficulty in tracing, insufficient privacy protection, and lack of trust in multi-party collaboration of clinical trial data. It can realize secure storage and reliable management of clinical trial data throughout its entire lifecycle from collection to archiving, and can effectively solve the problems in the background technology.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a blockchain-based drug clinical trial data security storage system, comprising: a multi-source heterogeneous data acquisition and preprocessing module, used to acquire multi-source heterogeneous data generated during drug clinical trials and perform data preprocessing; The data hierarchical encryption and off-chain distributed storage module is used to receive the preprocessed data output by the acquisition and preprocessing module, perform hierarchical encryption according to the security level of the data, and store the encrypted data in the off-chain distributed storage system, while generating the storage address and the hash value of the encrypted data. The consortium blockchain network module is used to build a consortium blockchain network jointly maintained by all participants in drug clinical trials. The network maintains a distributed ledger, which is used to store digitally signed data fingerprints, metadata, and operation logs. The smart contract automated management module is deployed in the consortium blockchain network module and is used to automate the data storage process through smart contracts, including data storage, permission verification, operation auditing and lifecycle control. The data ownership confirmation and evidence management module is used to generate a unique electronic evidence certificate for each piece of data based on the evidence records on the consortium blockchain network, and to provide data integrity verification function. The data tracing and auditing module is used to read the operation logs recorded by the distributed ledger and the smart contract to perform full-process tracing and compliance auditing of clinical trial data. The output of the acquisition and preprocessing module is connected to the input of the hierarchical encryption and off-chain storage module; the hierarchical encryption and off-chain storage module submits the storage address and hash value as metadata to the consortium blockchain network module for on-chain notarization; the data ownership confirmation and notarization certificate management module obtains notarization transaction records from the consortium blockchain network module to generate electronic notarization certificates; the data traceability and auditing module reads the notarization transaction records stored in the distributed ledger and the operation logs recorded by the smart contract for traceability and auditing.

[0009] Furthermore, the multi-source heterogeneous data acquisition and preprocessing module includes: Data standardization units are used to convert raw experimental data of different formats from different data sources into a unified data format that conforms to a preset standard format; The data desensitization unit is used to desensitize the subject privacy information in the unified data format and generate desensitized data; The data structuring unit is used to perform data structuring processing on the de-identified data to generate a data packet to be stored with a preset field structure.

[0010] Furthermore, the data hierarchical encryption and off-chain distributed storage module includes: The data classification unit is used to divide the preprocessed data into multiple security levels according to the preset data sensitivity classification rules, and to mark each data packet with a corresponding security level identifier. A multi-level encryption unit is used to receive data with security level identifiers output by the data classification unit, and to call different encryption strategies for different security levels to encrypt the data and generate encrypted data packets. An off-chain storage unit is used to store the encrypted data packet in an off-chain distributed storage system, generate a storage address, and calculate the data hash value of the encrypted data packet.

[0011] Furthermore, the off-chain storage unit includes: The storage address generation subunit is used to generate the corresponding content identifier or file path as the storage address after storing the encrypted data packet to IPFS or a private distributed file system. The hash calculation subunit is used to perform hash calculations on encrypted data packets using a message digest algorithm to generate data hash values; The storage address and the data hash value serve as metadata for on-chain storage by the consortium blockchain network module.

[0012] Furthermore, the consortium blockchain network module includes: The node management unit is used to register, authenticate, and assign permissions to nodes that join the consortium blockchain network. These nodes include clinical trial institution nodes, sponsor nodes, contract research organization nodes, data monitoring committee nodes, and drug regulatory agency nodes. The consensus mechanism unit is used to run a consensus algorithm among the nodes of the consortium blockchain network to reach a consensus confirmation on the submitted transactions. A distributed ledger unit is used to store blockchain ledger data. Each notarized transaction record in the ledger data includes a data identifier, a data hash value, a storage address, a timestamp, and an operator's digital signature.

[0013] Furthermore, the smart contract automated management module includes: The data storage management contract is used to define the process and rules for data storage, verify the data format, digital signature and submission permission, and submit the data metadata to the consortium blockchain network for storage after the verification is passed. Access control contracts are used to verify and authorize data access requests based on a predefined role permission table and data level identifiers. An audit trail contract is used to record operation logs of all data operation activities and write the operation logs into the distributed ledger; Lifecycle management contracts are used to automatically trigger corresponding data storage tasks based on key time nodes preset in the clinical trial protocol. When performing evidence storage, the evidence storage management contract calls the access control contract to perform permission verification and calls the audit trail contract to record the evidence storage operation; the lifecycle management contract calls the evidence storage management contract to trigger the evidence storage task according to a preset time node.

[0014] Furthermore, the access control contract includes: The role permission matrix unit is used to store the access permission mapping relationship of different roles to various types of data; The data level matching unit is used to match the corresponding access policy based on the data's security level identifier. The dynamic authorization unit is used to dynamically determine whether to grant access permissions based on the requester's role and the security level of the requested data when a data access request is received, and to generate a temporary access token after authorization.

[0015] Furthermore, the data ownership confirmation and evidence management module includes: The data fingerprint generation unit is used to perform hash operations on the original data packet using a message digest algorithm to generate a unique data fingerprint; A digital signature unit is used by the data submitter to digitally sign the data fingerprint using their private key, thereby generating signature data. The evidence storage certificate generation unit is used to combine the data fingerprint, signature data, evidence storage timestamp and corresponding blockchain transaction hash to generate an electronic evidence storage certificate. The evidence verification unit is used to receive the data packet to be verified, perform a hash operation on the data packet to be verified to generate a verification hash value, compare the verification hash value with the data fingerprint in the electronic evidence certificate, and output the verification result.

[0016] Furthermore, the electronic evidence certificate includes QR code information, which encodes the serial number of the evidence certificate, the blockchain transaction hash, and the data fingerprint.

[0017] Furthermore, the data tracing and auditing module includes: The data lineage tracking unit is used to record the complete flow path of each clinical trial data from collection, preprocessing, encrypted storage, on-chain evidence storage to access and modification, and generate a data lineage map; An audit report generation unit is used to extract operation logs from the distributed ledger and the smart contract according to regulatory requirements, and generate an audit report that complies with the Good Clinical Practice for Drug Clinical Trials. The anomaly detection and early warning unit is used to monitor data access and operation behavior in real time, detect abnormal operations according to preset abnormal behavior rules, and trigger an early warning when an anomaly is detected.

[0018] Compared with existing technologies, the beneficial effects of this invention are as follows: This blockchain-based drug clinical trial data security storage system has the following advantages: 1. By storing data fingerprints (hash values) on the blockchain, the possibility of unauthorized data tampering is technically eliminated by leveraging the blockchain's hash anchoring and decentralized verification mechanisms. Any modification to the original data will result in a change in the hash value, which will not match the on-chain fingerprint and will be immediately detected. By employing differentiated encryption strategies for data with different levels of sensitivity (high-security level uses SM4 / AES-256 dual encryption, and low-security level uses single encryption), highly sensitive data such as subject privacy is protected without excessively increasing system overhead, achieving a balance between security and usability.

[0019] 2. Adopting a collaborative architecture of "off-chain storage of raw data and on-chain storage of data fingerprints" ensures the immutability of data while avoiding the storage pressure and performance bottlenecks caused by storing large amounts of raw data directly on the blockchain. Through smart contracts, dual-dimensional access control based on roles and data security levels is implemented to ensure that different participants can only access data within their authorized scope, thereby achieving trusted data sharing among multiple participants while ensuring data security.

[0020] 3. Covering the entire process from data collection, storage, access to auditing, it automatically generates audit trail records that comply with regulatory requirements, significantly reducing compliance audit costs and improving regulatory efficiency; the blockchain's chain structure and timestamp mechanism ensure the traceability and non-repudiation of all operations, providing a solid technical guarantee for the scientific validity and reliability of drug clinical trial results. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the overall architecture of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] Please see Figure 1 The present invention provides the following embodiments: Example 1: System Architecture Deployment and Working Principle This embodiment specifically illustrates the overall deployment architecture and working principle of the system of the present invention.

[0024] (I) Overall System Architecture The system of this invention includes six core modules: a multi-source heterogeneous data acquisition and preprocessing module, a data hierarchical encryption and off-chain distributed storage module, a consortium blockchain network module, a smart contract automated management module, a data ownership confirmation and evidence management module, and a data traceability and auditing module.

[0025] The connection relationships between the modules are as follows: the output of the acquisition and preprocessing module is connected to the input of the hierarchical encryption and off-chain storage module; the hierarchical encryption and off-chain storage module submits the storage address and hash value as metadata to the consortium blockchain network module for on-chain notarization; the smart contract automated management module is deployed in the consortium blockchain network module; the data ownership confirmation and notarization certificate management module obtains notarization transaction records from the consortium blockchain network module to generate electronic notarization certificates; the data traceability and auditing module reads the notarization transaction records stored in the distributed ledger and the operation logs of the smart contract records for traceability and auditing.

[0026] (ii) Deployment of the consortium blockchain network The consortium blockchain network is built using the Hyperledger Fabric v2.x enterprise-grade blockchain framework. The network nodes are jointly maintained by all participants in the drug clinical trial, specifically including: 5 clinical trial institution nodes, 2 sponsor nodes, 1 contract research organization (CRO) node, 1 independent data monitoring committee (IDMC) node, and 1 drug regulatory agency node, totaling 10 organizational nodes.

[0027] Each Peer node is configured with an 8-core 3.0GHz or higher CPU, 32GB DDR4 ECC memory, and 512GB NVMe SSD storage to meet the load requirements of chaincode execution, consensus computation, and ledger storage. The Orderer service cluster deploys four ordering nodes with a 4-core CPU, 16GB memory, and RAID10 SAS storage configuration to ensure high system availability. The CA certification center is independently deployed in the Hardware Security Module (HSM) environment to store root certificates and issue node certificates. Nodes are connected via dedicated lines or VPNs to ensure secure network communication with a network bandwidth of at least 1Gbps. During system initialization, the following configurations are completed: generating the genesis block, defining the initial configuration of the consortium blockchain, including information on each organization and consensus mechanism parameters; creating a unified clinical trial data storage channel, with all participating nodes joining the same channel and sharing the storage ledger; and deploying the storage management contract, access control contract, audit trail contract, and lifecycle management contract to each Peer node in chaincode form.

[0028] The consensus mechanism unit employs the PBFT (Practical Byzantine Fault Tolerance) consensus algorithm. PBFT ensures system consistency even in the presence of malicious nodes through a three-phase protocol (Pre-Prepare, Prepare, Commit). The system is configured with at least four consensus nodes and can tolerate the failure of no more than one-third of the total number of Byzantine nodes.

[0029] (III) Deployment of Data Acquisition Module The multi-source heterogeneous data acquisition and preprocessing module is deployed on the internal servers of each clinical trial institution, and interfaces with the institution's internal Hospital Information System (HIS), Laboratory Information System (LIS), and Electronic Data Capture System (EDC) through the HL7FHIR standard interface. The data acquisition module also supports the CDISC ODM-XML data exchange standard, enabling the acquisition, archiving, and exchange of clinical research data that meets regulatory requirements.

[0030] (iv) Deployment of off-chain storage systems The off-chain distributed storage system adopts an IPFS (InterPlanetary File System) cluster deployment scheme. Each participating institution deploys one IPFS storage node, with each node configured with at least 4 cores and 8GB of memory (upgradable to 8 cores and 16GB for heavy user access), equipped with NVMe SSD storage (random read / write speeds of at least 300MB / s), and a network bandwidth of at least 100Mbps (500Mbps or higher recommended) to achieve multi-replica redundant data storage. The IPFS node opens three core ports: 5001 (API interface), 8080 (HTTP gateway), and 4001 (P2P communication). The cluster uses the IPFS Cluster tool to implement sharded storage, splitting large files into 256MB blocks for distributed storage, reducing the storage pressure on a single node and improving data redundancy.

[0031] (v) Deployment of the key management system The Key Management System (KMS) is independently deployed in a hardware cryptographic machine certified by the State Cryptography Administration, employing the national cryptographic algorithms SM2, SM3, and SM4. The SM2 algorithm is used for asymmetric encryption and digital signatures (256-bit key length), the SM3 algorithm is used to generate 256-bit data hash fingerprints, and the SM4 algorithm is used for symmetric encryption (128-bit block length, 128-bit key length, employing a 32-round non-linear iterative structure). The KMS uniformly generates, distributes, stores, and manages various encryption keys, ensuring key security throughout its entire lifecycle.

[0032] (vi) System Working Principle After the system starts, the multi-source heterogeneous data acquisition and preprocessing module first collects raw trial data from various clinical trial data sources in real time. The collected data undergoes format standardization processing, converting it into a unified data format that conforms to the preset standard format; then, it undergoes de-identification processing to remove information that can directly identify the subjects; finally, it performs data structuring processing to generate a data package with a standardized field structure for evidence storage according to the preset clinical trial data model.

[0033] After the data packet to be stored is transmitted to the data grading encryption and off-chain distributed storage module, the data grading unit divides the data into several security levels according to preset data sensitivity grading rules—setting the subject's identity information, personal medical records, and other private data to the highest confidentiality level; setting the experimental protocol, statistical analysis plan, etc., to the medium confidentiality level; and setting the de-identified experimental results data to the lowest confidentiality level. The multi-level encryption unit calls differentiated encryption strategies according to different security levels: a dual encryption mechanism of SM4 symmetric encryption and SM2 asymmetric encryption is used for the highest confidentiality level data; a single symmetric encryption is used for the medium confidentiality level data; and lightweight encryption is used for the lowest confidentiality level data. After encryption, the off-chain storage unit stores the encrypted data packet in IPFS or a private distributed file system, generates a storage address (CID or file path), and uses the SM3 message digest algorithm to calculate the data hash value of the encrypted data packet.

[0034] Subsequently, the data submitter digitally signs the data hash value using their private key and submits metadata such as storage address, data hash value, encryption algorithm identifier, timestamp, and operator's digital signature to the consortium blockchain network via the evidence storage management contract. After verifying the data format and digital signature, the evidence storage management contract calls the access control contract to verify the submitter's permissions. Upon successful verification, the evidence storage transaction achieves consensus confirmation through the PBFT consensus mechanism, is written to the distributed ledger, and the data is successfully stored on the blockchain. After successful evidence storage, the audit trail contract automatically records this evidence storage operation, and the data ownership confirmation and evidence storage certificate management module generates an electronic evidence storage certificate containing data fingerprint, signature, evidence storage timestamp, and blockchain transaction hash.

[0035] When any participant needs to access a piece of stored data, they initiate a data access request to the system. The access control contract dynamically determines whether to grant access based on the requester's role permissions and the security level identifier of the requested data, using a role permission matrix. After authorization, the system generates a temporary access token, retrieves the encrypted data packet from the off-chain distributed storage system according to the storage address, and uses the corresponding decryption key provided by the key management system to decrypt the data for the authorizing party's use. The entire process is automatically recorded to the distributed ledger by the audit trail contract.

[0036] Any participant or regulatory body can verify the integrity of the stored data through the evidence verification unit: by re-hashing the data to be verified and comparing it with the data fingerprint stored on the chain, it can be quickly determined whether the data has been tampered with. The data traceability and auditing module, based on the blockchain's chain structure and immutability, provides data lineage tracking functionality, recording the complete flow path of each piece of data from collection to archiving. All data operation activities are automatically logged and stored on the chain through the audit trail contract, ensuring the non-repudiation and traceability of the operations.

[0037] The lifecycle management contract in the smart contract automation management module automatically triggers corresponding data storage tasks based on key time nodes preset in the clinical trial protocol (such as the screening period, baseline period, treatment period, and follow-up period), without manual intervention. A closed-loop collaborative mechanism is formed between the storage management contract, access control contract, and audit trail contract: the storage management contract calls the access control contract for permission verification before executing storage, and calls the audit trail contract to record the operation after successful storage; the lifecycle management contract calls the storage management contract to trigger storage tasks according to preset time nodes. The entire process achieves fully automated operation of data storage, access control, operation auditing, and process management.

[0038] Example 2: Data Hierarchical Encryption and Complete Evidence Preservation Process This embodiment uses the evidence storage of a subject's efficacy evaluation data in a Phase III clinical trial of an anti-tumor drug as an example to illustrate the complete process of data collection, preprocessing, hierarchical encryption, off-chain storage and on-chain evidence storage.

[0039] (I) Multi-source heterogeneous data acquisition and preprocessing This trial involved eight clinical trial centers across the country, each using a different data management system. After researchers entered the efficacy assessment data for subject A's third treatment cycle into the EDC system, the multi-source heterogeneous data acquisition and preprocessing module automatically retrieved the data from the EDC system.

[0040] The data standardization unit interfaces with the EDC system via the HL7 FHIR standard interface. Data conforming to the CDISC ODM-XML standard is directly parsed and converted using the ODM format, transforming the raw data into a unified data format conforming to the preset standard. The data anonymization unit anonymizes the subject's privacy information in the unified data format: subject names are replaced with randomly generated subject numbers, and personal identification information such as ID numbers and contact information is irreversibly hashed for anonymization. Specific consultation dates are offset to relative dates (e.g., "Day X"). The anonymized data retains its statistical analysis value while removing directly identifiable information. The data structuring unit structures the anonymized data, generating a data package with a preset field structure according to a preset clinical trial data model (including subject demographic information, baseline indicators, adverse events, concomitant medications, efficacy assessment, etc.). This package includes fields such as subject number, assessment period, assessment date, tumor measurement results, ECOG score, and adverse event records, and adds metadata such as data field identifiers, data version numbers, and generation timestamps to the data package.

[0041] (ii) Data hierarchical encryption The data classification unit divides the preprocessed data into three security levels based on preset data sensitivity classification rules: Level 1 (highest confidentiality level) includes subject identity information, personal medical records, informed consent forms, etc.; Level 2 (medium confidentiality level) includes trial protocols, statistical analysis plans, investigator's manuals, etc.; and Level 3 (lower confidentiality level) includes anonymized trial results data, summary statistical data, etc. The data classification unit marks each data packet with a corresponding security level identifier.

[0042] In this embodiment, the efficacy evaluation data belongs to Level 3 (lower confidentiality level, anonymized test results data). The multi-level encryption unit uses SM4 symmetric encryption to encrypt the data packet (128-bit information block length, 128-bit key length), generating an encrypted data packet, with the encryption algorithm identifier and key ID appended to the data packet header.

[0043] (III) Off-chain storage and fingerprint generation The off-chain storage unit submits encrypted data packets to the IPFS cluster for storage. The storage address generation subunit submits the encrypted data packets to the IPFS cluster. IPFS generates a unique Content Identifier (CID) as the storage address by hashing the file content. The file is automatically split into 256KB data blocks and distributed across the nodes of the cluster. The system is configured with a multi-replica redundancy strategy (default 3 replicas) to ensure high availability and durability of the data. The hash calculation subunit uses the SM3 message digest algorithm to hash the encrypted data packets, generating a 256-bit data hash value as the data fingerprint.

[0044] (iv) On-chain storage of metadata Researchers use their SM2 private key (256 bits) to digitally sign the data hash value, generating an SM2 digital signature containing two components, r and s. The data submitter (a peer node of the researcher's institution) submits metadata such as the data identifier (automatically generated UUID), data hash value (SM3 hash), storage address (IPFS CID), encryption algorithm identifier (SM4), timestamp (current blockchain time), and operator digital signature (SM2 signature) to the evidence management contract.

[0045] After verifying the data format and digital signature, the evidence management contract calls the access control contract to verify the submitter's permissions. Upon successful verification, the evidence transaction is written to the distributed ledger via PBFT consensus, generating a blockchain transaction hash. The audit trail contract automatically records this evidence storage operation. The evidence certificate generation unit combines the data fingerprint, signature data, evidence storage timestamp, and blockchain transaction hash to generate an electronic evidence certificate containing a QR code, which is then returned to the researcher.

[0046] Example 3: Data Access, Traceability, and Auditing This embodiment uses the example of a drug regulatory agency verifying and accessing the aforementioned stored data to illustrate in detail the complete process of data access control, decryption verification, traceability auditing, and anomaly detection.

[0047] (a) Fine-grained access control and data decryption When a drug regulatory agency needs to verify the efficacy evaluation data of subject A, the regulatory personnel initiate a data access request to the system through the regulatory agency node, along with proof of the target data.

[0048] After receiving a data access request, the access control contract uses the role permission matrix unit to query the regulatory agency's access permissions for Level 3 data (the regulatory agency has read permissions for all levels of data); the data level matching unit matches the corresponding access policy based on the data's security level identifier (Level 3) (Level 3 data can be opened to all researchers after de-identification, and the regulatory agency naturally has access permissions); the dynamic authorization unit dynamically determines and grants access permissions based on the requester's role (regulatory agency) and the security level (Level 3) of the requested data, and generates a temporary access token (valid for 24 hours).

[0049] The system retrieves encrypted data from IPFS based on the storage address (CID), and the key management system provides the corresponding SM4 decryption key based on the key ID. Supervisors then obtain the decrypted original data. The audit trail contract automatically records this access behavior, including the operator's identity (digital certificate identifier of the regulatory agency node), operation type (access), operation object (data ID), operation time (blockchain timestamp), and operation result (success), and writes this information to the distributed ledger.

[0050] (ii) Data integrity verification and traceability Regulatory personnel verify the integrity of the acquired data through the evidence verification unit: the original data is re-hashd with SM3 and compared with the data fingerprint stored on the chain to confirm that the data has not been tampered with.

[0051] The data tracing and auditing module provides a complete data lineage graph through the data lineage tracking unit. Presented in the form of a directed acyclic graph (DAG), it shows the complete flow path of data from EDC collection, standardization, desensitization, structuring, hierarchical classification, encryption, storage, to on-chain notarization and the current access. Each node and edge is marked with a timestamp and operator information, enabling auditors to clearly trace the complete lifecycle of the data. The audit report generation unit extracts operation logs from the distributed ledger and smart contracts according to regulatory requirements, automatically generating audit reports that comply with the Good Clinical Practice for Drug Clinical Trials (ICH-GCP E6(R2)), FDA 21CFR Part 11, and relevant regulations of the China NMPA. The reports include a data notarization list (notarization time, submitter, and data fingerprint of all on-chain data), data access logs (time, requester, access scope, and authorization result of all data access requests), data modification records (time, applicant, modification content, and approval result of all data modification applications), and a summary of abnormal operations.

[0052] (III) Anomaly Detection and Early Warning The anomaly detection and early warning unit monitors data access and operation behavior in real time, detecting abnormal operations based on preset anomaly behavior rules. These preset rules include: unauthorized access (access requests denied by the access control contract), high-frequency access (more than 50 accesses by the same user within one hour), access outside of working hours (batch access to data between 00:00 and 06:00), batch download (downloading more than 100 data files in a single session), and abnormal privilege escalation (unauthorized changes to user privilege levels). When an abnormal operation is detected, the system automatically triggers an early warning, notifying the system administrator and security officer via email, SMS, etc., and recording the abnormal event in the audit trail contract.

[0053] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A blockchain-based secure data storage system for drug clinical trials, characterized in that: include: The multi-source heterogeneous data acquisition and preprocessing module is used to acquire multi-source heterogeneous data generated during drug clinical trials and perform data preprocessing. The data hierarchical encryption and off-chain distributed storage module is used to receive the preprocessed data output by the acquisition and preprocessing module, perform hierarchical encryption according to the security level of the data, and store the encrypted data in the off-chain distributed storage system, while generating the storage address and the hash value of the encrypted data. The consortium blockchain network module is used to build a consortium blockchain network jointly maintained by all participants in drug clinical trials. The network maintains a distributed ledger, which is used to store digitally signed data fingerprints, metadata, and operation logs. The smart contract automated management module is deployed in the consortium blockchain network module and is used to automate the data storage process through smart contracts, including data storage, permission verification, operation auditing and lifecycle control. The data ownership confirmation and evidence management module is used to generate a unique electronic evidence certificate for each piece of data based on the evidence records on the consortium blockchain network, and to provide data integrity verification function. The data tracing and auditing module is used to read the operation logs recorded by the distributed ledger and the smart contract to perform full-process tracing and compliance auditing of clinical trial data. The output of the acquisition and preprocessing module is connected to the input of the hierarchical encryption and off-chain storage module; the hierarchical encryption and off-chain storage module submits the storage address and hash value as metadata to the consortium blockchain network module for on-chain notarization; the data ownership confirmation and notarization certificate management module obtains notarization transaction records from the consortium blockchain network module to generate electronic notarization certificates; the data traceability and auditing module reads the notarization transaction records stored in the distributed ledger and the operation logs recorded by the smart contract for traceability and auditing.

2. The blockchain-based drug clinical trial data security storage system according to claim 1, characterized in that: The multi-source heterogeneous data acquisition and preprocessing module includes: Data standardization units are used to convert raw experimental data of different formats from different data sources into a unified data format that conforms to a preset standard format; The data desensitization unit is used to desensitize the subject privacy information in the unified data format and generate desensitized data; The data structuring unit is used to perform data structuring processing on the de-identified data to generate a data packet to be stored with a preset field structure.

3. The blockchain-based drug clinical trial data security storage system according to claim 1, characterized in that: The data hierarchical encryption and off-chain distributed storage module includes: The data classification unit is used to divide the preprocessed data into multiple security levels according to the preset data sensitivity classification rules, and to mark each data packet with a corresponding security level identifier. A multi-level encryption unit is used to receive data with security level identifiers output by the data classification unit, and to call different encryption strategies for different security levels to encrypt the data and generate encrypted data packets. An off-chain storage unit is used to store the encrypted data packet in an off-chain distributed storage system, generate a storage address, and calculate the data hash value of the encrypted data packet.

4. The blockchain-based drug clinical trial data security storage system according to claim 3, characterized in that: The off-chain storage unit includes: The storage address generation subunit is used to generate the corresponding content identifier or file path as the storage address after storing the encrypted data packet to IPFS or a private distributed file system. The hash calculation subunit is used to perform hash calculations on encrypted data packets using a message digest algorithm to generate data hash values; The storage address and the data hash value serve as metadata for on-chain storage by the consortium blockchain network module.

5. A blockchain-based secure data storage system for drug clinical trials according to claim 1, characterized in that: The consortium blockchain network module includes: The node management unit is used to register, authenticate, and assign permissions to nodes that join the consortium blockchain network. These nodes include clinical trial institution nodes, sponsor nodes, contract research organization nodes, data monitoring committee nodes, and drug regulatory agency nodes. The consensus mechanism unit is used to run a consensus algorithm among the nodes of the consortium blockchain network to reach a consensus confirmation on the submitted transactions. A distributed ledger unit is used to store blockchain ledger data. Each notarized transaction record in the ledger data includes a data identifier, a data hash value, a storage address, a timestamp, and an operator's digital signature.

6. The blockchain-based drug clinical trial data security storage system according to claim 1, characterized in that: The smart contract automated management module includes: The data storage management contract is used to define the process and rules for data storage, verify the data format, digital signature and submission permission, and submit the data metadata to the consortium blockchain network for storage after the verification is passed. Access control contracts are used to verify and authorize data access requests based on a predefined role permission table and data level identifiers. An audit trail contract is used to record operation logs of all data operation activities and write the operation logs into the distributed ledger; Lifecycle management contracts are used to automatically trigger corresponding data storage tasks based on key time points preset in the clinical trial protocol. When performing evidence storage, the evidence storage management contract calls the access control contract to perform permission verification and calls the audit trail contract to record the evidence storage operation; the lifecycle management contract calls the evidence storage management contract to trigger the evidence storage task according to a preset time node.

7. A blockchain-based secure data storage system for drug clinical trials according to claim 6, characterized in that: The access control contract includes: The role permission matrix unit is used to store the access permission mapping relationship of different roles to various types of data; The data level matching unit is used to match the corresponding access policy based on the data's security level identifier. The dynamic authorization unit is used to dynamically determine whether to grant access permissions based on the requester's role and the security level of the requested data when a data access request is received, and to generate a temporary access token after authorization.

8. The blockchain-based drug clinical trial data security storage system according to claim 1, characterized in that: The data ownership confirmation and evidence management module includes: The data fingerprint generation unit is used to perform hash operations on the original data packet using a message digest algorithm to generate a unique data fingerprint; A digital signature unit is used by the data submitter to digitally sign the data fingerprint using their private key, thereby generating signature data. The evidence storage certificate generation unit is used to combine the data fingerprint, signature data, evidence storage timestamp and corresponding blockchain transaction hash to generate an electronic evidence storage certificate. The evidence verification unit is used to receive the data packet to be verified, perform a hash operation on the data packet to be verified to generate a verification hash value, compare the verification hash value with the data fingerprint in the electronic evidence certificate, and output the verification result.

9. A blockchain-based secure data storage system for drug clinical trials according to claim 8, characterized in that: The electronic evidence certificate includes QR code information, which encodes the serial number of the evidence certificate, the blockchain transaction hash, and the data fingerprint.

10. A blockchain-based secure data storage system for drug clinical trials according to claim 1, characterized in that: The data tracing and auditing module includes: The data lineage tracking unit is used to record the complete flow path of each clinical trial data from collection, preprocessing, encrypted storage, on-chain evidence storage to access and modification, and generate a data lineage map; An audit report generation unit is used to extract operation logs from the distributed ledger and the smart contract according to regulatory requirements, and generate an audit report that complies with the Good Clinical Practice for Drug Clinical Trials. The anomaly detection and early warning unit is used to monitor data access and operation behavior in real time, detect abnormal operations according to preset abnormal behavior rules, and trigger an early warning when an anomaly is detected.

Images